@astram/guard 0.2.0 → 0.3.0

package/dist/authz/cross-tenant-grant-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tenant-grant-writer.js","sourceRoot":"","sources":["../../src/authz/cross-tenant-grant-writer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;;;AAEH,6CAAyC;AAGzC,oFAAoF;AACpF,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC,8CAA8C;AACjC,QAAA,gCAAgC,GAAG,MAAM,CAAC,kCAAkC,CAAC,CAAC;AA4H3F,wFAAwF;AACxF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,+EAA+E;AAC/E,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AALD,8CAKC;AAED,6FAA6F;AAC7F,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAiBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAa,sBAAsB;IAChB,EAAE,CAAiB;IACnB,SAAS,CAAmB;IAC5B,KAAK,CAA6B;IAClC,MAAM,CAAS;IACf,GAAG,CAAe;IAEnC,YAAY,IAaX;QACC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,KAAK,CAAC,KAAsB;QAChC,uFAAuF;QACvF,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE7B,yFAAyF;QACzF,2FAA2F;QAC3F,gFAAgF;QAChF,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,sBAAsB,CAC9B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAChD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAC/D,CAAC;QACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAsB,CAC9B,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC/B,0FAA0F;QAC1F,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,iBAAiB,IAAI,CAAC,MAAM,2BAA2B;gBACrD,8DAA8D;gBAC9D,iFAAiF;gBACjF,uEAAuE;gBACvE,sDAAsD,EACxD;gBACE,SAAS;gBACT,KAAK,CAAC,cAAc;gBACpB,KAAK,CAAC,eAAe;gBACrB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,KAAK;gBACX,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC1D,kBAAkB;gBAClB,KAAK,CAAC,SAAS;gBACf,qFAAqF;gBACrF,0FAA0F;gBAC1F,KAAK,CAAC,WAAW;aAClB,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,6CAA6C,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAC/B,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO,EAAE,KAAK,CAAC,SAAS;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE;gBACV,SAAS;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;aAC1C;SACF,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,sBAAsB,CAAC,kCAAkC,CAAC,CAAC,CAAC,qBAAqB;QAC7F,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,sBAAsB,CAC9B,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,qFAAqF;QACrF,4FAA4F;QAC5F,4FAA4F;QAC5F,uCAAuC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CACjD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CACxE,CAAC;QACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,sBAAsB,CAC9B,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAClC,OAAO,CAAC,0BAA0B;QACpC,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,0DAA0D;YAC1D,MAAM,IAAI,sBAAsB,CAC9B,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,YAAY,IAAI,CAAC,MAAM,2BAA2B;gBAChD,mDAAmD;gBACnD,gDAAgD,EAClD,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CACxC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,2CAA4C,GAAa,CAAC,OAAO,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,sBAAsB,CAAC,kCAAkC,CAAC,CAAC,CAAC,qBAAqB;QAC7F,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,sBAAsB,CAC9B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,uFAAuF;QACvF,4FAA4F;QAC5F,sFAAsF;QACtF,yBAAyB;QACzB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CACvD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CACtE,CAAC;QACF,IAAI,SAAS,GAAG,eAAe,KAAK,IAAI,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CACxD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CACvE,CAAC;YACF,SAAS,GAAG,gBAAgB,KAAK,IAAI,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,sBAAsB,CAC9B,uGAAuG,CACxG,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,0BAA0B;QACpC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,YAAY,IAAI,CAAC,MAAM,2BAA2B;gBAChD,iDAAiD;gBACjD,iDAAiD,EACnD,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CACxC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,2CAA4C,GAAa,CAAC,OAAO,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjF,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACK,gBAAgB,CAAC,KAAsB;QAC7C,2FAA2F;QAC3F,6DAA6D;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,iBAAiB,CAAC,yDAAyD,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,iBAAiB,CAAC,2EAA2E,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,kEAAkE,CAAC,CAAC;QAClG,CAAC;QAED,sEAAsE;QACtE,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,iBAAiB,CAAC,wDAAwD,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;QAC1E,CAAC;QAED,8EAA8E;QAC9E,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,EAA0B;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,yCAA0C,GAAa,CAAC,OAAO,EAAE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uGAAuG;IAC/F,KAAK,CAAC,UAAU,CAAC,SAAiB;QACxC,IAAI,IAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACzB,2EAA2E;gBACzE,oEAAoE;gBACpE,wCAAwC;gBACxC,WAAW,IAAI,CAAC,MAAM,2BAA2B;gBACjD,6BAA6B,EAC/B,CAAC,SAAS,CAAC,CACZ,CAAwB,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,8EAA8E;IAE9E,mEAAmE;IAC3D,KAAK,CAAC,IAAI,CAChB,MAAiC,EACjC,MAAgD;QAEhD,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,KAAK,GAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACjF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,WAAW,CACvB,MAAiC,EACjC,GAAsB,EACtB,SAAiB,EACjB,OAAe;QAEf,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,KAAK,GAAe,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;QAChF,0FAA0F;QAC1F,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YACtB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO;YACP,cAAc,EAAE,GAAG,CAAC,sBAAsB;YAC1C,eAAe,EAAE,GAAG,CAAC,uBAAuB;YAC5C,UAAU,EAAE;gBACV,SAAS;gBACT,OAAO,EAAE,GAAG,CAAC,YAAY;gBACzB,KAAK;gBACL,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,WAAW,EAAE,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC9D,WAAW,EAAE,GAAG,CAAC,gBAAgB;gBACjC,cAAc;aACf;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAxWD,wDAwWC"}

package/dist/authz/manifest-operation-authority-adapter.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `ManifestOperationAuthorityAdapter` — the concrete {@link OperationAuthorityPort} for
+ * `@astram/guard`, backed by a DECLARED operation manifest (ADR-0008). It answers
+ * `resolveDelegatedAuthority(operationKey, stepKey)`: what scoped, non-wildcard authority does
+ * a trusted operation's step carry?
+ *
+ * ── WHAT DELEGATED AUTHORITY IS (ADR-0008 / gate 7): one server operation performs an internal
+ *    side-effect on an object type the CALLER may not touch directly (e.g. "create user" also
+ *    writes an onboarding record in a separate object type). That internal step must run under
+ *    the OPERATION'S OWN declared, scoped, least-privilege authority — NOT the caller's grants,
+ *    and NEVER a wildcard "skip all checks". This adapter resolves THAT declared authority.
+ *
+ * ── PURE, NO DB (ADR-0008). This is DECLARED metadata — the operation's own manifest, known at
+ *    build/registration time. So the lookup is SYNCHRONOUS and in-memory (no store, no I/O). The
+ *    port is contracted synchronous; a manifest is the natural backing.
+ *
+ * ── THE MANIFEST: `${operationKey}:${stepKey}` → {@link DelegatedAuthority}. The consumer
+ *    DECLARES it by constructing the adapter with a map (or `[key, authority]` entries). An
+ *    UNKNOWN key ⇒ `undefined` (pass-through: NO delegation — evaluate under the caller — the
+ *    common case).
+ *
+ * ── FAIL-CLOSED ON A MALFORMED / WILDCARD ENTRY. Core's gate-7 overlay re-checks scope with
+ *    strict membership, but this adapter NEVER hands back a wildcard or malformed authority: a
+ *    declared entry whose `objectTypeKeys` / `allowedActions` is not a non-empty array of
+ *    non-empty strings, OR contains a wildcard `'*'`, is treated as UNDEFINED (no delegation).
+ *    An operation cannot accidentally (or maliciously) declare a `'*'` and gain a root
+ *    reach — the malformed declaration simply grants no delegated authority.
+ *
+ * ── EMPTY MANIFEST = every lookup returns `undefined` = pass-through everywhere. A consumer with
+ *    no trusted operations yet wires this with an empty manifest — identical runtime behavior to
+ *    the interim `emptyOperationAuthority`, but now a REAL, declared surface ready for the first
+ *    trusted operation.
+ *
+ * ── WHY HERE, NOT CORE (ADR-0003): core defines the PORT + the gate-7 overlay that consumes it;
+ *    the manifest-backed concrete lives in guard and is injected into the wired decision
+ *    authority. It uses `@astram/core` TYPES only (erased at build).
+ */
+import type { DelegatedAuthority, OperationAuthorityPort } from '@astram/core';
+/** The DI token the adapter is bound under (parity with the other authz-port tokens). */
+export declare const SHIELD_OPERATION_AUTHORITY_PORT: unique symbol;
+/**
+ * A single declared operation-step authority. Mirrors core's {@link DelegatedAuthority} (a
+ * scoped, NON-wildcard object-type + action ceiling) — declared by the consumer per trusted
+ * operation step.
+ */
+export interface OperationManifestEntry {
+    /** The trusted operation's stable key (its manifest identity). */
+    readonly operationKey: string;
+    /** The specific internal step within the operation. */
+    readonly stepKey: string;
+    /** The declared authority the step carries (scoped, non-wildcard). */
+    readonly authority: DelegatedAuthority;
+}
+export declare class ManifestOperationAuthorityAdapter implements OperationAuthorityPort {
+    private readonly manifest;
+    /**
+     * @param entries the declared operation-step authorities. Each malformed / wildcard entry is
+     *   DROPPED at construction (fail-closed) — it will resolve to `undefined` (no delegation)
+     *   rather than ever hand back an unsafe authority. A duplicate `${op}:${step}` key keeps the
+     *   LAST well-formed declaration.
+     */
+    constructor(entries?: readonly OperationManifestEntry[]);
+    resolveDelegatedAuthority(operationKey: string, stepKey: string): DelegatedAuthority | undefined;
+}
+//# sourceMappingURL=manifest-operation-authority-adapter.d.ts.map

package/dist/authz/manifest-operation-authority-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-operation-authority-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/manifest-operation-authority-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE/E,yFAAyF;AACzF,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;CACxC;AA6BD,qBAAa,iCAAkC,YAAW,sBAAsB;IAC9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D;;;;;OAKG;gBACS,OAAO,GAAE,SAAS,sBAAsB,EAAO;IAuB3D,yBAAyB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,SAAS;CAalC"}

package/dist/authz/manifest-operation-authority-adapter.js

@@ -0,0 +1,108 @@
+"use strict";
+/**
+ * `ManifestOperationAuthorityAdapter` — the concrete {@link OperationAuthorityPort} for
+ * `@astram/guard`, backed by a DECLARED operation manifest (ADR-0008). It answers
+ * `resolveDelegatedAuthority(operationKey, stepKey)`: what scoped, non-wildcard authority does
+ * a trusted operation's step carry?
+ *
+ * ── WHAT DELEGATED AUTHORITY IS (ADR-0008 / gate 7): one server operation performs an internal
+ *    side-effect on an object type the CALLER may not touch directly (e.g. "create user" also
+ *    writes an onboarding record in a separate object type). That internal step must run under
+ *    the OPERATION'S OWN declared, scoped, least-privilege authority — NOT the caller's grants,
+ *    and NEVER a wildcard "skip all checks". This adapter resolves THAT declared authority.
+ *
+ * ── PURE, NO DB (ADR-0008). This is DECLARED metadata — the operation's own manifest, known at
+ *    build/registration time. So the lookup is SYNCHRONOUS and in-memory (no store, no I/O). The
+ *    port is contracted synchronous; a manifest is the natural backing.
+ *
+ * ── THE MANIFEST: `${operationKey}:${stepKey}` → {@link DelegatedAuthority}. The consumer
+ *    DECLARES it by constructing the adapter with a map (or `[key, authority]` entries). An
+ *    UNKNOWN key ⇒ `undefined` (pass-through: NO delegation — evaluate under the caller — the
+ *    common case).
+ *
+ * ── FAIL-CLOSED ON A MALFORMED / WILDCARD ENTRY. Core's gate-7 overlay re-checks scope with
+ *    strict membership, but this adapter NEVER hands back a wildcard or malformed authority: a
+ *    declared entry whose `objectTypeKeys` / `allowedActions` is not a non-empty array of
+ *    non-empty strings, OR contains a wildcard `'*'`, is treated as UNDEFINED (no delegation).
+ *    An operation cannot accidentally (or maliciously) declare a `'*'` and gain a root
+ *    reach — the malformed declaration simply grants no delegated authority.
+ *
+ * ── EMPTY MANIFEST = every lookup returns `undefined` = pass-through everywhere. A consumer with
+ *    no trusted operations yet wires this with an empty manifest — identical runtime behavior to
+ *    the interim `emptyOperationAuthority`, but now a REAL, declared surface ready for the first
+ *    trusted operation.
+ *
+ * ── WHY HERE, NOT CORE (ADR-0003): core defines the PORT + the gate-7 overlay that consumes it;
+ *    the manifest-backed concrete lives in guard and is injected into the wired decision
+ *    authority. It uses `@astram/core` TYPES only (erased at build).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManifestOperationAuthorityAdapter = exports.SHIELD_OPERATION_AUTHORITY_PORT = void 0;
+/** The DI token the adapter is bound under (parity with the other authz-port tokens). */
+exports.SHIELD_OPERATION_AUTHORITY_PORT = Symbol('SHIELD_OPERATION_AUTHORITY_PORT');
+/** Compose the internal manifest map key from an operation + step. */
+function manifestKey(operationKey, stepKey) {
+    return `${operationKey}:${stepKey}`;
+}
+/**
+ * Whether a declared authority is WELL-FORMED and non-wildcard: both `objectTypeKeys` and
+ * `allowedActions` must be non-empty arrays of non-empty strings, and NEITHER may contain a
+ * wildcard `'*'`. A malformed / wildcard authority is rejected (⇒ treated as no delegation).
+ */
+function isWellFormedAuthority(authority) {
+    if (!authority || typeof authority !== 'object')
+        return false;
+    return (isNonEmptyExplicitStringArray(authority.objectTypeKeys) &&
+        isNonEmptyExplicitStringArray(authority.allowedActions));
+}
+/** A non-empty array of non-empty strings, NONE of which is a wildcard `'*'`. */
+function isNonEmptyExplicitStringArray(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return false;
+    for (const v of value) {
+        if (typeof v !== 'string' || v.length === 0 || v === '*')
+            return false;
+    }
+    return true;
+}
+class ManifestOperationAuthorityAdapter {
+    manifest;
+    /**
+     * @param entries the declared operation-step authorities. Each malformed / wildcard entry is
+     *   DROPPED at construction (fail-closed) — it will resolve to `undefined` (no delegation)
+     *   rather than ever hand back an unsafe authority. A duplicate `${op}:${step}` key keeps the
+     *   LAST well-formed declaration.
+     */
+    constructor(entries = []) {
+        this.manifest = new Map();
+        for (const entry of entries) {
+            if (typeof entry.operationKey !== 'string' ||
+                entry.operationKey.length === 0 ||
+                typeof entry.stepKey !== 'string' ||
+                entry.stepKey.length === 0) {
+                continue; // malformed key — skip
+            }
+            if (!isWellFormedAuthority(entry.authority)) {
+                continue; // malformed / wildcard authority — skip (fail-closed → undefined)
+            }
+            // Freeze a defensive copy so a later mutation of the caller's arrays cannot widen it.
+            const frozen = {
+                objectTypeKeys: Object.freeze([...entry.authority.objectTypeKeys]),
+                allowedActions: Object.freeze([...entry.authority.allowedActions]),
+            };
+            this.manifest.set(manifestKey(entry.operationKey, entry.stepKey), frozen);
+        }
+    }
+    resolveDelegatedAuthority(operationKey, stepKey) {
+        if (typeof operationKey !== 'string' ||
+            operationKey.length === 0 ||
+            typeof stepKey !== 'string' ||
+            stepKey.length === 0) {
+            return undefined; // malformed lookup key ⇒ pass-through
+        }
+        // A present entry is already validated + frozen at construction — return it as-is. An
+        // absent key ⇒ undefined (pass-through: no delegation, the common case).
+        return this.manifest.get(manifestKey(operationKey, stepKey));
+    }
+}
+exports.ManifestOperationAuthorityAdapter = ManifestOperationAuthorityAdapter;

package/dist/authz/manifest-operation-authority-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-operation-authority-adapter.js","sourceRoot":"","sources":["../../src/authz/manifest-operation-authority-adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;;;AAIH,yFAAyF;AAC5E,QAAA,+BAA+B,GAAG,MAAM,CAAC,iCAAiC,CAAC,CAAC;AAgBzF,sEAAsE;AACtE,SAAS,WAAW,CAAC,YAAoB,EAAE,OAAe;IACxD,OAAO,GAAG,YAAY,IAAI,OAAO,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,SAAyC;IACtE,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,CACL,6BAA6B,CAAC,SAAS,CAAC,cAAc,CAAC;QACvD,6BAA6B,CAAC,SAAS,CAAC,cAAc,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,6BAA6B,CAAC,KAAwB;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAa,iCAAiC;IAC3B,QAAQ,CAAkC;IAE3D;;;;;OAKG;IACH,YAAY,UAA6C,EAAE;QACzD,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IACE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;gBACtC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBAC/B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;gBACD,SAAS,CAAC,uBAAuB;YACnC,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5C,SAAS,CAAC,kEAAkE;YAC9E,CAAC;YACD,sFAAsF;YACtF,MAAM,MAAM,GAAuB;gBACjC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;gBAClE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;aACnE,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,yBAAyB,CACvB,YAAoB,EACpB,OAAe;QAEf,IACE,OAAO,YAAY,KAAK,QAAQ;YAChC,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,CAAC,MAAM,KAAK,CAAC,EACpB,CAAC;YACD,OAAO,SAAS,CAAC,CAAC,sCAAsC;QAC1D,CAAC;QACD,sFAAsF;QACtF,yEAAyE;QACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF;AAhDD,8EAgDC"}

package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `MariaDbCrossTenantGrantAdapter` — the concrete {@link CrossTenantGrantPort} for
+ * `@astram/guard`, backed by the `cross_tenant_grant` table (ADR-0009). It answers
+ * `findActiveGrant`: is there an ACTIVE (accepted, unexpired, unrevoked), consented grant
+ * that lets THIS grantee reach THIS owning tenant's object type (+ record) for an action?
+ *
+ * ── WHAT A CROSS-TENANT GRANT IS (ADR-0009): the ONLY sanctioned way (short of root)
+ *    a principal reaches a resource owned by a DIFFERENT tenant. It is an explicit,
+ *    CONSENTED handshake — the OWNING tenant (whose data is reached into) offers it, the
+ *    GRANTEE tenant accepts it, either side may revoke it, and it always expires. It is NEVER
+ *    a root bypass: it carries a HARD, non-wildcard action ceiling and a scope
+ *    (whole object type, or a single record). This adapter only REPORTS an active grant; core's
+ *    `isCrossTenantGrantApplicable` re-checks the ceiling + scope + expiry (defense-in-depth).
+ *
+ * ── WHY HERE, NOT CORE (ADR-0003): the `mariadb` driver is a real runtime dependency; core
+ *    defines only the PORT. This adapter is INJECTED into core's wired decision authority. It
+ *    uses `@astram/core` TYPES only (erased at build).
+ *
+ * ── THE MATCH (ADR-0009 — an ACTIVE grant): a row matches when ALL hold —
+ *    • `ctg_owning_tenant_uuid` = the resource's owning tenant AND `ctg_type_key` = the object
+ *      type;
+ *    • the grant is ACTIVE: `ctg_status = 'accepted'` (consent completed) AND
+ *      `ctg_revoked_at IS NULL` (not revoked by either side) AND `ctg_expires_at_ms > ?` (not
+ *      expired — bound epoch-ms, timezone-immune) — a revoked/offered/expired grant is NEVER
+ *      returned, so it can never open access even for a heartbeat;
+ *    • the grantee is EITHER this user (`ctg_grantee_kind='user'` AND
+ *      `ctg_grantee_uuid = grantee`) OR one of the grantee's roles (`ctg_grantee_kind='role'`
+ *      AND `ctg_grantee_uuid IN (roleIds)`);
+ *    • the action is in the ceiling — the action-ceiling membership check is left to core's
+ *      grant-evaluator (which re-checks `allowedActions`), but we DO gate scope: an
+ *      `object_type` grant matches any record of the type; a `record` grant matches ONLY when
+ *      the query names the exact `ctg_record_uuid` (a record-scoped row is EXCLUDED for an
+ *      object-type / record-less query so a NULL-compare never spuriously matches).
+ *    ≥1 matching row ⇒ mapped to a {@link CrossTenantGrant} (first match). No matching row ⇒
+ *    `null` (a NORMAL data-absence — no active consent — NOT an error, NOT a lockout).
+ *
+ * ── SCOPE + RECORD-ID HANDLING: `object_type` rows are always eligible; a `record` row is
+ *    eligible ONLY when `query.recordId` is present AND equals `ctg_record_uuid`. When the
+ *    query has NO recordId (an object-type-level question), the SQL restricts to
+ *    `ctg_scope = 'object_type'` so a record row's `ctg_record_uuid` is never compared to a
+ *    bound NULL (which would never match — but we make the intent explicit and avoid the
+ *    accidental all-records reach a `record_uuid = NULL` OR-branch could imply).
+ *
+ * ── ACTION CEILING PARSING: `ctg_allowed_actions` is a JSON column (a JSON array of action-key
+ *    strings). ⚠️ The mariadb driver AUTO-PARSES a JSON column into a JS ARRAY on read, so the
+ *    cell arrives already-parsed — `parseAllowedActions` accepts BOTH an already-parsed array
+ *    (production) and a JSON string (test mocks). A malformed/empty value ⇒ `[]` (an empty
+ *    ceiling permits nothing — fail-closed; core's ceiling check then denies).
+ *
+ * ── EXPIRY (MUST-FIX #1 — timezone immunity): `ctg_expires_at_ms` is a BIGINT epoch-ms column
+ *    (NOT a TIMESTAMP). The active-grant filter compares it `> ?` against a BOUND integer (the
+ *    adapter's `now()` epoch-ms), so it is immune to host-timezone / `NOW()` wall-clock skew (a
+ *    TIMESTAMP + `NOW()` comparison silently kept expired grants alive on a non-UTC host). Mirrors
+ *    the reset-token store's `prt_expires_at_ms` BIGINT precedent.
+ *
+ * ── EMPTY roleIds: guarded — an empty role list must NOT emit `IN ()` (a MariaDB syntax
+ *    error). We omit the role branch entirely when there are no roles, so a role-less grantee
+ *    is matched by its user-grant rows alone.
+ *
+ * ── ADR-0016 (transient-vs-deny): a genuine store outage THROWS
+ *    {@link AuthorizationUnavailableError} (→ 503 retryable) — NEVER a silent `null` that
+ *    would mask an outage as "no grant".
+ *
+ * ── SAFETY: every value (owningTenantId, typeKey, grantee, each roleId, recordId) is BOUND
+ *    as a `?` param — NEVER interpolated. A SQL payload in typeKey/recordId is data, not SQL.
+ *    Mirrors {@link MariaDbRecordShareAdapter}.
+ */
+import type { CrossTenantGrant, CrossTenantGrantPort, CrossTenantGrantQuery } from '@astram/core';
+/** The DI token the adapter is bound under (parity with the share/rule-port tokens). */
+export declare const SHIELD_CROSS_TENANT_GRANT_PORT: unique symbol;
+/** The minimal query surface this adapter needs — a `mariadb` Pool satisfies it. */
+export interface GrantQueryable {
+    query(sql: string, params?: readonly unknown[]): Promise<unknown>;
+}
+/**
+ * The concrete cross-tenant grant adapter. Answers `findActiveGrant` from `cross_tenant_grant`,
+ * matching user- and role-granted, ACCEPTED, unexpired, unrevoked grants for the owning tenant
+ * + object type (+ record for record-scoped).
+ */
+export declare class MariaDbCrossTenantGrantAdapter implements CrossTenantGrantPort {
+    private readonly db;
+    private readonly schema;
+    private readonly now;
+    constructor(db: GrantQueryable, opts?: {
+        schema?: string;
+        nowMs?: () => number;
+    });
+    findActiveGrant(query: CrossTenantGrantQuery): Promise<CrossTenantGrant | null>;
+}
+//# sourceMappingURL=mariadb-cross-tenant-grant-adapter.d.ts.map

package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-cross-tenant-grant-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-cross-tenant-grant-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,cAAc,CAAC;AAGtB,wFAAwF;AACxF,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAKvF,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAsDD;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,oBAAoB;IACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAQ9E,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAuFtF"}

package/dist/authz/mariadb-cross-tenant-grant-adapter.js

@@ -0,0 +1,211 @@
+"use strict";
+/**
+ * `MariaDbCrossTenantGrantAdapter` — the concrete {@link CrossTenantGrantPort} for
+ * `@astram/guard`, backed by the `cross_tenant_grant` table (ADR-0009). It answers
+ * `findActiveGrant`: is there an ACTIVE (accepted, unexpired, unrevoked), consented grant
+ * that lets THIS grantee reach THIS owning tenant's object type (+ record) for an action?
+ *
+ * ── WHAT A CROSS-TENANT GRANT IS (ADR-0009): the ONLY sanctioned way (short of root)
+ *    a principal reaches a resource owned by a DIFFERENT tenant. It is an explicit,
+ *    CONSENTED handshake — the OWNING tenant (whose data is reached into) offers it, the
+ *    GRANTEE tenant accepts it, either side may revoke it, and it always expires. It is NEVER
+ *    a root bypass: it carries a HARD, non-wildcard action ceiling and a scope
+ *    (whole object type, or a single record). This adapter only REPORTS an active grant; core's
+ *    `isCrossTenantGrantApplicable` re-checks the ceiling + scope + expiry (defense-in-depth).
+ *
+ * ── WHY HERE, NOT CORE (ADR-0003): the `mariadb` driver is a real runtime dependency; core
+ *    defines only the PORT. This adapter is INJECTED into core's wired decision authority. It
+ *    uses `@astram/core` TYPES only (erased at build).
+ *
+ * ── THE MATCH (ADR-0009 — an ACTIVE grant): a row matches when ALL hold —
+ *    • `ctg_owning_tenant_uuid` = the resource's owning tenant AND `ctg_type_key` = the object
+ *      type;
+ *    • the grant is ACTIVE: `ctg_status = 'accepted'` (consent completed) AND
+ *      `ctg_revoked_at IS NULL` (not revoked by either side) AND `ctg_expires_at_ms > ?` (not
+ *      expired — bound epoch-ms, timezone-immune) — a revoked/offered/expired grant is NEVER
+ *      returned, so it can never open access even for a heartbeat;
+ *    • the grantee is EITHER this user (`ctg_grantee_kind='user'` AND
+ *      `ctg_grantee_uuid = grantee`) OR one of the grantee's roles (`ctg_grantee_kind='role'`
+ *      AND `ctg_grantee_uuid IN (roleIds)`);
+ *    • the action is in the ceiling — the action-ceiling membership check is left to core's
+ *      grant-evaluator (which re-checks `allowedActions`), but we DO gate scope: an
+ *      `object_type` grant matches any record of the type; a `record` grant matches ONLY when
+ *      the query names the exact `ctg_record_uuid` (a record-scoped row is EXCLUDED for an
+ *      object-type / record-less query so a NULL-compare never spuriously matches).
+ *    ≥1 matching row ⇒ mapped to a {@link CrossTenantGrant} (first match). No matching row ⇒
+ *    `null` (a NORMAL data-absence — no active consent — NOT an error, NOT a lockout).
+ *
+ * ── SCOPE + RECORD-ID HANDLING: `object_type` rows are always eligible; a `record` row is
+ *    eligible ONLY when `query.recordId` is present AND equals `ctg_record_uuid`. When the
+ *    query has NO recordId (an object-type-level question), the SQL restricts to
+ *    `ctg_scope = 'object_type'` so a record row's `ctg_record_uuid` is never compared to a
+ *    bound NULL (which would never match — but we make the intent explicit and avoid the
+ *    accidental all-records reach a `record_uuid = NULL` OR-branch could imply).
+ *
+ * ── ACTION CEILING PARSING: `ctg_allowed_actions` is a JSON column (a JSON array of action-key
+ *    strings). ⚠️ The mariadb driver AUTO-PARSES a JSON column into a JS ARRAY on read, so the
+ *    cell arrives already-parsed — `parseAllowedActions` accepts BOTH an already-parsed array
+ *    (production) and a JSON string (test mocks). A malformed/empty value ⇒ `[]` (an empty
+ *    ceiling permits nothing — fail-closed; core's ceiling check then denies).
+ *
+ * ── EXPIRY (MUST-FIX #1 — timezone immunity): `ctg_expires_at_ms` is a BIGINT epoch-ms column
+ *    (NOT a TIMESTAMP). The active-grant filter compares it `> ?` against a BOUND integer (the
+ *    adapter's `now()` epoch-ms), so it is immune to host-timezone / `NOW()` wall-clock skew (a
+ *    TIMESTAMP + `NOW()` comparison silently kept expired grants alive on a non-UTC host). Mirrors
+ *    the reset-token store's `prt_expires_at_ms` BIGINT precedent.
+ *
+ * ── EMPTY roleIds: guarded — an empty role list must NOT emit `IN ()` (a MariaDB syntax
+ *    error). We omit the role branch entirely when there are no roles, so a role-less grantee
+ *    is matched by its user-grant rows alone.
+ *
+ * ── ADR-0016 (transient-vs-deny): a genuine store outage THROWS
+ *    {@link AuthorizationUnavailableError} (→ 503 retryable) — NEVER a silent `null` that
+ *    would mask an outage as "no grant".
+ *
+ * ── SAFETY: every value (owningTenantId, typeKey, grantee, each roleId, recordId) is BOUND
+ *    as a `?` param — NEVER interpolated. A SQL payload in typeKey/recordId is data, not SQL.
+ *    Mirrors {@link MariaDbRecordShareAdapter}.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbCrossTenantGrantAdapter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = void 0;
+const core_1 = require("@astram/core");
+/** The DI token the adapter is bound under (parity with the share/rule-port tokens). */
+exports.SHIELD_CROSS_TENANT_GRANT_PORT = Symbol('SHIELD_CROSS_TENANT_GRANT_PORT');
+/** Schema the `cross_tenant_grant` table lives in (astram3 ships the migration). */
+const DEFAULT_SCHEMA = 'shield_authz';
+/**
+ * Parse `ctg_allowed_actions` to a `string[]`. ⚠️ The `ctg_allowed_actions` column is a JSON
+ * column, and the mariadb driver AUTO-PARSES it into a JS ARRAY on read — so `raw` is ALREADY an
+ * array in production. A test mock, however, may hand back a JSON STRING. This helper accepts
+ * BOTH:
+ *   • already-parsed array ⇒ filter to strings, return directly (NO `JSON.parse` — parsing an
+ *     array throws, which is exactly the bug that collapsed every ceiling to `[]`);
+ *   • non-empty string ⇒ `JSON.parse`, then filter to strings;
+ *   • anything else (null / empty / non-array-non-string / malformed) ⇒ `[]`.
+ * Non-string members are dropped (fail-closed — a hostile array can never widen the ceiling); an
+ * empty ceiling permits nothing.
+ */
+function parseAllowedActions(raw) {
+    // Production path: the driver already parsed the JSON column into an array.
+    if (Array.isArray(raw)) {
+        return raw.filter((a) => typeof a === 'string');
+    }
+    // Mock / legacy path: a JSON string. Empty/null ⇒ empty ceiling.
+    if (typeof raw === 'string' && raw.length > 0) {
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return [];
+        }
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((a) => typeof a === 'string');
+    }
+    return [];
+}
+/** Coerce a BIGINT epoch-ms cell (number | bigint | numeric string | null) to a JS number. */
+function toMs(value) {
+    if (value === null)
+        return 0;
+    const ms = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(ms) ? ms : 0;
+}
+/**
+ * The concrete cross-tenant grant adapter. Answers `findActiveGrant` from `cross_tenant_grant`,
+ * matching user- and role-granted, ACCEPTED, unexpired, unrevoked grants for the owning tenant
+ * + object type (+ record for record-scoped).
+ */
+class MariaDbCrossTenantGrantAdapter {
+    db;
+    schema;
+    now;
+    constructor(db, opts = {}) {
+        this.db = db;
+        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        // The expiry filter binds THIS clock's epoch-ms against the BIGINT `ctg_expires_at_ms`
+        // column — timezone-immune (no Date/`NOW()` skew). Injectable for deterministic tests.
+        this.now = opts.nowMs ?? (() => Date.now());
+    }
+    async findActiveGrant(query) {
+        // Grantee predicate: the user grant OR (only when roles exist) a role grant. The role
+        // branch is OMITTED for an empty role list so we NEVER emit `IN ()` (a syntax error).
+        let granteeSql = `(ctg_grantee_kind = 'user' AND ctg_grantee_uuid = ?)`;
+        const granteeParams = [query.grantee];
+        if (query.roleIds.length > 0) {
+            const placeholders = query.roleIds.map(() => '?').join(', ');
+            granteeSql += ` OR (ctg_grantee_kind = 'role' AND ctg_grantee_uuid IN (${placeholders}))`;
+            granteeParams.push(...query.roleIds);
+        }
+        // Scope predicate. An `object_type` grant always matches this type; a `record` grant
+        // matches ONLY when the query names the exact record. When the query has NO recordId, we
+        // restrict to object_type grants (a record row's record_uuid must never be compared to a
+        // bound NULL — it would not match, but we make the intent explicit + never risk a NULL OR).
+        let scopeSql;
+        const scopeParams = [];
+        if (typeof query.recordId === 'string' && query.recordId.length > 0) {
+            scopeSql = `(ctg_scope = 'object_type' OR (ctg_scope = 'record' AND ctg_record_uuid = ?))`;
+            scopeParams.push(query.recordId);
+        }
+        else {
+            scopeSql = `ctg_scope = 'object_type'`;
+        }
+        // The expiry bound is a BIGINT epoch-ms comparison against a BOUND integer (this clock's
+        // now) — timezone-immune (no `NOW()`/Date wall-clock skew, MUST-FIX #1). Param order matches
+        // the SQL below exactly: owning_tenant, type_key, expiry_now, <grantee params>, <scope params>.
+        const nowMs = this.now();
+        const params = [
+            query.owningTenantId,
+            query.typeKey,
+            nowMs,
+            ...granteeParams,
+            ...scopeParams,
+        ];
+        let rows;
+        try {
+            rows = (await this.db.query(`SELECT ctg_scope, ctg_type_key, ctg_record_uuid, ctg_allowed_actions, ctg_expires_at_ms` +
+                ` FROM \`${this.schema}\`.\`cross_tenant_grant\`` +
+                ` WHERE ctg_owning_tenant_uuid = ?` +
+                `   AND ctg_type_key = ?` +
+                `   AND ctg_status = 'accepted'` +
+                `   AND ctg_revoked_at IS NULL` +
+                `   AND ctg_expires_at_ms > ?` +
+                `   AND (${granteeSql})` +
+                `   AND (${scopeSql})` +
+                // Prefer a record-scoped row over an object_type row when both match, and the
+                // latest-expiring first — deterministic single-match selection.
+                `   ORDER BY (ctg_scope = 'record') DESC, ctg_expires_at_ms DESC` +
+                `   LIMIT 1`, params));
+        }
+        catch (err) {
+            // Genuine store outage — fail closed as retryable (never mask as "no grant").
+            throw new core_1.AuthorizationUnavailableError(`cross_tenant_grant store unavailable for ` +
+                `${query.owningTenantId}:${query.typeKey}:${query.action}: ${err.message}`);
+        }
+        const row = rows[0];
+        if (!row) {
+            // No active consented grant — a NORMAL data-absence (NOT an error). Core reads this as
+            // "no cross-tenant permit" — deny-by-default for the reach.
+            return null;
+        }
+        // Map the row → CrossTenantGrant. Core's grant-evaluator re-checks allowedActions + scope
+        // + expiry; we still filtered status/expiry/revoke/scope in SQL so a revoked/expired/
+        // offered grant is never even returned.
+        const scope = row.ctg_scope === 'record' ? 'record' : 'object_type';
+        const grant = {
+            scope,
+            typeKey: row.ctg_type_key,
+            allowedActions: parseAllowedActions(row.ctg_allowed_actions),
+            // Already epoch-ms (BIGINT column) — just coerce the driver's number/string to a JS number.
+            expiresAtMs: toMs(row.ctg_expires_at_ms),
+            // `recordId` is only present for a record-scoped grant (exactOptionalPropertyTypes:
+            // never write an explicit `undefined` onto the optional field).
+            ...(scope === 'record' && row.ctg_record_uuid !== null
+                ? { recordId: row.ctg_record_uuid }
+                : {}),
+        };
+        return grant;
+    }
+}
+exports.MariaDbCrossTenantGrantAdapter = MariaDbCrossTenantGrantAdapter;

package/dist/authz/mariadb-cross-tenant-grant-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-cross-tenant-grant-adapter.js","sourceRoot":"","sources":["../../src/authz/mariadb-cross-tenant-grant-adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;;;AAQH,uCAA6D;AAE7D,wFAAwF;AAC3E,QAAA,8BAA8B,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAEvF,oFAAoF;AACpF,MAAM,cAAc,GAAG,cAAc,CAAC;AAqBtC;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,4EAA4E;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/D,CAAC;IACD,iEAAiE;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8FAA8F;AAC9F,SAAS,IAAI,CAAC,KAAsC;IAClD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAa,8BAA8B;IACxB,EAAE,CAAiB;IACnB,MAAM,CAAS;IACf,GAAG,CAAe;IAEnC,YAAY,EAAkB,EAAE,OAAkD,EAAE;QAClF,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC5C,uFAAuF;QACvF,uFAAuF;QACvF,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAA4B;QAChD,sFAAsF;QACtF,sFAAsF;QACtF,IAAI,UAAU,GAAG,sDAAsD,CAAC;QACxE,MAAM,aAAa,GAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,UAAU,IAAI,2DAA2D,YAAY,IAAI,CAAC;YAC1F,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,qFAAqF;QACrF,yFAAyF;QACzF,yFAAyF;QACzF,4FAA4F;QAC5F,IAAI,QAAgB,CAAC;QACrB,MAAM,WAAW,GAAc,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,QAAQ,GAAG,+EAA+E,CAAC;YAC3F,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,2BAA2B,CAAC;QACzC,CAAC;QAED,yFAAyF;QACzF,6FAA6F;QAC7F,gGAAgG;QAChG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAc;YACxB,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,OAAO;YACb,KAAK;YACL,GAAG,aAAa;YAChB,GAAG,WAAW;SACf,CAAC;QAEF,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACzB,yFAAyF;gBACvF,WAAW,IAAI,CAAC,MAAM,2BAA2B;gBACjD,mCAAmC;gBACnC,yBAAyB;gBACzB,gCAAgC;gBAChC,+BAA+B;gBAC/B,8BAA8B;gBAC9B,WAAW,UAAU,GAAG;gBACxB,WAAW,QAAQ,GAAG;gBACtB,8EAA8E;gBAC9E,gEAAgE;gBAChE,iEAAiE;gBACjE,YAAY,EACd,MAAM,CACP,CAAe,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,MAAM,IAAI,oCAA6B,CACrC,2CAA2C;gBACzC,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,uFAAuF;YACvF,4DAA4D;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0FAA0F;QAC1F,sFAAsF;QACtF,wCAAwC;QACxC,MAAM,KAAK,GAA0B,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;QAC3F,MAAM,KAAK,GAAqB;YAC9B,KAAK;YACL,OAAO,EAAE,GAAG,CAAC,YAAY;YACzB,cAAc,EAAE,mBAAmB,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC5D,4FAA4F;YAC5F,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACxC,oFAAoF;YACpF,gEAAgE;YAChE,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI;gBACpD,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,eAAe,EAAE;gBACnC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AApGD,wEAoGC"}

package/dist/authz/mariadb-record-rule-adapter.d.ts

@@ -0,0 +1,60 @@
+/**
+ * `MariaDbRecordPermissionRuleAdapter` — the concrete {@link RecordPermissionRulePort}
+ * for `@astram/guard`, backed by the `record_permission_rule` table (design §5.1). It
+ * reads ADMIN rules ONLY and evaluates them for a single record+action, returning the
+ * `{ allow, explicitDeny }` verdict core's record-permit tier composes with the
+ * framework-owned owner BASELINE (design §5.2).
+ *
+ * ── ADMIN-ONLY BY CONSTRUCTION (not by a WHERE filter): the owner/system baselines are
+ *    COMPUTED IN CORE (no rows), so this table is only ever WRITTEN admin-authored rules —
+ *    there is no `provenance` column and every row here is an admin rule. ⚠️ If a future
+ *    change EVER stores non-admin (e.g. `system`) rows in this table, this SELECT MUST add
+ *    a `WHERE rpr_provenance = 'admin'` filter — otherwise a system row would be read as an
+ *    admin rule and could conflict with core's immutable baseline.
+ *
+ * ── WHY HERE, NOT CORE (ADR-0003): the `mariadb` driver is a real runtime dependency;
+ *    core defines only the PORT + the immutable owner baseline. This adapter is INJECTED
+ *    into core's wired decision authority. It uses `@astram/core` TYPES only (erased).
+ *
+ * ── THE MODEL (design §5):
+ *    • The OWNER baseline is CORE's job — it is NOT a row here. This table holds ONLY
+ *      admin-authored rules that WIDEN the baseline (e.g. "Company Admins read all
+ *      inspection_reports") or add explicit DENIES (deny-wins). There is no
+ *      `owner`/`system` subject_kind row.
+ *    • NO applicable admin rule ⇒ `{ allow: false, explicitDeny: false }` — a NORMAL
+ *      data-absence (not a lockout): core's owner baseline still permits the owner. An
+ *      empty table ⇒ owner-only access, exactly the safe default.
+ *    • A matching `allow` rule ⇒ `allow: true`. A matching `deny` rule ⇒
+ *      `explicitDeny: true` (deny-wins; core short-circuits the share on it).
+ *
+ * ── ADR-0016 (transient-vs-deny): a genuine store outage THROWS
+ *    {@link AuthorizationUnavailableError} (→ 503 retryable) — NEVER a silent
+ *    `{allow:false,explicitDeny:false}` that would mask an outage as a deny.
+ *
+ * ── SAFETY: every rule row is matched on `(tenant, type_key, action)` with all values
+ *    BOUND as `?` params (no interpolation). The action match is exact OR the rule's
+ *    wildcard `*`. Field conditions are evaluated in JS against the record attributes
+ *    core supplies (design §11.1 builder shape) — the operator set is a fixed
+ *    allow-list; an unknown operator makes the rule NOT match (fail-closed, never a
+ *    spurious allow).
+ */
+import type { RecordPermissionRulePort, RulePermit, RulePermitInput } from '@astram/core';
+/** The DI token the adapter is bound under (parity with the session store token). */
+export declare const SHIELD_RECORD_RULE_PORT: unique symbol;
+/** The minimal query surface this adapter needs — a `mariadb` Pool satisfies it. */
+export interface RuleQueryable {
+    query(sql: string, params?: readonly unknown[]): Promise<unknown>;
+}
+/**
+ * The concrete admin-rule adapter. Reads ADMIN rules for `(tenant, type_key, action|*)`
+ * and folds them into a `{ allow, explicitDeny }` verdict with deny-wins.
+ */
+export declare class MariaDbRecordPermissionRuleAdapter implements RecordPermissionRulePort {
+    private readonly db;
+    private readonly schema;
+    constructor(db: RuleQueryable, opts?: {
+        schema?: string;
+    });
+    evaluate(input: RulePermitInput): Promise<RulePermit>;
+}
+//# sourceMappingURL=mariadb-record-rule-adapter.d.ts.map

package/dist/authz/mariadb-record-rule-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-record-rule-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-record-rule-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,UAAU,EACV,eAAe,EAChB,MAAM,cAAc,CAAC;AAGtB,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAKzE,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAsED;;;GAGG;AACH,qBAAa,kCAAmC,YAAW,wBAAwB;IACjF,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKvD,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;CAwC5D"}