@astram/engine 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Astram
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/adapters/mariadb-audit-sink.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The append-only audit sink adapter — writes one row per event into the
+ * `audit_log` table (shield_audit schema), on the pipe's transaction. Append-only:
+ * this adapter exposes ONLY `record()` — no update/delete path (structural, matching
+ * core's audit invariant). The table is created by an @astram/migrate migration
+ * (P-D); the adapter assumes it exists.
+ *
+ * Actor/tenant/action/resource are stored by stable id/key; the presentation layer
+ * resolves ids to labels (no raw ids to end users). Sensitive values are never put
+ * in the event by the pipe (the audit stage carries only op + typeKey attributes).
+ */
+import type { AuditEvent, AuditPort, QueryFn } from '../ports.js';
+export interface AuditSinkConfig {
+    /** Schema holding the audit_log table (default shield_audit). */
+    readonly schema?: string;
+    /** Table name (default audit_log). */
+    readonly table?: string;
+}
+export declare class MariaDbAuditSink implements AuditPort {
+    private readonly ref;
+    constructor(config?: AuditSinkConfig);
+    record(event: AuditEvent, query: QueryFn): Promise<void>;
+}
+//# sourceMappingURL=mariadb-audit-sink.d.ts.map

package/dist/adapters/mariadb-audit-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-audit-sink.d.ts","sourceRoot":"","sources":["../../src/adapters/mariadb-audit-sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,gBAAiB,YAAW,SAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEjB,MAAM,GAAE,eAAoB;IAMlC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB/D"}

package/dist/adapters/mariadb-audit-sink.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * The append-only audit sink adapter — writes one row per event into the
+ * `audit_log` table (shield_audit schema), on the pipe's transaction. Append-only:
+ * this adapter exposes ONLY `record()` — no update/delete path (structural, matching
+ * core's audit invariant). The table is created by an @astram/migrate migration
+ * (P-D); the adapter assumes it exists.
+ *
+ * Actor/tenant/action/resource are stored by stable id/key; the presentation layer
+ * resolves ids to labels (no raw ids to end users). Sensitive values are never put
+ * in the event by the pipe (the audit stage carries only op + typeKey attributes).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbAuditSink = void 0;
+const node_crypto_1 = require("node:crypto");
+class MariaDbAuditSink {
+    ref;
+    constructor(config = {}) {
+        const schema = config.schema ?? 'shield_audit';
+        const table = config.table ?? 'audit_log';
+        this.ref = `\`${schema}\`.\`${table}\``;
+    }
+    async record(event, query) {
+        await query(`INSERT INTO ${this.ref}
+         (al_uuid, al_type, al_occurred_at_ms, al_actor_id, al_tenant_id,
+          al_action_key, al_resource_json, al_decision_json, al_attributes_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+            (0, node_crypto_1.randomUUID)(),
+            event.type,
+            event.occurredAtMs,
+            event.actorId,
+            event.tenantId,
+            event.action?.key ?? null,
+            event.resource ? JSON.stringify(event.resource) : null,
+            event.decision ? JSON.stringify(event.decision) : null,
+            event.attributes ? JSON.stringify(event.attributes) : null,
+        ]);
+    }
+}
+exports.MariaDbAuditSink = MariaDbAuditSink;

package/dist/adapters/mariadb-audit-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-audit-sink.js","sourceRoot":"","sources":["../../src/adapters/mariadb-audit-sink.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,6CAAyC;AAUzC,MAAa,gBAAgB;IACV,GAAG,CAAS;IAE7B,YAAY,SAA0B,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,QAAQ,KAAK,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiB,EAAE,KAAc;QAC5C,MAAM,KAAK,CACT,eAAe,IAAI,CAAC,GAAG;;;0CAGa,EACpC;YACE,IAAA,wBAAU,GAAE;YACZ,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI;YACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACtD,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACtD,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;SAC3D,CACF,CAAC;IACJ,CAAC;CACF;AA5BD,4CA4BC"}

package/dist/adapters/mariadb-unit-of-work.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The SEALED mariadb {@link UnitOfWork} — the engine's own runtime pool (shield_core
+ * account: DML on shield_app, NO DDL). This pool is created INSIDE the engine module
+ * and is NEVER provided to feature scope — that absence IS the physical wall. A stage
+ * gets only the bound {@link QueryFn} for the duration of one transaction.
+ *
+ * ⛔ SECURITY — never logs the password. ADR-0018: the connection limit is a budgeted
+ * value from the engine config, not an ad-hoc knob.
+ */
+import type { QueryFn, UnitOfWork } from '../ports.js';
+export interface EngineDbConfig {
+    readonly host: string;
+    readonly port: number;
+    /** Runtime DML account (shield_core) — NOT a DDL account. */
+    readonly user: string;
+    readonly password: string;
+    readonly database: string;
+    /** ADR-0018 budgeted connection cap for this pool. */
+    readonly connectionLimit: number;
+}
+export declare class MariaDbUnitOfWork implements UnitOfWork {
+    private readonly pool;
+    constructor(config: EngineDbConfig);
+    run<T>(body: (query: QueryFn) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=mariadb-unit-of-work.d.ts.map

package/dist/adapters/mariadb-unit-of-work.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-unit-of-work.d.ts","sourceRoot":"","sources":["../../src/adapters/mariadb-unit-of-work.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,iBAAkB,YAAW,UAAU;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;gBAEhB,MAAM,EAAE,cAAc;IAc5B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAqBxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/adapters/mariadb-unit-of-work.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * The SEALED mariadb {@link UnitOfWork} — the engine's own runtime pool (shield_core
+ * account: DML on shield_app, NO DDL). This pool is created INSIDE the engine module
+ * and is NEVER provided to feature scope — that absence IS the physical wall. A stage
+ * gets only the bound {@link QueryFn} for the duration of one transaction.
+ *
+ * ⛔ SECURITY — never logs the password. ADR-0018: the connection limit is a budgeted
+ * value from the engine config, not an ad-hoc knob.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbUnitOfWork = void 0;
+const mariadb_1 = __importDefault(require("mariadb"));
+class MariaDbUnitOfWork {
+    pool;
+    constructor(config) {
+        this.pool = mariadb_1.default.createPool({
+            host: config.host,
+            port: config.port,
+            user: config.user,
+            password: config.password,
+            database: config.database,
+            connectionLimit: config.connectionLimit,
+            connectTimeout: 10_000,
+            timezone: 'Z',
+            multipleStatements: false,
+        });
+    }
+    async run(body) {
+        const conn = await this.pool.getConnection();
+        try {
+            await conn.beginTransaction();
+            const query = (sql, params) => params === undefined ? conn.query(sql) : conn.query(sql, params);
+            const result = await body(query);
+            await conn.commit();
+            return result;
+        }
+        catch (err) {
+            try {
+                await conn.rollback();
+            }
+            catch {
+                // subordinate to the original error
+            }
+            throw err;
+        }
+        finally {
+            await conn.release();
+        }
+    }
+    async close() {
+        await this.pool.end();
+    }
+}
+exports.MariaDbUnitOfWork = MariaDbUnitOfWork;

package/dist/adapters/mariadb-unit-of-work.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-unit-of-work.js","sourceRoot":"","sources":["../../src/adapters/mariadb-unit-of-work.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;AAEH,sDAA6C;AAc7C,MAAa,iBAAiB;IACX,IAAI,CAAO;IAE5B,YAAY,MAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,iBAAO,CAAC,UAAU,CAAC;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM;YACtB,QAAQ,EAAE,GAAG;YACb,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAoC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAY,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACrC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC;CACF;AAzCD,8CAyCC"}

package/dist/decorators/access-bundle.decorator.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `@AccessBundle` — a metadata-only class decorator that lets a feature declare a
+ * NAMED, admin-grantable permission bundle (a friendly label over a set of atomic
+ * permission keys), and {@link reflectAccessBundle} that reads it back into a flat
+ * {@link AccessBundleSpec}.
+ *
+ * Mirrors `@ObjectType` in `./object-type.decorator.ts` EXACTLY: a private `Symbol`
+ * metadata key, `reflect-metadata` used DIRECTLY (bare `Reflect.defineMetadata` — no
+ * Nest dependency), and the SAME omit-when-absent assembly discipline (`description`
+ * is set on the result ONLY when present, never as an `undefined` key).
+ *
+ * IMPORTANT — the decorated class is a METADATA CARRIER ONLY. It is NEVER
+ * instantiated: {@link reflectAccessBundle} takes the CONSTRUCTOR (`Function`), reads
+ * one `Reflect` key off it, and never calls `new cls()`.
+ *
+ * The bundle expands to atomic permission keys at reflect time:
+ * `permissionKeys = opts.permissions.flatMap(p => p.actions.map(a =>
+ * `${opts.module}:${p.typeKey}:${a}`))`, de-duped through a `Set` so the first-seen
+ * order is preserved (a repeated `module:typeKey:action` collapses to one entry).
+ */
+import 'reflect-metadata';
+/**
+ * One permission line inside a bundle: a `typeKey` (the object/resource type) and the
+ * `actions` on it. Each `(typeKey, action)` pair expands to a `module:typeKey:action`
+ * atomic key at reflect time.
+ */
+export interface AccessBundlePermission {
+    readonly typeKey: string;
+    readonly actions: readonly string[];
+}
+/** Class-level options for `@AccessBundle`. */
+export interface AccessBundleOptions {
+    readonly key: string;
+    readonly module: string;
+    readonly label: string;
+    readonly description?: string;
+    readonly permissions: readonly AccessBundlePermission[];
+}
+/**
+ * The reflected result: the bundle's identity + its flat, de-duped, declaration-ordered
+ * atomic key set. `description` is OMITTED when absent (never an `undefined` key).
+ */
+export interface AccessBundleSpec {
+    readonly key: string;
+    readonly module: string;
+    readonly label: string;
+    readonly description?: string;
+    readonly permissionKeys: readonly string[];
+}
+/**
+ * `@AccessBundle({ key, module, label, description?, permissions })` — declare a named
+ * permission bundle on a class. Stores the options verbatim under
+ * {@link ACCESS_BUNDLE_META} on the constructor.
+ */
+export declare function AccessBundle(opts: AccessBundleOptions): ClassDecorator;
+/**
+ * Read an {@link AccessBundleSpec} back out of a class decorated with `@AccessBundle`.
+ * Takes the CONSTRUCTOR (`Function`); never instantiates it.
+ *
+ * Throws {@link RegistrationError} when the class is undecorated or the options are
+ * empty (missing `key` / `module` / `label` / `permissions`). Assembles the result
+ * field-by-field with an explicit omit guard on `description` (omit-when-absent, mirror
+ * `reflectObjectType`).
+ */
+export declare function reflectAccessBundle(cls: Function): AccessBundleSpec;
+//# sourceMappingURL=access-bundle.decorator.d.ts.map

package/dist/decorators/access-bundle.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-bundle.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/access-bundle.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,kBAAkB,CAAC;AAW1B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAID;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAItE;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,GAAG,gBAAgB,CAsCnE"}

package/dist/decorators/access-bundle.decorator.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * `@AccessBundle` — a metadata-only class decorator that lets a feature declare a
+ * NAMED, admin-grantable permission bundle (a friendly label over a set of atomic
+ * permission keys), and {@link reflectAccessBundle} that reads it back into a flat
+ * {@link AccessBundleSpec}.
+ *
+ * Mirrors `@ObjectType` in `./object-type.decorator.ts` EXACTLY: a private `Symbol`
+ * metadata key, `reflect-metadata` used DIRECTLY (bare `Reflect.defineMetadata` — no
+ * Nest dependency), and the SAME omit-when-absent assembly discipline (`description`
+ * is set on the result ONLY when present, never as an `undefined` key).
+ *
+ * IMPORTANT — the decorated class is a METADATA CARRIER ONLY. It is NEVER
+ * instantiated: {@link reflectAccessBundle} takes the CONSTRUCTOR (`Function`), reads
+ * one `Reflect` key off it, and never calls `new cls()`.
+ *
+ * The bundle expands to atomic permission keys at reflect time:
+ * `permissionKeys = opts.permissions.flatMap(p => p.actions.map(a =>
+ * `${opts.module}:${p.typeKey}:${a}`))`, de-duped through a `Set` so the first-seen
+ * order is preserved (a repeated `module:typeKey:action` collapses to one entry).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessBundle = AccessBundle;
+exports.reflectAccessBundle = reflectAccessBundle;
+require("reflect-metadata");
+const errors_js_1 = require("../errors.js");
+// --- Private metadata key (Symbol) — mirror OBJECT_TYPE_META -------------------
+/** Class-level: the {@link AccessBundleOptions} passed to `@AccessBundle`. */
+const ACCESS_BUNDLE_META = Symbol('astram:engine:accessBundle');
+// --- Decorator ---------------------------------------------------------------
+/**
+ * `@AccessBundle({ key, module, label, description?, permissions })` — declare a named
+ * permission bundle on a class. Stores the options verbatim under
+ * {@link ACCESS_BUNDLE_META} on the constructor.
+ */
+function AccessBundle(opts) {
+    return (target) => {
+        Reflect.defineMetadata(ACCESS_BUNDLE_META, opts, target);
+    };
+}
+// --- Reflector ---------------------------------------------------------------
+/**
+ * Read an {@link AccessBundleSpec} back out of a class decorated with `@AccessBundle`.
+ * Takes the CONSTRUCTOR (`Function`); never instantiates it.
+ *
+ * Throws {@link RegistrationError} when the class is undecorated or the options are
+ * empty (missing `key` / `module` / `label` / `permissions`). Assembles the result
+ * field-by-field with an explicit omit guard on `description` (omit-when-absent, mirror
+ * `reflectObjectType`).
+ */
+function reflectAccessBundle(cls) {
+    const opts = Reflect.getMetadata(ACCESS_BUNDLE_META, cls);
+    if (!opts) {
+        throw new errors_js_1.RegistrationError(`${cls.name} is not decorated with @AccessBundle`);
+    }
+    if (!opts.key || !opts.module || !opts.label) {
+        throw new errors_js_1.RegistrationError(`${cls.name} @AccessBundle is missing a required 'key', 'module', or 'label'`);
+    }
+    if (!opts.permissions || opts.permissions.length === 0) {
+        throw new errors_js_1.RegistrationError(`${cls.name} @AccessBundle declares no permissions`);
+    }
+    // Expand to flat atomic keys, de-duped preserving first-seen order (Set keeps
+    // insertion order, and re-inserting an existing key is a no-op).
+    const permissionKeys = [
+        ...new Set(opts.permissions.flatMap((p) => p.actions.map((a) => `${opts.module}:${p.typeKey}:${a}`))),
+    ];
+    const out = {
+        key: opts.key,
+        module: opts.module,
+        label: opts.label,
+    };
+    if (opts.description !== undefined)
+        out.description = opts.description;
+    out.permissionKeys = permissionKeys;
+    return out;
+}

package/dist/decorators/access-bundle.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-bundle.decorator.js","sourceRoot":"","sources":["../../src/decorators/access-bundle.decorator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AAmDH,oCAIC;AAaD,kDAsCC;AAxGD,4BAA0B;AAE1B,4CAAiD;AAEjD,kFAAkF;AAElF,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAmChE,gFAAgF;AAEhF;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAyB;IACpD,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,OAAO,CAAC,cAAc,CAAC,kBAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CAAC,GAAa;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAE3C,CAAC;IACd,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,6BAAiB,CACzB,GAAG,GAAG,CAAC,IAAI,sCAAsC,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,6BAAiB,CACzB,GAAG,GAAG,CAAC,IAAI,kEAAkE,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,6BAAiB,CACzB,GAAG,GAAG,CAAC,IAAI,wCAAwC,CACpD,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CACR,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CACzD,CACF;KACF,CAAC;IAEF,MAAM,GAAG,GAA4B;QACnC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IACF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACvE,GAAG,CAAC,cAAc,GAAG,cAAc,CAAC;IACpC,OAAO,GAAkC,CAAC;AAC5C,CAAC"}

package/dist/decorators/object-type.decorator.d.ts

@@ -0,0 +1,116 @@
+/**
+ * `@ObjectType` / `@Field` / `@PrimaryKey` — the decorator layer that lets a
+ * feature author an {@link ObjectType} contract as a decorated (metadata-only)
+ * class instead of a plain literal, and {@link reflectObjectType} that reads it
+ * back into the exact same {@link ObjectType} shape.
+ *
+ * Mirrors the `@Classified` pattern in @astram/guard (SetMetadata-style
+ * `Reflect.defineMetadata` + a private metadata-key), but uses `reflect-metadata`
+ * DIRECTLY (bare `Reflect.defineMetadata` — no Nest dependency needed). The engine's
+ * tsconfig already has `experimentalDecorators` + `emitDecoratorMetadata` ON and
+ * `reflect-metadata` present, so the polyfill is active.
+ *
+ * IMPORTANT — the decorated class is a METADATA CARRIER ONLY. It is NEVER
+ * instantiated: {@link reflectObjectType} takes the CONSTRUCTOR (`Function`), reads
+ * three `Reflect` keys off it, and never calls `new cls()`. No instance is created,
+ * no field initializers run.
+ *
+ * GOLDEN INVARIANT — the reflected output must `deepStrictEqual` the equivalent
+ * literal INCLUDING the omit-when-absent convention (the literals OMIT
+ * `junctions` / `extensible` / `required:false` / absent `trusted` / absent
+ * `column` rather than setting `undefined` / `false`). The reflector therefore
+ * assembles the result field-by-field with explicit omit guards — NOT by spreading
+ * the whole options blob (a spread would carry `junctions` / `extensible` as
+ * `undefined` keys and break `deepStrictEqual`).
+ */
+import 'reflect-metadata';
+import type { AccessDeclaration, FieldType, IdentityRole, JunctionSpec, ObjectType as ObjectTypeContract, PkStrategy, TrustedSource } from '../types.js';
+/**
+ * Class-level options for `@ObjectType`. Mirrors the top-level {@link ObjectType}
+ * shape EXCEPT `primaryKey` (declared separately via `@PrimaryKey`) and `fields`
+ * (declared per-member via `@Field`).
+ *
+ * `junctions` is a CLASS-LEVEL option — a junction is an object-owned side-table
+ * (keyed by name), not a per-field concept, so it has no home member.
+ */
+export interface ObjectTypeOptions {
+    readonly typeKey: string;
+    readonly table: string;
+    readonly schema?: string;
+    readonly extensible?: boolean;
+    readonly junctions?: readonly JunctionSpec[];
+    /**
+     * REQUIRED access declaration (tenantScoped/owned/system). Reflected AS-IS onto the
+     * {@link ObjectType} contract; the REGISTRY's `validate` (chokepoint 1) rejects an
+     * absent/contradictory declaration at boot. See {@link AccessDeclaration}.
+     */
+    readonly access: AccessDeclaration;
+}
+/** Per-member options for `@Field` (the field's `key` is read from the member name). */
+export interface FieldOptions {
+    readonly column?: string;
+    readonly type: FieldType;
+    readonly required?: boolean;
+    readonly trusted?: TrustedSource;
+    readonly role?: IdentityRole;
+}
+/**
+ * `@PrimaryKey` options — the {@link PkStrategy} discriminated union verbatim, so it
+ * is stored + assigned AS-IS (no reconstruction), keeping the `column`-vs-`columns`
+ * key set byte-identical to the literal's union member.
+ */
+export type PrimaryKeyOptions = PkStrategy;
+/**
+ * `@ObjectType({ typeKey, table, access, schema?, junctions?, extensible? })` —
+ * declare the class-level object-type metadata. Stores the options verbatim under
+ * {@link OBJECT_TYPE_META} on the constructor. `access` is REQUIRED (the registry's
+ * `validate` — chokepoint 1 — rejects an absent/contradictory declaration at boot).
+ *
+ * The generic, framework-neutral decorator name. (The `ObjectType` result data type is
+ * referenced internally as `ObjectTypeContract` so the decorator can own this name.)
+ */
+export declare function ObjectType(opts: ObjectTypeOptions): ClassDecorator;
+/**
+ * DECLARATION MERGING — makes `ObjectType` carry BOTH meanings under one name:
+ *  - the `function ObjectType(...)` above is the VALUE (the class decorator), and
+ *  - this `interface ObjectType` (extending the data-shape contract) is the TYPE.
+ * A `function` + `interface` of the same name declaration-merge in TypeScript, so
+ * `import { ObjectType }` (decorator/value) AND `import type { ObjectType }` (the
+ * data shape) both resolve to this single, merged export. This is the mechanism that
+ * lets the barrel export ONE `ObjectType` name that is simultaneously the feature-
+ * facing decorator and the metadata contract type. `reflectObjectType` keeps
+ * returning `ObjectTypeContract`, which is structurally identical to this merged type.
+ */
+export interface ObjectType extends ObjectTypeContract {
+}
+/**
+ * `@Field({ type, column?, required?, trusted?, role? })` — declare one core field.
+ * The field's `key` is the decorated member's property name. Each invocation APPENDS a
+ * {@link FieldSpec} to the {@link FIELDS_META} array on the CONSTRUCTOR
+ * (`target.constructor` — `target` is the prototype for instance members).
+ *
+ * ORDER GUARANTEE: property decorators execute in SOURCE (top-to-bottom) member
+ * order at class-definition time, and each call read-existing → push → redefine, so
+ * the array accumulates in declaration order === the literal's `fields[]` order.
+ */
+export declare function Field(opts: FieldOptions): PropertyDecorator;
+/**
+ * `@PrimaryKey({ kind:'uuid', column } | { kind:'composite', columns:[...] })` — a
+ * SINGLE class-level decorator (never per-member). Stores the options object
+ * verbatim under {@link PK_META}; {@link reflectObjectType} assigns it directly to
+ * `primaryKey` (no reconstruction), so the result is byte-identical to the literal's
+ * {@link PkStrategy} union member. Authoring `columns` as an explicit literal array
+ * removes any member-ordering ambiguity for the composite case.
+ */
+export declare function PrimaryKey(opts: PrimaryKeyOptions): ClassDecorator;
+/**
+ * Read an {@link ObjectType} back out of a class decorated with `@ObjectType` +
+ * `@PrimaryKey` + one-or-more `@Field`. Takes the CONSTRUCTOR (`Function`); never
+ * instantiates it.
+ *
+ * The result is assembled field-by-field with explicit omit guards so it
+ * `deepStrictEqual`s the equivalent literal (omit-when-absent convention). Key order
+ * mirrors the literals for readability/JSON parity (irrelevant to `deepStrictEqual`).
+ */
+export declare function reflectObjectType(cls: Function): ObjectTypeContract;
+//# sourceMappingURL=object-type.decorator.d.ts.map

package/dist/decorators/object-type.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-type.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/object-type.decorator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACV,iBAAiB,EAEjB,SAAS,EACT,YAAY,EACZ,YAAY,EAKZ,UAAU,IAAI,kBAAkB,EAChC,UAAU,EACV,aAAa,EACd,MAAM,aAAa,CAAC;AAarB;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAI3C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAW,SAAQ,kBAAkB;CAAG;AAEzD;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,YAAY,GAAG,iBAAiB,CAQ3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAIlE;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,kBAAkB,CAqCnE"}

package/dist/decorators/object-type.decorator.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * `@ObjectType` / `@Field` / `@PrimaryKey` — the decorator layer that lets a
+ * feature author an {@link ObjectType} contract as a decorated (metadata-only)
+ * class instead of a plain literal, and {@link reflectObjectType} that reads it
+ * back into the exact same {@link ObjectType} shape.
+ *
+ * Mirrors the `@Classified` pattern in @astram/guard (SetMetadata-style
+ * `Reflect.defineMetadata` + a private metadata-key), but uses `reflect-metadata`
+ * DIRECTLY (bare `Reflect.defineMetadata` — no Nest dependency needed). The engine's
+ * tsconfig already has `experimentalDecorators` + `emitDecoratorMetadata` ON and
+ * `reflect-metadata` present, so the polyfill is active.
+ *
+ * IMPORTANT — the decorated class is a METADATA CARRIER ONLY. It is NEVER
+ * instantiated: {@link reflectObjectType} takes the CONSTRUCTOR (`Function`), reads
+ * three `Reflect` keys off it, and never calls `new cls()`. No instance is created,
+ * no field initializers run.
+ *
+ * GOLDEN INVARIANT — the reflected output must `deepStrictEqual` the equivalent
+ * literal INCLUDING the omit-when-absent convention (the literals OMIT
+ * `junctions` / `extensible` / `required:false` / absent `trusted` / absent
+ * `column` rather than setting `undefined` / `false`). The reflector therefore
+ * assembles the result field-by-field with explicit omit guards — NOT by spreading
+ * the whole options blob (a spread would carry `junctions` / `extensible` as
+ * `undefined` keys and break `deepStrictEqual`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObjectType = ObjectType;
+exports.Field = Field;
+exports.PrimaryKey = PrimaryKey;
+exports.reflectObjectType = reflectObjectType;
+require("reflect-metadata");
+const errors_js_1 = require("../errors.js");
+// --- Private metadata keys (Symbols) — mirror CLASSIFICATION_METADATA ---------
+/** Class-level: the {@link ObjectTypeOptions} passed to `@ObjectType`. */
+const OBJECT_TYPE_META = Symbol('astram:engine:objectType');
+/** Class-level: the {@link PrimaryKeyOptions} passed to `@PrimaryKey`. */
+const PK_META = Symbol('astram:engine:primaryKey');
+/** Constructor-level: the accumulated array of {@link FieldSpec} from `@Field`. */
+const FIELDS_META = Symbol('astram:engine:fields');
+// --- Decorators --------------------------------------------------------------
+/**
+ * `@ObjectType({ typeKey, table, access, schema?, junctions?, extensible? })` —
+ * declare the class-level object-type metadata. Stores the options verbatim under
+ * {@link OBJECT_TYPE_META} on the constructor. `access` is REQUIRED (the registry's
+ * `validate` — chokepoint 1 — rejects an absent/contradictory declaration at boot).
+ *
+ * The generic, framework-neutral decorator name. (The `ObjectType` result data type is
+ * referenced internally as `ObjectTypeContract` so the decorator can own this name.)
+ */
+function ObjectType(opts) {
+    return (target) => {
+        Reflect.defineMetadata(OBJECT_TYPE_META, opts, target);
+    };
+}
+/**
+ * `@Field({ type, column?, required?, trusted?, role? })` — declare one core field.
+ * The field's `key` is the decorated member's property name. Each invocation APPENDS a
+ * {@link FieldSpec} to the {@link FIELDS_META} array on the CONSTRUCTOR
+ * (`target.constructor` — `target` is the prototype for instance members).
+ *
+ * ORDER GUARANTEE: property decorators execute in SOURCE (top-to-bottom) member
+ * order at class-definition time, and each call read-existing → push → redefine, so
+ * the array accumulates in declaration order === the literal's `fields[]` order.
+ */
+function Field(opts) {
+    return (target, propertyKey) => {
+        const ctor = target.constructor;
+        const existing = Reflect.getMetadata(FIELDS_META, ctor) ?? [];
+        const spec = { key: String(propertyKey), ...opts };
+        Reflect.defineMetadata(FIELDS_META, [...existing, spec], ctor);
+    };
+}
+/**
+ * `@PrimaryKey({ kind:'uuid', column } | { kind:'composite', columns:[...] })` — a
+ * SINGLE class-level decorator (never per-member). Stores the options object
+ * verbatim under {@link PK_META}; {@link reflectObjectType} assigns it directly to
+ * `primaryKey` (no reconstruction), so the result is byte-identical to the literal's
+ * {@link PkStrategy} union member. Authoring `columns` as an explicit literal array
+ * removes any member-ordering ambiguity for the composite case.
+ */
+function PrimaryKey(opts) {
+    return (target) => {
+        Reflect.defineMetadata(PK_META, opts, target);
+    };
+}
+// --- Reflector ---------------------------------------------------------------
+/**
+ * Rebuild one {@link FieldSpec} from its stored spec, applying the per-field
+ * omit-when-absent rule so `required:false` / absent `trusted` / absent `role` /
+ * absent `column` never appear as keys (they must be OMITTED to `deepStrictEqual`
+ * the literals). Key order kept `{ key, column, type, required?, trusted?, role? }`
+ * to mirror the literals.
+ */
+function reflectField(spec) {
+    const f = { key: spec.key };
+    if (spec.column !== undefined)
+        f.column = spec.column;
+    f.type = spec.type;
+    if (spec.required === true)
+        f.required = true;
+    if (spec.trusted !== undefined)
+        f.trusted = spec.trusted;
+    if (spec.role !== undefined)
+        f.role = spec.role;
+    return f;
+}
+/**
+ * Read an {@link ObjectType} back out of a class decorated with `@ObjectType` +
+ * `@PrimaryKey` + one-or-more `@Field`. Takes the CONSTRUCTOR (`Function`); never
+ * instantiates it.
+ *
+ * The result is assembled field-by-field with explicit omit guards so it
+ * `deepStrictEqual`s the equivalent literal (omit-when-absent convention). Key order
+ * mirrors the literals for readability/JSON parity (irrelevant to `deepStrictEqual`).
+ */
+function reflectObjectType(cls) {
+    const opts = Reflect.getMetadata(OBJECT_TYPE_META, cls);
+    if (!opts) {
+        throw new errors_js_1.RegistrationError(`${cls.name} is not decorated with @ObjectType`);
+    }
+    const pk = Reflect.getMetadata(PK_META, cls);
+    if (!pk) {
+        throw new errors_js_1.RegistrationError(`${cls.name} is not decorated with @PrimaryKey`);
+    }
+    const fields = Reflect.getMetadata(FIELDS_META, cls) ?? [];
+    if (fields.length === 0) {
+        throw new errors_js_1.RegistrationError(`${cls.name} declares no @Field members`);
+    }
+    const out = { typeKey: opts.typeKey, table: opts.table };
+    if (opts.schema !== undefined)
+        out.schema = opts.schema;
+    out.primaryKey = pk; // assigned AS-IS — no reconstruction (union key set preserved)
+    out.fields = fields.map(reflectField);
+    if (opts.junctions !== undefined)
+        out.junctions = opts.junctions;
+    if (opts.extensible !== undefined)
+        out.extensible = opts.extensible;
+    // `access` is REQUIRED on the contract, but reflected with the SAME
+    // omit-when-absent discipline as junctions/extensible (assigned AS-IS). If a
+    // decorator omits it, the reflected literal likewise omits the key — and the
+    // registry's `validate` (chokepoint 1) is what rejects the absence at boot.
+    if (opts.access !== undefined)
+        out.access = opts.access;
+    return out;
+}

package/dist/decorators/object-type.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-type.decorator.js","sourceRoot":"","sources":["../../src/decorators/object-type.decorator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AA8EH,gCAIC;AAyBD,sBAQC;AAUD,gCAIC;AA4BD,8CAqCC;AAhMD,4BAA0B;AAE1B,4CAAiD;AAejD,iFAAiF;AAEjF,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC5D,0EAA0E;AAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;AACnD,mFAAmF;AACnF,MAAM,WAAW,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAyCnD,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,SAAgB,UAAU,CAAC,IAAuB;IAChD,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC;AAeD;;;;;;;;;GASG;AACH,SAAgB,KAAK,CAAC,IAAkB;IACtC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAI,MAAoC,CAAC,WAAW,CAAC;QAC/D,MAAM,QAAQ,GACX,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAA6B,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAc,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9D,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,IAAuB;IAChD,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAe;IACnC,MAAM,CAAC,GAA4B,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACtD,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;QAAE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACzD,OAAO,CAAyB,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,GAAa;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAEzC,CAAC;IACd,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,6BAAiB,CACzB,GAAG,GAAG,CAAC,IAAI,oCAAoC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAkC,CAAC;IAC9E,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,6BAAiB,CACzB,GAAG,GAAG,CAAC,IAAI,oCAAoC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACT,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,CAA6B,IAAI,EAAE,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,6BAAiB,CACzB,GAAG,GAAG,CAAC,IAAI,6BAA6B,CACzC,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACxD,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,+DAA+D;IACpF,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpE,oEAAoE;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACxD,OAAO,GAAoC,CAAC;AAC9C,CAAC"}