@selvajs/server 1.5.0-beta.1 → 1.5.0-beta.11

package/dist/handlers/apiTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiTokens.d.ts","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAKN,KAAK,oBAAoB,EAEzB,KAAK,cAAc,EACnB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAiH9D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,UAU3B,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,cAAc,EAAE,UAqC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,UAY5B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACxC,KAAK,EAAE,cAAc,GAAG,SAAS,EACjC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,EACtD,GAAG,EAAE,OAAO,GACV,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"apiTokens.d.ts","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAKN,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAiB9D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC/B,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EACxB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,OAAO,CAAC,CAElB;AAkBD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAMrE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,GAAI,KAAK,cAAc,KAAG,OACrB,CAAC;AAE1C;;;;GAIG;AACH,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,EAAE,MAAc,EAAE,GAAG,IAAI,EAAE,GAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAS5B;AAyED,wGAAwG;AACxG,eAAO,MAAM,aAAa,EAAE,UAO3B,CAAC;AAEF,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,oBAAoB,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,WAAW,CAAC;IACnB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CA6CzB;AAED,2FAA2F;AAC3F,eAAO,MAAM,cAAc,EAAE,UAQ5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,UAY5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAW/B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACxC,KAAK,EAAE,cAAc,GAAG,SAAS,EACjC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,EACtD,GAAG,EAAE,OAAO,GACV,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/handlers/apiTokens.js

@@ -2,7 +2,8 @@
  * API tokens: mint, list, revoke.
  *
  * **Session-only.** A key can't manage keys, so a leaked one can't mint more or
- * revoke the owner's others to cover its tracks.
+ * revoke the owner's others to cover its tracks. The one exception is a key
+ * revoking itself, which only ever takes access away.
  *
  * **The raw key exists only in the mint response.** The store holds its HMAC,
  * and every response goes through a schema that has no `tokenHash`.
@@ -11,7 +12,8 @@ import { randomUUID } from 'node:crypto';
 import { describeApiScope, hasPermission, parseApiScope } from '@selvajs/platform';
 import { renderApiTokenCreatedEmail } from '@selvajs/notifications';
 import { apiError, ApiErrorCode, ApiTokenResponseSchema, CreateApiTokenBodySchema, CreatedApiTokenResponseSchema, isApiError, noContent, parseBody, parseListOptions, requireCaller, requireParams, scopeRefusalsToday, shapedCollection } from '../api/index.js';
-import { requireActingOrg, requireCanViewProject, requireManageOrgMembers, requirePermission } from '../access/index.js';
+import { requireActingOrg, requireCanViewProject } from '../access/index.js';
+import { canHoldApiTokens } from '../tokens/index.js';
 const DAY_MS = 24 * 60 * 60 * 1000;
 function requireSessionInOrg(req) {
     if (req.ctx?.apiScope) {
@@ -19,6 +21,14 @@ function requireSessionInOrg(req) {
     }
     return requireActingOrg(req, req.params.orgId);
 }
+/**
+ * May `ctx` hold a key with `scopes`, by the host's policy or the default rule?
+ * The one call every mint path makes, so a host's token page and its consent
+ * screen can't disagree with the mint.
+ */
+export function mayHoldApiTokens(deps, ctx, scopes) {
+    return canHoldApiTokens(ctx, scopes, { policy: deps.tokens.mayHoldApiTokens, deps });
+}
 function unavailable() {
     apiError(503, ApiErrorCode.API_TOKENS_UNAVAILABLE, 'API tokens are not available on this server.');
 }
@@ -31,6 +41,23 @@ function codecOf(req) {
 function toResponse(token) {
     return { ...token, refusedToday: scopeRefusalsToday(token.id) };
 }
+/** Who sees every owner's keys in an org and may revoke any of them. */
+export const canManageApiTokenRoster = (ctx) => hasPermission(ctx, 'manage_org_members');
+/**
+ * Keys in `orgId`, newest first, including revoked and expired ones: the
+ * caller's own, or with `roster` everyone's. The list endpoint and a host's
+ * token page both read through here, so they can't disagree on who sees what.
+ */
+export async function listOrgApiTokens(store, ctx, orgId, { roster = false, ...opts } = {}) {
+    if (roster && !canManageApiTokenRoster(ctx)) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Only org admins can see everyone’s API tokens.');
+    }
+    const page = await store.listByOrg(ctx, orgId, {
+        ...opts,
+        userId: roster ? undefined : ctx.userId
+    });
+    return { ...page, items: page.items.map(toResponse) };
+}
 /**
  * Refuse scopes naming something outside this org or out of the creator's
  * sight. Not the security boundary: a key never exceeds its owner's live rights
@@ -95,33 +122,37 @@ async function mailTokenCreated(req, token) {
         });
     }
 }
-/**
- * The caller's own tokens in this org, newest first, including revoked and
- * expired ones. `?all=true` returns everyone's and needs `manage_org_members`.
- */
+/** The caller's own keys in this org. `?all=true` returns everyone's and needs `manage_org_members`. */
 export const listApiTokens = async (req) => {
     const { ctx, orgId } = requireSessionInOrg(req);
-    const all = req.url.searchParams.get('all') === 'true';
-    if (all)
-        requireManageOrgMembers(req);
-    const page = await storeOf(req).listByOrg(ctx, orgId, {
+    const page = await listOrgApiTokens(storeOf(req), ctx, orgId, {
         ...parseListOptions(req.url),
-        userId: all ? undefined : ctx.userId
+        roster: req.url.searchParams.get('all') === 'true'
     });
-    return shapedCollection(ApiTokenResponseSchema, { ...page, items: page.items.map(toResponse) });
+    return shapedCollection(ApiTokenResponseSchema, page);
 };
-/** Mint a token acting as the caller. The raw key is in this response and nowhere else. */
-export const createApiToken = async (req) => {
-    const { ctx, orgId } = requireSessionInOrg(req);
-    requirePermission(req, 'manage_api_tokens');
-    const { user } = requireCaller(req);
+/**
+ * Mint a token acting as the caller, in the caller's acting org. Every mint
+ * goes through here, the token endpoint and an OAuth consent alike, so the
+ * holder rule, the scope checks, the audit event and the owner's email always
+ * apply. A consent screen passes a `req` whose `ctx` acts in the org the user
+ * picked.
+ */
+export async function mintApiToken(req, input) {
+    const { ctx, user } = requireCaller(req);
+    const orgId = ctx.actingOrgId;
+    if (ctx.apiScope || !orgId) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'API tokens can only be created from a signed-in session.');
+    }
+    if (!(await mayHoldApiTokens(req.deps, ctx, input.scopes))) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You can’t create API tokens with this access in this org.');
+    }
     const store = storeOf(req);
     const codec = codecOf(req);
     // A key minted now would only ever get 503.
     const delegated = req.deps.auth.delegatedSession;
     if (delegated && !(await delegated.status()).ok)
         unavailable();
-    const input = await parseBody(req.request, CreateApiTokenBodySchema);
     await assertScopesReachable(req, orgId, input.scopes);
     const raw = codec.mintRawToken();
     const now = new Date();
@@ -141,10 +172,16 @@ export const createApiToken = async (req) => {
     await store.create(ctx, token);
     await mailTokenCreated(req, token);
     const { tokenHash: _hash, ...summary } = token;
+    return { token: toResponse(summary), secret: raw };
+}
+/** Mint a token acting as the caller. The raw key is in this response and nowhere else. */
+export const createApiToken = async (req) => {
+    requireSessionInOrg(req);
+    const input = await parseBody(req.request, CreateApiTokenBodySchema);
     return {
         status: 201,
         headers: { 'Cache-Control': 'no-store' },
-        body: CreatedApiTokenResponseSchema.parse({ token: toResponse(summary), secret: raw })
+        body: CreatedApiTokenResponseSchema.parse(await mintApiToken(req, input))
     };
 };
 /**
@@ -157,12 +194,25 @@ export const revokeApiToken = async (req) => {
     const store = storeOf(req);
     const token = await store.get(ctx, tokenId);
     const own = token?.userId === ctx.userId;
-    if (!token || token.orgId !== orgId || (!own && !hasPermission(ctx, 'manage_org_members'))) {
+    if (!token || token.orgId !== orgId || (!own && !canManageApiTokenRoster(ctx))) {
         apiError(404, ApiErrorCode.NOT_FOUND, 'API token not found');
     }
     await store.revoke(ctx, tokenId, own ? 'owner' : 'admin');
     return noContent();
 };
+/**
+ * Revoke the key that sent this request, and nothing else. Any key may call it,
+ * whatever its scopes, so a client signing out never needs more than it has.
+ * A browser session gets 400: it has no key to revoke.
+ */
+export const revokeOwnApiToken = async (req) => {
+    const { ctx } = requireCaller(req);
+    if (!ctx.apiScope) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, 'Only an API token can revoke itself. Revoke tokens from the web app instead.');
+    }
+    await storeOf(req).revoke(ctx, ctx.apiScope.tokenId, 'owner');
+    return noContent();
+};
 /**
  * Revoke every live key `userId` holds, in one org or (no `orgId`) all of
  * them. Call it when someone leaves an org or is disabled: the resolver already

package/dist/handlers/apiTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiTokens.js","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,gBAAgB,EAChB,aAAa,EACb,aAAa,EAOb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,UAAU,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,SAAS,mBAAmB,CAAC,GAAe;IAC3C,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,wEAAwE,CACxE,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW;IACnB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,sBAAsB,EACnC,8CAA8C,CAC9C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB;IACzC,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CACnC,GAAe,EACf,KAAa,EACb,MAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE,CACzC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAC3B,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK;gBAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACtE,SAAS;QACV,CAAC;QAED,IAAI,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,GACX,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1D,MAAM,CAAC,iBAAiB,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,oBAAoB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,KAAe;IAC/D,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;IAC3B,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE;QAAE,OAAO;IAClC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,aAAa,CAAC,IAAI,CACvB,0BAA0B,CAAC;YAC1B,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE;SAC9D,CAAC,EACF,GAAG,CAAC,GAAG,CACP,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAChD,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IACvD,IAAI,GAAG;QAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;QACrD,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;KACpC,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,sBAAsB,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,4CAA4C;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjD,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAa;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QAC/E,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEnC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,OAAO;QACN,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;QACxC,IAAI,EAAE,6BAA6B,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KACtF,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QAC5F,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,KAAiC,EACjC,GAAmB,EACnB,MAAc,EACd,IAAsD,EACtD,GAAY;IAEZ,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;YACxC,SAAS,EAAE,WAAW;YACtB,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}
+{"version":3,"file":"apiTokens.js","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,gBAAgB,EAChB,aAAa,EACb,aAAa,EAUb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,UAAU,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAsB,MAAM,oBAAoB,CAAC;AAE1E,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,SAAS,mBAAmB,CAAC,GAAe;IAC3C,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,wEAAwE,CACxE,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC/B,IAAwB,EACxB,GAAmB,EACnB,MAAyB;IAEzB,OAAO,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,WAAW;IACnB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,sBAAsB,EACnC,8CAA8C,CAC9C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACnD,CAAC;AAID,SAAS,UAAU,CAAC,KAAsB;IACzC,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAmB,EAAW,EAAE,CACvE,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,KAAqB,EACrB,GAAmB,EACnB,KAAa,EACb,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,IAAI,KAAyC,EAAE;IAEpE,IAAI,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gDAAgD,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;QAC9C,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;KACvC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CACnC,GAAe,EACf,KAAa,EACb,MAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE,CACzC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAC3B,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK;gBAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACtE,SAAS;QACV,CAAC;QAED,IAAI,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,GACX,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1D,MAAM,CAAC,iBAAiB,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,oBAAoB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,KAAe;IAC/D,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;IAC3B,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE;QAAE,OAAO;IAClC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,aAAa,CAAC,IAAI,CACvB,0BAA0B,CAAC;YAC1B,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE;SAC9D,CAAC,EACF,GAAG,CAAC,GAAG,CACP,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAChD,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE;QAC7D,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM;KAClD,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC,CAAC;AAcF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAe,EACf,KAAwB;IAExB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,4CAA4C;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjD,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,CAAC;IAE/D,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAa;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QAC/E,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEnC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACpD,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACrE,OAAO;QACN,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;QACxC,IAAI,EAAE,6BAA6B,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;KACzE,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,8EAA8E,CAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,KAAiC,EACjC,GAAmB,EACnB,MAAc,EACd,IAAsD,EACtD,GAAY;IAEZ,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;YACxC,SAAS,EAAE,WAAW;YACtB,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}

package/dist/handlers/definitions.d.ts

@@ -9,11 +9,17 @@ import type { ApiHandler } from '../api/index.js';
 /**
  * Definitions the caller can view. Visibility is resolved into the query via
  * `projectIds`, so `limit`/`nextCursor` describe the filtered set.
+ *
+ * `?documentId=<guid>` narrows to definitions uploaded from that Grasshopper
+ * document which the caller can upload a new version of.
  */
 export declare const listDefinitions: ApiHandler;
 /** Create a definition — metadata and the Grasshopper file in one request. */
 export declare const createDefinition: ApiHandler;
-/** The record plus its live and draft version summaries. */
+/**
+ * The record plus its live and draft version summaries. `canEdit` says whether
+ * the caller can upload a version and make one live, scope included for a key.
+ */
 export declare const getDefinition: ApiHandler;
 /** Soft-delete the definition; versions and blobs are wiped with it. */
 export declare const deleteDefinition: ApiHandler;

package/dist/handlers/definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/handlers/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAuBlD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,UAsB7B,CAAC;AAWF,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,UA0F9B,CAAC;AAaF,4DAA4D;AAC5D,eAAO,MAAM,aAAa,EAAE,UAoB3B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,UAM9B,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAE,UAW9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAejC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAM/B,CAAC;AAEF,4BAA4B;AAC5B,eAAO,MAAM,qBAAqB,EAAE,UAanC,CAAC"}
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/handlers/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkBH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA0BlD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,UA2B7B,CAAC;AAWF,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,UA0F9B,CAAC;AAaF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,UAuB3B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,UAM9B,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAE,UAa9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAejC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAM/B,CAAC;AAEF,4BAA4B;AAC5B,eAAO,MAAM,qBAAqB,EAAE,UAanC,CAAC"}

package/dist/handlers/definitions.js

@@ -6,30 +6,41 @@
  * and mark their own metrics, which the `ApiResponse` envelope does not model.
  */
 import { randomUUID } from 'node:crypto';
-import { apiError, ApiErrorCode, collection, created, formText, noContent, parseBody, parseDefinitionListOptions, parseParam, requireCaller, requireUpload, throwZodError } from '../api/index.js';
-import { toDefinitionListItem } from '@selvajs/platform';
+import { apiError, ApiErrorCode, assertScope, collection, created, formText, noContent, parseBody, parseDefinitionListOptions, parseParam, requireCaller, requireUpload, throwZodError } from '../api/index.js';
+import { toDefinitionListItem, toSourceDocumentId } from '@selvajs/platform';
 import { CreateDefinitionInputSchema, GuidSchema, PublishVersionInputSchema, UpdateMetadataInputSchema } from '@selvajs/platform/definitions';
 import { requireCanCreateDefinition, requireEditableDefinition } from '../access/index.js';
 import { GH_EXTENSIONS } from '@selvajs/platform';
 import { resolveServerForOrg } from '../compute/index.js';
-import { fetchSchemaFromCompute, getVisibleDefinition, listVisibleDefinitions, loadVisibleVersion, resolveAccessibleProjects } from '../definitions/index.js';
+import { fetchSchemaFromCompute, getVisibleDefinition, listEditableDefinitionsByDocument, listVisibleDefinitions, loadVisibleDefinition, loadVisibleVersion, mayUploadToDefinition, resolveAccessibleProjects } from '../definitions/index.js';
 import { definitionService } from './services.js';
 const LISTABLE_STATUSES = ['draft', 'published', 'archived'];
 /**
  * Definitions the caller can view. Visibility is resolved into the query via
  * `projectIds`, so `limit`/`nextCursor` describe the filtered set.
+ *
+ * `?documentId=<guid>` narrows to definitions uploaded from that Grasshopper
+ * document which the caller can upload a new version of.
  */
 export const listDefinitions = async (req) => {
     const { ctx } = requireCaller(req);
+    const documentParam = req.url.searchParams.get('documentId');
+    const documentId = documentParam === null ? null : toSourceDocumentId(documentParam);
+    if (documentParam !== null && !documentId) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, 'documentId must be a GUID');
+    }
     const statusParam = req.url.searchParams.get('status');
     if (statusParam && !LISTABLE_STATUSES.includes(statusParam)) {
         apiError(400, ApiErrorCode.VALIDATION_FAILED, `status must be one of: ${LISTABLE_STATUSES.join(', ')}`);
     }
-    const page = await listVisibleDefinitions(ctx, {
+    const opts = {
         ...parseDefinitionListOptions(req.url),
         projectId: req.url.searchParams.get('projectId') ?? undefined,
         statuses: statusParam ? [statusParam] : undefined
-    }, req.deps);
+    };
+    const page = documentId
+        ? await listEditableDefinitionsByDocument(ctx, documentId, opts, req.deps)
+        : await listVisibleDefinitions(ctx, opts, req.deps);
     return collection({ items: page.items.map(toDefinitionListItem), nextCursor: page.nextCursor });
 };
 function parseTags(raw) {
@@ -126,13 +137,17 @@ function versionSummary(v) {
         changeNote: v.changeNote
     };
 }
-/** The record plus its live and draft version summaries. */
+/**
+ * The record plus its live and draft version summaries. `canEdit` says whether
+ * the caller can upload a version and make one live, scope included for a key.
+ */
 export const getDefinition = async (req) => {
     const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
     const { ctx } = requireCaller(req);
-    const record = await getVisibleDefinition(ctx, guid, req.deps);
-    if (!record)
+    const visible = await loadVisibleDefinition(ctx, guid, req.deps);
+    if (!visible)
         apiError(404, ApiErrorCode.NOT_FOUND, 'Definition not found');
+    const { record } = visible;
     const meta = req.deps.definitionMeta;
     const [liveVersion, draftVersion] = await Promise.all([
         record.liveVersionId ? meta.getVersion(ctx, record.liveVersionId) : null,
@@ -141,6 +156,8 @@ export const getDefinition = async (req) => {
     return {
         body: {
             ...record,
+            sourceDocumentId: record.sourceDocumentId ?? null,
+            canEdit: mayUploadToDefinition(ctx, visible, req.deps),
             liveVersion: liveVersion ? versionSummary(liveVersion) : null,
             draftVersion: draftVersion ? versionSummary(draftVersion) : null
         }
@@ -158,8 +175,10 @@ export const updateDefinition = async (req) => {
     const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
     const { ctx, record } = await requireEditableDefinition(req, guid);
     const patch = await parseBody(req.request, UpdateMetadataInputSchema);
-    // Moving needs the same rights on the destination as uploading there.
+    // Moving needs the same rights on the destination as uploading there, and a
+    // key scoped to the source project must not carry the definition out of it.
     if (patch.projectId && patch.projectId !== record.projectId) {
+        assertScope(ctx, 'write', { projectId: patch.projectId });
         await requireCanCreateDefinition(req, patch.projectId);
     }
     await definitionService(req.deps).updateMeta(ctx, guid, patch);

package/dist/handlers/definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/handlers/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,SAAS,EACT,0BAA0B,EAC1B,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,oBAAoB,EAAyB,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACN,2BAA2B,EAC3B,UAAU,EACV,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,iBAAiB,GAAuB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAA+B,CAAC,EAAE,CAAC;QACjF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,0BAA0B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACxC,GAAG,EACH;QACC,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QACtC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;QAC7D,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAA+B,CAAC,CAAC,CAAC,CAAC,SAAS;KACrE,EACD,GAAG,CAAC,IAAI,CACR,CAAC;IACF,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAE1C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;QACvD,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB;QACrD,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,gCAAgC;KACvC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC;IAC7D,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;QACjE,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,8BAA8B,aAAa,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAChE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,uEAAuE;QACvE,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,yDAAyD;QACzD,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;QAC9F,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QAC1F,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAErE,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC;QACpD,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC1C,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC1C,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QACpC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QACxC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,SAAS;QACT,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1D,sEAAsE;IACtE,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;QACpF,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI;KAClD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAC/C,GAAG,EACH;QACC,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QAChC,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAiB;QAC3C,gBAAgB,EAAE,IAAI,CAAC,IAAI;QAC3B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;QAC5C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;QAC3C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;KAClC,EACD,QAAQ,EACR,MAAM,CACN,CAAC;IAEF,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,UAAU,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF,oFAAoF;AACpF,SAAS,cAAc,CAAC,CAAoB;IAC3C,OAAO;QACN,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAE3E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;IACrC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;QACxE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC,CAAC;IAEH,OAAO;QACN,IAAI,EAAE;YACL,GAAG,MAAM;YACT,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;SAChE;KACD,CAAC;AACH,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACtE,sEAAsE;IACtE,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7D,MAAM,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAEjG,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,4BAA4B;AAC5B,MAAM,CAAC,MAAM,qBAAqB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;QACrE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB;QAChD,KAAK,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,OAAO;QACN,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;KACvF,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/handlers/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,SAAS,EACT,0BAA0B,EAC1B,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAyB,MAAM,mBAAmB,CAAC;AACpG,OAAO,EACN,2BAA2B,EAC3B,UAAU,EACV,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,iBAAiB,GAAuB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACrF,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAA+B,CAAC,EAAE,CAAC;QACjF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,0BAA0B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG;QACZ,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QACtC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;QAC7D,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAA+B,CAAC,CAAC,CAAC,CAAC,SAAS;KACrE,CAAC;IACF,MAAM,IAAI,GAAG,UAAU;QACtB,CAAC,CAAC,MAAM,iCAAiC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;QAC1E,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAE1C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;QACvD,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB;QACrD,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,gCAAgC;KACvC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC;IAC7D,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;QACjE,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,8BAA8B,aAAa,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAChE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,uEAAuE;QACvE,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,yDAAyD;QACzD,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;QAC9F,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QAC1F,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAErE,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC;QACpD,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC1C,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC1C,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QACpC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QACxC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,SAAS;QACT,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1D,sEAAsE;IACtE,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;QACpF,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI;KAClD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAC/C,GAAG,EACH;QACC,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QAChC,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAiB;QAC3C,gBAAgB,EAAE,IAAI,CAAC,IAAI;QAC3B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;QAC5C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;QAC3C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;KAClC,EACD,QAAQ,EACR,MAAM,CACN,CAAC;IAEF,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,UAAU,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF,oFAAoF;AACpF,SAAS,cAAc,CAAC,CAAoB;IAC3C,OAAO;QACN,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;IACrC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;QACxE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC,CAAC;IAEH,OAAO;QACN,IAAI,EAAE;YACL,GAAG,MAAM;YACT,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC;YACtD,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;SAChE;KACD,CAAC;AACH,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7D,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAEjG,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,4BAA4B;AAC5B,MAAM,CAAC,MAAM,qBAAqB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;QACrE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB;QAChD,KAAK,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,OAAO;QACN,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;KACvF,CAAC;AACH,CAAC,CAAC"}

package/dist/handlers/index.d.ts

@@ -24,5 +24,6 @@ export { listProjects, createProject, getProject, updateProject, deleteProject }
 export { listProjectMembers, addProjectMember, updateProjectMemberRole, removeProjectMember } from './projectMembers.js';
 export { getOrgCompute, updateOrgCompute } from './orgCompute.js';
 export { listInvites, createInvite, revokeInvite, resendInvite } from './invites.js';
-export { listApiTokens, createApiToken, revokeApiToken, revokeUserApiTokens } from './apiTokens.js';
+export { listApiTokens, createApiToken, revokeApiToken, revokeOwnApiToken, revokeUserApiTokens, listOrgApiTokens, canManageApiTokenRoster, mintApiToken, mayHoldApiTokens, type ApiTokenRow, type MintApiTokenInput, type MintedApiToken } from './apiTokens.js';
+export { consentOffer, consentOrgs, mintConsentToken, revokeUnredeemedConsentToken, type ConsentLevel, type ConsentOffer, type ConsentOrg } from './oauthConsent.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/handlers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EACN,aAAa,EACb,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,4BAA4B,EAC5B,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,MAAM,mBAAmB,CAAC"}

package/dist/handlers/index.js

@@ -26,5 +26,6 @@ export { listProjects, createProject, getProject, updateProject, deleteProject }
 export { listProjectMembers, addProjectMember, updateProjectMemberRole, removeProjectMember } from './projectMembers.js';
 export { getOrgCompute, updateOrgCompute } from './orgCompute.js';
 export { listInvites, createInvite, revokeInvite, resendInvite } from './invites.js';
-export { listApiTokens, createApiToken, revokeApiToken, revokeUserApiTokens } from './apiTokens.js';
+export { listApiTokens, createApiToken, revokeApiToken, revokeOwnApiToken, revokeUserApiTokens, listOrgApiTokens, canManageApiTokenRoster, mintApiToken, mayHoldApiTokens } from './apiTokens.js';
+export { consentOffer, consentOrgs, mintConsentToken, revokeUnredeemedConsentToken } from './oauthConsent.js';
 //# sourceMappingURL=index.js.map

package/dist/handlers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EACN,aAAa,EACb,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,EAIhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,4BAA4B,EAI5B,MAAM,mBAAmB,CAAC"}

package/dist/handlers/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEjE,eAAO,MAAM,KAAK,EAAE,UAcnB,CAAC"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEjE,eAAO,MAAM,KAAK,EAAE,UAqBnB,CAAC"}

package/dist/handlers/me.js

@@ -3,6 +3,7 @@
  * holder can see which org their credential resolved into — `actingOrgId` is
  * derived per request from the caller's membership, not frozen at mint time.
  */
+import { formatApiScope } from '@selvajs/platform';
 import { requireCaller } from '../api/index.js';
 export const getMe = async (req) => {
     const { ctx, user } = requireCaller(req);
@@ -14,7 +15,14 @@ export const getMe = async (req) => {
             actingOrgId: ctx.actingOrgId,
             platformPermissions: ctx.platformPermissions,
             orgPermissions: ctx.orgPermissions,
-            starredDefinitions: req.profile?.starredDefinitions ?? []
+            starredDefinitions: req.profile?.starredDefinitions ?? [],
+            ...(ctx.apiScope && {
+                apiToken: {
+                    id: ctx.apiScope.tokenId,
+                    scopes: ctx.apiScope.scopes.map(formatApiScope),
+                    expiresAt: ctx.apiScope.expiresAt
+                }
+            })
         }
     };
 };

package/dist/handlers/me.js.map

@@ -1 +1 @@
-{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,CAAC,MAAM,KAAK,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzC,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;YACrC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,EAAE;SACzD;KACD,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,CAAC,MAAM,KAAK,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzC,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;YACrC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,EAAE;YACzD,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI;gBACnB,QAAQ,EAAE;oBACT,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;oBACxB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;oBAC/C,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;iBACjC;aACD,CAAC;SACF;KACD,CAAC;AACH,CAAC,CAAC"}

package/dist/handlers/oauthConsent.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The server half of an OAuth consent screen: which access levels and orgs the
+ * user may grant, and minting the key in the org they picked.
+ *
+ * A key is bound to one org at mint. The user's session acts in one org too,
+ * but they may belong to several, so consent builds a context pinned to the
+ * picked org rather than trusting the session's.
+ */
+import { type ApiRequest } from '../api/index.js';
+import { type ConsentChoice, type OAuthScope } from '../oauth/index.js';
+import { type MintApiTokenInput, type MintedApiToken } from './apiTokens.js';
+export interface ConsentOrg {
+    id: string;
+    name: string;
+}
+/**
+ * The orgs the signed-in user may grant a key with `scopes` in: those they
+ * belong to and may hold such a key in.
+ */
+export declare function consentOrgs(req: ApiRequest, scopes: readonly string[]): Promise<ConsentOrg[]>;
+export interface ConsentLevel {
+    choice: ConsentChoice;
+    /** Where this level may be granted. Never empty. */
+    orgs: ConsentOrg[];
+}
+export interface ConsentOffer {
+    /**
+     * Narrowest first. Only levels the user may hold in at least one of their
+     * orgs; each carries its own orgs, since a narrower level can reach more.
+     */
+    levels: ConsentLevel[];
+}
+/**
+ * What a consent page offers for a request's scopes, and what its approval
+ * accepts. Null when the user may grant none of it anywhere.
+ */
+export declare function consentOffer(req: ApiRequest, scopes: readonly OAuthScope[]): Promise<ConsentOffer | null>;
+/**
+ * Mint the key a consent grants, acting in `orgId`. An org the user doesn't
+ * belong to is refused here, whatever the form said.
+ */
+export declare function mintConsentToken(req: ApiRequest, orgId: string, input: MintApiTokenInput): Promise<MintedApiToken>;
+/**
+ * Revoke a consent key whose code was never redeemed, so an abandoned sign-in
+ * doesn't leave a live key nobody holds. A used key is kept: its code may have
+ * been redeemed on another replica.
+ */
+export declare function revokeUnredeemedConsentToken(req: ApiRequest, tokenId: string): Promise<void>;
+//# sourceMappingURL=oauthConsent.d.ts.map

package/dist/handlers/oauthConsent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthConsent.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzF,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGN,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACb;AAeD;;;GAGG;AACH,wBAAsB,WAAW,CAChC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,UAAU,EAAE,CAAC,CAWvB;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,oDAAoD;IACpD,IAAI,EAAE,UAAU,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,MAAM,EAAE,YAAY,EAAE,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,UAAU,EAAE,GAC3B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CASzB;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CACjD,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/handlers/oauthConsent.js

@@ -0,0 +1,76 @@
+/**
+ * The server half of an OAuth consent screen: which access levels and orgs the
+ * user may grant, and minting the key in the org they picked.
+ *
+ * A key is bound to one org at mint. The user's session acts in one org too,
+ * but they may belong to several, so consent builds a context pinned to the
+ * picked org rather than trusting the session's.
+ */
+import { apiError, ApiErrorCode, requireCaller } from '../api/index.js';
+import { buildRequestContext } from '../http/request-context.js';
+import { listUserMemberships } from '../organizations/user-memberships.js';
+import { apiScopesFor, consentChoices } from '../oauth/index.js';
+import { mayHoldApiTokens, mintApiToken } from './apiTokens.js';
+async function contextIn(req, member) {
+    const { ctx, user } = requireCaller(req);
+    if (ctx.apiScope) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Sign in to the web app to connect an app.');
+    }
+    const pinned = await buildRequestContext({ user, platformPermissions: ctx.platformPermissions, membership: member, pinOrg: true }, { orgs: req.deps.orgs });
+    // The session's own adapter payload (Supabase's user JWT) still applies.
+    return { ...pinned, adapterContext: ctx.adapterContext };
+}
+/**
+ * The orgs the signed-in user may grant a key with `scopes` in: those they
+ * belong to and may hold such a key in.
+ */
+export async function consentOrgs(req, scopes) {
+    const { ctx } = requireCaller(req);
+    const memberships = await listUserMemberships(req.deps.orgs, ctx.userId);
+    const allowed = await Promise.all(memberships.map(async ({ member }) => mayHoldApiTokens(req.deps, await contextIn(req, member), scopes)));
+    return memberships
+        .filter((_, i) => allowed[i])
+        .map(({ org }) => ({ id: org.id, name: org.name }));
+}
+/**
+ * What a consent page offers for a request's scopes, and what its approval
+ * accepts. Null when the user may grant none of it anywhere.
+ */
+export async function consentOffer(req, scopes) {
+    const levels = await Promise.all(consentChoices(scopes).map(async (choice) => ({
+        choice,
+        orgs: await consentOrgs(req, apiScopesFor(choice.scopes))
+    })));
+    const offered = levels.filter((l) => l.orgs.length > 0);
+    return offered.length ? { levels: offered } : null;
+}
+/**
+ * Mint the key a consent grants, acting in `orgId`. An org the user doesn't
+ * belong to is refused here, whatever the form said.
+ */
+export async function mintConsentToken(req, orgId, input) {
+    const { ctx } = requireCaller(req);
+    // Matched against the user's own memberships, so the posted id never reaches a store query.
+    const memberships = await listUserMemberships(req.deps.orgs, ctx.userId);
+    const picked = memberships.find(({ org }) => org.id === orgId);
+    if (!picked) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You aren’t a member of that organization.');
+    }
+    return mintApiToken({ ...req, ctx: await contextIn(req, picked.member) }, input);
+}
+/**
+ * Revoke a consent key whose code was never redeemed, so an abandoned sign-in
+ * doesn't leave a live key nobody holds. A used key is kept: its code may have
+ * been redeemed on another replica.
+ */
+export async function revokeUnredeemedConsentToken(req, tokenId) {
+    const store = req.deps.data.apiTokens;
+    if (!store)
+        return;
+    const { ctx } = requireCaller(req);
+    const token = await store.get(ctx, tokenId);
+    if (!token || token.revokedAt || token.lastUsedAt)
+        return;
+    await store.revoke(ctx, tokenId, 'owner');
+}
+//# sourceMappingURL=oauthConsent.js.map

package/dist/handlers/oauthConsent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthConsent.js","sourceRoot":"","sources":["../../src/handlers/oauthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EACN,YAAY,EACZ,cAAc,EAGd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,gBAAgB,EAChB,YAAY,EAGZ,MAAM,gBAAgB,CAAC;AAOxB,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,MAAiB;IAC1D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACvC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EACxF,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CACvB,CAAC;IACF,yEAAyE;IACzE,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,GAAe,EACf,MAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACpC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAChE,CACD,CAAC;IACF,OAAO,WAAW;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAe,EACf,MAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM;QACN,IAAI,EAAE,MAAM,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KACzD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,GAAe,EACf,KAAa,EACb,KAAwB;IAExB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,4FAA4F;IAC5F,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,GAAe,EACf,OAAe;IAEf,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO;IAC1D,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/handlers/projects.d.ts

@@ -7,6 +7,11 @@
  * correct. The rest are lifted, logic intact, with reads moved onto `req.deps`.
  */
 import { type ApiHandler } from '../api/index.js';
+/**
+ * Projects the caller can view. `canCreateDefinitions` says whether
+ * `POST /definitions` would take this project from this caller: the same rule
+ * as the route, and for an API token its `upload` scope there.
+ */
 export declare const listProjects: ApiHandler;
 export declare const createProject: ApiHandler;
 /**

package/dist/handlers/projects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/handlers/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAYN,KAAK,UAAU,EACf,MAAM,iBAAiB,CAAC;AAuBzB,eAAO,MAAM,YAAY,EAAE,UAkB1B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAiD3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,UAmCxB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAuE3B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAO3B,CAAC"}
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/handlers/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAYN,KAAK,UAAU,EACf,MAAM,iBAAiB,CAAC;AAyBzB;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,UAgC1B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAiD3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,UAmCxB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAuE3B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAO3B,CAAC"}