@owlmeans/iam 0.1.18-rc.14 → 0.1.18-rc.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -13,7 +13,7 @@ Provider-agnostic IAM abstraction for the OwlMeans framework — `IamService` in
13
13
  ## Installation
14
14
 
15
15
  ```bash
16
- bun add @owlmeans/iam
16
+ bun add @owlmeans/iam@^0.1.18-rc.15
17
17
  ```
18
18
 
19
19
  ## Usage
@@ -36,7 +36,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
36
36
  your project's skill store (`.agents/skills/`):
37
37
 
38
38
  ```sh
39
- npx @owlmeans/agent-skills
39
+ npx @owlmeans/agent-skills@^0.1.18-rc.12
40
40
  ```
41
41
 
42
42
  The embedded files are version-matched to this package release. Do not edit them
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
3
  "package": "@owlmeans/iam",
4
- "version": "0.1.18-rc.14",
5
- "generatedAt": "2026-09-01T16:28:56.987Z",
4
+ "version": "0.1.18-rc.16",
5
+ "generatedAt": "2026-09-04T22:43:25.440Z",
6
6
  "canonicalRepo": "https://github.com/owlmeans/common",
7
7
  "entries": [
8
8
  {
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: iam
3
- description: "IamService abstraction for provider-agnostic IAM provisioning. Load when wiring IAM operations, switching IAM mode, or implementing a new IAM provider. Applies to files matching **/services/iam*.ts, **/context.ts, **/types.ts."
3
+ description: "How to use @owlmeans/iam — the provider-agnostic IamService, the permission-definition and two-form grant model, client-id uniqueness, issuer and redirect-URI rules, and hasPermission. Load when wiring IAM operations, granting or revoking permissions, selecting the IAM backend, or implementing a new IAM provider. Applies to files matching **/services/iam*.ts, **/context.ts, **/types.ts."
4
4
  metadata:
5
5
  applyTo: "**/services/iam*.ts, **/context.ts, **/types.ts"
6
6
  ---
@@ -8,7 +8,46 @@ metadata:
8
8
 
9
9
  # Using `@owlmeans/iam`
10
10
 
11
- Provider-agnostic IAM abstraction. Defines `IamService` interface and related types. Used by both the platform backend (`viable-backend`) and the agent library (`@owlmeans/viable`). Concrete implementations live in `@owlmeans/iam-keycloak` (full proxy) and `@owlmeans/iam-integrated`.
11
+ **Install:** `"@owlmeans/iam": "^0.1.18-rc.16"` in `dependencies`
12
+
13
+ Provider-agnostic IAM abstraction: the `IamService` interface, the permission and grant shapes, the
14
+ gate-param grammar, and `hasPermission`. It contains no implementation and talks to no provider —
15
+ concrete backends (a Keycloak proxy, an integrated backend built on the OwlMeans OIDC provider) are
16
+ separate packages, and every consumer depends on this interface rather than on one of them.
17
+
18
+ ## The browser half — `@owlmeans/client-iam`
19
+
20
+ `@owlmeans/client-iam` has no skill of its own because it is a wiring package: it re-exports these
21
+ types and `hasPermission`, and adds the two calls that turn "this application uses IAM" into two
22
+ lines.
23
+
24
+ | Export | Description |
25
+ |--------|-------------|
26
+ | `appendIam(context, opts?)` | Wires the OIDC guard onto a web context **and** installs the consent-before-sign-in precondition |
27
+ | `setupIam(entrypoints, coguards?)` | Wires the same guard onto the entrypoint list, and attaches the dispatcher screen |
28
+ | `requireConsentForLogin(ctx, opts?)` | That precondition on its own, for a context wired some other way |
29
+ | `CONSENT_LOGIN_PRECONDITION` / `CLIENT_IAM_SERVICE` | The precondition alias and the service alias |
30
+ | `useLogin` / `useLogout`, `LoginOutcome` / `LoginIntent`, `LoginPlugin` / `LoginService` / … | Re-exported sign-in surface, so an app has one IAM import rather than three |
31
+ | Everything from `@owlmeans/iam` | The types above, plus `hasPermission` |
32
+
33
+ Two rules ride on it. **`setupIam` is called exactly once per entrypoint list** — it appends the OIDC
34
+ dispatcher entrypoints to the list it is given rather than returning a new one, and then elevates
35
+ three aliases in place. **Calling it twice fails silently, it does not throw.** Elevation is
36
+ idempotent: it replaces the *first* element carrying the alias and only raises when the alias is
37
+ absent (`Entrypoint with alias … not present`, which a list missing the `DISPATCHER` declaration
38
+ hits). So a second `setupIam` — or a `setupOidcGuard` from `@owlmeans/web-oidc-rp` called alongside
39
+ it — leaves the same declarations in the list twice and re-elevates them, with no error and no
40
+ warning, and the dispatcher screen ends up as whatever the later call attached: a parametrised
41
+ dispatcher is quietly swapped for the default. An app that calls `setupIam` must therefore not also
42
+ call `setupOidcGuard` itself.
43
+
44
+ And the consent precondition sits on `LoginService.begin` rather than on a hook, a screen or a login
45
+ plugin, because `begin` is the single funnel every sign-in mechanic passes through and the one place
46
+ the user's gesture is still live — a refusal resolves as `LoginOutcome.Gesture` and opens the consent dialog in
47
+ the same gesture. An application that genuinely sets no cookie passes `{ consent: { disabled: true } }`.
48
+
49
+ The server half of the same story is `@owlmeans/server-iam` — the IAM gate that asserts the grants
50
+ this package's screens hand out. Permission decisions are made there, never in the browser.
12
51
 
13
52
  ## Public API surface
14
53
 
@@ -18,24 +57,38 @@ Provider-agnostic IAM abstraction. Defines `IamService` interface and related ty
18
57
  | `IamClient` | type | Provisioned OIDC client `{ id?, clientId, secret?, name?, realm? }` |
19
58
  | `IamClientOptions` | type | `{ redirectUris? }` — explicit `ensureClient` hardening; omitting is a keycloak-only legacy shape (see below) |
20
59
  | `IamCredentialsPair` | type | `{ token: string; realm: string }` |
21
- | `IamPermissionArgs` | type | `{ permission?, resourceScoped?, title? }` — `permission` absent means unscoped resource name |
60
+ | `IamPermissionArgs` | type | `{ permission?, resourceScoped?, title?, area?, managed? }` — `permission` absent means unscoped resource name |
22
61
  | `IamResourceSpec` | type | `{ name: string; displayName?: string }` |
23
- | `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, title? }` |
24
- | `IamGrantArgs` | type | `{ resources?: string[] }` — present = resource-scoped grant form |
25
- | `IamGrant` | type | `{ profileId, clientId, permission, resources? }` |
62
+ | `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, title?, area?, managed? }` |
63
+ | `IamPermissionFilter` | type | `{ areas?, managed?, resourceScoped? }` — narrows `listPermissions`; an `areas` entry of `null` matches untagged definitions |
64
+ | `IamGrantArgs` | type | `{ resources?: string[], mode? }` |
65
+ | `IamGrant` | type | `{ profileId, clientId, permission, resources?, mode? }` |
66
+ | `IamGrantMode` | enum | `Blanket` / `Resources` / `All` — which FORM of a grant an operation addresses |
67
+ | `IamGrantBundle` | type | `{ filter?, permissions?, mode?, resources? }` — what `grantBundle` hands out |
68
+ | `IamRemovalPolicy` | enum | `Cascade` / `Refuse` — what to do about grants of a definition being deleted |
69
+ | `IamPermissionDeleteArgs`, `IamPermissionRemoval` | type | `{ policy?, managed? }` and `{ permission, clientId, found, revoked }` |
70
+ | `IamNormalizeArgs`, `IamNormalizationReport` | type | `{ dryRun? }` and the rename/merge plan `normalizePermissions` reports |
71
+ | `IAM_AREAS`, `IamArea` | const/type | `['user', 'operator', 'admin']` — presentational grouping tags, read by no gate |
72
+ | `PERMISSION_ACTION_SEPARATOR` | const | `'--'` — TWO hyphens, never one |
73
+ | `parsePermissionName` / `composePermissionName` / `isPermissionName` | fn | Read, build and validate a permission NAME |
74
+ | `ParsedPermissionName` | type | `{ name, resource, action?, problem? }` |
26
75
  | `IamUser` | type | End-user of an entity `{ profileId, email?, name?, role, disabled?, grantCount? }` |
27
76
  | `IamUserInvite` | type | `{ email, name?, role? }` — find-or-create args |
28
77
  | `IamUserUpdate` | type | `{ name?, role?, disabled? }` |
29
78
  | `hasPermission` | fn | `(auth, permission, { scope?, resourceId? }?)` — checks `Authorization.permissions` PermissionSet[]; an unscoped set satisfies a resourceId check |
79
+ | `HasPermissionOptions` | type | `{ scope?, resourceId? }` |
80
+ | Gate grammar | fn/type | `parseGateParam`, `parseGateSelector`, `formatGateParam`, `resolveGateResource`, `validateGateParams`, `routeParamsOf`, plus `RESOURCE_*_SEPARATOR`, `GateParamSource`, `DEFAULT_GATE_PARAM_SOURCES`, `GateParamErrorCode`, `GateResolutionFailure` and the `Gate*` types. The syntax itself is documented in the `server-iam` skill |
30
81
  | `DEFAULT_ALIAS` | const | Default service alias `'iam-service'` |
31
82
  | `IAM_MODE_KEYCLOAK` | const | `'keycloak'` |
32
83
  | `IAM_MODE_INTEGRATED` | const | `'integrated'` |
33
84
  | `IamMode` | type | `'keycloak' \| 'integrated'` |
34
85
  | `IamError` | class | Base IAM error |
35
- | `IamClientError` | class | Thrown when an OIDC client is missing a required field (e.g. `secret`) |
36
- | `IamResourceError` | class | Thrown when a KC resource returns with no name |
86
+ | `IamClientError` | class | An OIDC client is invalid or unusable — missing `secret`, unusable `redirect_uris`, `client:entity-mismatch`, an unconfigured provider route |
87
+ | `IamResourceError` | class | A provider resource returned with no name |
37
88
  | `IamGrantError` | class | Grant subject missing or entity mismatch |
38
- | `IamUnsupported` | class | Operation not supported by the active backend (e.g. resource-scoped grants on Keycloak) |
89
+ | `IamPermissionError` | class | A refusal about a DEFINITION: `permission:held:<name>`, `permission:managed:<name>` |
90
+ | `IamUserError` | class | An end-user operation was refused |
91
+ | `IamUnsupported` | class | Operation not supported by the active backend (e.g. `resource-scoped-grant`, `user-management`) |
39
92
 
40
93
  ## Permission model (two grant forms)
41
94
 
@@ -49,23 +102,36 @@ subjects with `grantPermission`:
49
102
  Grants materialize as OwlMeans `PermissionSet[]` (`scope` = clientId; resource-scoped grants live in a
50
103
  dedicated set per permission carrying `resources[]`, because `resources` applies to all keys of a set).
51
104
 
105
+ A **name** is `<resource>--<action>`, with two hyphens. One hyphen is not a separator: `enquiry-view`
106
+ is a resource named `enquiry-view` with no action, and it must keep parsing that way, because a name
107
+ already granted somewhere cannot be reinterpreted without orphaning the grant. Build and read names
108
+ through `composePermissionName` / `parsePermissionName` rather than splitting strings.
109
+
110
+ `resourceScoped: true` says a permission *may* be bound to resource ids, not that it must be. The
111
+ same name is grantable in both forms and they are stored separately, which is what `IamGrantMode`
112
+ addresses: `Blanket` is the set carrying no `resources` (and `hasPermission` reads it as covering
113
+ every id), `Resources` is an explicit id list, and `All` is revoke-only. The defaults are asymmetric
114
+ on purpose — `grantPermission` defaults to `Blanket`, `revokePermission` to `All`, because a bare
115
+ revoke has always meant "remove it everywhere". Pass `mode` explicitly rather than relying on either.
116
+
117
+ `area` is a presentational grouping tag (`IAM_AREAS`, or any string a deployment defines) and decides
118
+ nothing at request time. `managed: true` marks a definition the platform owns: an operator cannot
119
+ revoke it from an undifferentiated list, and a repair that deletes "definitions no declaration names"
120
+ must not reach one.
121
+
52
122
  ## `IamService` interface
53
123
 
54
124
  ```ts
55
125
  interface IamService extends InitializedService {
56
- // Get the admin OIDC provider config for a tenant (used in payment provisioning, RP config)
126
+ // The tenant's admin OIDC provider config, and a raw admin { token, realm } pair.
57
127
  getEntityAdminConfig: (entityId: string) => Promise<OidcProviderConfig>
58
-
59
- // Get an admin { token, realm } pair for raw low-level calls (avoid unless necessary)
60
128
  getCredentialsPair: (entityId: string) => Promise<IamCredentialsPair>
61
129
 
62
- // The tenant's public, fully-qualified OIDC issuer URL — the single value a relying party needs.
63
- // Config-only (no remote call); throws IamClientError when the provider route is unconfigured.
130
+ // The tenant's public issuer URL — see "Issuer & redirect URIs".
64
131
  getIssuerUrl: (entityId: string) => Promise<string>
65
132
 
66
- // Provision an OIDC client for a tenant and return its credentials.
67
- // options.redirectUris hardens the client; always pass them (see "Issuer & redirect URIs").
68
- // MUST refuse an existing record owned by another entity — see "A client id is a global name".
133
+ // Provision an OIDC client for a tenant — see "Issuer & redirect URIs" and
134
+ // "A client id is a global name" for the two rules it has to obey.
69
135
  ensureClient: (entityId: string, clientId: string, options?: IamClientOptions) => Promise<IamClient>
70
136
 
71
137
  // Reserve a free client id without provisioning it; false when anyone else holds it.
@@ -74,32 +140,42 @@ interface IamService extends InitializedService {
74
140
  // Release a client id and everything keyed by it (called when a project/slot is deleted).
75
141
  deleteClient: (entityId: string, clientId: string) => Promise<void>
76
142
 
77
- // Provision a named permission on a client resource; returns the resource name
143
+ // Declare a permission. Returns the canonical name. MERGES into an existing definition —
144
+ // resource/action re-derived, omitted flags kept — and NEVER rewrites the name. Refuses a
145
+ // `resource` carrying an `@` selector.
78
146
  ensurePermission: (entityId: string, clientId: string, resource?: string, args?: IamPermissionArgs) => Promise<string>
79
147
 
80
- // Provision a resource and assign it to the tenant's owner role (used in payment provisioning)
148
+ // Remove definitions BY NAME, and by default their grants. Idempotent ({ found: false } when
149
+ // absent). Grants go first: a crash between the stores must leave a definition with no grants,
150
+ // never grants with no definition. A `managed` definition needs args.managed === true.
151
+ deletePermission: (entityId: string, clientId: string, permission: string | string[], args?: IamPermissionDeleteArgs) => Promise<IamPermissionRemoval[]>
152
+
153
+ // Repair definitions whose stored name leaked a gate selector, moving grants in the same write.
154
+ // A rename and a merge — never a delete, never an invention.
155
+ normalizePermissions: (entityId: string, clientId: string, args?: IamNormalizeArgs) => Promise<IamNormalizationReport>
156
+
157
+ // Provision a resource and assign it to the tenant's owner role
81
158
  ensureResourceOwnership: (entityId: string, clientId: string, resource: IamResourceSpec) => Promise<void>
82
159
 
83
160
  // --- Authorization (permission definitions & grants) ---
84
161
 
85
- // List permission definitions registered for the entity's client
86
- listPermissions: (entityId: string, clientId: string) => Promise<IamPermissionDefinition[]>
162
+ listPermissions: (entityId: string, clientId: string, filter?: IamPermissionFilter) => Promise<IamPermissionDefinition[]>
87
163
 
88
- // Grant a permission to an end-user subject; args.resources = resource-scoped form
164
+ // args.resources selects the resource-scoped form; see "Permission model (two grant forms)"
89
165
  grantPermission: (entityId: string, clientId: string, profileId: string, permission: string, args?: IamGrantArgs) => Promise<IamGrant>
90
-
91
- // Revoke; with args.resources only those ids are removed, else the whole grant
92
166
  revokePermission: (entityId: string, clientId: string, profileId: string, permission: string, args?: IamGrantArgs) => Promise<void>
93
167
 
94
- // List grants for the client, optionally for one subject
168
+ // Grant everything a bundle selects to each subject, idempotently, in ONE read and write per
169
+ // subject. Returns what each subject now holds, not what changed. Use it instead of looping over
170
+ // grantPermission, which costs N·M writes and N·M lost-update windows on the same records.
171
+ grantBundle: (entityId: string, clientId: string, profileIds: string[], bundle: IamGrantBundle) => Promise<IamGrant[]>
172
+
95
173
  listGrants: (entityId: string, clientId: string, profileId?: string) => Promise<IamGrant[]>
96
174
 
97
- // --- End-user management (customer-wide users, shared per entityId) ---
175
+ // --- End-user management — see "End-users are customer-wide" ---
98
176
 
99
- // Every end-user of the entity. clientId scopes the reported grantCount — it does NOT filter.
100
177
  listUsers: (entityId: string, clientId?: string) => Promise<IamUser[]>
101
178
  getUser: (entityId: string, profileId: string) => Promise<IamUser | null>
102
- // Find-or-create by email — the one way an end-user record comes into existence.
103
179
  inviteUser: (entityId: string, invite: IamUserInvite) => Promise<IamUser>
104
180
  updateUser: (entityId: string, profileId: string, update: IamUserUpdate) => Promise<IamUser>
105
181
  removeUser: (entityId: string, profileId: string) => Promise<void>
@@ -115,9 +191,9 @@ has authenticated against a project but holds no grant there is still that proje
115
191
  screen that hands out grants is exactly where they have to be visible.
116
192
 
117
193
  `inviteUser` is idempotent by email, which is what lets an invitation and a first sign-in converge on
118
- one record instead of accumulating twins. Backends that have no user store of their own (keycloak,
119
- where the customer manages realm users in its console) throw `IamUnsupported('user-management')` from
120
- all five methods; callers turn that into an "external console" fallback rather than an error.
194
+ one record instead of accumulating twins. A backend with no user store of its own — one where the
195
+ customer manages users in the provider's own console — throws `IamUnsupported('user-management')`
196
+ from all five methods.
121
197
 
122
198
  ## A client id is a global name
123
199
 
@@ -138,15 +214,8 @@ cannot namespace it on a consumer's behalf. Uniqueness has to be *in the id*.
138
214
 
139
215
  ## `IamClient.realm` field
140
216
 
141
- `realm` is set by the provider to the entity ID. Use it instead of accessing internal properties:
142
-
143
- ```ts
144
- // ✓ correct
145
- await meta.update('oidcRealm', client.realm ?? fallbackEntityId)
146
-
147
- // ✗ never do this — internal Keycloak implementation detail
148
- await meta.update('oidcRealm', (client as any)._realm)
149
- ```
217
+ `realm` is set by the provider to the entity id, so read `client.realm ?? fallbackEntityId` and never
218
+ reach into an adapter's own internals (`(client as any)._realm`) for the same value.
150
219
 
151
220
  ## Issuer & redirect URIs
152
221
 
@@ -167,39 +236,63 @@ config is self-sufficient too.
167
236
 
168
237
  **Always pass `redirectUris`.** Omitting them is a keycloak-only legacy default (`['*']`, which
169
238
  Keycloak expands per-origin). The integrated provider does exact `redirect_uri` matching and
170
- `oidc-provider` refuses to load a client whose `redirect_uris` are not absolute URIs — so
171
- `iam-integrated.ensureClient` throws `IamClientError('redirect-uris')` on creation rather than
239
+ `oidc-provider` refuses to load a client whose `redirect_uris` are not absolute URIs — so an
240
+ integrated backend's `ensureClient` throws `IamClientError('redirect-uris')` on creation rather than
172
241
  registering a client that can never complete a callback. An omitted list never widens an existing
173
242
  hardened client.
174
243
 
175
- ## Selecting the IAM provider
244
+ ## Selecting the IAM backend
176
245
 
177
- The platform wires the correct implementation via the `IAM_MODE` environment variable. The default is **`integrated`** (the internal IAM); `IAM_MODE=keycloak` is opt-in, used mainly for custom / standalone customer production setups. Do not read `IAM_MODE` directly from feature code — it belongs in the service-factory only (the platform exposes `resolveIamMode()` / `isIntegratedIam()` from `viable-common`):
246
+ The choice is made **once, in a service factory**, and nowhere else. Feature code depends on
247
+ `IamService` and never learns which implementation answers it. `IAM_MODE_INTEGRATED` /
248
+ `IAM_MODE_KEYCLOAK` and `OidcIamConfig.iamMode` (`@owlmeans/oidc`) exist so a deployment can carry
249
+ that choice as ordinary configuration rather than as a branch scattered through handlers. No OwlMeans
250
+ package reads `iamMode`; it is declared for the consumer's own factory to switch on, which is the
251
+ only thing that may branch.
178
252
 
179
253
  ```ts
180
- export const makeIamService = (mode = resolveIamMode()) => {
181
- if (mode === IAM_MODE_KEYCLOAK) return makeIamKeycloakService(VIABLE_IAM, { oidcProductAlias: OIDC_PRODUCT })
182
- // Pass the consumer's OWN service alias + base path: the package defaults ('manager-api',
183
- // '/oidc') are placeholders, and a mismatch makes every cfg.services[...] lookup miss.
184
- return makeIamIntegratedService(VIABLE_IAM, {
185
- providerServiceAlias: MANAGER_API, providerBasePath: IAM_PROVIDER_BASE_PATH,
186
- })
187
- }
254
+ import { DEFAULT_ALIAS, IAM_MODE_INTEGRATED, IAM_MODE_KEYCLOAK } from '@owlmeans/iam'
255
+ import type { IamMode, IamService } from '@owlmeans/iam'
256
+
257
+ // makeKeycloakAdapter / makeIntegratedAdapter are PLACEHOLDER names standing in for whichever
258
+ // adapter packages the deployment installs — this factory is the one place either is named, and
259
+ // every consumer resolves IamService by alias instead. An adapter exposes a
260
+ // `(alias?: string, options?: object) => IamService` factory whose alias defaults to DEFAULT_ALIAS.
261
+ export const makeIamService = (mode: IamMode = IAM_MODE_INTEGRATED): IamService =>
262
+ mode === IAM_MODE_KEYCLOAK
263
+ ? makeKeycloakAdapter(DEFAULT_ALIAS, /* adapter options */)
264
+ : makeIntegratedAdapter(DEFAULT_ALIAS, /* adapter options */)
265
+
266
+ // cfg.oidc typed as OidcSharedConfig & OidcIamConfig is what carries the mode
267
+ context.registerService(makeIamService(cfg.oidc?.iamMode))
188
268
  ```
189
269
 
190
- When a context hosts **more than one** `IamService` instance (the viable agent registers both
191
- `viable-backend`'s and the agent library's), every instance must be constructed with the same
192
- options — otherwise they disagree about the issuer.
270
+ An adapter that reassembles the issuer from a registered service alias plus a base path must be given
271
+ the **consumer's own** alias and path. Whatever an adapter defaults to is a placeholder, and a
272
+ mismatch makes every service lookup behind `getIssuerUrl` miss.
193
273
 
194
- ## Rules
274
+ An integrated backend — one built on `@owlmeans/server-oidc-provider`, so the deployment hosts its
275
+ own provider — is the default choice; a Keycloak-backed adapter exists for deployments that already
276
+ run one.
195
277
 
196
- - Always depend on `IamService` from `@owlmeans/iam`, not on `KeycloakApiService` directly.
197
- - Do not expose `getCredentialsPair` to request handlers — it returns a raw admin token.
198
- - `IamClientError` means the provisioned client was invalid (missing secret, null token). The proxy already throws it; callers only need to handle it, not re-throw wrapped errors.
199
- - The `realm` field on `IamClient` is guaranteed to be set by all concrete implementations.
278
+ When a context hosts **more than one** `IamService` instance, every instance must be constructed with
279
+ the same options — otherwise they disagree about the issuer, and only one of them can be right.
200
280
 
201
- ## Related instructions
281
+ ## Rules
202
282
 
203
- - `@owlmeans/iam-keycloak` (internal) — full proxy over Keycloak; see the `iam-keycloak` skill
204
- - `@owlmeans/keycloak` (internal) — low-level KC admin API; see the `keycloak` skill
205
- - `@owlmeans/server-iam` — IAM gate asserting both grant forms; see the `server-iam` skill
283
+ - Always depend on `IamService`, never on a backend's own admin client.
284
+ - Do not expose `getCredentialsPair` to request handlers — it returns a raw admin token.
285
+ - `IamClientError` means the provisioned client was invalid (missing secret, null token). The adapter
286
+ already throws it; callers handle it rather than re-throwing a wrapped error.
287
+ - `IamClient.realm` is set by every concrete implementation.
288
+ - An operation a backend cannot support throws `IamUnsupported('<what>')`. Callers turn that into a
289
+ fallback — an "external console" link, a disabled control — rather than an error screen.
290
+
291
+ ## Related
292
+
293
+ - `@owlmeans/server-iam` — the IAM gate that asserts both grant forms, and the gate-param grammar;
294
+ see the `server-iam` skill
295
+ - `@owlmeans/oidc` — provider descriptors and the `iamMode` config seam; see the `oidc` skill
296
+ - The concrete adapters (a Keycloak proxy, and the integrated backend built on
297
+ `@owlmeans/server-oidc-provider` plus `@owlmeans/server-auth-identity`) ship separately and are
298
+ reached only through `IamService`.
package/build/consts.d.ts CHANGED
@@ -89,7 +89,7 @@ export declare enum IamRemovalPolicy {
89
89
  * deliberately absent: a public surface declares no permissions, and adding an area later would
90
90
  * re-classify names already tagged.
91
91
  */
92
- export declare const IAM_AREAS: readonly ["user", "operator", "admin"];
92
+ export declare const IAM_AREAS: readonly ['user', 'operator', 'admin'];
93
93
  export type IamArea = typeof IAM_AREAS[number];
94
94
  /** Separates the resource from the action in a permission name. TWO hyphens, never one. */
95
95
  export declare const PERMISSION_ACTION_SEPARATOR = "--";
@@ -1 +1 @@
1
- {"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,iBAAiB,GAAG,OAAO,mBAAmB,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,wCAAyC,CAAA;AAE/D,MAAM,MAAM,OAAO,GAAG,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;AAE9C,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,OAAO,CAAA"}
1
+ {"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,iBAAiB,GAAG,OAAO,mBAAmB,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,YAAI,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAE/D,MAAM,MAAM,OAAO,GAAG,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;AAE9C,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,OAAO,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;gBAErD,OAAO,SAAU;CAI9B;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;gBAE3D,OAAO,SAAU;CAI9B;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;gBAE7D,OAAO,SAAU;CAI9B;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;gBAE1D,OAAO,SAAU;CAI9B;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,OAAuB,QAAQ,SAA4C;gBAE/D,OAAO,SAAU;CAI9B;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAA6C;gBAEhE,OAAO,SAAU;CAI9B;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAsC;gBAEzD,OAAO,SAAU;CAI9B"}
1
+ {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;IAEjE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;IAEvE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;IAEzE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,OAAuB,QAAQ,SAA4C;IAE3E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAA6C;IAE5E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAsC;IAErE,YAAY,OAAO,SAAU,EAG5B;CACF"}
@@ -1 +1 @@
1
- {"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEjE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAC/B,CAAC;;AAGH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,YAAY,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEvE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;;AAGH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACrC,MAAM,CAAU,QAAQ,GAAG,cAAc,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEzE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IACvC,CAAC;;AAGH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAClC,MAAM,CAAU,QAAQ,GAAG,WAAW,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEtE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;;AAGH;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IACvC,MAAM,CAAU,QAAQ,GAAG,gBAAgB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE3E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAA;IACzC,CAAC;;AAGH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,iBAAiB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE5E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;;AAGH,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACjC,MAAM,CAAU,QAAQ,GAAG,UAAU,cAAc,CAAC,QAAQ,EAAE,CAAA;IAErE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAA;IACnC,CAAC;;AAGH,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;AACnD,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;AAChD,cAAc,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AACrD,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA"}
1
+ {"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEjE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,YAAY,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEvE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACrC,MAAM,CAAU,QAAQ,GAAG,cAAc,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEzE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IACvC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAClC,MAAM,CAAU,QAAQ,GAAG,WAAW,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEtE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IACvC,MAAM,CAAU,QAAQ,GAAG,gBAAgB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE3E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,iBAAiB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE5E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACjC,MAAM,CAAU,QAAQ,GAAG,UAAU,cAAc,CAAC,QAAQ,EAAE,CAAA;IAErE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAA;IACnC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;AACnD,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;AAChD,cAAc,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AACrD,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"param.d.ts","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAI1F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,KAAG,oBAAoB,GAAG,gBA6C3E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,eAoB9C,CAAA;AAED,2FAA2F;AAC3F,eAAO,MAAM,eAAe,GAC1B,YAAY,MAAM,EAClB,WAAW,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,KAC/D,MAmBF,CAAA"}
1
+ {"version":3,"file":"param.d.ts","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAI1F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,aAAc,MAAM,KAAG,oBAAoB,GAAG,gBA6C3E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,eAoB9C,CAAA;AAED,2FAA2F;AAC3F,eAAO,MAAM,eAAe,eACd,MAAM,aACP,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,KAC/D,MAmBF,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA4EhG;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAC9B,KAAK,eAAe,EAAE,UAAU,oBAAoB,KACnD,sBA2BF,CAAA"}
1
+ {"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA4EhG;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QACzB,eAAe,YAAY,oBAAoB,KACnD,sBA2BF,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGrE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC/C,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAA;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,EAAE,CAAA;QACnB;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,MAAuB,EAAW,EAAE;IAC1E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,CAAA;QAC9C,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAA;QAC5C,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,CAAA;QAC1C,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,OAAO,CAAA;QAChD,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,CAAA;IAC5C,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,IAAI,GAAG,CACX,SAAkB,EAAE,IAAc,EAAE,MAAuB,EACN,EAAE;IACvD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,aAAa,EAAE,CAAA;IACxD,CAAC;IAED,IAAI,MAAM,GAAY,SAAS,CAAA;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC;YAC/D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;YAC1B,CAAC,CAAC,UAAU,CAAA;QAEd,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,IAAI,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,GAAoB,EAAE,QAA8B,EAC5B,EAAE;IAC1B,IAAI,MAAM,GAA0B,qBAAqB,CAAC,aAAa,CAAA;IAEvE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAEjE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,2FAA2F;YAC3F,2DAA2D;YAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,CAAC,SAAS,EAAE,CAAC;gBACtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YAChD,CAAC;YACD,IAAI,MAAM,KAAK,qBAAqB,CAAC,aAAa,EAAE,CAAC;gBACnD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YACxB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC,CAAA"}
1
+ {"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGrE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC/C,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAA;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,EAAE,CAAA;QACnB;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,MAAuB,EAAW,EAAE;IAC1E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,CAAA;QAC9C,KAAK,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,CAAA;QAC5C,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,CAAA;QAC1C,KAAK,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,CAAA;QAChD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,CAAA;IAC5C,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,IAAI,GAAG,CACX,SAAkB,EAAE,IAAc,EAAE,MAAuB,EACN,EAAE;IACvD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,aAAa,EAAE,CAAA;IACxD,CAAC;IAED,IAAI,MAAM,GAAY,SAAS,CAAA;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC;YAC/D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;YAC1B,CAAC,CAAC,UAAU,CAAA;QAEd,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,IAAI,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,GAAoB,EAAE,QAA8B,EAC5B,EAAE;IAC1B,IAAI,MAAM,GAA0B,qBAAqB,CAAC,aAAa,CAAA;IAEvE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAEjE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,2FAA2F;YAC3F,2DAA2D;YAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,CAAC,SAAS,EAAE,CAAC;gBACtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YAChD,CAAC;YACD,IAAI,MAAM,KAAK,qBAAqB,CAAC,aAAa,EAAE,CAAC;gBACnD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YACxB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAA;AAGvF,gDAAgD;AAChD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAM,EAGH,CAAA;AA0FhD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,EAAE,QAAQ,cAAc,KAAG,cAAc,EAsB3F,CAAA"}
1
+ {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAA;AAGvF,gDAAgD;AAChD,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,EAGH,CAAA;AA0FhD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,EAAE,UAAU,cAAc,KAAG,cAAc,EAsB3F,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAY,EAAE,CACtD,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KAC3B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;KAC5C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AAOhD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,GAAW,EAAW,EAAE;IACvE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,MAAoB,CAAA;IACjE,IAAI,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAqB,EAAE,MAAuB,EAAsB,EAAE;IACvF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,CAAA;QACtD,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAA;QACpD,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,CAAA;QAC1D,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,MAAM,CAAA;QACxD,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,SAAS,CAAA;IAC7C,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,KAAqB,EAAE,QAA8B,EACf,EAAE;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+FAA+F;IAC/F,6FAA6F;IAC7F,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;WAChC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE3E,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACpF,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;gBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;sBAClE,6DAA6D;aAClE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAChG,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;gBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;aACvE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,wBAAwB,GAAG,sCAAsC;kBAC3F,6DAA6D;SAClE,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAgB,EAAE,KAAsB,EAAoB,EAAE;IAC/F,MAAM,MAAM,GAAqB,EAAE,CAAA;IAEnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAEpC,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5E,SAAQ;QACV,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAC7C,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACnD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
1
+ {"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAY,EAAE,CACtD,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KAC3B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;KAC5C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AAOhD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,GAAW,EAAW,EAAE;IACvE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,MAAoB,CAAA;IACjE,IAAI,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAqB,EAAE,MAAuB,EAAsB,EAAE;IACvF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,CAAA;QACtD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAA;QACpD,KAAK,eAAe,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,CAAA;QAC1D,KAAK,eAAe,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,MAAM,CAAA;QACxD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,KAAqB,EAAE,QAA8B,EACf,EAAE;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+FAA+F;IAC/F,6FAA6F;IAC7F,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;WAChC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE3E,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACpF,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;gBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;sBAClE,6DAA6D;aAClE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAChG,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;gBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;aACvE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,wBAAwB,GAAG,sCAAsC;kBAC3F,6DAA6D;SAClE,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAgB,EAAE,KAAsB,EAAoB,EAAE;IAC/F,MAAM,MAAM,GAAqB,EAAE,CAAA;IAEnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAEpC,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5E,SAAQ;QACV,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAC7C,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACnD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,KAAG,oBAsBlD,CAAA;AAED,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,GAChC,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAC3C,MAEiE,CAAA;AAEpE,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,OACU,CAAA"}
1
+ {"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,oBAsBlD,CAAA;AAED,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,UACzB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAC3C,MAEiE,CAAA;AAEpE,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,OACU,CAAA"}
@@ -1 +1 @@
1
- {"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,EACnB,YAAY,MAAM,EAClB,OAAO,oBAAoB,KAC1B,OAIO,CAAA"}
1
+ {"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,SAClB,aAAa,cACP,MAAM,SACX,oBAAoB,KAC1B,OAIO,CAAA"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@owlmeans/iam",
3
- "version": "0.1.18-rc.14",
3
+ "version": "0.1.18-rc.16",
4
4
  "license": "MIT",
5
5
  "type": "module",
6
6
  "scripts": {
@@ -22,11 +22,11 @@
22
22
  }
23
23
  },
24
24
  "dependencies": {
25
- "@owlmeans/auth": "^0.1.18-rc.8",
26
- "@owlmeans/context": "^0.1.18-rc.7",
27
- "@owlmeans/error": "^0.1.18-rc.7",
28
- "@owlmeans/oidc": "^0.1.18-rc.11",
29
- "@owlmeans/route": "^0.1.18-rc.7"
25
+ "@owlmeans/auth": "^0.1.18-rc.9",
26
+ "@owlmeans/context": "^0.1.18-rc.8",
27
+ "@owlmeans/error": "^0.1.18-rc.8",
28
+ "@owlmeans/oidc": "^0.1.18-rc.13",
29
+ "@owlmeans/route": "^0.1.18-rc.9"
30
30
  },
31
31
  "devDependencies": {
32
32
  "@owlmeans/dep-config": "workspace:*",