@vantageos/cloud-identity 0.12.0 → 0.15.0

package/dist/principal-by-id.js

@@ -343,6 +343,64 @@ export async function assertTargetBelongsTo(principal, target, lookups, opts = {
     }
     return { ok: true };
 }
+/** Refusal reasons that say only "this ROW is not the principal's". */
+const ROW_NOT_OURS = new Set([
+    "target-unstamped",
+    "target-other-organisation",
+    "target-owner-mismatch",
+    "reserved-fleet-scope",
+]);
+/**
+ * Keeps the rows that belong to the principal, deciding by STORED ID only.
+ * The ID-keyed replacement for the name-keyed `scopeFilterList`.
+ *
+ * Each row is judged by `assertTargetBelongsTo` (never re-derived here), so
+ * the same organisation, operator-org, unstamped, `ownerOnly` and
+ * `fleetCrossOrg` rules apply.
+ *
+ *   - The principal is proved FIRST, before any row is read. An absent or
+ *     unresolved principal, or a failed organisation-kind lookup for it,
+ *     returns `{ ok: false, refusal }` naming the door, even for an empty
+ *     list: a refusal is never an `ok: true` with no rows.
+ *   - `fleetCrossOrg: true` from a principal that is not `kind: "fleet"` is a
+ *     misconfigured door and is refused `reserved-fleet-scope` up front, for
+ *     any list. Per row, `reserved-fleet-scope` therefore only means "this row
+ *     is in the operator scope" and the row is dropped.
+ *   - A resolved principal whose rows all belong elsewhere gets
+ *     `{ ok: true, rows: [] }`: an absence, distinguishable from a refusal.
+ *   - A row that does not belong (other organisation, operator-org row,
+ *     unstamped, owner mismatch) is dropped. A same-NAME row of another
+ *     organisation is dropped: no name field is read.
+ *   - A lookup failure on any row refuses the whole call. It is never a
+ *     silent drop and never a pass; any refusal reason not known to mean
+ *     "this row is not yours" refuses too.
+ *   - The order of the kept rows is the order of the input.
+ */
+export async function filterTargetsBelongingTo(principal, rows, lookups, opts = {}) {
+    const door = opts.door ?? "filterTargetsBelongingTo";
+    const doorOpts = { ...opts, door };
+    // A door asking for cross-organisation reach that the principal does not
+    // hold is a misconfigured door: refused, never an absence of rows.
+    if (opts.fleetCrossOrg === true && principal != null && principal.kind !== "fleet") {
+        return denied("reserved-fleet-scope", door, "Cross-organisation reach is held only by the operator organisation's service account.");
+    }
+    // Prove the principal on a target that is its own organisation's, owner
+    // check off: only a principal-level fault can refuse this.
+    const proof = await assertTargetBelongsTo(principal, { orgId: principal?.orgId }, lookups, { ...doorOpts, ownerOnly: false, fleetCrossOrg: false });
+    if (!proof.ok)
+        return proof;
+    const kept = [];
+    for (const row of rows) {
+        const verdict = await assertTargetBelongsTo(principal, row, lookups, doorOpts);
+        if (verdict.ok) {
+            kept.push(row);
+        }
+        else if (!ROW_NOT_OURS.has(verdict.refusal.reason)) {
+            return verdict;
+        }
+    }
+    return { ok: true, rows: kept };
+}
 /**
  * Admits a principal as ADMIN of the target organisation, deciding by ID only.
  * The principal must come from `resolveActingPrincipal`; the role is the
@@ -385,4 +443,172 @@ export function assertOrgAdmin(principal, targetOrgId, opts) {
     }
     return { ok: true };
 }
+/**
+ * Admits a principal only when its AGENT ID is an entry of a stored list that
+ * belongs to its own organisation. The principal must come from
+ * `resolveActingPrincipal`; synchronous, no lookup, no name read anywhere.
+ *
+ * Refusal by default. Each of these refuses with a typed `RBAC_DENIED`
+ * carrying the door (default `"assertPrincipalListed"`):
+ *
+ *   - an absent principal, or one with an empty ID or organisation
+ *     (`credential-invalid`). A principal carrying only a name has no ID.
+ *   - a principal that is not `kind: "agent"` (`principal-not-an-agent`): the
+ *     list holds agent IDs, so a person, a service account and the fleet
+ *     principal are not admitted by it. An agent acting through a service
+ *     account is `kind: "agent"` and is judged by its own ID.
+ *   - an absent list (`list-absent`).
+ *   - a list with a missing or empty `orgId` (`target-unstamped`), or one
+ *     stored under another organisation (`target-other-organisation`).
+ *   - an empty or malformed `principalIds` (`list-empty`).
+ *   - an ID that is not byte-equal to an entry (`principal-not-listed`). No
+ *     case folding, no trimming, no prefix match.
+ *
+ * There is no wildcard: a `"*"` entry is an ordinary string, never "everyone".
+ * The fleet sentinel is out of scope here.
+ */
+export function assertPrincipalListed(principal, list, opts) {
+    const door = opts?.door ?? "assertPrincipalListed";
+    if (principal === null ||
+        typeof principal !== "object" ||
+        !nonEmpty(principal.principalId) ||
+        !nonEmpty(principal.orgId)) {
+        return denied("credential-invalid", door, "No resolved principal stands behind this call.");
+    }
+    if (principal.kind !== "agent") {
+        return denied("principal-not-an-agent", door, "The list holds agent IDs; this principal is not an agent.");
+    }
+    if (list === null || list === undefined || typeof list !== "object") {
+        return denied("list-absent", door, "No list was supplied, so nobody is listed.");
+    }
+    if (!nonEmpty(list.orgId)) {
+        return denied("target-unstamped", door, "The list carries no organisation, so it admits nobody.");
+    }
+    if (list.orgId !== principal.orgId) {
+        return denied("target-other-organisation", door, "The list belongs to another organisation than the principal.");
+    }
+    const ids = list.principalIds;
+    if (!Array.isArray(ids) || ids.length === 0) {
+        return denied("list-empty", door, "The list holds no principal IDs, so nobody is listed.");
+    }
+    if (!ids.some((id) => id === principal.principalId)) {
+        return denied("principal-not-listed", door, "The principal's ID is not on the list.");
+    }
+    return { ok: true };
+}
+/**
+ * Decides whether a sender may address a recipient, across organisations
+ * included, by AGENT ID only. The sender must come from
+ * `resolveActingPrincipal`. No name is read anywhere; a name never matches.
+ *
+ * Admitted iff one of these holds:
+ *   (a) same organisation: the sender's `orgId` equals the recipient's;
+ *   (b) client to operator: the sender is in a client organisation, the
+ *       recipient is in the operator organisation, and the RECIPIENT's ID is
+ *       on the SENDER organisation's roster;
+ *   (c) operator to client: the sender is in the operator organisation, the
+ *       recipient is in a client organisation, and the SENDER's ID is on the
+ *       RECIPIENT organisation's roster.
+ *
+ * Everything else is refused with a typed `RBAC_DENIED` carrying the door
+ * (default `"assertRecipientAddressable"`): an absent sender or one without an
+ * ID (`credential-invalid`), a sender that is not `kind: "agent"`
+ * (`principal-not-an-agent`), an absent recipient or one without an agent ID
+ * or organisation (`target-unstamped`), client to client across organisations
+ * and an organisation kind that is neither operator nor client
+ * (`target-other-organisation`), a missing or throwing `orgKindOf` /
+ * `rosterOf` (`principal-lookup-failed`), an absent roster (`list-absent`), and
+ * a roster that is empty, stored under the wrong organisation or does not list
+ * the ID (the refusals of {@link assertPrincipalListed}, which is reused for
+ * that check).
+ */
+export async function assertRecipientAddressable(sender, recipient, lookups, opts) {
+    const door = opts?.door ?? "assertRecipientAddressable";
+    if (sender === null ||
+        typeof sender !== "object" ||
+        !nonEmpty(sender.principalId) ||
+        !nonEmpty(sender.orgId)) {
+        return denied("credential-invalid", door, "No resolved sender stands behind this call.");
+    }
+    if (sender.kind !== "agent") {
+        return denied("principal-not-an-agent", door, "Only an agent addresses a recipient; the sender is not an agent.");
+    }
+    if (recipient === null ||
+        typeof recipient !== "object" ||
+        !nonEmpty(recipient.agentId) ||
+        !nonEmpty(recipient.orgId)) {
+        return denied("target-unstamped", door, "The recipient carries no agent ID and organisation.");
+    }
+    if (recipient.orgId === sender.orgId)
+        return { ok: true };
+    const senderKind = await loadOrgKind(lookups, sender.orgId, door);
+    if (!senderKind.ok)
+        return senderKind;
+    const recipientKind = await loadOrgKind(lookups, recipient.orgId, door);
+    if (!recipientKind.ok)
+        return recipientKind;
+    let clientOrgId;
+    let listed;
+    if (senderKind.kind === "client" && recipientKind.kind === "operator") {
+        clientOrgId = sender.orgId;
+        listed = { principalId: recipient.agentId };
+    }
+    else if (senderKind.kind === "operator" && recipientKind.kind === "client") {
+        clientOrgId = recipient.orgId;
+        listed = { principalId: sender.principalId };
+    }
+    else {
+        return denied("target-other-organisation", door, "The recipient belongs to another organisation that this sender may not reach.");
+    }
+    const rosterOf = lookups?.rosterOf;
+    if (typeof rosterOf !== "function") {
+        return denied("principal-lookup-failed", door, "No lookup was supplied for the roster.");
+    }
+    let roster;
+    try {
+        roster = await rosterOf(clientOrgId);
+    }
+    catch {
+        return denied("principal-lookup-failed", door, "The roster could not be read, so none is resolved.");
+    }
+    return assertPrincipalListed({ ...listed, orgId: clientOrgId, kind: "agent" }, roster, { door });
+}
+// ---------------------------------------------------------------------------
+// resolveCallerStanding (0.14.0)
+// ---------------------------------------------------------------------------
+/**
+ * A verified session that carries a person but NO organisation (a signed-in
+ * user who has not joined one). `resolveActingPrincipal` cannot express this:
+ * a person credential requires `verifiedOrgId`, so a no-organisation session
+ * is refused there exactly as a garbled credential is. This kind exists so
+ * the consumer can say "verified, and no organisation" on purpose; an absent
+ * `verifiedOrgId` on a `person` credential stays a garbled credential.
+ */
+const preOrgCredentialSchema = z.strictObject({
+    kind: z.literal("person-no-org"),
+    personId: z.string().min(1),
+});
+/**
+ * Derives a caller's STANDING from a verified credential. It adds one case to
+ * the existing primitives, the signed-in session with no organisation, and
+ * reuses them for everything else: `resolveActingPrincipal` decides who the
+ * caller is (and `fleet`), `assertOrgAdmin` decides `admin` against the
+ * principal's own organisation. Any other resolved principal (a person
+ * without the admin role, an agent, a non-operator service account) is a
+ * `member`; read `principal.kind` to tell them apart.
+ */
+export async function resolveCallerStanding(credential, lookups, opts) {
+    const door = opts?.door ?? "resolveCallerStanding";
+    const preOrg = preOrgCredentialSchema.safeParse(credential);
+    if (preOrg.success)
+        return { standing: "pre-org", personId: preOrg.data.personId };
+    const resolved = await resolveActingPrincipal(credential, lookups, door);
+    if (!resolved.ok)
+        return { standing: "anonymous", refusal: resolved.refusal };
+    const { principal } = resolved;
+    if (principal.kind === "fleet")
+        return { standing: "fleet", principal };
+    const admin = assertOrgAdmin(principal, principal.orgId, { adminRoles: opts?.adminRoles, door });
+    return { standing: admin.ok ? "admin" : "member", principal };
+}
 //# sourceMappingURL=principal-by-id.js.map

package/dist/principal-by-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAyFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,eAAe;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,WAAsC,EACtC,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC5C,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAyFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,eAAe;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAUD,uEAAuE;AACvE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IAChD,kBAAkB;IAClB,2BAA2B;IAC3B,uBAAuB;IACvB,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAA6C,EAC7C,IAAkB,EAClB,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,0BAA0B,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAExD,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnF,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,SAAS,EACT,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAC3B,OAAO,EACP,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CACxD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,WAAsC,EACtC,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC5C,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6C,EAC7C,IAAwC,EACxC,IAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA0C,EAC1C,SAA0C,EAC1C,OAAyB,EACzB,IAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,4BAA4B,CAAC;IACxD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,wBAAwB,EAAE,IAAI,EAAE,kEAAkE,CAAC,CAAC;IACpH,CAAC;IACD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IACtC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAE5C,IAAI,WAAmB,CAAC;IACxB,IAAI,MAA+B,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtE,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,MAAM,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7E,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9B,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,oDAAoD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,qBAAqB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AA0BH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAA+C,EAC/C,OAAyB,EACzB,IAAiC;IAEjC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,UAAiD,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IAC/B,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC"}

package/dist/resource-server.d.ts

@@ -0,0 +1,108 @@
+import type { ClerkJwks } from "./clerk-session.js";
+import type { VerifiedClerkSession } from "./clerk-session.js";
+import { type IdentityRefusal } from "./identity-refusal.js";
+export interface ProtectedResourceMetadataConfig {
+    /** Canonical identifier of this resource (the MCP server URL). Absolute URL, no fragment. */
+    resource: string;
+    /** Issuer URL(s) of the authorization server(s). At least one. */
+    authorizationServers: readonly string[];
+    /** Bearer transports accepted. Default `["header"]`. */
+    bearerMethodsSupported?: readonly string[];
+    /** Scopes this resource understands. */
+    scopesSupported?: readonly string[];
+    /** Human-readable label of the resource, emitted as RFC 9728 `resource_name`. A display string, never an identity: the package rule bans name-like inputs. */
+    resourceLabel?: string;
+    /** URL of developer documentation for the resource. */
+    resourceDocumentation?: string;
+}
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    scopes_supported?: string[];
+    resource_name?: string;
+    resource_documentation?: string;
+}
+/**
+ * Builds the RFC 9728 document served at `/.well-known/oauth-protected-resource`.
+ * A config that cannot produce a valid document throws: a document without a
+ * resource or an authorization server leaves a client unable to discover where
+ * to authenticate.
+ */
+export declare function buildProtectedResourceMetadata(config: ProtectedResourceMetadataConfig): ProtectedResourceMetadata;
+export interface UnauthorizedChallengeConfig {
+    /** Protection realm, for example `"mcp"`. */
+    realm: string;
+    /** Absolute URL of this resource's RFC 9728 metadata document. */
+    resourceMetadataUrl: string;
+    /** RFC 6750 `error`; omit when no token was presented. */
+    error?: "invalid_request" | "invalid_token" | "insufficient_scope";
+    /** RFC 6750 `error_description`. */
+    errorDescription?: string;
+    /** RFC 6750 `scope`: scopes needed, space separated. */
+    scope?: string;
+}
+export interface UnauthorizedChallenge {
+    status: 401;
+    headers: {
+        "WWW-Authenticate": string;
+    };
+}
+/**
+ * Builds the `401` envelope: status and a `WWW-Authenticate: Bearer` value that
+ * always carries `resource_metadata`, so a client can complete discovery. Every
+ * value is quoted and escaped; a value cannot inject a parameter or a header.
+ */
+export declare function unauthorizedChallenge(config: UnauthorizedChallengeConfig): UnauthorizedChallenge;
+export interface ClerkDiscoveryUrls {
+    discoveryUrl: string;
+    jwksUrl: string;
+}
+/**
+ * Derives the OIDC discovery and JWKS URLs of a Clerk issuer. The issuer must
+ * be an absolute `https` URL; anything else throws rather than producing a
+ * URL the client fails against later.
+ */
+export declare function deriveClerkDiscoveryUrls(issuer: string): ClerkDiscoveryUrls;
+export interface McpResourceServerConfig {
+    /** Realm of the challenge. */
+    realm: string;
+    /** Absolute URL of this resource's RFC 9728 metadata document. */
+    resourceMetadataUrl: string;
+    /** Exact `iss` the token must carry. */
+    issuer: string;
+    /** This resource's identifier: the token's `aud` must contain it. Required, never optional. */
+    audience: string;
+    /** The key set, or a function returning it (the consumer owns fetching and caching). */
+    jwks: ClerkJwks | (() => Promise<ClerkJwks>);
+    /** Clock tolerance in seconds for `exp` / `nbf`. Default 5. */
+    clockToleranceSeconds?: number;
+    /** The consumer's name for the entry point, carried in every refusal. */
+    door?: string;
+}
+export type VerifyMcpAccessTokenResult = {
+    ok: true;
+    session: VerifiedClerkSession;
+} | ({
+    ok: false;
+    refusal: IdentityRefusal;
+} & UnauthorizedChallenge) | {
+    ok: false;
+    refusal: IdentityRefusal;
+    status: 503;
+};
+/**
+ * Verifies the `Authorization` header of an MCP request against this resource.
+ *
+ * - no header: `401`, `invalid_request`, reason `bearer-missing`
+ * - not a non-empty `Bearer` credential: `401`, `invalid_request`, `bearer-malformed`
+ * - signature, issuer, audience, expiry or not-before wrong: `401`,
+ *   `invalid_token`, `token-invalid` (one answer, so the cause is not an oracle)
+ * - key set unreachable: `503`, no challenge, `jwks-unavailable` (an outage is
+ *   never reported as a bad credential)
+ *
+ * A missing issuer, or a missing or non-URL audience, in the config throws: the check is never skipped.
+ * `nowMs` is injectable for tests. The token never appears in a result.
+ */
+export declare function verifyMcpAccessToken(authorization: string | undefined, config: McpResourceServerConfig, nowMs?: number): Promise<VerifyMcpAccessTokenResult>;
+//# sourceMappingURL=resource-server.d.ts.map

package/dist/resource-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-server.d.ts","sourceRoot":"","sources":["../src/resource-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAgDtE,MAAM,WAAW,+BAA+B;IAC9C,6FAA6F;IAC7F,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,wDAAwD;IACxD,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,wCAAwC;IACxC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,8JAA8J;IAC9J,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,+BAA+B,GACtC,yBAAyB,CAuB3B;AAMD,MAAM,WAAW,2BAA2B;IAC1C,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,iBAAiB,GAAG,eAAe,GAAG,oBAAoB,CAAC;IACnE,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,GAAG,CAAC;IACZ,OAAO,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AASD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,qBAAqB,CAchG;AAMD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAW3E;AAMD,MAAM,WAAW,uBAAuB;IACtC,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,IAAI,EAAE,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAC3C,CAAC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAAG,qBAAqB,CAAC,GACjE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,MAAM,EAAE,uBAAuB,EAC/B,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAuDrC"}

package/dist/resource-server.js

@@ -0,0 +1,171 @@
+import { verifyClerkSessionToken } from "./clerk-session.js";
+import { refusal } from "./identity-refusal.js";
+/**
+ * Resource-server primitives for an MCP server that is an OAuth 2.1 protected
+ * resource: the discovery document (RFC 9728), the `401` challenge (RFC 6750,
+ * RFC 9728 section 5.1), the issuer discovery URLs, and the verification of an
+ * inbound access token bound to this resource (RFC 8707 audience, RFC 9207
+ * issuer).
+ *
+ * Token verification is NOT a second verifier: it delegates signature, `iss`,
+ * `aud`, `exp` and `nbf` to `verifyClerkSessionToken` (RS256 only) and adds the
+ * `Authorization` header handling, the mandatory audience, and the HTTP
+ * envelope. Nothing here fetches a key set or calls the network.
+ */
+const DEFAULT_DOOR = "mcp-resource-server";
+function requireNonEmpty(fn, name, value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`cloud-identity: ${fn} requires a non-empty ${name}`);
+    }
+}
+function requireAbsoluteUrl(fn, name, value) {
+    requireNonEmpty(fn, name, value);
+    try {
+        return new URL(value);
+    }
+    catch {
+        throw new Error(`cloud-identity: ${fn}: ${name} must be an absolute URL`);
+    }
+}
+/**
+ * A resource identifier (RFC 8707 section 2, RFC 9728): an absolute URL with no
+ * fragment. The one validator for the metadata `resource` and the token audience.
+ */
+function requireResourceIdentifier(fn, name, value) {
+    const url = requireAbsoluteUrl(fn, name, value);
+    if (url.hash !== "" || value.includes("#")) {
+        throw new Error(`cloud-identity: ${fn}: ${name} must not carry a fragment`);
+    }
+    return url;
+}
+/**
+ * Builds the RFC 9728 document served at `/.well-known/oauth-protected-resource`.
+ * A config that cannot produce a valid document throws: a document without a
+ * resource or an authorization server leaves a client unable to discover where
+ * to authenticate.
+ */
+export function buildProtectedResourceMetadata(config) {
+    const fn = "buildProtectedResourceMetadata";
+    requireResourceIdentifier(fn, "resource", config.resource);
+    if (!Array.isArray(config.authorizationServers) || config.authorizationServers.length === 0) {
+        throw new Error(`cloud-identity: ${fn} requires at least one authorizationServer`);
+    }
+    for (const as of config.authorizationServers) {
+        requireAbsoluteUrl(fn, "authorizationServer", as);
+    }
+    const methods = config.bearerMethodsSupported ?? ["header"];
+    if (methods.length === 0) {
+        throw new Error(`cloud-identity: ${fn}: bearerMethodsSupported must not be empty`);
+    }
+    const doc = {
+        resource: config.resource,
+        authorization_servers: [...config.authorizationServers],
+        bearer_methods_supported: [...methods],
+    };
+    if (config.scopesSupported)
+        doc.scopes_supported = [...config.scopesSupported];
+    if (config.resourceLabel)
+        doc.resource_name = config.resourceLabel;
+    if (config.resourceDocumentation)
+        doc.resource_documentation = config.resourceDocumentation;
+    return doc;
+}
+function quoted(fn, name, value) {
+    if (/[\r\n]/.test(value)) {
+        throw new Error(`cloud-identity: ${fn}: ${name} must not contain a line break`);
+    }
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+/**
+ * Builds the `401` envelope: status and a `WWW-Authenticate: Bearer` value that
+ * always carries `resource_metadata`, so a client can complete discovery. Every
+ * value is quoted and escaped; a value cannot inject a parameter or a header.
+ */
+export function unauthorizedChallenge(config) {
+    const fn = "unauthorizedChallenge";
+    requireNonEmpty(fn, "realm", config.realm);
+    requireAbsoluteUrl(fn, "resourceMetadataUrl", config.resourceMetadataUrl);
+    const parts = [
+        `Bearer realm=${quoted(fn, "realm", config.realm)}`,
+        `resource_metadata=${quoted(fn, "resourceMetadataUrl", config.resourceMetadataUrl)}`,
+    ];
+    if (config.error)
+        parts.push(`error=${quoted(fn, "error", config.error)}`);
+    if (config.errorDescription) {
+        parts.push(`error_description=${quoted(fn, "errorDescription", config.errorDescription)}`);
+    }
+    if (config.scope)
+        parts.push(`scope=${quoted(fn, "scope", config.scope)}`);
+    return { status: 401, headers: { "WWW-Authenticate": parts.join(", ") } };
+}
+/**
+ * Derives the OIDC discovery and JWKS URLs of a Clerk issuer. The issuer must
+ * be an absolute `https` URL; anything else throws rather than producing a
+ * URL the client fails against later.
+ */
+export function deriveClerkDiscoveryUrls(issuer) {
+    const fn = "deriveClerkDiscoveryUrls";
+    const url = requireAbsoluteUrl(fn, "issuer", issuer);
+    if (url.protocol !== "https:") {
+        throw new Error(`cloud-identity: ${fn}: issuer must use https`);
+    }
+    const base = issuer.endsWith("/") ? issuer.slice(0, -1) : issuer;
+    return {
+        discoveryUrl: `${base}/.well-known/openid-configuration`,
+        jwksUrl: `${base}/.well-known/jwks.json`,
+    };
+}
+/**
+ * Verifies the `Authorization` header of an MCP request against this resource.
+ *
+ * - no header: `401`, `invalid_request`, reason `bearer-missing`
+ * - not a non-empty `Bearer` credential: `401`, `invalid_request`, `bearer-malformed`
+ * - signature, issuer, audience, expiry or not-before wrong: `401`,
+ *   `invalid_token`, `token-invalid` (one answer, so the cause is not an oracle)
+ * - key set unreachable: `503`, no challenge, `jwks-unavailable` (an outage is
+ *   never reported as a bad credential)
+ *
+ * A missing issuer, or a missing or non-URL audience, in the config throws: the check is never skipped.
+ * `nowMs` is injectable for tests. The token never appears in a result.
+ */
+export async function verifyMcpAccessToken(authorization, config, nowMs = Date.now()) {
+    const fn = "verifyMcpAccessToken";
+    requireNonEmpty(fn, "issuer", config.issuer);
+    requireResourceIdentifier(fn, "audience", config.audience);
+    requireNonEmpty(fn, "realm", config.realm);
+    requireAbsoluteUrl(fn, "resourceMetadataUrl", config.resourceMetadataUrl);
+    const door = config.door ?? DEFAULT_DOOR;
+    const deny = (reason, error, detail) => ({
+        ok: false,
+        refusal: refusal("CREDENTIAL_REFUSED", reason, door, detail),
+        ...unauthorizedChallenge({
+            realm: config.realm,
+            resourceMetadataUrl: config.resourceMetadataUrl,
+            error,
+        }),
+    });
+    if (authorization === undefined || authorization === null || authorization === "") {
+        return deny("bearer-missing", "invalid_request", "No Authorization header was presented.");
+    }
+    const match = /^bearer[ \t]+(\S+)[ \t]*$/i.exec(authorization);
+    if (!match || !match[1]) {
+        return deny("bearer-malformed", "invalid_request", "The Authorization header is not a Bearer credential.");
+    }
+    const verified = await verifyClerkSessionToken(match[1], {
+        issuer: config.issuer,
+        jwks: config.jwks,
+        audience: config.audience,
+        clockToleranceSeconds: config.clockToleranceSeconds,
+    }, nowMs);
+    if (verified.ok)
+        return { ok: true, session: verified.session };
+    if (verified.refusal.reason === "jwks-unavailable") {
+        return {
+            ok: false,
+            status: 503,
+            refusal: refusal("CREDENTIAL_REFUSED", "jwks-unavailable", door, "The signing keys could not be retrieved; retry later."),
+        };
+    }
+    return deny("token-invalid", "invalid_token", "The access token was refused.");
+}
+//# sourceMappingURL=resource-server.js.map

package/dist/resource-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-server.js","sourceRoot":"","sources":["../src/resource-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAE,OAAO,EAAwB,MAAM,uBAAuB,CAAC;AAEtE;;;;;;;;;;;GAWG;AAEH,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C,SAAS,eAAe,CAAC,EAAU,EAAE,IAAY,EAAE,KAAc;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU,EAAE,IAAY,EAAE,KAAc;IAClE,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,KAAK,IAAI,0BAA0B,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,EAAU,EAAE,IAAY,EAAE,KAAc;IACzE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAK,KAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,KAAK,IAAI,4BAA4B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA8BD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAuC;IAEvC,MAAM,EAAE,GAAG,gCAAgC,CAAC;IAC5C,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC7C,kBAAkB,CAAC,EAAE,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,GAAG,GAA8B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,qBAAqB,EAAE,CAAC,GAAG,MAAM,CAAC,oBAAoB,CAAC;QACvD,wBAAwB,EAAE,CAAC,GAAG,OAAO,CAAC;KACvC,CAAC;IACF,IAAI,MAAM,CAAC,eAAe;QAAE,GAAG,CAAC,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,aAAa;QAAE,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IACnE,IAAI,MAAM,CAAC,qBAAqB;QAAE,GAAG,CAAC,sBAAsB,GAAG,MAAM,CAAC,qBAAqB,CAAC;IAC5F,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD,SAAS,MAAM,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;IACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,KAAK,IAAI,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAmC;IACvE,MAAM,EAAE,GAAG,uBAAuB,CAAC;IACnC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,gBAAgB,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QACnD,qBAAqB,MAAM,CAAC,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE;KACrF,CAAC;IACF,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAC5E,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,EAAE,GAAG,0BAA0B,CAAC;IACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,OAAO;QACL,YAAY,EAAE,GAAG,IAAI,mCAAmC;QACxD,OAAO,EAAE,GAAG,IAAI,wBAAwB;KACzC,CAAC;AACJ,CAAC;AA4BD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAiC,EACjC,MAA+B,EAC/B,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,EAAE,GAAG,sBAAsB,CAAC;IAClC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;IAEzC,MAAM,IAAI,GAAG,CACX,MAA+D,EAC/D,KAA0C,EAC1C,MAAc,EACc,EAAE,CAAC,CAAC;QAChC,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;QAC5D,GAAG,qBAAqB,CAAC;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,KAAK;SACN,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,CAAC,CAAC,EACR;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,EACD,KAAK,CACN,CAAC;IACF,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAEhE,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,OAAO,CACd,oBAAoB,EACpB,kBAAkB,EAClB,IAAI,EACJ,uDAAuD,CACxD;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,+BAA+B,CAAC,CAAC;AACjF,CAAC"}

package/dist/scope-filter.d.ts

@@ -123,9 +123,10 @@ export type GrantFieldDeclaration = readonly string[];
  * @deprecated Since 0.11.0. A `createdBy` name matched against
  * `fromAllowList` selects the row, which backend standard R-53 clause 1
  * forbids: a name never selects or authorises a row. Use
- * `resolveActingPrincipal` and `assertTargetBelongsTo`, which compare stored
- * IDs. Behaviour unchanged; it stays exported until consumers migrate off it,
- * and is removed in a major release.
+ * `resolveActingPrincipal` and `assertTargetBelongsTo` (one row) or
+ * `filterTargetsBelongingTo` (a list), which compare stored IDs. Behaviour
+ * unchanged; it stays exported until consumers migrate off it, and is removed
+ * in a major release.
  */
 export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T, grantFields?: GrantFieldDeclaration): boolean;
 /**
@@ -136,9 +137,10 @@ export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: O
  *
  * @deprecated Since 0.11.0. It selects rows through `passesScopeFilter`,
  * where a `createdBy` name selects the row, which backend standard R-53
- * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
- * which compare stored IDs. Behaviour unchanged; it stays exported until
- * consumers migrate off it, and is removed in a major release.
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`
+ * (one row) or `filterTargetsBelongingTo` (a list), which compare stored IDs.
+ * Behaviour unchanged; it stays exported until consumers migrate off it, and
+ * is removed in a major release.
  */
 export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[], grantFields?: GrantFieldDeclaration): T[];
 /**
@@ -151,9 +153,10 @@ export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAu
  *
  * @deprecated Since 0.11.0. It admits the row through `passesScopeFilter`,
  * where a `createdBy` name selects the row, which backend standard R-53
- * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
- * which compare stored IDs. Behaviour unchanged; it stays exported until
- * consumers migrate off it, and is removed in a major release.
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`
+ * (one row) or `filterTargetsBelongingTo` (a list), which compare stored IDs.
+ * Behaviour unchanged; it stays exported until consumers migrate off it, and
+ * is removed in a major release.
  */
 export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined, grantFields?: GrantFieldDeclaration): T | null;
 /**

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}