@substrat-run/kernel 0.139.0 → 0.141.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/admin-log-ddl.d.ts +21 -0
- package/dist/admin-log-ddl.d.ts.map +1 -0
- package/dist/admin-log-ddl.js +32 -0
- package/dist/admin-log-ddl.js.map +1 -0
- package/dist/attachment-extractor.d.ts +12 -1
- package/dist/attachment-extractor.d.ts.map +1 -1
- package/dist/attachment-extractor.js +10 -5
- package/dist/attachment-extractor.js.map +1 -1
- package/dist/audit-outcome.d.ts +149 -0
- package/dist/audit-outcome.d.ts.map +1 -0
- package/dist/audit-outcome.js +233 -0
- package/dist/audit-outcome.js.map +1 -0
- package/dist/capability.d.ts +5 -2
- package/dist/capability.d.ts.map +1 -1
- package/dist/capability.js +17 -8
- package/dist/capability.js.map +1 -1
- package/dist/connect-links.d.ts +91 -0
- package/dist/connect-links.d.ts.map +1 -0
- package/dist/connect-links.js +189 -0
- package/dist/connect-links.js.map +1 -0
- package/dist/connect-state.d.ts +12 -3
- package/dist/connect-state.d.ts.map +1 -1
- package/dist/connect-state.js +8 -3
- package/dist/connect-state.js.map +1 -1
- package/dist/derived-object.d.ts +14 -0
- package/dist/derived-object.d.ts.map +1 -0
- package/dist/derived-object.js +2 -0
- package/dist/derived-object.js.map +1 -0
- package/dist/derived-objects.d.ts +108 -0
- package/dist/derived-objects.d.ts.map +1 -0
- package/dist/derived-objects.js +199 -0
- package/dist/derived-objects.js.map +1 -0
- package/dist/email-intent.d.ts +56 -0
- package/dist/email-intent.d.ts.map +1 -0
- package/dist/email-intent.js +71 -0
- package/dist/email-intent.js.map +1 -0
- package/dist/entity-edges.d.ts +6 -1
- package/dist/entity-edges.d.ts.map +1 -1
- package/dist/entity-edges.js +13 -0
- package/dist/entity-edges.js.map +1 -1
- package/dist/entity-grant-shape.d.ts +94 -0
- package/dist/entity-grant-shape.d.ts.map +1 -0
- package/dist/entity-grant-shape.js +329 -0
- package/dist/entity-grant-shape.js.map +1 -0
- package/dist/entity-grant.d.ts +45 -0
- package/dist/entity-grant.d.ts.map +1 -0
- package/dist/entity-grant.js +71 -0
- package/dist/entity-grant.js.map +1 -0
- package/dist/entity-state-reads.d.ts +4 -7
- package/dist/entity-state-reads.d.ts.map +1 -1
- package/dist/entity-state-reads.js +13 -57
- package/dist/entity-state-reads.js.map +1 -1
- package/dist/entity-state.d.ts +37 -10
- package/dist/entity-state.d.ts.map +1 -1
- package/dist/entity-state.js +80 -69
- package/dist/entity-state.js.map +1 -1
- package/dist/entity-trash.d.ts +245 -0
- package/dist/entity-trash.d.ts.map +1 -0
- package/dist/entity-trash.js +380 -0
- package/dist/entity-trash.js.map +1 -0
- package/dist/grant-scoped-read.d.ts +41 -0
- package/dist/grant-scoped-read.d.ts.map +1 -0
- package/dist/grant-scoped-read.js +100 -0
- package/dist/grant-scoped-read.js.map +1 -0
- package/dist/index.d.ts +35 -8
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +22 -5
- package/dist/index.js.map +1 -1
- package/dist/kernel-outbox.d.ts +14 -0
- package/dist/kernel-outbox.d.ts.map +1 -0
- package/dist/kernel-outbox.js +37 -0
- package/dist/kernel-outbox.js.map +1 -0
- package/dist/list-index.d.ts +11 -2
- package/dist/list-index.d.ts.map +1 -1
- package/dist/list-index.js +29 -21
- package/dist/list-index.js.map +1 -1
- package/dist/mail-sender.d.ts +78 -0
- package/dist/mail-sender.d.ts.map +1 -0
- package/dist/mail-sender.js +2 -0
- package/dist/mail-sender.js.map +1 -0
- package/dist/membership-executor.d.ts +0 -52
- package/dist/membership-executor.d.ts.map +1 -1
- package/dist/membership-executor.js +19 -59
- package/dist/membership-executor.js.map +1 -1
- package/dist/migration-digest.d.ts +161 -0
- package/dist/migration-digest.d.ts.map +1 -0
- package/dist/migration-digest.js +237 -0
- package/dist/migration-digest.js.map +1 -0
- package/dist/module-erasure.d.ts +156 -0
- package/dist/module-erasure.d.ts.map +1 -0
- package/dist/module-erasure.js +440 -0
- package/dist/module-erasure.js.map +1 -0
- package/dist/peer.d.ts +9 -1
- package/dist/peer.d.ts.map +1 -1
- package/dist/peer.js +29 -0
- package/dist/peer.js.map +1 -1
- package/dist/permission-checker.d.ts +6 -0
- package/dist/permission-checker.d.ts.map +1 -1
- package/dist/permission-checker.js.map +1 -1
- package/dist/permission-eval.d.ts +10 -1
- package/dist/permission-eval.d.ts.map +1 -1
- package/dist/permission-eval.js +51 -2
- package/dist/permission-eval.js.map +1 -1
- package/dist/platform-sweep.d.ts +1 -1
- package/dist/platform-sweep.d.ts.map +1 -1
- package/dist/platform-sweep.js +5 -0
- package/dist/platform-sweep.js.map +1 -1
- package/dist/scope-copy-ledger.d.ts +79 -0
- package/dist/scope-copy-ledger.d.ts.map +1 -0
- package/dist/scope-copy-ledger.js +82 -0
- package/dist/scope-copy-ledger.js.map +1 -0
- package/dist/scope-host.d.ts +402 -25
- package/dist/scope-host.d.ts.map +1 -1
- package/dist/scope-host.js +74 -5
- package/dist/scope-host.js.map +1 -1
- package/dist/search-index.d.ts +8 -0
- package/dist/search-index.d.ts.map +1 -1
- package/dist/search-index.js +51 -21
- package/dist/search-index.js.map +1 -1
- package/dist/spine-guard.d.ts +7 -0
- package/dist/spine-guard.d.ts.map +1 -1
- package/dist/spine-guard.js +54 -6
- package/dist/spine-guard.js.map +1 -1
- package/dist/spine-restore.d.ts.map +1 -1
- package/dist/spine-restore.js +5 -0
- package/dist/spine-restore.js.map +1 -1
- package/dist/sql-statements.d.ts +71 -0
- package/dist/sql-statements.d.ts.map +1 -0
- package/dist/sql-statements.js +191 -0
- package/dist/sql-statements.js.map +1 -0
- package/dist/subject-redaction.d.ts +9 -1
- package/dist/subject-redaction.d.ts.map +1 -1
- package/dist/subject-redaction.js.map +1 -1
- package/dist/system-switch-record.d.ts +3 -0
- package/dist/system-switch-record.d.ts.map +1 -1
- package/dist/system-switch-record.js +2 -0
- package/dist/system-switch-record.js.map +1 -1
- package/dist/table-ownership.d.ts +103 -0
- package/dist/table-ownership.d.ts.map +1 -0
- package/dist/table-ownership.js +285 -0
- package/dist/table-ownership.js.map +1 -0
- package/dist/timeline.d.ts +4 -4
- package/dist/timeline.js +4 -4
- package/dist/visible-continuation.d.ts +38 -0
- package/dist/visible-continuation.d.ts.map +1 -0
- package/dist/visible-continuation.js +162 -0
- package/dist/visible-continuation.js.map +1 -0
- package/package.json +4 -4
package/dist/capability.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,qBAAqB,EAE1B,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA0C3D;;;;GAIG;AACH,eAAO,MAAM,cAAc,
|
|
1
|
+
{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,qBAAqB,EAE1B,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EAExB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AA0C3D;;;;GAIG;AACH,eAAO,MAAM,cAAc,ypFAmD1B,CAAC;AAEF,gHAAgH;AAChH,eAAO,MAAM,sBAAsB,YAAI,wBAAwB,EAAE,+BAA+B,CAAU,CAAC;AAE3G,2GAA2G;AAC3G,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,QAEgD,CAAC;AAEhF,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAKnF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,gBAAgB,EACtB,KAAK,SAAI,GACR;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,EAAE,CAAA;CAAE,CAoBrC;AAED,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAG9F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAQ5F;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QACpB,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,CAAC,OAChD,MAAM,KACV,OAAuF,CAAC;AAE3F;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAC5B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC,OACtE,MAAM,KACV,OAAyF,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,mBAAmB,GAAG,IAAI,CAehF;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAyBvE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,qEAAqE;AACrE,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8BlD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIjF;AAED,oEAAoE;AACpE,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAS/F;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAWpF;AAMD,+JAA+J;AAC/J,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,GAAG,EAAE,SAAS,CAAC;IACf,sBAAsB;IACtB,OAAO,EAAE,YAAY,CAAC;IACtB,+BAA+B;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,kFAAkF;IAClF,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACxC,wFAAwF;IACxF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,yDAAyD;IACzD,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAgBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAoI/E;AAMD,+FAA+F;AAC/F,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAGrE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACnE,EACD,MAAM,EAAE,OAAO;AACf;;;;GAIG;AACH,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GACtB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA0EpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,cAAc,UAAQ,GACrB,YAAY,CA2Bd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,oBAAoB,GAAG,oBAAoB,EACtD,IAAI,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;CAAE,EAC9D,UAAU,CAAC,EAAE,aAAa,GACzB,gBAAgB,CAMlB;AAED,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,UAAW,OAAO,KAAG,KAAK,IAAI,MACnB,CAAC;AAE9C,mGAAmG;AACnG,eAAO,MAAM,yBAAyB,WAAY,OAAO,KAAG,MAAM,IAAI,MACzB,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,GAAG,qBAAqB,CAShG;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,gBAAgB,CAAC,CAsB3B;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,OAAO,GACX,gBAAgB,GAAG,SAAS,CAY9B"}
|
package/dist/capability.js
CHANGED
|
@@ -14,7 +14,7 @@ export const CAPABILITY_DDL = `
|
|
|
14
14
|
-- the kernel once, in the mint's return value, and a lookup is this indexed equality.
|
|
15
15
|
token_hash TEXT NOT NULL UNIQUE,
|
|
16
16
|
-- 'act': the holder acts AS the capability ({ capability } on the spine), bounded by
|
|
17
|
-
-- entity + permissions (+ operations). 'become': exchanging it yields \`principal\`.
|
|
17
|
+
-- entity + permissions (+ operations + attachments). 'become': exchanging it yields \`principal\`.
|
|
18
18
|
mode TEXT NOT NULL,
|
|
19
19
|
label TEXT,
|
|
20
20
|
entity_type TEXT,
|
|
@@ -24,6 +24,8 @@ export const CAPABILITY_DDL = `
|
|
|
24
24
|
permissions TEXT,
|
|
25
25
|
-- JSON array of operation names, or NULL = any operation the keys allow (act).
|
|
26
26
|
operations TEXT,
|
|
27
|
+
-- NULL = no attachment read opt-in; 'read' explicitly allows attachment readers.
|
|
28
|
+
attachments TEXT,
|
|
27
29
|
principal TEXT,
|
|
28
30
|
-- JSON capabilityAuthor: a principal id (a module minted it, and its authority is
|
|
29
31
|
-- re-checked on every use) or {"platform": …} (HostAdmin minted it).
|
|
@@ -60,7 +62,7 @@ export const CAPABILITY_DDL = `
|
|
|
60
62
|
/** The tables `CAPABILITY_DDL` builds — what a copy of a scope leaves behind (`capabilitiesForLoad`, #1686). */
|
|
61
63
|
export const CAPABILITY_TABLE_NAMES = ['_substrat_capabilities', '_substrat_capability_sessions'];
|
|
62
64
|
/** Every column a read returns — everything but `token_hash`, which no reader has a use for. */
|
|
63
|
-
export const CAPABILITY_COLUMNS = 'id, mode, label, entity_type, entity_id, permissions, operations, principal, minted_by, ' +
|
|
65
|
+
export const CAPABILITY_COLUMNS = 'id, mode, label, entity_type, entity_id, permissions, operations, attachments, principal, minted_by, ' +
|
|
64
66
|
'minted_at, expires_at, max_uses, uses, last_used_at, revoked_at, revoked_by';
|
|
65
67
|
/** The row the permission checker reads for a capability subject (`ScopeTupleReader.capability`). */
|
|
66
68
|
export function capabilityByIdQuery(id) {
|
|
@@ -181,6 +183,7 @@ export function capabilityRecordOf(row) {
|
|
|
181
183
|
entity: { entityType: row.entity_type, entityId: row.entity_id },
|
|
182
184
|
permissions: JSON.parse(row.permissions ?? '[]'),
|
|
183
185
|
operations: row.operations === null ? null : JSON.parse(row.operations),
|
|
186
|
+
attachments: row.attachments === null ? null : 'read',
|
|
184
187
|
});
|
|
185
188
|
}
|
|
186
189
|
/** A fresh capability secret: 256 bits, base64url, prefixed. Only its hash is ever stored. */
|
|
@@ -319,6 +322,7 @@ export function createCapabilityVerbs(deps) {
|
|
|
319
322
|
const root = entityObjectRef(input.entity, 'ctx.capabilities.mint');
|
|
320
323
|
const permissions = [...new Set(input.permissions)];
|
|
321
324
|
const operations = input.operations ? [...new Set(input.operations)] : null;
|
|
325
|
+
const attachments = input.attachments ?? null;
|
|
322
326
|
for (const op of operations ?? []) {
|
|
323
327
|
if (!deps.isOperation(op)) {
|
|
324
328
|
throw substratError('validation_failed', `ctx.capabilities.mint: '${op}' is not an operation on this host — an allowlist ` +
|
|
@@ -342,9 +346,9 @@ export function createCapabilityVerbs(deps) {
|
|
|
342
346
|
const secret = mintCapabilitySecret();
|
|
343
347
|
const tokenHash = await capabilityTokenHash(secret);
|
|
344
348
|
deps.sql.exec(`INSERT INTO _substrat_capabilities
|
|
345
|
-
(id, token_hash, mode, label, entity_type, entity_id, permissions, operations,
|
|
349
|
+
(id, token_hash, mode, label, entity_type, entity_id, permissions, operations, attachments,
|
|
346
350
|
principal, minted_by, minted_at, expires_at, max_uses, uses)
|
|
347
|
-
VALUES (?, ?, 'act', ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, 0)`, [
|
|
351
|
+
VALUES (?, ?, 'act', ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, 0)`, [
|
|
348
352
|
id,
|
|
349
353
|
tokenHash,
|
|
350
354
|
input.label ?? null,
|
|
@@ -352,6 +356,7 @@ export function createCapabilityVerbs(deps) {
|
|
|
352
356
|
input.entity.entityId,
|
|
353
357
|
JSON.stringify(permissions),
|
|
354
358
|
operations === null ? null : JSON.stringify(operations),
|
|
359
|
+
attachments,
|
|
355
360
|
JSON.stringify(minter),
|
|
356
361
|
deps.now,
|
|
357
362
|
input.expiresAt ?? null,
|
|
@@ -420,6 +425,7 @@ export function createCapabilityVerbs(deps) {
|
|
|
420
425
|
// ---------------------------------------------------------------------------
|
|
421
426
|
/** The pseudo-operation an exchange's spine event names, on `attachments.upload`'s pattern. */
|
|
422
427
|
export const CAPABILITY_EXCHANGE_OPERATION = 'capabilities.exchange';
|
|
428
|
+
const CAPABILITY_ATTACHMENT_READ_OPERATIONS = new Set(['attachments.list', 'attachments.open', 'attachments.search']);
|
|
423
429
|
/**
|
|
424
430
|
* Trade a secret for what it grants — ONE counted use. Runs inside the scope's
|
|
425
431
|
* serialization domain and a transaction the adapter opened; `emit` writes the
|
|
@@ -517,8 +523,10 @@ mode) {
|
|
|
517
523
|
* remedy — and an operation outside the capability's allowlist as `forbidden`. None of
|
|
518
524
|
* these is a K-35 denial: no permission key was checked, and the denial log records
|
|
519
525
|
* enforced checks. The handler's own checks, once it runs, are.
|
|
526
|
+
* `attachmentRead` is true only at the dedicated attachment reader boundary; ordinary
|
|
527
|
+
* operation resolution leaves the independent attachment field out of its decision.
|
|
520
528
|
*/
|
|
521
|
-
export function resolveCapabilitySession(sql, sessionHash, now, operation) {
|
|
529
|
+
export function resolveCapabilitySession(sql, sessionHash, now, operation, attachmentRead = false) {
|
|
522
530
|
const session = sql.query(`SELECT capability_id, expires_at FROM _substrat_capability_sessions WHERE token_hash = ?`, [sessionHash])[0];
|
|
523
531
|
if (!session || session.expires_at <= now) {
|
|
524
532
|
throw substratError('unauthenticated', 'capability session is unknown or has expired');
|
|
@@ -530,7 +538,8 @@ export function resolveCapabilitySession(sql, sessionHash, now, operation) {
|
|
|
530
538
|
}
|
|
531
539
|
if (row.operations !== null) {
|
|
532
540
|
const allowed = JSON.parse(row.operations);
|
|
533
|
-
|
|
541
|
+
const optedIntoAttachmentRead = attachmentRead && row.attachments === 'read' && CAPABILITY_ATTACHMENT_READ_OPERATIONS.has(operation);
|
|
542
|
+
if (!allowed.includes(operation) && !optedIntoAttachmentRead) {
|
|
534
543
|
throw substratError('forbidden', `capability ${row.id} may not invoke '${operation}' — it is not on the capability's ` +
|
|
535
544
|
'operation list', { reason: 'capability_operation' });
|
|
536
545
|
}
|
|
@@ -586,9 +595,9 @@ export async function mintBecomeCapability(sql, raw, actor, now) {
|
|
|
586
595
|
const secret = mintCapabilitySecret();
|
|
587
596
|
const author = { platform: actor };
|
|
588
597
|
sql.exec(`INSERT INTO _substrat_capabilities
|
|
589
|
-
(id, token_hash, mode, label, entity_type, entity_id, permissions, operations,
|
|
598
|
+
(id, token_hash, mode, label, entity_type, entity_id, permissions, operations, attachments,
|
|
590
599
|
principal, minted_by, minted_at, expires_at, max_uses, uses)
|
|
591
|
-
VALUES (?, ?, 'become', ?, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, 0)`, [
|
|
600
|
+
VALUES (?, ?, 'become', ?, NULL, NULL, NULL, NULL, NULL, ?, ?, ?, ?, ?, 0)`, [
|
|
592
601
|
id,
|
|
593
602
|
await capabilityTokenHash(secret),
|
|
594
603
|
input.label ?? null,
|
package/dist/capability.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,IAAI,kBAAkB,EAClC,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,WAAW,IAAI,iBAAiB,EAChC,aAAa,EACb,eAAe,GAsBhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyCjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiD7B,CAAC;AAEF,gHAAgH;AAChH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,wBAAwB,EAAE,+BAA+B,CAAU,CAAC;AAsB3G,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAC7B,0FAA0F;IAC1F,6EAA6E,CAAC;AAEhF,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,OAAO;QACL,GAAG,EAAE,UAAU,kBAAkB,2CAA2C;QAC5E,MAAM,EAAE,CAAC,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsB,EACtB,KAAK,GAAG,CAAC;IAET,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC,GAAG,KAAK,CAAC,CAAC;IAChE,OAAO;QACL,GAAG,EACD,UAAU,kBAAkB,8BAA8B;YAC1D,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B;QACnF,MAAM;KACP,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAc,EAAE,MAAyB;IACxE,MAAM,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAc,EAAE,MAAyB;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC;IACvD,MAAM,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAqD,EACrD,GAAW,EACF,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAA2E,EAC3E,GAAW,EACF,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;AAc7F,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CACvB,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE;YAChE,WAAW;YACX,QAAQ,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;KACvE,CAAC;IACF,OAAO,gBAAgB,CAAC,KAAK,CAC3B,GAAG,CAAC,IAAI,KAAK,QAAQ;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;QACzD,CAAC,CAAC;YACE,IAAI,EAAE,KAAK;YACX,GAAG,MAAM;YACT,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE;YAChE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;YAChD,UAAU,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;SACxE,CACN,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB;IAClC,OAAO,wBAAwB,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,0BAA0B;IACxC,OAAO,yBAAyB,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,wFAAwF;AACxF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,MAAc,EAAmB,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;AAuB5F,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAU,EAAE,EAAE,CACzC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CACpF,IAAI,EAAE,CACR,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAA0B;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAI,KAAQ,EAAE,OAA0B;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAA0B;IACvE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAe,EAAE,OAA0B;IACvF,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,KAAK,4EAA4E;YAClF,qEAAqE,EACvE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,YAAY,CAAC,KAAgB,EAAE,OAA0B;IACvE,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACrB,cAAc,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACpB,cAAc,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAoDD,MAAM,WAAW,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE9E,SAAS,WAAW,CAAC,OAAqB,EAAE,IAAY;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,0BAA0B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,kBAAkB;YAC1F,KAAK,OAAO,CAAC,IAAI,oEAAoE,EACvF,EAAE,MAAM,EAAE,uBAAuB,EAAE,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,OAAO,GAAG,CAAC,EAAU,EAA6B,EAAE;QACxD,MAAM,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,oEAAoE;YACpE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;YACpE,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,KAAK,MAAM,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,MAAM,aAAa,CACjB,mBAAmB,EACnB,2BAA2B,EAAE,oDAAoD;wBAC/E,6DAA6D,CAChE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACjE,MAAM,aAAa,CACjB,mBAAmB,EACnB,oCAAoC,KAAK,CAAC,SAAS,uBAAuB,CAC3E,CAAC;YACJ,CAAC;YACD,qFAAqF;YACrF,uFAAuF;YACvF,gFAAgF;YAChF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,UAAU,QAAQ,IAAI,KAAK;wBAC/D,+EAA+E,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;;;kEAG0D,EAC1D;gBACE,EAAE;gBACF,SAAS;gBACT,KAAK,CAAC,KAAK,IAAI,IAAI;gBACnB,KAAK,CAAC,MAAM,CAAC,UAAU;gBACvB,KAAK,CAAC,MAAM,CAAC,QAAQ;gBACrB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;gBAC3B,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;gBACvD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBACtB,IAAI,CAAC,GAAG;gBACR,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,OAAO,IAAI,IAAI;aACtB,CACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,OAAO,GAA4B;gBACvC,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;gBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO;aACR,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;YACrE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,MAAM,aAAa,CAAC,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,aAAa,CACjB,WAAW,EACX,cAAc,EAAE,8DAA8D,EAC9E,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO;YACpC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,IAAI,gBAAgB,CACxB,4BAA4B,EAAE,gCAAgC,UAAU,OAAO;wBAC7E,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,qDAAqD,CACpF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;6CACqC,EACrC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CACxC,CAAC;YACF,MAAM,OAAO,GAA6B;gBACxC,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,kBAAkB;gBACxB,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAE9E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAIC,EACD,MAAe;AACf;;;;GAIG;AACH,IAAuB;IAEvB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CACxB,UAAU,kBAAkB,mDAAmD,EAC/E,CAAC,SAAS,CAAC,CACZ,CAAC,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CACzB;+BAC2B,EAC3B,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAC7B,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAE1B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAA+B;YAC1C,YAAY,EAAE,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,gBAAgB,EAAE,IAAI;YACtB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACZ,IAAI,EAAE,oBAAoB;YAC1B,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;YAClD,QAAQ,EAAE,MAAM;YAChB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,MAAM;QACnE,CAAC,CAAC,GAAG,CAAC,UAAU;QAChB,CAAC,CAAC,MAAM,CAAY,CAAC;IACvB,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;IAClD,8EAA8E;IAC9E,qFAAqF;IACrF,kEAAkE;IAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;2FACuF,EACvF,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAC3C,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;yBACqB,EACrB,CAAC,MAAM,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CACnE,CAAC;IACF,MAAM,OAAO,GAA+B;QAC1C,YAAY,EAAE,EAAE;QAChB,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;QACZ,IAAI,EAAE,oBAAoB;QAC1B,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,MAAM;QAChB,OAAO;KACR,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAc,EACd,WAAmB,EACnB,GAAY,EACZ,SAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CACvB,0FAA0F,EAC1F,CAAC,WAAW,CAAC,CACd,CAAC,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,aAAa,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,aAAa,CACjB,WAAW,EACX,cAAc,GAAG,CAAC,EAAE,oBAAoB,SAAS,oCAAoC;gBACnF,gBAAgB,EAClB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,UAAwB,EACxB,SAAsD,EACtD,IAA8D,EAC9D,UAA0B;IAE1B,OAAO,IAAI,gBAAgB,CACzB,cAAc,UAAU,YAAY,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG;QAC7F,gEAAgE,EAClE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAAmB,EAAE,CACvE,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;AAE9C,mGAAmG;AACnG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAAe,EAAoB,EAAE,CAC7E,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA0B,EAAE,GAAY;IACvE,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,mBAAmB,EACnB,6BAA6B,KAAK,CAAC,SAAS,uBAAuB,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAc,EACd,GAA0B,EAC1B,KAAsB,EACtB,GAAY;IAEZ,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrD,GAAG,CAAC,IAAI,CACN;;;0EAGsE,EACtE;QACE,EAAE;QACF,MAAM,mBAAmB,CAAC,MAAM,CAAC;QACjC,KAAK,CAAC,KAAK,IAAI,IAAI;QACnB,KAAK,CAAC,SAAS;QACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACtB,GAAG;QACH,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,OAAO;KACd,CACF,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAc,EACd,KAAa,EACb,KAAsB,EACtB,GAAY;IAEZ,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrD,GAAG,CAAC,IAAI,CACN;yCACqC,EACrC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAClC,CAAC;IACF,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}
|
|
1
|
+
{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,IAAI,kBAAkB,EAClC,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,WAAW,IAAI,iBAAiB,EAChC,aAAa,EACb,eAAe,GAsBhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyCjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmD7B,CAAC;AAEF,gHAAgH;AAChH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,wBAAwB,EAAE,+BAA+B,CAAU,CAAC;AAuB3G,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAC7B,uGAAuG;IACvG,6EAA6E,CAAC;AAEhF,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,OAAO;QACL,GAAG,EAAE,UAAU,kBAAkB,2CAA2C;QAC5E,MAAM,EAAE,CAAC,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAsB,EACtB,KAAK,GAAG,CAAC;IAET,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC,GAAG,KAAK,CAAC,CAAC;IAChE,OAAO;QACL,GAAG,EACD,UAAU,kBAAkB,8BAA8B;YAC1D,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B;QACnF,MAAM;KACP,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAc,EAAE,MAAyB;IACxE,MAAM,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAc,EAAE,MAAyB;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC;IACvD,MAAM,CAAC,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAqD,EACrD,GAAW,EACF,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAA2E,EAC3E,GAAW,EACF,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;AAc7F,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CACvB,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE;YAChE,WAAW;YACX,QAAQ,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACnD,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;KACvE,CAAC;IACF,OAAO,gBAAgB,CAAC,KAAK,CAC3B,GAAG,CAAC,IAAI,KAAK,QAAQ;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;QACzD,CAAC,CAAC;YACE,IAAI,EAAE,KAAK;YACX,GAAG,MAAM;YACT,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE;YAChE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;YAChD,UAAU,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YACvE,WAAW,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;SACtD,CACN,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB;IAClC,OAAO,wBAAwB,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,0BAA0B;IACxC,OAAO,yBAAyB,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,wFAAwF;AACxF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,MAAc,EAAmB,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;AAuB5F,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAU,EAAE,EAAE,CACzC,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CACpF,IAAI,EAAE,CACR,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAA0B;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAI,KAAQ,EAAE,OAA0B;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAA0B;IACvE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAe,EAAE,OAA0B;IACvF,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,KAAK,4EAA4E;YAClF,qEAAqE,EACvE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAChC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,YAAY,CAAC,KAAgB,EAAE,OAA0B;IACvE,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACrB,cAAc,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACpB,cAAc,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC;AAoDD,MAAM,WAAW,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE9E,SAAS,WAAW,CAAC,OAAqB,EAAE,IAAY;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,0BAA0B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,kBAAkB;YAC1F,KAAK,OAAO,CAAC,IAAI,oEAAoE,EACvF,EAAE,MAAM,EAAE,uBAAuB,EAAE,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,OAAO,GAAG,CAAC,EAAU,EAA6B,EAAE;QACxD,MAAM,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,oEAAoE;YACpE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;YACpE,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;YAC9C,KAAK,MAAM,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,MAAM,aAAa,CACjB,mBAAmB,EACnB,2BAA2B,EAAE,oDAAoD;wBAC/E,6DAA6D,CAChE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACjE,MAAM,aAAa,CACjB,mBAAmB,EACnB,oCAAoC,KAAK,CAAC,SAAS,uBAAuB,CAC3E,CAAC;YACJ,CAAC;YACD,qFAAqF;YACrF,uFAAuF;YACvF,gFAAgF;YAChF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,UAAU,QAAQ,IAAI,KAAK;wBAC/D,+EAA+E,CAClF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;;;qEAG6D,EAC7D;gBACE,EAAE;gBACF,SAAS;gBACT,KAAK,CAAC,KAAK,IAAI,IAAI;gBACnB,KAAK,CAAC,MAAM,CAAC,UAAU;gBACvB,KAAK,CAAC,MAAM,CAAC,QAAQ;gBACrB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;gBAC3B,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;gBACvD,WAAW;gBACX,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBACtB,IAAI,CAAC,GAAG;gBACR,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,OAAO,IAAI,IAAI;aACtB,CACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,OAAO,GAA4B;gBACvC,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW;gBACX,UAAU;gBACV,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;gBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO;aACR,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;YACrE,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,MAAM,aAAa,CAAC,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,aAAa,CACjB,WAAW,EACX,cAAc,EAAE,8DAA8D,EAC9E,EAAE,MAAM,EAAE,4BAA4B,EAAE,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO;YACpC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,IAAI,gBAAgB,CACxB,4BAA4B,EAAE,gCAAgC,UAAU,OAAO;wBAC7E,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,qDAAqD,CACpF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;6CACqC,EACrC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CACxC,CAAC;YACF,MAAM,OAAO,GAA6B;gBACxC,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,OAAO;aACnB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,kBAAkB;gBACxB,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAE9E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;AACrE,MAAM,qCAAqC,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAEtH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAIC,EACD,MAAe;AACf;;;;GAIG;AACH,IAAuB;IAEvB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CACxB,UAAU,kBAAkB,mDAAmD,EAC/E,CAAC,SAAS,CAAC,CACZ,CAAC,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CACzB;+BAC2B,EAC3B,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAC7B,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAE1B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAA+B;YAC1C,YAAY,EAAE,EAAE;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,gBAAgB,EAAE,IAAI;YACtB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACZ,IAAI,EAAE,oBAAoB;YAC1B,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;YAClD,QAAQ,EAAE,MAAM;YAChB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,MAAM;QACnE,CAAC,CAAC,GAAG,CAAC,UAAU;QAChB,CAAC,CAAC,MAAM,CAAY,CAAC;IACvB,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;IAClD,8EAA8E;IAC9E,qFAAqF;IACrF,kEAAkE;IAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;2FACuF,EACvF,CAAC,IAAI,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAC3C,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI,CACX;yBACqB,EACrB,CAAC,MAAM,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CACnE,CAAC;IACF,MAAM,OAAO,GAA+B;QAC1C,YAAY,EAAE,EAAE;QAChB,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,gBAAgB,EAAE,SAAS;QAC3B,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;QACZ,IAAI,EAAE,oBAAoB;QAC1B,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,MAAM;QAChB,OAAO;KACR,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAc,EACd,WAAmB,EACnB,GAAY,EACZ,SAAiB,EACjB,cAAc,GAAG,KAAK;IAEtB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CACvB,0FAA0F,EAC1F,CAAC,WAAW,CAAC,CACd,CAAC,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,aAAa,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,aAAa,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QACvD,MAAM,uBAAuB,GAC3B,cAAc,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM,IAAI,qCAAqC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7D,MAAM,aAAa,CACjB,WAAW,EACX,cAAc,GAAG,CAAC,EAAE,oBAAoB,SAAS,oCAAoC;gBACnF,gBAAgB,EAClB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,UAAwB,EACxB,SAAsD,EACtD,IAA8D,EAC9D,UAA0B;IAE1B,OAAO,IAAI,gBAAgB,CACzB,cAAc,UAAU,YAAY,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG;QAC7F,gEAAgE,EAClE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAAmB,EAAE,CACvE,SAAS,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;AAE9C,mGAAmG;AACnG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAAe,EAAoB,EAAE,CAC7E,SAAS,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE9C;;;;;GAKG;AACH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA0B,EAAE,GAAY;IACvE,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,mBAAmB,EACnB,6BAA6B,KAAK,CAAC,SAAS,uBAAuB,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAc,EACd,GAA0B,EAC1B,KAAsB,EACtB,GAAY;IAEZ,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrD,GAAG,CAAC,IAAI,CACN;;;gFAG4E,EAC5E;QACE,EAAE;QACF,MAAM,mBAAmB,CAAC,MAAM,CAAC;QACjC,KAAK,CAAC,KAAK,IAAI,IAAI;QACnB,KAAK,CAAC,SAAS;QACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACtB,GAAG;QACH,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,OAAO;KACd,CACF,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAc,EACd,KAAa,EACb,KAAsB,EACtB,GAAY;IAEZ,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrD,GAAG,CAAC,IAAI,CACN;yCACqC,EACrC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAClC,CAAC;IACF,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
import { type ConnectLink, type ConnectLinkConsume, type ScopeId, type TenantId } from '@substrat-run/contracts';
|
|
2
|
+
import type { RedactionSql } from './subject-redaction.js';
|
|
3
|
+
/**
|
|
4
|
+
* The platform-held connect link (connections.md §3.5.4), as statements both adapters run
|
|
5
|
+
* against their directory — the SQLite host over better-sqlite3, the hosted one inside
|
|
6
|
+
* ControlPlaneDO — so the lifecycle is written once, the way the findings store is.
|
|
7
|
+
*
|
|
8
|
+
* A vertical mints one to be MAILED: a bookkeeping bureau's staff send it to a client
|
|
9
|
+
* company's Fortnox administrator, who opens it days later. A signature alone cannot be
|
|
10
|
+
* withdrawn and cannot be spent, which is what §3.5.3's in-session URL gets away with by
|
|
11
|
+
* living minutes; a link living a week cannot. So the signed state names this row, and the
|
|
12
|
+
* row decides: outstanding and unexpired opens, anything else refuses.
|
|
13
|
+
*
|
|
14
|
+
* Every read and write is keyed by (tenant, scope, id). A link of another scope or tenant
|
|
15
|
+
* is not a forbidden row — it is an absent one, and answers exactly as `unknown` does.
|
|
16
|
+
*
|
|
17
|
+
* Expiry is judged against the `now` the caller passes: the pure host's clock, or the
|
|
18
|
+
* coordinator's wall clock on the hosted one. ISO 8601 UTC text on both sides, so a string
|
|
19
|
+
* comparison is a chronological one.
|
|
20
|
+
*/
|
|
21
|
+
export declare const CONNECT_LINKS_DDL = "\n CREATE TABLE IF NOT EXISTS _substrat_connect_links (\n id TEXT PRIMARY KEY,\n tenant_id TEXT NOT NULL,\n scope_id TEXT NOT NULL,\n vertical TEXT NOT NULL,\n provider TEXT NOT NULL,\n status TEXT NOT NULL,\n created_by TEXT NOT NULL,\n subject_ref TEXT,\n return_url TEXT,\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n used_at TEXT,\n account_ref TEXT,\n account_label TEXT\n );\n CREATE INDEX IF NOT EXISTS _substrat_connect_links_scope\n ON _substrat_connect_links (tenant_id, scope_id, created_at);\n";
|
|
22
|
+
export interface ConnectLinkKeyRow {
|
|
23
|
+
tenantId: string;
|
|
24
|
+
scopeId: string;
|
|
25
|
+
id: string;
|
|
26
|
+
}
|
|
27
|
+
/**
|
|
28
|
+
* The admin-log row a link move hands back, for the caller to write in the SAME unit as the
|
|
29
|
+
* move: a consume whose audit row failed would otherwise leave the link spent with no
|
|
30
|
+
* connection and no record, and the retry refused as `used`. Shaped here, once, so both
|
|
31
|
+
* adapters write the same row. A move that changed nothing hands back nothing.
|
|
32
|
+
*/
|
|
33
|
+
export interface ConnectLinkAudit {
|
|
34
|
+
action: 'mintConnectLink' | 'revokeConnectLink' | 'consumeConnectLink' | 'restoreConnectLink';
|
|
35
|
+
target: {
|
|
36
|
+
tenantId: TenantId;
|
|
37
|
+
scopeId: ScopeId;
|
|
38
|
+
vertical: string;
|
|
39
|
+
};
|
|
40
|
+
before: unknown;
|
|
41
|
+
after: unknown;
|
|
42
|
+
}
|
|
43
|
+
export declare function insertConnectLink(sql: RedactionSql, row: {
|
|
44
|
+
id: string;
|
|
45
|
+
tenantId: string;
|
|
46
|
+
scopeId: string;
|
|
47
|
+
vertical: string;
|
|
48
|
+
provider: string;
|
|
49
|
+
createdBy: string;
|
|
50
|
+
subjectRef: string | null;
|
|
51
|
+
returnUrl: string | null;
|
|
52
|
+
createdAt: string;
|
|
53
|
+
expiresAt: string;
|
|
54
|
+
}, audit: (row: ConnectLinkAudit) => void): ConnectLink;
|
|
55
|
+
export declare function readConnectLink(sql: RedactionSql, key: ConnectLinkKeyRow): ConnectLink | undefined;
|
|
56
|
+
export declare function listConnectLinks(sql: RedactionSql, filter: {
|
|
57
|
+
tenantId: string;
|
|
58
|
+
scopeId?: string;
|
|
59
|
+
ids?: readonly string[];
|
|
60
|
+
provider?: string;
|
|
61
|
+
outstandingOnly?: boolean;
|
|
62
|
+
}, now: string): ConnectLink[];
|
|
63
|
+
/**
|
|
64
|
+
* Withdraw an outstanding link. Idempotent, and only an outstanding row moves: a used link
|
|
65
|
+
* has already been spent (its connection is what to disconnect), and a revoked one stays
|
|
66
|
+
* revoked. `undefined` when no such link exists in this scope; `changed` says whether this
|
|
67
|
+
* call is the one that revoked it, so a no-op is not audited.
|
|
68
|
+
*/
|
|
69
|
+
export declare function revokeConnectLinkRow(sql: RedactionSql, key: ConnectLinkKeyRow, audit: (row: ConnectLinkAudit) => void): {
|
|
70
|
+
link: ConnectLink;
|
|
71
|
+
changed: boolean;
|
|
72
|
+
} | undefined;
|
|
73
|
+
/**
|
|
74
|
+
* Spend a link — the callback's act, BEFORE it stores the credential, so of two racing
|
|
75
|
+
* callbacks exactly one gets past it. Single-use is decided by the UPDATE's WHERE, not by
|
|
76
|
+
* the read in front of it: the read only picks which refusal to answer with.
|
|
77
|
+
*/
|
|
78
|
+
export declare function consumeConnectLinkRow(sql: RedactionSql, input: ConnectLinkKeyRow & {
|
|
79
|
+
provider: string;
|
|
80
|
+
accountRef?: string;
|
|
81
|
+
accountLabel?: string;
|
|
82
|
+
}, now: string, audit: (row: ConnectLinkAudit) => void): ConnectLinkConsume;
|
|
83
|
+
/**
|
|
84
|
+
* The compensating half of consume: the callback spent the link, then failed to store the
|
|
85
|
+
* credential, so nothing was connected and the link goes back to outstanding — a platform
|
|
86
|
+
* hiccup costs a retry, not a fresh link mailed to a client. Only a `used` row moves (a
|
|
87
|
+
* revocation is never undone by this), and only an unexpired one: a link that lapsed while
|
|
88
|
+
* the store failed stays spent rather than coming back already dead.
|
|
89
|
+
*/
|
|
90
|
+
export declare function restoreConnectLinkRow(sql: RedactionSql, key: ConnectLinkKeyRow, now: string, audit: (row: ConnectLinkAudit) => void): ConnectLink | undefined;
|
|
91
|
+
//# sourceMappingURL=connect-links.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"connect-links.d.ts","sourceRoot":"","sources":["../src/connect-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EAEvB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,qnBAmB7B,CAAC;AA0CF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,CAAC;IAC9F,MAAM,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAWD,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE;IACH,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,KAAK,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,GACrC,WAAW,CA4Bb;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAGlG;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,EACrH,GAAG,EAAE,MAAM,GACV,WAAW,EAAE,CAgBf;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,GACrC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAmBrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,iBAAiB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3F,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,GACrC,kBAAkB,CAuBpB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,YAAY,EACjB,GAAG,EAAE,iBAAiB,EACtB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,IAAI,GACrC,WAAW,GAAG,SAAS,CAiBzB"}
|
|
@@ -0,0 +1,189 @@
|
|
|
1
|
+
import { connectLink, } from '@substrat-run/contracts';
|
|
2
|
+
/**
|
|
3
|
+
* The platform-held connect link (connections.md §3.5.4), as statements both adapters run
|
|
4
|
+
* against their directory — the SQLite host over better-sqlite3, the hosted one inside
|
|
5
|
+
* ControlPlaneDO — so the lifecycle is written once, the way the findings store is.
|
|
6
|
+
*
|
|
7
|
+
* A vertical mints one to be MAILED: a bookkeeping bureau's staff send it to a client
|
|
8
|
+
* company's Fortnox administrator, who opens it days later. A signature alone cannot be
|
|
9
|
+
* withdrawn and cannot be spent, which is what §3.5.3's in-session URL gets away with by
|
|
10
|
+
* living minutes; a link living a week cannot. So the signed state names this row, and the
|
|
11
|
+
* row decides: outstanding and unexpired opens, anything else refuses.
|
|
12
|
+
*
|
|
13
|
+
* Every read and write is keyed by (tenant, scope, id). A link of another scope or tenant
|
|
14
|
+
* is not a forbidden row — it is an absent one, and answers exactly as `unknown` does.
|
|
15
|
+
*
|
|
16
|
+
* Expiry is judged against the `now` the caller passes: the pure host's clock, or the
|
|
17
|
+
* coordinator's wall clock on the hosted one. ISO 8601 UTC text on both sides, so a string
|
|
18
|
+
* comparison is a chronological one.
|
|
19
|
+
*/
|
|
20
|
+
export const CONNECT_LINKS_DDL = `
|
|
21
|
+
CREATE TABLE IF NOT EXISTS _substrat_connect_links (
|
|
22
|
+
id TEXT PRIMARY KEY,
|
|
23
|
+
tenant_id TEXT NOT NULL,
|
|
24
|
+
scope_id TEXT NOT NULL,
|
|
25
|
+
vertical TEXT NOT NULL,
|
|
26
|
+
provider TEXT NOT NULL,
|
|
27
|
+
status TEXT NOT NULL,
|
|
28
|
+
created_by TEXT NOT NULL,
|
|
29
|
+
subject_ref TEXT,
|
|
30
|
+
return_url TEXT,
|
|
31
|
+
created_at TEXT NOT NULL,
|
|
32
|
+
expires_at TEXT NOT NULL,
|
|
33
|
+
used_at TEXT,
|
|
34
|
+
account_ref TEXT,
|
|
35
|
+
account_label TEXT
|
|
36
|
+
);
|
|
37
|
+
CREATE INDEX IF NOT EXISTS _substrat_connect_links_scope
|
|
38
|
+
ON _substrat_connect_links (tenant_id, scope_id, created_at);
|
|
39
|
+
`;
|
|
40
|
+
/** Named, never `*`: the row a read returns is the shape below, whatever the table grows. */
|
|
41
|
+
const COLUMNS = 'id, tenant_id, scope_id, vertical, provider, status, created_by, subject_ref, return_url, ' +
|
|
42
|
+
'created_at, expires_at, used_at, account_ref, account_label';
|
|
43
|
+
const toConnectLink = (r) => connectLink.parse({
|
|
44
|
+
id: r.id,
|
|
45
|
+
tenantId: r.tenant_id,
|
|
46
|
+
scopeId: r.scope_id,
|
|
47
|
+
vertical: r.vertical,
|
|
48
|
+
provider: r.provider,
|
|
49
|
+
status: r.status,
|
|
50
|
+
createdBy: r.created_by,
|
|
51
|
+
subjectRef: r.subject_ref,
|
|
52
|
+
returnUrl: r.return_url,
|
|
53
|
+
createdAt: r.created_at,
|
|
54
|
+
expiresAt: r.expires_at,
|
|
55
|
+
usedAt: r.used_at,
|
|
56
|
+
accountRef: r.account_ref,
|
|
57
|
+
accountLabel: r.account_label,
|
|
58
|
+
});
|
|
59
|
+
const targetOf = (link) => ({ tenantId: link.tenantId, scopeId: link.scopeId, vertical: link.vertical });
|
|
60
|
+
const readRow = (sql, key) => sql(`SELECT ${COLUMNS} FROM _substrat_connect_links WHERE id = ? AND tenant_id = ? AND scope_id = ?`, [
|
|
61
|
+
key.id,
|
|
62
|
+
key.tenantId,
|
|
63
|
+
key.scopeId,
|
|
64
|
+
])[0];
|
|
65
|
+
export function insertConnectLink(sql, row, audit) {
|
|
66
|
+
const inserted = sql(`INSERT INTO _substrat_connect_links
|
|
67
|
+
(id, tenant_id, scope_id, vertical, provider, status, created_by, subject_ref, return_url,
|
|
68
|
+
created_at, expires_at, used_at, account_ref, account_label)
|
|
69
|
+
VALUES (?, ?, ?, ?, ?, 'outstanding', ?, ?, ?, ?, ?, NULL, NULL, NULL)
|
|
70
|
+
RETURNING ${COLUMNS}`, [
|
|
71
|
+
row.id,
|
|
72
|
+
row.tenantId,
|
|
73
|
+
row.scopeId,
|
|
74
|
+
row.vertical,
|
|
75
|
+
row.provider,
|
|
76
|
+
row.createdBy,
|
|
77
|
+
row.subjectRef,
|
|
78
|
+
row.returnUrl,
|
|
79
|
+
row.createdAt,
|
|
80
|
+
row.expiresAt,
|
|
81
|
+
])[0];
|
|
82
|
+
const link = toConnectLink(inserted);
|
|
83
|
+
audit({
|
|
84
|
+
action: 'mintConnectLink',
|
|
85
|
+
target: targetOf(link),
|
|
86
|
+
before: null,
|
|
87
|
+
after: { id: link.id, provider: link.provider, createdBy: link.createdBy, expiresAt: link.expiresAt },
|
|
88
|
+
});
|
|
89
|
+
return link;
|
|
90
|
+
}
|
|
91
|
+
export function readConnectLink(sql, key) {
|
|
92
|
+
const row = readRow(sql, key);
|
|
93
|
+
return row ? toConnectLink(row) : undefined;
|
|
94
|
+
}
|
|
95
|
+
export function listConnectLinks(sql, filter, now) {
|
|
96
|
+
if (filter.ids?.length === 0)
|
|
97
|
+
return []; // no id named — match nothing, never everything
|
|
98
|
+
const where = ['tenant_id = ?'];
|
|
99
|
+
const params = [filter.tenantId];
|
|
100
|
+
if (filter.scopeId)
|
|
101
|
+
(where.push('scope_id = ?'), params.push(filter.scopeId));
|
|
102
|
+
// ONE bound JSON array, not a `?` per id: a DO binds at most 100 parameters (#1776).
|
|
103
|
+
if (filter.ids)
|
|
104
|
+
(where.push('id IN (SELECT value FROM json_each(?))'), params.push(JSON.stringify(filter.ids)));
|
|
105
|
+
if (filter.provider)
|
|
106
|
+
(where.push('provider = ?'), params.push(filter.provider));
|
|
107
|
+
if (filter.outstandingOnly)
|
|
108
|
+
(where.push(`status = 'outstanding' AND expires_at > ?`), params.push(now));
|
|
109
|
+
return sql(`SELECT ${COLUMNS} FROM _substrat_connect_links WHERE ${where.join(' AND ')}
|
|
110
|
+
ORDER BY created_at DESC, id DESC`, params).map(toConnectLink);
|
|
111
|
+
}
|
|
112
|
+
/**
|
|
113
|
+
* Withdraw an outstanding link. Idempotent, and only an outstanding row moves: a used link
|
|
114
|
+
* has already been spent (its connection is what to disconnect), and a revoked one stays
|
|
115
|
+
* revoked. `undefined` when no such link exists in this scope; `changed` says whether this
|
|
116
|
+
* call is the one that revoked it, so a no-op is not audited.
|
|
117
|
+
*/
|
|
118
|
+
export function revokeConnectLinkRow(sql, key, audit) {
|
|
119
|
+
const moved = sql(`UPDATE _substrat_connect_links SET status = 'revoked'
|
|
120
|
+
WHERE id = ? AND tenant_id = ? AND scope_id = ? AND status = 'outstanding'
|
|
121
|
+
RETURNING ${COLUMNS}`, [key.id, key.tenantId, key.scopeId])[0];
|
|
122
|
+
if (moved) {
|
|
123
|
+
const link = toConnectLink(moved);
|
|
124
|
+
audit({
|
|
125
|
+
action: 'revokeConnectLink',
|
|
126
|
+
target: targetOf(link),
|
|
127
|
+
before: { status: 'outstanding' },
|
|
128
|
+
after: { id: link.id, provider: link.provider, status: 'revoked' },
|
|
129
|
+
});
|
|
130
|
+
return { link, changed: true };
|
|
131
|
+
}
|
|
132
|
+
const row = readRow(sql, key);
|
|
133
|
+
return row ? { link: toConnectLink(row), changed: false } : undefined;
|
|
134
|
+
}
|
|
135
|
+
/**
|
|
136
|
+
* Spend a link — the callback's act, BEFORE it stores the credential, so of two racing
|
|
137
|
+
* callbacks exactly one gets past it. Single-use is decided by the UPDATE's WHERE, not by
|
|
138
|
+
* the read in front of it: the read only picks which refusal to answer with.
|
|
139
|
+
*/
|
|
140
|
+
export function consumeConnectLinkRow(sql, input, now, audit) {
|
|
141
|
+
const row = readRow(sql, input);
|
|
142
|
+
const refuse = (reason) => ({ ok: false, reason });
|
|
143
|
+
// A link minted for another provider is not this round's link at all.
|
|
144
|
+
if (!row || row.provider !== input.provider)
|
|
145
|
+
return refuse('unknown');
|
|
146
|
+
if (row.status === 'used')
|
|
147
|
+
return refuse('used');
|
|
148
|
+
if (row.status === 'revoked')
|
|
149
|
+
return refuse('revoked');
|
|
150
|
+
if (row.expires_at <= now)
|
|
151
|
+
return refuse('expired');
|
|
152
|
+
const spent = sql(`UPDATE _substrat_connect_links SET status = 'used', used_at = ?, account_ref = ?, account_label = ?
|
|
153
|
+
WHERE id = ? AND tenant_id = ? AND scope_id = ? AND status = 'outstanding' AND expires_at > ?
|
|
154
|
+
RETURNING ${COLUMNS}`, [now, input.accountRef ?? null, input.accountLabel ?? null, input.id, input.tenantId, input.scopeId, now])[0];
|
|
155
|
+
if (!spent)
|
|
156
|
+
return refuse('used');
|
|
157
|
+
const link = toConnectLink(spent);
|
|
158
|
+
audit({
|
|
159
|
+
action: 'consumeConnectLink',
|
|
160
|
+
target: targetOf(link),
|
|
161
|
+
before: { status: 'outstanding' },
|
|
162
|
+
after: { id: link.id, provider: link.provider, status: 'used', accountRef: link.accountRef },
|
|
163
|
+
});
|
|
164
|
+
return { ok: true, link };
|
|
165
|
+
}
|
|
166
|
+
/**
|
|
167
|
+
* The compensating half of consume: the callback spent the link, then failed to store the
|
|
168
|
+
* credential, so nothing was connected and the link goes back to outstanding — a platform
|
|
169
|
+
* hiccup costs a retry, not a fresh link mailed to a client. Only a `used` row moves (a
|
|
170
|
+
* revocation is never undone by this), and only an unexpired one: a link that lapsed while
|
|
171
|
+
* the store failed stays spent rather than coming back already dead.
|
|
172
|
+
*/
|
|
173
|
+
export function restoreConnectLinkRow(sql, key, now, audit) {
|
|
174
|
+
const restored = sql(`UPDATE _substrat_connect_links
|
|
175
|
+
SET status = 'outstanding', used_at = NULL, account_ref = NULL, account_label = NULL
|
|
176
|
+
WHERE id = ? AND tenant_id = ? AND scope_id = ? AND status = 'used' AND expires_at > ?
|
|
177
|
+
RETURNING ${COLUMNS}`, [key.id, key.tenantId, key.scopeId, now])[0];
|
|
178
|
+
if (!restored)
|
|
179
|
+
return undefined;
|
|
180
|
+
const link = toConnectLink(restored);
|
|
181
|
+
audit({
|
|
182
|
+
action: 'restoreConnectLink',
|
|
183
|
+
target: targetOf(link),
|
|
184
|
+
before: { status: 'used' },
|
|
185
|
+
after: { id: link.id, provider: link.provider, status: 'outstanding' },
|
|
186
|
+
});
|
|
187
|
+
return link;
|
|
188
|
+
}
|
|
189
|
+
//# sourceMappingURL=connect-links.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"connect-links.js","sourceRoot":"","sources":["../src/connect-links.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAMZ,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;AAEF,6FAA6F;AAC7F,MAAM,OAAO,GACX,4FAA4F;IAC5F,6DAA6D,CAAC;AAmBhE,MAAM,aAAa,GAAG,CAAC,CAAiB,EAAe,EAAE,CACvD,WAAW,CAAC,KAAK,CAAC;IAChB,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,QAAQ,EAAE,CAAC,CAAC,SAAS;IACrB,OAAO,EAAE,CAAC,CAAC,QAAQ;IACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,YAAY,EAAE,CAAC,CAAC,aAAa;CAC9B,CAAC,CAAC;AAqBL,MAAM,QAAQ,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEtH,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,GAAsB,EAA8B,EAAE,CACxF,GAAG,CAAC,UAAU,OAAO,+EAA+E,EAAE;IACpG,GAAG,CAAC,EAAE;IACN,GAAG,CAAC,QAAQ;IACZ,GAAG,CAAC,OAAO;CACZ,CAAC,CAAC,CAAC,CAA+B,CAAC;AAEtC,MAAM,UAAU,iBAAiB,CAC/B,GAAiB,EACjB,GAWC,EACD,KAAsC;IAEtC,MAAM,QAAQ,GAAG,GAAG,CAClB;;;;iBAIa,OAAO,EAAE,EACtB;QACE,GAAG,CAAC,EAAE;QACN,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,UAAU;QACd,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;KACd,CACF,CAAC,CAAC,CAAmB,CAAC;IACvB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,KAAK,CAAC;QACJ,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;KACtG,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAiB,EAAE,GAAsB;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAiB,EACjB,MAAqH,EACrH,GAAW;IAEX,IAAI,MAAM,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,gDAAgD;IACzF,MAAM,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;IAChC,MAAM,MAAM,GAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,OAAO;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,qFAAqF;IACrF,IAAI,MAAM,CAAC,GAAG;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,QAAQ;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,eAAe;QAAE,CAAC,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxG,OACE,GAAG,CACD,UAAU,OAAO,uCAAuC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;yCACxC,EACnC,MAAM,CAET,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAiB,EACjB,GAAsB,EACtB,KAAsC;IAEtC,MAAM,KAAK,GAAG,GAAG,CACf;;iBAEa,OAAO,EAAE,EACtB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CACpC,CAAC,CAAC,CAA+B,CAAC;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,KAAK,CAAC;YACJ,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;YACtB,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;YACjC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;SACnE,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAiB,EACjB,KAA2F,EAC3F,GAAW,EACX,KAAsC;IAEtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,sEAAsE;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,CACf;;iBAEa,OAAO,EAAE,EACtB,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAC1G,CAAC,CAAC,CAA+B,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,KAAK,CAAC;QACJ,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;QACjC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;KAC7F,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAiB,EACjB,GAAsB,EACtB,GAAW,EACX,KAAsC;IAEtC,MAAM,QAAQ,GAAG,GAAG,CAClB;;;iBAGa,OAAO,EAAE,EACtB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CACzC,CAAC,CAAC,CAA+B,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,KAAK,CAAC;QACJ,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;QAC1B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE;KACvE,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/connect-state.d.ts
CHANGED
|
@@ -9,13 +9,14 @@
|
|
|
9
9
|
* reason to have one — presses Connect on the vertical's own screen, and the vertical's
|
|
10
10
|
* operation is the permission-checked act.
|
|
11
11
|
*
|
|
12
|
-
* **Why
|
|
13
|
-
* and clicked days later by someone else, so it is a row: single-use, revocable, and
|
|
14
|
-
* when the minting admin loses access. A vertical-minted round is clicked in-session by
|
|
12
|
+
* **Why an in-session claim carries no link row.** The dashboard's connect link is minted,
|
|
13
|
+
* mailed, and clicked days later by someone else, so it is a row: single-use, revocable, and
|
|
14
|
+
* dead when the minting admin loses access. A vertical-minted round is clicked in-session by
|
|
15
15
|
* the person who just pressed the button, so the row would be state nobody reads. What
|
|
16
16
|
* replaces it is the expiry — minutes, not a week — and the account leg of the connection
|
|
17
17
|
* key: a replayed round re-consents the SAME company, which the store rotates in place
|
|
18
18
|
* rather than duplicating (#1267). The consent code itself is single-use at the provider.
|
|
19
|
+
* A vertical's MAILED link is the other case again, and carries a row: `linkId`, below.
|
|
19
20
|
*
|
|
20
21
|
* **Why the kernel.** Two workers hold the halves — the control plane mints (it owns the
|
|
21
22
|
* directory the vertical is re-derived from), the dashboard verifies (it owns the one
|
|
@@ -70,6 +71,14 @@ export interface ConnectStateClaim {
|
|
|
70
71
|
* just landed without waiting to match on an organisation number.
|
|
71
72
|
*/
|
|
72
73
|
subjectRef?: string;
|
|
74
|
+
/**
|
|
75
|
+
* Set when the round is a MAILED link (connections.md §3.5.4): the platform-held row in
|
|
76
|
+
* `_substrat_connect_links` that makes it single-use and revocable. The signature alone
|
|
77
|
+
* cannot be withdrawn, and a link lives days — so the callback asks this row, consumes it
|
|
78
|
+
* before storing, and refuses a round whose row is spent or revoked. Absent: an in-session
|
|
79
|
+
* round, which lives minutes and has no row (above). `exp` is then the row's own expiry.
|
|
80
|
+
*/
|
|
81
|
+
linkId?: string;
|
|
73
82
|
/** Epoch ms. */
|
|
74
83
|
exp: number;
|
|
75
84
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connect-state.d.ts","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"connect-state.d.ts","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8FAA8F;AAC9F,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,uCAAuC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AA6DD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxG;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA6BnC"}
|
package/dist/connect-state.js
CHANGED
|
@@ -9,13 +9,14 @@
|
|
|
9
9
|
* reason to have one — presses Connect on the vertical's own screen, and the vertical's
|
|
10
10
|
* operation is the permission-checked act.
|
|
11
11
|
*
|
|
12
|
-
* **Why
|
|
13
|
-
* and clicked days later by someone else, so it is a row: single-use, revocable, and
|
|
14
|
-
* when the minting admin loses access. A vertical-minted round is clicked in-session by
|
|
12
|
+
* **Why an in-session claim carries no link row.** The dashboard's connect link is minted,
|
|
13
|
+
* mailed, and clicked days later by someone else, so it is a row: single-use, revocable, and
|
|
14
|
+
* dead when the minting admin loses access. A vertical-minted round is clicked in-session by
|
|
15
15
|
* the person who just pressed the button, so the row would be state nobody reads. What
|
|
16
16
|
* replaces it is the expiry — minutes, not a week — and the account leg of the connection
|
|
17
17
|
* key: a replayed round re-consents the SAME company, which the store rotates in place
|
|
18
18
|
* rather than duplicating (#1267). The consent code itself is single-use at the provider.
|
|
19
|
+
* A vertical's MAILED link is the other case again, and carries a row: `linkId`, below.
|
|
19
20
|
*
|
|
20
21
|
* **Why the kernel.** Two workers hold the halves — the control plane mints (it owns the
|
|
21
22
|
* directory the vertical is re-derived from), the dashboard verifies (it owns the one
|
|
@@ -114,6 +115,10 @@ export async function verifyConnectState(platformSecret, token, now) {
|
|
|
114
115
|
if (typeof claim[field] !== 'string' || !claim[field])
|
|
115
116
|
return null;
|
|
116
117
|
}
|
|
118
|
+
// A link round with a malformed row reference would read as an in-session round — the
|
|
119
|
+
// one kind the callback spends nothing for — so it is refused, never downgraded.
|
|
120
|
+
if (claim.linkId !== undefined && (typeof claim.linkId !== 'string' || !claim.linkId))
|
|
121
|
+
return null;
|
|
117
122
|
return claim;
|
|
118
123
|
}
|
|
119
124
|
catch {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connect-state.js","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"connect-state.js","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8FAA8F;AAC9F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AA6E1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAc,EAAE;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,yFAAyF;AACzF,KAAK,UAAU,QAAQ,CAAC,cAAsB;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE,EACnG,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAAsB,EAAE,KAAwB;IACrF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAAkC,EAClC,KAAa,EACb,GAAW;IAEX,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAsB,CAAC;QAC7F,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACnE,mFAAmF;QACnF,mFAAmF;QACnF,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAU,EAAE,CAAC;YAC1F,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrE,CAAC;QACD,sFAAsF;QACtF,iFAAiF;QACjF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* One schema object the kernel derives from a declaration (#2090): the CREATE statement as the
|
|
3
|
+
* kernel emits it, and the table SQLite files it under (`sqlite_master.tbl_name`). The DDL that
|
|
4
|
+
* creates it is assembled from this, so what is checked and what is run cannot differ.
|
|
5
|
+
*/
|
|
6
|
+
export interface DerivedObject {
|
|
7
|
+
readonly name: string;
|
|
8
|
+
readonly type: 'table' | 'trigger' | 'index';
|
|
9
|
+
/** `sqlite_master.tbl_name`: the table a trigger or index is on; a table's own name. */
|
|
10
|
+
readonly table: string;
|
|
11
|
+
/** The CREATE statement, without its trailing `;` — as `sqlite_master.sql` stores it. */
|
|
12
|
+
readonly sql: string;
|
|
13
|
+
}
|
|
14
|
+
//# sourceMappingURL=derived-object.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"derived-object.d.ts","sourceRoot":"","sources":["../src/derived-object.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;IAC7C,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB"}
|