@nacre.work/api 0.5.2 → 0.5.5

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAeL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEb,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEpG,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjH,OAAO,KAAK,EAAE,KAAK,EAAU,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAoC,KAAK,MAAM,EAAkB,KAAK,KAAK,EAAiB,MAAM,iBAAiB,CAAA;AAS1H,OAAO,EAAY,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACtE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7F;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC,CAAA;IACpG,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5F;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IACtE,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC7E,uEAAuE;IACvE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,aAAa,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC1E,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACvE,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,YAAY,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC1E;AAED;;;;;;;;GAQG;AACH,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACjF,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IACxF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,GACjE,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;IAC7C,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAkpBD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAuBrD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EA0BL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEb,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEpG,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjH,OAAO,KAAK,EAAE,KAAK,EAAU,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC5G,OAAO,EAAoC,KAAK,MAAM,EAAkB,KAAK,KAAK,EAAiB,MAAM,iBAAiB,CAAA;AAS1H,OAAO,EAAY,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACtE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7F;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC,CAAA;IACpG,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5F;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IACtE,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC7E,uEAAuE;IACvE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,aAAa,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC1E,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACvE,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,YAAY,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC1E;AAED;;;;;;;;GAQG;AACH,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACjF,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IACxF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,GACjE,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;CACzF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAA;IAC1C,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;;OAMG;IACH,IAAI,CAAC,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjH;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;IAC7C,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAgqBD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAuBrD"}

package/dist/server.js

@@ -3,7 +3,7 @@ import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 // Imported rather than taken from the global scope: `lib` is ES2023 with no
 // DOM, so the global URL is not typed here.
 import { URL } from 'node:url';
-import { logger, MetadataError, MultipartError, multipartBoundary, parseMultipart, queryAudit, parseFilters, parseMetadata, PROTECTED_RESOURCE_PATH, JWKS_PATH, ADMIN_PREFIX, adminRoutes, withAuditSinks, TooBusy, } from '@nacre.work/core';
+import { logger, MetadataError, MultipartError, multipartBoundary, parseMultipart, queryAudit, parseFilters, parseMetadata, PROTECTED_RESOURCE_PATH, JWKS_PATH, AUTHORIZATION_SERVER_PATH, AUTHORIZE_PATH, CODE_TTL_MS, REGISTER_PATH, TOKEN_PATH, authorizationServerMetadata, consentRedirect, generateClientId, generateCode, redirectAllowed, verifierMatches, ADMIN_PREFIX, adminRoutes, withAuditSinks, TooBusy, } from '@nacre.work/core';
 import { authenticate, rejectTenantOverride } from './auth.js';
 import { badRequest, internal, notFound, Problem } from './errors.js';
 import { isConflict, isReplay } from './idempotency.js';
@@ -54,6 +54,10 @@ function accountJson(a) {
         created_at: a.createdAt,
         last_used_at: a.lastUsedAt,
         revoked_at: a.revokedAt,
+        // Null on everything created before the column, and on anything `init`
+        // made. "My agents" filters on it; a guessed owner would be worse than
+        // none.
+        created_by: a.createdBy ?? null,
     };
 }
 function userJson(u) {
@@ -165,6 +169,15 @@ async function readRaw(req, limit) {
     }
     return Buffer.concat(chunks);
 }
+/**
+ * The body as text, for the one endpoint whose media type is not JSON.
+ *
+ * RFC 6749 specifies `application/x-www-form-urlencoded` at the token endpoint,
+ * so it has to see the bytes rather than a parsed object.
+ */
+async function readRawBody(req, limit = MAX_BODY_BYTES) {
+    return (await readRaw(req, limit)).toString('utf8');
+}
 async function readBody(req, limit = MAX_BODY_BYTES) {
     const raw = await readRaw(req, limit);
     if (raw.length === 0)
@@ -678,6 +691,23 @@ async function handle(req, res, options) {
         send(res, 200, options.resourceMetadata, requestId);
         return;
     }
+    /**
+     * RFC 8414 — where a client finds the two endpoints.
+     *
+     * Served only when this deployment runs the authorization server. Absent, the
+     * discovery below still answers and simply names no `authorization_servers`,
+     * which is the resource-server-only shape this product had before and still
+     * supports: a deployment with its own identity provider names that instead.
+     */
+    if (req.method === 'GET' && instance === AUTHORIZATION_SERVER_PATH) {
+        if (options.oauth === undefined) {
+            const problem = notFound(instance, requestId);
+            send(res, problem.status, problem.toJSON(), requestId);
+            return;
+        }
+        send(res, 200, authorizationServerMetadata(options.oauth.issuer), requestId);
+        return;
+    }
     if (req.method === 'GET' && instance === JWKS_PATH) {
         // The public half of the signing key, so anything outside this process can
         // verify a token without a secret — a gateway, a sidecar, a second service
@@ -760,6 +790,234 @@ async function handle(req, res, options) {
     // rather than an omission: they are inside the authenticated surface, where
     // presenting a credential is the price of being told anything. Nothing is
     // concealed by it — every route this API serves is in docs/openapi.yaml.
+    // ─────────────────────── the authorization server ───────────────────────
+    //
+    // Three endpoints, and one decision running through all of them: the token
+    // this flow issues acts as a **service account**, never as the person who
+    // signed in. A consent screen that hands an agent your authority collapses
+    // "what may this agent read" into "what may you read", which is the
+    // distinction this whole product is built on.
+    //
+    // Unauthenticated by necessity — a client arrives here with no credential,
+    // which is what it came to get. Authority is created at exactly one point:
+    // `POST /v1/oauth/consent`, which is inside the authenticated surface and is
+    // where a signed-in person picks the agent.
+    if (options.oauth !== undefined && (instance === REGISTER_PATH || instance === AUTHORIZE_PATH || instance === TOKEN_PATH)) {
+        const oauth = options.oauth;
+        // RFC 7591. Open, which is what an MCP client expects and what the RFC is
+        // for; the exposure is bounded by the fact that a client row permits
+        // nothing at all. It becomes authority only when somebody signs in and
+        // approves it, and the consent screen shows the redirect URI beside the
+        // self-asserted name, because the URI is what actually decides where a code
+        // goes.
+        if (instance === REGISTER_PATH) {
+            if (req.method !== 'POST') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            // Read here rather than by the shared parse below: this endpoint sits
+            // ahead of the authenticated surface, which is where that happens.
+            let posted;
+            try {
+                posted = await readBody(req);
+            }
+            catch {
+                send(res, 400, { error: 'invalid_request', error_description: 'The request body could not be read.' }, requestId);
+                return;
+            }
+            const registration = (posted ?? {});
+            const uris = Array.isArray(registration.redirect_uris)
+                ? registration.redirect_uris.filter((u) => typeof u === 'string')
+                : [];
+            if (uris.length === 0) {
+                send(res, 400, { error: 'invalid_redirect_uri', error_description: "'redirect_uris' is required." }, requestId);
+                return;
+            }
+            // Checked at registration as well as at authorize. A URI that could never
+            // receive a code is better refused now, when there is somebody to tell,
+            // than at the redirect, when the failure is a blank browser tab.
+            if (!uris.every((u) => redirectAllowed(u, uris))) {
+                send(res, 400, {
+                    error: 'invalid_redirect_uri',
+                    error_description: 'Every redirect URI must be https, or http on loopback (127.0.0.1, [::1], localhost).',
+                }, requestId);
+                return;
+            }
+            const name = typeof registration.client_name === 'string' ? registration.client_name.slice(0, 200) : 'unnamed client';
+            const clientId = generateClientId();
+            await oauth.clients.register(name, uris, clientId);
+            // 201 and the RFC's field names. No secret: this is a public client and
+            // PKCE is what binds the exchange, so issuing one would be theatre.
+            send(res, 201, { client_id: clientId, client_name: name, redirect_uris: uris, token_endpoint_auth_method: 'none' }, requestId);
+            return;
+        }
+        // The authorize endpoint hands the browser to the consent screen and does
+        // nothing else. Nothing is written here: an unapproved authorization
+        // request is a set of query parameters the browser is already carrying, and
+        // storing it would add a table any unauthenticated caller could fill.
+        if (instance === AUTHORIZE_PATH) {
+            if (req.method !== 'GET') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const q = url.searchParams;
+            const clientId = q.get('client_id') ?? '';
+            const redirectUri = q.get('redirect_uri') ?? '';
+            const client = clientId === '' ? undefined : await oauth.clients.find(clientId);
+            // These two are the only errors that must **not** redirect. RFC 6749 is
+            // explicit and the reason is worth stating: an unvalidated redirect URI
+            // is exactly what an attacker supplies, so bouncing an error to it would
+            // make this endpoint an open redirector.
+            if (client === undefined) {
+                send(res, 400, { error: 'invalid_client', error_description: 'Unknown client_id.' }, requestId);
+                return;
+            }
+            if (!redirectAllowed(redirectUri, client.redirectUris)) {
+                send(res, 400, { error: 'invalid_redirect_uri', error_description: 'redirect_uri does not match a registered value.' }, requestId);
+                return;
+            }
+            const challenge = q.get('code_challenge') ?? '';
+            const method = q.get('code_challenge_method') ?? '';
+            const back = (error, description) => {
+                const to = new URL(redirectUri);
+                to.searchParams.set('error', error);
+                to.searchParams.set('error_description', description);
+                const state = q.get('state');
+                if (state !== null)
+                    to.searchParams.set('state', state);
+                res.writeHead(302, { location: to.toString() });
+                res.end();
+            };
+            if (q.get('response_type') !== 'code') {
+                back('unsupported_response_type', 'Only the authorization code flow is supported.');
+                return;
+            }
+            // S256 only. `plain` is in RFC 7636 and defeats it — the verifier travels
+            // in the clear, so anybody holding the code holds the challenge too.
+            if (method !== 'S256' || challenge === '') {
+                back('invalid_request', 'PKCE with code_challenge_method=S256 is required.');
+                return;
+            }
+            // Straight to the consent screen. `consentRedirect` carries the rule that
+            // the fragment is a route and the request is appended to it — see the
+            // note there for what assigning it outright did.
+            res.writeHead(302, { location: consentRedirect(oauth.consentUrl, q) });
+            res.end();
+            return;
+        }
+        // The exchange. A code, a verifier, and the redirect URI it was issued for.
+        if (instance === TOKEN_PATH) {
+            if (req.method !== 'POST') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            // `application/x-www-form-urlencoded` is what RFC 6749 specifies and what
+            // every client sends; JSON is accepted too because some send that and
+            // refusing it would be a conformance point nobody benefits from.
+            let form;
+            try {
+                const raw = await readRawBody(req);
+                form =
+                    (req.headers['content-type'] ?? '').includes('json')
+                        ? (JSON.parse(raw) ?? {})
+                        : Object.fromEntries(new URLSearchParams(raw));
+            }
+            catch {
+                send(res, 400, { error: 'invalid_request', error_description: 'The request body could not be read.' }, requestId);
+                return;
+            }
+            const fail = (error, description) => {
+                send(res, 400, { error, error_description: description }, requestId);
+            };
+            // The refresh grant, which is what makes a connection endable. An access
+            // token is a JWT verified against a key, so nothing can take one back
+            // before it expires; the refresh token is stored, and revoking the
+            // connection deletes it. The access token then outlives a revocation by
+            // at most its own TTL, which is bounded and stated rather than forever.
+            if (form.grant_type === 'refresh_token') {
+                const presented = typeof form.refresh_token === 'string' ? form.refresh_token : '';
+                if (presented === '') {
+                    fail('invalid_request', "'refresh_token' is required.");
+                    return;
+                }
+                const rotated = await oauth.refreshTokens.rotate(presented);
+                if (rotated === undefined) {
+                    // One answer for expired, revoked, unknown and replayed. A client can
+                    // act on exactly one thing — start the flow again — and telling them
+                    // apart would say whether a token ever existed.
+                    fail('invalid_grant', 'The refresh token is unknown, expired, already used, or the connection was ended.');
+                    return;
+                }
+                const next = generateCode();
+                await oauth.refreshTokens.issue(rotated.orgId, rotated.consentId, next, rotated.family, new Date(Date.now() + oauth.refreshTtlSeconds * 1000));
+                const issued = await oauth.mint(rotated);
+                send(res, 200, {
+                    access_token: issued.accessToken,
+                    token_type: 'Bearer',
+                    expires_in: issued.expiresIn,
+                    refresh_token: next,
+                }, requestId, { 'cache-control': 'no-store', pragma: 'no-cache' });
+                return;
+            }
+            if (form.grant_type !== 'authorization_code') {
+                fail('unsupported_grant_type', 'Only authorization_code and refresh_token are supported.');
+                return;
+            }
+            const code = typeof form.code === 'string' ? form.code : '';
+            const verifier = typeof form.code_verifier === 'string' ? form.code_verifier : '';
+            if (code === '' || verifier === '') {
+                fail('invalid_request', "'code' and 'code_verifier' are required.");
+                return;
+            }
+            // Consumed here whether or not the checks below pass, and deliberately:
+            // a code presented with a wrong verifier is a code that has been in the
+            // wrong hands, and the safe response is to spend it.
+            const approved = await oauth.authorizations.redeem(code);
+            if (approved === undefined) {
+                fail('invalid_grant', 'The code is unknown, expired, or already used.');
+                return;
+            }
+            if (!verifierMatches(verifier, approved.codeChallenge)) {
+                fail('invalid_grant', 'The code_verifier does not match the challenge.');
+                return;
+            }
+            if (typeof form.client_id === 'string' && form.client_id !== approved.clientId) {
+                fail('invalid_grant', 'The code was issued to another client.');
+                return;
+            }
+            if (typeof form.redirect_uri === 'string' && form.redirect_uri !== approved.redirectUri) {
+                fail('invalid_grant', 'The redirect_uri does not match the one the code was issued for.');
+                return;
+            }
+            const token = await oauth.mint(approved);
+            // A refresh token, hung on the standing connection. Without one the
+            // client's access simply stops at the TTL and it has to send somebody
+            // back through consent — and, more to the point, there would be nothing
+            // to revoke when they end the connection.
+            //
+            // Absent for a code from before consents existed: those rows carry no
+            // connection, and issuing a refresh token against nothing would create
+            // access with no record and no way to end it.
+            let refresh;
+            if (approved.consentId !== undefined) {
+                refresh = generateCode();
+                await oauth.refreshTokens.issue(approved.orgId, approved.consentId, refresh, undefined, new Date(Date.now() + oauth.refreshTtlSeconds * 1000));
+            }
+            // `no-store`, which RFC 6749 requires of this response and which matters
+            // more here than usual: the body is a bearer token and a caching proxy
+            // that keeps it hands it to whoever asks next.
+            send(res, 200, {
+                access_token: token.accessToken,
+                token_type: 'Bearer',
+                expires_in: token.expiresIn,
+                ...(refresh === undefined ? {} : { refresh_token: refresh }),
+            }, requestId, { 'cache-control': 'no-store', pragma: 'no-cache' });
+            return;
+        }
+    }
     if (!instance.startsWith('/v1/')) {
         const problem = notFound(instance, requestId);
         send(res, problem.status, problem.toJSON(), requestId);
@@ -1343,6 +1601,47 @@ async function handle(req, res, options) {
             }, requestId);
             return;
         }
+        /**
+         * Who the caller is — and nothing about anyone else.
+         *
+         * There was no way to ask. The admin UI signed in, got a pair of tokens,
+         * and had no idea whether the person holding them was an `org_admin` or a
+         * `member` — so it drew every screen and every button for everybody. A
+         * member then pressed "New user" and got a `404`, because invariant 4 makes
+         * a refusal indistinguishable from a missing object. That is right for the
+         * API and unusable as a product: to the person it reads as a broken
+         * application rather than as a permission they do not hold.
+         *
+         * Telling a caller their own role is not a leak and is not in tension with
+         * invariant 4. Rule 4 is about *objects* being invisible; this discloses
+         * nothing except what the presented token already asserts, which the caller
+         * necessarily has. Nothing here can name another principal.
+         *
+         * A service account gets an answer too, which the "sign in as an agent to
+         * see what it sees" flow needs: the UI accepts a `nacre_sk_` key and could
+         * not previously say which account it belonged to.
+         */
+        if (instance === '/v1/me') {
+            // 404 for another method, the same as every other path here: invariant 4
+            // reserves the distinction for objects, and a 405 on a path that answers
+            // one verb tells a caller nothing they can act on.
+            if (req.method !== 'GET') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            // Composed from the token and nothing else — no query, so this cannot
+            // grow a way to name somebody else. `organization` is included because a
+            // UI showing "you are an administrator" has to say of what, and it is the
+            // same value invariant 1 already took from the token.
+            send(res, 200, {
+                organization: auth.orgId,
+                principal_type: auth.principal.type,
+                principal_id: auth.principal.id,
+                role: auth.role,
+            }, requestId);
+            return;
+        }
         if (instance === '/v1/workspaces' && options.workspaces !== undefined) {
             if (req.method === 'GET') {
                 const page = readPage(url.searchParams, instance, requestId);
@@ -1924,6 +2223,183 @@ async function handle(req, res, options) {
             res.end(format === 'ndjson' ? toNdjson(items) : toCsv(items));
             return;
         }
+        /**
+         * The one point in the OAuth flow where authority is created.
+         *
+         * Everything before it — registration, the authorize redirect — is a
+         * conversation with an unauthenticated caller and grants nothing. This is
+         * inside the authenticated surface because it has to be: a signed-in person
+         * is choosing which **agent** the client will act as.
+         *
+         * The token that comes out acts as that service account and never as the
+         * person. That is the design and not an implementation detail: an agent
+         * holding your authority answers "what may this agent read" with "whatever
+         * you may read", which is the question the whole permission model exists to
+         * ask separately.
+         *
+         * The service account must already exist and the caller must be able to see
+         * it. Creating one, and granting it anything, goes through the endpoints
+         * that already exist and already check — this deliberately adds no second
+         * path to either, because a second path is how the guarded one gets walked
+         * around.
+         */
+        /**
+         * The connections this caller may see, and ending one.
+         *
+         * "Forget this application" is the whole point, and it is why 0024 exists:
+         * before it there was a record of an authorization *code* — ninety seconds
+         * long and consumed — and nothing of the connection that outlived it. So
+         * nothing could list what was connected, and nothing could stop it.
+         *
+         * Ending one deletes its refresh tokens in the same transaction. The access
+         * token already issued is a JWT verified against a key, so it keeps working
+         * until it expires — at most `NACRE_ACCESS_TOKEN_TTL`. That window is real
+         * and is stated in the response rather than papered over: the alternative
+         * is a denylist consulted on every request, which would make local
+         * verification not local.
+         */
+        if (instance === '/v1/oauth/consents' && options.oauth !== undefined) {
+            if (req.method !== 'GET') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const items = await options.oauth.consents.list(auth);
+            send(res, 200, {
+                items: items.map((c) => ({
+                    id: c.id,
+                    client_id: c.clientId,
+                    client_name: c.clientName,
+                    service_account_id: c.serviceAccountId,
+                    service_account_name: c.serviceAccountName,
+                    approved_by: c.approvedBy,
+                    created_at: c.createdAt,
+                    last_refreshed_at: c.lastRefreshedAt,
+                    revoked_at: c.revokedAt,
+                })),
+                // Not a field a caller has to compute from configuration they cannot
+                // see. It is how long an already-issued access token can still work
+                // after a connection is ended, and a screen that says "ended" without
+                // it would be overstating what just happened.
+                access_token_ttl_seconds: options.oauth.accessTtlSeconds,
+            }, requestId);
+            return;
+        }
+        if (instance.startsWith('/v1/oauth/consents/') && options.oauth !== undefined) {
+            const id = instance.slice('/v1/oauth/consents/'.length);
+            if (req.method !== 'DELETE') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const ended = await options.oauth.consents.revoke(auth, id);
+            if (!ended) {
+                // One they cannot see, one that does not exist, and one already ended
+                // are the same answer.
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            await options.audit?.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'oauth.revoke',
+                result: 'allow',
+                detail: { consent_id: id },
+                requestId,
+            });
+            send(res, 200, { ended: true, access_token_ttl_seconds: options.oauth.accessTtlSeconds }, requestId);
+            return;
+        }
+        if (instance === '/v1/oauth/consent' && options.oauth !== undefined) {
+            if (req.method !== 'POST') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            // A service account cannot consent on behalf of anybody: the flow exists
+            // so a *person* decides what an agent gets, and an agent approving its
+            // own successor is that decision made by the thing it is about.
+            if (auth.principal.type !== 'user') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const consent = (body ?? {});
+            const need = (field) => typeof consent[field] === 'string' && consent[field] !== '' ? consent[field] : undefined;
+            const clientId = need('client_id');
+            const redirectUri = need('redirect_uri');
+            const codeChallenge = need('code_challenge');
+            const serviceAccountId = need('service_account_id');
+            if (clientId === undefined || redirectUri === undefined || codeChallenge === undefined || serviceAccountId === undefined) {
+                const problem = badRequest(instance, requestId, "'client_id', 'redirect_uri', 'code_challenge' and 'service_account_id' are required.");
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            // Re-checked here rather than trusted from the browser. Everything in
+            // this body came back through a redirect the caller controls, so the
+            // client and its redirect URI are verified against the registration
+            // again — the authorize endpoint's check protected the redirect, and this
+            // one protects the code.
+            const client = await options.oauth.clients.find(clientId);
+            if (client === undefined || !redirectAllowed(redirectUri, client.redirectUris)) {
+                const problem = badRequest(instance, requestId, 'Unknown client, or a redirect_uri it did not register.');
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            // The agent has to be one this caller can see, which is what makes the
+            // consent theirs to give. `404` for anything else, because an agent they
+            // cannot see and one that does not exist are the same answer here as
+            // everywhere.
+            const visible = options.serviceAccounts === undefined
+                ? undefined
+                : (await options.serviceAccounts.list(auth, { limit: 200, after: undefined })).items.find((a) => a.id === serviceAccountId);
+            if (visible === undefined) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            // The standing connection first, then the code that points at it. That
+            // order matters: the code is exchanged for a refresh token hung on the
+            // connection, and a code with no connection would mint access nobody can
+            // ever take back — which is the gap this closes.
+            const consentId = await options.oauth.consents.record(auth, clientId, serviceAccountId);
+            const code = generateCode();
+            await options.oauth.authorizations.approve(auth, {
+                orgId: auth.orgId,
+                serviceAccountId,
+                clientId,
+                redirectUri,
+                codeChallenge,
+                ...(need('resource') === undefined ? {} : { resource: need('resource') }),
+                code,
+                consentId,
+                expiresAt: new Date(Date.now() + CODE_TTL_MS),
+            });
+            // Recorded, because "why does this agent hold a token" is a question an
+            // administrator will ask and the grant table cannot answer: the grants
+            // were there before, and what changed is that a client was handed the
+            // right to act as this principal.
+            await options.audit?.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'oauth.consent',
+                result: 'allow',
+                detail: { client_id: clientId, client_name: client.clientName, service_account_id: serviceAccountId },
+                requestId,
+            });
+            // The redirect is returned rather than performed: this is an API call
+            // from a page, and the page is what navigates. `state` is echoed
+            // untouched — it is the client's, it is opaque to us, and it is how the
+            // client ties the response back to the request it started.
+            const to = new URL(redirectUri);
+            to.searchParams.set('code', code);
+            const state = need('state');
+            if (state !== undefined)
+                to.searchParams.set('state', state);
+            send(res, 200, { redirect_to: to.toString() }, requestId);
+            return;
+        }
         if (instance === '/v1/service-accounts' && options.serviceAccounts !== undefined) {
             // org_admin, not "admin on some scope". A service account is a principal
             // in the organization rather than an object inside a workspace, and there