@weave-kit/engine 1.1.0 → 1.2.0

package/dist/adapters/rest/audit.js

@@ -53,14 +53,15 @@ export function registerAuditRoutes(app, deps, options = {}) {
         else if (!isAdmin) {
             filter.actorId = subject.id;
         }
-        // tenant boundary: an ordinary identity only sees its own tenant's events
-        // (admins may filter by tenantId explicitly)
-        const rawTenant = readString(query, 'tenantId', locale);
-        if (!isAdmin && subject.tenantId !== undefined) {
-            filter.tenantId = subject.tenantId;
+        // row-scope boundary: an ordinary identity only sees its own scope's events
+        // (admins may filter by scopeId / tenantId explicitly)
+        const rawScope = readString(query, 'scopeId', locale) ?? readString(query, 'tenantId', locale);
+        const subjectScope = subject.scopeId ?? subject.tenantId;
+        if (!isAdmin && subjectScope !== undefined) {
+            filter.scopeId = subjectScope;
         }
-        else if (isAdmin && rawTenant !== undefined) {
-            filter.tenantId = rawTenant;
+        else if (isAdmin && rawScope !== undefined) {
+            filter.scopeId = rawScope;
         }
         const action = readString(query, 'action', locale);
         if (action !== undefined)

package/dist/adapters/rest/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/adapters/rest/audit.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjG,iFAAiF;AACjF,SAAS,gBAAgB,CACvB,KAA8B,EAC9B,GAAW,EACX,MAAc;IAEd,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAc,EAAE,UAAuB,EAAE;IACjG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAEhC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAC;QAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;QAC9B,CAAC;QACD,0EAA0E;QAC1E,6CAA6C;QAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC;aAAM,IAAI,OAAO,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;YACtC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAEjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/adapters/rest/audit.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjG,iFAAiF;AACjF,SAAS,gBAAgB,CACvB,KAA8B,EAC9B,GAAW,EACX,MAAc;IAEd,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAc,EAAE,UAAuB,EAAE;IACjG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAEhC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAC;QAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;QAC9B,CAAC;QACD,4EAA4E;QAC5E,uDAAuD;QACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/F,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;QACzD,IAAI,CAAC,OAAO,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,IAAI,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;YACtC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAEjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/capabilities.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyInstance } from 'fastify';
+import type { Locale } from '../../core/index.js';
+import type { CapabilitiesProvider } from '../../core/provider/capabilities/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+export interface CapabilitiesRouteDeps {
+    authenticator: Authenticator;
+    locale: Locale;
+    /**
+     * host-injected capability provider (absent = baseline only). The engine
+     * surfaces it verbatim and **never judges** licensing.
+     */
+    capabilities?: CapabilitiesProvider;
+}
+/**
+ * Capabilities route (read-only, authenticated): the console's source of truth
+ * for which advanced features to show/hide.
+ *   GET {prefix}/capabilities → { features, meta? }
+ * The baseline is `{ features: {} }`; a configured provider (e.g. the closed
+ * E0 license base) contributes the entitled features.
+ */
+export declare function registerCapabilitiesRoutes(app: FastifyInstance, deps: CapabilitiesRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/adapters/rest/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAgB,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACpG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,qBAAqB,EAC3B,OAAO,GAAE,WAAgB,GACxB,IAAI,CAiBN"}

package/dist/adapters/rest/capabilities.js

@@ -0,0 +1,27 @@
+import { authenticateRequest, checkRateLimit } from './common.js';
+/**
+ * Capabilities route (read-only, authenticated): the console's source of truth
+ * for which advanced features to show/hide.
+ *   GET {prefix}/capabilities → { features, meta? }
+ * The baseline is `{ features: {} }`; a configured provider (e.g. the closed
+ * E0 license base) contributes the entitled features.
+ */
+export function registerCapabilitiesRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/capabilities`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        await authenticateRequest(authenticator, request, locale);
+        const baseline = { features: {} };
+        if (deps.capabilities === undefined)
+            return baseline;
+        const provided = await deps.capabilities.get();
+        return {
+            ...baseline,
+            ...provided,
+            features: { ...baseline.features, ...provided.features },
+        };
+    });
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/adapters/rest/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/adapters/rest/capabilities.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAalE;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,IAA2B,EAC3B,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;QAC/C,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,QAAQ;YACX,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;SACzD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/common.d.ts

@@ -1,6 +1,7 @@
-import type { Locale, IdentitySubject } from '../../core/index.js';
+import type { Locale, IdentitySubject, AccessPrincipal } from '../../core/index.js';
 import type { SlidingWindow } from '../../core/limiter/index.js';
 import { type Authenticator } from '../auth/index.js';
+import type { FastifyRequest } from 'fastify';
 /** raw API key from the Authorization header (rate-limit key, mirrors MCP) */
 export declare function rateKey(header: string | undefined): string | undefined;
 /** enforce the sliding window for a request; throws 429 when exceeded */
@@ -15,6 +16,14 @@ export declare function authenticateRequest(authenticator: Authenticator, reques
         authorization?: string;
     };
 }, locale: Locale): Promise<IdentitySubject>;
+/**
+ * Map an authenticated subject to the {@link AccessPrincipal} the data-access
+ * layer runs as. A host may inject `principalFor` to elevate a request to a
+ * **system principal** (e.g. a control plane's cross-tenant admin scope, D32);
+ * absent = plain `userPrincipal(subject)` (unchanged behavior).
+ */
+export type PrincipalResolver = (request: FastifyRequest, subject: IdentitySubject) => AccessPrincipal | Promise<AccessPrincipal>;
+export declare function resolvePrincipal(principalFor: PrincipalResolver | undefined, request: FastifyRequest, subject: IdentitySubject): AccessPrincipal | Promise<AccessPrincipal>;
 /**
  * Fail-closed admin gate: the subject must carry at least one
  * role listed in `adminRoles`. Used for admin-only source routes (server

package/dist/adapters/rest/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/common.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEpE,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAItE;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE;IAAE,OAAO,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChD,MAAM,EAAE,MAAM,GACb,IAAI,CAMN;AAED,kFAAkF;AAClF,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE;IAAE,OAAO,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAChC,MAAM,EAAE,MAAM,GACb,IAAI,CAKN;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK1G;AAED,oEAAoE;AACpE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAMtG;AAED,oEAAoE;AACpE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKvG"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/common.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAItE;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE;IAAE,OAAO,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChD,MAAM,EAAE,MAAM,GACb,IAAI,CAMN;AAED,kFAAkF;AAClF,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE;IAAE,OAAO,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,eAAe,KACrB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,eAAe,GACvB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAChC,MAAM,EAAE,MAAM,GACb,IAAI,CAKN;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK1G;AAED,oEAAoE;AACpE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAMtG;AAED,oEAAoE;AACpE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKvG"}

package/dist/adapters/rest/common.js

@@ -1,4 +1,5 @@
 import { SchemaError } from '../../core/index.js';
+import { userPrincipal } from '../../core/index.js';
 import { authenticate } from '../auth/index.js';
 /** raw API key from the Authorization header (rate-limit key, mirrors MCP) */
 export function rateKey(header) {
@@ -20,6 +21,9 @@ export function checkRateLimit(limiter, request, locale) {
 export async function authenticateRequest(authenticator, request, locale) {
     return authenticate(authenticator, request.headers.authorization, locale);
 }
+export function resolvePrincipal(principalFor, request, subject) {
+    return principalFor === undefined ? userPrincipal(subject) : principalFor(request, subject);
+}
 /**
  * Fail-closed admin gate: the subject must carry at least one
  * role listed in `adminRoles`. Used for admin-only source routes (server

package/dist/adapters/rest/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/adapters/rest/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAsB,MAAM,kBAAkB,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CAAC,MAA0B;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAC5B,OAAkC,EAClC,OAAgD,EAChD,MAAc;IAEd,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC;IAC/D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAA4B,EAC5B,OAAgD,EAChD,MAAc;IAEd,OAAO,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAe,EACf,QAAgB,EAChB,UAAgC,EAChC,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IACpF,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IAClF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IACjF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/adapters/rest/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAsB,MAAM,kBAAkB,CAAC;AAGpE,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CAAC,MAA0B;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAC5B,OAAkC,EAClC,OAAgD,EAChD,MAAc;IAEd,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC;IAC/D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAA4B,EAC5B,OAAgD,EAChD,MAAc;IAEd,OAAO,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAaD,MAAM,UAAU,gBAAgB,CAC9B,YAA2C,EAC3C,OAAuB,EACvB,OAAwB;IAExB,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAe,EACf,QAAgB,EAChB,UAAgC,EAChC,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IACpF,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IAClF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IACjF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}

package/dist/adapters/rest/identityAdmin.d.ts

@@ -10,9 +10,12 @@ export interface IdentityAdminRouteDeps {
 }
 /**
  * Greenfield identity administration (admin-gated, `adapters.rest.adminRoles`):
- *   GET   {prefix}/identity/users        → { users: [{ id, roles, departmentId, enabled, ... }] }
- *   POST  {prefix}/identity/users        → { id } (create an engine-owned user)
- *   PATCH {prefix}/identity/users/:id    → { id, enabled } (enable/disable)
+ *   GET    {prefix}/identity/users        → { users: [{ id, name, email, mobile, roles, departmentId, enabled }] }
+ *   POST   {prefix}/identity/users        → { id } (create an engine-owned user)
+ *   PATCH  {prefix}/identity/users/:id    → { id, enabled?, roles? } (enable/disable and/or set roles)
+ *   DELETE {prefix}/identity/users/:id    → 204
+ *   GET    {prefix}/identity/departments  → { departments: [...] }
+ *   POST   {prefix}/identity/departments  → { id } (create an engine-owned department)
  */
 export declare function registerIdentityAdminRoutes(app: FastifyInstance, deps: IdentityAdminRouteDeps, options?: RestOptions): void;
 //# sourceMappingURL=identityAdmin.d.ts.map

package/dist/adapters/rest/identityAdmin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identityAdmin.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/identityAdmin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;CACtB;AAYD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,sBAAsB,EAC5B,OAAO,GAAE,WAAgB,GACxB,IAAI,CAwCN"}
+{"version":3,"file":"identityAdmin.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/identityAdmin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;CACtB;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,sBAAsB,EAC5B,OAAO,GAAE,WAAgB,GACxB,IAAI,CA0EN"}

package/dist/adapters/rest/identityAdmin.js

@@ -11,11 +11,22 @@ function parseRoles(value) {
         .map((s) => s.trim())
         .filter((s) => s !== '');
 }
+/** nullable string from a body value */
+function optString(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null)
+        return null;
+    return String(value);
+}
 /**
  * Greenfield identity administration (admin-gated, `adapters.rest.adminRoles`):
- *   GET   {prefix}/identity/users        → { users: [{ id, roles, departmentId, enabled, ... }] }
- *   POST  {prefix}/identity/users        → { id } (create an engine-owned user)
- *   PATCH {prefix}/identity/users/:id    → { id, enabled } (enable/disable)
+ *   GET    {prefix}/identity/users        → { users: [{ id, name, email, mobile, roles, departmentId, enabled }] }
+ *   POST   {prefix}/identity/users        → { id } (create an engine-owned user)
+ *   PATCH  {prefix}/identity/users/:id    → { id, enabled?, roles? } (enable/disable and/or set roles)
+ *   DELETE {prefix}/identity/users/:id    → 204
+ *   GET    {prefix}/identity/departments  → { departments: [...] }
+ *   POST   {prefix}/identity/departments  → { id } (create an engine-owned department)
  */
 export function registerIdentityAdminRoutes(app, deps, options = {}) {
     const prefix = options.prefix ?? '/api';
@@ -26,6 +37,7 @@ export function registerIdentityAdminRoutes(app, deps, options = {}) {
         const subject = await authenticateRequest(authenticator, request, locale);
         requireAdmin(subject.roles, 'identity', options.adminRoles, locale);
     };
+    const notFound = (id) => new SchemaError('data.recordNotFound', { object: 'weavekit_user', id }, locale);
     app.get(`${prefix}/identity/users`, async (request) => {
         await gate(request);
         return { users: await admin.list() };
@@ -46,13 +58,45 @@ export function registerIdentityAdminRoutes(app, deps, options = {}) {
         await gate(request);
         const { id } = request.params;
         const body = (request.body ?? {});
-        if (typeof body.enabled !== 'boolean') {
-            throw new SchemaError('http.param.invalid', { param: 'enabled' }, locale);
+        const hasEnabled = body.enabled !== undefined;
+        const hasRoles = body.roles !== undefined;
+        if (!hasEnabled && !hasRoles) {
+            throw new SchemaError('http.param.invalid', { param: 'enabled|roles' }, locale);
+        }
+        if (hasEnabled) {
+            if (typeof body.enabled !== 'boolean')
+                throw new SchemaError('http.param.invalid', { param: 'enabled' }, locale);
+            if (!(await admin.setEnabled(id, body.enabled)))
+                throw notFound(id);
+        }
+        if (hasRoles) {
+            if (!(await admin.setRoles(id, parseRoles(body.roles) ?? [])))
+                throw notFound(id);
         }
-        const ok = await admin.setEnabled(id, body.enabled);
-        if (!ok)
-            throw new SchemaError('data.recordNotFound', { object: 'weavekit_user', id }, locale);
-        return { id, enabled: body.enabled };
+        return { id };
+    });
+    app.delete(`${prefix}/identity/users/:id`, async (request, reply) => {
+        await gate(request);
+        const { id } = request.params;
+        if (!(await admin.remove(id)))
+            throw notFound(id);
+        reply.code(204).send();
+    });
+    app.get(`${prefix}/identity/departments`, async (request) => {
+        await gate(request);
+        return { departments: await admin.listDepartments() };
+    });
+    app.post(`${prefix}/identity/departments`, async (request, reply) => {
+        await gate(request);
+        const body = (request.body ?? {});
+        const { id } = await admin.createDepartment({
+            name: optString(body.name) ?? null,
+            code: optString(body.code) ?? null,
+            parentId: optString(body.parentId) ?? null,
+            managerId: optString(body.managerId) ?? null,
+            enabled: body.enabled === undefined ? true : body.enabled === true,
+        });
+        return reply.code(201).send({ id });
     });
 }
 //# sourceMappingURL=identityAdmin.js.map

package/dist/adapters/rest/identityAdmin.js.map

@@ -1 +1 @@
-{"version":3,"file":"identityAdmin.js","sourceRoot":"","sources":["../../../src/adapters/rest/identityAdmin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAShF,0EAA0E;AAC1E,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAoB,EACpB,IAA4B,EAC5B,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,KAAK,EAAE,OAAuB,EAAiB,EAAE;QAC5D,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACxD,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9D,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;SACnE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/F,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"identityAdmin.js","sourceRoot":"","sources":["../../../src/adapters/rest/identityAdmin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAShF,0EAA0E;AAC1E,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,wCAAwC;AACxC,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAoB,EACpB,IAA4B,EAC5B,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,MAAM,IAAI,GAAG,KAAK,EAAE,OAAuB,EAAiB,EAAE;QAC5D,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAe,EAAE,CAAC,IAAI,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAE9H,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACxD,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9D,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;SACnE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;QAC1C,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YACjH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAClE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;YAC1C,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI;YAClC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI;YAClC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI;YAC1C,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI;YAC5C,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;SACnE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/identitySync.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyInstance } from 'fastify';
+import type { Locale } from '../../core/index.js';
+import type { IdentitySource, IdentityStore } from '../../core/provider/identity/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+export interface IdentitySyncRouteDeps {
+    authenticator: Authenticator;
+    locale: Locale;
+    store: IdentityStore;
+    /** pre-resolved identity source; absent = no `identity.source` configured (route returns 404) */
+    source?: IdentitySource;
+    /** default for `deactivateMissing` when the request omits it */
+    deactivateMissingDefault?: boolean;
+}
+/**
+ * Identity sync trigger (admin-gated): lets a governance console **manually
+ * provision** the configured identity source into the local directory
+ * (`weavekit_user`/`weavekit_department`) — the projection step for site
+ * members. Read-only against the source; `dryRun` never writes.
+ *   POST {prefix}/identity/sync  { dryRun?, deactivateMissing? } → IdentitySyncSummary
+ */
+export declare function registerIdentitySyncRoutes(app: FastifyInstance, deps: IdentitySyncRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=identitySync.d.ts.map

package/dist/adapters/rest/identitySync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identitySync.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/identitySync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,iGAAiG;IACjG,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,gEAAgE;IAChE,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,qBAAqB,EAC3B,OAAO,GAAE,WAAgB,GACxB,IAAI,CAkBN"}

package/dist/adapters/rest/identitySync.js

@@ -0,0 +1,28 @@
+import { SchemaError } from '../../core/index.js';
+import { authenticateRequest, checkRateLimit, requireAdmin } from './common.js';
+import { runIdentitySync } from '../../runtime/identity/index.js';
+/**
+ * Identity sync trigger (admin-gated): lets a governance console **manually
+ * provision** the configured identity source into the local directory
+ * (`weavekit_user`/`weavekit_department`) — the projection step for site
+ * members. Read-only against the source; `dryRun` never writes.
+ *   POST {prefix}/identity/sync  { dryRun?, deactivateMissing? } → IdentitySyncSummary
+ */
+export function registerIdentitySyncRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.post(`${prefix}/identity/sync`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'identity', options.adminRoles, locale);
+        if (deps.source === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        const body = (request.body ?? {});
+        const dryRun = body.dryRun === true;
+        const deactivateMissing = body.deactivateMissing === undefined ? deps.deactivateMissingDefault === true : body.deactivateMissing === true;
+        return runIdentitySync(deps.source, deps.store, { dryRun, deactivateMissing });
+    });
+}
+//# sourceMappingURL=identitySync.js.map

package/dist/adapters/rest/identitySync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identitySync.js","sourceRoot":"","sources":["../../../src/adapters/rest/identitySync.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAYlE;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB,EACpB,IAA2B,EAC3B,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QACpC,MAAM,iBAAiB,GACrB,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;QAClH,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/index.d.ts

@@ -1,5 +1,6 @@
 export { registerObjectRoutes } from './plugin.js';
 export type { RestDeps, RestOptions } from './plugin.js';
+export type { PrincipalResolver } from './common.js';
 export { setErrorHandlers } from './errorHandler.js';
 export { registerMetadataRoutes } from './metadata.js';
 export { registerPermissionsRoutes } from './permissions.js';
@@ -14,6 +15,10 @@ export { registerGuardrailsRoutes } from './guardrails.js';
 export { registerIdentitiesRoutes } from './identities.js';
 export { registerIdentityAdminRoutes } from './identityAdmin.js';
 export type { IdentityAdminRouteDeps } from './identityAdmin.js';
+export { registerIdentitySyncRoutes } from './identitySync.js';
+export type { IdentitySyncRouteDeps } from './identitySync.js';
+export { registerCapabilitiesRoutes } from './capabilities.js';
+export type { CapabilitiesRouteDeps } from './capabilities.js';
 export { registerProxyRoutes } from './proxy.js';
 export type { ProxyRouteDeps } from './proxy.js';
 export { registerIngressRoutes } from './ingress.js';

package/dist/adapters/rest/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/adapters/rest/index.js

@@ -12,6 +12,8 @@ export { registerSchemaRoutes } from './schemas.js';
 export { registerGuardrailsRoutes } from './guardrails.js';
 export { registerIdentitiesRoutes } from './identities.js';
 export { registerIdentityAdminRoutes } from './identityAdmin.js';
+export { registerIdentitySyncRoutes } from './identitySync.js';
+export { registerCapabilitiesRoutes } from './capabilities.js';
 export { registerProxyRoutes } from './proxy.js';
 export { registerIngressRoutes } from './ingress.js';
 //# sourceMappingURL=index.js.map

package/dist/adapters/rest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/rest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/rest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/adapters/rest/plugin.d.ts

@@ -6,6 +6,7 @@ import type { ToolApprovals } from "../../core/tools/index.js";
 import type { SlidingWindow } from "../../core/limiter/index.js";
 import type { ObjectDataAccess } from "../../runtime/data-access/index.js";
 import type { Authenticator } from "../auth/index.js";
+import { type PrincipalResolver } from "./common.js";
 /** everything the REST layer needs to serve a request */
 export interface RestDeps {
     registry: ObjectRegistry;
@@ -25,6 +26,11 @@ export interface RestOptions {
     rateLimiter?: SlidingWindow;
     /** roles allowed to query the full audit trail and use admin script-source read/write routes */
     adminRoles?: string[];
+    /**
+     * maps an authenticated request to the {@link AccessPrincipal} data-access runs
+     * as (e.g. a control plane's system/admin scope, D32). Absent = `userPrincipal`.
+     */
+    principalFor?: PrincipalResolver;
 }
 /**
  * Register the generic object CRUD routes on a fastify app:

package/dist/adapters/rest/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAWtD,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,gGAAgG;IAChG,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAsFD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,QAAQ,EACd,OAAO,GAAE,WAAgB,GACxB,IAAI,CAwIN"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAyD,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAS5G,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,gGAAgG;IAChG,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAsFD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,QAAQ,EACd,OAAO,GAAE,WAAgB,GACxB,IAAI,CAwIN"}

package/dist/adapters/rest/plugin.js

@@ -1,7 +1,7 @@
-import { SchemaError, traceIdOf, userPrincipal } from "../../core/index.js";
+import { SchemaError, traceIdOf } from "../../core/index.js";
 import { SORT_DIRS, resolvePagination, withTx, } from "../../runtime/data-access/index.js";
 import { parseFindParams } from "../../core/api/index.js";
-import { authenticateRequest, checkRateLimit } from "./common.js";
+import { authenticateRequest, checkRateLimit, resolvePrincipal } from "./common.js";
 /** trace correlation for a request (W3C `traceparent`), spreadable into a DataAccessContext */
 function requestTrace(request) {
     const header = request.headers.traceparent;
@@ -102,7 +102,7 @@ export function registerObjectRoutes(app, deps, options = {}) {
         const { name } = request.params;
         checkRateLimit(limiter, request, locale);
         const subject = await authenticateRequest(authenticator, request, locale);
-        const ctx = { pool, registry, principal: userPrincipal(subject), locale, requestId: request.id, ...requestTrace(request) };
+        const ctx = { pool, registry, principal: await resolvePrincipal(options.principalFor, request, subject), locale, requestId: request.id, ...requestTrace(request) };
         const list = parseFindParams(request.query, locale);
         const opts = toFindOptions(list, locale);
         const { rows, total } = await dataAccess.find(name, opts, ctx);
@@ -117,7 +117,7 @@ export function registerObjectRoutes(app, deps, options = {}) {
         const ctx = {
             pool,
             registry,
-            principal: userPrincipal(subject),
+            principal: await resolvePrincipal(options.principalFor, request, subject),
             locale,
             requestId: request.id,
             ...requestTrace(request),
@@ -133,7 +133,7 @@ export function registerObjectRoutes(app, deps, options = {}) {
         const { name, id } = request.params;
         checkRateLimit(limiter, request, locale);
         const subject = await authenticateRequest(authenticator, request, locale);
-        const ctx = { pool, registry, principal: userPrincipal(subject), locale, requestId: request.id, ...requestTrace(request) };
+        const ctx = { pool, registry, principal: await resolvePrincipal(options.principalFor, request, subject), locale, requestId: request.id, ...requestTrace(request) };
         const record = await dataAccess.findOne(name, id, ctx);
         if (record === null) {
             throw new SchemaError("data.recordNotFound", { object: name, id }, locale);
@@ -148,7 +148,7 @@ export function registerObjectRoutes(app, deps, options = {}) {
         const ctx = {
             pool,
             registry,
-            principal: userPrincipal(subject),
+            principal: await resolvePrincipal(options.principalFor, request, subject),
             locale,
             requestId: request.id,
             ...requestTrace(request),
@@ -162,7 +162,7 @@ export function registerObjectRoutes(app, deps, options = {}) {
         const { name, id } = request.params;
         checkRateLimit(limiter, request, locale);
         const subject = await authenticateRequest(authenticator, request, locale);
-        const ctx = { pool, registry, principal: userPrincipal(subject), locale, requestId: request.id, ...requestTrace(request) };
+        const ctx = { pool, registry, principal: await resolvePrincipal(options.principalFor, request, subject), locale, requestId: request.id, ...requestTrace(request) };
         await dataAccess.delete(name, id, ctx);
         reply.code(204).send();
     });
@@ -181,7 +181,7 @@ export function registerObjectRoutes(app, deps, options = {}) {
         const ctx = {
             pool,
             registry,
-            principal: userPrincipal(subject),
+            principal: await resolvePrincipal(options.principalFor, request, subject),
             locale,
             requestId: request.id,
             ...requestTrace(request),
@@ -199,7 +199,7 @@ export function registerObjectRoutes(app, deps, options = {}) {
         checkRateLimit(limiter, request, locale);
         const subject = await authenticateRequest(authenticator, request, locale);
         const ids = parseIds(bodyObject(request.body, locale), locale);
-        const ctx = { pool, registry, principal: userPrincipal(subject), locale, requestId: request.id, ...requestTrace(request) };
+        const ctx = { pool, registry, principal: await resolvePrincipal(options.principalFor, request, subject), locale, requestId: request.id, ...requestTrace(request) };
         await withTx(ctx, async (txCtx) => {
             for (const id of ids) {
                 await dataAccess.delete(name, id, txCtx);

package/dist/adapters/rest/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/adapters/rest/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQ5E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,MAAM,GACP,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAkB,MAAM,yBAAyB,CAAC;AAG1E,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,+FAA+F;AAC/F,SAAS,YAAY,CAAC,OAAuB;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAwBD,sFAAsF;AACtF,SAAS,gBAAgB,CACvB,QAAwB,EACxB,UAAkB,EAClB,MAAsC;IAEtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAwB,EACxB,UAAkB,EAClB,IAA+B;IAE/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAA4B,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,MAAc;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,IAA6B,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,SAAS,YAAY,CACnB,IAA6B,EAC7B,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAkC,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,IAAe,EAAE,MAAc;IACpD,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAwB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,IAAc,EACd,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACnD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9I,MAAM,IAAI,GAAG,eAAe,CAC1B,OAAO,CAAC,KAAgC,EACxC,MAAM,CACP,CAAC;QACF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;YACjC,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CACpC,IAAI,EACJ,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,GAAG,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9I,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EACpB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;YACjC,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CACpC,IAAI,EACJ,EAAE,EACF,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,GAAG,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9I,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;YACjC,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9I,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/adapters/rest/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAQ7D,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,MAAM,GACP,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAkB,MAAM,yBAAyB,CAAC;AAG1E,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAA0B,MAAM,aAAa,CAAC;AAE5G,+FAA+F;AAC/F,SAAS,YAAY,CAAC,OAAuB;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AA6BD,sFAAsF;AACtF,SAAS,gBAAgB,CACvB,QAAwB,EACxB,UAAkB,EAClB,MAAsC;IAEtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAwB,EACxB,UAAkB,EAClB,IAA+B;IAE/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAA4B,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,MAAc;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,IAA6B,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,SAAS,YAAY,CACnB,IAA6B,EAC7B,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAkC,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,IAAe,EAAE,MAAc;IACpD,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAwB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,IAAc,EACd,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACnD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACtL,MAAM,IAAI,GAAG,eAAe,CAC1B,OAAO,CAAC,KAAgC,EACxC,MAAM,CACP,CAAC;QACF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,SAAS,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;YACzE,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CACpC,IAAI,EACJ,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,GAAG,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACtL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EACpB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,SAAS,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;YACzE,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CACpC,IAAI,EACJ,EAAE,EACF,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,GAAG,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACtL,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,SAAS,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;YACzE,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACtL,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}