@selvajs/platform 0.17.0 → 0.19.0

package/dist/invites/types.d.ts

@@ -1,4 +1,5 @@
 import type { OrgRole, OrgPermission } from '../organizations/schemas.js';
+import type { PlatformPermission } from '../permissions/types.js';
 /**
  * "The holder of the raw token whose hash is `tokenHash` may join `orgId` at
  * `orgRole` with these org permissions." Accepting creates the user (if
@@ -22,6 +23,15 @@ export interface Invite {
     orgRole: OrgRole;
     /** May be empty — adapters may seed from `DEFAULT_ORG_PERMISSIONS` in that case. */
     orgPermissions: OrgPermission[];
+    /**
+     * Instance-wide permissions granted on accept — usually empty.
+     *
+     * Only a caller who already holds `instance_admin` may mint an invite
+     * carrying these; the mint route enforces that, because anyone able to set
+     * this field can hand out `instance_admin` and escalate past org scope.
+     * Optional so invites stored before this field existed still parse.
+     */
+    platformPermissions?: PlatformPermission[];
     invitedBy: string;
     createdAt: string;
     expiresAt: string;

package/dist/invites/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/invites/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,0GAA0G;IAC1G,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/invites/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,0GAA0G;IAC1G,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/permissions/interface.d.ts

@@ -36,5 +36,22 @@ export interface IPlatformPermissionStore {
      * admin and the op must be refused. Must exclude disabled users.
      */
     countInstanceAdminsExcluding(ctx: RequestContext, excludeUserId: string): Promise<number>;
+    /**
+     * First-run bootstrap: grant `userId` every platform permission **only if
+     * the instance has no enabled `instance_admin` yet**. Returns whether this
+     * call was the one that claimed it.
+     *
+     * Exists because `hasInstanceAdmin()` followed by `set()` is a read-then-
+     * write: on a fresh single-tenant install with no
+     * `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` configured, any signer is eligible, so
+     * two people signing in at the same moment both observe "no admin" and both
+     * become permanent platform admins. §2 promises "first signer wins" — this
+     * is what makes that true rather than aspirational.
+     *
+     * Same shape as the sole-admin invariant (`set`), pointing the other way:
+     * that one refuses to drop the last admin, this one refuses to create a
+     * second first admin. Adapters MUST make the check and the write atomic.
+     */
+    claimFirstInstanceAdmin(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<boolean>;
 }
 //# sourceMappingURL=interface.d.ts.map

package/dist/permissions/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/permissions/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACxC,wFAAwF;IACxF,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE3E,kBAAkB;IAClB,WAAW,CACV,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,GAAG,CACF,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;OAGG;IACH,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExD;;;;OAIG;IACH,4BAA4B,CAAC,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1F"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/permissions/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACxC,wFAAwF;IACxF,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE3E,kBAAkB;IAClB,WAAW,CACV,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,GAAG,CACF,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;OAGG;IACH,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExD;;;;OAIG;IACH,4BAA4B,CAAC,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1F;;;;;;;;;;;;;;;OAeG;IACH,uBAAuB,CACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,OAAO,CAAC,CAAC;CACpB"}

package/dist/shareLinks/index.d.ts

@@ -1,4 +1,4 @@
-export type { ShareLink } from './types.js';
+export type { OrgShareLink, ShareLink } from './types.js';
 export type { IShareLinkStore } from './interface.js';
 export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './types.js';
 export type { CreateShareLinkInput } from './schemas.js';

package/dist/shareLinks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shareLinks/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shareLinks/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1D,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC"}

package/dist/shareLinks/interface.d.ts

@@ -1,6 +1,6 @@
 import type { RequestContext } from '../context.js';
 import type { ListOptions, Page } from '../pagination.js';
-import type { ShareLink } from './types.js';
+import type { OrgShareLink, ShareLink } from './types.js';
 /**
  * Per-definition tokens granting unauthenticated access to one
  * (definitionId, channel). The store sees only the HMAC hash; the raw token
@@ -13,6 +13,19 @@ export interface IShareLinkStore {
     create(ctx: RequestContext, link: ShareLink): Promise<void>;
     /** Newest first by `createdAt`. Excludes revoked links. */
     listByDefinition(ctx: RequestContext, definitionId: string, opts?: ListOptions): Promise<Page<ShareLink>>;
+    /**
+     * Every live link across every definition in the org, newest first.
+     *
+     * A share link is a bearer credential: the URL is the whole authentication.
+     * Listing by definition — the only other read — means "what reaches my org's
+     * data right now?" can only be answered by walking every definition by hand,
+     * so in practice it goes unanswered. Offboarding depends on this being one
+     * query.
+     *
+     * Rows carry the definition and project they hang off, because a roster of
+     * bare GUIDs is not something anyone can act on.
+     */
+    listByOrg(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<OrgShareLink>>;
     getById(ctx: RequestContext, id: string): Promise<ShareLink | null>;
     /** Returns null when the link doesn't exist, is revoked, or its parent definition is soft-deleted. */
     getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<ShareLink | null>;

package/dist/shareLinks/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/shareLinks/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B,+CAA+C;IAC/C,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,2DAA2D;IAC3D,gBAAgB,CACf,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,sGAAsG;IACtG,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClF,iDAAiD;IACjD,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,sBAAsB,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChF"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/shareLinks/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B,+CAA+C;IAC/C,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,2DAA2D;IAC3D,gBAAgB,CACf,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACpE,sGAAsG;IACtG,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClF,iDAAiD;IACjD,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,sBAAsB,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChF"}

package/dist/shareLinks/types.d.ts

@@ -23,6 +23,23 @@ export interface ShareLink {
     maxSolves?: number | null;
     solveCount: number;
 }
+/**
+ * A share link plus the definition and project it hangs off.
+ *
+ * The org-wide roster is the one read where the parent matters: `definitionId`
+ * alone identifies nothing a person can recognize, and revoking the wrong link
+ * is unrecoverable — the raw token is gone.
+ *
+ * `tokenHash` is omitted, not merely unused. This is the only share-link shape
+ * built for a page, and the roster spans every definition in the org — so a
+ * careless `JSON.stringify` here would ship every credential digest in the
+ * tenant to the browser at once.
+ */
+export interface OrgShareLink extends Omit<ShareLink, 'tokenHash'> {
+    definitionName: string;
+    projectId: string;
+    projectName: string;
+}
 /**
  * Default cap applied when the minter doesn't specify one. Tokens are
  * leak-prone by design (visible in iframes), so a default bounds the

package/dist/shareLinks/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shareLinks/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shareLinks/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;IACjE,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC"}

package/dist/shareLinks/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shareLinks/types.ts"],"names":[],"mappings":"AA2BA;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shareLinks/types.ts"],"names":[],"mappings":"AA6CA;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC"}

package/dist/testing/suites/inviteStoreSuite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inviteStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/inviteStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAExF,MAAM,WAAW,eAAe;IAC/B,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAC/D,QAAQ,CAAC,EAAE,UAAU,CAAC;CACtB;AA6BD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,6BAA6B,GAAG,IAAI,CA4EnF"}
+{"version":3,"file":"inviteStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/inviteStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAExF,MAAM,WAAW,eAAe;IAC/B,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAC/D,QAAQ,CAAC,EAAE,UAAU,CAAC;CACtB;AA6BD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,6BAA6B,GAAG,IAAI,CAuInF"}

package/dist/testing/suites/inviteStoreSuite.js

@@ -108,6 +108,53 @@ export function runInviteStoreConformance(opts) {
             const got = await store.getByTokenHash(SYSTEM_CONTEXT, inv.tokenHash);
             expect(got).toBeNull();
         });
+        it('revokePendingByEmail kills every pending invite to that address', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const email = `offboard-${makeUuid()}@test.local`;
+            const first = invite(scope, { email });
+            const second = invite(scope, { email });
+            await store.create(ctx(scope.adminId), first);
+            await store.create(ctx(scope.adminId), second);
+            const revoked = await store.revokePendingByEmail(ctx(scope.adminId), scope.orgId, email);
+            expect(revoked.sort()).toEqual([first.id, second.id].sort());
+            expect(await store.getByTokenHash(SYSTEM_CONTEXT, first.tokenHash)).toBeNull();
+            expect(await store.getByTokenHash(SYSTEM_CONTEXT, second.tokenHash)).toBeNull();
+        });
+        it('revokePendingByEmail leaves other addresses and other orgs alone', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const target = `target-${makeUuid()}@test.local`;
+            const bystander = invite(scope, { email: `bystander-${makeUuid()}@test.local` });
+            await store.create(ctx(scope.adminId), invite(scope, { email: target }));
+            await store.create(ctx(scope.adminId), bystander);
+            await store.revokePendingByEmail(ctx(scope.adminId), scope.orgId, target);
+            expect(await store.getByTokenHash(SYSTEM_CONTEXT, bystander.tokenHash)).not.toBeNull();
+        });
+        it('revokePendingByEmail does not un-consume an accepted invite', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const { userId: acceptor } = await seedUser(makeUuid());
+            const email = `accepted-${makeUuid()}@test.local`;
+            const inv = invite(scope, { email });
+            await store.create(ctx(scope.adminId), inv);
+            await store.markAccepted(SYSTEM_CONTEXT, inv.id, acceptor);
+            // Accepting is history, not a live grant — offboarding must not erase
+            // the record that this person once joined.
+            const revoked = await store.revokePendingByEmail(ctx(scope.adminId), scope.orgId, email);
+            expect(revoked).toEqual([]);
+            const listed = await store.listByOrg(ctx(scope.adminId), scope.orgId, { limit: 100 });
+            expect(listed.items.find((i) => i.id === inv.id)?.acceptedAt).toBeTruthy();
+        });
+        it('revokePendingByEmail matches case-insensitively', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const email = `mixed-${makeUuid()}@test.local`;
+            const inv = invite(scope, { email });
+            await store.create(ctx(scope.adminId), inv);
+            const revoked = await store.revokePendingByEmail(ctx(scope.adminId), scope.orgId, email.toUpperCase());
+            expect(revoked).toEqual([inv.id]);
+        });
     });
 }
 //# sourceMappingURL=inviteStoreSuite.js.map

package/dist/testing/suites/inviteStoreSuite.js.map

@@ -1 +1 @@
-{"version":3,"file":"inviteStoreSuite.js","sourceRoot":"","sources":["../../../src/testing/suites/inviteStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAmB,MAAM,cAAc,CAAC;AAqBxF,SAAS,MAAM,CAAC,KAAsB,EAAE,YAA6B,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,EAAE,IAAI,QAAQ,EAAE;QAC9B,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,yCAAyC;QACzC,SAAS,EACR,SAAS,CAAC,SAAS,IAAI,QAAQ,QAAQ,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACtF,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa;QACxF,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK;QACrC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,QAAQ;QACtC,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,EAAE;QAC9C,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO;QAC/C,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW,EAAE;QACnD,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7F,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;KAC5C,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAoB;IACtC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACd,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAmC;IAC5E,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACzE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,KAAK,IAA8B,EAAE;QACrD,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QAC5D,IAAI,CAAC,CAAC,iBAAiB;YAAE,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,QAAQ,CAAC,6BAA6B,IAAI,EAAE,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;YAClG,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"inviteStoreSuite.js","sourceRoot":"","sources":["../../../src/testing/suites/inviteStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAmB,MAAM,cAAc,CAAC;AAqBxF,SAAS,MAAM,CAAC,KAAsB,EAAE,YAA6B,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,OAAO;QACN,EAAE,EAAE,SAAS,CAAC,EAAE,IAAI,QAAQ,EAAE;QAC9B,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,yCAAyC;QACzC,SAAS,EACR,SAAS,CAAC,SAAS,IAAI,QAAQ,QAAQ,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACtF,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa;QACxF,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK;QACrC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,QAAQ;QACtC,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,EAAE;QAC9C,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO;QAC/C,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW,EAAE;QACnD,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7F,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;KAC5C,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAoB;IACtC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACd,CAAC;AAEF,MAAM,UAAU,yBAAyB,CAAC,IAAmC;IAC5E,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACzE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,KAAK,IAA8B,EAAE;QACrD,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QAC5D,IAAI,CAAC,CAAC,iBAAiB;YAAE,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC;IACV,CAAC,CAAC;IAEF,QAAQ,CAAC,6BAA6B,IAAI,EAAE,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;aACtD,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;YAClG,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,YAAY,QAAQ,EAAE,aAAa,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACxC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YAE/C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/E,MAAM,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,UAAU,QAAQ,EAAE,aAAa,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,aAAa,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YACjF,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;YAElD,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YAC5E,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,YAAY,QAAQ,EAAE,aAAa,CAAC;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAE3D,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,SAAS,QAAQ,EAAE,aAAa,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YAE5C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAC/C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAClB,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,WAAW,EAAE,CACnB,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/testing/suites/platformPermissionStoreSuite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platformPermissionStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/platformPermissionStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAkB,MAAM,gBAAgB,CAAC;AAG/E,MAAM,WAAW,yCAAyC;IACzD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,EAAE,MAAM,OAAO,CAAC;QAC1B,KAAK,EAAE,wBAAwB,CAAC;QAChC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;KAChC,CAAC,CAAC;IACH;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,qCAAqC,CACpD,IAAI,EAAE,yCAAyC,GAC7C,IAAI,CAqMN"}
+{"version":3,"file":"platformPermissionStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/platformPermissionStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAkB,MAAM,gBAAgB,CAAC;AAG/E,MAAM,WAAW,yCAAyC;IACzD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,EAAE,MAAM,OAAO,CAAC;QAC1B,KAAK,EAAE,wBAAwB,CAAC;QAChC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;KAChC,CAAC,CAAC;IACH;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,qCAAqC,CACpD,IAAI,EAAE,yCAAyC,GAC7C,IAAI,CAkVN"}

package/dist/testing/suites/platformPermissionStoreSuite.js

@@ -29,6 +29,14 @@ export function runPlatformPermissionStoreConformance(opts) {
             orgPermissions: []
         };
     }
+    /** §8's user-admin role: runs `/admin/users`, holds no `instance_admin`. */
+    function userAdminCtx(userId) {
+        return {
+            userId,
+            platformPermissions: ['manage_instance_users'],
+            orgPermissions: []
+        };
+    }
     describe(`IPlatformPermissionStore conformance: ${name}`, () => {
         beforeEach(() => {
             // Every test creates its own store via createStore — no shared state.
@@ -113,6 +121,89 @@ export function runPlatformPermissionStoreConformance(opts) {
             const after = await store.getFor(adminCtx(adminA), adminB);
             expect(after).toContain('instance_admin');
         });
+        // The invariant has to survive concurrency, not just sequence. Two admins
+        // demoting each other at the same moment used to each read the other as
+        // "another admin exists" and both commit, bricking the instance. Exactly
+        // one must win.
+        it('concurrent demotions of two admins leave one standing', async () => {
+            const { store, seedUser } = await createStore();
+            const adminA = await seedUser();
+            const adminB = await seedUser();
+            await store.set(adminCtx(adminA), adminA, ['instance_admin']);
+            await store.set(adminCtx(adminA), adminB, ['instance_admin']);
+            const [resA, resB] = await Promise.all([
+                store.set(adminCtx(adminA), adminA, []),
+                store.set(adminCtx(adminB), adminB, [])
+            ]);
+            // One demotion succeeds, the other is refused — never both.
+            expect([resA, resB].filter((r) => r === 'ok')).toHaveLength(1);
+            expect([resA, resB].filter((r) => r === 'last_admin')).toHaveLength(1);
+            const sysCtx = {
+                userId: '',
+                platformPermissions: [],
+                orgPermissions: [],
+                system: true
+            };
+            expect(await store.hasInstanceAdmin(sysCtx)).toBe(true);
+        });
+        it('a burst of concurrent demotions never drops the last admin', async () => {
+            const { store, seedUser } = await createStore();
+            // Seeded sequentially on purpose: concurrent seeding races the
+            // adapter's own row-creation writes, which is not what this asserts.
+            const ids = [];
+            for (let i = 0; i < 4; i++)
+                ids.push(await seedUser());
+            for (const id of ids)
+                await store.set(adminCtx(ids[0]), id, ['instance_admin']);
+            const results = await Promise.all(ids.map((id) => store.set(adminCtx(id), id, [])));
+            // Whatever the interleaving, exactly one admin survives.
+            expect(results.filter((r) => r === 'ok')).toHaveLength(ids.length - 1);
+            expect(results.filter((r) => r === 'last_admin')).toHaveLength(1);
+            const sysCtx = {
+                userId: '',
+                platformPermissions: [],
+                orgPermissions: [],
+                system: true
+            };
+            expect(await store.hasInstanceAdmin(sysCtx)).toBe(true);
+        });
+        it('claimFirstInstanceAdmin grants on a fresh instance and refuses once claimed', async () => {
+            const { store, seedUser } = await createStore();
+            const first = await seedUser();
+            const second = await seedUser();
+            const sysCtx = {
+                userId: '',
+                platformPermissions: [],
+                orgPermissions: [],
+                system: true
+            };
+            expect(await store.claimFirstInstanceAdmin(sysCtx, first, ['instance_admin'])).toBe(true);
+            expect(await store.getFor(adminCtx(first), first)).toContain('instance_admin');
+            // The instance is claimed. A later signer must not become a second
+            // "first" admin, however they arrive.
+            expect(await store.claimFirstInstanceAdmin(sysCtx, second, ['instance_admin'])).toBe(false);
+            expect(await store.getFor(adminCtx(first), second)).not.toContain('instance_admin');
+        });
+        it('a burst of concurrent first-admin claims produces exactly one admin', async () => {
+            const { store, seedUser } = await createStore();
+            // The §2 "first signer wins" promise. With no
+            // BOOTSTRAP_INSTANCE_ADMIN_EMAIL configured every signer is eligible,
+            // so this is four different people hitting a fresh install at once —
+            // the read-then-write version granted all four.
+            const ids = [];
+            for (let i = 0; i < 4; i++)
+                ids.push(await seedUser());
+            const sysCtx = {
+                userId: '',
+                platformPermissions: [],
+                orgPermissions: [],
+                system: true
+            };
+            const results = await Promise.all(ids.map((id) => store.claimFirstInstanceAdmin(sysCtx, id, ['instance_admin'])));
+            expect(results.filter(Boolean)).toHaveLength(1);
+            const admins = await store.getForBatch(adminCtx(ids[0]), ids);
+            expect([...admins.values()].filter((p) => p.includes('instance_admin'))).toHaveLength(1);
+        });
         it('countInstanceAdminsExcluding excludes the named user', async () => {
             const { store, seedUser } = await createStore();
             const adminA = await seedUser();
@@ -190,6 +281,35 @@ export function runPlatformPermissionStoreConformance(opts) {
             const target = await seedUser();
             await expect(store.getForBatch(selfCtx(attacker), [target])).rejects.toThrow();
         });
+        // §8 — `manage_instance_users` runs the user-admin surface, so it must be
+        // able to see who holds `instance_admin`: without that read the page cannot
+        // render its locks, and `/admin/users` fails for the exact role it serves.
+        // The two adapters disagreed here (local admitted the role, Supabase did
+        // not), which surfaced as "User store unavailable" on Supabase only. Read
+        // access is not authority — the `set` case below is what keeps them apart.
+        it('manage_instance_users can batch-read platform permissions', async () => {
+            const { store, seedUser } = await createStore();
+            const admin = await seedUser();
+            const userAdmin = await seedUser();
+            await store.set(adminCtx(admin), admin, ['instance_admin']);
+            const map = await store.getForBatch(userAdminCtx(userAdmin), [admin, userAdmin]);
+            expect(map.get(admin)).toContain('instance_admin');
+        });
+        it('manage_instance_users can read another user’s permissions singly', async () => {
+            const { store, seedUser } = await createStore();
+            const admin = await seedUser();
+            const userAdmin = await seedUser();
+            await store.set(adminCtx(admin), admin, ['instance_admin']);
+            // Single and batch reads must agree; when they didn't, the delete/disable
+            // routes threw 500 where they meant to return 403.
+            expect(await store.getFor(userAdminCtx(userAdmin), admin)).toContain('instance_admin');
+        });
+        it('manage_instance_users cannot grant permissions', async () => {
+            const { store, seedUser } = await createStore();
+            const target = await seedUser();
+            const userAdmin = await seedUser();
+            await expect(store.set(userAdminCtx(userAdmin), target, ['instance_admin'])).rejects.toThrow();
+        });
     });
 }
 //# sourceMappingURL=platformPermissionStoreSuite.js.map

package/dist/testing/suites/platformPermissionStoreSuite.js.map

@@ -1 +1 @@
-{"version":3,"file":"platformPermissionStoreSuite.js","sourceRoot":"","sources":["../../../src/testing/suites/platformPermissionStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAyB/E,MAAM,UAAU,qCAAqC,CACpD,IAA+C;IAE/C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;IAEjD,SAAS,QAAQ,CAAC,MAAc;QAC/B,OAAO;YACN,MAAM;YACN,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;YAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;SACxC,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,MAAc;QAC9B,OAAO;YACN,MAAM;YACN,mBAAmB,EAAE,EAAE;YACvB,cAAc,EAAE,EAAE;SAClB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,yCAAyC,IAAI,EAAE,EAAE,GAAG,EAAE;QAC9D,UAAU,CAAC,GAAG,EAAE;YACf,sEAAsE;QACvE,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,KAAK,IAAI,EAAE;YACpB,IAAI,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,CAAU,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,qDAAqD;YACrD,MAAM,KAAK,GAAG,sCAAsC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;YACxF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,wCAAwC;QACxC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,wBAAwB;YACxB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,+CAA+C;YAC/C,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzE,+CAA+C;YAC/C,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,aAAa,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,WAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,aAAa,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,WAAY,CAAC,MAAM,CAAC,CAAC;YAC3B,iEAAiE;YACjE,4DAA4D;YAC5D,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAChF,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platformPermissionStoreSuite.js","sourceRoot":"","sources":["../../../src/testing/suites/platformPermissionStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAyB/E,MAAM,UAAU,qCAAqC,CACpD,IAA+C;IAE/C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;IAEjD,SAAS,QAAQ,CAAC,MAAc;QAC/B,OAAO;YACN,MAAM;YACN,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;YAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;SACxC,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,MAAc;QAC9B,OAAO;YACN,MAAM;YACN,mBAAmB,EAAE,EAAE;YACvB,cAAc,EAAE,EAAE;SAClB,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS,YAAY,CAAC,MAAc;QACnC,OAAO;YACN,MAAM;YACN,mBAAmB,EAAE,CAAC,uBAAuB,CAAC;YAC9C,cAAc,EAAE,EAAE;SAClB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,yCAAyC,IAAI,EAAE,EAAE,GAAG,EAAE;QAC9D,UAAU,CAAC,GAAG,EAAE;YACf,sEAAsE;QACvE,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,KAAK,IAAI,EAAE;YACpB,IAAI,OAAO;gBAAE,MAAM,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,CAAU,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,qDAAqD;YACrD,MAAM,KAAK,GAAG,sCAAsC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;YACxF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,wCAAwC;QACxC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,wBAAwB;YACxB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,gBAAgB;QAChB,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAE9D,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACtC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;gBACvC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;aACvC,CAAC,CAAC;YAEH,4DAA4D;YAC5D,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAEvE,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC3E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,+DAA+D;YAC/D,qEAAqE;YACrE,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;YACvD,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAEhF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAEpF,yDAAyD;YACzD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAElE,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YAEF,MAAM,CAAC,MAAM,KAAK,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1F,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAE/E,mEAAmE;YACnE,sCAAsC;YACtC,MAAM,CAAC,MAAM,KAAK,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5F,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,8CAA8C;YAC9C,sEAAsE;YACtE,qEAAqE;YACrE,gDAAgD;YAChD,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;YACvD,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAC9E,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9D,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,+CAA+C;YAC/C,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzE,+CAA+C;YAC/C,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,aAAa,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,WAAY,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,aAAa,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAmB;gBAC9B,MAAM,EAAE,EAAE;gBACV,mBAAmB,EAAE,EAAE;gBACvB,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,IAAI;aACZ,CAAC;YACF,MAAM,WAAY,CAAC,MAAM,CAAC,CAAC;YAC3B,iEAAiE;YACjE,4DAA4D;YAC5D,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,CAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAE5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAE5D,0EAA0E;YAC1E,mDAAmD;YACnD,MAAM,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,QAAQ,EAAE,CAAC;YACnC,MAAM,MAAM,CACX,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAC9D,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/testing/suites/shareLinkStoreSuite.d.ts

@@ -19,6 +19,14 @@ export interface ShareLinkTestScope {
     definitionId: string;
     /** A second definition id for cross-definition isolation tests. */
     otherDefinitionId: string;
+    /**
+     * Org owning both definitions' project. Set it to run the `listByOrg`
+     * cases; adapters that can't seed the definition→project→org chain leave it
+     * undefined and those cases skip.
+     */
+    orgId?: string;
+    /** An org with no share links, to prove the roster is tenant-scoped. */
+    otherOrgId?: string;
 }
 export interface ShareLinkStoreConformanceOptions {
     name: string;

package/dist/testing/suites/shareLinkStoreSuite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shareLinkStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/shareLinkStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAoBrE,MAAM,WAAW,kBAAkB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAC9D;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACrE;AA0BD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,gCAAgC,GAAG,IAAI,CAmKzF"}
+{"version":3,"file":"shareLinkStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/shareLinkStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAoBrE,MAAM,WAAW,kBAAkB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gCAAgC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAC9D;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACrE;AA0BD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,gCAAgC,GAAG,IAAI,CAmPzF"}

package/dist/testing/suites/shareLinkStoreSuite.js

@@ -99,9 +99,9 @@ export function runShareLinkStoreConformance(opts) {
             const got = await store.getByTokenHash(ctx(scope.ownerId), 'will-revoke');
             expect(got).toBeNull();
         });
-        // Expiry is a store-level filter, not just a route-level check: the local
-        // store once tested only `revokedAt`, so an expired link stayed listed and
-        // resolvable while Supabase (which filters both in SQL) reported it dead.
+        // Expiry is a store-level filter, not just a route-level check. Each
+        // provider has at some point filtered only `revokedAt`, leaving an expired
+        // link listed and resolvable there while the other reported it dead.
         it('an expired link is excluded from listByDefinition', async () => {
             const store = await createStore();
             const scope = await scopeFor();
@@ -132,6 +132,81 @@ export function runShareLinkStoreConformance(opts) {
             const got = await store.getByTokenHash(ctx(scope.ownerId), 'not-yet-expired');
             expect(got?.id).toBe(l.id);
         });
+        // The org roster is the only read that answers "what reaches this
+        // tenant's data right now?". `it.skipIf` rather than an omitted block, so
+        // an adapter that stops seeding an org shows as skipped instead of silently
+        // covering nothing.
+        describe('listByOrg', () => {
+            it('returns links across every definition in the org, newest first', async () => {
+                const scope = await scopeFor();
+                if (!scope.orgId)
+                    return;
+                const store = await createStore();
+                const a = link(scope, { createdAt: '2026-04-01T00:00:00.000Z' });
+                const b = link(scope, {
+                    definitionId: scope.otherDefinitionId,
+                    createdAt: '2026-04-02T00:00:00.000Z'
+                });
+                await store.create(ctx(scope.ownerId), a);
+                await store.create(ctx(scope.ownerId), b);
+                const page = await store.listByOrg(ctx(scope.ownerId), scope.orgId, { limit: 100 });
+                expect(page.items.map((l) => l.id)).toEqual([b.id, a.id]);
+            });
+            it('names the parent definition and project on every row', async () => {
+                const scope = await scopeFor();
+                if (!scope.orgId)
+                    return;
+                const store = await createStore();
+                const l = link(scope);
+                await store.create(ctx(scope.ownerId), l);
+                const page = await store.listByOrg(ctx(scope.ownerId), scope.orgId, { limit: 100 });
+                const row = page.items.find((x) => x.id === l.id);
+                // A roster of bare GUIDs can't be acted on — revoking the wrong link
+                // is unrecoverable.
+                expect(row?.definitionName).toBeTruthy();
+                expect(row?.projectName).toBeTruthy();
+                expect(row?.projectId).toBeTruthy();
+            });
+            it('never carries tokenHash — the roster spans the whole tenant', async () => {
+                const scope = await scopeFor();
+                if (!scope.orgId)
+                    return;
+                const store = await createStore();
+                await store.create(ctx(scope.ownerId), link(scope));
+                const page = await store.listByOrg(ctx(scope.ownerId), scope.orgId, { limit: 100 });
+                expect(page.items.length).toBeGreaterThan(0);
+                for (const row of page.items) {
+                    expect(row).not.toHaveProperty('tokenHash');
+                }
+            });
+            it('excludes revoked and expired links', async () => {
+                const scope = await scopeFor();
+                if (!scope.orgId)
+                    return;
+                const store = await createStore();
+                const revoked = link(scope);
+                const expired = link(scope, { expiresAt: new Date(Date.now() - 60_000).toISOString() });
+                const live = link(scope);
+                await store.create(ctx(scope.ownerId), revoked);
+                await store.create(ctx(scope.ownerId), expired);
+                await store.create(ctx(scope.ownerId), live);
+                await store.revoke(ctx(scope.ownerId), revoked.id);
+                const page = await store.listByOrg(ctx(scope.ownerId), scope.orgId, { limit: 100 });
+                const ids = page.items.map((x) => x.id);
+                expect(ids).toContain(live.id);
+                expect(ids).not.toContain(revoked.id);
+                expect(ids).not.toContain(expired.id);
+            });
+            it('does not leak links into another org', async () => {
+                const scope = await scopeFor();
+                if (!scope.orgId || !scope.otherOrgId)
+                    return;
+                const store = await createStore();
+                await store.create(ctx(scope.ownerId), link(scope));
+                const page = await store.listByOrg(ctx(scope.ownerId), scope.otherOrgId, { limit: 100 });
+                expect(page.items).toHaveLength(0);
+            });
+        });
         it('revoke is idempotent (no error on double-revoke)', async () => {
             const store = await createStore();
             const scope = await scopeFor();