@astram/guard 0.2.0 → 0.3.0

package/dist/authz/record-share-writer.js

@@ -0,0 +1,225 @@
+"use strict";
+/**
+ * `RecordShareWriter` — the framework-owned WHO-MAY-SHARE write path (design §6.2, the
+ * KEY NEW INVARIANT of Phase 3). Share CREATION — not just evaluation — is framework-
+ * governed here so a share can NEVER expose data the sharer does not own.
+ *
+ * ⛔ THIS IS NOT A CORE PORT. Share evaluation is a core port ({@link RecordSharePort});
+ *    share CREATION is a guard WRITE path (it needs the `mariadb` driver + the type's
+ *    physical schema, neither of which core may touch — ADR-0003). It lives in guard and
+ *    is exposed as a provider the consumer app calls from its share/unshare surface.
+ *
+ * ── THE BOUND (enforced fail-closed, IN ORDER, BEFORE any INSERT):
+ *    1. The type MUST be `owned`. A non-owned type (system / tenant-scoped-only) has no
+ *       single owner, so there is no "sharer owns it" notion — sharing it is meaningless
+ *       and REJECTED. The writer resolves the type's access posture via the injected
+ *       {@link ShareTypeResolver}; an unknown type / non-owned type ⇒ reject.
+ *    2. The record's OWNER is FETCHED from the DB, TENANT-SCOPED
+ *       (`SELECT owner_col FROM table WHERE pk = ? AND tenant_col = ?`). A row that does
+ *       not exist in the SHARER'S tenant ⇒ reject (no cross-tenant reach, and no existence
+ *       oracle beyond "you can't share it"). ⛔ THE OWNER IS ALWAYS FETCHED — never taken
+ *       from caller input (fetch-then-gate discipline, mirrors the engine's fetch-owner
+ *       stage).
+ *    3. The sharer MUST BE THE OWNER: `fetchedOwner === sharerId` (STRICT, non-empty). A
+ *       non-owner — INCLUDING a grantee who merely received a share — can NEVER share.
+ *       Because only the LITERAL owner passes, re-share by grantees is forbidden BY
+ *       CONSTRUCTION (a grantee's id is not the owner id).
+ *    ⛔ The `sharerId` is the AUTHENTICATED PRINCIPAL'S id — the caller MUST supply it from
+ *       the request principal, NOT from a user-controlled body field. The writer never
+ *       trusts an owner id in `input`; it fetches the owner and compares against `sharerId`.
+ *
+ * ── ON PASS: an IDEMPOTENT INSERT into `record_share` (the UNIQUE index on
+ *    (tenant, type, record, grantee_kind, grantee_uuid, action) makes a repeat share of the
+ *    same tuple a no-op via `INSERT ... ON DUPLICATE KEY UPDATE`). `unshare` DELETEs the
+ *    matching row(s). Every share/unshare emits an audit event via the injected
+ *    {@link ShareAuditSink} (best-effort; a sink error never fails the operation). NO raw
+ *    uuid appears in a human-readable audit MESSAGE — ids ride in structured fields only.
+ *
+ * ── TENANT: every write is stamped with, and scoped to, the SHARER'S tenant. A share for
+ *    a foreign tenant's record is impossible — the owner fetch is tenant-scoped, so a
+ *    record outside the sharer's tenant is "not found" ⇒ rejected at step 2.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecordShareWriter = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = void 0;
+const node_crypto_1 = require("node:crypto");
+/** Schema the `record_share` table lives in (astram3 ships the migration). */
+const DEFAULT_SCHEMA = 'shield_authz';
+/** The DI token the writer is bound under. */
+exports.SHIELD_RECORD_SHARE_WRITER = Symbol('SHIELD_RECORD_SHARE_WRITER');
+/** Thrown when the who-may-share bound rejects a share/unshare (fail-closed). */
+class ShareNotPermittedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ShareNotPermittedError';
+    }
+}
+exports.ShareNotPermittedError = ShareNotPermittedError;
+/** Thrown when the share store genuinely cannot answer/write (transient). */
+class ShareStoreUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ShareStoreUnavailableError';
+    }
+}
+exports.ShareStoreUnavailableError = ShareStoreUnavailableError;
+class RecordShareWriter {
+    db;
+    types;
+    audit;
+    schema;
+    now;
+    constructor(deps) {
+        this.db = deps.db;
+        this.types = deps.types;
+        this.audit = deps.audit;
+        this.schema = deps.schema ?? DEFAULT_SCHEMA;
+        this.now = deps.nowMs ?? (() => Date.now());
+    }
+    /**
+     * Create a share, enforcing the §6.2 who-may-share bound. Idempotent: re-sharing the
+     * same (tenant, type, record, grantee, action) tuple is a no-op (UNIQUE index +
+     * ON DUPLICATE KEY UPDATE). Emits a `share.created` audit event on success.
+     *
+     * @throws {@link ShareNotPermittedError} if the bound rejects (non-owned type, record
+     *   not in the sharer's tenant, or the sharer is not the owner).
+     * @throws {@link ShareStoreUnavailableError} if the store cannot be reached (transient).
+     */
+    async share(input) {
+        await this.assertMayShare(input);
+        try {
+            // Idempotent insert — the UNIQUE index makes a repeat tuple a no-op. rs_granted_by
+            // records the sharer (for the who-may-share audit trail).
+            await this.db.query(`INSERT INTO \`${this.schema}\`.\`record_share\`` +
+                ` (rs_uuid, rs_tenant_uuid, rs_type_key, rs_record_uuid,` +
+                `  rs_grantee_kind, rs_grantee_uuid, rs_action, rs_granted_by)` +
+                ` VALUES (?, ?, ?, ?, ?, ?, ?, ?)` +
+                ` ON DUPLICATE KEY UPDATE rs_granted_by = VALUES(rs_granted_by)`, [
+                (0, node_crypto_1.randomUUID)(),
+                input.tenantId,
+                input.typeKey,
+                input.recordId,
+                input.granteeKind,
+                input.granteeUuid,
+                input.action,
+                input.sharerId,
+            ]);
+        }
+        catch (err) {
+            throw new ShareStoreUnavailableError(`record_share write failed for ${input.typeKey}: ${err.message}`);
+        }
+        await this.emit('share.created', input);
+    }
+    /**
+     * Remove a share. The SAME owner bound applies — only the owner of the record may revoke
+     * a share on it (a grantee cannot unshare a record they don't own). DELETEs the matching
+     * row(s); a no-match delete is a benign no-op. Emits `share.removed` on success.
+     */
+    async unshare(input) {
+        await this.assertMayShare(input);
+        try {
+            await this.db.query(`DELETE FROM \`${this.schema}\`.\`record_share\`` +
+                ` WHERE rs_tenant_uuid = ?` +
+                `   AND rs_type_key = ?` +
+                `   AND rs_record_uuid = ?` +
+                `   AND rs_grantee_kind = ?` +
+                `   AND rs_grantee_uuid = ?` +
+                `   AND rs_action = ?`, [
+                input.tenantId,
+                input.typeKey,
+                input.recordId,
+                input.granteeKind,
+                input.granteeUuid,
+                input.action,
+            ]);
+        }
+        catch (err) {
+            throw new ShareStoreUnavailableError(`record_share delete failed for ${input.typeKey}: ${err.message}`);
+        }
+        await this.emit('share.removed', input);
+    }
+    // --- the bound -------------------------------------------------------------
+    /**
+     * Enforce the §6.2 who-may-share bound (steps 1–3) and return the resolved type info.
+     * Fetches the record owner tenant-scoped and proves `sharerId` owns it. Throws
+     * {@link ShareNotPermittedError} on any failure (fail-closed).
+     */
+    async assertMayShare(input) {
+        // Step 1 — the type must be `owned` (and known).
+        const info = this.types.resolve(input.typeKey);
+        if (!info) {
+            throw new ShareNotPermittedError(`type '${input.typeKey}' is not registered — cannot share.`);
+        }
+        if (info.owned !== true) {
+            throw new ShareNotPermittedError(`type '${input.typeKey}' is not an owned type — only owned records are shareable.`);
+        }
+        // A sharerId is mandatory + non-empty (the authenticated principal).
+        if (typeof input.sharerId !== 'string' || input.sharerId.length === 0) {
+            throw new ShareNotPermittedError(`a non-empty sharerId (the authenticated principal) is required.`);
+        }
+        // Step 2 — FETCH the owner tenant-scoped (never trust caller input). A record absent
+        // from the sharer's tenant ⇒ reject (no cross-tenant, no existence oracle).
+        const owner = await this.fetchOwnerTenantScoped(info, input.recordId, input.tenantId);
+        if (owner === undefined) {
+            throw new ShareNotPermittedError(`record not found in tenant — cannot share.`);
+        }
+        // Step 3 — the sharer MUST BE the owner (strict, non-empty). Grantees never pass.
+        if (owner !== input.sharerId) {
+            throw new ShareNotPermittedError(`only the record owner may share it.`);
+        }
+        return info;
+    }
+    /**
+     * SELECT the owner column for `recordId`, tenant-scoped by `tenantId`. Returns the owner
+     * id string, or `undefined` when the row does not exist in that tenant / the owner is not
+     * a non-empty string (fail-closed — a null/non-string owner never matches a sharerId).
+     */
+    async fetchOwnerTenantScoped(info, recordId, tenantId) {
+        const qualified = this.qualifiedTable(info);
+        let where = `\`${info.pkColumn}\` = ?`;
+        const params = [recordId];
+        if (info.tenantColumn) {
+            where += ` AND \`${info.tenantColumn}\` = ?`;
+            params.push(tenantId);
+        }
+        let rows;
+        try {
+            rows = (await this.db.query(`SELECT \`${info.ownerColumn}\` AS owner_id FROM ${qualified} WHERE ${where} LIMIT 1`, params));
+        }
+        catch (err) {
+            throw new ShareStoreUnavailableError(`owner fetch failed for ${info.table}: ${err.message}`);
+        }
+        const first = rows[0];
+        return first && typeof first.owner_id === 'string' && first.owner_id.length > 0
+            ? first.owner_id
+            : undefined;
+    }
+    qualifiedTable(info) {
+        return info.schema ? `\`${info.schema}\`.\`${info.table}\`` : `\`${info.table}\``;
+    }
+    /** Best-effort audit emission — a sink error is swallowed (never fails the write). */
+    async emit(action, input) {
+        if (!this.audit)
+            return;
+        const event = {
+            type: 'record_share',
+            action,
+            occurredAtMs: this.now(),
+            actorId: input.sharerId,
+            tenantId: input.tenantId,
+            attributes: {
+                typeKey: input.typeKey,
+                recordId: input.recordId,
+                granteeKind: input.granteeKind,
+                granteeUuid: input.granteeUuid,
+                shareAction: input.action,
+            },
+        };
+        try {
+            await this.audit.record(event);
+        }
+        catch {
+            // Best-effort: an audit failure must not fail a legitimate share/unshare.
+        }
+    }
+}
+exports.RecordShareWriter = RecordShareWriter;

package/dist/authz/record-share-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-share-writer.js","sourceRoot":"","sources":["../../src/authz/record-share-writer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;;;AAEH,6CAAyC;AAGzC,8EAA8E;AAC9E,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC,8CAA8C;AACjC,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAoF/E,iFAAiF;AACjF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,6EAA6E;AAC7E,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAOD,MAAa,iBAAiB;IACX,EAAE,CAAiB;IACnB,KAAK,CAAoB;IACzB,KAAK,CAA6B;IAClC,MAAM,CAAS;IACf,GAAG,CAAe;IAEnC,YAAY,IAQX;QACC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,mFAAmF;YACnF,0DAA0D;YAC1D,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,iBAAiB,IAAI,CAAC,MAAM,qBAAqB;gBAC/C,yDAAyD;gBACzD,+DAA+D;gBAC/D,kCAAkC;gBAClC,gEAAgE,EAClE;gBACE,IAAA,wBAAU,GAAE;gBACZ,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,MAAM;gBACZ,KAAK,CAAC,QAAQ;aACf,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,iCAAiC,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAiB;QAC7B,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,iBAAiB,IAAI,CAAC,MAAM,qBAAqB;gBAC/C,2BAA2B;gBAC3B,wBAAwB;gBACxB,2BAA2B;gBAC3B,4BAA4B;gBAC5B,4BAA4B;gBAC5B,sBAAsB,EACxB;gBACE,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,MAAM;aACb,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,kCAAkC,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,KAAiB;QAC5C,iDAAiD;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,sBAAsB,CAC9B,SAAS,KAAK,CAAC,OAAO,qCAAqC,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAC9B,SAAS,KAAK,CAAC,OAAO,4DAA4D,CACnF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,sBAAsB,CAAC,iEAAiE,CAAC,CAAC;QACtG,CAAC;QAED,qFAAqF;QACrF,4EAA4E;QAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAC9B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,sBAAsB,CAC9B,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,sBAAsB,CAClC,IAAmB,EACnB,QAAgB,EAChB,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,KAAK,IAAI,CAAC,QAAQ,QAAQ,CAAC;QACvC,MAAM,MAAM,GAAc,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,IAAI,UAAU,IAAI,CAAC,YAAY,QAAQ,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACzB,YAAY,IAAI,CAAC,WAAW,uBAAuB,SAAS,UAAU,KAAK,UAAU,EACrF,MAAM,CACP,CAAe,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,IAAI,CAAC,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7E,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,IAAmB;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;IACpF,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,IAAI,CAAC,MAAiC,EAAE,KAAiB;QACrE,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,KAAK,GAAoB;YAC7B,IAAI,EAAE,cAAc;YACpB,MAAM;YACN,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,MAAM;aAC1B;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;CACF;AAvMD,8CAuMC"}

package/dist/authz/wire-record-authorization.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `buildRecordAuthorization` — the ONE place the four framework-owned record-tier
+ * guard adapters are constructed and handed to core's `createWiredDecisionAuthority`
+ * (design §9, Phase 5 — "the framework pre-wires").
+ *
+ * ── WHY THIS FILE EXISTS (the record-tier ownership invariant, ADR-0003 / the
+ *    "framework-owns-the-data-layer" initiative): before Phase 5, the CONSUMER app
+ *    hand-constructed `MariaDbRecordPermissionRuleAdapter` / `MariaDbRecordShareAdapter`
+ *    / `MariaDbCrossTenantGrantAdapter` / `ManifestOperationAuthorityAdapter` and called
+ *    core's `createWiredDecisionAuthority` itself. That meant the app COULD swap in a
+ *    fail-OPEN record adapter — the exact hole the initiative closes. Phase 5 moves that
+ *    construction HERE, inside the framework: the app supplies ONLY the DB pool + the two
+ *    app-owned ports (`permissionFacts`, `sessionFacts`) + the module registry + the
+ *    operation-manifest DATA. The four record-tier read adapters are framework-built and
+ *    UN-overridable — a planted fail-open adapter is now impossible.
+ *
+ * ── WHY IT IS NOT STATICALLY IMPORTED BY shield.module.ts (the enforcement-only
+ *    invariant): this file value-imports `@astram/core` (`createWiredDecisionAuthority`)
+ *    and the adapter classes (which themselves value-import core). `shield.module.ts` is
+ *    deliberately kept core-free in its OWN compiled output (see its header) so the
+ *    enforcement-only path is provably free of a top-level `require('@astram/core')`.
+ *    So `shield.module.ts` reaches `buildRecordAuthorization` ONLY through a LAZY dynamic
+ *    import inside the `SHIELD_DECISION_AUTHORITY` async factory — which runs ONLY when a
+ *    consumer opts into `recordAuthorization`. This file (and thus core) loads only then.
+ */
+import type { DecisionAuthority, ModuleRegistry, PermissionFactsPort, SessionFactsReader } from '@astram/core';
+import { type RuleQueryable } from './mariadb-record-rule-adapter.js';
+import { type OperationManifestEntry } from './manifest-operation-authority-adapter.js';
+/**
+ * The pieces a consumer supplies for the framework to build the real record-tier
+ * DecisionAuthority. The app owns ONLY these — the pool, the two app-owned ports, the
+ * module registry, and the operation-manifest DATA. The four record-tier read adapters
+ * are framework-constructed from `pool` and are DELIBERATELY NOT part of this shape
+ * (they cannot be overridden — the Phase-5 acceptance criterion).
+ */
+export interface RecordAuthorizationInputs {
+    /**
+     * The MariaDB pool the three DB-backed record-tier adapters read through. Typed
+     * structurally (`RuleQueryable`: `{ query(sql, params?) }`) — a `mariadb` `Pool`
+     * satisfies it — so the guard module signature does not force a hard `mariadb` type
+     * on consumers that inject a custom queryable. The framework builds the adapters over
+     * THIS pool; the app never constructs them.
+     */
+    readonly pool: RuleQueryable;
+    /** APP-OWNED port: the principal's coarse grants for the object-type gate (gate 5). */
+    readonly permissionFacts: PermissionFactsPort;
+    /** APP-OWNED port: per-request cached session facts (null-slot until the Redis hot path). */
+    readonly sessionFacts: SessionFactsReader;
+    /** APP-OWNED: the module registry (object types + actions + tiers), bridged from the app's registrations. */
+    readonly registry: ModuleRegistry;
+    /**
+     * APP-SUPPLIED DATA (not an adapter): the declared trusted-operation manifest entries.
+     * The framework constructs the `ManifestOperationAuthorityAdapter` over them. Empty
+     * (default) ⇒ every delegation lookup is pass-through (undefined). The app supplies the
+     * ENTRIES; the framework owns the ADAPTER.
+     */
+    readonly operationManifest?: readonly OperationManifestEntry[];
+}
+/**
+ * Construct the four framework-owned record-tier adapters over the supplied pool +
+ * manifest, and return the fully-wired core {@link DecisionAuthority}. Behavior-identical
+ * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
+ * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
+ */
+export declare function buildRecordAuthorization(inputs: RecordAuthorizationInputs): DecisionAuthority;
+//# sourceMappingURL=wire-record-authorization.d.ts.map

package/dist/authz/wire-record-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,yBAAyB,GAAG,iBAAiB,CAmB7F"}

package/dist/authz/wire-record-authorization.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRecordAuthorization = buildRecordAuthorization;
+const core_1 = require("@astram/core");
+const mariadb_record_rule_adapter_js_1 = require("./mariadb-record-rule-adapter.js");
+const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapter.js");
+const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
+const manifest_operation_authority_adapter_js_1 = require("./manifest-operation-authority-adapter.js");
+/**
+ * Construct the four framework-owned record-tier adapters over the supplied pool +
+ * manifest, and return the fully-wired core {@link DecisionAuthority}. Behavior-identical
+ * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
+ * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
+ */
+function buildRecordAuthorization(inputs) {
+    return (0, core_1.createWiredDecisionAuthority)({
+        registry: inputs.registry,
+        permissionFacts: inputs.permissionFacts,
+        sessionFacts: inputs.sessionFacts,
+        // ── The FOUR framework-owned record-tier adapters — constructed HERE, and ONLY here.
+        // Record-permit ADMIN rules over `shield_authz.record_permission_rule` (widen the
+        // core-owned owner baseline, deny-wins). Empty table ⇒ owner-only (NOT a lockout).
+        recordRule: new mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter(inputs.pool),
+        // Per-record SHARE source over `shield_authz.record_share` (widening permit, union
+        // with baseline under deny-wins). No share ⇒ false (baseline still governs).
+        recordShare: new mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter(inputs.pool),
+        // Cross-tenant consented grants over `shield_authz.cross_tenant_grant`. No active
+        // grant ⇒ null (deny-by-default for the cross-tenant reach).
+        crossTenantGrant: new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool),
+        // Delegation / trusted-operation authority over the DECLARED manifest (no DB).
+        // Empty ⇒ pass-through. The app supplies the entries; the framework owns the adapter.
+        operationAuthority: new manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter(inputs.operationManifest ?? []),
+    });
+}

package/dist/authz/wire-record-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-record-authorization.js","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":";;AAgFA,4DAmBC;AApED,uCAA4D;AAC5D,qFAG0C;AAC1C,uFAA8E;AAC9E,mGAAyF;AACzF,uGAGmD;AAiCnD;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,MAAiC;IACxE,OAAO,IAAA,mCAA4B,EAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,sFAAsF;QACtF,kFAAkF;QAClF,mFAAmF;QACnF,UAAU,EAAE,IAAI,mEAAkC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC/D,mFAAmF;QACnF,6EAA6E;QAC7E,WAAW,EAAE,IAAI,2DAAyB,CAAC,MAAM,CAAC,IAAI,CAAC;QACvD,kFAAkF;QAClF,6DAA6D;QAC7D,gBAAgB,EAAE,IAAI,sEAA8B,CAAC,MAAM,CAAC,IAAI,CAAC;QACjE,+EAA+E;QAC/E,sFAAsF;QACtF,kBAAkB,EAAE,IAAI,2EAAiC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC"}

package/dist/boot/boot-sequence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-sequence.js","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAoDA,4CAuBC;AA3ED,2CAAiF;AACjF,iEAAwD;AACxD,2DAAoG;AAEpG;;;;;;;;;;;;;;GAcG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IAC0B;IAAjD,YAAiD,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAAG,CAAC;IAEtE,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACvC,8DAA8D;IAChE,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,yBAAyB;QACrC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAtBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,6BAAU,CAAC,CAAA;;GADpB,YAAY,CAsBxB;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,GAAqB;IACpD,MAAM,CAAC,GAAG,IAAA,kCAAkB,EAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,iCAAiC,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI;YACxE,uEAAuE;YACvE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,eAAe,CAAC,CAAC,mBAAmB,0BAA0B;YAC9D,GAAG,GAAG,CAAC,cAAc,sBAAsB,GAAG,CAAC,OAAO,MAAM;YAC5D,2BAA2B,CAAC,CAAC,oBAAoB,eAAe;YAChE,GAAG,GAAG,CAAC,QAAQ,OAAO,CAAC,CAAC,mBAAmB,MAAM,GAAG,CAAC,cAAc,IAAI;YACvE,4DAA4D;YAC5D,6DAA6D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/boot/boot.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.module.js","sourceRoot":"","sources":["../../src/boot/boot.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,yDAAkD;AAElD;;;;GAIG;AAII,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IAHtB,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,+BAAY,CAAC;KAC1B,CAAC;GACW,UAAU,CAAG"}

package/dist/completeness/catalog-reconciler.d.ts

@@ -0,0 +1,21 @@
+import type { OperationInventory, ModuleRegistry } from '@astram/core';
+import type { CatalogStore, ReconcileReport } from './ports/catalog-store.js';
+/** A @Classified route could not be gated (stranded or key-not-registered). Boot must
+ *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
+export declare class CatalogGatabilityError extends Error {
+    constructor(message: string);
+}
+export declare class CatalogReconciler {
+    /**
+     * BOOT — read-only, fail-closed. Throws if any non-public route is stranded (no key)
+     * or unclassified (declares a key the registry doesn't know). No DB, no writes.
+     */
+    verifyGatable(inventory: OperationInventory, registry: ModuleRegistry): void;
+    /**
+     * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
+     * marks orphaned any stored row with no registered action, reactivates revived ones.
+     * Idempotent. Returns a report for logging + /health/catalog.
+     */
+    reconcile(registry: ModuleRegistry, store: CatalogStore, nowIso: string): Promise<ReconcileReport>;
+}
+//# sourceMappingURL=catalog-reconciler.d.ts.map

package/dist/completeness/catalog-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-reconciler.d.ts","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E;iFACiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAgB5E;;;;OAIG;IACG,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAoCzG"}

package/dist/completeness/catalog-reconciler.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CatalogReconciler = exports.CatalogGatabilityError = void 0;
+// astram-framework/packages/guard/src/completeness/catalog-reconciler.ts
+const core_1 = require("@astram/core");
+/** A @Classified route could not be gated (stranded or key-not-registered). Boot must
+ *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
+class CatalogGatabilityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CatalogGatabilityError';
+    }
+}
+exports.CatalogGatabilityError = CatalogGatabilityError;
+class CatalogReconciler {
+    /**
+     * BOOT — read-only, fail-closed. Throws if any non-public route is stranded (no key)
+     * or unclassified (declares a key the registry doesn't know). No DB, no writes.
+     */
+    verifyGatable(inventory, registry) {
+        const result = (0, core_1.checkCompleteness)(inventory, registry);
+        if (result.strandedOperations.length > 0 || result.unclassifiedOperations.length > 0) {
+            const stranded = result.strandedOperations.map((o) => o.operationId);
+            const unclassified = result.unclassifiedOperations.map((o) => `${o.operationId}${o.declaredPermissionKey ? ` (${o.declaredPermissionKey})` : ''}`);
+            throw new CatalogGatabilityError(`Shield: ${stranded.length} stranded + ${unclassified.length} unclassified route(s) — cannot boot. ` +
+                `Stranded (no @Classified): ${stranded.join(', ') || 'none'}. ` +
+                `Unclassified (key not registered): ${unclassified.join(', ') || 'none'}. ` +
+                `Classify the route or register the action.`);
+        }
+    }
+    /**
+     * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
+     * marks orphaned any stored row with no registered action, reactivates revived ones.
+     * Idempotent. Returns a report for logging + /health/catalog.
+     */
+    async reconcile(registry, store, nowIso) {
+        const stored = await store.listPermissions();
+        const storedByKey = new Map(stored.map((r) => [r.permissionKey, r]));
+        const registered = registry.listActions().filter((a) => a.tier !== 'public');
+        const registeredKeys = new Set(registered.map((a) => a.permissionKey));
+        // code → catalog: add missing rows; revive orphaned-but-now-registered.
+        const added = [];
+        const reactivated = [];
+        for (const a of registered) {
+            const key = a.permissionKey;
+            const existing = storedByKey.get(key);
+            if (!existing) {
+                const inserted = await store.upsertPermission({
+                    permissionKey: key,
+                    moduleKey: a.moduleKey,
+                    typeKey: a.action.typeKey,
+                    action: a.action.actionKey,
+                    label: `${a.action.actionKey} ${a.action.typeKey}`,
+                    tier: a.tier,
+                });
+                if (inserted)
+                    added.push(key);
+            }
+            else if (existing.status === 'orphaned') {
+                reactivated.push(key);
+            }
+        }
+        if (reactivated.length)
+            await store.markActive(reactivated);
+        // catalog → code: mark orphaned any active stored row with no registered action.
+        const orphaned = stored
+            .filter((r) => r.status === 'active' && !registeredKeys.has(r.permissionKey))
+            .map((r) => r.permissionKey);
+        if (orphaned.length)
+            await store.markOrphaned(orphaned);
+        return { added, orphaned, reactivated, at: nowIso };
+    }
+}
+exports.CatalogReconciler = CatalogReconciler;

package/dist/completeness/catalog-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-reconciler.js","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":";;;AAAA,yEAAyE;AACzE,uCAAiD;AAIjD;iFACiF;AACjF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,MAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAA6B,EAAE,QAAwB;QACnE,MAAM,MAAM,GAAG,IAAA,wBAAiB,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACrE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3F,CAAC;YACF,MAAM,IAAI,sBAAsB,CAC9B,WAAW,QAAQ,CAAC,MAAM,eAAe,YAAY,CAAC,MAAM,wCAAwC;gBAClG,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;gBAC/D,sCAAsC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;gBAC3E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,QAAwB,EAAE,KAAmB,EAAE,MAAc;QAC3E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAuB,CAAC,CAAC,CAAC;QAEjF,wEAAwE;QACxE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,aAAuB,CAAC;YACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;oBAC5C,aAAa,EAAE,GAAG;oBAClB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;oBACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;oBAC1B,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClD,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE5D,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;aAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;CACF;AA9DD,8CA8DC"}

package/dist/completeness/operation-inventory-scanner.d.ts

@@ -0,0 +1,17 @@
+import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
+import type { OperationInventory } from '@astram/core';
+/**
+ * Reflects every controller handler at boot and emits an OperationInventory for core's
+ * checkCompleteness. operationId = `${ControllerClass.name}#${method}` (core's contract).
+ * A handler's permissionKey is `${moduleKey}:${typeKey}:${action}` from its @Classified;
+ * @Public handlers carry isPublic:true; an unclassified non-public handler carries no
+ * permissionKey (→ core reports it stranded).
+ */
+export declare class OperationInventoryScanner {
+    private readonly discovery;
+    private readonly scanner;
+    private readonly reflector;
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector);
+    scan(moduleKey: string): OperationInventory;
+}
+//# sourceMappingURL=operation-inventory-scanner.d.ts.map

package/dist/completeness/operation-inventory-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-inventory-scanner.d.ts","sourceRoot":"","sources":["../../src/completeness/operation-inventory-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,KAAK,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AAO5E;;;;;;GAMG;AACH,qBACa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS;IAGvC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB;CAyC5C"}

package/dist/completeness/operation-inventory-scanner.js

@@ -0,0 +1,79 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OperationInventoryScanner = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const core_1 = require("@nestjs/core");
+const core_2 = require("@astram/core");
+const classification_decorator_js_1 = require("../enforcement/classification.decorator.js");
+/**
+ * Reflects every controller handler at boot and emits an OperationInventory for core's
+ * checkCompleteness. operationId = `${ControllerClass.name}#${method}` (core's contract).
+ * A handler's permissionKey is `${moduleKey}:${typeKey}:${action}` from its @Classified;
+ * @Public handlers carry isPublic:true; an unclassified non-public handler carries no
+ * permissionKey (→ core reports it stranded).
+ */
+let OperationInventoryScanner = class OperationInventoryScanner {
+    discovery;
+    scanner;
+    reflector;
+    constructor(discovery, scanner, reflector) {
+        this.discovery = discovery;
+        this.scanner = scanner;
+        this.reflector = reflector;
+    }
+    scan(moduleKey) {
+        const operations = [];
+        for (const wrapper of this.discovery.getControllers()) {
+            const { instance, metatype } = wrapper;
+            if (!instance || !metatype)
+                continue;
+            const controllerName = metatype.name;
+            const prototype = Object.getPrototypeOf(instance);
+            for (const method of this.scanner.getAllMethodNames(prototype)) {
+                const handler = prototype[method];
+                // Only real HTTP route handlers carry route metadata (set by @Get/@Post/etc.).
+                // Private/helper methods (e.g. buildQuery()) are emitted by getAllMethodNames but
+                // carry no PATH_METADATA — skipping them prevents core from stranding them and
+                // aborting boot. This matches what the guard actually enforces at runtime, which
+                // only ever runs on mapped handlers via context.getHandler().
+                if (Reflect.getMetadata(constants_1.PATH_METADATA, handler) === undefined)
+                    continue;
+                // Mirror the guard's precedence: method metadata overrides class-level.
+                const isPublic = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.PUBLIC, [
+                    handler,
+                    metatype,
+                ]) === true;
+                const raw = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, metatype]);
+                const classification = (0, classification_decorator_js_1.normalizeClassification)(raw);
+                // Single-source the key format via core's derivePermissionKey (returns the
+                // branded PermissionKey) rather than a hand-built template string.
+                const permissionKey = !isPublic && classification
+                    ? (0, core_2.derivePermissionKey)(moduleKey, classification.typeKey, classification.action)
+                    : undefined;
+                operations.push({
+                    operationId: `${controllerName}#${method}`,
+                    isPublic,
+                    ...(permissionKey ? { permissionKey } : {}),
+                });
+            }
+        }
+        return { operations };
+    }
+};
+exports.OperationInventoryScanner = OperationInventoryScanner;
+exports.OperationInventoryScanner = OperationInventoryScanner = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.MetadataScanner,
+        core_1.Reflector])
+], OperationInventoryScanner);

package/dist/completeness/operation-inventory-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-inventory-scanner.js","sourceRoot":"","sources":["../../src/completeness/operation-inventory-scanner.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,wDAAyD;AACzD,uCAA4E;AAC5E,uCAAmD;AAEnD,4FAIoD;AAEpD;;;;;;GAMG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAEjB;IACA;IACA;IAHnB,YACmB,SAA2B,EAC3B,OAAwB,EACxB,SAAoB;QAFpB,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAiB;QACxB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,IAAI,CAAC,SAAiB;QACpB,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;YACtD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClC,+EAA+E;gBAC/E,kFAAkF;gBAClF,+EAA+E;gBAC/E,iFAAiF;gBACjF,8DAA8D;gBAC9D,IAAI,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,OAAO,CAAC,KAAK,SAAS;oBAAE,SAAS;gBACxE,wEAAwE;gBACxE,MAAM,QAAQ,GACZ,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAuB,CAAC,MAAM,EAAE;oBACxE,OAAO;oBACP,QAAQ;iBACT,CAAC,KAAK,IAAI,CAAC;gBACd,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,qDAAuB,CAAC,UAAU,EAClC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;gBACF,MAAM,cAAc,GAAG,IAAA,qDAAuB,EAAC,GAAG,CAAC,CAAC;gBACpD,2EAA2E;gBAC3E,mEAAmE;gBACnE,MAAM,aAAa,GACjB,CAAC,QAAQ,IAAI,cAAc;oBACzB,CAAC,CAAC,IAAA,0BAAmB,EAAC,SAAS,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;oBAC/E,CAAC,CAAC,SAAS,CAAC;gBAChB,UAAU,CAAC,IAAI,CAAC;oBACd,WAAW,EAAE,GAAG,cAAc,IAAI,MAAM,EAAE;oBAC1C,QAAQ;oBACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;CACF,CAAA;AAhDY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAGmB,uBAAgB;QAClB,sBAAe;QACb,gBAAS;GAJ5B,yBAAyB,CAgDrC"}

package/dist/completeness/ports/catalog-store.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The DB seam for the catalog reconciler. The framework defines the interface only;
+ * the consumer app supplies the implementation (ADR-0003 — guard does no DB). A row is
+ * keyed by its permission key (`moduleKey:typeKey:actionKey`); `status` is the soft
+ * active/orphaned marker (never hard-delete).
+ */
+export interface CatalogPermissionRow {
+    readonly permissionKey: string;
+    readonly moduleKey: string;
+    readonly typeKey: string;
+    readonly action: string;
+    readonly label: string;
+    readonly tier: string;
+    readonly status: 'active' | 'orphaned';
+}
+/** The result of one mutating reconcile pass — surfaced via /health/catalog + logged. */
+export interface ReconcileReport {
+    readonly added: readonly string[];
+    readonly orphaned: readonly string[];
+    readonly reactivated: readonly string[];
+    readonly at: string;
+}
+export interface CatalogStore {
+    /** All catalog rows (both active + orphaned). */
+    listPermissions(): Promise<CatalogPermissionRow[]>;
+    /** Idempotent insert of an ACTIVE row (no-op if the key already exists as active). */
+    upsertPermission(row: Omit<CatalogPermissionRow, 'status'>): Promise<boolean>;
+    /** Mark keys orphaned (soft). No-op for keys already orphaned. */
+    markOrphaned(keys: readonly string[]): Promise<void>;
+    /** Flip keys orphaned → active (a route returned). */
+    markActive(keys: readonly string[]): Promise<void>;
+}
+//# sourceMappingURL=catalog-store.d.ts.map

package/dist/completeness/ports/catalog-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-store.d.ts","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnD,sFAAsF;IACtF,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,sDAAsD;IACtD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/completeness/ports/catalog-store.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/completeness/ports/catalog-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-store.js","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":""}

package/dist/config/app-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":";;;AAoMA,wCAuBC;AAgDD,oCAQC;AAOD,0CAaC;AAYD,oDAeC;AAQD,gDAEC;AAiBD,oDASC;AAaD,sCAUC;AA0BD,gDAgBC;AAlRD,wEAAwE;AAC3D,QAAA,mBAAmB,GAAqB;IACnD,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,GAAG;IACnB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE;QACb,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,CAAC;QAClB,iBAAiB,EAAE,CAAC;KACrB;CACF,CAAC;AAEF,gFAAgF;AACnE,QAAA,wBAAwB,GAAG,CAAC,CAAC;AAE1C,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAgB;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACvD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO;QACL,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,mBAAmB,EAAE,2BAAmB,CAAC,OAAO,CAAC;QAC/E,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,yBAAyB,EAC7B,2BAAmB,CAAC,cAAc,CACnC;QACD,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,oBAAoB,EAAE,2BAAmB,CAAC,QAAQ,CAAC;QAClF,aAAa,EAAE;YACb,WAAW,EAAE,gBAAgB,CAC3B,GAAG,CAAC,oBAAoB,EACxB,2BAAmB,CAAC,aAAa,CAAC,WAAW,CAC9C;YACD,eAAe,EAAE,gBAAgB,CAC/B,GAAG,CAAC,wBAAwB,EAC5B,2BAAmB,CAAC,aAAa,CAAC,eAAe,CAClD;YACD,iBAAiB,EAAE,gBAAgB,CACjC,GAAG,CAAC,0BAA0B,EAC9B,2BAAmB,CAAC,aAAa,CAAC,iBAAiB,CACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,8EAA8E;AAE9E,uFAAuF;AAC1E,QAAA,iBAAiB,GAA+B;IAC3D,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,iBAAiB;CAC5B,CAAC;AAEF,6DAA6D;AAChD,QAAA,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,wEAAwE;AACxE,SAAS,WAAW,CAAC,GAAuB,EAAE,QAAgB;IAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,GAAuB;IACvD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC7D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC3D,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC7D,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC;QACjD,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACnC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,yBAAiB,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAIX,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACzE,IAAI,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,SAAS,CAAC,oBAAoB,GAAG,GAAG,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,WAAW,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,+EAA+E;YAC/E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC/B,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC;QACzB,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC;QACrB,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;QAC3B,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACvC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;KACrC,CAAC;AACJ,CAAC;AAsBD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAqB;IACtD,MAAM,oBAAoB,GACxB,GAAG,CAAC,aAAa,CAAC,WAAW;QAC7B,GAAG,CAAC,aAAa,CAAC,eAAe;QACjC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC;IACtC,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,GAAG,oBAAoB,CAAC;IAC9D,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,GAAG,mBAAmB,CAAC;IACvD,OAAO;QACL,oBAAoB;QACpB,kBAAkB;QAClB,mBAAmB;QACnB,KAAK;QACL,YAAY,EAAE,mBAAmB,IAAI,GAAG,CAAC,cAAc;QACvD,sBAAsB,EAAE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,gCAAwB;KACxF,CAAC;AACJ,CAAC"}