@astram/guard 0.1.1 → 0.3.0

package/dist/request-auth/request-principal.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Request-principal resolution — extract the bearer access token from an HTTP
+ * request and resolve it (via the {@link SessionTokenBinder}) to a `Principal`,
+ * fail-closed. This is the request-auth read path the enforcement guard uses for
+ * `@Classified` routes before calling `decide()`.
+ *
+ * The `Principal` is rebuilt from the bound claims. We deliberately do NOT re-run
+ * the Core identity broker here (which would apply the root allowlist and could
+ * mint a root from an id) — instead we reconstruct a plain, non-root
+ * Principal from the exact claims captured at login. `isRoot` is set to
+ * `false` on the request path unless the binding explicitly recorded it (it is
+ * captured from the login-time Principal, so a genuinely-root login stays
+ * root; a normal login can never become one on a later request).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractBearerToken = extractBearerToken;
+exports.principalFromClaims = principalFromClaims;
+exports.resolveRequestPrincipal = resolveRequestPrincipal;
+exports.resolveRequestAuth = resolveRequestAuth;
+/** Valid `Principal.kind` values (mirror of the Core union; validated at rebuild). */
+const PRINCIPAL_KINDS = new Set(['user', 'role_group', 'service_account']);
+/** Extract a bearer token from an `Authorization: Bearer <token>` header. */
+function extractBearerToken(authorizationHeader) {
+    if (typeof authorizationHeader !== 'string')
+        return null;
+    const m = /^Bearer\s+(.+)$/i.exec(authorizationHeader.trim());
+    const token = m?.[1]?.trim();
+    return token && token.length > 0 ? token : null;
+}
+/**
+ * Rebuild a `Principal` from bound claims (validated). `isRoot` is read
+ * from the binding (captured at login), NEVER inferred — a normal user cannot become
+ * a root on the request path.
+ */
+function principalFromClaims(claims) {
+    if (typeof claims.id !== 'string' ||
+        claims.id.length === 0 ||
+        typeof claims.tenantId !== 'string' ||
+        claims.tenantId.length === 0) {
+        return null;
+    }
+    const kind = PRINCIPAL_KINDS.has(claims.kind) ? claims.kind : 'user';
+    const roleIds = Array.isArray(claims.roleIds)
+        ? claims.roleIds.filter((r) => typeof r === 'string')
+        : [];
+    return Object.freeze({
+        kind,
+        id: claims.id,
+        tenantId: claims.tenantId,
+        roleIds: Object.freeze([...roleIds]),
+        isRoot: claims.isRoot === true,
+    });
+}
+/**
+ * Resolve an HTTP request's bearer token to a `Principal`, or `null` (fail-closed)
+ * when there is no token, no binding, or the binding is malformed.
+ */
+async function resolveRequestPrincipal(authorizationHeader, binder) {
+    const token = extractBearerToken(authorizationHeader);
+    if (token === null)
+        return null;
+    const claims = await binder.resolve(token);
+    if (claims === null)
+        return null;
+    return principalFromClaims(claims);
+}
+/**
+ * Resolve an HTTP request's bearer token to BOTH a `Principal` AND the raw
+ * {@link BoundPrincipalClaims}, or `null` (fail-closed) — the same read path as
+ * {@link resolveRequestPrincipal}, but it also surfaces the claims the `Principal`
+ * projection drops (notably `mustReenroll` and `sessionId`). The enforcement guard
+ * uses this so it can read `claims.mustReenroll` to apply the enforced-re-enroll gate
+ * while still attaching the resolved `Principal` for `decide()`.
+ */
+async function resolveRequestAuth(authorizationHeader, binder) {
+    const token = extractBearerToken(authorizationHeader);
+    if (token === null)
+        return null;
+    const claims = await binder.resolve(token);
+    if (claims === null)
+        return null;
+    const principal = principalFromClaims(claims);
+    if (principal === null)
+        return null;
+    return { principal, claims };
+}

package/dist/request-auth/request-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-principal.js","sourceRoot":"","sources":["../../src/request-auth/request-principal.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AASH,gDAKC;AAOD,kDAoBC;AAMD,0DASC;AAUD,gDAWC;AAxED,sFAAsF;AACtF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE3E,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,mBAA4B;IAC7D,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7B,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,MAA4B;IAC9D,IACE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAA0B,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,mBAA4B,EAC5B,MAA0B;IAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,mBAA4B,EAC5B,MAA0B;IAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/dist/request-auth/session-facts-als.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The per-request **session-facts AsyncLocalStorage** (ADR-0011 hot path) — the
+ * SINGLE shared instance the enforcement guard ENTERS and the consumer's
+ * `SessionFactsReader` READS. This is the seam that lets gate 5 serve a principal's
+ * coarse grants from the request's cached facts instead of a DB reload on every
+ * request, WITHOUT touching the frozen 4-arg `decide()` signature or the core
+ * `SessionFactsReader` dep contract.
+ *
+ * ── WHY A FRAMEWORK-EXPORTED SINGLETON (not DI-injected) ─────────────────────────
+ * The guard (framework) must ENTER the scope; the reader (app-owned — astram3 swaps
+ * `nullSessionFacts` for an ALS-backed one) must READ the SAME scope. An
+ * `AsyncLocalStorage` only shares state across `run()`/`getStore()` calls on the
+ * SAME instance, so both sides MUST hold one identical object. Exporting ONE module
+ * singleton and importing it on both sides is the simplest way to guarantee that —
+ * no DI token round-trip, no risk of two divergent instances. It is a pure in-memory
+ * request-scoping primitive (no I/O, no secret), so a shared module-level singleton
+ * is safe and idiomatic (this is exactly how Nest's own `ClsService`-style helpers
+ * and request-context libraries share an ALS).
+ *
+ * ── CROSS-PRINCIPAL ISOLATION (the #1 danger) ────────────────────────────────────
+ * `AsyncLocalStorage.run(store, cb)` binds `store` to the async execution context of
+ * `cb` and everything it awaits — and ONLY that context. Two concurrent requests each
+ * call `run()` with THEIR OWN store, so `getStore()` inside each returns that request's
+ * facts and never the other's. The guard enters the scope with THIS request's
+ * `claims.cachedFacts` (same bearer token → same principal → same facts) wrapping the
+ * `decide()` call, so the facts a gate reads are always the current request's. The
+ * reader holds NO per-request state on `this` — only the ALS handle — so nothing leaks
+ * across requests through the reader object itself.
+ *
+ * ── FAIL-CLOSED ──────────────────────────────────────────────────────────────────
+ * Outside any `run()` scope (or when the guard entered with `cachedFacts: null` because
+ * the binding carried none / was malformed), `getStore()` is `undefined` / the store's
+ * `cachedFacts` is `null`. The reader maps BOTH to `{ cachedFacts: null,
+ * permissionsVersion: 0 }`, so gate 5 falls back to the authoritative DB reload
+ * (`PermissionFactsPort.loadCoarseGrants`). A cache miss NEVER fabricates a permit.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import type { CoarseGrants } from '@astram/core';
+/**
+ * The per-request session-facts store carried through the ALS. `cachedFacts` is the
+ * principal's coarse grants for THIS request (or `null` when none were projected →
+ * gate 5 DB-reloads); `permissionsVersion` is the version those facts were projected
+ * at (0 when absent). Mirrors the core `SessionFactsReader` shape 1:1.
+ */
+export interface SessionFactsStore {
+    /** THIS request's coarse grants (ADR-0011), or `null` → gate 5 reloads via the port. */
+    readonly cachedFacts: CoarseGrants | null;
+    /** The version `cachedFacts` was projected at (0 when absent). */
+    readonly permissionsVersion: number;
+}
+/**
+ * The ONE shared session-facts `AsyncLocalStorage` (see the file header). The
+ * enforcement guard imports this to `run()` the `decide()` call inside the request's
+ * scope; the consumer's ALS-backed `SessionFactsReader` imports the SAME instance to
+ * `getStore()`. Exported through the guard barrel so the app reads the identical
+ * singleton — never a second, divergent ALS.
+ */
+export declare const SHIELD_SESSION_FACTS_ALS: AsyncLocalStorage<SessionFactsStore>;
+/**
+ * The fail-closed "no facts" store — what a reader returns when there is no active
+ * scope or the scope carried no facts. Kept here as the single source of the
+ * fail-closed shape so the guard and the reader agree byte-for-byte.
+ */
+export declare const NO_SESSION_FACTS: SessionFactsStore;
+//# sourceMappingURL=session-facts-als.d.ts.map

package/dist/request-auth/session-facts-als.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-facts-als.d.ts","sourceRoot":"","sources":["../../src/request-auth/session-facts-als.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,sCAA6C,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAG7B,CAAC"}

package/dist/request-auth/session-facts-als.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * The per-request **session-facts AsyncLocalStorage** (ADR-0011 hot path) — the
+ * SINGLE shared instance the enforcement guard ENTERS and the consumer's
+ * `SessionFactsReader` READS. This is the seam that lets gate 5 serve a principal's
+ * coarse grants from the request's cached facts instead of a DB reload on every
+ * request, WITHOUT touching the frozen 4-arg `decide()` signature or the core
+ * `SessionFactsReader` dep contract.
+ *
+ * ── WHY A FRAMEWORK-EXPORTED SINGLETON (not DI-injected) ─────────────────────────
+ * The guard (framework) must ENTER the scope; the reader (app-owned — astram3 swaps
+ * `nullSessionFacts` for an ALS-backed one) must READ the SAME scope. An
+ * `AsyncLocalStorage` only shares state across `run()`/`getStore()` calls on the
+ * SAME instance, so both sides MUST hold one identical object. Exporting ONE module
+ * singleton and importing it on both sides is the simplest way to guarantee that —
+ * no DI token round-trip, no risk of two divergent instances. It is a pure in-memory
+ * request-scoping primitive (no I/O, no secret), so a shared module-level singleton
+ * is safe and idiomatic (this is exactly how Nest's own `ClsService`-style helpers
+ * and request-context libraries share an ALS).
+ *
+ * ── CROSS-PRINCIPAL ISOLATION (the #1 danger) ────────────────────────────────────
+ * `AsyncLocalStorage.run(store, cb)` binds `store` to the async execution context of
+ * `cb` and everything it awaits — and ONLY that context. Two concurrent requests each
+ * call `run()` with THEIR OWN store, so `getStore()` inside each returns that request's
+ * facts and never the other's. The guard enters the scope with THIS request's
+ * `claims.cachedFacts` (same bearer token → same principal → same facts) wrapping the
+ * `decide()` call, so the facts a gate reads are always the current request's. The
+ * reader holds NO per-request state on `this` — only the ALS handle — so nothing leaks
+ * across requests through the reader object itself.
+ *
+ * ── FAIL-CLOSED ──────────────────────────────────────────────────────────────────
+ * Outside any `run()` scope (or when the guard entered with `cachedFacts: null` because
+ * the binding carried none / was malformed), `getStore()` is `undefined` / the store's
+ * `cachedFacts` is `null`. The reader maps BOTH to `{ cachedFacts: null,
+ * permissionsVersion: 0 }`, so gate 5 falls back to the authoritative DB reload
+ * (`PermissionFactsPort.loadCoarseGrants`). A cache miss NEVER fabricates a permit.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = void 0;
+const node_async_hooks_1 = require("node:async_hooks");
+/**
+ * The ONE shared session-facts `AsyncLocalStorage` (see the file header). The
+ * enforcement guard imports this to `run()` the `decide()` call inside the request's
+ * scope; the consumer's ALS-backed `SessionFactsReader` imports the SAME instance to
+ * `getStore()`. Exported through the guard barrel so the app reads the identical
+ * singleton — never a second, divergent ALS.
+ */
+exports.SHIELD_SESSION_FACTS_ALS = new node_async_hooks_1.AsyncLocalStorage();
+/**
+ * The fail-closed "no facts" store — what a reader returns when there is no active
+ * scope or the scope carried no facts. Kept here as the single source of the
+ * fail-closed shape so the guard and the reader agree byte-for-byte.
+ */
+exports.NO_SESSION_FACTS = Object.freeze({
+    cachedFacts: null,
+    permissionsVersion: 0,
+});

package/dist/request-auth/session-facts-als.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-facts-als.js","sourceRoot":"","sources":["../../src/request-auth/session-facts-als.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAEH,uDAAqD;AAmBrD;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG,IAAI,oCAAiB,EAAqB,CAAC;AAEnF;;;;GAIG;AACU,QAAA,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/D,WAAW,EAAE,IAAI;IACjB,kBAAkB,EAAE,CAAC;CACtB,CAAC,CAAC"}

package/dist/request-auth/session-token-binder.d.ts

@@ -0,0 +1,130 @@
+/**
+ * SessionTokenBinder — binds an opaque access token to its session's principal
+ * claims, so the request-auth layer can turn a bearer token on a later request
+ * back into a `Principal`.
+ *
+ * WHY THIS EXISTS (the flagged framework gap): the Core session layer mints an
+ * OPAQUE access token and never stores it — the hot session record is keyed by
+ * `sessionId` and carries only `principalId` + `tenantId` (no roles). There is no
+ * access-token → session mapping. Rather than change the frozen Core session
+ * contract (Article 1), this guard-side adapter writes a SEPARATE binding entry at
+ * establish/rotate time and reads it per request. Zero Core changes.
+ *
+ * The binding: `shield:at:<accessToken>` → JSON {@link BoundPrincipalClaims}
+ * ({ id, tenantId, roleIds, kind }), TTL = the access-token lifetime. The token
+ * stays fully opaque (carries no data itself); the mapping is server-side, so the
+ * session is server-REVOCABLE (drop the key) and the read is FAIL-CLOSED (absent or
+ * Redis-unavailable → no principal → the guard denies).
+ *
+ * ⛔ SECURITY: the access token is used only as a Redis key here; it is never logged
+ * and the stored value carries no secret (claims only — ids, not credentials).
+ */
+import type Redis from 'ioredis';
+import type { CoarseGrants } from '@astram/core';
+/** The principal claims carried in the access-token binding (enough to re-mint). */
+export interface BoundPrincipalClaims {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly roleIds: readonly string[];
+    readonly kind: string;
+    /**
+     * Root status, captured from the LOGIN-TIME Principal (the identity broker's
+     * server-side allowlist decided it at login). Carried here so a genuine root
+     * stays root on later requests, and — critically — a normal user can NEVER
+     * become one on the request path (it is read from the binding, never inferred).
+     */
+    readonly isRoot: boolean;
+    /** The bound session id (for server-side revoke correlation). */
+    readonly sessionId: string;
+    /**
+     * The ENFORCED-RE-ENROLL flag (spec §4). `true` when the session was established
+     * via a lower-assurance recovery-code login: the enforcement gate then restricts
+     * the session to the "re-secure" allowlist until a fresh device is confirmed.
+     * A normal (TOTP/password) login binds `false`.
+     *
+     * ⚠ AUTHORITATIVE SOURCE = the SESSION-CLAIMS entry, not the per-access-token
+     * entry. `resolve()` reads this field from the session-claims entry (which it
+     * already fetches for the liveness gate) so that {@link SessionTokenBinder.clearReenroll}
+     * — which can only key by `sessionId` — flips it for EVERY live access token of the
+     * session at once (device-confirm re-secures the whole session, not one token). The
+     * access token itself is never re-minted; only this bound claim changes.
+     */
+    readonly mustReenroll: boolean;
+    /**
+     * OPTIONAL cached coarse grants (ADR-0011 eager-projection hot path). When the auth
+     * surface has a {@link import('../auth/ports/session-facts-projector.js').SessionFactsProjector}
+     * wired, it computes the principal's {@link CoarseGrants} at login/refresh and stores
+     * them HERE, so the enforcement guard can hand them to gate 5 as the request's
+     * `cachedFacts` (serving the coarse decision from cache instead of a DB reload when the
+     * cached version is still fresh).
+     *
+     * ⛔ ABSENT (undefined) is the DEFAULT and the fail-closed state: no projector wired,
+     * a legacy/old binding, or a malformed slot → `resolve()` returns claims WITHOUT this
+     * field → the guard enters the ALS with `cachedFacts: null` → gate 5 DB-reloads (today's
+     * behavior). It is NEVER inferred; only a genuine projection sets it. A missing/malformed
+     * `cachedFacts` slot is treated as absent (see `resolve()`), never fabricated.
+     */
+    readonly cachedFacts?: CoarseGrants;
+}
+export declare class SessionTokenBinder {
+    private readonly redis;
+    constructor(redis: Redis);
+    /**
+     * Bind an access token to its principal claims for `ttlMs` (the access-token
+     * lifetime). Called right after `SessionAuthority.establish` in the auth
+     * controller (it holds both the freshly-minted access token and the Principal).
+     * ALSO writes a session-id → claims entry so a later `rebindOnRotate` can carry the
+     * full claims (roles/kind/root) forward across a token rotation, where the
+     * durable session row alone lacks them.
+     */
+    bind(accessToken: string, claims: BoundPrincipalClaims, ttlMs: number): Promise<void>;
+    /**
+     * On refresh/rotate the controller has the NEW access token + the session, but not
+     * the full Principal (roles/kind/root live only in the binding, not the
+     * durable session row). Re-bind by reading the session-claims entry and writing the
+     * new access-token binding with the SAME claims. Returns true if it carried claims
+     * forward, false if the session-claims entry was gone (then the caller has nothing
+     * to bind — a later request will 401 and the user re-logs in; fail-closed).
+     *
+     * `freshFacts` (ADR-0011 eager projection at REFRESH):
+     *   - `undefined` (omitted, the default) → carry whatever `cachedFacts` the session
+     *     already had FORWARD unchanged (no re-projection). Existing callers that pass no
+     *     facts behave EXACTLY as before.
+     *   - a {@link CoarseGrants} → REPLACE `cachedFacts` with this freshly-projected value
+     *     (a refresh re-reads the current grants so the cache stays warm past the version
+     *     the login projected at).
+     *   - `null` → STRIP `cachedFacts` (a projection that yielded nothing → the next
+     *     request DB-reloads; fail-closed).
+     */
+    rebindOnRotate(newAccessToken: string, sessionId: string, ttlMs: number, freshFacts?: CoarseGrants | null): Promise<boolean>;
+    /**
+     * Resolve an access token to its bound claims, or `null` if the binding is
+     * absent/expired. Fail-closed: any Redis error → `null` (the caller denies), never
+     * a thrown 500 that could be mistaken for allow. The token is opaque; an unknown
+     * token simply has no key.
+     */
+    resolve(accessToken: string): Promise<BoundPrincipalClaims | null>;
+    /**
+     * Clear the ENFORCED-RE-ENROLL flag for a session — the re-secure is complete
+     * (a fresh device was confirmed, spec §4.3). Rewrites the session-claims entry with
+     * `mustReenroll: false`, preserving its remaining TTL, so the LIVE access token's
+     * next {@link SessionTokenBinder.resolve} sees `false` (the token is NOT re-minted;
+     * only the bound claim flips). Keyed by `sessionId` because the caller (the account
+     * controller on device-confirm) has the session id from its own claims, and this must
+     * apply to every outstanding access token of the session at once.
+     *
+     * Best-effort + fail-closed on the LOAD: if the session-claims entry is gone (logged
+     * out) or Redis is unavailable, there is nothing to clear (the session is already
+     * dead / will re-deny) — we simply return. Idempotent.
+     */
+    clearReenroll(sessionId: string): Promise<void>;
+    /** Drop an access-token binding. Idempotent. */
+    unbind(accessToken: string): Promise<void>;
+    /**
+     * Drop the session-claims entry on logout/revoke, so a rotate after logout cannot
+     * re-mint a binding (defense-in-depth: the session is already revoked, but this
+     * removes the claims cushion too). The per-access-token bindings expire by TTL.
+     */
+    unbindSession(sessionId: string): Promise<void>;
+}
+//# sourceMappingURL=session-token-binder.d.ts.map

package/dist/request-auth/session-token-binder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token-binder.d.ts","sourceRoot":"","sources":["../../src/request-auth/session-token-binder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAKjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;CACrC;AA0CD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK;IAEzC;;;;;;;OAOG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3F;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,YAAY,GAAG,IAAI,GAC/B,OAAO,CAAC,OAAO,CAAC;IAgCnB;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA8DxE;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BrD,gDAAgD;IAC1C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOtD"}

package/dist/request-auth/session-token-binder.js

@@ -0,0 +1,277 @@
+"use strict";
+/**
+ * SessionTokenBinder — binds an opaque access token to its session's principal
+ * claims, so the request-auth layer can turn a bearer token on a later request
+ * back into a `Principal`.
+ *
+ * WHY THIS EXISTS (the flagged framework gap): the Core session layer mints an
+ * OPAQUE access token and never stores it — the hot session record is keyed by
+ * `sessionId` and carries only `principalId` + `tenantId` (no roles). There is no
+ * access-token → session mapping. Rather than change the frozen Core session
+ * contract (Article 1), this guard-side adapter writes a SEPARATE binding entry at
+ * establish/rotate time and reads it per request. Zero Core changes.
+ *
+ * The binding: `shield:at:<accessToken>` → JSON {@link BoundPrincipalClaims}
+ * ({ id, tenantId, roleIds, kind }), TTL = the access-token lifetime. The token
+ * stays fully opaque (carries no data itself); the mapping is server-side, so the
+ * session is server-REVOCABLE (drop the key) and the read is FAIL-CLOSED (absent or
+ * Redis-unavailable → no principal → the guard denies).
+ *
+ * ⛔ SECURITY: the access token is used only as a Redis key here; it is never logged
+ * and the stored value carries no secret (claims only — ids, not credentials).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionTokenBinder = void 0;
+/**
+ * Structurally validate a value pulled from the (untrusted) Redis payload as
+ * {@link CoarseGrants}. Returns the parsed facts or `undefined` — a `null`/junk/legacy
+ * slot is treated as ABSENT (fail-closed → the request path DB-reloads), NEVER fabricated.
+ * Mirrors core gate 5's own defensive `asCoarseGrants` probe so a hostile payload can't
+ * sneak a non-string key or a non-number version into the cache.
+ */
+function parseCachedFacts(slot) {
+    if (slot === null || typeof slot !== 'object')
+        return undefined;
+    const c = slot;
+    if (typeof c.permissionsVersion !== 'number')
+        return undefined;
+    if (!Array.isArray(c.grantedPermissionKeys))
+        return undefined;
+    for (const k of c.grantedPermissionKeys)
+        if (typeof k !== 'string')
+            return undefined;
+    return {
+        permissionsVersion: c.permissionsVersion,
+        grantedPermissionKeys: [...c.grantedPermissionKeys],
+    };
+}
+/** Return the claims with any `cachedFacts` slot removed (absent → gate 5 DB-reloads). */
+function stripCachedFacts(claims) {
+    if (!('cachedFacts' in claims))
+        return claims;
+    const { cachedFacts: _drop, ...rest } = claims;
+    return rest;
+}
+/** Redis key prefix for the access-token → claims binding. */
+const AT_KEY_PREFIX = 'shield:at:';
+/** Redis key prefix for the session-id → claims binding (survives token rotation). */
+const SESS_CLAIMS_PREFIX = 'shield:sessclaims:';
+function atKey(accessToken) {
+    return `${AT_KEY_PREFIX}${accessToken}`;
+}
+function sessClaimsKey(sessionId) {
+    return `${SESS_CLAIMS_PREFIX}${sessionId}`;
+}
+class SessionTokenBinder {
+    redis;
+    constructor(redis) {
+        this.redis = redis;
+    }
+    /**
+     * Bind an access token to its principal claims for `ttlMs` (the access-token
+     * lifetime). Called right after `SessionAuthority.establish` in the auth
+     * controller (it holds both the freshly-minted access token and the Principal).
+     * ALSO writes a session-id → claims entry so a later `rebindOnRotate` can carry the
+     * full claims (roles/kind/root) forward across a token rotation, where the
+     * durable session row alone lacks them.
+     */
+    async bind(accessToken, claims, ttlMs) {
+        const payload = JSON.stringify(claims);
+        await this.redis.set(atKey(accessToken), payload, 'PX', ttlMs);
+        // The session-claims entry gets a longer TTL cushion so it survives across
+        // multiple short-lived access tokens within one session's lifetime.
+        await this.redis.set(sessClaimsKey(claims.sessionId), payload, 'PX', Math.max(ttlMs * 4, ttlMs));
+    }
+    /**
+     * On refresh/rotate the controller has the NEW access token + the session, but not
+     * the full Principal (roles/kind/root live only in the binding, not the
+     * durable session row). Re-bind by reading the session-claims entry and writing the
+     * new access-token binding with the SAME claims. Returns true if it carried claims
+     * forward, false if the session-claims entry was gone (then the caller has nothing
+     * to bind — a later request will 401 and the user re-logs in; fail-closed).
+     *
+     * `freshFacts` (ADR-0011 eager projection at REFRESH):
+     *   - `undefined` (omitted, the default) → carry whatever `cachedFacts` the session
+     *     already had FORWARD unchanged (no re-projection). Existing callers that pass no
+     *     facts behave EXACTLY as before.
+     *   - a {@link CoarseGrants} → REPLACE `cachedFacts` with this freshly-projected value
+     *     (a refresh re-reads the current grants so the cache stays warm past the version
+     *     the login projected at).
+     *   - `null` → STRIP `cachedFacts` (a projection that yielded nothing → the next
+     *     request DB-reloads; fail-closed).
+     */
+    async rebindOnRotate(newAccessToken, sessionId, ttlMs, freshFacts) {
+        let raw;
+        try {
+            raw = await this.redis.get(sessClaimsKey(sessionId));
+        }
+        catch {
+            return false;
+        }
+        if (raw === null)
+            return false;
+        // Default: carry the existing payload forward byte-for-byte (facts unchanged).
+        let payload = raw;
+        if (freshFacts !== undefined) {
+            // A refresh-time projection was supplied → rewrite the `cachedFacts` slot on the
+            // carried-forward claims. A parse failure here is treated as "nothing to update"
+            // and we carry the original payload forward (fail-safe: never drop the whole
+            // binding on a transient JSON hiccup — a later request re-projects/DB-reloads).
+            try {
+                const parsed = JSON.parse(raw);
+                const next = freshFacts === null ? stripCachedFacts(parsed) : { ...parsed, cachedFacts: freshFacts };
+                payload = JSON.stringify(next);
+            }
+            catch {
+                payload = raw;
+            }
+        }
+        await this.redis.set(atKey(newAccessToken), payload, 'PX', ttlMs);
+        // Refresh the session-claims TTL cushion too (with the same, possibly-updated payload).
+        await this.redis.set(sessClaimsKey(sessionId), payload, 'PX', Math.max(ttlMs * 4, ttlMs));
+        return true;
+    }
+    /**
+     * Resolve an access token to its bound claims, or `null` if the binding is
+     * absent/expired. Fail-closed: any Redis error → `null` (the caller denies), never
+     * a thrown 500 that could be mistaken for allow. The token is opaque; an unknown
+     * token simply has no key.
+     */
+    async resolve(accessToken) {
+        let raw;
+        try {
+            raw = await this.redis.get(atKey(accessToken));
+        }
+        catch {
+            return null; // Redis unavailable → fail closed.
+        }
+        if (raw === null)
+            return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+        if (typeof parsed?.id !== 'string' ||
+            typeof parsed?.tenantId !== 'string' ||
+            !Array.isArray(parsed?.roleIds) ||
+            typeof parsed?.kind !== 'string' ||
+            typeof parsed?.isRoot !== 'boolean' ||
+            typeof parsed?.sessionId !== 'string' ||
+            typeof parsed?.mustReenroll !== 'boolean') {
+            return null; // malformed → fail closed.
+        }
+        // Normalize the OPTIONAL cached-facts slot (ADR-0011): a malformed/legacy/absent
+        // slot is scrubbed to `undefined` (→ the guard enters the ALS with `cachedFacts:
+        // null` → gate 5 DB-reloads). Present + well-formed → the validated CoarseGrants.
+        // Never fabricated. Rebuild the object so a malformed slot cannot ride through.
+        const cachedFacts = parseCachedFacts(parsed.cachedFacts);
+        parsed = cachedFacts === undefined
+            ? stripCachedFacts(parsed)
+            : { ...parsed, cachedFacts };
+        // SESSION-LIVENESS GATE: the per-token binding alone is not enough — a logout
+        // revokes the session but cannot reach every outstanding access-token key. So we
+        // ALSO require the session-claims entry (which `unbindSession` deletes on logout)
+        // to still exist. Gone → the session was revoked → deny (fail-closed), even if the
+        // token binding lingers until its TTL. This makes logout an IMMEDIATE token kill.
+        let liveness;
+        try {
+            liveness = await this.redis.get(sessClaimsKey(parsed.sessionId));
+        }
+        catch {
+            return null; // Redis unavailable → fail closed.
+        }
+        if (liveness === null)
+            return null; // session revoked (logout) → deny.
+        // MUST-REENROLL is read from the SESSION-CLAIMS entry (the one we just fetched for
+        // liveness), NOT the per-token entry — so `clearReenroll(sessionId)` (which cannot
+        // know each outstanding access token) flips it for the LIVE token on the very next
+        // request. The token stays the same; only this bound claim changes. A malformed or
+        // legacy session-claims entry that lacks the flag is treated as `false` (default
+        // safe: an old binding predating this field must not spuriously lock a session).
+        let mustReenroll = parsed.mustReenroll;
+        try {
+            const sess = JSON.parse(liveness);
+            mustReenroll = sess?.mustReenroll === true;
+        }
+        catch {
+            mustReenroll = false; // unparseable session-claims → treat as not-reenroll.
+        }
+        return mustReenroll === parsed.mustReenroll ? parsed : { ...parsed, mustReenroll };
+    }
+    /**
+     * Clear the ENFORCED-RE-ENROLL flag for a session — the re-secure is complete
+     * (a fresh device was confirmed, spec §4.3). Rewrites the session-claims entry with
+     * `mustReenroll: false`, preserving its remaining TTL, so the LIVE access token's
+     * next {@link SessionTokenBinder.resolve} sees `false` (the token is NOT re-minted;
+     * only the bound claim flips). Keyed by `sessionId` because the caller (the account
+     * controller on device-confirm) has the session id from its own claims, and this must
+     * apply to every outstanding access token of the session at once.
+     *
+     * Best-effort + fail-closed on the LOAD: if the session-claims entry is gone (logged
+     * out) or Redis is unavailable, there is nothing to clear (the session is already
+     * dead / will re-deny) — we simply return. Idempotent.
+     */
+    async clearReenroll(sessionId) {
+        let raw;
+        try {
+            raw = await this.redis.get(sessClaimsKey(sessionId));
+        }
+        catch {
+            return; // Redis unavailable → nothing to do (the gate re-evaluates next request).
+        }
+        if (raw === null)
+            return; // session revoked/expired → nothing to clear.
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return; // malformed → leave as-is (resolve() already fails it closed).
+        }
+        if (parsed.mustReenroll === false)
+            return; // already clear — idempotent no-op.
+        // Preserve the remaining TTL so clearing the flag never extends the session life.
+        let ttlMs;
+        try {
+            ttlMs = await this.redis.pttl(sessClaimsKey(sessionId));
+        }
+        catch {
+            return;
+        }
+        if (ttlMs <= 0)
+            return; // expired/no-expiry between get and pttl → leave it.
+        const updated = { ...parsed, mustReenroll: false };
+        try {
+            await this.redis.set(sessClaimsKey(sessionId), JSON.stringify(updated), 'PX', ttlMs);
+        }
+        catch {
+            // best-effort; a failed clear just means the next re-secure attempt retries.
+        }
+    }
+    /** Drop an access-token binding. Idempotent. */
+    async unbind(accessToken) {
+        try {
+            await this.redis.del(atKey(accessToken));
+        }
+        catch {
+            // best-effort; the TTL expires the key regardless.
+        }
+    }
+    /**
+     * Drop the session-claims entry on logout/revoke, so a rotate after logout cannot
+     * re-mint a binding (defense-in-depth: the session is already revoked, but this
+     * removes the claims cushion too). The per-access-token bindings expire by TTL.
+     */
+    async unbindSession(sessionId) {
+        try {
+            await this.redis.del(sessClaimsKey(sessionId));
+        }
+        catch {
+            // best-effort; TTL cleans up regardless.
+        }
+    }
+}
+exports.SessionTokenBinder = SessionTokenBinder;

package/dist/request-auth/session-token-binder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token-binder.js","sourceRoot":"","sources":["../../src/request-auth/session-token-binder.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAuDH;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,IAAyE,CAAC;IACpF,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;IACrF,OAAO;QACL,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,qBAAqB,EAAE,CAAC,GAAI,CAAC,CAAC,qBAAkC,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,MAA4B;IACpD,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAEvC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,sFAAsF;AACtF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD,SAAS,KAAK,CAAC,WAAmB;IAChC,OAAO,GAAG,aAAa,GAAG,WAAW,EAAE,CAAC;AAC1C,CAAC;AACD,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,GAAG,kBAAkB,GAAG,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,MAAa,kBAAkB;IACA;IAA7B,YAA6B,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,MAA4B,EAAE,KAAa;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAsB,EACtB,SAAiB,EACjB,KAAa,EACb,UAAgC;QAEhC,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAE/B,+EAA+E;QAC/E,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,iFAAiF;YACjF,iFAAiF;YACjF,6EAA6E;YAC7E,gFAAgF;YAChF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;gBACvD,MAAM,IAAI,GACR,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;gBAC1F,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,GAAG,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAClE,wFAAwF;QACxF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAClD,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ;YAC9B,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ;YACpC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;YAC/B,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ;YAChC,OAAO,MAAM,EAAE,MAAM,KAAK,SAAS;YACnC,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ;YACrC,OAAO,MAAM,EAAE,YAAY,KAAK,SAAS,EACzC,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,2BAA2B;QAC1C,CAAC;QACD,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,gFAAgF;QAChF,MAAM,WAAW,GAAG,gBAAgB,CAAE,MAAoC,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,GAAG,WAAW,KAAK,SAAS;YAChC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,iFAAiF;QACjF,kFAAkF;QAClF,mFAAmF;QACnF,kFAAkF;QAClF,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAClD,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAEvE,mFAAmF;QACnF,mFAAmF;QACnF,mFAAmF;QACnF,mFAAmF;QACnF,iFAAiF;QACjF,iFAAiF;QACjF,IAAI,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;YAChE,YAAY,GAAG,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,KAAK,CAAC,CAAC,sDAAsD;QAC9E,CAAC;QACD,OAAO,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,0EAA0E;QACpF,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,CAAC,8CAA8C;QACxE,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,+DAA+D;QACzE,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;YAAE,OAAO,CAAC,oCAAoC;QAC/E,kFAAkF;QAClF,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,qDAAqD;QAC7E,MAAM,OAAO,GAAyB,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;CACF;AA/MD,gDA+MC"}