@sasjs/api 0.6.0 → 0.7.0

package/build/esm/corpus/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAQnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QASjD,CAAA;AAkBF;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AASnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAkBlD,CAAA;AAkBD;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAepB,CAAA"}

package/build/esm/corpus/runner.js

@@ -2,6 +2,7 @@ import { dispatch } from '../host/dispatch.js';
 import { createDriveService } from '../drive/service.js';
 import { MemoryDriveStore } from '../drive/memory-store.js';
 import { createIdentityService } from '../identity/service.js';
+import { createRecordService } from '../identity/records.js';
 import { MemoryIdentityStore } from '../identity/memory-store.js';
 import { DEFAULT_IDENTITY } from '../identity/fixture.js';
 import { isApiError } from '../types.js';
@@ -11,12 +12,20 @@ import { isApiError } from '../types.js';
  * The identity store is built for every case, drive or not, so a case that starts
  * mid-flow can declare the tokens and codes it begins with.
  */
-export const servicesFor = (testCase) => ({
-    drive: createDriveService(testCase.unwritable
-        ? new RefusingDriveStore(testCase.seed || {})
-        : new MemoryDriveStore(testCase.seed || {})),
-    identity: createIdentityService(new MemoryIdentityStore(testCase.identity || DEFAULT_IDENTITY))
-});
+export const servicesFor = (testCase) => {
+    // one identity store, shared by both services: a token the sign-in flow issues
+    // has to be the token a record route reads, and a user a record route creates
+    // has to be one the flow can sign in. Two stores built from the same fixture
+    // would let a case assert across two independent states and still pass.
+    const identity = new MemoryIdentityStore(testCase.identity || DEFAULT_IDENTITY);
+    return {
+        drive: createDriveService(testCase.unwritable
+            ? new RefusingDriveStore(testCase.seed || {})
+            : new MemoryDriveStore(testCase.seed || {})),
+        identity: createIdentityService(identity),
+        records: createRecordService(identity)
+    };
+};
 /**
  * A drive that reads but refuses every write.
  *

package/build/esm/drive/deploy.d.ts

@@ -99,6 +99,16 @@ export interface DeployMeasurements {
         bytes: number;
     };
 }
+/**
+ * How deep a tree may nest.
+ *
+ * A deployment is an app: `services/`, `web/`, a folder per service. A few dozen
+ * levels is generous, and the number matters because the walk recurses once per
+ * level - without a ceiling, a tree nested deeply enough exhausts the stack and
+ * throws a `RangeError`, which is neither the `400` nor the `413` this route
+ * documents, on input the cap exists to bound.
+ */
+export declare const MAX_DEPTH = 32;
 /** The bytes a base64 body decodes to, for a store that writes bytes. */
 export declare const decodeBase64: (value: string) => Uint8Array;
 /**

package/build/esm/drive/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/drive/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAI7C,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;AAE5D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,YAAY,GACtB,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAA;AAE7D,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,eAAO,MAAM,aAAa,EAAE,YAI3B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,QAAoB,CAAA;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;CAGjB,CAAA;AAEV,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,GAAG,GAAG,GAAG,CAAA;IACf,MAAM,EAAE,SAAS,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACzC;AAiBD,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,KAAG,UAmB5C,CAAA;AA8FD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,YAAY,EAAE,KACtB,kBAUF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,YAAY,EAAE,EACvB,SAAQ,YAA4B,KACnC,aAAa,GAAG,IA6BlB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,UAMtD,CAAA;AAkBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,GACrB,OAAO,UAAU,EACjB,QAAQ,OAAO,EACf,MAAM,OAAO,EACb,SAAQ,YAA4B,KACnC,OAAO,CAAC,IAAI,CAiCd,CAAA"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/drive/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAI7C,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;AAE5D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,YAAY,GACtB,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAA;AAE7D,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,eAAO,MAAM,aAAa,EAAE,YAI3B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,QAAoB,CAAA;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc;;;CAGjB,CAAA;AAEV,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,GAAG,GAAG,GAAG,CAAA;IACf,MAAM,EAAE,SAAS,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACzC;AASD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,KAAK,CAAA;AAY3B,yEAAyE;AACzE,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,KAAG,UAmB5C,CAAA;AA8HD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,YAAY,EAAE,KACtB,kBAUF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,YAAY,EAAE,EACvB,SAAQ,YAA4B,KACnC,aAAa,GAAG,IAoClB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,UAMtD,CAAA;AAkBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,GACrB,OAAO,UAAU,EACjB,QAAQ,OAAO,EACf,MAAM,OAAO,EACb,SAAQ,YAA4B,KACnC,OAAO,CAAC,IAAI,CAiCd,CAAA"}

package/build/esm/drive/deploy.js

@@ -33,6 +33,16 @@ export const DEPLOY_SUCCESS = {
     status: 'success',
     message: 'Files deployed successfully to @sasjs/server.'
 };
+/**
+ * How deep a tree may nest.
+ *
+ * A deployment is an app: `services/`, `web/`, a folder per service. A few dozen
+ * levels is generous, and the number matters because the walk recurses once per
+ * level - without a ceiling, a tree nested deeply enough exhausts the stack and
+ * throws a `RangeError`, which is neither the `400` nor the `413` this route
+ * documents, on input the cap exists to bound.
+ */
+export const MAX_DEPTH = 32;
 const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
 /** A base64 body without its padding, which is what the arithmetic needs. */
 const base64Body = (value) => value.replace(/[^A-Za-z0-9+/]/g, '');
@@ -78,14 +88,28 @@ const utf8Length = (value) => {
 const memberName = (member) => member.type === 'service' ? `${member.name}.sas` : member.name;
 /** The bytes a member writes. */
 const memberBytes = (member) => member.type === 'file' ? base64Length(member.code) : utf8Length(member.code);
+const MEGABYTE = 1024 * 1024;
 /**
- * Sizes as the messages state them: one decimal in binary megabytes, and bytes
- * below a megabyte - a limit small enough to be measured in bytes should not
- * read as "0 MB", which is what a stricter host would otherwise report.
+ * A MEASURED size, rounded UP to one decimal in binary megabytes.
+ *
+ * Up, not to nearest: a tree one byte over a 100 MB cap must not read as "100 MB
+ * (maximum 100 MB)", which is a refusal that states no overage at all. Rounding
+ * up is the direction that never understates what is being refused.
+ *
+ * Bytes below a megabyte are printed as bytes, because a limit small enough to
+ * be measured in bytes should not read as "0 MB" - which is what a host passing
+ * a tighter set would otherwise report.
  */
-const describeSize = (bytes) => bytes < 1024 * 1024
+const describeSize = (bytes) => bytes < MEGABYTE
     ? `${bytes} bytes`
-    : `${Math.round((bytes / (1024 * 1024)) * 10) / 10} MB`;
+    : `${Math.ceil((bytes / MEGABYTE) * 10) / 10} MB`;
+/**
+ * A LIMIT, printed as it is stated: `DEPLOY_LIMITS` holds exact megabytes, so
+ * rounding cannot make it disagree with itself.
+ */
+const describeLimit = (bytes) => bytes < MEGABYTE
+    ? `${bytes} bytes`
+    : `${Math.round((bytes / MEGABYTE) * 10) / 10} MB`;
 /** A walk's starting point. */
 const emptyWalk = () => ({
     entries: 0,
@@ -109,8 +133,12 @@ const isSafeSegment = (name) => name !== '' &&
  * a caller that only wants the numbers gets the size of the whole tree, and the
  * validator decides whether the name matters. Returning early would report a
  * truncated tree as if it were the real one.
+ *
+ * The one thing that stops the walk is depth: past `MAX_DEPTH` it does not
+ * descend, because descending is the work that would exhaust the stack. The
+ * level it reached is recorded so the refusal can state it.
  */
-const walk = (members, parentPath, acc) => {
+const walk = (members, parentPath, acc, depth = 1) => {
     for (const member of members) {
         const name = memberName(member);
         const memberPath = parentPath ? `${parentPath}/${name}` : name;
@@ -122,7 +150,12 @@ const walk = (members, parentPath, acc) => {
             };
         acc.entries++;
         if (member.type === 'folder') {
-            walk(member.members, memberPath, acc);
+            if (depth + 1 > MAX_DEPTH) {
+                if (!acc.tooDeep)
+                    acc.tooDeep = depth + 1;
+                continue;
+            }
+            walk(member.members, memberPath, acc, depth + 1);
             continue;
         }
         const bytes = memberBytes(member);
@@ -161,6 +194,12 @@ export const checkDeployTree = (members, limits = DEPLOY_LIMITS) => {
     walk(members, '', measured);
     if (measured.nameRefusal)
         return measured.nameRefusal;
+    if (measured.tooDeep)
+        return {
+            code: 413,
+            status: 'failure',
+            message: `The file tree is nested too deeply: ${measured.tooDeep} levels (maximum ${MAX_DEPTH}).`
+        };
     if (measured.entries > limits.entries)
         return {
             code: 413,
@@ -171,13 +210,13 @@ export const checkDeployTree = (members, limits = DEPLOY_LIMITS) => {
         return {
             code: 413,
             status: 'failure',
-            message: `The file tree exceeds the deploy limit: ${describeSize(measured.totalBytes)} (maximum ${describeSize(limits.totalBytes)}).`
+            message: `The file tree exceeds the deploy limit: ${describeSize(measured.totalBytes)} (maximum ${describeLimit(limits.totalBytes)}).`
         };
     if (measured.largest.bytes > limits.fileBytes)
         return {
             code: 413,
             status: 'failure',
-            message: `A file in the tree exceeds the deploy limit: ${measured.largest.path} is ${describeSize(measured.largest.bytes)} (maximum ${describeSize(limits.fileBytes)} per file).`
+            message: `A file in the tree exceeds the deploy limit: ${measured.largest.path} is ${describeSize(measured.largest.bytes)} (maximum ${describeLimit(limits.fileBytes)} per file).`
         };
     return null;
 };

package/build/esm/host/dispatch.d.ts

@@ -1,9 +1,16 @@
 import type { DriveService } from '../drive/service.js';
 import type { IdentityService } from '../identity/service.js';
+import type { RecordService } from '../identity/records.js';
 import type { Subject } from '../identity/types.js';
 export interface ApiRequest {
     query?: Record<string, string | undefined>;
     body?: Record<string, unknown>;
+    /**
+     * The values the route's path parameters carried, by name - `{ uid: 'abc' }`
+     * for `/user/{uid}`. A host extracts them from its own router; the corpus
+     * states them.
+     */
+    params?: Record<string, string>;
     /** The multipart payload: the API names it `file` on every route that takes one. */
     file?: {
         name: string;
@@ -33,6 +40,8 @@ export interface Services {
      * implement - the difference is the message, and it names the capability.
      */
     identity?: IdentityService;
+    /** Users, groups, permission rules and clients. Absent, the record routes answer 501. */
+    records?: RecordService;
 }
 export declare const dispatch: (services: Services, routeId: string, request?: ApiRequest) => Promise<ApiResponse>;
 /** Whether a route is one `dispatch` can answer today. */

package/build/esm/host/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAInD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CAsIrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAkBlC,CAAA"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAOnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,yFAAyF;IACzF,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CA+VrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAwClC,CAAA"}

package/build/esm/host/dispatch.js

@@ -1,6 +1,8 @@
 import { routeById } from '../routes/index.js';
 import { ApiError } from '../types.js';
 import { DEPLOY_SUCCESS } from '../drive/deploy.js';
+/** The defaults sasjs/server's Client schema applies to an omitted lifetime. */
+const SECONDS_IN_A_DAY = 86400;
 /**
  * The parameters the table marks required, checked before the handler runs.
  *
@@ -39,10 +41,36 @@ export const dispatch = async (services, routeId, request = {}) => {
     const route = routeById(routeId);
     if (!route)
         throw new ApiError(404, `No such operation: ${routeId}`);
+    const { drive, identity, records } = services;
+    // The server authenticates before its payload schema runs, so an anonymous
+    // request with an incomplete body is a 401 there rather than a 400. The order
+    // is only observable on the route groups that gate on a caller: the sign-in
+    // flow has no caller by definition, and the drive has no identity at all.
+    const identityScoped = ['User', 'Group', 'Permission', 'Client'].includes(route.tag) ||
+        routeId === 'PATCH /SASjsApi/auth/updatePassword';
+    if (identityScoped && records) {
+        const subject = request.subject ??
+            (identity ? await identity.authenticate(request.token) : undefined);
+        if (!subject) {
+            // A host may serve records without a sign-in flow - it resolves the caller
+            // itself and passes `subject`. Without one it cannot authenticate at all,
+            // and a 401 would send every request round the login loop for ever, so it
+            // is told which capability it is missing instead.
+            if (!identity)
+                throw new ApiError(501, `This host has no identity service, so it cannot answer ${routeId}.`);
+            throw new ApiError(401, 'Unauthorized');
+        }
+    }
     validate(route, request);
-    const { drive, identity } = services;
     const query = request.query || {};
     const body = request.body || {};
+    const params = request.params || {};
+    /** The record service, or the 501 a host without one answers. */
+    const required = () => {
+        if (!records)
+            throw new ApiError(501, `This host has no record service, so it cannot answer ${routeId}.`);
+        return records;
+    };
     /** The caller, from the request's own subject or the token it carried. */
     const caller = async () => {
         if (request.subject)
@@ -135,6 +163,144 @@ export const dispatch = async (services, routeId, request = {}) => {
         }
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
+        // ------------------------------------------------------------- records
+        //
+        // The administration routes: users, groups, permission rules, clients and the
+        // caller's own password. Each handler resolves the caller and passes it on;
+        // the admin gate and the wording live in the service.
+        case 'GET /SASjsApi/user':
+            return { status: 200, body: await required().listUsers(await caller()) };
+        case 'GET /SASjsApi/user/{uid}':
+            return {
+                status: 200,
+                body: await required().getUser(await caller(), {
+                    uid: String(params.uid ?? '')
+                })
+            };
+        case 'GET /SASjsApi/user/by/username/{username}':
+            return {
+                status: 200,
+                body: await required().getUser(await caller(), {
+                    username: String(params.username ?? '')
+                })
+            };
+        case 'POST /SASjsApi/user':
+            return {
+                status: 200,
+                body: await required().createUser(await caller(), {
+                    username: String(body.username ?? ''),
+                    displayName: String(body.displayName ?? ''),
+                    password: String(body.password ?? ''),
+                    isAdmin: body.isAdmin,
+                    isActive: body.isActive,
+                    autoExec: body.autoExec
+                })
+            };
+        case 'PATCH /SASjsApi/user/{uid}':
+            return {
+                status: 200,
+                body: await required().updateUser(await caller(), { uid: String(params.uid ?? '') }, body)
+            };
+        case 'PATCH /SASjsApi/user/by/username/{username}':
+            return {
+                status: 200,
+                body: await required().updateUser(await caller(), { username: String(params.username ?? '') }, body)
+            };
+        case 'DELETE /SASjsApi/user/{uid}':
+            await required().deleteUser(await caller(), { uid: String(params.uid ?? '') }, { password: body.password });
+            return { status: 204 };
+        case 'DELETE /SASjsApi/user/by/username/{username}':
+            await required().deleteUser(await caller(), { username: String(params.username ?? '') }, { password: body.password });
+            return { status: 204 };
+        case 'GET /SASjsApi/group':
+            return { status: 200, body: await required().listGroups(await caller()) };
+        case 'GET /SASjsApi/group/{uid}':
+            return {
+                status: 200,
+                body: await required().getGroup(await caller(), {
+                    uid: String(params.uid ?? '')
+                })
+            };
+        case 'GET /SASjsApi/group/by/groupname/{name}':
+            return {
+                status: 200,
+                body: await required().getGroup(await caller(), {
+                    name: String(params.name ?? '')
+                })
+            };
+        case 'POST /SASjsApi/group':
+            return {
+                status: 200,
+                body: await required().createGroup(await caller(), {
+                    name: String(body.name ?? ''),
+                    description: String(body.description ?? ''),
+                    isActive: body.isActive
+                })
+            };
+        case 'POST /SASjsApi/group/{groupUid}/{userUid}':
+            return {
+                status: 200,
+                body: await required().addUserToGroup(await caller(), String(params.groupUid ?? ''), String(params.userUid ?? ''))
+            };
+        case 'DELETE /SASjsApi/group/{groupUid}/{userUid}':
+            return {
+                status: 200,
+                body: await required().removeUserFromGroup(await caller(), String(params.groupUid ?? ''), String(params.userUid ?? ''))
+            };
+        case 'DELETE /SASjsApi/group/{uid}':
+            // the document states 200 for this one - the server answers with the
+            // driver's delete result rather than nothing
+            await required().deleteGroup(await caller(), String(params.uid ?? ''));
+            return { status: 200 };
+        case 'GET /SASjsApi/permission':
+            return {
+                status: 200,
+                body: await required().listPermissions(await caller())
+            };
+        case 'POST /SASjsApi/permission':
+            return {
+                status: 200,
+                body: await required().createPermission(await caller(), {
+                    path: String(body.path ?? ''),
+                    type: String(body.type ?? ''),
+                    setting: String(body.setting ?? ''),
+                    principalType: String(body.principalType ?? ''),
+                    principalId: String(body.principalId ?? '')
+                })
+            };
+        case 'PATCH /SASjsApi/permission/{uid}':
+            return {
+                status: 200,
+                body: await required().updatePermission(await caller(), String(params.uid ?? ''), { setting: String(body.setting ?? '') })
+            };
+        case 'DELETE /SASjsApi/permission/{uid}':
+            await required().deletePermission(await caller(), String(params.uid ?? ''));
+            return { status: 204 };
+        case 'GET /SASjsApi/client':
+            return { status: 200, body: await required().listClients(await caller()) };
+        case 'POST /SASjsApi/client':
+            return {
+                status: 200,
+                // An omitted lifetime is the schema's default, not NaN: the server's
+                // Client model declares 86400 and 2592000, and a NaN lifetime would make
+                // every token the client buys expire on arrival.
+                body: await required().createClient(await caller(), {
+                    clientId: String(body.clientId ?? ''),
+                    clientSecret: String(body.clientSecret ?? ''),
+                    accessTokenExpiration: body.accessTokenExpiration === undefined
+                        ? SECONDS_IN_A_DAY
+                        : Number(body.accessTokenExpiration),
+                    refreshTokenExpiration: body.refreshTokenExpiration === undefined
+                        ? SECONDS_IN_A_DAY * 30
+                        : Number(body.refreshTokenExpiration)
+                })
+            };
+        case 'PATCH /SASjsApi/auth/updatePassword':
+            await required().updatePassword(await caller(), {
+                currentPassword: String(body.currentPassword ?? ''),
+                newPassword: String(body.newPassword ?? '')
+            });
+            return { status: 204 };
         default: {
             // The reason the table carries travels with the refusal: a host developer
             // reading a 501 wants to know what the operation waits on, not only that
@@ -162,5 +328,27 @@ export const HANDLED_ROUTES = [
     'POST /SASLogon/login',
     'POST /SASLogon/authorize',
     'GET /SASLogon/logout',
-    'GET /SASjsApi/session'
+    'GET /SASjsApi/session',
+    'GET /SASjsApi/user',
+    'GET /SASjsApi/user/{uid}',
+    'GET /SASjsApi/user/by/username/{username}',
+    'POST /SASjsApi/user',
+    'PATCH /SASjsApi/user/{uid}',
+    'PATCH /SASjsApi/user/by/username/{username}',
+    'DELETE /SASjsApi/user/{uid}',
+    'DELETE /SASjsApi/user/by/username/{username}',
+    'GET /SASjsApi/group',
+    'GET /SASjsApi/group/{uid}',
+    'GET /SASjsApi/group/by/groupname/{name}',
+    'POST /SASjsApi/group',
+    'POST /SASjsApi/group/{groupUid}/{userUid}',
+    'DELETE /SASjsApi/group/{groupUid}/{userUid}',
+    'DELETE /SASjsApi/group/{uid}',
+    'GET /SASjsApi/permission',
+    'POST /SASjsApi/permission',
+    'PATCH /SASjsApi/permission/{uid}',
+    'DELETE /SASjsApi/permission/{uid}',
+    'GET /SASjsApi/client',
+    'POST /SASjsApi/client',
+    'PATCH /SASjsApi/auth/updatePassword'
 ];

package/build/esm/identity/fixture.d.ts

@@ -19,6 +19,10 @@ export interface IdentityFixtureUser {
     isAdmin: boolean;
     isActive: boolean;
     needsToUpdatePassword: boolean;
+    /** Set when the account is managed by an external auth provider. */
+    authProvider?: string;
+    /** The account's own auto-exec code, where the fixture declares one. */
+    autoExec?: string;
 }
 export interface IdentityFixtureGroup {
     uid: string;
@@ -27,6 +31,8 @@ export interface IdentityFixtureGroup {
     isActive: boolean;
     /** Usernames of the members. */
     users: string[];
+    /** Set when the group is managed by an external auth provider. */
+    authProvider?: string;
 }
 export interface IdentityFixturePermission {
     uid: string;

package/build/esm/identity/fixture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../../src/identity/fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,eAAe,IAAI,CAAA;AAEhC,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC9B,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,sDAAsD;IACtD,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC/B,mEAAmE;IACnE,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAC9B;AAID,eAAO,MAAM,gBAAgB,EAAE,eA6E9B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,OAAO,KAAG,eA2B5C,CAAA"}
+{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../../src/identity/fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,eAAe,IAAI,CAAA;AAEhC,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;IAC9B,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC9B,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,sDAAsD;IACtD,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC/B,mEAAmE;IACnE,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAC9B;AAID,eAAO,MAAM,gBAAgB,EAAE,eA6E9B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,OAAO,KAAG,eA2B5C,CAAA"}

package/build/esm/identity/memory-store.d.ts

@@ -8,7 +8,7 @@
  * resolving. A host with real credentials - a server - supplies its own store
  * with JWTs, bcrypt and a database behind it.
  */
-import type { IdentityClient, IdentityStore, IdentityUser, Subject, TokenPair } from './types.js';
+import type { IdentityClient, IdentityClientRecord, IdentityGroupRecord, IdentityPermissionRecord, IdentityStore, IdentityUser, IdentityUserRecord, NewGroup, NewPermission, NewUser, Subject, TokenPair, UserChange } from './types.js';
 import { type IdentityFixture } from './fixture.js';
 /**
  * Whether a token minted for one subject names the same user and client.
@@ -17,17 +17,20 @@ import { type IdentityFixture } from './fixture.js';
  * the read paths compare rather than trust the reference.
  */
 export declare class MemoryIdentityStore implements IdentityStore {
-    private readonly users;
+    private readonly userList;
     private readonly passwords;
-    private readonly clients;
+    private readonly groupList;
+    private readonly permissionList;
+    private readonly clientRecords;
+    private readonly clientMap;
     private readonly pairs;
     private readonly access;
     private readonly refresh;
     private readonly codes;
     private readonly claimed;
     constructor(fixture?: IdentityFixture);
-    userByName(username: string): Promise<IdentityUser | undefined>;
-    userById(uid: string): Promise<IdentityUser | undefined>;
+    userByName(username: string): Promise<IdentityUserRecord | undefined>;
+    userById(uid: string): Promise<IdentityUserRecord | undefined>;
     /** A fixture holds the password in clear, so the check is an equality. */
     passwordMatches(user: IdentityUser, password: string): Promise<boolean>;
     client(clientId: string): Promise<IdentityClient | undefined>;
@@ -57,5 +60,26 @@ export declare class MemoryIdentityStore implements IdentityStore {
     issueCode(subject: Subject): Promise<string>;
     readCode(code: string): Promise<Subject | undefined>;
     claimCode(code: string): Promise<boolean>;
+    users(): Promise<IdentityUserRecord[]>;
+    /** A user as the administration routes report one: groups derived, not stored. */
+    private recordOf;
+    createUser(input: NewUser): Promise<IdentityUserRecord>;
+    updateUser(uid: string, change: UserChange): Promise<IdentityUserRecord | undefined>;
+    deleteUser(uid: string): Promise<void>;
+    setPassword(uid: string, password: string): Promise<void>;
+    groups(): Promise<IdentityGroupRecord[]>;
+    groupById(uid: string): Promise<IdentityGroupRecord | undefined>;
+    groupByName(name: string): Promise<IdentityGroupRecord | undefined>;
+    createGroup(input: NewGroup): Promise<IdentityGroupRecord>;
+    deleteGroup(uid: string): Promise<void>;
+    addToGroup(groupUid: string, userUid: string): Promise<IdentityGroupRecord | undefined>;
+    removeFromGroup(groupUid: string, userUid: string): Promise<IdentityGroupRecord | undefined>;
+    permissions(): Promise<IdentityPermissionRecord[]>;
+    permissionById(uid: string): Promise<IdentityPermissionRecord | undefined>;
+    createPermission(input: NewPermission): Promise<IdentityPermissionRecord>;
+    setPermissionSetting(uid: string, setting: string): Promise<IdentityPermissionRecord | undefined>;
+    deletePermission(uid: string): Promise<void>;
+    clients(): Promise<IdentityClientRecord[]>;
+    createClient(input: IdentityClientRecord): Promise<IdentityClientRecord>;
 }
 //# sourceMappingURL=memory-store.d.ts.map

package/build/esm/identity/memory-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-store.d.ts","sourceRoot":"","sources":["../../../src/identity/memory-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,OAAO,EACP,SAAS,EACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,cAAc,CAAA;AAyDrB;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAEhC,OAAO,GAAE,eAAkC;IAsDjD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAI/D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAI9D,0EAA0E;IACpE,eAAe,CACnB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAIb,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI7D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBzE;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAI9D,OAAO,CAAC,OAAO;IAef;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAWzD,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAS5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIpD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAKhD"}
+{"version":3,"file":"memory-store.d.ts","sourceRoot":"","sources":["../../../src/identity/memory-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,YAAY,CAAA;AACnB,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,cAAc,CAAA;AA+DrB;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAC7E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAEhC,OAAO,GAAE,eAAkC;IA+FjD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAOrE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAKpE,0EAA0E;IACpE,eAAe,CACnB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAIb,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAI7D,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBzE;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAI9D,OAAO,CAAC,OAAO;IAef;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAWzD,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAS5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIpD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzC,KAAK,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAI5C,kFAAkF;IAClF,OAAO,CAAC,QAAQ;IASV,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAevD,UAAU,CACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAepC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAatC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD,MAAM,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAIxC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAIhE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAInE,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAY1D,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvC,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAOrC,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAOrC,WAAW,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAIlD,cAAc,CAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAI1C,gBAAgB,CACpB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,wBAAwB,CAAC;IAa9B,oBAAoB,CACxB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAO1C,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,OAAO,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI1C,YAAY,CAChB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,oBAAoB,CAAC;CASjC"}