synomem 0.8.0 → 0.9.1

package/dist/credentials.js

@@ -1,16 +1,74 @@
-import { createHash } from 'node:crypto';
+/**
+ * Credential storage, indexed by connection — never by actor or workspace.
+ *
+ * One stored secret serves every profile that routes through its connection:
+ * adding a profile for another agent or workspace never copies a refresh
+ * token, and rotating a credential updates exactly one entry. Which actor and
+ * workspace an operation uses is the profile's business (see `profiles.ts`),
+ * and the server authorizes it on every request regardless of what is stored
+ * here.
+ *
+ * Two credential kinds, deliberately distinct so nothing tries to refresh a
+ * key or treat an OAuth family as a static secret:
+ *
+ *   - `oauth`: an authorization-code family for one connection, refreshed
+ *     under a cross-process lock with a generation counter;
+ *   - `access-key`: a member-owned `syn_…` key, used exactly as stored.
+ *
+ * Backends: the macOS Keychain, Linux Secret Service (`secret-tool`), an
+ * explicit restricted file, or the process environment. There is no silent
+ * fallback from one to another: a keychain that refuses a write is an error
+ * that names the explicit alternative.
+ */
 import { spawn } from 'node:child_process';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { chmodSync, closeSync, existsSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeSync, } from 'node:fs';
+import { hostname } from 'node:os';
+import { join } from 'node:path';
+import { z } from 'zod';
 import { SynomemError } from './errors.js';
+import { atomicWriteFile } from './fs-utils.js';
 const serviceName = 'ai.synomem.credentials';
 const maximumOutputBytes = 128 * 1024;
-export function credentialReference(baseUrl, workspaceId, actor) {
-    return createHash('sha256')
-        .update(JSON.stringify({
-        baseUrl: new URL(baseUrl).origin,
-        workspaceId,
-        actor: { kind: actor.kind, id: actor.id },
-    }))
-        .digest('base64url');
+export const storedOAuthCredentialSchema = z.object({
+    kind: z.literal('oauth'),
+    issuer: z.string().min(1),
+    resource: z.string().min(1),
+    clientId: z.string().min(1),
+    tokenEndpoint: z.string().min(1),
+    scope: z.string(),
+    accessToken: z.string().min(1),
+    refreshToken: z.string().min(1).optional(),
+    /** Epoch milliseconds, already reduced by a safety margin. */
+    expiresAt: z.number().int().nonnegative(),
+    /** Incremented on every successful refresh; the compare-and-swap token. */
+    generation: z.number().int().nonnegative(),
+});
+export const storedAccessKeySchema = z.object({
+    kind: z.literal('access-key'),
+    secret: z.string().min(1),
+});
+export const storedCredentialSchema = z.discriminatedUnion('kind', [
+    storedOAuthCredentialSchema,
+    storedAccessKeySchema,
+]);
+/** An opaque, non-secret handle for a stored secret. Never derived from names. */
+export function newSecretReference() {
+    return `synomem-${randomUUID()}`;
+}
+export function parseStoredCredential(value) {
+    let raw;
+    try {
+        raw = JSON.parse(value);
+    }
+    catch {
+        throw new SynomemError('AUTH_REQUIRED', 'Stored Synomem credential is malformed.');
+    }
+    const parsed = storedCredentialSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new SynomemError('AUTH_REQUIRED', 'Stored Synomem credential is in an unsupported format. Run `synomem connection login` (or `connection add-key`) again.');
+    }
+    return parsed.data;
 }
 async function command(executable, arguments_, input) {
     return await new Promise((resolve, reject) => {
@@ -38,28 +96,26 @@ async function command(executable, arguments_, input) {
         child.stdin.end(input);
     });
 }
-function parseCredential(value) {
-    try {
-        const parsed = JSON.parse(value);
-        if (typeof parsed.accessToken !== 'string' ||
-            typeof parsed.tokenEndpoint !== 'string' ||
-            typeof parsed.clientId !== 'string' ||
-            typeof parsed.resource !== 'string' ||
-            typeof parsed.scope !== 'string') {
-            throw new Error();
-        }
-        return parsed;
-    }
-    catch {
-        throw new SynomemError('AUTH_REQUIRED', 'Stored Synomem credentials are malformed.');
-    }
-}
+/** macOS Keychain or Linux Secret Service. */
 export class OsCredentialStore {
     platform;
     run;
     constructor(options = {}) {
         this.platform = options.platform ?? process.platform;
-        this.run = options.run ?? command;
+        const run = options.run ?? command;
+        // A missing helper (a headless Linux box with no Secret Service) is a
+        // configuration answer, not a crash: name the explicit alternatives. There
+        // is still no fallback — the caller chooses --store file deliberately.
+        this.run = async (executable, arguments_, input) => {
+            try {
+                return await run(executable, arguments_, input);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    this.unsupported();
+                throw error;
+            }
+        };
     }
     async get(reference) {
         const result = this.platform === 'darwin'
@@ -76,10 +132,10 @@ export class OsCredentialStore {
                 : this.unsupported();
         if (result.code !== 0)
             return undefined;
-        return parseCredential(result.stdout.trim());
+        return parseStoredCredential(result.stdout.trim());
     }
     async set(reference, credential) {
-        const serialized = JSON.stringify(credential);
+        const serialized = JSON.stringify(storedCredentialSchema.parse(credential));
         const result = this.platform === 'darwin'
             ? await this.run('/usr/bin/security', [
                 'add-generic-password',
@@ -88,22 +144,15 @@ export class OsCredentialStore {
                 '-s',
                 serviceName,
                 '-l',
-                'Synomem OAuth credential',
+                'Synomem credential',
                 '-U',
                 '-w',
             ], `${serialized}\n`)
             : this.platform === 'linux'
-                ? await this.run('secret-tool', [
-                    'store',
-                    '--label=Synomem OAuth credential',
-                    'service',
-                    serviceName,
-                    'account',
-                    reference,
-                ], serialized)
+                ? await this.run('secret-tool', ['store', '--label=Synomem credential', 'service', serviceName, 'account', reference], serialized)
                 : this.unsupported();
         if (result.code !== 0) {
-            throw new SynomemError('AUTH_REQUIRED', 'The operating-system credential store rejected the credential.');
+            throw new SynomemError('CONFIG_INVALID', 'The operating-system credential store rejected the credential. Re-run with --store file to use a restricted file instead.');
         }
     }
     async delete(reference) {
@@ -121,15 +170,192 @@ export class OsCredentialStore {
         return result.code === 0;
     }
     /*
-     * Windows Credential Manager is not implemented yet. `cmdkey` can write a
-     * generic credential but deliberately will not read the secret back, so a
-     * store built on it would accept a credential and then never return it --
-     * worse than saying so plainly.
+     * Windows Credential Manager is not implemented: `cmdkey` can write a generic
+     * credential but will not read the secret back, so a store built on it would
+     * accept a credential and never return it.
      */
     unsupported() {
         throw new SynomemError('CONFIG_INVALID', this.platform === 'win32'
-            ? 'Windows Credential Manager storage is not supported yet. Run `synomem config init` and choose the restricted-file store, or set SYNOMEM_ACCESS_TOKEN.'
-            : 'Operating-system credential storage needs the macOS Keychain, or secret-tool on Linux. Run `synomem config init` and choose the restricted-file store, or set SYNOMEM_ACCESS_TOKEN.');
+            ? 'Windows Credential Manager storage is not supported yet. Use --store file, or --store environment with SYNOMEM_ACCESS_TOKEN.'
+            : 'No operating-system credential store is available here (it needs the macOS Keychain, or secret-tool with a Secret Service on Linux). Choose one explicitly: --store file keeps it in a 0600 file under your Synomem home; --store environment reads SYNOMEM_ACCESS_TOKEN.');
+    }
+}
+/**
+ * One restricted file per secret under `<home>/credentials/`, mode 0600 in a
+ * 0700 directory. Chosen explicitly (`--store file`), never as a fallback.
+ */
+export class FileCredentialStore {
+    directory;
+    constructor(home) {
+        this.directory = join(home, 'credentials');
+    }
+    path(reference) {
+        if (!/^[A-Za-z0-9_-]{1,100}$/.test(reference)) {
+            throw new SynomemError('CONFIG_INVALID', 'Credential reference is malformed.');
+        }
+        return join(this.directory, `${reference}.json`);
+    }
+    async get(reference) {
+        const path = this.path(reference);
+        if (!existsSync(path))
+            return undefined;
+        assertPrivate(this.directory, 0o700);
+        assertPrivate(path, 0o600);
+        return parseStoredCredential(readFileSync(path, 'utf8'));
+    }
+    async set(reference, credential) {
+        if (!existsSync(this.directory))
+            mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+        chmodSync(this.directory, 0o700);
+        atomicWriteFile(this.path(reference), `${JSON.stringify(storedCredentialSchema.parse(credential))}\n`, 0o600);
+    }
+    async delete(reference) {
+        const path = this.path(reference);
+        if (!existsSync(path))
+            return false;
+        rmSync(path, { force: true });
+        return true;
+    }
+}
+/*
+ * Like ssh with a private key: a credential file (or its directory) that other
+ * users can read, or that another user owns, is refused rather than used. The
+ * fix is the owner's to make; silently tightening it would hide that the
+ * secret may already have been exposed.
+ */
+function assertPrivate(path, expected) {
+    if (process.platform === 'win32')
+        return;
+    const stat = statSync(path);
+    if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+        throw new SynomemError('CONFIG_INVALID', `${path} is owned by another user; refusing to use it.`);
+    }
+    if ((stat.mode & 0o077) !== 0) {
+        throw new SynomemError('CONFIG_INVALID', `${path} is accessible to other users (mode ${(stat.mode & 0o777).toString(8)}). ` +
+            `Run \`chmod ${expected.toString(8)} ${path}\` if you are sure it was not exposed, ` +
+            'otherwise remove it and sign in again.');
+    }
+}
+export function defaultCredentialStores(home) {
+    return { keychain: new OsCredentialStore(), file: new FileCredentialStore(home) };
+}
+/**
+ * A cross-process lock around one credential's refresh.
+ *
+ * `O_EXCL` creation is the mutual exclusion. The lock file records its owner
+ * (pid, host) and a random token. A lock is broken only when its owner is
+ * provably gone — a dead pid on this host — or, for an owner on another host
+ * or an unreadable file, once it is older than `staleMs`. A live owner is never
+ * preempted however long its refresh takes (the refresh request itself times
+ * out well inside `staleMs`).
+ *
+ * Breaking renames the file aside first and checks the token: if another
+ * process already broke and re-acquired it in between, the fresh lock is put
+ * back rather than deleted. Correctness against a concurrent writer is still
+ * the generation compare-and-swap in the refresh path; the lock exists so that
+ * only one process ever spends a given refresh token. Locks assume one host's
+ * filesystem; a home shared over a network filesystem is not supported.
+ */
+export async function withCredentialLock(home, name, operation, options = {}) {
+    if (!/^[A-Za-z0-9_.-]{1,100}$/.test(name)) {
+        throw new SynomemError('CONFIG_INVALID', 'Credential name is malformed.');
+    }
+    const directory = join(home, 'locks');
+    if (!existsSync(directory))
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const path = join(directory, `${name}.lock`);
+    const staleMs = options.staleMs ?? 60_000;
+    const deadline = Date.now() + (options.timeoutMs ?? 30_000);
+    const pollMs = options.pollMs ?? 50;
+    const token = randomBytes(16).toString('hex');
+    const host = hostname();
+    let descriptor;
+    while (descriptor === undefined) {
+        try {
+            descriptor = openSync(path, 'wx', 0o600);
+            writeSync(descriptor, `${process.pid}\n${host}\n${token}\n`);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            if (breakIfAbandoned(path, host, staleMs))
+                continue;
+            if (Date.now() > deadline) {
+                throw new SynomemError('DATABASE_BUSY', `Another Synomem process is refreshing the ${name} credential. Try again.`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollMs));
+        }
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        closeSync(descriptor);
+        // Release only our own lock.
+        if (readLock(path)?.token === token)
+            rmSync(path, { force: true });
+    }
+}
+function readLock(path) {
+    try {
+        const [pid, host, token] = readFileSync(path, 'utf8').split('\n');
+        const parsed = Number(pid);
+        if (!Number.isSafeInteger(parsed) || !host || !token)
+            return undefined;
+        return { pid: parsed, host, token };
+    }
+    catch {
+        return undefined;
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM: it exists but belongs to someone else — alive.
+        return error.code === 'EPERM';
+    }
+}
+/** Returns true when the caller should immediately retry acquiring. */
+function breakIfAbandoned(path, host, staleMs) {
+    let age;
+    try {
+        age = Date.now() - statSync(path).mtimeMs;
+    }
+    catch {
+        return true; // Released between the failed open and now.
+    }
+    const owner = readLock(path);
+    // A lock whose contents are still being written is fresh, not abandoned.
+    if (!owner && age < 1_000)
+        return false;
+    const abandoned = owner
+        ? owner.host === host
+            ? !processAlive(owner.pid)
+            : age > staleMs
+        : age > staleMs;
+    if (!abandoned)
+        return false;
+    const aside = `${path}.broken-${randomBytes(6).toString('hex')}`;
+    try {
+        renameSync(path, aside);
+    }
+    catch {
+        return true; // Someone else broke or released it first.
+    }
+    const taken = readLock(aside);
+    if (owner && taken?.token !== owner.token) {
+        // We grabbed a lock re-acquired after our inspection: restore it.
+        try {
+            linkSync(aside, path);
+        }
+        catch {
+            /* a third process holds the path now; ours is the one to discard */
+        }
     }
+    rmSync(aside, { force: true });
+    return true;
 }
 //# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAwCtC,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,WAAmB,EACnB,KAAoB;IAEpB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM;QAChC,WAAW;QACX,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;KAC1C,CAAC,CACH;SACA,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAcD,KAAK,UAAU,OAAO,CACpB,UAAkB,EAClB,UAAoB,EACpB,KAAc;IAEd,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;YACtD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,YAAY,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,OAAO,CAAC;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE,IAAI,IAAI,CAAC;SAChB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAmC,CAAC;QACnE,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,MAAM,IAAI,KAAK,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,MAA+B,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAkB;IAC1B,GAAG,CAA0B;IAE9C,YAAY,UAAyE,EAAE;QACrF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,uBAAuB;gBACvB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;aACL,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACzF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,UAAiC;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,mBAAmB,EACnB;gBACE,sBAAsB;gBACtB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;gBACJ,0BAA0B;gBAC1B,IAAI;gBACJ,IAAI;aACL,EACD,GAAG,UAAU,IAAI,CAClB;YACH,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,aAAa,EACb;oBACE,OAAO;oBACP,kCAAkC;oBAClC,SAAS;oBACT,WAAW;oBACX,SAAS;oBACT,SAAS;iBACV,EACD,UAAU,CACX;gBACH,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,gEAAgE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,yBAAyB;gBACzB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;aACZ,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACxF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACK,WAAW;QACjB,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,IAAI,CAAC,QAAQ,KAAK,OAAO;YACvB,CAAC,CAAC,uJAAuJ;YACzJ,CAAC,CAAC,qLAAqL,CAC1L,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEtC,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,2EAA2E;IAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,2BAA2B;IAC3B,qBAAqB;CACtB,CAAC,CAAC;AAeH,kFAAkF;AAClF,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,UAAU,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,wHAAwH,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAcD,KAAK,UAAU,OAAO,CACpB,UAAkB,EAClB,UAAoB,EACpB,KAAc;IAEd,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;YACtD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,YAAY,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3B,OAAO,CAAC;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE,IAAI,IAAI,CAAC;SAChB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8CAA8C;AAC9C,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAkB;IAC1B,GAAG,CAA0B;IAE9C,YAAY,UAAyE,EAAE;QACrF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;QACnC,sEAAsE;QACtE,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,CAAC,GAAG,GAAG,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;YACjD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3E,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,uBAAuB;gBACvB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;aACL,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACzF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,UAA4B;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,mBAAmB,EACnB;gBACE,sBAAsB;gBACtB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;gBACX,IAAI;gBACJ,oBAAoB;gBACpB,IAAI;gBACJ,IAAI;aACL,EACD,GAAG,UAAU,IAAI,CAClB;YACH,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CACZ,aAAa,EACb,CAAC,OAAO,EAAE,4BAA4B,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,EACrF,UAAU,CACX;gBACH,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,2HAA2H,CAC5H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAClC,yBAAyB;gBACzB,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,WAAW;aACZ,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBACzB,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACxF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACK,WAAW;QACjB,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,IAAI,CAAC,QAAQ,KAAK,OAAO;YACvB,CAAC,CAAC,8HAA8H;YAChI,CAAC,CAAC,2QAA2Q,CAChR,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACb,SAAS,CAAS;IAEnC,YAAY,IAAY;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEO,IAAI,CAAC,SAAiB;QAC5B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,qBAAqB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,UAA4B;QACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,eAAe,CACb,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EACpB,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAC/D,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,QAAgB;IACnD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1E,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,GAAG,IAAI,gDAAgD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,gBAAgB,EAChB,GAAG,IAAI,uCAAuC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;YAChF,eAAe,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,yCAAyC;YACpF,wCAAwC,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,IAAY,EACZ,SAA2B,EAC3B,UAAqE,EAAE;IAEvE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,UAA8B,CAAC;IACnC,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,SAAS,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,IAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;gBAAE,SAAS;YACpD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,6CAA6C,IAAI,yBAAyB,CAC3E,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAQD,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACvE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wDAAwD;QACxD,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;IACnE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,4CAA4C;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,yEAAyE;IACzE,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI;YACnB,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,GAAG,GAAG,OAAO;QACjB,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,IAAI,WAAW,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,IAAI,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1C,kEAAkE;QAClE,IAAI,CAAC;YACH,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/discover.d.ts

@@ -1,3 +1,4 @@
+import type { ContextListing, IdentityDescription } from './types.js';
 export interface DiscoveredWorkspace {
     id: string;
     displayName: string;
@@ -9,18 +10,6 @@ export interface DiscoveredOrganization {
     role: string;
     workspaces: DiscoveredWorkspace[];
 }
-export interface WorkspaceMembership {
-    id: string;
-    displayName: string;
-    roles: string[];
-    /**
-     * Reachable right now, with this same credential, by naming it as
-     * Synomem-Workspace-Id — no new token or re-authentication. A human
-     * credential's own organization is the boundary; an agent credential has
-     * only ever one such entry, its own.
-     */
-    addressableWithThisToken: boolean;
-}
 export interface DiscoveryOptions {
     baseUrl: string;
     accessToken: string;
@@ -28,19 +17,6 @@ export interface DiscoveryOptions {
     fetch?: typeof globalThis.fetch;
     signal?: AbortSignal;
 }
-/**
- * Every workspace a member-owned access key can reach, asked before any one
- * of them has been chosen.
- *
- * Answered by the data plane rather than the control plane: an access key is
- * not an account principal the control plane recognizes, but the data plane
- * already knows which organization owns it and can list that organization's
- * workspaces without requiring one to be named first.
- */
-export declare function discoverAccessKeyWorkspaces(options: DiscoveryOptions): Promise<{
-    organizationId: string;
-    workspaces: DiscoveredWorkspace[];
-}>;
 /**
  * Every organization this account belongs to, each with its workspaces.
  *
@@ -50,17 +26,14 @@ export declare function discoverAccessKeyWorkspaces(options: DiscoveryOptions):
  */
 export declare function discoverOrganizations(options: DiscoveryOptions): Promise<DiscoveredOrganization[]>;
 /**
- * Every workspace this credential's account belongs to, and which are
- * reachable right now without a new token — the data-plane counterpart to
- * `discoverOrganizations`, and the one that actually works with an ordinary
- * bearer token (OAuth or access key alike). `/v1/me` requires a first-party
- * control-plane credential a CLI never holds; `/v1/identity` requires only
- * the normal `synomem:read` scope every credential already has.
+ * Every context this credential's grant may use right now, with canonical ids
+ * (`GET /v1/contexts`). Follows `nextCursor` until the listing is complete, bounded.
  */
-export declare function discoverIdentity(options: DiscoveryOptions): Promise<{
-    workspaceId: string;
-    workspaces: WorkspaceMembership[];
-}>;
+export declare function discoverContexts(options: DiscoveryOptions): Promise<ContextListing>;
+/** Who this credential is: account, connection, grant, and effective context if selected. */
+export declare function describeIdentity(options: DiscoveryOptions & {
+    contextId?: string;
+}): Promise<IdentityDescription>;
 /** Flattens discovery into the choices a person picks from. */
 export declare function workspaceChoices(organizations: DiscoveredOrganization[]): Array<{
     value: string;

package/dist/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA2CD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC,CAKxE;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAsBnC;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC,CAKrE;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,sBAAsB,EAAE,GACtC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAe1D"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA6DD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAsBnC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAazF;AAED,6FAA6F;AAC7F,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,gBAAgB,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,mBAAmB,CAAC,CAM9B;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,sBAAsB,EAAE,GACtC,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAe1D"}

package/dist/discover.js

@@ -1,31 +1,28 @@
 /*
- * Finding out which workspaces a credential can reach, so nobody has to type
- * one from memory.
+ * Finding out what a credential can reach, so nobody has to type an id from memory.
  *
- * A hosted workspace ID looks like `ws-04psqx2rkt8ttft7a1t2z69r97`. Asking a
- * person to enter that during setup is asking them to leave and go find it, and
- * the credential they just authorized already knows the answer -- or knows
- * enough to offer a short list.
+ * Two questions, two routes, because they carry different authority:
  *
- * Two credentials, two routes, because they carry different authority:
+ *   `discoverContexts` / `describeIdentity` ask the DATA plane, with any credential
+ *   (OAuth access token or `syn_` access key), which workspace/actor targets that
+ *   credential's grant may use right now (identity contract §4). No context has to be
+ *   chosen first — that is the point.
  *
- *   A member-owned access key authenticates the ACCOUNT that created it, and
- *   reaches every workspace in that account's organization -- never just one
- *   -- so `discoverAccessKeyWorkspaces` lists them off the data plane, with no
- *   workspace chosen yet, which is exactly what setup cannot supply up front.
- *
- *   A browser sign-in also authorizes an ACCOUNT, which may reach several
- *   organizations, each with several workspaces. `discoverOrganizations` lists
- *   them for selection.
+ *   `discoverOrganizations` asks the control plane which organizations an account
+ *   belongs to, for first-party setup flows that hold an account session.
  */
 import { SynomemError } from './errors.js';
-async function readJson(options, path) {
+async function readJson(options, path, extraHeaders) {
     const request = options.fetch ?? globalThis.fetch;
     const url = new URL(path, options.baseUrl.endsWith('/') ? options.baseUrl : `${options.baseUrl}/`);
     let response;
     try {
         response = await request(url, {
-            headers: { authorization: `Bearer ${options.accessToken}`, accept: 'application/json' },
+            headers: {
+                authorization: `Bearer ${options.accessToken}`,
+                accept: 'application/json',
+                ...extraHeaders,
+            },
             ...(options.signal ? { signal: options.signal } : {}),
         });
     }
@@ -42,24 +39,22 @@ async function readJson(options, path) {
     if (!response.ok || body.ok !== true || body.data === undefined) {
         // 401 and 403 are the ones a person can act on, so they keep their own
         // codes rather than being flattened into a generic protocol error.
-        const code = response.status === 401 ? 'AUTH_REQUIRED' : response.status === 403 ? 'AUTH_FORBIDDEN' : null;
+        const reported = body.error?.code;
+        const code = reported === 'CONTEXT_REQUIRED' ||
+            reported === 'CONTEXT_FORBIDDEN' ||
+            reported === 'CONTEXT_AMBIGUOUS' ||
+            reported === 'REAUTHORIZATION_REQUIRED'
+            ? reported
+            : response.status === 401
+                ? 'AUTH_REQUIRED'
+                : response.status === 403
+                    ? 'AUTH_FORBIDDEN'
+                    : null;
         const message = body.error?.message ?? `${url.pathname} returned ${response.status}.`;
         throw new SynomemError(code ?? 'REMOTE_PROTOCOL', message);
     }
     return body.data;
 }
-/**
- * Every workspace a member-owned access key can reach, asked before any one
- * of them has been chosen.
- *
- * Answered by the data plane rather than the control plane: an access key is
- * not an account principal the control plane recognizes, but the data plane
- * already knows which organization owns it and can list that organization's
- * workspaces without requiring one to be named first.
- */
-export async function discoverAccessKeyWorkspaces(options) {
-    return await readJson(options, 'v1/access-keys/workspaces');
-}
 /**
  * Every organization this account belongs to, each with its workspaces.
  *
@@ -86,15 +81,24 @@ export async function discoverOrganizations(options) {
     return organizations;
 }
 /**
- * Every workspace this credential's account belongs to, and which are
- * reachable right now without a new token — the data-plane counterpart to
- * `discoverOrganizations`, and the one that actually works with an ordinary
- * bearer token (OAuth or access key alike). `/v1/me` requires a first-party
- * control-plane credential a CLI never holds; `/v1/identity` requires only
- * the normal `synomem:read` scope every credential already has.
+ * Every context this credential's grant may use right now, with canonical ids
+ * (`GET /v1/contexts`). Follows `nextCursor` until the listing is complete, bounded.
  */
-export async function discoverIdentity(options) {
-    return await readJson(options, 'v1/identity');
+export async function discoverContexts(options) {
+    let listing;
+    let cursor;
+    for (let page = 0; page < 20; page += 1) {
+        const next = await readJson(options, `v1/contexts?limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''}`);
+        listing = listing ? { ...next, contexts: [...listing.contexts, ...next.contexts] } : next;
+        cursor = next.nextCursor;
+        if (!cursor)
+            break;
+    }
+    return { ...listing, nextCursor: null };
+}
+/** Who this credential is: account, connection, grant, and effective context if selected. */
+export async function describeIdentity(options) {
+    return await readJson(options, 'v1/identity', options.contextId ? { 'synomem-context-id': options.contextId } : undefined);
 }
 /** Flattens discovery into the choices a person picks from. */
 export function workspaceChoices(organizations) {

package/dist/discover.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover.js","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0C3C,KAAK,UAAU,QAAQ,CAAI,OAAyB,EAAE,IAAY;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,EACJ,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,GAAG,CACxE,CAAC;IACF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mBAAmB,GAAG,CAAC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,GAAG,CAAC,QAAQ,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC;QACtF,MAAM,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAyB;IAEzB,OAAO,MAAM,QAAQ,CACnB,OAAO,EACP,2BAA2B,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,QAAQ,CAEtB,OAAO,EAAE,OAAO,CAAC,CAAC;IACrB,MAAM,aAAa,GAA6B,EAAE,CAAC;IACnD,KAAK,MAAM,YAAY,IAAI,EAAE,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAC/B,OAAO,EACP,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,aAAa,CACrE,CAAC;QACF,aAAa,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,UAAU,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACjD,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,WAAW,EAAE,SAAS,CAAC,WAAW;aACnC,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB;IAEzB,OAAO,MAAM,QAAQ,CACnB,OAAO,EACP,aAAa,CACd,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAC9B,aAAuC;IAEvC,MAAM,OAAO,GAA6D,EAAE,CAAC;IAC7E,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,SAAS,CAAC,EAAE;gBACnB,6DAA6D;gBAC7D,uEAAuE;gBACvE,yDAAyD;gBACzD,KAAK,EAAE,GAAG,YAAY,CAAC,WAAW,MAAM,SAAS,CAAC,WAAW,EAAE;gBAC/D,MAAM,EAAE,SAAS,CAAC,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA8B3C,KAAK,UAAU,QAAQ,CACrB,OAAyB,EACzB,IAAY,EACZ,YAAqC;IAErC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,EACJ,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,GAAG,CACxE,CAAC;IACF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;gBAC9C,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,YAAY;aAChB;YACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mBAAmB,GAAG,CAAC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAClC,MAAM,IAAI,GACR,QAAQ,KAAK,kBAAkB;YAC/B,QAAQ,KAAK,mBAAmB;YAChC,QAAQ,KAAK,mBAAmB;YAChC,QAAQ,KAAK,0BAA0B;YACrC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;oBACvB,CAAC,CAAC,gBAAgB;oBAClB,CAAC,CAAC,IAAI,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,GAAG,CAAC,QAAQ,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC;QACtF,MAAM,IAAI,YAAY,CAAC,IAAI,IAAI,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,QAAQ,CAEtB,OAAO,EAAE,OAAO,CAAC,CAAC;IACrB,MAAM,aAAa,GAA6B,EAAE,CAAC;IACnD,KAAK,MAAM,YAAY,IAAI,EAAE,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAC/B,OAAO,EACP,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,aAAa,CACrE,CAAC;QACF,aAAa,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,UAAU,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACjD,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,WAAW,EAAE,SAAS,CAAC,WAAW;aACnC,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAyB;IAC9D,IAAI,OAAmC,CAAC;IACxC,IAAI,MAAiC,CAAC;IACtC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAmB,MAAM,QAAQ,CACzC,OAAO,EACP,wBAAwB,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChF,CAAC;QACF,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,MAAM;YAAE,MAAM;IACrB,CAAC;IACD,OAAO,EAAE,GAAG,OAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAkD;IAElD,OAAO,MAAM,QAAQ,CACnB,OAAO,EACP,aAAa,EACb,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAC5E,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAC9B,aAAuC;IAEvC,MAAM,OAAO,GAA6D,EAAE,CAAC;IAC7E,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,SAAS,CAAC,EAAE;gBACnB,6DAA6D;gBAC7D,uEAAuE;gBACvE,yDAAyD;gBACzD,KAAK,EAAE,GAAG,YAAY,CAAC,WAAW,MAAM,SAAS,CAAC,WAAW,EAAE;gBAC/D,MAAM,EAAE,SAAS,CAAC,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export declare const errorCodes: readonly ["INVALID_INPUT", "INVALID_AGENT_ID", "INVALID_EVENT", "UNSUPPORTED_EVENT", "AGENT_NOT_FOUND", "AGENT_EXISTS", "ALIAS_CONFLICT", "TOPIC_NOT_FOUND", "TOPIC_EXISTS", "KUDOS_NOT_FOUND", "ITEM_NOT_FOUND", "MEMO_NOT_FOUND", "NOTE_NOT_FOUND", "TODO_NOT_FOUND", "REVISION_CONFLICT", "IDEMPOTENCY_CONFLICT", "MUTATION_FORBIDDEN", "SELF_AWARD_FORBIDDEN", "ACKNOWLEDGMENT_FORBIDDEN", "REVOCATION_FORBIDDEN", "READ_ONLY", "DATABASE_BUSY", "DATABASE_CORRUPT", "UNSUPPORTED_SCHEMA", "UNSAFE_PATH", "POLICY_FORBIDDEN", "CONFIG_INVALID", "AUTH_REQUIRED", "AUTH_FORBIDDEN", "UNSUPPORTED_BACKEND", "REMOTE_UNAVAILABLE", "REMOTE_PROTOCOL", "RATE_LIMITED", "INTERNAL_ERROR"];
+export declare const errorCodes: readonly ["INVALID_INPUT", "INVALID_AGENT_ID", "INVALID_EVENT", "UNSUPPORTED_EVENT", "AGENT_NOT_FOUND", "AGENT_EXISTS", "ALIAS_CONFLICT", "TOPIC_NOT_FOUND", "TOPIC_EXISTS", "KUDOS_NOT_FOUND", "ITEM_NOT_FOUND", "MEMO_NOT_FOUND", "NOTE_NOT_FOUND", "TODO_NOT_FOUND", "REVISION_CONFLICT", "IDEMPOTENCY_CONFLICT", "MUTATION_FORBIDDEN", "SELF_AWARD_FORBIDDEN", "ACKNOWLEDGMENT_FORBIDDEN", "REVOCATION_FORBIDDEN", "READ_ONLY", "DATABASE_BUSY", "DATABASE_CORRUPT", "UNSUPPORTED_SCHEMA", "UNSAFE_PATH", "POLICY_FORBIDDEN", "CONFIG_INVALID", "AUTH_REQUIRED", "AUTH_FORBIDDEN", "CONTEXT_REQUIRED", "CONTEXT_FORBIDDEN", "CONTEXT_AMBIGUOUS", "REAUTHORIZATION_REQUIRED", "UNSUPPORTED_BACKEND", "REMOTE_UNAVAILABLE", "REMOTE_PROTOCOL", "RATE_LIMITED", "INTERNAL_ERROR"];
 export type SynomemErrorCode = (typeof errorCodes)[number];
 export declare class SynomemError extends Error {
     readonly code: SynomemErrorCode;

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,0pBAmCb,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAMvF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAa3D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,ovBAuCb,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAMvF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAa3D"}

package/dist/errors.js

@@ -29,6 +29,10 @@ export const errorCodes = [
     'CONFIG_INVALID',
     'AUTH_REQUIRED',
     'AUTH_FORBIDDEN',
+    'CONTEXT_REQUIRED',
+    'CONTEXT_FORBIDDEN',
+    'CONTEXT_AMBIGUOUS',
+    'REAUTHORIZATION_REQUIRED',
     'UNSUPPORTED_BACKEND',
     'REMOTE_UNAVAILABLE',
     'REMOTE_PROTOCOL',

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,0BAA0B;IAC1B,sBAAsB;IACtB,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,aAAa;IACb,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,cAAc;IACd,gBAAgB;CACR,CAAC;AAIX,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IACvB,OAAO,CAA2B;IAE3C,YAAY,IAAsB,EAAE,OAAe,EAAE,OAAiC;QACpF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACpF,IAAI,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,YAAY,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,YAAY,CAAC,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,sBAAsB;IACtB,0BAA0B;IAC1B,sBAAsB;IACtB,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,oBAAoB;IACpB,aAAa;IACb,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,cAAc;IACd,gBAAgB;CACR,CAAC;AAIX,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IACvB,OAAO,CAA2B;IAE3C,YAAY,IAAsB,EAAE,OAAe,EAAE,OAAiC;QACpF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACpF,IAAI,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,YAAY,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,YAAY,CAAC,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC"}