npm - @sanoma-ai/workflows - Versions diffs - 0.11.9 → 0.11.12 - Mend

@sanoma-ai/workflows 0.11.9 → 0.11.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md CHANGED Viewed

@@ -260,9 +260,13 @@ What a workflow cannot do itself, the runtime does as operations of the vendor `
 | `sanoma.secret.delete`       | `{ name }`                                                                      | `{}`                                    | Deletes the selected stored value, including a database URL export; none stored is nothing to do. External bindings and read-only stores refuse deletion. Effect `write`                                                                                                                                                                     |
 | `sanoma.secretStore.prepare` | `{ company, environment, database: { $secret: "NAME" }, store: "RUNTIME_URL" }` | `{ company, environment, role, store }` | Initializes an existing company database's private KMS schema and restricted runtime login; saves its URL under `store`. Retried with the same stored credential; conflicting ownership is refused. Effect `access`. See [database preparation](KMS-SECRETS.md#preparing-the-company-database)                                               |
 | `sanoma.invite.mint`         | `{ host, email, key: secret("NAME") }`                                          | `{ url }`                               | Seals an invite request for `email` (good for five minutes) under the signing key stored as `NAME`, an instance's `SANOMA_SIGNING_KEY` (`sealInvite` with that key), posts it to `<host>/auth/invite` and answers the one-use link it mints; the ledger records `url` as `"<url>"`. Retried on a status worth retrying. Effect `access`      |
-| `sanoma.token.mint`          | `{ subject, groups, store: "NAME" }`                                            | `{ id }`                                | Mints an api token (`SanomaClient.tokens`) acting for `subject` in `groups`, stores it under `store` (refused when `store` holds a value), and answers its id alone; a host takes it as `secret("NAME")`. Not retried. Effect `access`                                                                                                       |
+| `sanoma.token.mint`          | `{ id?, reference?, subject, groups, store: "NAME" }`                           | `{ id }`                                | Saves an API token under `store` before registering its hash and authority. An identical active registration can retry; conflicting or revoked registrations are refused. Answers its id alone; a host takes the value as `secret("NAME")`. Idempotent. Effect `access`                                                                      |
 | `sanoma.token.revoke`        | `{ id }`                                                                        | `{}`                                    | Revokes the token: it resolves to nobody from now on. Effect `access`                                                                                                                                                                                                                                                                        |
+`sanoma.token.mint` accepts either a recorded UUID-shaped `id` or a stable non-secret `reference`, never both. Prefer `reference` when the workflow has no token ID yet: record a value unique to that provisioning incarnation (for example, `cloud-signup:<original-run-id>`) in the company record before minting. The runtime derives the same ID from that reference across runs. Reuse it with the same secret name, subject and group membership. Explicit IDs also accept the UUID-shaped hash values returned by minting, without requiring RFC version/variant bits. Without either input, the runtime derives an ID from the call's idempotency key, which is stable for retries of that call but changes in a new run. The bearer is saved in the selected secret store before its hash is registered, so a lost store or database response can reuse the saved value. Only the ID, reference and other non-secret metadata enter workflow inputs, results and the ledger. Do not put credentials in a reference.
+An existing registration must have the same ID, bearer, subject and group membership and remain active. A conflict never changes its authority, revives a revoked registration or revokes another token. Keep the saved bearer while its registration outcome is uncertain; deleting the secret does not revoke its token. The provisioning workflow still owns its lifecycle claim and recovery checks: a stable token ID is not a lock and does not reconcile another vendor's uncertain creation outcome.
 For a database URL export, `<EXPORT>` must contain one or more uppercase letters, digits or underscores: for example, `ctx.sanoma.secret.delete({ name: "SANOMA_DATABASE_URL_CLOUD_ACME" })`. This removes only that value from the configured store. It does not delete the database, revoke its login or retire a KMS key. The lifecycle workflow must retire the resource and access first, then remove its stored URL; deleting `SANOMA_DATABASE_URL` or another runtime bootstrap secret remains refused.
 `sanoma.run.inspect` reports `active` (queued, running or waiting), `finished`, `failed`, `cancelled`, `interrupted` (recovery attempts exhausted) or `missing`; an unknown DBOS status remains `active`. A run outside the configured application is `missing`. Inspection failures throw a sanitized error rather than reporting completion. The result is a snapshot, not a lock or fence: `missing` does not prove completion, and cancellation or exhausted recovery attempts do not prove an in-flight vendor action has stopped. Lifecycle recovery must separately establish resource ownership and reconcile uncertain effects before taking over.
@@ -665,6 +669,8 @@ A stopped worker cannot launch again in its process, so whoever supervises it st
 A database is a resource type that holds the company's database (a Neon project, a Supabase project): `defineResource({ …, writable: true, afterCreate, database })`, where `database` (`DatabaseSpec`) says what it can do (`capabilities: { pauses, branch }`: its compute scales to zero and wakes on a connection; it makes copy-on-write branches that carry the data), where it takes going live's choices, by dotted path into its fields (`inputs: { region, size? }`), the regions it takes when known (`regions`), the operation that stores its URL (`storeUrl`) and how its state reads (`outputs(state) → { healthy }`). `storeUrl` is an operation of the type's own vendor, in the type's own group (`neon.project.storeUrl`) or another (`supabase.database.storeUrl`), never one of a resource type's own: it takes `{ ref | id, export }` and stores the URL that carries `LISTEN` as `SANOMA_DATABASE_URL_<EXPORT>` (`databaseUrlSecret(export)`; `storeDatabaseUrl` stores it so, refusing a secret that holds another), never returning it, and the type's `afterCreate` calls it. A database type is not `stateless`: apply asks before it deletes one. `defineResource` refuses a `database` that breaks any of that; `resolveConfig` refuses one whose `storeUrl` is not among the config's operations, or does not take a binding id and an export. Its conformance kit is [`@sanoma-ai/testing/database`](../testing/README.md#a-databases-conformance). After retiring a database, a workflow can remove its exported URL with `sanoma.secret.delete` under the [runtime operation contract](#the-runtimes-own-operations).
+`databaseUrlSecret` converts camel-case exports to uppercase words (`mainStore` → `SANOMA_DATABASE_URL_MAIN_STORE`) and preserves exports that are already uppercase, including digits and underscores (`CLOUD_ACME_97F9` → `SANOMA_DATABASE_URL_CLOUD_ACME_97F9`). Use the same export when storing, binding and retiring its URL.
 ### Secrets
 Never put a secret in a workflow's input or an operation's input or output. They are persisted verbatim: DBOS keeps every step's input and output in Postgres, the ledger records each call's input and output, an approval a policy asks for carries the held call's input, and the app shows all of it to anyone who can reach it. A driver reads its credentials when it is called (from the environment or a secret store), and an operation that creates a secret (an API key, a password reset link) returns a reference to where it is stored, not the secret.

package/dist/database.js CHANGED Viewed

@@ -5,7 +5,10 @@ import { RESOURCE_OPS } from "./wakeup.js";
  * The secret a database's `storeUrl` stores its URL in, for the data file's export that declares
  * it: `store` → `SANOMA_DATABASE_URL_STORE`, `mainStore` → `SANOMA_DATABASE_URL_MAIN_STORE`.
  */
-export const databaseUrlSecret = (exportName) => `SANOMA_DATABASE_URL_${exportName.replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase()}`;
+export const databaseUrlSecret = (exportName) => {
+    const upper = exportName.toUpperCase();
+    return `SANOMA_DATABASE_URL_${exportName === upper ? upper : exportName.replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase()}`;
+};
 /**
  * A `storeUrl`'s store: `url` as `databaseUrlSecret(exportName)`, whose name it returns. The store
  * only adds: a secret that holds another URL (another database, or a password since changed) is

package/dist/database.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"database.js","sourceRoot":"","sources":["../src/database.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAW,MAAM,SAAS,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA+C3C;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAU,EAAE,~~CAC9D~~,uBAAuB,UAAU,CAAC,UAAU,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;~~AAE9F~~;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,UAAkB,EAClB,GAAW,EACX,EAAE,KAAK,EAAE,MAAM,EAAqC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,KAAK,MAAM,uBAAuB,MAAM,gCAAgC,EAAE;YACtG,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,QAAsB,EACtB,IAOC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAClH,MAAM,YAAY,GAAkC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACjD,IAAI,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,IAAI,wBAAwB,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,MAAM,GAAG,CAAC,CAAC;IACpH,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAY,QAAQ,CAAC,QAAQ,CAAC;IAC5C,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrG,QAAQ,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,MAAM,kBAAkB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,IAAK,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,4DAA4D,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,yBAAyB,QAAQ,6CAA6C,CAAC,CAAC;IAChG,CAAC;IACD,IACE,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,EAC/F,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACrG,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAoC,EAAE,GAA4B;IACjG,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8BAA8B,IAAI,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CAAC,CAAC;QACjH,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAClG,CAAC;QACD,8FAA8F;QAC9F,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}
1	+ {"version":3,"file":"database.js","sourceRoot":"","sources":["../src/database.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAW,MAAM,SAAS,CAAC;AAG/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA+C3C;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAU,EAAE;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,uBAAuB,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACpI,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,UAAkB,EAClB,GAAW,EACX,EAAE,KAAK,EAAE,MAAM,EAAqC;IAEpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,KAAK,MAAM,uBAAuB,MAAM,gCAAgC,EAAE;YACtG,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,QAAsB,EACtB,IAOC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAClH,MAAM,YAAY,GAAkC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU,EAAE,CAAC;QACjD,IAAI,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,IAAI,wBAAwB,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,MAAM,GAAG,CAAC,CAAC;IACpH,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAY,QAAQ,CAAC,QAAQ,CAAC;IAC5C,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrG,QAAQ,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,MAAM,kBAAkB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,IAAK,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,4DAA4D,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,yBAAyB,QAAQ,6CAA6C,CAAC,CAAC;IAChG,CAAC;IACD,IACE,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,EAC/F,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACrG,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAoC,EAAE,GAA4B;IACjG,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8BAA8B,IAAI,CAAC,QAAQ,CAAC,QAAQ,oCAAoC,CAAC,CAAC;QACjH,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAClG,CAAC;QACD,8FAA8F;QAC9F,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/runtime-ops.d.ts CHANGED Viewed

@@ -181,8 +181,11 @@ export declare const sanoma: import("./op.ts").Connector<"sanoma", {
     readonly token: {
         readonly mint: {
             readonly effect: "access";
+            readonly idempotent: true;
             readonly description: "Mint an api token acting for a subject in groups, store it under a name, and answer its id (never the token)";
             readonly input: z.ZodObject<{
+                id: z.ZodOptional<z.ZodGUID>;
+                reference: z.ZodOptional<z.ZodString>;
                 subject: z.ZodString;
                 groups: z.ZodArray<z.ZodString>;
                 store: z.ZodString;

package/dist/runtime-ops.js CHANGED Viewed

@@ -6,7 +6,7 @@ import { generateSecret, SECRET_NAME } from "./secret.js";
 import { sealInvite } from "./seal.js";
 import { errorMessage } from "./shared.js";
 import { sourceKeyPair, sshPublicKey } from "./ssh-key.js";
-import { memoryTokens } from "./tokens.js";
+import { memoryTokens, newApiToken } from "./tokens.js";
 import { identityProvisioningCode, memoryIdentityProvisioning, } from "./identity-provisioning.js";
 import { prepareSecretStore, memoryStorageProvisioning, storageProvisioningCode, } from "./storage-provisioning.js";
 // What a workflow cannot do itself and the runtime does for it, as operations of the vendor
@@ -152,12 +152,22 @@ export const sanoma = defineConnector("sanoma", {
     token: {
         mint: {
             effect: "access",
+            idempotent: true,
             description: "Mint an api token acting for a subject in groups, store it under a name, and answer its id (never the token)",
-            input: z.object({
+            input: z
+                .object({
+                id: z.guid().optional().describe("A recorded UUID-shaped token ID for recovery across workflow runs"),
+                reference: z
+                    .string()
+                    .min(1)
+                    .max(1024)
+                    .optional()
+                    .describe("A stable non-secret provisioning reference, recorded before minting; alternative to id"),
                 subject: z.string().regex(/^\S+$/, "a principal's id, such as visitor:better-auth:<id>"),
                 groups: z.array(z.string().min(1)),
                 store: SecretName.describe("The secret the token is stored under"),
-            }),
+            })
+                .refine(({ id, reference }) => id === undefined || reference === undefined, "Pass id or reference, not both"),
             output: z.object({ id: z.string() }),
             target: ({ subject }) => subject,
             createsSecrets: ({ store }) => [store],
@@ -174,9 +184,10 @@ export const sanoma = defineConnector("sanoma", {
 });
 /** A `DriverError` that a retry would not change. */
 const refuse = (message) => new DriverError(`sanoma: ${message}`, { retryable: false });
-/** The token id a call mints, from its idempotency key: the same on every try of one call, so a retry finds its own. */
-function tokenIdOf(call) {
-    const hex = createHash("sha256").update(call.idempotencyKey).digest("hex");
+/** Stable identity from a recorded reference, or this call's idempotency key when none was supplied. */
+function tokenIdOf(call, reference) {
+    const key = reference === undefined ? call.idempotencyKey : JSON.stringify(["sanoma.token.reference", reference]);
+    const hex = createHash("sha256").update(key).digest("hex");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 /** The 32 bytes of a signing key stored as text (base64, or base64url as `generate` makes one), or a refusal. */
@@ -303,30 +314,22 @@ export function runtimeDriver({ tokens, identities, inspect, storage = prepareSe
             },
         },
         token: {
-            async mint({ subject, groups, store }, call) {
-                const id = tokenIdOf(call);
-                const held = await call.secrets.get(store);
-                if (held !== undefined) {
-                    // This call's own, stored by a try whose answer was lost.
-                    if ((await tokens.resolve(held))?.principal.id === `token:${id}`)
-                        return { id };
-                    throw refuse(`${store} holds a value already: delete it, or store the token under another name`);
-                }
-                let token;
+            async mint({ id: requestedId, reference, subject, groups, store }, call) {
+                const id = requestedId ?? tokenIdOf(call, reference);
+                // Persist the bearer before registration. A lost store or database response can then
+                // retry the same value; no live token is created whose only copy was in this process.
+                const token = await call.secrets.ensure(store, newApiToken);
+                if (!/^sca_[A-Za-z0-9_-]{43}$/.test(token))
+                    throw refuse(`${store} holds a value that is not an api token`);
+                let registered;
                 try {
-                    ({ token } = await tokens.mint({ id, subject, groups }));
-                }
-                catch (err) {
-                    // A try that minted this id and stopped before storing it left a token nobody holds: revoked here.
-                    if ((await tokens.subjectOf(id)) === undefined)
-                        throw err;
-                    await tokens.revoke({ id });
-                    throw refuse(`an earlier try minted token ${id} and stopped before storing it: it is revoked, start again`);
+                    registered = await tokens.register({ id, token, subject, groups });
                 }
-                if ((await call.secrets.ensure(store, () => token)) !== token) {
-                    await tokens.revoke({ id });
-                    throw refuse(`${store} was stored by someone else meanwhile: the token minted is revoked`);
+                catch {
+                    throw new DriverError("sanoma: token registration unavailable", { retryable: true });
                 }
+                if (!registered)
+                    throw refuse(`${store} holds a token with conflicting or revoked registration`);
                 return { id };
             },
             async revoke({ id }) {

package/dist/runtime-ops.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime-ops.js","sourceRoot":"","sources":["../src/runtime-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAoB,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AAExD,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,2BAA2B,CAAC;AAEnC,4FAA4F;AAC5F,oGAAoG;AACpG,4FAA4F;AAC5F,iGAAiG;AACjG,gGAAgG;AAEhG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;AACtG,0EAA0E;AAC1E,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CACxC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EACrC,8DAA8D,CAC/D,CAAC;AACF,2GAA2G;AAC3G,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,CACjD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EACtF,wEAAwE,CACzE,CAAC;AAEF,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC;CACjG,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC5E,MAAM,cAAc,GAAG,CAAC,EAAE,UAAU,EAA0B,EAAE,EAAE,CAAC,UAAU,CAAC;AAE9E,+FAA+F;AAC/F,iGAAiG;AACjG,KAAK,UAAU,aAAa,CAAC,KAA0B;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE;IAC9C,GAAG,EAAE;QACH,OAAO,EAAE;YACP,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,yJAAyJ;YAC3J,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;gBACjB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;gBACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAChC,CAAC;YACF,MAAM,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,KAAK;SAChD;KACF;IACD,WAAW,EAAE;QACX,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,sIAAsI;YACxI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;gBACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,KAAK,EAAE,UAAU;aAClB,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAA4C,EAAE,EAAE,CAC7E,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACxC,cAAc,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;SAC1D;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,4IAA4I;YAC9I,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvF,MAAM,EAAE,cAAc;YACtB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;SAC1D;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,qGAAqG;YACvG,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,cAAc;SACvB;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,sFAAsF;YACnG,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,cAAc;SACvB;KACF;IACD,MAAM,EAAE;QACN,QAAQ,EAAE;YACR,MAAM,EAAE,OAAO;YACf,qEAAqE;YACrE,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,2LAA2L;YAC7L,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;aACpG,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;aAC9F,CAAC;YACF,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;SACvD;QACD,MAAM,EAAE;YACN,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,8HAA8H;YAChI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;SACvD;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,gGAAgG;YAChG,yCAAyC;YACzC,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,6KAA6K;YAC/K,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;gBAC1G,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;gBAC1E,GAAG,EAAE,CAAC;qBACH,YAAY,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;qBACrC,QAAQ,CAAC,oEAAoE,CAAC;aAClF,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,wFAAwF;YACxF,MAAM,EAAE,CAAC,KAAK,CAAC;SAChB;KACF;IACD,KAAK,EAAE;QACL,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,WAAW,EACT,8GAA8G;YAChH,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oDAAoD,CAAC;gBACxF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAClC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,sCAAsC,CAAC;aACnE,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAuB,EAAE,EAAE,CAAC,OAAO;YACrD,cAAc,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;SAC1D;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,wDAAwD;YACrE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE;SAClD;KACF;CACF,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,WAAW,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhG,wHAAwH;AACxH,SAAS,SAAS,CAAC,IAAiB;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,iHAAiH;AACjH,SAAS,YAAY,CAAC,MAAc,EAAE,IAAwB;IAC5D,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,cAAc,MAAM,wDAAwD,CAAC,CAAC;IACnH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,MAAM,MAAM,CAAC,GAAG,MAAM,2CAA2C,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IAC5D,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;YACjC,iGAAiG;YACjG,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE;YACrF,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAmD,CAAC;IACzG,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,wBAAwB,GAAG,EAAE,EAAE;QAC5F,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,MAAM,EACN,UAAU,EACV,OAAO,EACP,OAAO,GAAG,kBAAkB,EAC5B,MAAM,GAAG,UAAU,GAOpB;IACC,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,GAAG,EAAE;YACH,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;gBACrB,IAAI,CAAC,OAAO;oBAAE,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;gBAC/D,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,WAAW,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;SACF;QACD,WAAW,EAAE;YACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;gBACvB,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC;oBAC7D,MAAM,IAAI,WAAW,CAAC,yBAAyB,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;SACF;QACD,QAAQ,EAAE;YACR,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI;gBACpC,IAAI,CAAC,UAAU;oBAAE,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBACzE,mGAAmG;gBACnG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBACpE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;gBACnG,MAAM,aAAa,CAAC,GAAG,EAAE,CACvB,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC7F,CAAC;gBACF,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;YAC/E,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,UAAU;oBAAE,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBACzE,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,UAAU;oBAAE,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBACzE,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;QACD,MAAM,EAAE;YACN,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI;gBACjC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBAChD,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,CAAC;gBACD,wFAAwF;gBACxF,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;oBACnC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,CAAC,SAAS;oBACZ,MAAM,MAAM,CAAC,GAAG,IAAI,2EAA2E,CAAC,CAAC;gBACnG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI;gBACzB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;QACD,MAAM,EAAE;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI;gBACnC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClF,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;gBAClD,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;SACF;QACD,KAAK,EAAE;YACL,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI;gBACzC,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,0DAA0D;oBAC1D,IAAI,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,SAAS,EAAE,EAAE;wBAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBAChF,MAAM,MAAM,CAAC,GAAG,KAAK,0EAA0E,CAAC,CAAC;gBACnG,CAAC;gBACD,IAAI,KAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,mGAAmG;oBACnG,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS;wBAAE,MAAM,GAAG,CAAC;oBAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5B,MAAM,MAAM,CAAC,+BAA+B,EAAE,4DAA4D,CAAC,CAAC;gBAC9G,CAAC;gBACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBAC9D,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5B,MAAM,MAAM,CAAC,GAAG,KAAK,oEAAoE,CAAC,CAAC;gBAC7F,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;gBACjB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,aAAa,CAAC;IACZ,MAAM,EAAE,YAAY,EAAE;IACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxD,UAAU,EAAE,0BAA0B,EAAE;IACxC,OAAO,EAAE,yBAAyB,EAAE;IACpC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,wBAAwB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;CACjH,CAAC,CAAC"}
1	+ {"version":3,"file":"runtime-ops.js","sourceRoot":"","sources":["../src/runtime-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAoB,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAe,MAAM,aAAa,CAAC;AAErE,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,2BAA2B,CAAC;AAEnC,4FAA4F;AAC5F,oGAAoG;AACpG,4FAA4F;AAC5F,iGAAiG;AACjG,gGAAgG;AAEhG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;AACtG,0EAA0E;AAC1E,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CACxC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EACrC,8DAA8D,CAC/D,CAAC;AACF,2GAA2G;AAC3G,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,CACjD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EACtF,wEAAwE,CACzE,CAAC;AAEF,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC;CACjG,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC5E,MAAM,cAAc,GAAG,CAAC,EAAE,UAAU,EAA0B,EAAE,EAAE,CAAC,UAAU,CAAC;AAE9E,+FAA+F;AAC/F,iGAAiG;AACjG,KAAK,UAAU,aAAa,CAAC,KAA0B;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE;IAC9C,GAAG,EAAE;QACH,OAAO,EAAE;YACP,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,yJAAyJ;YAC3J,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;gBACjB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;gBACvF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAChC,CAAC;YACF,MAAM,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,KAAK;SAChD;KACF;IACD,WAAW,EAAE;QACX,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,sIAAsI;YACxI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;gBACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;gBACvC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,KAAK,EAAE,UAAU;aAClB,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAA4C,EAAE,EAAE,CAC7E,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACxC,cAAc,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;SAC1D;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,4IAA4I;YAC9I,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACvF,MAAM,EAAE,cAAc;YACtB,cAAc,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;SAC1D;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,qGAAqG;YACvG,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,cAAc;SACvB;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,sFAAsF;YACnG,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,cAAc;SACvB;KACF;IACD,MAAM,EAAE;QACN,QAAQ,EAAE;YACR,MAAM,EAAE,OAAO;YACf,qEAAqE;YACrE,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,2LAA2L;YAC7L,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;aACpG,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;aAC9F,CAAC;YACF,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;SACvD;QACD,MAAM,EAAE;YACN,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,8HAA8H;YAChI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;YAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,cAAc,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;SACvD;KACF;IACD,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,gGAAgG;YAChG,yCAAyC;YACzC,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,6KAA6K;YAC/K,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;gBAC1G,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;gBAC1E,GAAG,EAAE,CAAC;qBACH,YAAY,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;qBACrC,QAAQ,CAAC,oEAAoE,CAAC;aAClF,CAAC;YACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC,EAAE,CAAC;YAC7F,MAAM,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAAC,IAAI;YAC5C,wFAAwF;YACxF,MAAM,EAAE,CAAC,KAAK,CAAC;SAChB;KACF;IACD,KAAK,EAAE;QACL,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EACT,8GAA8G;YAChH,KAAK,EAAE,CAAC;iBACL,MAAM,CAAC;gBACN,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;gBACrG,SAAS,EAAE,CAAC;qBACT,MAAM,EAAE;qBACR,GAAG,CAAC,CAAC,CAAC;qBACN,GAAG,CAAC,IAAI,CAAC;qBACT,QAAQ,EAAE;qBACV,QAAQ,CAAC,wFAAwF,CAAC;gBACrG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oDAAoD,CAAC;gBACxF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAClC,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,sCAAsC,CAAC;aACnE,CAAC;iBACD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,gCAAgC,CAAC;YAC/G,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAuB,EAAE,EAAE,CAAC,OAAO;YACrD,cAAc,EAAE,CAAC,EAAE,KAAK,EAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;SAC1D;QACD,MAAM,EAAE;YACN,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,wDAAwD;YACrE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE;SAClD;KACF;CACF,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,WAAW,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEhG,wGAAwG;AACxG,SAAS,SAAS,CAAC,IAAiB,EAAE,SAAkB;IACtD,MAAM,GAAG,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACjH,CAAC;AAED,iHAAiH;AACjH,SAAS,YAAY,CAAC,MAAc,EAAE,IAAwB;IAC5D,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,cAAc,MAAM,wDAAwD,CAAC,CAAC;IACnH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,MAAM,MAAM,CAAC,GAAG,MAAM,2CAA2C,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe;IAC5D,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;YACjC,iGAAiG;YACjG,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE;YACrF,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAmD,CAAC;IACzG,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,wBAAwB,GAAG,EAAE,EAAE;QAC5F,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QACjD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,MAAM,EACN,UAAU,EACV,OAAO,EACP,OAAO,GAAG,kBAAkB,EAC5B,MAAM,GAAG,UAAU,GAOpB;IACC,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,GAAG,EAAE;YACH,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;gBACrB,IAAI,CAAC,OAAO;oBAAE,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;gBAC/D,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,WAAW,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;SACF;QACD,WAAW,EAAE;YACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;gBACvB,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC;oBAC7D,MAAM,IAAI,WAAW,CAAC,yBAAyB,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;SACF;QACD,QAAQ,EAAE;YACR,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,IAAI;gBACpC,IAAI,CAAC,UAAU;oBAAE,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBACzE,mGAAmG;gBACnG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBACpE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;oBAAE,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;gBACnG,MAAM,aAAa,CAAC,GAAG,EAAE,CACvB,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC7F,CAAC;gBACF,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;YAC/E,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,UAAU;oBAAE,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBACzE,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,UAAU;oBAAE,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;gBACzE,MAAM,aAAa,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;QACD,MAAM,EAAE;YACN,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI;gBACjC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBAChD,OAAO,EAAE,IAAI,EAAE,CAAC;gBAClB,CAAC;gBACD,wFAAwF;gBACxF,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;oBACnC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,CAAC,SAAS;oBACZ,MAAM,MAAM,CAAC,GAAG,IAAI,2EAA2E,CAAC,CAAC;gBACnG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI;gBACzB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;QACD,MAAM,EAAE;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI;gBACnC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClF,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;gBAClD,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;SACF;QACD,KAAK,EAAE;YACL,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI;gBACrE,MAAM,EAAE,GAAG,WAAW,IAAI,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACrD,qFAAqF;gBACrF,sFAAsF;gBACtF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBAC5D,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,MAAM,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;gBAC5G,IAAI,UAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrE,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,WAAW,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,CAAC,UAAU;oBAAE,MAAM,MAAM,CAAC,GAAG,KAAK,yDAAyD,CAAC,CAAC;gBACjG,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;gBACjB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,EAAE,CACvC,aAAa,CAAC;IACZ,MAAM,EAAE,YAAY,EAAE;IACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxD,UAAU,EAAE,0BAA0B,EAAE;IACxC,OAAO,EAAE,yBAAyB,EAAE;IACpC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,wBAAwB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;CACjH,CAAC,CAAC"}

package/dist/tokens.d.ts CHANGED Viewed

@@ -1,5 +1,13 @@
 import type { Pool } from "pg";
 import type { Principal } from "./define.ts";
+/** Register only a generated bearer retained by trusted provisioning, never a workflow value. */
+export interface TokenRegistration {
+    id: string;
+    token: string;
+    subject: string;
+    groups: readonly string[];
+}
+export declare const newApiToken: () => string;
 /** The api tokens' store, `SanomaClient.tokens`. */
 export interface Tokens {
     /**
@@ -15,6 +23,8 @@ export interface Tokens {
         id: string;
         token: string;
     }>;
+    /** Register a saved bearer, or confirm the identical active registration. Conflicts and revocation return false. */
+    register(token: TokenRegistration): Promise<boolean>;
     /** Revokes the token `id`: it resolves to nobody from now on. Revoking one revoked or missing does nothing. */
     revoke(token: {
         id: string;

package/dist/tokens.js CHANGED Viewed

@@ -6,10 +6,17 @@ import { generateSecret, tokenHash as hashOf } from "./secret.js";
 // a visitor, with the row's groups. Only a token's SHA-256 is kept; the token is shown once, at mint.
 /** What every token starts with, so a bearer that is not one is told at a glance. */
 const PREFIX = "sca_";
+export const newApiToken = () => `${PREFIX}${generateSecret()}`;
+const groupsOf = (groups) => [...new Set(groups)].toSorted();
+const registrationOf = (input) => {
+    if (!input.id || !input.subject || !/^sca_[A-Za-z0-9_-]{43}$/.test(input.token))
+        throw new Error("Invalid token registration");
+    return { ...input, hash: hashOf(input.token), groups: groupsOf(input.groups) };
+};
 export function tokenStore(db) {
     return {
         async mint({ id = randomUUID(), subject, groups }) {
-            const token = `${PREFIX}${generateSecret()}`;
+            const token = newApiToken();
             await (await db()).query(`INSERT INTO ${TABLE} (id, hash, subject, groups) VALUES ($1, $2, $3, $4::jsonb)`, [
                 id,
                 hashOf(token),
@@ -18,6 +25,24 @@ export function tokenStore(db) {
             ]);
             return { id, token };
         },
+        async register(input) {
+            const { id, hash, subject, groups } = registrationOf(input);
+            try {
+                const result = await (await db()).query(`INSERT INTO ${TABLE} (id, hash, subject, groups) VALUES ($1,$2,$3,$4::jsonb)
+           ON CONFLICT (id) DO UPDATE SET id=EXCLUDED.id
+           WHERE ${TABLE}.hash=EXCLUDED.hash AND ${TABLE}.subject=EXCLUDED.subject
+             AND ${TABLE}.groups @> EXCLUDED.groups AND ${TABLE}.groups <@ EXCLUDED.groups
+             AND ${TABLE}.revoked_at IS NULL
+           RETURNING id`, [id, hash, subject, JSON.stringify(groups)]);
+                return result.rowCount === 1;
+            }
+            catch (error) {
+                // A bearer already registered under another ID cannot acquire a second identity.
+                if (error.code === "23505")
+                    return false;
+                throw error;
+            }
+        },
         async revoke({ id }) {
             await (await db()).query(`UPDATE ${TABLE} SET revoked_at = now() WHERE id = $1 AND revoked_at IS NULL`, [id]);
         },
@@ -44,10 +69,23 @@ export function memoryTokens() {
         async mint({ id = randomUUID(), subject, groups }) {
             if (rows.has(id))
                 throw new Error(`A token with the id ${id} exists`);
-            const token = `${PREFIX}${generateSecret()}`;
+            const token = newApiToken();
             rows.set(id, { hash: hashOf(token), subject, groups: [...groups], revoked: false });
             return { id, token };
         },
+        async register(input) {
+            const { id, hash, subject, groups } = registrationOf(input);
+            const row = rows.get(id);
+            if (row)
+                return (!row.revoked &&
+                    row.hash === hash &&
+                    row.subject === subject &&
+                    JSON.stringify(groupsOf(row.groups)) === JSON.stringify(groups));
+            if ([...rows.values()].some((other) => other.hash === hash))
+                return false;
+            rows.set(id, { hash, subject, groups, revoked: false });
+            return true;
+        },
         async revoke({ id }) {
             const row = rows.get(id);
             if (row)

package/dist/tokens.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,IAAI,KAAK,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,SAAS,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAElE,4FAA4F;AAC5F,iGAAiG;AACjG,sGAAsG;AAEtG,qFAAqF;AACrF,MAAM,MAAM,GAAG,MAAM,CAAC;~~AAqBtB~~,MAAM,UAAU,UAAU,CAAC,EAAuB;IAChD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC/C,MAAM,KAAK,GAAG,~~GAAG~~,~~MAAM,GAAG,cAAc,~~EAAE,~~EAAE,~~CAAC;~~YAC7C~~,MAAM,CACJ,MAAM,EAAE,EAAE,CACX,CAAC,KAAK,CAAC,eAAe,KAAK,6DAA6D,EAAE;gBACzF,EAAE;gBACF,MAAM,CAAC,KAAK,CAAC;gBACb,OAAO;gBACP,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;YACjB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,8DAA8D,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChD,iGAAiG;YACjG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CACrB,MAAM,EAAE,EAAE,CACX,CAAC,KAAK,CACL,mCAAmC,KAAK,yCAAyC,EACjF,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,EAAE;YAChB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CACrB,MAAM,EAAE,EAAE,CACX,CAAC,KAAK,CAAsB,uBAAuB,KAAK,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACxG,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiF,CAAC;IACtG,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,~~GAAG~~,~~MAAM,GAAG,cAAc,~~EAAE,~~EAAE,~~CAAC;~~YAC7C~~,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,GAAG;gBAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;gBAC7F,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,IAAI,KAAK,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,SAAS,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAElE,4FAA4F;AAC5F,iGAAiG;AACjG,sGAAsG;AAEtG,qFAAqF;AACrF,MAAM,MAAM,GAAG,MAAM,CAAC;AAUtB,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,GAAG,MAAM,GAAG,cAAc,EAAE,EAAE,CAAC;AAChE,MAAM,QAAQ,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChF,MAAM,cAAc,GAAG,CAAC,KAAwB,EAAE,EAAE;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACjF,CAAC,CAAC;AAuBF,MAAM,UAAU,UAAU,CAAC,EAAuB;IAChD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,MAAM,CACJ,MAAM,EAAE,EAAE,CACX,CAAC,KAAK,CAAC,eAAe,KAAK,6DAA6D,EAAE;gBACzF,EAAE;gBACF,MAAM,CAAC,KAAK,CAAC;gBACb,OAAO;gBACP,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACvB,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CACnB,MAAM,EAAE,EAAE,CACX,CAAC,KAAK,CACL,eAAe,KAAK;;mBAEX,KAAK,2BAA2B,KAAK;mBACrC,KAAK,kCAAkC,KAAK;mBAC5C,KAAK;wBACA,EACd,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAC5C,CAAC;gBACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iFAAiF;gBACjF,IAAK,KAA2B,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAChE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;YACjB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,8DAA8D,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChD,iGAAiG;YACjG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CACrB,MAAM,EAAE,EAAE,CACX,CAAC,KAAK,CACL,mCAAmC,KAAK,yCAAyC,EACjF,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAChB,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,EAAE;YAChB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CACrB,MAAM,EAAE,EAAE,CACX,CAAC,KAAK,CAAsB,uBAAuB,KAAK,uCAAuC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACxG,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiF,CAAC;IACtG,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,GAAG;gBACL,OAAO,CACL,CAAC,GAAG,CAAC,OAAO;oBACZ,GAAG,CAAC,IAAI,KAAK,IAAI;oBACjB,GAAG,CAAC,OAAO,KAAK,OAAO;oBACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAChE,CAAC;YACJ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,GAAG;gBAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;gBAC7F,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,EAAE;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@sanoma-ai/workflows",
-  "version": "0.11.9",
+  "version": "0.11.12",
   "description": "Business processes as TypeScript functions, run durably on DBOS",
   "keywords": [
     "approvals",

package/src/database.ts CHANGED Viewed

@@ -54,8 +54,10 @@ export interface DatabaseSpec {
  * The secret a database's `storeUrl` stores its URL in, for the data file's export that declares
  * it: `store` → `SANOMA_DATABASE_URL_STORE`, `mainStore` → `SANOMA_DATABASE_URL_MAIN_STORE`.
  */
-export const databaseUrlSecret = (exportName: string): string =>
-  `SANOMA_DATABASE_URL_${exportName.replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase()}`;
+export const databaseUrlSecret = (exportName: string): string => {
+  const upper = exportName.toUpperCase();
+  return `SANOMA_DATABASE_URL_${exportName === upper ? upper : exportName.replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase()}`;
+};
 /**
  * A `storeUrl`'s store: `url` as `databaseUrlSecret(exportName)`, whose name it returns. The store

package/src/runtime-ops.ts CHANGED Viewed

@@ -6,7 +6,7 @@ import { generateSecret, SECRET_NAME } from "./secret.ts";
 import { sealInvite } from "./seal.ts";
 import { errorMessage } from "./shared.ts";
 import { sourceKeyPair, sshPublicKey } from "./ssh-key.ts";
-import { memoryTokens, type Tokens } from "./tokens.ts";
+import { memoryTokens, newApiToken, type Tokens } from "./tokens.ts";
 import type { InspectRun } from "./run-status.ts";
 import {
   identityProvisioningCode,
@@ -181,13 +181,23 @@ export const sanoma = defineConnector("sanoma", {
   token: {
     mint: {
       effect: "access",
+      idempotent: true,
       description:
         "Mint an api token acting for a subject in groups, store it under a name, and answer its id (never the token)",
-      input: z.object({
-        subject: z.string().regex(/^\S+$/, "a principal's id, such as visitor:better-auth:<id>"),
-        groups: z.array(z.string().min(1)),
-        store: SecretName.describe("The secret the token is stored under"),
-      }),
+      input: z
+        .object({
+          id: z.guid().optional().describe("A recorded UUID-shaped token ID for recovery across workflow runs"),
+          reference: z
+            .string()
+            .min(1)
+            .max(1024)
+            .optional()
+            .describe("A stable non-secret provisioning reference, recorded before minting; alternative to id"),
+          subject: z.string().regex(/^\S+$/, "a principal's id, such as visitor:better-auth:<id>"),
+          groups: z.array(z.string().min(1)),
+          store: SecretName.describe("The secret the token is stored under"),
+        })
+        .refine(({ id, reference }) => id === undefined || reference === undefined, "Pass id or reference, not both"),
       output: z.object({ id: z.string() }),
       target: ({ subject }: { subject: string }) => subject,
       createsSecrets: ({ store }: { store: string }) => [store],
@@ -206,9 +216,10 @@ export const sanoma = defineConnector("sanoma", {
 /** A `DriverError` that a retry would not change. */
 const refuse = (message: string) => new DriverError(`sanoma: ${message}`, { retryable: false });
-/** The token id a call mints, from its idempotency key: the same on every try of one call, so a retry finds its own. */
-function tokenIdOf(call: CallContext) {
-  const hex = createHash("sha256").update(call.idempotencyKey).digest("hex");
+/** Stable identity from a recorded reference, or this call's idempotency key when none was supplied. */
+function tokenIdOf(call: CallContext, reference?: string) {
+  const key = reference === undefined ? call.idempotencyKey : JSON.stringify(["sanoma.token.reference", reference]);
+  const hex = createHash("sha256").update(key).digest("hex");
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
@@ -341,27 +352,19 @@ export function runtimeDriver({
       },
     },
     token: {
-      async mint({ subject, groups, store }, call) {
-        const id = tokenIdOf(call);
-        const held = await call.secrets.get(store);
-        if (held !== undefined) {
-          // This call's own, stored by a try whose answer was lost.
-          if ((await tokens.resolve(held))?.principal.id === `token:${id}`) return { id };
-          throw refuse(`${store} holds a value already: delete it, or store the token under another name`);
-        }
-        let token: string;
+      async mint({ id: requestedId, reference, subject, groups, store }, call) {
+        const id = requestedId ?? tokenIdOf(call, reference);
+        // Persist the bearer before registration. A lost store or database response can then
+        // retry the same value; no live token is created whose only copy was in this process.
+        const token = await call.secrets.ensure(store, newApiToken);
+        if (!/^sca_[A-Za-z0-9_-]{43}$/.test(token)) throw refuse(`${store} holds a value that is not an api token`);
+        let registered: boolean;
         try {
-          ({ token } = await tokens.mint({ id, subject, groups }));
-        } catch (err) {
-          // A try that minted this id and stopped before storing it left a token nobody holds: revoked here.
-          if ((await tokens.subjectOf(id)) === undefined) throw err;
-          await tokens.revoke({ id });
-          throw refuse(`an earlier try minted token ${id} and stopped before storing it: it is revoked, start again`);
-        }
-        if ((await call.secrets.ensure(store, () => token)) !== token) {
-          await tokens.revoke({ id });
-          throw refuse(`${store} was stored by someone else meanwhile: the token minted is revoked`);
+          registered = await tokens.register({ id, token, subject, groups });
+        } catch {
+          throw new DriverError("sanoma: token registration unavailable", { retryable: true });
         }
+        if (!registered) throw refuse(`${store} holds a token with conflicting or revoked registration`);
         return { id };
       },
       async revoke({ id }) {

package/src/tokens.ts CHANGED Viewed

@@ -11,6 +11,22 @@ import { generateSecret, tokenHash as hashOf } from "./secret.ts";
 /** What every token starts with, so a bearer that is not one is told at a glance. */
 const PREFIX = "sca_";
+/** Register only a generated bearer retained by trusted provisioning, never a workflow value. */
+export interface TokenRegistration {
+  id: string;
+  token: string;
+  subject: string;
+  groups: readonly string[];
+}
+export const newApiToken = () => `${PREFIX}${generateSecret()}`;
+const groupsOf = (groups: readonly string[]) => [...new Set(groups)].toSorted();
+const registrationOf = (input: TokenRegistration) => {
+  if (!input.id || !input.subject || !/^sca_[A-Za-z0-9_-]{43}$/.test(input.token))
+    throw new Error("Invalid token registration");
+  return { ...input, hash: hashOf(input.token), groups: groupsOf(input.groups) };
+};
 /** The api tokens' store, `SanomaClient.tokens`. */
 export interface Tokens {
   /**
@@ -19,6 +35,8 @@ export interface Tokens {
    * shown only here. An id another token has is refused.
    */
   mint(token: { id?: string; subject: string; groups: readonly string[] }): Promise<{ id: string; token: string }>;
+  /** Register a saved bearer, or confirm the identical active registration. Conflicts and revocation return false. */
+  register(token: TokenRegistration): Promise<boolean>;
   /** Revokes the token `id`: it resolves to nobody from now on. Revoking one revoked or missing does nothing. */
   revoke(token: { id: string }): Promise<void>;
   /**
@@ -33,7 +51,7 @@ export interface Tokens {
 export function tokenStore(db: () => Promise<Pool>): Tokens {
   return {
     async mint({ id = randomUUID(), subject, groups }) {
-      const token = `${PREFIX}${generateSecret()}`;
+      const token = newApiToken();
       await (
         await db()
       ).query(`INSERT INTO ${TABLE} (id, hash, subject, groups) VALUES ($1, $2, $3, $4::jsonb)`, [
@@ -44,6 +62,27 @@ export function tokenStore(db: () => Promise<Pool>): Tokens {
       ]);
       return { id, token };
     },
+    async register(input) {
+      const { id, hash, subject, groups } = registrationOf(input);
+      try {
+        const result = await (
+          await db()
+        ).query(
+          `INSERT INTO ${TABLE} (id, hash, subject, groups) VALUES ($1,$2,$3,$4::jsonb)
+           ON CONFLICT (id) DO UPDATE SET id=EXCLUDED.id
+           WHERE ${TABLE}.hash=EXCLUDED.hash AND ${TABLE}.subject=EXCLUDED.subject
+             AND ${TABLE}.groups @> EXCLUDED.groups AND ${TABLE}.groups <@ EXCLUDED.groups
+             AND ${TABLE}.revoked_at IS NULL
+           RETURNING id`,
+          [id, hash, subject, JSON.stringify(groups)],
+        );
+        return result.rowCount === 1;
+      } catch (error) {
+        // A bearer already registered under another ID cannot acquire a second identity.
+        if ((error as { code?: string }).code === "23505") return false;
+        throw error;
+      }
+    },
     async revoke({ id }) {
       await (await db()).query(`UPDATE ${TABLE} SET revoked_at = now() WHERE id = $1 AND revoked_at IS NULL`, [id]);
     },
@@ -75,10 +114,24 @@ export function memoryTokens(): Tokens {
   return {
     async mint({ id = randomUUID(), subject, groups }) {
       if (rows.has(id)) throw new Error(`A token with the id ${id} exists`);
-      const token = `${PREFIX}${generateSecret()}`;
+      const token = newApiToken();
       rows.set(id, { hash: hashOf(token), subject, groups: [...groups], revoked: false });
       return { id, token };
     },
+    async register(input) {
+      const { id, hash, subject, groups } = registrationOf(input);
+      const row = rows.get(id);
+      if (row)
+        return (
+          !row.revoked &&
+          row.hash === hash &&
+          row.subject === subject &&
+          JSON.stringify(groupsOf(row.groups)) === JSON.stringify(groups)
+        );
+      if ([...rows.values()].some((other) => other.hash === hash)) return false;
+      rows.set(id, { hash, subject, groups, revoked: false });
+      return true;
+    },
     async revoke({ id }) {
       const row = rows.get(id);
       if (row) row.revoked = true;