@nxgt/janus 0.24.0 → 0.25.0

package/README.md

@@ -410,7 +410,8 @@ else reaches the store and is asynchronous.
 - **Shared**: `authenticate`, `signOut`, `signOutEverywhere(user, { except })`,
   `findUser` and `getUser` across types, `cookie.serialize(token, session)` and
   `cookie.clear()` — `HttpOnly; SameSite=Lax; Secure` unless you say otherwise
-  — and `collectExpired`.
+  — and `collectExpired`, which deletes lapsed sessions and lapsed one-time
+  tokens.
 - **Password guessing is throttled**, on by default: past ten passwords
   tried at one login in a 15-minute window, `signIn` refuses every one — the
   right password included — with `CREDENTIALS_INVALID`, `reason:
@@ -1330,7 +1331,7 @@ describeJanusStores({
 });
 ```
 
-There are 59 cases. They cover:
+There are 61 cases. They cover:
 - round-trip, byte for byte — including every edge character the core lets
   through (control characters, U+FFFF, a surrogate pair);
 - uniqueness, as a constraint: of twenty concurrent inserts of one login,
@@ -1359,12 +1360,15 @@ There are 59 cases. They cover:
   goes, with a replay answering `false` or `0` rather than failing;
 - the optional `users.findUsers`: each stored user once, whatever its type, an
   id nobody holds left out, and `[]` — never `null` — when nobody holds any;
-- **outages**, one case for each of the fifteen methods whose honest answer can
+- the optional `tokens.deleteExpiredTokens`: lapsed tokens deleted, spent or
+  not, and a token one millisecond short of lapsing kept, still spent when it
+  was;
+- **outages**, one case for each of the sixteen methods whose honest answer can
   be "nothing".
 
 **An optional method a store lacks skips its cases, with the reason** — a
-store without `sessions.deleteExpiredSessions` or `users.findUsers` passes the
-suite. A case's `needs` names what it cannot run without, one `CaseNeed` or a list
+store without `sessions.deleteExpiredSessions`, `tokens.deleteExpiredTokens`
+or `users.findUsers` passes the suite. A case's `needs` names what it cannot run without, one `CaseNeed` or a list
 (`outage.findUsers` needs `['faults', 'findUsers']`).
 
 The suite imports no test framework and no assertion library. It runs under
@@ -1661,8 +1665,8 @@ test that tries more than ten wrong passwords at one login over a
 `fixedClock` is throttled too: advance the clock past `retryAfter`, or wire
 `signIn: { throttle: false }`. **Somebody who knows a login can keep its
 password sign-in shut**, ten tries a window; a sign-in code or link, when you wire them, still opens it — the throttle counts passwords, never those.
-On PostgreSQL, delete lapsed tokens on a schedule: every login tried adds a
-row per window. One password tried against
+On a store with no TTL (PostgreSQL through `@nxgt/janus-drizzle`), schedule
+`collectExpired()`: every login tried adds a row per window, and it deletes them. One password tried against
 many logins is not counted: rate-limit `signIn` per client address yourself
 ([passwords](docs/guide/passwords.md#what-you-still-limit-yourself)). The
 counts live in the tokens store: a flushed or evicting Redis forgets them,
@@ -1693,11 +1697,21 @@ counted: add a per-IP ceiling with `@nxgt/redis` rate limits
 [example](docs/guide/email-flows.md#requests-that-send-e-mail-are-throttled)). A test suite that requests more than five of
 one flow for one address or user over a `fixedClock` is throttled: advance the
 clock past `retryAfter`, or wire `mail: { throttle: false }`. The counts live
-in the tokens store, so on PostgreSQL schedule the delete of lapsed tokens, a
+in the tokens store, so on a store with no TTL (PostgreSQL through `@nxgt/janus-drizzle`) schedule
+`collectExpired()`, which deletes them; a
 flushed or evicting Redis forgets them, and a tokens store that cannot count
 throws `STORE_FAILED` with nothing issued
 ([e-mail flows](docs/guide/email-flows.md#requests-that-send-e-mail-are-throttled)).
 
+**`collectExpired()` also collects lapsed one-time tokens, and a custom
+tokens store has to implement `deleteExpiredTokens` for it.** Without the
+method, only the sessions are collected — or `UNSUPPORTED`, when the sessions
+store has none either — and the throttles' counts pile up on a database with
+no TTL. Once a lapsed token is collected, its link answers `TOKEN_UNKNOWN`
+instead of `TOKEN_EXPIRED` or `TOKEN_SPENT`: a page that tells the two apart
+should treat the third as "this link is no longer valid"
+([sessions](docs/guide/sessions.md#collectexpired)).
+
 **A sign-in can move a user's `version`.** Rewriting a stale hash is a write. A
 user object read before that sign-in, and then passed as `ifVersion`, gets
 `VERSION_CONFLICT`. That is the conflict doing its job: read the user again.
@@ -1782,13 +1796,13 @@ that sends one, since it is awaited: queue the event and return.
 
 ## Type safety, counted
 
-**One hundred and eighty plausible mistakes, one hundred and eighty refused at compile time — and
+**One hundred and eighty-one plausible mistakes, one hundred and eighty-one refused at compile time — and
 two gaps, named.**
 
 The lists are typechecked and never run, with one `@ts-expect-error` per
 mistake beside the shapes that must keep compiling. One is a single file:
 `test/types/refusals.ts` (fifteen, on the shared vocabulary). The other three
-are folders with one file per behaviour: `test/types/port/` (twenty-five, on
+are folders with one file per behaviour: `test/types/port/` (twenty-six, on
 the identity stores' port, from the point of view of the person implementing
 it), `test/types/auth/` (eighty-eight, on `janus()`, from the point of view of
 the application — twelve of them on the second factor, three on sign-in codes,

package/dist/auth/outage.d.ts

@@ -29,8 +29,8 @@ import type { JanusStores } from './port/types';
  *   Rule 2 of the port, enforced at run time for the JavaScript adapter the
  *   compiler never saw.
  *
- * The optional `deleteExpiredSessions` is guarded when present and left absent
- * when absent, so capability detection still reads the truth.
+ * The optional `deleteExpiredSessions` and `deleteExpiredTokens` are guarded
+ * when present and left absent when absent, so capability detection still reads the truth.
  */
 export declare function guardStores(stores: JanusStores): JanusStores;
 /**

package/dist/auth/port/assert-stores.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assert-stores.d.ts","sourceRoot":"","sources":["../../../src/auth/port/assert-stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAoC9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,CA+BnB"}
+{"version":3,"file":"assert-stores.d.ts","sourceRoot":"","sources":["../../../src/auth/port/assert-stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAoC9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,CAqCnB"}

package/dist/auth/port/memory/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/memory/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,UAAU,CAAC;AAGxD,gDAAgD;AAChD,wBAAgB,gBAAgB,IAAI,UAAU,CAkE7C"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/memory/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,UAAU,CAAC;AAGxD,gDAAgD;AAChD,wBAAgB,gBAAgB,IAAI,UAAU,CA+E7C"}

package/dist/auth/port/types/stores.d.ts

@@ -24,6 +24,8 @@ export interface JanusStores {
 export interface StoreCapabilities {
     /** Whether `sessions.deleteExpiredSessions` is implemented. */
     readonly collectExpired: boolean;
+    /** Whether `tokens.deleteExpiredTokens` is implemented. */
+    readonly collectExpiredTokens: boolean;
     /**
      * Whether `users.findUsers` is implemented: `findMany` answers in one query
      * when it is, and with `findUser`, a few ids at a time, when it is not.

package/dist/auth/port/types/stores.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stores.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/stores.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC5B;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5B"}
+{"version":3,"file":"stores.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/stores.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC5B;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5B"}

package/dist/auth/port/types/tokens.d.ts

@@ -134,5 +134,17 @@ export interface TokenStore {
      * must not outlive the user until its expiry.
      */
     deleteUserTokens(userId: Id): Promise<number>;
+    /**
+     * **Optional capability.** Deletes every token — spent or not, of any kind
+     * and any user — whose `expiresAt` is at or before `before`, and answers how
+     * many. Never one whose `expiresAt` is later, spent or not: a spent token is
+     * kept until it lapses, or a count would start over.
+     *
+     * What collects the sign-in and mail throttles' counts, which are ordinary
+     * tokens under a keyed-hash user id that `deleteUserTokens` never reaches.
+     * A store with its own expiry — a TTL index, a key TTL — does not implement
+     * it; `collectExpired()` reads its presence.
+     */
+    deleteExpiredTokens?(before: Date): Promise<number>;
 }
 //# sourceMappingURL=tokens.d.ts.map

package/dist/auth/port/types/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,SAAS,GAClB,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,aAAa,CAAC;AAEjB,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IAC1B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CACd,MAAM,EAAE,EAAE,EACV,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,SAAS,GAClB,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,aAAa,CAAC;AAEjB,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IAC1B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CACd,MAAM,EAAE,EAAE,EACV,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpD"}

package/dist/auth/sessions/collect-expired.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `collectExpired()`: the lapsed sessions and the lapsed one-time tokens, from
+ * whichever of the two stores implements its collector.
+ */
+import type { Context } from '../context';
+/**
+ * Deletes what has lapsed at `clock.now()` and answers how many in all.
+ *
+ * Sessions first, then tokens, one after the other: both deletions are
+ * idempotent, so a token failure after the sessions went leaves a call that can
+ * simply be repeated. `UNSUPPORTED` only when neither store has a collector.
+ */
+export declare function collectExpired(context: Context): Promise<number>;
+//# sourceMappingURL=collect-expired.d.ts.map

package/dist/auth/sessions/collect-expired.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect-expired.d.ts","sourceRoot":"","sources":["../../../src/auth/sessions/collect-expired.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBtE"}

package/dist/auth/sessions/shared-api.d.ts

@@ -1,7 +1,7 @@
 /**
  * What `janus()` answers whatever its user types: authenticating a request,
  * signing out, finding a user by id, the cookie, and collecting expired
- * sessions.
+ * sessions and one-time tokens.
  */
 import { type AnyUser, type Context } from '../context';
 import type { Authenticated, RequestLike, SharedApi } from '../types';

package/dist/auth/sessions/shared-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared-api.d.ts","sourceRoot":"","sources":["../../../src/auth/sessions/shared-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAKtE,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,GAAG;IAC1E,YAAY,CACX,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;CAC1C,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAqD7D"}
+{"version":3,"file":"shared-api.d.ts","sourceRoot":"","sources":["../../../src/auth/sessions/shared-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAMtE,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,GAAG;IAC1E,YAAY,CACX,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;CAC1C,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CA8C7D"}

package/dist/auth/types/janus.d.ts

@@ -68,9 +68,10 @@ export interface SharedApi<U extends {
         clear(): string;
     };
     /**
-     * Deletes lapsed sessions. `UNSUPPORTED` when the sessions store does not
-     * implement `deleteExpiredSessions` — a store with its own TTL does not need
-     * to.
+     * Deletes lapsed sessions and lapsed one-time tokens — the throttles' counts
+     * included — from the stores that implement `deleteExpiredSessions` /
+     * `deleteExpiredTokens`, and answers how many in all. `UNSUPPORTED` when
+     * neither does — a store with its own TTL does not need to.
      */
     collectExpired(): Promise<number>;
     /** The user type names, in the order they were declared. */

package/dist/auth/types/janus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"janus.d.ts","sourceRoot":"","sources":["../../../src/auth/types/janus.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EACX,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EACX,OAAO,EACP,WAAW,EACX,OAAO,EACP,YAAY,EACZ,MAAM,EACN,UAAU,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,KAAK,YAAY,CAChB,IAAI,SAAS,MAAM,EACnB,GAAG,EACH,SAAS,SAAS,OAAO,IACtB,SAAS,SAAS,IAAI,GACvB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAC/B,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACpC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAEnC;;;GAGG;AACH,MAAM,MAAM,OAAO,CAClB,IAAI,SAAS,MAAM,EACnB,GAAG,EACH,SAAS,SAAS,OAAO,GAAG,KAAK,IAC9B,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GACvD,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,GAC1E,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,SAAS,SAAS,IAAI,GACrB,WAAW,CACX,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,WAAW,CAAC,GAAG,CAAC,EAChB,OAAO,CAAC,GAAG,CAAC,EACZ,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACnC,GACA,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACtC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GACvE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,OAAO,GACP,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GACzD,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,aAAa,CACZ,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAClC,GACD,YAAY,CACX,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAClC,GACD,SAAS,CACR,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,SAAS,SAAS,IAAI,GACnB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAElC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACpC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACvC,CAAC,GACL,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,OAAO,GACP,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9C,iEAAiE;AACjE,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;IAC7D;;;;;;;;;;OAUG;IACH,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,GAC7B,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnE,gGAAgG;IAChG,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD,uEAAuE;IACvE,iBAAiB,CAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC,kEAAkE;IAClE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEhC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QACnD,KAAK,IAAI,MAAM,CAAC;KAChB,CAAC;IAEF;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAElC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,KAAK,WAAW,CAAC,CAAC,IAAI,cAAc,SAAS,MAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC;AAEpE,oCAAoC;AACpC,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAC9D,CAAC,CAAC,SAAS,eAAe,GACvB;IACA,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CACjD,CAAC,EACD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EACb,WAAW,CAAC,CAAC,CAAC,CACd;CACD,GACA,CAAC,SAAS,gBAAgB,GACzB,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAChD,KAAK,CAAC,CAAC"}
+{"version":3,"file":"janus.d.ts","sourceRoot":"","sources":["../../../src/auth/types/janus.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EACX,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EACX,OAAO,EACP,WAAW,EACX,OAAO,EACP,YAAY,EACZ,MAAM,EACN,UAAU,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,KAAK,YAAY,CAChB,IAAI,SAAS,MAAM,EACnB,GAAG,EACH,SAAS,SAAS,OAAO,IACtB,SAAS,SAAS,IAAI,GACvB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAC/B,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACpC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAEnC;;;GAGG;AACH,MAAM,MAAM,OAAO,CAClB,IAAI,SAAS,MAAM,EACnB,GAAG,EACH,SAAS,SAAS,OAAO,GAAG,KAAK,IAC9B,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GACvD,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,GAC1E,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,SAAS,SAAS,IAAI,GACrB,WAAW,CACX,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,WAAW,CAAC,GAAG,CAAC,EAChB,OAAO,CAAC,GAAG,CAAC,EACZ,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACnC,GACA,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACtC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GACvE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,OAAO,GACP,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GACzD,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAC5D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,aAAa,CACZ,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAClC,GACD,YAAY,CACX,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAClC,GACD,SAAS,CACR,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,SAAS,SAAS,IAAI,GACnB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAElC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACpC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACrC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACvC,CAAC,GACL,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,OAAO,GACP,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9C,iEAAiE;AACjE,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;IAC7D;;;;;;;;;;OAUG;IACH,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,GAC7B,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnE,gGAAgG;IAChG,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD,uEAAuE;IACvE,iBAAiB,CAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC,kEAAkE;IAClE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEhC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QACnD,KAAK,IAAI,MAAM,CAAC;KAChB,CAAC;IAEF;;;;;OAKG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAElC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,KAAK,WAAW,CAAC,CAAC,IAAI,cAAc,SAAS,MAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC;AAEpE,oCAAoC;AACpC,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAC9D,CAAC,CAAC,SAAS,eAAe,GACvB;IACA,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CACjD,CAAC,EACD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EACb,WAAW,CAAC,CAAC,CAAC,CACd;CACD,GACA,CAAC,SAAS,gBAAgB,GACzB,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAChD,KAAK,CAAC,CAAC"}

package/dist/chunks/{index-6bjfv4xv.js → index-q3w3vr69.js}

@@ -1,7 +1,7 @@
 import {
   StoreConflict2,
   NotFoundError2
-} from "./index-kppkcbn5.js";
+} from "./index-spwh8b9z.js";
 
 // src/ids/id.ts
 var HEX = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
@@ -175,6 +175,16 @@ function memoryTokenStore() {
         }
       }
       return deleted;
+    },
+    async deleteExpiredTokens(before) {
+      let deleted = 0;
+      for (const [tokenHash, stored] of byTokenHash) {
+        if (stored.expiresAt.getTime() <= before.getTime()) {
+          byTokenHash.delete(tokenHash);
+          deleted += 1;
+        }
+      }
+      return deleted;
     }
   };
 }
@@ -312,5 +322,5 @@ function createMemoryStores2() {
 }
 export { mintId2, isId2, mintedAt2, createMemoryStores2 };
 
-//# debugId=D2F28CB1297A405F64756E2164756E21
-//# sourceMappingURL=index-6bjfv4xv.js.map
+//# debugId=4BEC7DA3378A80BC64756E2164756E21
+//# sourceMappingURL=index-q3w3vr69.js.map

package/dist/chunks/{index-6bjfv4xv.js.map → index-q3w3vr69.js.map}

@@ -5,13 +5,13 @@
     "/**\n * An id — of a user, a session: a UUIDv7, lowercase, hyphenated.\n *\n * **The core mints it, not the store**, and that decision pays for itself three\n * times over:\n *\n *   - A UUIDv7 leads with a 48-bit millisecond timestamp, so ids sort in\n *     creation order as strings. The pagination cursor is therefore *the last\n *     id* — one index on the id, and the ordering is already total. A\n *     store-minted id would need a `createdAt` index plus the id as a tiebreak,\n *     because a timestamp alone is not a total order, and an opaque cursor per\n *     adapter.\n *   - `insertUser` becomes **idempotent under retry**: the id is decided\n *     before the call, so a retry after a timeout writes the same row rather\n *     than a second user.\n *   - Every adapter reports the same shape, so moving an application from one\n *     adapter to another is a copy rather than a rewrite of every stored\n *     reference.\n *\n * The price, stated plainly: an adapter cannot reuse an existing numeric primary\n * key. It gets a `uuid` column, or a 36-character string, and the monotonic\n * prefix gives it the index locality a UUIDv4 destroys.\n */\nexport type Id = string;\n\nconst HEX: readonly string[] = Array.from({ length: 256 }, (_, i) =>\n\ti.toString(16).padStart(2, '0'),\n);\n\nlet lastMs = -1;\nlet sequence = 0;\n\n/**\n * The 12-bit sequence UUIDv7 keeps for ordering inside one millisecond.\n *\n * RFC 9562 calls this the \"replace leftmost random bits with an increased clock\n * precision\" method. Without it, two ids minted in the same millisecond order\n * by their random tail — still a total order, which is all the port requires,\n * but not creation order, and \"newest first\" would then be wrong for anything\n * created in a burst. A signup storm is exactly such a burst.\n */\nconst SEQUENCE_MAX = 0xfff;\n\n/**\n * A fresh id.\n *\n * Strictly increasing: within one millisecond it uses the sequence, and if that\n * overflows — more than 4096 ids in a millisecond, which no real\n * application reaches — it borrows the next millisecond rather than repeating\n * one. Across processes the 62 random bits of the tail are what keep two machines\n * apart.\n */\nexport function mintId(now: number = Date.now()): Id {\n\tlet ms = now;\n\n\tif (ms === lastMs) {\n\t\tsequence += 1;\n\t\tif (sequence > SEQUENCE_MAX) {\n\t\t\t// Borrow from the next millisecond. This keeps ids strictly\n\t\t\t// increasing at the cost of a timestamp a hair ahead of the clock,\n\t\t\t// which is the right trade: a repeated id would break the cursor.\n\t\t\tms = lastMs + 1;\n\t\t\tsequence = 0;\n\t\t}\n\t} else if (ms > lastMs) {\n\t\tsequence = 0;\n\t} else {\n\t\t// The clock went backwards — an NTP step, or a container resumed. Hold\n\t\t// the last millisecond and keep counting, so ids stay ordered even\n\t\t// though they stop matching the wall clock for a moment.\n\t\tms = lastMs;\n\t\tsequence += 1;\n\t\tif (sequence > SEQUENCE_MAX) {\n\t\t\tms = lastMs + 1;\n\t\t\tsequence = 0;\n\t\t}\n\t}\n\n\tlastMs = ms;\n\n\tconst bytes = new Uint8Array(16);\n\tcrypto.getRandomValues(bytes.subarray(8));\n\n\tbytes[0] = (ms / 2 ** 40) & 0xff;\n\tbytes[1] = (ms / 2 ** 32) & 0xff;\n\tbytes[2] = (ms / 2 ** 24) & 0xff;\n\tbytes[3] = (ms / 2 ** 16) & 0xff;\n\tbytes[4] = (ms / 2 ** 8) & 0xff;\n\tbytes[5] = ms & 0xff;\n\t// Version 7 in the high nibble, the sequence's top 4 bits below it.\n\tbytes[6] = 0x70 | ((sequence >> 8) & 0x0f);\n\tbytes[7] = sequence & 0xff;\n\t// Variant 10 in the two high bits of byte 8; the rest of it stays random.\n\tbytes[8] = 0x80 | ((bytes[8] as number) & 0x3f);\n\n\treturn `${HEX[bytes[0] as number]}${HEX[bytes[1] as number]}${HEX[bytes[2] as number]}${HEX[bytes[3] as number]}-${HEX[bytes[4] as number]}${HEX[bytes[5] as number]}-${HEX[bytes[6] as number]}${HEX[bytes[7] as number]}-${HEX[bytes[8] as number]}${HEX[bytes[9] as number]}-${HEX[bytes[10] as number]}${HEX[bytes[11] as number]}${HEX[bytes[12] as number]}${HEX[bytes[13] as number]}${HEX[bytes[14] as number]}${HEX[bytes[15] as number]}`;\n}\n\nconst UUID_V7 =\n\t/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\n\n/**\n * Whether this string is an id this package could have minted.\n *\n * Used by an adapter to answer `null` for a malformed id **without reaching the\n * store**: an id arrives off a URL, and one of the wrong shape is \"no such\n * user\", not an outage and not a query. Rejecting it here also keeps a\n * hand-written id out of a store that would then hold something the cursor\n * cannot order.\n */\nexport function isId(value: string): boolean {\n\treturn UUID_V7.test(value);\n}\n\n/**\n * When this id was minted, from the id itself.\n *\n * Offered because the timestamp is *in* the id, so a `createdAt` column is a\n * convenience rather than the truth — and an adapter that loses one can still\n * answer. It is not a substitute for `createdAt`: the sequence may have borrowed\n * a millisecond, and a clock that stepped backwards is held rather than\n * followed, so this is accurate to the millisecond and no further.\n */\nexport function mintedAt(id: Id): Date {\n\tconst hex = id.replace(/-/g, '').slice(0, 12);\n\treturn new Date(Number.parseInt(hex, 16));\n}\n",
     "/**\n * A deep copy: every record goes in and comes out through it, so a caller that\n * mutates what it passed or what it got back cannot reach the store.\n */\nexport const copy = <T>(value: T): T => structuredClone(value);\n",
     "import type { SessionId, SessionRecord, SessionStore } from '../types';\nimport { copy } from './copy';\n\n/** What the in-memory session store holds: the records, and the index on their token hashes. */\ninterface SessionIndex {\n\treadonly byId: Map<SessionId, SessionRecord>;\n\treadonly byTokenHash: Map<string, SessionId>;\n}\n\n/** The session store in memory. */\nexport function memorySessionStore(): SessionStore {\n\tconst index: SessionIndex = {\n\t\tbyId: new Map<SessionId, SessionRecord>(),\n\t\tbyTokenHash: new Map<string, SessionId>(),\n\t};\n\tconst { byId, byTokenHash } = index;\n\n\treturn {\n\t\tasync insertSession(record) {\n\t\t\tif (byId.has(record.id)) return;\n\n\t\t\tconst written = copy(record);\n\t\t\tbyId.set(written.id, written);\n\t\t\tbyTokenHash.set(written.tokenHash, written.id);\n\t\t},\n\n\t\tasync findSessionByTokenHash(tokenHash) {\n\t\t\tconst id = byTokenHash.get(tokenHash);\n\t\t\tconst stored = id === undefined ? undefined : byId.get(id);\n\t\t\treturn stored === undefined ? null : copy(stored);\n\t\t},\n\n\t\tasync extendSession(id, expiresAt) {\n\t\t\treturn standingWrite(index, id, { expiresAt: new Date(expiresAt) });\n\t\t},\n\n\t\tasync reauthenticateSession(id, at) {\n\t\t\treturn standingWrite(index, id, { authenticatedAt: new Date(at) });\n\t\t},\n\n\t\tasync revokeSession(id, at) {\n\t\t\tconst stored = byId.get(id);\n\t\t\tif (stored === undefined) return false;\n\n\t\t\tif (stored.revokedAt === null) revoke(index, id, stored, at);\n\t\t\treturn true;\n\t\t},\n\n\t\tasync revokeUserSessions(userId, at, except) {\n\t\t\tlet revoked = 0;\n\n\t\t\tfor (const [id, stored] of byId) {\n\t\t\t\tif (\n\t\t\t\t\tstored.userId === userId &&\n\t\t\t\t\tstored.revokedAt === null &&\n\t\t\t\t\tid !== except\n\t\t\t\t) {\n\t\t\t\t\trevoke(index, id, stored, at);\n\t\t\t\t\trevoked += 1;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn revoked;\n\t\t},\n\n\t\tasync deleteUserSessions(userId) {\n\t\t\treturn deleteWhere(index, (stored) => stored.userId === userId);\n\t\t},\n\n\t\tasync deleteExpiredSessions(before) {\n\t\t\treturn deleteWhere(\n\t\t\t\tindex,\n\t\t\t\t(stored) => stored.expiresAt.getTime() <= before.getTime(),\n\t\t\t);\n\t\t},\n\t};\n}\n\n/**\n * Writes `patch` on a session **only while it is not revoked**, and answers\n * it as written — or `null` for none, or a revoked one, never brought back.\n */\nfunction standingWrite(\n\t{ byId }: SessionIndex,\n\tid: SessionId,\n\tpatch: Pick<Partial<SessionRecord>, 'expiresAt' | 'authenticatedAt'>,\n): SessionRecord | null {\n\tconst stored = byId.get(id);\n\tif (stored === undefined || stored.revokedAt !== null) return null;\n\n\tconst written: SessionRecord = { ...stored, ...patch };\n\tbyId.set(id, written);\n\treturn copy(written);\n}\n\nfunction revoke(\n\t{ byId }: SessionIndex,\n\tid: SessionId,\n\tstored: SessionRecord,\n\tat: Date,\n): void {\n\tbyId.set(id, { ...stored, revokedAt: new Date(at) });\n}\n\n/** Deletes every session `matches` accepts, from both maps, and counts them. */\nfunction deleteWhere(\n\t{ byId, byTokenHash }: SessionIndex,\n\tmatches: (stored: SessionRecord) => boolean,\n): number {\n\tlet deleted = 0;\n\n\tfor (const [id, stored] of byId) {\n\t\tif (matches(stored)) {\n\t\t\tbyId.delete(id);\n\t\t\tbyTokenHash.delete(stored.tokenHash);\n\t\t\tdeleted += 1;\n\t\t}\n\t}\n\n\treturn deleted;\n}\n",
-    "import type { TokenRecord, TokenStore } from '../types';\nimport { copy } from './copy';\n\n/** The token store in memory, by token hash. */\nexport function memoryTokenStore(): TokenStore {\n\tconst byTokenHash = new Map<string, TokenRecord>();\n\n\treturn {\n\t\tasync insertToken(record) {\n\t\t\tif (byTokenHash.has(record.tokenHash)) return;\n\t\t\tbyTokenHash.set(record.tokenHash, copy(record));\n\t\t},\n\n\t\tasync consumeToken(tokenHash, kind, at) {\n\t\t\t// No `await` between this read and the write below: on one event loop\n\t\t\t// that is what makes the pair a single conditional write.\n\t\t\tconst stored = byTokenHash.get(tokenHash);\n\t\t\tif (stored === undefined || stored.kind !== kind) return null;\n\n\t\t\tconst before = copy(stored);\n\t\t\tif (stored.spentAt === null) {\n\t\t\t\tbyTokenHash.set(tokenHash, { ...stored, spentAt: new Date(at) });\n\t\t\t}\n\n\t\t\treturn before;\n\t\t},\n\n\t\tasync countAttempt(tokenHash, kind) {\n\t\t\t// The same single conditional write as consumeToken: no `await`\n\t\t\t// between the read and the write.\n\t\t\tconst stored = byTokenHash.get(tokenHash);\n\t\t\tif (stored === undefined || stored.kind !== kind) return null;\n\t\t\tif (stored.spentAt !== null) return copy(stored);\n\n\t\t\tconst counted = { ...stored, attempts: stored.attempts + 1 };\n\t\t\tbyTokenHash.set(tokenHash, counted);\n\t\t\treturn copy(counted);\n\t\t},\n\n\t\tasync spendUserTokens(userId, kind, at, except) {\n\t\t\tlet spent = 0;\n\n\t\t\tfor (const [tokenHash, stored] of byTokenHash) {\n\t\t\t\tif (\n\t\t\t\t\ttokenHash !== except &&\n\t\t\t\t\tstored.userId === userId &&\n\t\t\t\t\tstored.kind === kind &&\n\t\t\t\t\tstored.spentAt === null\n\t\t\t\t) {\n\t\t\t\t\tbyTokenHash.set(tokenHash, { ...stored, spentAt: new Date(at) });\n\t\t\t\t\tspent += 1;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn spent;\n\t\t},\n\n\t\tasync deleteUserTokens(userId) {\n\t\t\tlet deleted = 0;\n\n\t\t\tfor (const [tokenHash, stored] of byTokenHash) {\n\t\t\t\tif (stored.userId === userId) {\n\t\t\t\t\tbyTokenHash.delete(tokenHash);\n\t\t\t\t\tdeleted += 1;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn deleted;\n\t\t},\n\t};\n}\n",
+    "import type { TokenRecord, TokenStore } from '../types';\nimport { copy } from './copy';\n\n/** The token store in memory, by token hash. */\nexport function memoryTokenStore(): TokenStore {\n\tconst byTokenHash = new Map<string, TokenRecord>();\n\n\treturn {\n\t\tasync insertToken(record) {\n\t\t\tif (byTokenHash.has(record.tokenHash)) return;\n\t\t\tbyTokenHash.set(record.tokenHash, copy(record));\n\t\t},\n\n\t\tasync consumeToken(tokenHash, kind, at) {\n\t\t\t// No `await` between this read and the write below: on one event loop\n\t\t\t// that is what makes the pair a single conditional write.\n\t\t\tconst stored = byTokenHash.get(tokenHash);\n\t\t\tif (stored === undefined || stored.kind !== kind) return null;\n\n\t\t\tconst before = copy(stored);\n\t\t\tif (stored.spentAt === null) {\n\t\t\t\tbyTokenHash.set(tokenHash, { ...stored, spentAt: new Date(at) });\n\t\t\t}\n\n\t\t\treturn before;\n\t\t},\n\n\t\tasync countAttempt(tokenHash, kind) {\n\t\t\t// The same single conditional write as consumeToken: no `await`\n\t\t\t// between the read and the write.\n\t\t\tconst stored = byTokenHash.get(tokenHash);\n\t\t\tif (stored === undefined || stored.kind !== kind) return null;\n\t\t\tif (stored.spentAt !== null) return copy(stored);\n\n\t\t\tconst counted = { ...stored, attempts: stored.attempts + 1 };\n\t\t\tbyTokenHash.set(tokenHash, counted);\n\t\t\treturn copy(counted);\n\t\t},\n\n\t\tasync spendUserTokens(userId, kind, at, except) {\n\t\t\tlet spent = 0;\n\n\t\t\tfor (const [tokenHash, stored] of byTokenHash) {\n\t\t\t\tif (\n\t\t\t\t\ttokenHash !== except &&\n\t\t\t\t\tstored.userId === userId &&\n\t\t\t\t\tstored.kind === kind &&\n\t\t\t\t\tstored.spentAt === null\n\t\t\t\t) {\n\t\t\t\t\tbyTokenHash.set(tokenHash, { ...stored, spentAt: new Date(at) });\n\t\t\t\t\tspent += 1;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn spent;\n\t\t},\n\n\t\tasync deleteUserTokens(userId) {\n\t\t\tlet deleted = 0;\n\n\t\t\tfor (const [tokenHash, stored] of byTokenHash) {\n\t\t\t\tif (stored.userId === userId) {\n\t\t\t\t\tbyTokenHash.delete(tokenHash);\n\t\t\t\t\tdeleted += 1;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn deleted;\n\t\t},\n\n\t\tasync deleteExpiredTokens(before) {\n\t\t\tlet deleted = 0;\n\n\t\t\tfor (const [tokenHash, stored] of byTokenHash) {\n\t\t\t\tif (stored.expiresAt.getTime() <= before.getTime()) {\n\t\t\t\t\tbyTokenHash.delete(tokenHash);\n\t\t\t\t\tdeleted += 1;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn deleted;\n\t\t},\n\t};\n}\n",
     "import { StoreConflict } from '../../../errors/janus-error';\nimport type { Id } from '../../../ids/id';\nimport type { UserRecord } from '../types';\n\n/** What the in-memory user store holds: the records, and the unique index on their logins. */\nexport interface UserIndex {\n\treadonly byId: Map<Id, UserRecord>;\n\t/** The unique index: (type, login) key → the id holding it. */\n\treadonly byLogin: Map<string, Id>;\n}\n\n/** The unique key of one login. `\\u0000` cannot occur in a type name the core accepts. */\nexport const keyOf = (type: string, login: string): string =>\n\t`${type}\\u0000${login}`;\n\n/** The first of `logins` held by a user of `type` other than `id`. */\nexport const takenBy = (\n\t{ byLogin }: UserIndex,\n\ttype: string,\n\tlogins: readonly string[],\n\tid: Id,\n): string | undefined =>\n\tlogins.find((login) => {\n\t\tconst holder = byLogin.get(keyOf(type, login));\n\t\treturn holder !== undefined && holder !== id;\n\t});\n\n/** The conflict a login held by another user of `type` is refused with. */\nexport const taken = (operation: string, type: string, login: string) =>\n\tnew StoreConflict(\n\t\t'login',\n\t\t`${operation}: the login is taken by another ${type}`,\n\t\t{ login, userType: type, operation },\n\t);\n\n/** Points every login of `record` at its id. */\nexport function indexLogins({ byLogin }: UserIndex, record: UserRecord): void {\n\tfor (const login of record.logins) {\n\t\tbyLogin.set(keyOf(record.type, login), record.id);\n\t}\n}\n\n/** Frees every login of `record`. */\nexport function dropLogins({ byLogin }: UserIndex, record: UserRecord): void {\n\tfor (const login of record.logins) {\n\t\tbyLogin.delete(keyOf(record.type, login));\n\t}\n}\n",
     "import { NotFoundError, StoreConflict } from '../../../errors/janus-error';\nimport type { Id } from '../../../ids/id';\nimport type { UserPatch, UserRecord } from '../types';\nimport { copy } from './copy';\nimport {\n\tdropLogins,\n\tindexLogins,\n\ttaken,\n\ttakenBy,\n\ttype UserIndex,\n} from './user-index';\n\n/**\n * `updateUser` in memory: refused for an unknown id, a version that moved or\n * a login held by another user — checked, then written, in one synchronous\n * step.\n */\nexport function updateStored(\n\tindex: UserIndex,\n\tid: Id,\n\tpatch: UserPatch,\n\tifVersion: number,\n): UserRecord {\n\tconst stored = index.byId.get(id);\n\n\tif (stored === undefined) {\n\t\tthrow new NotFoundError('updateUser: no user has this id', {\n\t\t\tuserId: id,\n\t\t\toperation: 'updateUser',\n\t\t});\n\t}\n\n\tif (stored.version !== ifVersion) {\n\t\tthrow new StoreConflict(\n\t\t\t'version',\n\t\t\t`updateUser: expected version ${ifVersion}, found ${stored.version}`,\n\t\t\t{\n\t\t\t\tuserId: id,\n\t\t\t\texpectedVersion: ifVersion,\n\t\t\t\tactualVersion: stored.version,\n\t\t\t\toperation: 'updateUser',\n\t\t\t},\n\t\t);\n\t}\n\n\tif (patch.logins !== undefined) {\n\t\tconst collision = takenBy(index, stored.type, patch.logins, id);\n\t\tif (collision !== undefined) {\n\t\t\tthrow taken('updateUser', stored.type, collision);\n\t\t}\n\t}\n\n\tconst written = applyPatch(stored, copy(patch));\n\n\tindex.byId.set(id, written);\n\tif (patch.logins !== undefined) {\n\t\tdropLogins(index, stored);\n\t\tindexLogins(index, written);\n\t}\n\n\treturn copy(written);\n}\n\n/**\n * The record a patch produces: the fields it names, replaced whole; the fields\n * it does not name, untouched.\n *\n * Reads each field by name rather than spreading the patch, so a key the port\n * does not declare — `version`, `id`, `type`, `createdAt`, or a `snake_case`\n * typo from JavaScript — never reaches the record. A key present as\n * `undefined` is absent, never an erasure.\n */\nfunction applyPatch(stored: UserRecord, patch: UserPatch): UserRecord {\n\treturn {\n\t\t...stored,\n\t\tschemaVersion: patch.schemaVersion ?? stored.schemaVersion,\n\t\tactive: patch.active ?? stored.active,\n\t\tfields: patch.fields ?? stored.fields,\n\t\tlogins: patch.logins ?? stored.logins,\n\t\tpassword: patch.password === undefined ? stored.password : patch.password,\n\t\tsecondFactor:\n\t\t\tpatch.secondFactor === undefined\n\t\t\t\t? stored.secondFactor\n\t\t\t\t: patch.secondFactor,\n\t\temailVerifiedAt:\n\t\t\tpatch.emailVerifiedAt === undefined\n\t\t\t\t? stored.emailVerifiedAt\n\t\t\t\t: patch.emailVerifiedAt,\n\t\tversion: stored.version + 1,\n\t\tupdatedAt: patch.updatedAt,\n\t};\n}\n",
     "import type { Id } from '../../../ids/id';\nimport type { UserRecord, UserStore } from '../types';\nimport { copy } from './copy';\nimport {\n\tdropLogins,\n\tindexLogins,\n\tkeyOf,\n\ttaken,\n\ttakenBy,\n\ttype UserIndex,\n} from './user-index';\nimport { updateStored } from './user-update';\n\n/** The user store in memory: the records by id, and the unique index on logins. */\nexport function memoryUserStore(): UserStore {\n\tconst index: UserIndex = {\n\t\tbyId: new Map<Id, UserRecord>(),\n\t\tbyLogin: new Map<string, Id>(),\n\t};\n\tconst { byId, byLogin } = index;\n\n\treturn {\n\t\tasync insertUser(record) {\n\t\t\tconst stored = byId.get(record.id);\n\t\t\tif (stored !== undefined) return copy(stored);\n\n\t\t\tconst collision = takenBy(index, record.type, record.logins, record.id);\n\t\t\tif (collision !== undefined) {\n\t\t\t\tthrow taken('insertUser', record.type, collision);\n\t\t\t}\n\n\t\t\tconst written = copy(record);\n\t\t\tbyId.set(written.id, written);\n\t\t\tindexLogins(index, written);\n\n\t\t\treturn copy(written);\n\t\t},\n\n\t\tasync findUser(id) {\n\t\t\tconst stored = byId.get(id);\n\t\t\treturn stored === undefined ? null : copy(stored);\n\t\t},\n\n\t\tasync findUsers(ids) {\n\t\t\treturn [...new Set(ids)].flatMap((id) => {\n\t\t\t\tconst stored = byId.get(id);\n\t\t\t\treturn stored === undefined ? [] : [copy(stored)];\n\t\t\t});\n\t\t},\n\n\t\tasync findUserByLogin(type, login) {\n\t\t\tconst id = byLogin.get(keyOf(type, login));\n\t\t\tconst stored = id === undefined ? undefined : byId.get(id);\n\t\t\treturn stored === undefined ? null : copy(stored);\n\t\t},\n\n\t\tasync listUsers({ type, after, limit }) {\n\t\t\t// A Map keeps insertion order, not id order: a retried insert or an\n\t\t\t// id minted on another machine can land out of sequence.\n\t\t\tconst ids = [...byId.values()]\n\t\t\t\t.filter((user) => user.type === type)\n\t\t\t\t.map((user) => user.id)\n\t\t\t\t.filter((id) => after === null || id > after)\n\t\t\t\t.sort();\n\t\t\tconst pageIds = ids.slice(0, limit);\n\t\t\tconst last = pageIds.at(-1);\n\n\t\t\treturn {\n\t\t\t\titems: pageIds.map((id) => copy(byId.get(id) as UserRecord)),\n\t\t\t\tnextCursor: ids.length > limit && last !== undefined ? last : null,\n\t\t\t};\n\t\t},\n\n\t\tasync updateUser(id, patch, ifVersion) {\n\t\t\treturn updateStored(index, id, patch, ifVersion);\n\t\t},\n\n\t\tasync deleteUser(id) {\n\t\t\tconst stored = byId.get(id);\n\t\t\tif (stored === undefined) return false;\n\n\t\t\tbyId.delete(id);\n\t\t\tdropLogins(index, stored);\n\t\t\treturn true;\n\t\t},\n\t};\n}\n",
     "import type { JanusStores } from '../types';\nimport { memorySessionStore } from './sessions';\nimport { memoryTokenStore } from './tokens';\nimport { memoryUserStore } from './users';\n\n/**\n * The reference implementation of the store port, in memory.\n *\n * **Shipped and documented, not a test helper.** It is what a consumer uses in\n * their own unit tests, and what an adapter author compares against when a\n * conformance case they do not understand turns red. So it keeps the six rules\n * for real rather than approximately:\n *\n * - uniqueness is a constraint — an index checked and written inside the same\n *   synchronous step, which is what atomic means on one event loop;\n * - `consumeToken` reads and writes with no `await` between the two, so twenty\n *   concurrent calls see exactly one unspent token;\n * - every record is **copied in and copied out**, so a caller that mutates what\n *   it passed or what it got back cannot reach the store — the in-memory\n *   version of \"bytes round-trip\";\n * - a patch applies only the fields it names, and only the fields the port\n *   declares: a stray `version` or `id` in a patch from JavaScript is ignored,\n *   not written.\n *\n * Every method is `async` even though none waits on anything: a caller that\n * forgot an `await` must fail here the way it would against a real database.\n */\nexport function createMemoryStores(): JanusStores {\n\treturn {\n\t\tusers: memoryUserStore(),\n\t\tsessions: memorySessionStore(),\n\t\ttokens: memoryTokenStore(),\n\t};\n}\n"
   ],
-  "mappings": ";;;;;;AAyBA,IAAM,MAAyB,MAAM,KAAK,EAAE,QAAQ,IAAI,GAAG,CAAC,GAAG,MAC9D,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAC/B;AAEA,IAAI,SAAS;AACb,IAAI,WAAW;AAWf,IAAM,eAAe;AAWd,SAAS,OAAM,CAAC,MAAc,KAAK,IAAI,GAAO;AAAA,EACpD,IAAI,KAAK;AAAA,EAET,IAAI,OAAO,QAAQ;AAAA,IAClB,YAAY;AAAA,IACZ,IAAI,WAAW,cAAc;AAAA,MAI5B,KAAK,SAAS;AAAA,MACd,WAAW;AAAA,IACZ;AAAA,EACD,EAAO,SAAI,KAAK,QAAQ;AAAA,IACvB,WAAW;AAAA,EACZ,EAAO;AAAA,IAIN,KAAK;AAAA,IACL,YAAY;AAAA,IACZ,IAAI,WAAW,cAAc;AAAA,MAC5B,KAAK,SAAS;AAAA,MACd,WAAW;AAAA,IACZ;AAAA;AAAA,EAGD,SAAS;AAAA,EAET,MAAM,QAAQ,IAAI,WAAW,EAAE;AAAA,EAC/B,OAAO,gBAAgB,MAAM,SAAS,CAAC,CAAC;AAAA,EAExC,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,IAAK;AAAA,EAC3B,MAAM,KAAK,KAAK;AAAA,EAEhB,MAAM,KAAK,MAAS,YAAY,IAAK;AAAA,EACrC,MAAM,KAAK,WAAW;AAAA,EAEtB,MAAM,KAAK,MAAS,MAAM,KAAgB;AAAA,EAE1C,OAAO,GAAG,IAAI,MAAM,MAAgB,IAAI,MAAM,MAAgB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM;AAAA;AAGpa,IAAM,UACL;AAWM,SAAS,KAAI,CAAC,OAAwB;AAAA,EAC5C,OAAO,QAAQ,KAAK,KAAK;AAAA;AAYnB,SAAS,SAAQ,CAAC,IAAc;AAAA,EACtC,MAAM,MAAM,GAAG,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAAA,EAC5C,OAAO,IAAI,KAAK,OAAO,SAAS,KAAK,EAAE,CAAC;AAAA;;;ACzHlC,IAAM,OAAO,CAAI,UAAgB,gBAAgB,KAAK;;;ACMtD,SAAS,kBAAkB,GAAiB;AAAA,EAClD,MAAM,QAAsB;AAAA,IAC3B,MAAM,IAAI;AAAA,IACV,aAAa,IAAI;AAAA,EAClB;AAAA,EACA,QAAQ,MAAM,gBAAgB;AAAA,EAE9B,OAAO;AAAA,SACA,cAAa,CAAC,QAAQ;AAAA,MAC3B,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,QAAG;AAAA,MAEzB,MAAM,UAAU,KAAK,MAAM;AAAA,MAC3B,KAAK,IAAI,QAAQ,IAAI,OAAO;AAAA,MAC5B,YAAY,IAAI,QAAQ,WAAW,QAAQ,EAAE;AAAA;AAAA,SAGxC,uBAAsB,CAAC,WAAW;AAAA,MACvC,MAAM,KAAK,YAAY,IAAI,SAAS;AAAA,MACpC,MAAM,SAAS,OAAO,YAAY,YAAY,KAAK,IAAI,EAAE;AAAA,MACzD,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AAAA;AAAA,SAG3C,cAAa,CAAC,IAAI,WAAW;AAAA,MAClC,OAAO,cAAc,OAAO,IAAI,EAAE,WAAW,IAAI,KAAK,SAAS,EAAE,CAAC;AAAA;AAAA,SAG7D,sBAAqB,CAAC,IAAI,IAAI;AAAA,MACnC,OAAO,cAAc,OAAO,IAAI,EAAE,iBAAiB,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA;AAAA,SAG5D,cAAa,CAAC,IAAI,IAAI;AAAA,MAC3B,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAO;AAAA,MAEjC,IAAI,OAAO,cAAc;AAAA,QAAM,OAAO,OAAO,IAAI,QAAQ,EAAE;AAAA,MAC3D,OAAO;AAAA;AAAA,SAGF,mBAAkB,CAAC,QAAQ,IAAI,QAAQ;AAAA,MAC5C,IAAI,UAAU;AAAA,MAEd,YAAY,IAAI,WAAW,MAAM;AAAA,QAChC,IACC,OAAO,WAAW,UAClB,OAAO,cAAc,QACrB,OAAO,QACN;AAAA,UACD,OAAO,OAAO,IAAI,QAAQ,EAAE;AAAA,UAC5B,WAAW;AAAA,QACZ;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,SAGF,mBAAkB,CAAC,QAAQ;AAAA,MAChC,OAAO,YAAY,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM;AAAA;AAAA,SAGzD,sBAAqB,CAAC,QAAQ;AAAA,MACnC,OAAO,YACN,OACA,CAAC,WAAW,OAAO,UAAU,QAAQ,KAAK,OAAO,QAAQ,CAC1D;AAAA;AAAA,EAEF;AAAA;AAOD,SAAS,aAAa,GACnB,QACF,IACA,OACuB;AAAA,EACvB,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,EAC1B,IAAI,WAAW,aAAa,OAAO,cAAc;AAAA,IAAM,OAAO;AAAA,EAE9D,MAAM,UAAyB,KAAK,WAAW,MAAM;AAAA,EACrD,KAAK,IAAI,IAAI,OAAO;AAAA,EACpB,OAAO,KAAK,OAAO;AAAA;AAGpB,SAAS,MAAM,GACZ,QACF,IACA,QACA,IACO;AAAA,EACP,KAAK,IAAI,IAAI,KAAK,QAAQ,WAAW,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA;AAIpD,SAAS,WAAW,GACjB,MAAM,eACR,SACS;AAAA,EACT,IAAI,UAAU;AAAA,EAEd,YAAY,IAAI,WAAW,MAAM;AAAA,IAChC,IAAI,QAAQ,MAAM,GAAG;AAAA,MACpB,KAAK,OAAO,EAAE;AAAA,MACd,YAAY,OAAO,OAAO,SAAS;AAAA,MACnC,WAAW;AAAA,IACZ;AAAA,EACD;AAAA,EAEA,OAAO;AAAA;;;ACnHD,SAAS,gBAAgB,GAAe;AAAA,EAC9C,MAAM,cAAc,IAAI;AAAA,EAExB,OAAO;AAAA,SACA,YAAW,CAAC,QAAQ;AAAA,MACzB,IAAI,YAAY,IAAI,OAAO,SAAS;AAAA,QAAG;AAAA,MACvC,YAAY,IAAI,OAAO,WAAW,KAAK,MAAM,CAAC;AAAA;AAAA,SAGzC,aAAY,CAAC,WAAW,MAAM,IAAI;AAAA,MAGvC,MAAM,SAAS,YAAY,IAAI,SAAS;AAAA,MACxC,IAAI,WAAW,aAAa,OAAO,SAAS;AAAA,QAAM,OAAO;AAAA,MAEzD,MAAM,SAAS,KAAK,MAAM;AAAA,MAC1B,IAAI,OAAO,YAAY,MAAM;AAAA,QAC5B,YAAY,IAAI,WAAW,KAAK,QAAQ,SAAS,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA,MAChE;AAAA,MAEA,OAAO;AAAA;AAAA,SAGF,aAAY,CAAC,WAAW,MAAM;AAAA,MAGnC,MAAM,SAAS,YAAY,IAAI,SAAS;AAAA,MACxC,IAAI,WAAW,aAAa,OAAO,SAAS;AAAA,QAAM,OAAO;AAAA,MACzD,IAAI,OAAO,YAAY;AAAA,QAAM,OAAO,KAAK,MAAM;AAAA,MAE/C,MAAM,UAAU,KAAK,QAAQ,UAAU,OAAO,WAAW,EAAE;AAAA,MAC3D,YAAY,IAAI,WAAW,OAAO;AAAA,MAClC,OAAO,KAAK,OAAO;AAAA;AAAA,SAGd,gBAAe,CAAC,QAAQ,MAAM,IAAI,QAAQ;AAAA,MAC/C,IAAI,QAAQ;AAAA,MAEZ,YAAY,WAAW,WAAW,aAAa;AAAA,QAC9C,IACC,cAAc,UACd,OAAO,WAAW,UAClB,OAAO,SAAS,QAChB,OAAO,YAAY,MAClB;AAAA,UACD,YAAY,IAAI,WAAW,KAAK,QAAQ,SAAS,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA,UAC/D,SAAS;AAAA,QACV;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,SAGF,iBAAgB,CAAC,QAAQ;AAAA,MAC9B,IAAI,UAAU;AAAA,MAEd,YAAY,WAAW,WAAW,aAAa;AAAA,QAC9C,IAAI,OAAO,WAAW,QAAQ;AAAA,UAC7B,YAAY,OAAO,SAAS;AAAA,UAC5B,WAAW;AAAA,QACZ;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,EAET;AAAA;;;ACzDM,IAAM,QAAQ,CAAC,MAAc,UACnC,GAAG,WAAa;AAGV,IAAM,UAAU,GACpB,WACF,MACA,QACA,OAEA,OAAO,KAAK,CAAC,UAAU;AAAA,EACtB,MAAM,SAAS,QAAQ,IAAI,MAAM,MAAM,KAAK,CAAC;AAAA,EAC7C,OAAO,WAAW,aAAa,WAAW;AAAA,CAC1C;AAGK,IAAM,QAAQ,CAAC,WAAmB,MAAc,UACtD,IAAI,eACH,SACA,GAAG,4CAA4C,QAC/C,EAAE,OAAO,UAAU,MAAM,UAAU,CACpC;AAGM,SAAS,WAAW,GAAG,WAAsB,QAA0B;AAAA,EAC7E,WAAW,SAAS,OAAO,QAAQ;AAAA,IAClC,QAAQ,IAAI,MAAM,OAAO,MAAM,KAAK,GAAG,OAAO,EAAE;AAAA,EACjD;AAAA;AAIM,SAAS,UAAU,GAAG,WAAsB,QAA0B;AAAA,EAC5E,WAAW,SAAS,OAAO,QAAQ;AAAA,IAClC,QAAQ,OAAO,MAAM,OAAO,MAAM,KAAK,CAAC;AAAA,EACzC;AAAA;;;AC7BM,SAAS,YAAY,CAC3B,OACA,IACA,OACA,WACa;AAAA,EACb,MAAM,SAAS,MAAM,KAAK,IAAI,EAAE;AAAA,EAEhC,IAAI,WAAW,WAAW;AAAA,IACzB,MAAM,IAAI,eAAc,mCAAmC;AAAA,MAC1D,QAAQ;AAAA,MACR,WAAW;AAAA,IACZ,CAAC;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,YAAY,WAAW;AAAA,IACjC,MAAM,IAAI,eACT,WACA,gCAAgC,oBAAoB,OAAO,WAC3D;AAAA,MACC,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,WAAW;AAAA,IACZ,CACD;AAAA,EACD;AAAA,EAEA,IAAI,MAAM,WAAW,WAAW;AAAA,IAC/B,MAAM,YAAY,QAAQ,OAAO,OAAO,MAAM,MAAM,QAAQ,EAAE;AAAA,IAC9D,IAAI,cAAc,WAAW;AAAA,MAC5B,MAAM,MAAM,cAAc,OAAO,MAAM,SAAS;AAAA,IACjD;AAAA,EACD;AAAA,EAEA,MAAM,UAAU,WAAW,QAAQ,KAAK,KAAK,CAAC;AAAA,EAE9C,MAAM,KAAK,IAAI,IAAI,OAAO;AAAA,EAC1B,IAAI,MAAM,WAAW,WAAW;AAAA,IAC/B,WAAW,OAAO,MAAM;AAAA,IACxB,YAAY,OAAO,OAAO;AAAA,EAC3B;AAAA,EAEA,OAAO,KAAK,OAAO;AAAA;AAYpB,SAAS,UAAU,CAAC,QAAoB,OAA8B;AAAA,EACrE,OAAO;AAAA,OACH;AAAA,IACH,eAAe,MAAM,iBAAiB,OAAO;AAAA,IAC7C,QAAQ,MAAM,UAAU,OAAO;AAAA,IAC/B,QAAQ,MAAM,UAAU,OAAO;AAAA,IAC/B,QAAQ,MAAM,UAAU,OAAO;AAAA,IAC/B,UAAU,MAAM,aAAa,YAAY,OAAO,WAAW,MAAM;AAAA,IACjE,cACC,MAAM,iBAAiB,YACpB,OAAO,eACP,MAAM;AAAA,IACV,iBACC,MAAM,oBAAoB,YACvB,OAAO,kBACP,MAAM;AAAA,IACV,SAAS,OAAO,UAAU;AAAA,IAC1B,WAAW,MAAM;AAAA,EAClB;AAAA;;;AC5EM,SAAS,eAAe,GAAc;AAAA,EAC5C,MAAM,QAAmB;AAAA,IACxB,MAAM,IAAI;AAAA,IACV,SAAS,IAAI;AAAA,EACd;AAAA,EACA,QAAQ,MAAM,YAAY;AAAA,EAE1B,OAAO;AAAA,SACA,WAAU,CAAC,QAAQ;AAAA,MACxB,MAAM,SAAS,KAAK,IAAI,OAAO,EAAE;AAAA,MACjC,IAAI,WAAW;AAAA,QAAW,OAAO,KAAK,MAAM;AAAA,MAE5C,MAAM,YAAY,QAAQ,OAAO,OAAO,MAAM,OAAO,QAAQ,OAAO,EAAE;AAAA,MACtE,IAAI,cAAc,WAAW;AAAA,QAC5B,MAAM,MAAM,cAAc,OAAO,MAAM,SAAS;AAAA,MACjD;AAAA,MAEA,MAAM,UAAU,KAAK,MAAM;AAAA,MAC3B,KAAK,IAAI,QAAQ,IAAI,OAAO;AAAA,MAC5B,YAAY,OAAO,OAAO;AAAA,MAE1B,OAAO,KAAK,OAAO;AAAA;AAAA,SAGd,SAAQ,CAAC,IAAI;AAAA,MAClB,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,MAC1B,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AAAA;AAAA,SAG3C,UAAS,CAAC,KAAK;AAAA,MACpB,OAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC,OAAO;AAAA,QACxC,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,QAC1B,OAAO,WAAW,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AAAA,OAChD;AAAA;AAAA,SAGI,gBAAe,CAAC,MAAM,OAAO;AAAA,MAClC,MAAM,KAAK,QAAQ,IAAI,MAAM,MAAM,KAAK,CAAC;AAAA,MACzC,MAAM,SAAS,OAAO,YAAY,YAAY,KAAK,IAAI,EAAE;AAAA,MACzD,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AAAA;AAAA,SAG3C,UAAS,GAAG,MAAM,OAAO,SAAS;AAAA,MAGvC,MAAM,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,EAC3B,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EACnC,IAAI,CAAC,SAAS,KAAK,EAAE,EACrB,OAAO,CAAC,OAAO,UAAU,QAAQ,KAAK,KAAK,EAC3C,KAAK;AAAA,MACP,MAAM,UAAU,IAAI,MAAM,GAAG,KAAK;AAAA,MAClC,MAAM,OAAO,QAAQ,GAAG,EAAE;AAAA,MAE1B,OAAO;AAAA,QACN,OAAO,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,EAAE,CAAe,CAAC;AAAA,QAC3D,YAAY,IAAI,SAAS,SAAS,SAAS,YAAY,OAAO;AAAA,MAC/D;AAAA;AAAA,SAGK,WAAU,CAAC,IAAI,OAAO,WAAW;AAAA,MACtC,OAAO,aAAa,OAAO,IAAI,OAAO,SAAS;AAAA;AAAA,SAG1C,WAAU,CAAC,IAAI;AAAA,MACpB,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAO;AAAA,MAEjC,KAAK,OAAO,EAAE;AAAA,MACd,WAAW,OAAO,MAAM;AAAA,MACxB,OAAO;AAAA;AAAA,EAET;AAAA;;;AC1DM,SAAS,mBAAkB,GAAgB;AAAA,EACjD,OAAO;AAAA,IACN,OAAO,gBAAgB;AAAA,IACvB,UAAU,mBAAmB;AAAA,IAC7B,QAAQ,iBAAiB;AAAA,EAC1B;AAAA;",
-  "debugId": "D2F28CB1297A405F64756E2164756E21",
+  "mappings": ";;;;;;AAyBA,IAAM,MAAyB,MAAM,KAAK,EAAE,QAAQ,IAAI,GAAG,CAAC,GAAG,MAC9D,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAC/B;AAEA,IAAI,SAAS;AACb,IAAI,WAAW;AAWf,IAAM,eAAe;AAWd,SAAS,OAAM,CAAC,MAAc,KAAK,IAAI,GAAO;AAAA,EACpD,IAAI,KAAK;AAAA,EAET,IAAI,OAAO,QAAQ;AAAA,IAClB,YAAY;AAAA,IACZ,IAAI,WAAW,cAAc;AAAA,MAI5B,KAAK,SAAS;AAAA,MACd,WAAW;AAAA,IACZ;AAAA,EACD,EAAO,SAAI,KAAK,QAAQ;AAAA,IACvB,WAAW;AAAA,EACZ,EAAO;AAAA,IAIN,KAAK;AAAA,IACL,YAAY;AAAA,IACZ,IAAI,WAAW,cAAc;AAAA,MAC5B,KAAK,SAAS;AAAA,MACd,WAAW;AAAA,IACZ;AAAA;AAAA,EAGD,SAAS;AAAA,EAET,MAAM,QAAQ,IAAI,WAAW,EAAE;AAAA,EAC/B,OAAO,gBAAgB,MAAM,SAAS,CAAC,CAAC;AAAA,EAExC,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,KAAM;AAAA,EAC5B,MAAM,KAAM,KAAK,KAAK,IAAK;AAAA,EAC3B,MAAM,KAAK,KAAK;AAAA,EAEhB,MAAM,KAAK,MAAS,YAAY,IAAK;AAAA,EACrC,MAAM,KAAK,WAAW;AAAA,EAEtB,MAAM,KAAK,MAAS,MAAM,KAAgB;AAAA,EAE1C,OAAO,GAAG,IAAI,MAAM,MAAgB,IAAI,MAAM,MAAgB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,MAAgB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM,OAAiB,IAAI,MAAM;AAAA;AAGpa,IAAM,UACL;AAWM,SAAS,KAAI,CAAC,OAAwB;AAAA,EAC5C,OAAO,QAAQ,KAAK,KAAK;AAAA;AAYnB,SAAS,SAAQ,CAAC,IAAc;AAAA,EACtC,MAAM,MAAM,GAAG,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAAA,EAC5C,OAAO,IAAI,KAAK,OAAO,SAAS,KAAK,EAAE,CAAC;AAAA;;;ACzHlC,IAAM,OAAO,CAAI,UAAgB,gBAAgB,KAAK;;;ACMtD,SAAS,kBAAkB,GAAiB;AAAA,EAClD,MAAM,QAAsB;AAAA,IAC3B,MAAM,IAAI;AAAA,IACV,aAAa,IAAI;AAAA,EAClB;AAAA,EACA,QAAQ,MAAM,gBAAgB;AAAA,EAE9B,OAAO;AAAA,SACA,cAAa,CAAC,QAAQ;AAAA,MAC3B,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,QAAG;AAAA,MAEzB,MAAM,UAAU,KAAK,MAAM;AAAA,MAC3B,KAAK,IAAI,QAAQ,IAAI,OAAO;AAAA,MAC5B,YAAY,IAAI,QAAQ,WAAW,QAAQ,EAAE;AAAA;AAAA,SAGxC,uBAAsB,CAAC,WAAW;AAAA,MACvC,MAAM,KAAK,YAAY,IAAI,SAAS;AAAA,MACpC,MAAM,SAAS,OAAO,YAAY,YAAY,KAAK,IAAI,EAAE;AAAA,MACzD,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AAAA;AAAA,SAG3C,cAAa,CAAC,IAAI,WAAW;AAAA,MAClC,OAAO,cAAc,OAAO,IAAI,EAAE,WAAW,IAAI,KAAK,SAAS,EAAE,CAAC;AAAA;AAAA,SAG7D,sBAAqB,CAAC,IAAI,IAAI;AAAA,MACnC,OAAO,cAAc,OAAO,IAAI,EAAE,iBAAiB,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA;AAAA,SAG5D,cAAa,CAAC,IAAI,IAAI;AAAA,MAC3B,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAO;AAAA,MAEjC,IAAI,OAAO,cAAc;AAAA,QAAM,OAAO,OAAO,IAAI,QAAQ,EAAE;AAAA,MAC3D,OAAO;AAAA;AAAA,SAGF,mBAAkB,CAAC,QAAQ,IAAI,QAAQ;AAAA,MAC5C,IAAI,UAAU;AAAA,MAEd,YAAY,IAAI,WAAW,MAAM;AAAA,QAChC,IACC,OAAO,WAAW,UAClB,OAAO,cAAc,QACrB,OAAO,QACN;AAAA,UACD,OAAO,OAAO,IAAI,QAAQ,EAAE;AAAA,UAC5B,WAAW;AAAA,QACZ;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,SAGF,mBAAkB,CAAC,QAAQ;AAAA,MAChC,OAAO,YAAY,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM;AAAA;AAAA,SAGzD,sBAAqB,CAAC,QAAQ;AAAA,MACnC,OAAO,YACN,OACA,CAAC,WAAW,OAAO,UAAU,QAAQ,KAAK,OAAO,QAAQ,CAC1D;AAAA;AAAA,EAEF;AAAA;AAOD,SAAS,aAAa,GACnB,QACF,IACA,OACuB;AAAA,EACvB,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,EAC1B,IAAI,WAAW,aAAa,OAAO,cAAc;AAAA,IAAM,OAAO;AAAA,EAE9D,MAAM,UAAyB,KAAK,WAAW,MAAM;AAAA,EACrD,KAAK,IAAI,IAAI,OAAO;AAAA,EACpB,OAAO,KAAK,OAAO;AAAA;AAGpB,SAAS,MAAM,GACZ,QACF,IACA,QACA,IACO;AAAA,EACP,KAAK,IAAI,IAAI,KAAK,QAAQ,WAAW,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA;AAIpD,SAAS,WAAW,GACjB,MAAM,eACR,SACS;AAAA,EACT,IAAI,UAAU;AAAA,EAEd,YAAY,IAAI,WAAW,MAAM;AAAA,IAChC,IAAI,QAAQ,MAAM,GAAG;AAAA,MACpB,KAAK,OAAO,EAAE;AAAA,MACd,YAAY,OAAO,OAAO,SAAS;AAAA,MACnC,WAAW;AAAA,IACZ;AAAA,EACD;AAAA,EAEA,OAAO;AAAA;;;ACnHD,SAAS,gBAAgB,GAAe;AAAA,EAC9C,MAAM,cAAc,IAAI;AAAA,EAExB,OAAO;AAAA,SACA,YAAW,CAAC,QAAQ;AAAA,MACzB,IAAI,YAAY,IAAI,OAAO,SAAS;AAAA,QAAG;AAAA,MACvC,YAAY,IAAI,OAAO,WAAW,KAAK,MAAM,CAAC;AAAA;AAAA,SAGzC,aAAY,CAAC,WAAW,MAAM,IAAI;AAAA,MAGvC,MAAM,SAAS,YAAY,IAAI,SAAS;AAAA,MACxC,IAAI,WAAW,aAAa,OAAO,SAAS;AAAA,QAAM,OAAO;AAAA,MAEzD,MAAM,SAAS,KAAK,MAAM;AAAA,MAC1B,IAAI,OAAO,YAAY,MAAM;AAAA,QAC5B,YAAY,IAAI,WAAW,KAAK,QAAQ,SAAS,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA,MAChE;AAAA,MAEA,OAAO;AAAA;AAAA,SAGF,aAAY,CAAC,WAAW,MAAM;AAAA,MAGnC,MAAM,SAAS,YAAY,IAAI,SAAS;AAAA,MACxC,IAAI,WAAW,aAAa,OAAO,SAAS;AAAA,QAAM,OAAO;AAAA,MACzD,IAAI,OAAO,YAAY;AAAA,QAAM,OAAO,KAAK,MAAM;AAAA,MAE/C,MAAM,UAAU,KAAK,QAAQ,UAAU,OAAO,WAAW,EAAE;AAAA,MAC3D,YAAY,IAAI,WAAW,OAAO;AAAA,MAClC,OAAO,KAAK,OAAO;AAAA;AAAA,SAGd,gBAAe,CAAC,QAAQ,MAAM,IAAI,QAAQ;AAAA,MAC/C,IAAI,QAAQ;AAAA,MAEZ,YAAY,WAAW,WAAW,aAAa;AAAA,QAC9C,IACC,cAAc,UACd,OAAO,WAAW,UAClB,OAAO,SAAS,QAChB,OAAO,YAAY,MAClB;AAAA,UACD,YAAY,IAAI,WAAW,KAAK,QAAQ,SAAS,IAAI,KAAK,EAAE,EAAE,CAAC;AAAA,UAC/D,SAAS;AAAA,QACV;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,SAGF,iBAAgB,CAAC,QAAQ;AAAA,MAC9B,IAAI,UAAU;AAAA,MAEd,YAAY,WAAW,WAAW,aAAa;AAAA,QAC9C,IAAI,OAAO,WAAW,QAAQ;AAAA,UAC7B,YAAY,OAAO,SAAS;AAAA,UAC5B,WAAW;AAAA,QACZ;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,SAGF,oBAAmB,CAAC,QAAQ;AAAA,MACjC,IAAI,UAAU;AAAA,MAEd,YAAY,WAAW,WAAW,aAAa;AAAA,QAC9C,IAAI,OAAO,UAAU,QAAQ,KAAK,OAAO,QAAQ,GAAG;AAAA,UACnD,YAAY,OAAO,SAAS;AAAA,UAC5B,WAAW;AAAA,QACZ;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,EAET;AAAA;;;ACtEM,IAAM,QAAQ,CAAC,MAAc,UACnC,GAAG,WAAa;AAGV,IAAM,UAAU,GACpB,WACF,MACA,QACA,OAEA,OAAO,KAAK,CAAC,UAAU;AAAA,EACtB,MAAM,SAAS,QAAQ,IAAI,MAAM,MAAM,KAAK,CAAC;AAAA,EAC7C,OAAO,WAAW,aAAa,WAAW;AAAA,CAC1C;AAGK,IAAM,QAAQ,CAAC,WAAmB,MAAc,UACtD,IAAI,eACH,SACA,GAAG,4CAA4C,QAC/C,EAAE,OAAO,UAAU,MAAM,UAAU,CACpC;AAGM,SAAS,WAAW,GAAG,WAAsB,QAA0B;AAAA,EAC7E,WAAW,SAAS,OAAO,QAAQ;AAAA,IAClC,QAAQ,IAAI,MAAM,OAAO,MAAM,KAAK,GAAG,OAAO,EAAE;AAAA,EACjD;AAAA;AAIM,SAAS,UAAU,GAAG,WAAsB,QAA0B;AAAA,EAC5E,WAAW,SAAS,OAAO,QAAQ;AAAA,IAClC,QAAQ,OAAO,MAAM,OAAO,MAAM,KAAK,CAAC;AAAA,EACzC;AAAA;;;AC7BM,SAAS,YAAY,CAC3B,OACA,IACA,OACA,WACa;AAAA,EACb,MAAM,SAAS,MAAM,KAAK,IAAI,EAAE;AAAA,EAEhC,IAAI,WAAW,WAAW;AAAA,IACzB,MAAM,IAAI,eAAc,mCAAmC;AAAA,MAC1D,QAAQ;AAAA,MACR,WAAW;AAAA,IACZ,CAAC;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,YAAY,WAAW;AAAA,IACjC,MAAM,IAAI,eACT,WACA,gCAAgC,oBAAoB,OAAO,WAC3D;AAAA,MACC,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,WAAW;AAAA,IACZ,CACD;AAAA,EACD;AAAA,EAEA,IAAI,MAAM,WAAW,WAAW;AAAA,IAC/B,MAAM,YAAY,QAAQ,OAAO,OAAO,MAAM,MAAM,QAAQ,EAAE;AAAA,IAC9D,IAAI,cAAc,WAAW;AAAA,MAC5B,MAAM,MAAM,cAAc,OAAO,MAAM,SAAS;AAAA,IACjD;AAAA,EACD;AAAA,EAEA,MAAM,UAAU,WAAW,QAAQ,KAAK,KAAK,CAAC;AAAA,EAE9C,MAAM,KAAK,IAAI,IAAI,OAAO;AAAA,EAC1B,IAAI,MAAM,WAAW,WAAW;AAAA,IAC/B,WAAW,OAAO,MAAM;AAAA,IACxB,YAAY,OAAO,OAAO;AAAA,EAC3B;AAAA,EAEA,OAAO,KAAK,OAAO;AAAA;AAYpB,SAAS,UAAU,CAAC,QAAoB,OAA8B;AAAA,EACrE,OAAO;AAAA,OACH;AAAA,IACH,eAAe,MAAM,iBAAiB,OAAO;AAAA,IAC7C,QAAQ,MAAM,UAAU,OAAO;AAAA,IAC/B,QAAQ,MAAM,UAAU,OAAO;AAAA,IAC/B,QAAQ,MAAM,UAAU,OAAO;AAAA,IAC/B,UAAU,MAAM,aAAa,YAAY,OAAO,WAAW,MAAM;AAAA,IACjE,cACC,MAAM,iBAAiB,YACpB,OAAO,eACP,MAAM;AAAA,IACV,iBACC,MAAM,oBAAoB,YACvB,OAAO,kBACP,MAAM;AAAA,IACV,SAAS,OAAO,UAAU;AAAA,IAC1B,WAAW,MAAM;AAAA,EAClB;AAAA;;;AC5EM,SAAS,eAAe,GAAc;AAAA,EAC5C,MAAM,QAAmB;AAAA,IACxB,MAAM,IAAI;AAAA,IACV,SAAS,IAAI;AAAA,EACd;AAAA,EACA,QAAQ,MAAM,YAAY;AAAA,EAE1B,OAAO;AAAA,SACA,WAAU,CAAC,QAAQ;AAAA,MACxB,MAAM,SAAS,KAAK,IAAI,OAAO,EAAE;AAAA,MACjC,IAAI,WAAW;AAAA,QAAW,OAAO,KAAK,MAAM;AAAA,MAE5C,MAAM,YAAY,QAAQ,OAAO,OAAO,MAAM,OAAO,QAAQ,OAAO,EAAE;AAAA,MACtE,IAAI,cAAc,WAAW;AAAA,QAC5B,MAAM,MAAM,cAAc,OAAO,MAAM,SAAS;AAAA,MACjD;AAAA,MAEA,MAAM,UAAU,KAAK,MAAM;AAAA,MAC3B,KAAK,IAAI,QAAQ,IAAI,OAAO;AAAA,MAC5B,YAAY,OAAO,OAAO;AAAA,MAE1B,OAAO,KAAK,OAAO;AAAA;AAAA,SAGd,SAAQ,CAAC,IAAI;AAAA,MAClB,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,MAC1B,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AAAA;AAAA,SAG3C,UAAS,CAAC,KAAK;AAAA,MACpB,OAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC,OAAO;AAAA,QACxC,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,QAC1B,OAAO,WAAW,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AAAA,OAChD;AAAA;AAAA,SAGI,gBAAe,CAAC,MAAM,OAAO;AAAA,MAClC,MAAM,KAAK,QAAQ,IAAI,MAAM,MAAM,KAAK,CAAC;AAAA,MACzC,MAAM,SAAS,OAAO,YAAY,YAAY,KAAK,IAAI,EAAE;AAAA,MACzD,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM;AAAA;AAAA,SAG3C,UAAS,GAAG,MAAM,OAAO,SAAS;AAAA,MAGvC,MAAM,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,EAC3B,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EACnC,IAAI,CAAC,SAAS,KAAK,EAAE,EACrB,OAAO,CAAC,OAAO,UAAU,QAAQ,KAAK,KAAK,EAC3C,KAAK;AAAA,MACP,MAAM,UAAU,IAAI,MAAM,GAAG,KAAK;AAAA,MAClC,MAAM,OAAO,QAAQ,GAAG,EAAE;AAAA,MAE1B,OAAO;AAAA,QACN,OAAO,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,EAAE,CAAe,CAAC;AAAA,QAC3D,YAAY,IAAI,SAAS,SAAS,SAAS,YAAY,OAAO;AAAA,MAC/D;AAAA;AAAA,SAGK,WAAU,CAAC,IAAI,OAAO,WAAW;AAAA,MACtC,OAAO,aAAa,OAAO,IAAI,OAAO,SAAS;AAAA;AAAA,SAG1C,WAAU,CAAC,IAAI;AAAA,MACpB,MAAM,SAAS,KAAK,IAAI,EAAE;AAAA,MAC1B,IAAI,WAAW;AAAA,QAAW,OAAO;AAAA,MAEjC,KAAK,OAAO,EAAE;AAAA,MACd,WAAW,OAAO,MAAM;AAAA,MACxB,OAAO;AAAA;AAAA,EAET;AAAA;;;AC1DM,SAAS,mBAAkB,GAAgB;AAAA,EACjD,OAAO;AAAA,IACN,OAAO,gBAAgB;AAAA,IACvB,UAAU,mBAAmB;AAAA,IAC7B,QAAQ,iBAAiB;AAAA,EAC1B;AAAA;",
+  "debugId": "4BEC7DA3378A80BC64756E2164756E21",
   "names": []
 }

package/dist/chunks/{index-cntabs9d.js → index-rpp0bw6e.js}

@@ -1,7 +1,7 @@
 import {
   isSubjectSet2,
   formatTuple2
-} from "./index-kppkcbn5.js";
+} from "./index-spwh8b9z.js";
 
 // src/permissions/port/memory.ts
 function createMemoryRelations2() {
@@ -77,4 +77,4 @@ function copyTuple(tuple) {
 export { createMemoryRelations2 };
 
 //# debugId=0BA3AA406E650E8464756E2164756E21
-//# sourceMappingURL=index-cntabs9d.js.map
+//# sourceMappingURL=index-rpp0bw6e.js.map

package/dist/chunks/{index-kppkcbn5.js → index-spwh8b9z.js}

@@ -36,7 +36,6 @@ class JanusError2 extends Error {
     this.retryAfter = options?.retryAfter;
   }
 }
-
 // src/errors/janus-error/refusals.ts
 class UserInvalidError2 extends JanusError2 {
   name = "UserInvalidError";
@@ -99,7 +98,6 @@ class PermissionDepthError2 extends JanusError2 {
   name = "PermissionDepthError";
   code = "PERMISSION_DEPTH";
 }
-
 // src/errors/janus-error/status.ts
 function statusOf2(code) {
   switch (code) {
@@ -135,7 +133,6 @@ function statusOf2(code) {
       return 500;
   }
 }
-
 // src/errors/janus-error/store.ts
 class StoreFailure2 extends JanusError2 {
   name = "StoreFailure";
@@ -217,5 +214,5 @@ function parseSubject2(text) {
 
 export { JanusError2, UserInvalidError2, CredentialError2, UserInactiveError2, TokenError2, SecondFactorError2, StepUpRequiredError2, MailThrottledError2, InvalidCursorError2, UnsupportedError2, PermissionDepthError2, statusOf2, StoreFailure2, StoreConflict2, NotFoundError2, isSubjectSet2, subjectOf2, setOf2, isSetOf2, formatEntity2, formatSubject2, formatTuple2, parseTuple2, parseSubject2 };
 
-//# debugId=2BB721119E78839E64756E2164756E21
-//# sourceMappingURL=index-kppkcbn5.js.map
+//# debugId=B36CA6F795B9956364756E2164756E21
+//# sourceMappingURL=index-spwh8b9z.js.map

package/dist/chunks/{index-kppkcbn5.js.map → index-spwh8b9z.js.map}

@@ -9,7 +9,7 @@
     "/**\n * The id every decision in this package hangs on: a user's `id`, as `janus()`\n * mints it.\n *\n * In Ory, the equality between a Kratos identity id and Keto's `subject_id` is\n * a comment and a convention, restated in three repositories and enforced\n * nowhere. Here a user **is** a subject — see {@link subjectOf} — and that\n * shared vocabulary is the whole reason users and permissions are one package\n * rather than two: two packages would make this contract implicit, and an\n * implicit contract between independently versioned packages breaks silently.\n *\n * Opaque: compared with `===`, carried in a URL, logged, never parsed.\n */\nexport type SubjectId = string;\n\n/**\n * Something a permission is about or held by — a user, a record, a team — by\n * its type and its id.\n *\n * **Typed, unlike Keto's subjects.** One application has patients and staff,\n * and an object can hold a relation too (a record's team), so an id alone does\n * not say who. `type` is a user type of `janus()` or an object type of the\n * permission model, and the same word as a user's own `type`.\n */\nexport interface Entity {\n\treadonly type: string;\n\treadonly id: string;\n}\n\n/**\n * Everyone who holds `relation` on an entity — `team:t1#member` — which is how\n * a permission is inherited rather than granted.\n *\n * A tuple whose subject is a subject set lets a whole group be given access\n * with one write: granting a record's `viewer` to `team:t1#member` means every\n * member of that team can view it, and no member holds a tuple on the record.\n */\nexport interface SubjectSet extends Entity {\n\treadonly relation: string;\n}\n\n/**\n * Who a tuple is about: one entity, or everyone who holds a relation on one.\n * {@link isSubjectSet} tells them apart.\n */\nexport type Subject = Entity | SubjectSet;\n\n/**\n * A relation tuple: `subject` holds `relation` on `object`.\n *\n * `relation` is Zanzibar's word, and a tuple is Zanzibar's unit. What is not\n * carried over is Keto's `namespace`/`object` pair: here the object is an\n * {@link Entity}, with the `type` and `id` a user already has.\n */\nexport interface RelationTuple {\n\treadonly object: Entity;\n\treadonly relation: string;\n\treadonly subject: Subject;\n}\n\n/**\n * Whether this subject is a set rather than one entity. Narrows.\n *\n * It reads the shape, so pass a user through {@link subjectOf} first: a user\n * whose fields include a string `relation` would otherwise read as a set.\n */\nexport function isSubjectSet(subject: Subject): subject is SubjectSet {\n\treturn typeof (subject as { relation?: unknown }).relation === 'string';\n}\n\n/**\n * The subject a user is: their `type` and `id`, and nothing else.\n *\n * One line, and the entire join between the two sides of the package. It\n * takes the narrowest shape it reads, so the permissions side never has to\n * know what a user is, and it copies those two fields so none of the user's\n * own fields ever reaches a tuple.\n */\nexport function subjectOf(user: {\n\treadonly type: string;\n\treadonly id: SubjectId;\n}): Entity {\n\treturn { type: user.type, id: user.id };\n}\n\n/**\n * The mark `setOf()` puts on a set: a symbol property, so it survives a spread\n * and `Object.assign`, and no value read from a database or from JSON can\n * carry it. Registered with `Symbol.for`, so two copies of this module — two\n * bundles, two entry points — still agree on it.\n */\nconst SET_OF: unique symbol = Symbol.for('@nxgt/janus/setOf');\n\n/**\n * A subject set `setOf()` made: everyone who holds `relation` on `type:id`.\n *\n * Marked, because a user is passed to `can()` and `grant()` as it is, fields\n * flat on it: a user whose fields include `relation` must stay that user, and\n * never read as the set of whoever holds that relation on them. For an object\n * type, `{ type, id, relation }` is a set as written; for a user type — one\n * the model also declares as an object type — only `setOf()` makes one.\n *\n * A spread keeps the mark. `JSON.stringify` and `structuredClone` drop it:\n * through either, a set comes back as a user — call `setOf()` again, or\n * `parseSubject()` on its notation.\n */\nexport type SetOf<\n\tType extends string = string,\n\tRelation extends string = string,\n> = SubjectSet & {\n\treadonly type: Type;\n\treadonly relation: Relation;\n\treadonly [SET_OF]: true;\n};\n\n/**\n * A user or an object, never a set `setOf()` made: where a relation admits\n * `staff` but not `staff#managers`, a set passed there is refused at compile\n * time as it is at run time.\n */\nexport type NotASet = { readonly [SET_OF]?: never };\n\n/**\n * Everyone who holds `relation` on this user or object — `staff:s1#managers`.\n *\n * ```ts\n * await access.grant(record, 'viewers', setOf(ada, 'managers'));\n * ```\n *\n * Copies `type` and `id` only, like {@link subjectOf}: none of a user's own\n * fields reaches a tuple.\n */\nexport function setOf<const Type extends string, const Relation extends string>(\n\tentity: { readonly type: Type; readonly id: SubjectId },\n\trelation: Relation,\n): SetOf<Type, Relation> {\n\tif (\n\t\ttypeof entity !== 'object' ||\n\t\tentity === null ||\n\t\ttypeof entity.type !== 'string' ||\n\t\ttypeof entity.id !== 'string'\n\t) {\n\t\tthrow new TypeError('setOf: pass a user or { type, id }, then a relation');\n\t}\n\tif (typeof relation !== 'string' || relation === '') {\n\t\tthrow new TypeError('setOf: the relation must be a non-empty string');\n\t}\n\treturn Object.freeze({\n\t\ttype: entity.type,\n\t\tid: entity.id,\n\t\trelation,\n\t\t[SET_OF]: true as const,\n\t});\n}\n\n/**\n * Whether `setOf()` made this value, or a spread of one — what `can()` and\n * `grant()` read to tell a set on a user type from a user.\n */\nexport function isSetOf(value: unknown): value is SetOf {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t(value as { readonly [SET_OF]?: unknown })[SET_OF] === true\n\t);\n}\n",
     "import {\n\ttype Entity,\n\tisSubjectSet,\n\ttype RelationTuple,\n\ttype SetOf,\n\ttype Subject,\n\tsetOf,\n} from './subject';\n\n/**\n * Zanzibar's notation, with typed subjects:\n *\n * ```\n * record:r1#viewer@staff:u1\n * record:r1#viewer@team:t1#member\n * ```\n *\n * It exists for **messages, logs and documentation**, not as a wire format:\n * nothing in this package parses a tuple off the network, and a tuple that\n * crosses a boundary crosses it as an object. Keeping the notation is worth it\n * because every piece of Zanzibar writing uses it, so an error message in it is\n * an error message a reader has already learned to read.\n *\n * A type holds no `:`, and no part holds `@`, `#` or a parenthesis, so a\n * subject set needs no parentheses: after the `@`, a `#` can only begin its\n * relation. {@link parseTuple} refuses a string where that would not hold,\n * rather than reading it two ways.\n */\nexport function formatEntity(entity: Entity): string {\n\treturn `${entity.type}:${entity.id}`;\n}\n\n/** One subject: `staff:u1`, or `team:t1#member`. */\nexport function formatSubject(subject: Subject): string {\n\treturn isSubjectSet(subject)\n\t\t? `${formatEntity(subject)}#${subject.relation}`\n\t\t: formatEntity(subject);\n}\n\n/** One relation tuple, in the notation above. */\nexport function formatTuple(tuple: RelationTuple): string {\n\treturn `${formatEntity(tuple.object)}#${tuple.relation}@${formatSubject(tuple.subject)}`;\n}\n\nconst TYPE = '([^:@#()]+)';\nconst ID = '([^@#()]+)';\nconst RELATION = '([^:@#()]+)';\n\nconst TUPLE = new RegExp(`^${TYPE}:${ID}#${RELATION}@(.+)$`);\nconst SUBJECT = new RegExp(`^${TYPE}:${ID}(?:#${RELATION})?$`);\n\n/**\n * Reads a tuple back. Refuses, with a `TypeError`, a string that is not one —\n * a permission question built from a malformed string is a question whose\n * answer means nothing, and no request is behind it: the string came from a\n * developer's own code.\n */\nexport function parseTuple(text: string): RelationTuple {\n\tconst match = TUPLE.exec(text);\n\n\tif (!match) {\n\t\tthrow new TypeError(\n\t\t\t`parseTuple: \"${text}\" is not a relation tuple; expected type:id#relation@subject`,\n\t\t);\n\t}\n\n\tconst [, type, id, relation, subject] = match as unknown as [\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t];\n\n\treturn { object: { type, id }, relation, subject: parseSubject(subject) };\n}\n\n/**\n * Reads one subject back: `staff:u1`, or `team:t1#member`. A set is answered\n * as `setOf()` makes it, so `can()` and `grant()` read it as the set it names\n * on a user type too.\n */\nexport function parseSubject(text: string): Entity | SetOf {\n\tconst match = SUBJECT.exec(text);\n\n\tif (!match) {\n\t\tthrow new TypeError(\n\t\t\t`parseSubject: \"${text}\" is not a subject; expected type:id, or type:id#relation for a subject set`,\n\t\t);\n\t}\n\n\tconst [, type, id, relation] = match as unknown as [\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t\tstring | undefined,\n\t];\n\n\treturn relation === undefined ? { type, id } : setOf({ type, id }, relation);\n}\n"
   ],
-  "mappings": ";AAmBO,MAAM,oBAAmB,MAAM;AAAA,EAC5B,OAAO;AAAA,EACP,OAAuB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,WAAW,CAAC,SAAiB,SAA6B;AAAA,IACzD,MAAM,SAAS,EAAE,OAAO,SAAS,MAAM,CAAC;AAAA,IACxC,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,WAAW,SAAS;AAAA,IACzB,KAAK,QAAQ,SAAS;AAAA,IACtB,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,kBAAkB,SAAS;AAAA,IAChC,KAAK,gBAAgB,SAAS;AAAA,IAC9B,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,OAAO,SAAS;AAAA,IACrB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,WAAW,SAAS;AAAA,IACzB,KAAK,eAAe,SAAS;AAAA,IAC7B,KAAK,aAAa,SAAS;AAAA;AAE7B;;;ACnDO,MAAM,0BAAyB,YAAW;AAAA,EACvC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,yBAAwB,YAAW;AAAA,EACtC,OAAO;AAAA,EACE;AAAA,EAElB,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,2BAA0B,YAAW;AAAA,EACxC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAMO,MAAM,oBAAmB,YAAW;AAAA,EACjC,OAAO;AAAA,EACE;AAAA,EAElB,WAAW,CACV,MAQA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,2BAA0B,YAAW;AAAA,EACxC,OAAO;AAAA,EACE;AAAA,EAElB,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO;AAAA;AAEd;AAAA;AAMO,MAAM,6BAA4B,YAAW;AAAA,EAC1C,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAMO,MAAM,4BAA2B,YAAW;AAAA,EACzC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,4BAA2B,YAAW;AAAA,EACzC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,0BAAyB,YAAW;AAAA,EACvC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,8BAA6B,YAAW;AAAA,EAC3C,OAAO;AAAA,EACE,OAAO;AAC1B;;;ACjFO,SAAS,SAAQ,CAAC,MAAwC;AAAA,EAChE,QAAQ;AAAA,SACF;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA;AAAA;;;ACjDH,MAAM,sBAAqB,YAAW;AAAA,EACnC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AASO,MAAM,uBAAsB,YAAW;AAAA,EACpC,OAAO;AAAA,EACE;AAAA,EACT;AAAA,EAET,WAAW,CACV,IACA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,KAAK,OAAO,OAAO,UAAU,gBAAgB;AAAA;AAE/C;AAAA;AAGO,MAAM,uBAAsB,YAAW;AAAA,EACpC,OAAO;AAAA,EACE,OAAO;AAC1B;;ACsBO,SAAS,aAAY,CAAC,SAAyC;AAAA,EACrE,OAAO,OAAQ,QAAmC,aAAa;AAAA;AAWzD,SAAS,UAAS,CAAC,MAGf;AAAA,EACV,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG;AAAA;AASvC,IAAM,SAAwB,OAAO,IAAI,mBAAmB;AAyCrD,SAAS,MAA+D,CAC9E,QACA,UACwB;AAAA,EACxB,IACC,OAAO,WAAW,YAClB,WAAW,QACX,OAAO,OAAO,SAAS,YACvB,OAAO,OAAO,OAAO,UACpB;AAAA,IACD,MAAM,IAAI,UAAU,qDAAqD;AAAA,EAC1E;AAAA,EACA,IAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAAA,IACpD,MAAM,IAAI,UAAU,gDAAgD;AAAA,EACrE;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,IAAI,OAAO;AAAA,IACX;AAAA,KACC,SAAS;AAAA,EACX,CAAC;AAAA;AAOK,SAAS,QAAO,CAAC,OAAgC;AAAA,EACvD,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAA0C,YAAY;AAAA;;;ACvIlD,SAAS,aAAY,CAAC,QAAwB;AAAA,EACpD,OAAO,GAAG,OAAO,QAAQ,OAAO;AAAA;AAI1B,SAAS,cAAa,CAAC,SAA0B;AAAA,EACvD,OAAO,cAAa,OAAO,IACxB,GAAG,cAAa,OAAO,KAAK,QAAQ,aACpC,cAAa,OAAO;AAAA;AAIjB,SAAS,YAAW,CAAC,OAA8B;AAAA,EACzD,OAAO,GAAG,cAAa,MAAM,MAAM,KAAK,MAAM,YAAY,eAAc,MAAM,OAAO;AAAA;AAGtF,IAAM,OAAO;AACb,IAAM,KAAK;AACX,IAAM,WAAW;AAEjB,IAAM,QAAQ,IAAI,OAAO,IAAI,QAAQ,MAAM,gBAAgB;AAC3D,IAAM,UAAU,IAAI,OAAO,IAAI,QAAQ,SAAS,aAAa;AAQtD,SAAS,WAAU,CAAC,MAA6B;AAAA,EACvD,MAAM,QAAQ,MAAM,KAAK,IAAI;AAAA,EAE7B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,gBAAgB,kEACjB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,UAAU,WAAW;AAAA,EAQxC,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,UAAU,SAAS,cAAa,OAAO,EAAE;AAAA;AAQlE,SAAS,aAAY,CAAC,MAA8B;AAAA,EAC1D,MAAM,QAAQ,QAAQ,KAAK,IAAI;AAAA,EAE/B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,kBAAkB,iFACnB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,YAAY;AAAA,EAO/B,OAAO,aAAa,YAAY,EAAE,MAAM,GAAG,IAAI,OAAM,EAAE,MAAM,GAAG,GAAG,QAAQ;AAAA;",
-  "debugId": "2BB721119E78839E64756E2164756E21",
+  "mappings": ";AAmBO,MAAM,oBAAmB,MAAM;AAAA,EAC5B,OAAO;AAAA,EACP,OAAuB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,WAAW,CAAC,SAAiB,SAA6B;AAAA,IACzD,MAAM,SAAS,EAAE,OAAO,SAAS,MAAM,CAAC;AAAA,IACxC,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,WAAW,SAAS;AAAA,IACzB,KAAK,QAAQ,SAAS;AAAA,IACtB,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,kBAAkB,SAAS;AAAA,IAChC,KAAK,gBAAgB,SAAS;AAAA,IAC9B,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,OAAO,SAAS;AAAA,IACrB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,WAAW,SAAS;AAAA,IACzB,KAAK,eAAe,SAAS;AAAA,IAC7B,KAAK,aAAa,SAAS;AAAA;AAE7B;;ACnDO,MAAM,0BAAyB,YAAW;AAAA,EACvC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,yBAAwB,YAAW;AAAA,EACtC,OAAO;AAAA,EACE;AAAA,EAElB,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,2BAA0B,YAAW;AAAA,EACxC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAMO,MAAM,oBAAmB,YAAW;AAAA,EACjC,OAAO;AAAA,EACE;AAAA,EAElB,WAAW,CACV,MAQA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,2BAA0B,YAAW;AAAA,EACxC,OAAO;AAAA,EACE;AAAA,EAElB,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO;AAAA;AAEd;AAAA;AAMO,MAAM,6BAA4B,YAAW;AAAA,EAC1C,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAMO,MAAM,4BAA2B,YAAW;AAAA,EACzC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,4BAA2B,YAAW;AAAA,EACzC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,0BAAyB,YAAW;AAAA,EACvC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AAGO,MAAM,8BAA6B,YAAW;AAAA,EAC3C,OAAO;AAAA,EACE,OAAO;AAC1B;;ACjFO,SAAS,SAAQ,CAAC,MAAwC;AAAA,EAChE,QAAQ;AAAA,SACF;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,SACA;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA,SACH;AAAA,MACJ,OAAO;AAAA;AAAA;;ACjDH,MAAM,sBAAqB,YAAW;AAAA,EACnC,OAAO;AAAA,EACE,OAAO;AAC1B;AAAA;AASO,MAAM,uBAAsB,YAAW;AAAA,EACpC,OAAO;AAAA,EACE;AAAA,EACT;AAAA,EAET,WAAW,CACV,IACA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,KAAK;AAAA,IACV,KAAK,OAAO,OAAO,UAAU,gBAAgB;AAAA;AAE/C;AAAA;AAGO,MAAM,uBAAsB,YAAW;AAAA,EACpC,OAAO;AAAA,EACE,OAAO;AAC1B;;ACsBO,SAAS,aAAY,CAAC,SAAyC;AAAA,EACrE,OAAO,OAAQ,QAAmC,aAAa;AAAA;AAWzD,SAAS,UAAS,CAAC,MAGf;AAAA,EACV,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG;AAAA;AASvC,IAAM,SAAwB,OAAO,IAAI,mBAAmB;AAyCrD,SAAS,MAA+D,CAC9E,QACA,UACwB;AAAA,EACxB,IACC,OAAO,WAAW,YAClB,WAAW,QACX,OAAO,OAAO,SAAS,YACvB,OAAO,OAAO,OAAO,UACpB;AAAA,IACD,MAAM,IAAI,UAAU,qDAAqD;AAAA,EAC1E;AAAA,EACA,IAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAAA,IACpD,MAAM,IAAI,UAAU,gDAAgD;AAAA,EACrE;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,IAAI,OAAO;AAAA,IACX;AAAA,KACC,SAAS;AAAA,EACX,CAAC;AAAA;AAOK,SAAS,QAAO,CAAC,OAAgC;AAAA,EACvD,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAA0C,YAAY;AAAA;;;ACvIlD,SAAS,aAAY,CAAC,QAAwB;AAAA,EACpD,OAAO,GAAG,OAAO,QAAQ,OAAO;AAAA;AAI1B,SAAS,cAAa,CAAC,SAA0B;AAAA,EACvD,OAAO,cAAa,OAAO,IACxB,GAAG,cAAa,OAAO,KAAK,QAAQ,aACpC,cAAa,OAAO;AAAA;AAIjB,SAAS,YAAW,CAAC,OAA8B;AAAA,EACzD,OAAO,GAAG,cAAa,MAAM,MAAM,KAAK,MAAM,YAAY,eAAc,MAAM,OAAO;AAAA;AAGtF,IAAM,OAAO;AACb,IAAM,KAAK;AACX,IAAM,WAAW;AAEjB,IAAM,QAAQ,IAAI,OAAO,IAAI,QAAQ,MAAM,gBAAgB;AAC3D,IAAM,UAAU,IAAI,OAAO,IAAI,QAAQ,SAAS,aAAa;AAQtD,SAAS,WAAU,CAAC,MAA6B;AAAA,EACvD,MAAM,QAAQ,MAAM,KAAK,IAAI;AAAA,EAE7B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,gBAAgB,kEACjB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,UAAU,WAAW;AAAA,EAQxC,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,UAAU,SAAS,cAAa,OAAO,EAAE;AAAA;AAQlE,SAAS,aAAY,CAAC,MAA8B;AAAA,EAC1D,MAAM,QAAQ,QAAQ,KAAK,IAAI;AAAA,EAE/B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,kBAAkB,iFACnB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,YAAY;AAAA,EAO/B,OAAO,aAAa,YAAY,EAAE,MAAM,GAAG,IAAI,OAAM,EAAE,MAAM,GAAG,GAAG,QAAQ;AAAA;",
+  "debugId": "B36CA6F795B9956364756E2164756E21",
   "names": []
 }

package/dist/chunks/{index-4khsm7mw.js → index-y9b327j8.js}

@@ -2,22 +2,7 @@ import {
   JanusError2,
   InvalidCursorError2,
   StoreFailure2
-} from "./index-kppkcbn5.js";
-
-// src/pagination/cursor-page.ts
-var DEFAULT_PAGE_SIZE2 = 20;
-var MAX_PAGE_SIZE2 = 100;
-function pageLimit2(limit, where) {
-  if (limit === undefined)
-    return DEFAULT_PAGE_SIZE2;
-  if (!Number.isInteger(limit) || limit < 1) {
-    throw new TypeError(`${where}: limit must be an integer of at least 1, or absent`);
-  }
-  return Math.min(limit, MAX_PAGE_SIZE2);
-}
-function invalidCursor2(where, cursor) {
-  return new InvalidCursorError2(`${where}: this cursor was not minted by this store, or was minted for another ordering (${cursor.length} characters)`);
-}
+} from "./index-spwh8b9z.js";
 
 // src/stores/guard.ts
 var ANSWERS_NOTHING = new Set(["insertSession", "insertToken", "write"]);
@@ -69,7 +54,22 @@ function guardRelations(store) {
 var isStorable = (value) => !value.includes("\x00") && value.isWellFormed();
 var UNSTORABLE = "holds a NUL character or a lone surrogate, which no store can keep";
 
+// src/pagination/cursor-page.ts
+var DEFAULT_PAGE_SIZE2 = 20;
+var MAX_PAGE_SIZE2 = 100;
+function pageLimit2(limit, where) {
+  if (limit === undefined)
+    return DEFAULT_PAGE_SIZE2;
+  if (!Number.isInteger(limit) || limit < 1) {
+    throw new TypeError(`${where}: limit must be an integer of at least 1, or absent`);
+  }
+  return Math.min(limit, MAX_PAGE_SIZE2);
+}
+function invalidCursor2(where, cursor) {
+  return new InvalidCursorError2(`${where}: this cursor was not minted by this store, or was minted for another ordering (${cursor.length} characters)`);
+}
+
 export { guardStore, guardRelations, isStorable, UNSTORABLE, DEFAULT_PAGE_SIZE2, MAX_PAGE_SIZE2, pageLimit2, invalidCursor2 };
 
-//# debugId=7AD3830DC22148E664756E2164756E21
-//# sourceMappingURL=index-4khsm7mw.js.map
+//# debugId=5702950D83C4F86D64756E2164756E21
+//# sourceMappingURL=index-y9b327j8.js.map

package/dist/chunks/{index-4khsm7mw.js.map → index-y9b327j8.js.map}

@@ -1,12 +1,12 @@
 {
   "version": 3,
-  "sources": ["../src/pagination/cursor-page.ts", "../src/stores/guard.ts", "../src/stores/storable.ts"],
+  "sources": ["../src/stores/guard.ts", "../src/stores/storable.ts", "../src/pagination/cursor-page.ts"],
   "sourcesContent": [
-    "import { InvalidCursorError } from '../errors/janus-error';\n\n/**\n * One page of results, and where the next one starts.\n *\n * `nextCursor` is `null` on the last page and a string on every other, so\n * `while (cursor)` is the loop and there is no separate \"done\" flag to forget.\n *\n * **There is no `total`**, and that is deliberate — the same choice\n * `@nxgt/mongo`'s cursor page makes, for the same reason: an exact count over a\n * large table is a second scan, and no adapter should be made to promise one.\n * An application that needs a count asks its own store for one, where it can\n * decide what the count is allowed to cost.\n *\n * This type is **redefined here rather than imported** from `@nxgt/mongo`. That\n * is deliberate duplication, recorded in AGENTS.md: a port that every adapter\n * implements cannot make one database library a dependency of the contract.\n */\nexport interface CursorPage<T> {\n\treadonly items: readonly T[];\n\treadonly nextCursor: string | null;\n}\n\n/** How many a page holds when the caller did not say. */\nexport const DEFAULT_PAGE_SIZE = 20;\n\n/**\n * The most a page may hold, whatever the caller asked for.\n *\n * Bounded in the core rather than left to each adapter, so a caller cannot ask\n * one store for a million rows and be refused by another. An application that\n * wants everything pages for it.\n */\nexport const MAX_PAGE_SIZE = 100;\n\n/**\n * The limit a store will be given, from the limit a caller asked for.\n *\n * `where` names the call the consumer wrote — `listIdentities`, not an internal\n * function — because several calls in this package take a `limit` and a message\n * that does not say which one leaves the reader to guess. That naming rule is\n * `nxgt-data`'s, and it is the reason its errors read the way they do.\n *\n * A bare `TypeError`: a limit is written in the application's own code, so this\n * cannot come from a request.\n */\nexport function pageLimit(limit: number | undefined, where: string): number {\n\tif (limit === undefined) return DEFAULT_PAGE_SIZE;\n\n\tif (!Number.isInteger(limit) || limit < 1) {\n\t\tthrow new TypeError(\n\t\t\t`${where}: limit must be an integer of at least 1, or absent`,\n\t\t);\n\t}\n\n\treturn Math.min(limit, MAX_PAGE_SIZE);\n}\n\n/**\n * Refuses a cursor this store did not mint.\n *\n * Exported for adapter authors: a cursor from another store, another ordering\n * or another version of the adapter must be refused, **never treated as an\n * absent cursor**. A silent fall back to the first page makes a caller paging a\n * list loop for ever, and the loop looks like a slow query rather than a bug.\n */\nexport function invalidCursor(\n\twhere: string,\n\tcursor: string,\n): InvalidCursorError {\n\t// The cursor's own bytes are not in the message: it is opaque, it may be\n\t// long, and printing it tells the reader nothing they can act on. Its length\n\t// is enough to tell \"truncated in transit\" from \"written by another store\".\n\treturn new InvalidCursorError(\n\t\t`${where}: this cursor was not minted by this store, or was minted for another ordering (${cursor.length} characters)`,\n\t);\n}\n",
     "/**\n * **The one place a store's answer is caught**, shared by both sides of the\n * package: the identity stores and the relation store reach a caller only\n * through {@link guardStore}.\n *\n * - A `JanusError` the store threw passes through, so `instanceof` holds.\n * - **Anything else it threw is a failure** — `StoreFailure`, naming the slot\n *   and the method, with the original as `cause`. Never an absence.\n * - `undefined` where the port says `null` is a store that forgot to answer,\n *   and becomes `StoreFailure` rather than \"not found\".\n *\n * The `catch` below always rethrows; `src/auth/outage.scan.spec.ts` holds it to that.\n */\n\nimport {\n\ttype JanusError,\n\tJanusError as JanusErrorClass,\n\tStoreFailure,\n} from '../errors/janus-error';\nimport type { RelationStore } from '../permissions/port/types';\n\n/** A store the guard names in a `StoreFailure`: `users`, `sessions`, `tokens` or `relations`. */\nexport type StoreSlot = NonNullable<StoreFailure['slot']>;\n\n/**\n * The methods whose answer is legitimately nothing: `undefined` from them is\n * not a forgotten `return`. Every other method answers a value, `null`,\n * `false`, `0` or a page — **never `undefined`**.\n */\nconst ANSWERS_NOTHING = new Set(['insertSession', 'insertToken', 'write']);\n\nexport function guardStore<S extends object>(slot: StoreSlot, store: S): S {\n\tconst guarded: Record<string, unknown> = {};\n\n\tfor (const method of methodsOf(store)) {\n\t\tconst original = (store as Record<string, unknown>)[method];\n\t\tif (typeof original !== 'function') continue;\n\n\t\tguarded[method] = async (...args: unknown[]) => {\n\t\t\tlet answer: unknown;\n\n\t\t\ttry {\n\t\t\t\tanswer = await original.apply(store, args);\n\t\t\t} catch (error) {\n\t\t\t\t// Rethrown, always. The only question is under which class.\n\t\t\t\tthrow asFailure(error, slot, method);\n\t\t\t}\n\n\t\t\tif (answer === undefined && !ANSWERS_NOTHING.has(method)) {\n\t\t\t\tthrow new StoreFailure(\n\t\t\t\t\t`${slot}.${method} answered undefined: an absence is null, so this store forgot to answer`,\n\t\t\t\t\t{ slot, operation: method },\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn answer;\n\t\t};\n\t}\n\n\treturn guarded as S;\n}\n\n/** Own and prototype methods, so a class-based store is guarded like a literal. */\nfunction methodsOf(store: object): string[] {\n\tconst names = new Set<string>();\n\n\tfor (\n\t\tlet proto: object | null = store;\n\t\tproto !== null && proto !== Object.prototype;\n\t\tproto = Object.getPrototypeOf(proto)\n\t) {\n\t\tfor (const name of Object.getOwnPropertyNames(proto)) {\n\t\t\tif (name !== 'constructor') names.add(name);\n\t\t}\n\t}\n\n\treturn [...names];\n}\n\nfunction asFailure(\n\terror: unknown,\n\tslot: StoreSlot,\n\tmethod: string,\n): JanusError {\n\tif (error instanceof JanusErrorClass) return error;\n\n\t// The message names where, never what: a driver's message may hold a\n\t// connection string, and a connection string holds a password. It is kept\n\t// as `cause`, for the operator's logs.\n\treturn new StoreFailure(`${slot}.${method}: the store could not answer`, {\n\t\tslot,\n\t\toperation: method,\n\t\tcause: error,\n\t});\n}\n\n/**\n * The relation store, guarded the same way: the permission engine's only way\n * to a store, so a failure there is `STORE_FAILED` and never a denial.\n */\nexport function guardRelations(store: RelationStore): RelationStore {\n\treturn guardStore('relations', store);\n}\n",
-    "/**\n * What every store can keep. PostgreSQL refuses `\\u0000` in `text` and\n * `jsonb`, and a lone surrogate in `jsonb`; MongoDB and the memory store keep\n * both. The core refuses them before a store is asked, so a request that sends\n * one is answered the same way on every adapter — not `STORE_FAILED` on one of\n * them, a 503 for a database that is up.\n *\n * Shared by both sides of the package, like `guard.ts`: a string from a\n * request reaches the identity stores and the relation store alike.\n */\n\n/** Whether every store can keep this string. */\nexport const isStorable = (value: string): boolean =>\n\t!value.includes('\\u0000') && value.isWellFormed();\n\n/** What an issue says about a string no store can keep. */\nexport const UNSTORABLE =\n\t'holds a NUL character or a lone surrogate, which no store can keep';\n"
+    "/**\n * What every store can keep. PostgreSQL refuses `\\u0000` in `text` and\n * `jsonb`, and a lone surrogate in `jsonb`; MongoDB and the memory store keep\n * both. The core refuses them before a store is asked, so a request that sends\n * one is answered the same way on every adapter — not `STORE_FAILED` on one of\n * them, a 503 for a database that is up.\n *\n * Shared by both sides of the package, like `guard.ts`: a string from a\n * request reaches the identity stores and the relation store alike.\n */\n\n/** Whether every store can keep this string. */\nexport const isStorable = (value: string): boolean =>\n\t!value.includes('\\u0000') && value.isWellFormed();\n\n/** What an issue says about a string no store can keep. */\nexport const UNSTORABLE =\n\t'holds a NUL character or a lone surrogate, which no store can keep';\n",
+    "import { InvalidCursorError } from '../errors/janus-error';\n\n/**\n * One page of results, and where the next one starts.\n *\n * `nextCursor` is `null` on the last page and a string on every other, so\n * `while (cursor)` is the loop and there is no separate \"done\" flag to forget.\n *\n * **There is no `total`**, and that is deliberate — the same choice\n * `@nxgt/mongo`'s cursor page makes, for the same reason: an exact count over a\n * large table is a second scan, and no adapter should be made to promise one.\n * An application that needs a count asks its own store for one, where it can\n * decide what the count is allowed to cost.\n *\n * This type is **redefined here rather than imported** from `@nxgt/mongo`. That\n * is deliberate duplication, recorded in AGENTS.md: a port that every adapter\n * implements cannot make one database library a dependency of the contract.\n */\nexport interface CursorPage<T> {\n\treadonly items: readonly T[];\n\treadonly nextCursor: string | null;\n}\n\n/** How many a page holds when the caller did not say. */\nexport const DEFAULT_PAGE_SIZE = 20;\n\n/**\n * The most a page may hold, whatever the caller asked for.\n *\n * Bounded in the core rather than left to each adapter, so a caller cannot ask\n * one store for a million rows and be refused by another. An application that\n * wants everything pages for it.\n */\nexport const MAX_PAGE_SIZE = 100;\n\n/**\n * The limit a store will be given, from the limit a caller asked for.\n *\n * `where` names the call the consumer wrote — `listIdentities`, not an internal\n * function — because several calls in this package take a `limit` and a message\n * that does not say which one leaves the reader to guess. That naming rule is\n * `nxgt-data`'s, and it is the reason its errors read the way they do.\n *\n * A bare `TypeError`: a limit is written in the application's own code, so this\n * cannot come from a request.\n */\nexport function pageLimit(limit: number | undefined, where: string): number {\n\tif (limit === undefined) return DEFAULT_PAGE_SIZE;\n\n\tif (!Number.isInteger(limit) || limit < 1) {\n\t\tthrow new TypeError(\n\t\t\t`${where}: limit must be an integer of at least 1, or absent`,\n\t\t);\n\t}\n\n\treturn Math.min(limit, MAX_PAGE_SIZE);\n}\n\n/**\n * Refuses a cursor this store did not mint.\n *\n * Exported for adapter authors: a cursor from another store, another ordering\n * or another version of the adapter must be refused, **never treated as an\n * absent cursor**. A silent fall back to the first page makes a caller paging a\n * list loop for ever, and the loop looks like a slow query rather than a bug.\n */\nexport function invalidCursor(\n\twhere: string,\n\tcursor: string,\n): InvalidCursorError {\n\t// The cursor's own bytes are not in the message: it is opaque, it may be\n\t// long, and printing it tells the reader nothing they can act on. Its length\n\t// is enough to tell \"truncated in transit\" from \"written by another store\".\n\treturn new InvalidCursorError(\n\t\t`${where}: this cursor was not minted by this store, or was minted for another ordering (${cursor.length} characters)`,\n\t);\n}\n"
   ],
-  "mappings": ";;;;;;;AAwBO,IAAM,qBAAoB;AAS1B,IAAM,iBAAgB;AAatB,SAAS,UAAS,CAAC,OAA2B,OAAuB;AAAA,EAC3E,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAEhC,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC1C,MAAM,IAAI,UACT,GAAG,0DACJ;AAAA,EACD;AAAA,EAEA,OAAO,KAAK,IAAI,OAAO,cAAa;AAAA;AAW9B,SAAS,cAAa,CAC5B,OACA,QACqB;AAAA,EAIrB,OAAO,IAAI,oBACV,GAAG,wFAAwF,OAAO,oBACnG;AAAA;;;AC9CD,IAAM,kBAAkB,IAAI,IAAI,CAAC,iBAAiB,eAAe,OAAO,CAAC;AAElE,SAAS,UAA4B,CAAC,MAAiB,OAAa;AAAA,EAC1E,MAAM,UAAmC,CAAC;AAAA,EAE1C,WAAW,UAAU,UAAU,KAAK,GAAG;AAAA,IACtC,MAAM,WAAY,MAAkC;AAAA,IACpD,IAAI,OAAO,aAAa;AAAA,MAAY;AAAA,IAEpC,QAAQ,UAAU,UAAU,SAAoB;AAAA,MAC/C,IAAI;AAAA,MAEJ,IAAI;AAAA,QACH,SAAS,MAAM,SAAS,MAAM,OAAO,IAAI;AAAA,QACxC,OAAO,OAAO;AAAA,QAEf,MAAM,UAAU,OAAO,MAAM,MAAM;AAAA;AAAA,MAGpC,IAAI,WAAW,aAAa,CAAC,gBAAgB,IAAI,MAAM,GAAG;AAAA,QACzD,MAAM,IAAI,cACT,GAAG,QAAQ,iFACX,EAAE,MAAM,WAAW,OAAO,CAC3B;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,EAET;AAAA,EAEA,OAAO;AAAA;AAIR,SAAS,SAAS,CAAC,OAAyB;AAAA,EAC3C,MAAM,QAAQ,IAAI;AAAA,EAElB,SACK,QAAuB,MAC3B,UAAU,QAAQ,UAAU,OAAO,WACnC,QAAQ,OAAO,eAAe,KAAK,GAClC;AAAA,IACD,WAAW,QAAQ,OAAO,oBAAoB,KAAK,GAAG;AAAA,MACrD,IAAI,SAAS;AAAA,QAAe,MAAM,IAAI,IAAI;AAAA,IAC3C;AAAA,EACD;AAAA,EAEA,OAAO,CAAC,GAAG,KAAK;AAAA;AAGjB,SAAS,SAAS,CACjB,OACA,MACA,QACa;AAAA,EACb,IAAI,iBAAiB;AAAA,IAAiB,OAAO;AAAA,EAK7C,OAAO,IAAI,cAAa,GAAG,QAAQ,sCAAsC;AAAA,IACxE;AAAA,IACA,WAAW;AAAA,IACX,OAAO;AAAA,EACR,CAAC;AAAA;AAOK,SAAS,cAAc,CAAC,OAAqC;AAAA,EACnE,OAAO,WAAW,aAAa,KAAK;AAAA;;;ACzF9B,IAAM,aAAa,CAAC,UAC1B,CAAC,MAAM,SAAS,MAAQ,KAAK,MAAM,aAAa;AAG1C,IAAM,aACZ;",
-  "debugId": "7AD3830DC22148E664756E2164756E21",
+  "mappings": ";;;;;;;AA6BA,IAAM,kBAAkB,IAAI,IAAI,CAAC,iBAAiB,eAAe,OAAO,CAAC;AAElE,SAAS,UAA4B,CAAC,MAAiB,OAAa;AAAA,EAC1E,MAAM,UAAmC,CAAC;AAAA,EAE1C,WAAW,UAAU,UAAU,KAAK,GAAG;AAAA,IACtC,MAAM,WAAY,MAAkC;AAAA,IACpD,IAAI,OAAO,aAAa;AAAA,MAAY;AAAA,IAEpC,QAAQ,UAAU,UAAU,SAAoB;AAAA,MAC/C,IAAI;AAAA,MAEJ,IAAI;AAAA,QACH,SAAS,MAAM,SAAS,MAAM,OAAO,IAAI;AAAA,QACxC,OAAO,OAAO;AAAA,QAEf,MAAM,UAAU,OAAO,MAAM,MAAM;AAAA;AAAA,MAGpC,IAAI,WAAW,aAAa,CAAC,gBAAgB,IAAI,MAAM,GAAG;AAAA,QACzD,MAAM,IAAI,cACT,GAAG,QAAQ,iFACX,EAAE,MAAM,WAAW,OAAO,CAC3B;AAAA,MACD;AAAA,MAEA,OAAO;AAAA;AAAA,EAET;AAAA,EAEA,OAAO;AAAA;AAIR,SAAS,SAAS,CAAC,OAAyB;AAAA,EAC3C,MAAM,QAAQ,IAAI;AAAA,EAElB,SACK,QAAuB,MAC3B,UAAU,QAAQ,UAAU,OAAO,WACnC,QAAQ,OAAO,eAAe,KAAK,GAClC;AAAA,IACD,WAAW,QAAQ,OAAO,oBAAoB,KAAK,GAAG;AAAA,MACrD,IAAI,SAAS;AAAA,QAAe,MAAM,IAAI,IAAI;AAAA,IAC3C;AAAA,EACD;AAAA,EAEA,OAAO,CAAC,GAAG,KAAK;AAAA;AAGjB,SAAS,SAAS,CACjB,OACA,MACA,QACa;AAAA,EACb,IAAI,iBAAiB;AAAA,IAAiB,OAAO;AAAA,EAK7C,OAAO,IAAI,cAAa,GAAG,QAAQ,sCAAsC;AAAA,IACxE;AAAA,IACA,WAAW;AAAA,IACX,OAAO;AAAA,EACR,CAAC;AAAA;AAOK,SAAS,cAAc,CAAC,OAAqC;AAAA,EACnE,OAAO,WAAW,aAAa,KAAK;AAAA;;;ACzF9B,IAAM,aAAa,CAAC,UAC1B,CAAC,MAAM,SAAS,MAAQ,KAAK,MAAM,aAAa;AAG1C,IAAM,aACZ;;;ACOM,IAAM,qBAAoB;AAS1B,IAAM,iBAAgB;AAatB,SAAS,UAAS,CAAC,OAA2B,OAAuB;AAAA,EAC3E,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAEhC,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,GAAG;AAAA,IAC1C,MAAM,IAAI,UACT,GAAG,0DACJ;AAAA,EACD;AAAA,EAEA,OAAO,KAAK,IAAI,OAAO,cAAa;AAAA;AAW9B,SAAS,cAAa,CAC5B,OACA,QACqB;AAAA,EAIrB,OAAO,IAAI,oBACV,GAAG,wFAAwF,OAAO,oBACnG;AAAA;",
+  "debugId": "5702950D83C4F86D64756E2164756E21",
   "names": []
 }

package/dist/conformance/cases/outage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outage.d.ts","sourceRoot":"","sources":["../../../src/conformance/cases/outage.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,eAAe,EAAc,MAAM,UAAU,CAAC;AAkEzE,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EAuGjD,CAAC"}
+{"version":3,"file":"outage.d.ts","sourceRoot":"","sources":["../../../src/conformance/cases/outage.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,eAAe,EAAc,MAAM,UAAU,CAAC;AAkEzE,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EAkHjD,CAAC"}

package/dist/conformance/cases/tokens/deletion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deletion.d.ts","sourceRoot":"","sources":["../../../../src/conformance/cases/tokens/deletion.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EA6CxD,CAAC"}
+{"version":3,"file":"deletion.d.ts","sourceRoot":"","sources":["../../../../src/conformance/cases/tokens/deletion.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EA+FxD,CAAC"}

package/dist/conformance/describe.d.ts

@@ -5,6 +5,7 @@ export declare const allCases: readonly ConformanceCase[];
 export declare const SKIP_REASONS: {
     readonly faults: "faults not provided: the outage invariant is not proven for this adapter";
     readonly deleteExpiredSessions: "stores.sessions does not implement the optional deleteExpiredSessions";
+    readonly deleteExpiredTokens: "stores.tokens does not implement the optional deleteExpiredTokens";
     readonly findUsers: "stores.users does not implement the optional findUsers: findMany reads with findUser instead";
 };
 /**

package/dist/conformance/describe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/conformance/describe.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEX,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,MAAM,SAAS,CAAC;AAEjB,mDAAmD;AACnD,eAAO,MAAM,QAAQ,EAAE,SAAS,eAAe,EAK9C,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,YAAY;;;;CAOf,CAAC;AAEX;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC5B,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,kBAAkB,GACzB,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC,CAiBnE;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,IAAI,CASP;AAED,oEAAoE;AACpE,UAAU,aAAa;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CAC5C;AAQD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,aAAa,EAAE,OAAO,EAAE;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,CACb,eAAe,EAAE,CAAC,KACd,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC,GAAG,IAAI,CA6CP;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAgB5D"}
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/conformance/describe.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEX,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,MAAM,SAAS,CAAC;AAEjB,mDAAmD;AACnD,eAAO,MAAM,QAAQ,EAAE,SAAS,eAAe,EAK9C,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,YAAY;;;;;CASf,CAAC;AAEX;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC5B,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,kBAAkB,GACzB,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC,CAiBnE;AAsBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,IAAI,CASP;AAED,oEAAoE;AACpE,UAAU,aAAa;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CAC5C;AAQD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,aAAa,EAAE,OAAO,EAAE;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,CACb,eAAe,EAAE,CAAC,KACd,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;CACrC,GAAG,IAAI,CA6CP;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAgB5D"}