@synoikia/core 0.7.0 → 0.8.0

package/dist/http/admin/me.d.ts

@@ -0,0 +1,6 @@
+import type { Hono } from 'hono';
+import type { AppContext } from '../../app.js';
+import type { AdminEnv } from './auth.js';
+/** What every signed-in user may use (design §6.4, §8.4): their endpoints and levels, their own levels
+ * and rules where the role allows them, and their own tokens and OAuth grants. */
+export declare function registerMeRoutes(app: Hono<AdminEnv>, ctx: AppContext): void;

package/dist/http/admin/me.js

@@ -0,0 +1,189 @@
+import { z } from 'zod';
+import { levelView, roleHasInstance, roleInstanceIds, setOwnLevel } from '../../catalog/role-levels.js';
+import { findRegistryEntries, scopesFromQuery } from '../../catalog/registry.js';
+import { createRule, deleteRule, listRules, updateRule } from '../../catalog/rules.js';
+import { ForbiddenError, NotFoundError, ValidationError } from '../../errors.js';
+import { ACCESS_LEVELS } from '../../gate/access.js';
+import { getSettings } from '../../settings.js';
+import { readJson } from '../common.js';
+/** What every signed-in user may use (design §6.4, §8.4): their endpoints and levels, their own levels
+ * and rules where the role allows them, and their own tokens and OAuth grants. */
+export function registerMeRoutes(app, ctx) {
+    const me = (c) => c.get('user');
+    const roleOf = (c) => ctx.users.roleOf(me(c));
+    const mcpBase = () => ctx.config.PUBLIC_MCP_URL?.replace(/\/$/, '') ?? '';
+    /** An endpoint of the caller's role; any other answers 404, as if it didn't exist. */
+    const myInstance = (c) => {
+        const id = c.req.param('id') ?? '';
+        if (!roleHasInstance(ctx.db, me(c).roleId, id))
+            throw new NotFoundError('instance_not_found', 'No such endpoint');
+        return ctx.instances.get(id);
+    };
+    const need = (c, cap) => {
+        if (!roleOf(c)[cap])
+            throw new ForbiddenError('forbidden', 'Your role does not allow this');
+    };
+    const view = (c, instanceId) => levelView(ctx.db, instanceId, { roleId: me(c).roleId, userId: me(c).id }, { reachableOnly: !roleOf(c).isAdmin });
+    app.get('/api/me/endpoints', (c) => {
+        const role = roleOf(c);
+        const mine = role.isAdmin ? null : new Set(roleInstanceIds(ctx.db, role.id));
+        const mode = getSettings(ctx.db, 'mcp').defaultAuthMode;
+        return c.json(ctx.instances
+            .list()
+            .filter((i) => !mine || mine.has(i.id))
+            .map((i) => ({
+            id: i.id,
+            slug: i.slug,
+            displayName: i.displayName,
+            endpointUrl: `${mcpBase()}/${i.slug}`,
+            authMode: i.authMode ?? mode,
+            // Live status only where the role shows it (design §6.4).
+            ...(role.isAdmin || role.canSeeStatus
+                ? {
+                    status: {
+                        enabled: i.enabled,
+                        state: i.status,
+                        error: i.statusError,
+                        plugin: i.plugin.name,
+                        upstreamVersion: i.upstreamVersion,
+                        lastSyncedAt: i.lastSyncedAt,
+                        lastSyncStatus: i.lastSyncStatus,
+                    },
+                }
+                : {}),
+        })));
+    });
+    app.get('/api/me/endpoints/:id/access', (c) => c.json(view(c, myInstance(c).id)));
+    const Level = z.object({ level: z.enum(ACCESS_LEVELS).nullable() });
+    app.put('/api/me/endpoints/:id/groups/:key', async (c) => {
+        need(c, 'canSetOwnLevels');
+        const { id } = myInstance(c);
+        const { level } = await readJson(c, Level);
+        setOwnLevel(ctx.db, me(c).id, id, { group: c.req.param('key') }, level);
+        return c.json(view(c, id));
+    });
+    app.put('/api/me/endpoints/:id/operations/:opId', async (c) => {
+        need(c, 'canSetOwnLevels');
+        const { id } = myInstance(c);
+        const { level } = await readJson(c, Level);
+        setOwnLevel(ctx.db, me(c).id, id, { operationId: c.req.param('opId') }, level);
+        return c.json(view(c, id));
+    });
+    // ── own pre-approval rules ──
+    /** The caller's own rules, plus admin rules on operations they can reach (read-only to them). */
+    const myRules = (c, instanceId) => {
+        const reachable = new Set(view(c, instanceId).operations.map((o) => o.id));
+        return listRules(ctx.db, instanceId)
+            .filter((r) => r.ownerUserId === me(c).id || (r.ownerUserId === null && reachable.has(r.operationId)))
+            .map((r) => ({ ...r, editable: r.ownerUserId === me(c).id }));
+    };
+    const reachableOp = (c, instanceId, raw) => {
+        const opId = raw?.operationId;
+        if (opId === undefined)
+            return;
+        if (!view(c, instanceId).operations.some((o) => o.id === opId))
+            throw new ValidationError('operation_not_reachable', 'You can only write rules for operations you can call');
+    };
+    // What the rule editor needs from the manifest: the match fields and target scopes.
+    app.get('/api/me/endpoints/:id/rule-form', (c) => {
+        need(c, 'canManageOwnRules');
+        const { manifest } = ctx.instances.runtime(myInstance(c).id);
+        return c.json({ matchProfiles: manifest.matchProfiles, targets: manifest.targets ?? null });
+    });
+    /** The match fields of operations the caller may write rules for: reachable, plain writes. */
+    const ruleFields = (c, instanceId) => {
+        const { manifest } = ctx.instances.runtime(instanceId);
+        const fields = view(c, instanceId)
+            .operations.filter((o) => o.classification === 'write' && o.matchProfile)
+            .flatMap((o) => manifest.matchProfiles[o.matchProfile] ?? []);
+        return { manifest, fields };
+    };
+    // The editor's pickers, limited to what a rule the caller may write can name (design §6.4).
+    app.get('/api/me/endpoints/:id/options/:source', async (c) => {
+        need(c, 'canManageOwnRules');
+        const { id } = myInstance(c);
+        const source = c.req.param('source');
+        if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(source) ||
+            !ruleFields(c, id).fields.some((f) => f.optionsSource === source))
+            throw new NotFoundError('options_not_found', 'No such options source');
+        // Each call reaches the upstream with the instance's credential: a budget per user.
+        if (!ctx.limiter.allows(`options:${me(c).id}`, 60, 60_000))
+            return c.json({ error: 'rate_limited', message: 'Too many requests; slow down' }, 429);
+        const rt = ctx.instances.runtime(id);
+        const options = await rt.plugin().call('optionsFor', { source, query: c.req.query('q')?.slice(0, 200) });
+        // Only what the picker shows, redacted: `meta` and secrets in labels never reach a non-admin.
+        return c.json(rt.redact(options.map(({ value, label }) => ({ value, label }))));
+    });
+    app.get('/api/me/endpoints/:id/registry', (c) => {
+        need(c, 'canManageOwnRules');
+        const { id } = myInstance(c);
+        const { manifest, fields } = ruleFields(c, id);
+        const kinds = new Set([manifest.targets?.registryKind, ...(manifest.targets?.scopes ?? []).map((s) => s.registryKind)].filter(Boolean));
+        const query = c.req.query();
+        if (!fields.some((f) => f.field === '$targets') || !query.kind || !kinds.has(query.kind))
+            throw new NotFoundError('registry_not_found', 'No such registry kind');
+        // Only what the picker shows: attributes stay out, they can hold upstream secrets.
+        const entries = findRegistryEntries(ctx.db, id, { ...query, scopes: scopesFromQuery(query) }).map(({ kind, id: extId, name, parentId, scopes }) => ({ kind, id: extId, name, parentId, scopes }));
+        return c.json(ctx.instances.runtime(id).redact(entries));
+    });
+    app.get('/api/me/endpoints/:id/rules', (c) => {
+        need(c, 'canManageOwnRules');
+        return c.json(myRules(c, myInstance(c).id));
+    });
+    app.post('/api/me/endpoints/:id/rules', async (c) => {
+        need(c, 'canManageOwnRules');
+        const { id } = myInstance(c);
+        const raw = await readJson(c, z.unknown());
+        if (raw?.operationId === undefined)
+            throw new ValidationError('invalid_rule', 'operationId is required');
+        reachableOp(c, id, raw);
+        const rt = ctx.instances.runtime(id);
+        const rule = createRule(ctx.db, rt.manifest, id, raw, { userId: me(c).id }, { owner: me(c).id });
+        return c.json({ ...rule, editable: true }, 201);
+    });
+    app.patch('/api/me/endpoints/:id/rules/:ruleId', async (c) => {
+        need(c, 'canManageOwnRules');
+        const { id } = myInstance(c);
+        const raw = await readJson(c, z.unknown());
+        reachableOp(c, id, raw);
+        const rt = ctx.instances.runtime(id);
+        const rule = updateRule(ctx.db, rt.manifest, id, c.req.param('ruleId'), raw, { userId: me(c).id }, {
+            owner: me(c).id,
+        });
+        return c.json({ ...rule, editable: true });
+    });
+    app.delete('/api/me/endpoints/:id/rules/:ruleId', (c) => {
+        need(c, 'canManageOwnRules');
+        const { id } = myInstance(c);
+        deleteRule(ctx.db, id, c.req.param('ruleId'), { userId: me(c).id }, { owner: me(c).id });
+        return c.body(null, 204);
+    });
+    // ── own MCP credentials ──
+    app.get('/api/me/tokens', (c) => c.json(ctx.tokens.list(me(c).id)));
+    app.post('/api/me/tokens', async (c) => {
+        const raw = await readJson(c, z.object({ scope: z.array(z.string()).min(1) }).passthrough());
+        const role = roleOf(c);
+        if (!role.isAdmin) {
+            // `*` follows the role's endpoints as they change; named endpoints must be the role's now.
+            const mine = new Set(roleInstanceIds(ctx.db, role.id));
+            const outside = raw.scope.filter((s) => s !== '*' && !mine.has(s));
+            if (outside.length)
+                throw new ValidationError('unknown_instance', `Unknown endpoint(s) in scope: ${outside.join(', ')}`);
+        }
+        return c.json(ctx.tokens.create(raw, { userId: me(c).id }), 201);
+    });
+    app.delete('/api/me/tokens/:id', (c) => {
+        if (ctx.tokens.ownerOf(c.req.param('id')) !== me(c).id)
+            throw new NotFoundError('token_not_found', 'No such token');
+        ctx.tokens.revoke(c.req.param('id'), { userId: me(c).id });
+        return c.body(null, 204);
+    });
+    app.get('/api/me/grants', (c) => c.json(ctx.oauth.listGrants(me(c).id)));
+    app.delete('/api/me/grants/:id', (c) => {
+        if (!ctx.oauth.listGrants(me(c).id).some((g) => g.id === c.req.param('id')))
+            throw new NotFoundError('grant_not_found', 'No such grant');
+        ctx.oauth.revokeGrant(c.req.param('id'), { userId: me(c).id });
+        return c.body(null, 204);
+    });
+}
+//# sourceMappingURL=me.js.map

package/dist/http/admin/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../../src/http/admin/me.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC;kFACkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,GAAe;IACnE,MAAM,EAAE,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,CAAoB,EAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAE1E,sFAAsF;IACtF,MAAM,UAAU,GAAG,CAAC,CAAoB,EAAE,EAAE;QAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QAClH,OAAO,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAoB,EAAE,GAA4C,EAAE,EAAE;QAClF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IAC9F,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAoB,EAAE,UAAkB,EAAE,EAAE,CACxD,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAEnH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,SAAS;aACV,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;YACrC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;YAC5B,0DAA0D;YAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY;gBACnC,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,KAAK,EAAE,CAAC,CAAC,MAAM;wBACf,KAAK,EAAE,CAAC,CAAC,WAAW;wBACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI;wBACrB,eAAe,EAAE,CAAC,CAAC,eAAe;wBAClC,YAAY,EAAE,CAAC,CAAC,YAAY;wBAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;qBACjC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAElF,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEpE,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,IAAI,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC3B,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3C,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,IAAI,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC3B,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3C,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAE/B,iGAAiG;IACjG,MAAM,OAAO,GAAG,CAAC,CAAoB,EAAE,UAAkB,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;aACrG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,CAAoB,EAAE,UAAkB,EAAE,GAAY,EAAE,EAAE;QAC7E,MAAM,IAAI,GAAI,GAAwC,EAAE,WAAW,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;YAC5D,MAAM,IAAI,eAAe,CAAC,yBAAyB,EAAE,sDAAsD,CAAC,CAAC;IACjH,CAAC,CAAC;IAEF,oFAAoF;IACpF,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/C,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC7B,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,MAAM,UAAU,GAAG,CAAC,CAAoB,EAAE,UAAkB,EAAE,EAAE;QAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC;aAC/B,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC;aACxE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,YAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC;IAEF,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC7B,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3C,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC;YAEjE,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QACzE,oFAAoF;QACpF,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzG,8FAA8F;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC7B,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACjH,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACtF,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;QACzE,mFAAmF;QACnF,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAC/F,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAC/F,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC7B,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,IAAK,GAAwC,EAAE,WAAW,KAAK,SAAS;YACtE,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;QACvE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC7B,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CACrB,GAAG,CAAC,EAAE,EACN,EAAE,CAAC,QAAQ,EACX,EAAE,EACF,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EACrB,GAAG,EACH,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EACpB;YACE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;SAChB,CACF,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,qCAAqC,EAAE,CAAC,CAAC,EAAE,EAAE;QACtD,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC7B,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,4BAA4B;IAE5B,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,2FAA2F;YAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,IAAI,OAAO,CAAC,MAAM;gBAChB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QACpH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/admin/roles.d.ts

@@ -0,0 +1,5 @@
+import type { Hono } from 'hono';
+import type { AppContext } from '../../app.js';
+import type { AdminEnv } from './auth.js';
+/** Role management (design §6.4, §8.4): admin only, like everything outside `/api/me` and the profile. */
+export declare function registerRoleRoutes(app: Hono<AdminEnv>, ctx: AppContext): void;

package/dist/http/admin/roles.js

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+import { levelView, setRoleBulkLevel, setRoleLevel } from '../../catalog/role-levels.js';
+import { ACCESS_LEVELS } from '../../gate/access.js';
+import { readJson } from '../common.js';
+/** Role management (design §6.4, §8.4): admin only, like everything outside `/api/me` and the profile. */
+export function registerRoleRoutes(app, ctx) {
+    const actor = (c) => ({ userId: c.get('user').id });
+    const Level = z.object({ level: z.enum(ACCESS_LEVELS).nullable() });
+    app.get('/api/roles', (c) => c.json(ctx.roles.list()));
+    app.post('/api/roles', async (c) => c.json(ctx.roles.create(await readJson(c, z.unknown()), actor(c)), 201));
+    app.patch('/api/roles/:id', async (c) => c.json(ctx.roles.update(c.req.param('id'), await readJson(c, z.unknown()), actor(c))));
+    app.delete('/api/roles/:id', (c) => {
+        ctx.roles.remove(c.req.param('id'), actor(c));
+        return c.body(null, 204);
+    });
+    app.put('/api/roles/:id/instances', async (c) => {
+        const { instanceIds } = await readJson(c, z.object({ instanceIds: z.array(z.string()).max(1000) }));
+        return c.json({ instanceIds: ctx.roles.setInstances(c.req.param('id'), instanceIds, actor(c)) });
+    });
+    app.get('/api/roles/:id/endpoints/:instanceId/access', (c) => {
+        const role = ctx.roles.get(c.req.param('id'));
+        ctx.instances.get(c.req.param('instanceId'));
+        return c.json(levelView(ctx.db, c.req.param('instanceId'), { roleId: role.id }));
+    });
+    app.put('/api/roles/:id/endpoints/:instanceId/groups/:key', async (c) => {
+        const { level } = await readJson(c, Level);
+        setRoleLevel(ctx.db, c.req.param('id'), c.req.param('instanceId'), { group: c.req.param('key') }, level, {
+            actor: actor(c),
+        });
+        return c.json(levelView(ctx.db, c.req.param('instanceId'), { roleId: c.req.param('id') }));
+    });
+    app.put('/api/roles/:id/endpoints/:instanceId/operations/:opId', async (c) => {
+        const { level } = await readJson(c, Level);
+        setRoleLevel(ctx.db, c.req.param('id'), c.req.param('instanceId'), { operationId: c.req.param('opId') }, level, {
+            actor: actor(c),
+        });
+        return c.json(levelView(ctx.db, c.req.param('instanceId'), { roleId: c.req.param('id') }));
+    });
+    app.post('/api/roles/:id/endpoints/:instanceId/bulk-level', async (c) => {
+        const { level } = await readJson(c, z.object({ level: z.enum(ACCESS_LEVELS) }));
+        setRoleBulkLevel(ctx.db, c.req.param('id'), c.req.param('instanceId'), level, { actor: actor(c) });
+        return c.json(levelView(ctx.db, c.req.param('instanceId'), { roleId: c.req.param('id') }));
+    });
+}
+//# sourceMappingURL=roles.js.map

package/dist/http/admin/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/http/admin/roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,GAAmB,EAAE,GAAe;IACrE,MAAM,KAAK,GAAG,CAAC,CAAyC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEpE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7G,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CACtF,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,6CAA6C,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,kDAAkD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3C,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE;YACvG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,uDAAuD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3C,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE;YAC9G,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/admin/system.js

@@ -2,7 +2,6 @@ import { streamSSE } from 'hono/streaming';
 import { asc, count, eq } from 'drizzle-orm';
 import { z } from 'zod';
 import { auditCsvChunks, queryAudit } from '../../audit-query.js';
-import { toPublicUser } from '../../auth/users.js';
 import { pluginInstances, plugins } from '../../db/schema.js';
 import { ConflictError, NotFoundError, ValidationError } from '../../errors.js';
 import { CORE_EVENT_NAMES } from '../../events.js';
@@ -141,15 +140,17 @@ export function registerSystemRoutes(app, ctx) {
         ctx.oauth.revokeGrant(c.req.param('id'), actor(c));
         return c.body(null, 204);
     });
-    // ── users (no roles: every user is an admin) ──
+    // ── users (design §6.1, §6.4) ──
     app.get('/api/users', (c) => c.json(ctx.users.list()));
     app.post('/api/users', async (c) => {
-        const body = await readJson(c, z.object({ username: z.string(), password: z.string().optional() }));
+        const body = await readJson(c, z.object({ username: z.string(), password: z.string().optional(), roleId: z.string().min(1) }));
         return c.json(await ctx.users.create(body, actor(c)), 201);
     });
     app.patch('/api/users/:id', async (c) => {
-        const body = await readJson(c, z.object({ disabled: z.boolean().optional(), password: z.string().optional() }));
+        const body = await readJson(c, z.object({ disabled: z.boolean().optional(), password: z.string().optional(), roleId: z.string().optional() }));
         const id = c.req.param('id');
+        if (body.roleId !== undefined)
+            ctx.users.setRole(id, body.roleId, actor(c));
         if (body.disabled !== undefined) {
             if (id === c.get('user').id && body.disabled)
                 throw new ConflictError('self_disable', 'You cannot disable yourself');
@@ -168,13 +169,13 @@ export function registerSystemRoutes(app, ctx) {
             ctx.sessions.revokeUser(id);
             ctx.oauth.revokeUserGrants(id, 'password_changed', actor(c));
         }
-        return c.json(toPublicUser(ctx.users.get(id)));
+        return c.json(ctx.users.toPublic(ctx.users.get(id)));
     });
     app.post('/api/users/:id/reset-totp', (c) => {
         ctx.users.resetTotp(c.req.param('id'), actor(c));
         // An approval browser's TOTP proof must not outlive the authenticator it was made with.
         ctx.sessions.revokeKind(c.req.param('id'), 'approval_ui');
-        return c.json(toPublicUser(ctx.users.get(c.req.param('id'))));
+        return c.json(ctx.users.toPublic(ctx.users.get(c.req.param('id'))));
     });
     // ── settings ──
     app.get('/api/settings', (c) => c.json({
@@ -197,6 +198,8 @@ export function registerSystemRoutes(app, ctx) {
         if (!isSettingsSection(section))
             throw new NotFoundError('unknown_section', 'Unknown settings section');
         const body = await readJson(c, z.record(z.string(), z.unknown()));
+        if (section === 'security' && typeof body.defaultRoleId === 'string')
+            ctx.roles.get(body.defaultRoleId);
         // Disabling local login locks everyone out unless SSO works and someone can use it (design §6.1).
         if (section === 'security' && body.disableLocalLogin === true) {
             if (!ctx.oidc.isEnabled() || !ctx.users.hasOidcLinkedUser()) {

package/dist/http/admin/system.js.map

@@ -1 +1 @@
-{"version":3,"file":"system.js","sourceRoot":"","sources":["../../../src/http/admin/system.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,GAAmB,EAAE,GAAe;IACvE,MAAM,KAAK,GAAG,CAAC,CAAyC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE5F,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAE1E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,GAAG,CAAC;YACJ,WAAW,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;YACrC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,eAAe;SAC7D,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,EAAE;iBACZ,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;iBAC9B,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI;YAC/C,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAEhB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,GAAG,CAAC,EAAE;aACH,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aAC1D,IAAI,CAAC,eAAe,CAAC;aACrB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC;aACjC,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACjC,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;aAC9B,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACxC,GAAG,EAAE,IAAI,IAAI,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC3C,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAC/E,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAE9C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAC3E,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAE1C,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CACpF,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACtG,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,cAAc;IAEd,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CACX,IAAI,cAAc,CAAa;YAC7B,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;oBAC7B,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM;gBACJ,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wCAAwC;IAExC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/G,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAE7C,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACvC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,CAAC,CACH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,KAAK,CAAC,QAAQ,CAChB;YACE,WAAW,EAAE,IAAI,CAAC,IAAI;YACtB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;SAC9E,EACD,OAAO,EACP,KAAK,CAAC,CAAC,CAAC,CACT,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,iDAAiD;IAEjD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAChH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ;gBAC1C,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;YACzE,IAAI,IAAI,CAAC,QAAQ;gBAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,2FAA2F;gBAC3F,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC5B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,wFAAwF;QACxF,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,iBAAiB;IAEjB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,IAAI,CAAC;QACL,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC;QACzC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC;QAC/B,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE;QAC5B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,uBAAuB;QACnD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI;QAC/C,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI;KACpD,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;YAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,kGAAkG;QAClG,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5D,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sEAAsE;IAEtE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3G,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,OAAgB,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACjG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxB,0FAA0F;YAC1F,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;;gBACrC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,SAAS,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,QAAQ;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAgB,CAAC,CAAC;IACjF,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../../src/http/admin/system.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,GAAmB,EAAE,GAAe;IACvE,MAAM,KAAK,GAAG,CAAC,CAAyC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE5F,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAE1E,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,GAAG,CAAC;YACJ,WAAW,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;YACrC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,eAAe;SAC7D,CAAC,CAAC,CAAC;QACJ,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,EAAE;iBACZ,MAAM,EAAE;iBACR,IAAI,CAAC,OAAO,CAAC;iBACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;iBAC9B,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI;YAC/C,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAEhB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,GAAG,CAAC,EAAE;aACH,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aAC1D,IAAI,CAAC,eAAe,CAAC;aACrB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC;aACjC,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACjC,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;aAC9B,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAC5D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aACxC,GAAG,EAAE,IAAI,IAAI,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC3C,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAC/E,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAE9C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAC3E,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAE1C,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CACpF,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACtG,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,cAAc;IAEd,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;QACpD,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CACX,IAAI,cAAc,CAAa;YAC7B,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;oBAC7B,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM;gBACJ,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wCAAwC;IAExC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/G,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAE7C,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACvC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACzC,CAAC,CACH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,KAAK,CAAC,QAAQ,CAChB;YACE,WAAW,EAAE,IAAI,CAAC,IAAI;YACtB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;SAC9E,EACD,OAAO,EACP,KAAK,CAAC,CAAC,CAAC,CACT,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,kCAAkC;IAElC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/F,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAC/G,CAAC;QACF,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ;gBAC1C,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;YACzE,IAAI,IAAI,CAAC,QAAQ;gBAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,2FAA2F;gBAC3F,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC5B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC1C,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,wFAAwF;QACxF,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,iBAAiB;IAEjB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,IAAI,CAAC;QACL,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC;QACzC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC;QAC/B,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE;QAC5B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,uBAAuB;QACnD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI;QAC/C,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI;KACpD,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;YAAE,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxG,kGAAkG;QAClG,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBAC5D,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,sEAAsE;IAEtE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3G,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,OAAgB,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACjG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxB,0FAA0F;YAC1F,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;;gBACrC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,SAAS,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,QAAQ;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAgB,CAAC,CAAC;IACjF,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/http/admin-app.js

@@ -2,10 +2,14 @@ import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { serveStatic } from '@hono/node-server/serve-static';
 import { Hono } from 'hono';
-import { csrfGuard, registerAuthRoutes, registerProfileRoutes, requireUser } from './admin/auth.js';
+import { csrfGuard, registerAuthRoutes, registerProfileRoutes, requireAdmin, requireUser } from './admin/auth.js';
 import { registerInstanceRoutes } from './admin/instances.js';
+import { registerMeRoutes } from './admin/me.js';
+import { registerRoleRoutes } from './admin/roles.js';
 import { registerSystemRoutes } from './admin/system.js';
 import { errorResponse } from './common.js';
+/** The only API paths a non-admin may use; every other route is admin-only by default. */
+const EVERY_USER = ['/api/session', '/api/setup', '/api/profile', '/api/me'];
 /** Paths the SPA fallback must never swallow, so API/auth typos surface as 404s. */
 const NON_SPA_PREFIXES = ['/api', '/auth', '/.well-known', '/healthz'];
 /** The LAN-only admin listener (design §2.1): Vue SPA + Admin API + login/OIDC. */
@@ -25,13 +29,20 @@ export function createAdminApp(ctx, { uiDir } = {}) {
     app.use('/api/*', csrfGuard(ctx));
     app.use('/auth/*', csrfGuard(ctx));
     registerAuthRoutes(app, ctx); // public: session probe, setup, login, OIDC
-    // Everything else under /api needs a signed-in user.
+    // Everything else under /api needs a signed-in user, and is admin-only unless listed (design §8.4).
     app.use('/api/*', async (c, next) => {
         if (c.req.path === '/api/session' || c.req.path === '/api/setup')
             return next();
         return requireUser(ctx)(c, next);
     });
+    app.use('/api/*', async (c, next) => {
+        if (EVERY_USER.some((p) => c.req.path === p || c.req.path.startsWith(`${p}/`)))
+            return next();
+        return requireAdmin(ctx)(c, next);
+    });
     registerProfileRoutes(app, ctx);
+    registerMeRoutes(app, ctx);
+    registerRoleRoutes(app, ctx);
     registerInstanceRoutes(app, ctx);
     registerSystemRoutes(app, ctx);
     app.all('/api/*', (c) => c.json({ error: 'not_found', message: 'No such API route' }, 404));

package/dist/http/admin-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-app.js","sourceRoot":"","sources":["../../src/http/admin-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEpG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;AAEvE,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,EAAE,KAAK,KAAsB,EAAE;IAC7E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAY,CAAC;IACjC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3B,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CACN,yBAAyB,EACzB,qHAAqH;YACnH,6DAA6D,CAChE,CAAC;QACF,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,4CAA4C;IAE1E,qDAAqD;IACrD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,EAAE,CAAC;QAChF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAE5F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,IAAI,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACpG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"admin-app.js","sourceRoot":"","sources":["../../src/http/admin-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAElH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,0FAA0F;AAC1F,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;AAE7E,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;AAEvE,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,EAAE,KAAK,KAAsB,EAAE;IAC7E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAY,CAAC;IACjC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3B,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CACN,yBAAyB,EACzB,qHAAqH;YACnH,6DAA6D,CAChE,CAAC;QACF,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,4CAA4C;IAE1E,oGAAoG;IACpG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,EAAE,CAAC;QAChF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC9F,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAE5F,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,KAAK,IAAI,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACpG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/http/common.d.ts

@@ -16,7 +16,7 @@ export declare function errorResponse(err: unknown, c: Context): (Response & imp
     details?: null | undefined;
     error: string;
     message: string;
-}, 400 | 404 | 409, "json">) | (Response & import("hono").TypedResponse<{
+}, 400 | 403 | 404 | 409, "json">) | (Response & import("hono").TypedResponse<{
     error: string;
     message: string;
     details: string[];

package/dist/http/mcp/approval-routes.js

@@ -49,6 +49,9 @@ export function registerApprovalRoutes(app, ctx) {
         return data.op.locked ? since > LOCKED_TOTP_MAX_AGE_MS : since === Infinity;
     };
     const noTotp = (c) => errorPage(c, 'Two-factor authentication required', 'Approving calls needs an authenticator app on your account. Set it up in the admin portal under Profile, then open this link again.', 403);
+    /** Only the credential's owner decides (design §5.3); a call without one, only an admin. */
+    const mayDecide = (session, data) => data.approval.ownerUserId ? data.approval.ownerUserId === session.user.id : ctx.users.isAdmin(session.user);
+    const notYours = (c) => errorPage(c, 'Not your request', 'This approval request belongs to another user. Only the person whose client made the call can decide.', 403);
     const render = (c, token, data, session, error) => approvalPage(c, {
         token,
         csrf: uiCsrf(ctx, c),
@@ -77,6 +80,8 @@ export function registerApprovalRoutes(app, ctx) {
         const session = uiSession(ctx, c, 'approval');
         if (!session)
             return renderLogin(ctx, c, `/a/${token}`, 'Sign in to review this approval request.');
+        if (!mayDecide(session, data))
+            return notYours(c);
         if (!session.user.totpEnabled)
             return noTotp(c);
         return render(c, token, data, session);
@@ -90,6 +95,8 @@ export function registerApprovalRoutes(app, ctx) {
         const session = uiSession(ctx, c, 'approval');
         if (!session)
             return renderLogin(ctx, c, `/a/${token}`, 'Your sign-in expired. Sign in again to decide.');
+        if (!mayDecide(session, data))
+            return notYours(c);
         if (!session.user.totpEnabled)
             return noTotp(c);
         if (!checkUiCsrf(c, body.csrf))

package/dist/http/mcp/approval-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-routes.js","sourceRoot":"","sources":["../../../src/http/mcp/approval-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAErD,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAE1C,yGAAyG;AACzG,SAAS,YAAY,CAAC,GAAS,EAAE,QAAgB;IAC/C,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,GAAG,SAAS;QAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;0GAC0G;AAC1G,MAAM,UAAU,sBAAsB,CAAC,GAAS,EAAE,GAAe;IAC/D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAC1B,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,2DAA2D,EAAE,GAAG,CAAC,CAAC;IAEjG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,+DAA+D;YAC/D,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE;aACf,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aACjF,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aACtE,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;aAC/E,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC,CAAC;IAGF,0EAA0E;IAC1E,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAE5F,2GAA2G;IAC3G,MAAM,SAAS,GAAG,CAAC,OAAqB,EAAE,IAAY,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAC5B,SAAS,CACP,CAAC,EACD,oCAAoC,EACpC,qIAAqI,EACrI,GAAG,CACJ,CAAC;IAEJ,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,KAAc,EAAE,EAAE,CAChG,YAAY,CACV,CAAC,EACD;QACE,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACpB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG;QACzB,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM;QACtB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;QACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;QACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC5B,KAAK;KACN,EACD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAClB,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACpG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAC1G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8BAA8B,CAAC,CAAC;QACvG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,CAAC;QACnF,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAC5G,IAAI,iBAAmC,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACxC,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YAC/E,IAAI,CAAC,iBAAiB;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC;gBAClD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,CAAC,CAAC;YAChF,2EAA2E;YAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;oBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;wBAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;wBACvC,OAAO,EAAE,KAAK;qBACf,CAAC,CAAC;gBACL,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8CAA8C,CAAC,CAAC;YACzF,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBACrC,OAAO;gBACP,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACpE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAChC,iBAAiB;aAClB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB;YAC/B,CAAC,CAAC,sCAAsC,IAAI,CAAC,QAAQ,CAAC,IAAI,6BAA6B,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG;YAC1K,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,SAAS,CACd,CAAC,EACD,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAC/B,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,0DAA0D,EACpJ,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"approval-routes.js","sourceRoot":"","sources":["../../../src/http/mcp/approval-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAErD,+EAA+E;AAC/E,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAE1C,yGAAyG;AACzG,SAAS,YAAY,CAAC,GAAS,EAAE,QAAgB;IAC/C,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,QAAQ,GAAG,SAAS;QAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;0GAC0G;AAC1G,MAAM,UAAU,sBAAsB,CAAC,GAAS,EAAE,GAAe;IAC/D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAC1B,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,2DAA2D,EAAE,GAAG,CAAC,CAAC;IAEjG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,+DAA+D;YAC/D,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE;aACf,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aACjF,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aACtE,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;aAC/E,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;aAC/C,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC,CAAC;IAGF,0EAA0E;IAC1E,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAE5F,2GAA2G;IAC3G,MAAM,SAAS,GAAG,CAAC,OAAqB,EAAE,IAAY,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAC5B,SAAS,CACP,CAAC,EACD,oCAAoC,EACpC,qIAAqI,EACrI,GAAG,CACJ,CAAC;IAEJ,4FAA4F;IAC5F,MAAM,SAAS,GAAG,CAAC,OAAqB,EAAE,IAAY,EAAE,EAAE,CACxD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9G,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAC9B,SAAS,CACP,CAAC,EACD,kBAAkB,EAClB,uGAAuG,EACvG,GAAG,CACJ,CAAC;IAEJ,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,KAAc,EAAE,EAAE,CAChG,YAAY,CACV,CAAC,EACD;QACE,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACpB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;QAC/B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;QACvC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG;QACzB,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM;QACtB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;QACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;QACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAClC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;QAC5C,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;QACnC,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC5B,KAAK;KACN,EACD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAClB,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACpG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAC1G,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8BAA8B,CAAC,CAAC;QACvG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,CAAC;QACnF,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAC5G,IAAI,iBAAmC,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACxC,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;YAC/E,IAAI,CAAC,iBAAiB;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC;gBAClD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,CAAC,CAAC;YAChF,2EAA2E;YAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;oBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;wBAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;wBACvC,OAAO,EAAE,KAAK;qBACf,CAAC,CAAC;gBACL,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8CAA8C,CAAC,CAAC;YACzF,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBACrC,OAAO;gBACP,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACpE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAChC,iBAAiB;aAClB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB;YAC/B,CAAC,CAAC,sCAAsC,IAAI,CAAC,QAAQ,CAAC,IAAI,6BAA6B,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG;YAC1K,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,SAAS,CACd,CAAC,EACD,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAC/B,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,0DAA0D,EACpJ,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/mcp/endpoint.js

@@ -3,7 +3,7 @@ import { isIP } from 'node:net';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
 import { z } from 'zod';
-import { authenticateMcp, effectiveAuthMode, principalLive, publicMcpBase } from '../../auth/mcp-auth.js';
+import { authenticateMcp, effectiveAuthMode, ownerLive, principalLive, publicMcpBase } from '../../auth/mcp-auth.js';
 import { TOKEN_PREFIX } from '../../auth/mcp-tokens.js';
 import { ACCESS_PREFIX } from '../../auth/oauth.js';
 import { executeCode, resumeExecution, searchCode } from '../../runtime/index.js';
@@ -232,10 +232,10 @@ export class McpEndpoints {
         const caller = (sessionId) => ({
             client: { kind: 'mcp_client', id: identity.label, key: identity.principal },
             mcpSessionId: sessionId,
-            principal: { ceiling: identity.access },
+            principal: { ceiling: identity.access, roleId: identity.roleId, userId: identity.userId },
             prompts: prompts(),
             parkable: true,
-            stillAuthorized: () => principalLive(this.ctx, identity.principal, instanceId),
+            stillAuthorized: () => principalLive(this.ctx, identity.principal, instanceId) && ownerLive(this.ctx, identity, instanceId),
         });
         const extras = () => ({
             publicBase,