@astram/guard 0.2.0 → 0.3.0

package/dist/config/config.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.module.js","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,mDAAgE;AAEhE,mDAAmD;AACtC,QAAA,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAE/C;;;;;;GAMG;AAWI,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAVxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,kBAAU;gBACnB,UAAU,EAAE,GAAc,EAAE,CAAC,IAAA,6BAAa,GAAE;aAC7C;SACF;QACD,OAAO,EAAE,CAAC,kBAAU,CAAC;KACtB,CAAC;GACW,YAAY,CAAG"}

package/dist/enforcement/classification.decorator.d.ts

@@ -4,22 +4,40 @@
  * Every HTTP handler in Shield must carry a classification. The global
  * enforcement guard (see {@link GlobalEnforcementGuard}) reads these keys and,
  * for any route WITHOUT one, denies the request (deny-by-default). This is the
- * structurally-unavoidable, fail-closed posture ADR-0002 mandates — present from
- * day one, even though the Scaffold stub does not yet consult a real decision
- * authority.
+ * structurally-unavoidable, fail-closed posture ADR-0002 mandates.
+ *
+ * The `@Classified(...)` value now carries the {@link Classification} the guard
+ * maps to a `decide(principal, action, resource, context)` call (the request-auth
+ * layer): `{ typeKey, action }`. A bare string is still accepted (deprecated
+ * back-compat) and treated as `typeKey` with a default `action` of `'access'`.
  */
 export declare const CLASSIFICATION_METADATA: {
     /** Marks a route as an explicit, code-reviewed public opt-out. */
     readonly PUBLIC: "shield:classification:public";
     /**
-     * Marks a route as classified against a permission/tier. In the Scaffold this
-     * is a placeholder value only — a LATER layer (ADR-0004 tiers, ADR-0012
-     * authoring) resolves it to a real decision. Its mere PRESENCE is what the
-     * stub guard checks: a classified route is "declared", an undeclared route is
-     * denied.
+     * Marks a route as classified. The value is a {@link Classification}
+     * (`{ typeKey, action }`) the guard uses to build the `decide()` request; a bare
+     * string is accepted for back-compat (→ `{ typeKey: <string>, action: 'access' }`).
      */
     readonly CLASSIFIED: "shield:classification:classified";
 };
+/**
+ * What a `@Classified` route gates on — the object-type key + the action the
+ * caller is attempting. The guard maps this to the Core `decide()` inputs:
+ * `Action = { key: action }`, `Resource = { level: 'object_type', typeKey,
+ * tenantId: <principal's tenant> }`. Stable keys (never route strings), matching
+ * the Core metadata contract (ADR-0004/ADR-0012).
+ */
+export interface Classification {
+    /** Stable object-type key the action operates on (e.g. `'company'`). */
+    readonly typeKey: string;
+    /** Stable action key (e.g. `'read'`, `'create'`, `'update'`, `'delete'`). */
+    readonly action: string;
+}
+/** Default action when a bare-string `@Classified('typeKey')` is used (back-compat). */
+export declare const DEFAULT_CLASSIFIED_ACTION = "access";
+/** Normalize either form of the decorator value to a {@link Classification}. */
+export declare function normalizeClassification(value: string | Classification | undefined): Classification | null;
 /**
  * `@Public()` — the explicit, deny-by-default opt-OUT (ADR-0002).
  *
@@ -30,12 +48,13 @@ export declare const CLASSIFICATION_METADATA: {
  */
 export declare const Public: () => MethodDecorator & ClassDecorator;
 /**
- * `@Classified(...)` — declare a route's permission/tier classification.
+ * `@Classified({ typeKey, action })` — declare what a route gates on.
  *
- * SCAFFOLD STUB: this only records that the route was classified; it does not
- * yet gate on a real permission. A later authorization layer replaces the stub
- * with an actual decision. Present here so business routes can be authored with
- * the final API shape from the start.
+ * The global enforcement guard reconstructs the caller's `Principal` from the
+ * request's bearer token, builds `Action`/`Resource` from this classification, and
+ * calls the Core `decide()` — allowing the request iff the decision is `allow`
+ * (deny-by-default otherwise). A bare string (`@Classified('company')`) is accepted
+ * for back-compat (→ action `'access'`), but the structured form is preferred.
  */
-export declare const Classified: (classification: string) => MethodDecorator & ClassDecorator;
+export declare const Classified: (classification: string | Classification) => MethodDecorator & ClassDecorator;
 //# sourceMappingURL=classification.decorator.d.ts.map

package/dist/enforcement/classification.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classification.decorator.d.ts","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB;IAClC,kEAAkE;;IAElE;;;;;;OAMG;;CAEK,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,QAAO,eAAe,GAAG,cACO,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,GAAI,gBAAgB,MAAM,KAAG,eAAe,GAAG,cACL,CAAC"}
+{"version":3,"file":"classification.decorator.d.ts","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;IAClC,kEAAkE;;IAElE;;;;OAIG;;CAEK,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,GACzC,cAAc,GAAG,IAAI,CAcvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,QAAO,eAAe,GAAG,cACO,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACrB,gBAAgB,MAAM,GAAG,cAAc,KACtC,eAAe,GAAG,cAC4C,CAAC"}

package/dist/enforcement/classification.decorator.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Classified = exports.Public = exports.CLASSIFICATION_METADATA = void 0;
+exports.Classified = exports.Public = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = void 0;
+exports.normalizeClassification = normalizeClassification;
 const common_1 = require("@nestjs/common");
 /**
  * Route-classification metadata keys (ADR-0002).
@@ -8,22 +9,40 @@ const common_1 = require("@nestjs/common");
  * Every HTTP handler in Shield must carry a classification. The global
  * enforcement guard (see {@link GlobalEnforcementGuard}) reads these keys and,
  * for any route WITHOUT one, denies the request (deny-by-default). This is the
- * structurally-unavoidable, fail-closed posture ADR-0002 mandates — present from
- * day one, even though the Scaffold stub does not yet consult a real decision
- * authority.
+ * structurally-unavoidable, fail-closed posture ADR-0002 mandates.
+ *
+ * The `@Classified(...)` value now carries the {@link Classification} the guard
+ * maps to a `decide(principal, action, resource, context)` call (the request-auth
+ * layer): `{ typeKey, action }`. A bare string is still accepted (deprecated
+ * back-compat) and treated as `typeKey` with a default `action` of `'access'`.
  */
 exports.CLASSIFICATION_METADATA = {
     /** Marks a route as an explicit, code-reviewed public opt-out. */
     PUBLIC: 'shield:classification:public',
     /**
-     * Marks a route as classified against a permission/tier. In the Scaffold this
-     * is a placeholder value only — a LATER layer (ADR-0004 tiers, ADR-0012
-     * authoring) resolves it to a real decision. Its mere PRESENCE is what the
-     * stub guard checks: a classified route is "declared", an undeclared route is
-     * denied.
+     * Marks a route as classified. The value is a {@link Classification}
+     * (`{ typeKey, action }`) the guard uses to build the `decide()` request; a bare
+     * string is accepted for back-compat (→ `{ typeKey: <string>, action: 'access' }`).
      */
     CLASSIFIED: 'shield:classification:classified',
 };
+/** Default action when a bare-string `@Classified('typeKey')` is used (back-compat). */
+exports.DEFAULT_CLASSIFIED_ACTION = 'access';
+/** Normalize either form of the decorator value to a {@link Classification}. */
+function normalizeClassification(value) {
+    if (value === undefined)
+        return null;
+    if (typeof value === 'string') {
+        return value.length > 0 ? { typeKey: value, action: exports.DEFAULT_CLASSIFIED_ACTION } : null;
+    }
+    if (typeof value.typeKey === 'string' &&
+        value.typeKey.length > 0 &&
+        typeof value.action === 'string' &&
+        value.action.length > 0) {
+        return { typeKey: value.typeKey, action: value.action };
+    }
+    return null;
+}
 /**
  * `@Public()` — the explicit, deny-by-default opt-OUT (ADR-0002).
  *
@@ -35,12 +54,13 @@ exports.CLASSIFICATION_METADATA = {
 const Public = () => (0, common_1.SetMetadata)(exports.CLASSIFICATION_METADATA.PUBLIC, true);
 exports.Public = Public;
 /**
- * `@Classified(...)` — declare a route's permission/tier classification.
+ * `@Classified({ typeKey, action })` — declare what a route gates on.
  *
- * SCAFFOLD STUB: this only records that the route was classified; it does not
- * yet gate on a real permission. A later authorization layer replaces the stub
- * with an actual decision. Present here so business routes can be authored with
- * the final API shape from the start.
+ * The global enforcement guard reconstructs the caller's `Principal` from the
+ * request's bearer token, builds `Action`/`Resource` from this classification, and
+ * calls the Core `decide()` — allowing the request iff the decision is `allow`
+ * (deny-by-default otherwise). A bare string (`@Classified('company')`) is accepted
+ * for back-compat (→ action `'access'`), but the structured form is preferred.
  */
 const Classified = (classification) => (0, common_1.SetMetadata)(exports.CLASSIFICATION_METADATA.CLASSIFIED, classification);
 exports.Classified = Classified;

package/dist/enforcement/classification.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.decorator.js","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":";;;AA4CA,0DAgBC;AA5DD,2CAA6C;AAE7C;;;;;;;;;;;;GAYG;AACU,QAAA,uBAAuB,GAAG;IACrC,kEAAkE;IAClE,MAAM,EAAE,8BAA8B;IACtC;;;;OAIG;IACH,UAAU,EAAE,kCAAkC;CACtC,CAAC;AAgBX,wFAAwF;AAC3E,QAAA,yBAAyB,GAAG,QAAQ,CAAC;AAElD,gFAAgF;AAChF,SAAgB,uBAAuB,CACrC,KAA0C;IAE1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IACD,IACE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,MAAM,MAAM,GAAG,GAAqC,EAAE,CAC3D,IAAA,oBAAW,EAAC,+BAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AADvC,QAAA,MAAM,UACiC;AAEpD;;;;;;;;GAQG;AACI,MAAM,UAAU,GAAG,CACxB,cAAuC,EACL,EAAE,CACpC,IAAA,oBAAW,EAAC,+BAAuB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;AAHrD,QAAA,UAAU,cAG2C"}

package/dist/enforcement/core-seam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-seam.js","sourceRoot":"","sources":["../../src/enforcement/core-seam.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAqBH;;;;;;;;;;;GAWG;AACU,QAAA,qBAAqB,GAA0B;IAC1D,MAAM;QACJ,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;CACF,CAAC"}

package/dist/enforcement/enforcement.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.module.js","sourceRoot":"","sources":["../../src/enforcement/enforcement.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,uCAAyC;AACzC,+EAAuE;AAEvE;;;;;;;;;;;;;;GAcG;AASI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IAR7B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,oDAAsB;aACjC;SACF;KACF,CAAC;GACW,iBAAiB,CAAG"}

package/dist/enforcement/global-enforcement.guard.d.ts

@@ -1,31 +1,41 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import type { CoreDecisionAuthority } from './core-seam.js';
+import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
 /**
- * Global, fail-closed enforcement guard (ADR-0002).
+ * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
+ * authorization for classified routes.
  *
  * This guard is the SINGLE, structurally-unavoidable point every request passes
- * through. It is bound as an `APP_GUARD` through the ONE registration seam,
- * `ShieldModule.forRoot()` (which composes the internal `EnforcementModule` that
- * holds the sole binding) — NOT opt-in per controller — so no endpoint can escape
- * it. Its posture is **deny-by-default**:
+ * through (bound as the sole `APP_GUARD` via `ShieldModule.forRoot()`). Posture is
+ * **deny-by-default**:
  *
- *   - A route marked `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
- *   - A route marked `@Classified()`  → allowed to PROCEED in the Scaffold stub
- *       (a LATER layer will consult the real Core `DecisionAuthority` here; see
- *       {@link ../enforcement/core-seam.ts}). Its presence proves the route was
- *       declared.
- *   - A route with NO classification  → DENIED (403). A forgotten declaration
- *       locks the door instead of opening it.
+ *   - `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
+ *   - `@Classified({typeKey, action})` → the request-auth path runs:
+ *       1. extract the bearer access token from `Authorization`,
+ *       2. resolve it to a `Principal` (via the {@link SessionTokenBinder}),
+ *       3. build `Action`/`Resource` from the classification,
+ *       4. call the Core `decide()` — ALLOW iff `effect === 'allow'`, else 403.
+ *       No/invalid token → 401 (fail-closed). This replaces the old scaffold stub
+ *       that let classified routes through unconditionally.
+ *   - No classification → DENIED (403). A forgotten declaration locks the door.
  *
- * SCAFFOLD SCOPE: this does not yet perform real authorization. It only proves
- * the fail-closed, globally-unavoidable, deny-by-default seam exists from day
- * one. When the Authorization layer lands, the `@Classified` branch calls the
- * Core decision authority (wired via the core-seam) — the deny-by-default
- * structure here does not change.
+ * OPT-IN / GRACEFUL DEGRADE: the request-auth dependencies (the token binder) exist
+ * only when `auth: true`. When they are ABSENT (enforcement-only, no-`.env` boot),
+ * the guard cannot authenticate a request — so a classified route with the
+ * request-auth path unavailable is DENIED (403), never allowed-through. This keeps
+ * the enforcement-only app booting AND fail-closed: an app that declares classified
+ * routes but hasn't enabled auth gets a clear deny, not a silent open door. (The
+ * decision authority defaults to the deny-by-default stub, so even a wired-but-
+ * unconfigured authority denies.)
  */
 export declare class GlobalEnforcementGuard implements CanActivate {
     private readonly reflector;
-    constructor(reflector: Reflector);
-    canActivate(context: ExecutionContext): boolean;
+    private readonly decisionAuthority?;
+    private readonly tokenBinder?;
+    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    /** The real authorization path for a classified route (fail-closed throughout). */
+    private authorizeClassified;
 }
 //# sourceMappingURL=global-enforcement.guard.d.ts.map

package/dist/enforcement/global-enforcement.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAkC,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAEjD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAsChD"}
+{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAQlF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBANZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAG7C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}

package/dist/enforcement/global-enforcement.guard.js

@@ -8,40 +8,56 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GlobalEnforcementGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const classification_decorator_js_1 = require("./classification.decorator.js");
+const shield_tokens_js_1 = require("../module/shield-tokens.js");
+const tokens_js_1 = require("../request-auth/tokens.js");
+const request_principal_js_1 = require("../request-auth/request-principal.js");
+const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
+const reenroll_allowlist_js_1 = require("./reenroll-allowlist.js");
 /**
- * Global, fail-closed enforcement guard (ADR-0002).
+ * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
+ * authorization for classified routes.
  *
  * This guard is the SINGLE, structurally-unavoidable point every request passes
- * through. It is bound as an `APP_GUARD` through the ONE registration seam,
- * `ShieldModule.forRoot()` (which composes the internal `EnforcementModule` that
- * holds the sole binding) — NOT opt-in per controller — so no endpoint can escape
- * it. Its posture is **deny-by-default**:
+ * through (bound as the sole `APP_GUARD` via `ShieldModule.forRoot()`). Posture is
+ * **deny-by-default**:
  *
- *   - A route marked `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
- *   - A route marked `@Classified()`  → allowed to PROCEED in the Scaffold stub
- *       (a LATER layer will consult the real Core `DecisionAuthority` here; see
- *       {@link ../enforcement/core-seam.ts}). Its presence proves the route was
- *       declared.
- *   - A route with NO classification  → DENIED (403). A forgotten declaration
- *       locks the door instead of opening it.
+ *   - `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
+ *   - `@Classified({typeKey, action})` → the request-auth path runs:
+ *       1. extract the bearer access token from `Authorization`,
+ *       2. resolve it to a `Principal` (via the {@link SessionTokenBinder}),
+ *       3. build `Action`/`Resource` from the classification,
+ *       4. call the Core `decide()` — ALLOW iff `effect === 'allow'`, else 403.
+ *       No/invalid token → 401 (fail-closed). This replaces the old scaffold stub
+ *       that let classified routes through unconditionally.
+ *   - No classification → DENIED (403). A forgotten declaration locks the door.
  *
- * SCAFFOLD SCOPE: this does not yet perform real authorization. It only proves
- * the fail-closed, globally-unavoidable, deny-by-default seam exists from day
- * one. When the Authorization layer lands, the `@Classified` branch calls the
- * Core decision authority (wired via the core-seam) — the deny-by-default
- * structure here does not change.
+ * OPT-IN / GRACEFUL DEGRADE: the request-auth dependencies (the token binder) exist
+ * only when `auth: true`. When they are ABSENT (enforcement-only, no-`.env` boot),
+ * the guard cannot authenticate a request — so a classified route with the
+ * request-auth path unavailable is DENIED (403), never allowed-through. This keeps
+ * the enforcement-only app booting AND fail-closed: an app that declares classified
+ * routes but hasn't enabled auth gets a clear deny, not a silent open door. (The
+ * decision authority defaults to the deny-by-default stub, so even a wired-but-
+ * unconfigured authority denies.)
  */
 let GlobalEnforcementGuard = class GlobalEnforcementGuard {
     reflector;
-    constructor(reflector) {
+    decisionAuthority;
+    tokenBinder;
+    constructor(reflector, decisionAuthority, tokenBinder) {
         this.reflector = reflector;
+        this.decisionAuthority = decisionAuthority;
+        this.tokenBinder = tokenBinder;
     }
-    canActivate(context) {
+    async canActivate(context) {
         // Only HTTP requests are classified here. Non-HTTP contexts (if ever added)
         // must be handled explicitly rather than silently allowed.
         if (context.getType() !== 'http') {
@@ -57,20 +73,87 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         if (isPublic === true) {
             return true;
         }
-        // 2. Classified route → declared. Scaffold stub lets it proceed (a real
-        //    decision authority is wired in a later layer via the core-seam).
-        const classification = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, controller]);
-        if (typeof classification === 'string' && classification.length > 0) {
-            return true;
+        // 2. Classified route → run the request-auth + decide() path.
+        const raw = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, controller]);
+        const classification = (0, classification_decorator_js_1.normalizeClassification)(raw);
+        if (classification !== null) {
+            return this.authorizeClassified(context, classification);
         }
         // 3. No classification at all → DENY (ADR-0002 deny-by-default / fail-closed).
         throw new common_1.ForbiddenException('Shield enforcement: this route carries no access classification. ' +
             'It is denied by default (ADR-0002). Mark it @Public() to opt out, or ' +
             '@Classified(...) to declare its permission.');
     }
+    /** The real authorization path for a classified route (fail-closed throughout). */
+    async authorizeClassified(context, classification) {
+        // Request-auth is only possible when the token binder is wired (auth: true).
+        // Absent → we cannot authenticate the caller → DENY (never allow-through).
+        if (this.tokenBinder === undefined || this.decisionAuthority === undefined) {
+            throw new common_1.ForbiddenException('Shield enforcement: this route is @Classified but request authentication is not ' +
+                "enabled (ShieldModule.forRoot({ auth: true })). It is denied by default.");
+        }
+        const req = context.switchToHttp().getRequest();
+        const authHeader = req?.headers?.['authorization'];
+        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authHeader, this.tokenBinder);
+        if (resolved === null) {
+            // No/invalid/expired token → not authenticated. 401 (distinct from a deny).
+            throw new common_1.UnauthorizedException('Shield enforcement: missing or invalid access token for a classified route.');
+        }
+        const { principal, claims } = resolved;
+        // ENFORCED-RE-ENROLL GATE (spec §4.2): a session established via a recovery-code
+        // login is restricted to the re-secure allowlist until a fresh device is confirmed.
+        // Checked AFTER authentication, BEFORE decide() — a marked session hitting any route
+        // NOT on REENROLL_ALLOWED is 403 `reenrollment_required` (a distinct code the
+        // frontend recognizes → forces the re-enroll screen). Fail-closed: this is an
+        // allowlist, so an unknown/unclassified route with a marked session also 403s. This
+        // runs only on @Classified routes (the @Public re-secure routes self-authenticate
+        // and check nothing here). The classified route being gated here is, by definition,
+        // NOT on the allowlist (the allowlist is @Public), so a marked session is always
+        // denied — the isReenrollAllowed check below is defense-in-depth for a future
+        // classified allowlisted route.
+        if (claims.mustReenroll === true) {
+            const method = req?.method;
+            const url = req?.originalUrl ?? req?.url;
+            if (!(0, reenroll_allowlist_js_1.isReenrollAllowed)(method, url)) {
+                throw new common_1.ForbiddenException({ error: 'reenrollment_required' });
+            }
+        }
+        // Attach the resolved principal so downstream handlers can act as this user.
+        req.principal = principal;
+        // ── ADR-0011 SESSION-FACTS HOT PATH ──────────────────────────────────────────
+        // Enter the per-request session-facts ALS scope with THIS request's cached grants
+        // (from the binding — same bearer token → same principal → same facts) around the
+        // decide() call. The app-owned `SessionFactsReader` (an ALS-backed reader wired into
+        // the decision authority) reads the SAME `SHIELD_SESSION_FACTS_ALS` store inside
+        // decide(), so gate 5 gets these facts and can serve the coarse decision from cache
+        // (no DB reload) when the cached version is still fresh.
+        //
+        // CROSS-PRINCIPAL ISOLATION: `als.run(store, cb)` binds `store` to this async
+        // context and everything decide() awaits, and ONLY that context — a concurrent
+        // request runs its own `run()` with its own store, so getStore() never returns
+        // another request's facts. The store is built HERE from THIS request's claims.
+        //
+        // FAIL-CLOSED: no projector wired / absent / malformed binding → `claims.cachedFacts`
+        // is undefined → the store carries `cachedFacts: null` → gate 5 DB-reloads (today's
+        // behavior). The cache is only ever consulted; it never fabricates a permit.
+        const factsStore = {
+            cachedFacts: claims.cachedFacts ?? null,
+            permissionsVersion: claims.cachedFacts?.permissionsVersion ?? 0,
+        };
+        const decision = await session_facts_als_js_1.SHIELD_SESSION_FACTS_ALS.run(factsStore, () => this.decisionAuthority.decide(principal, { key: classification.action }, { level: 'object_type', typeKey: classification.typeKey, tenantId: principal.tenantId }, { isAuthenticated: true }));
+        if (decision.effect === 'allow') {
+            return true;
+        }
+        // Deny (or any non-allow) → 403. Do NOT leak the reason detail to the caller.
+        throw new common_1.ForbiddenException(`Shield enforcement: access denied for ${classification.action} on ${classification.typeKey}.`);
+    }
 };
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard;
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [core_1.Reflector])
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(shield_tokens_js_1.SHIELD_DECISION_AUTHORITY)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object, Function])
 ], GlobalEnforcementGuard);

package/dist/enforcement/global-enforcement.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-enforcement.guard.js","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AACzC,+EAIuC;AACvC,iEAAuE;AAEvE,yDAAwE;AAExE,+EAA0E;AAC1E,+EAG8C;AAC9C,mEAA4D;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAEd;IAGA;IAGA;IAPnB,YACmB,SAAoB,EAGpB,iBAAyC,EAGzC,WAAgC;QANhC,cAAS,GAAT,SAAS,CAAW;QAGpB,sBAAiB,GAAjB,iBAAiB,CAAwB;QAGzC,gBAAW,GAAX,WAAW,CAAqB;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,4EAA4E;QAC5E,2DAA2D;QAC3D,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,2BAAkB,CAC1B,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAuB,CAAC,MAAM,EAAE;YACzF,OAAO;YACP,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8DAA8D;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,qDAAuB,CAAC,UAAU,EAClC,CAAC,OAAO,EAAE,UAAU,CAAC,CACtB,CAAC;QACF,MAAM,cAAc,GAAG,IAAA,qDAAuB,EAAC,GAAG,CAAC,CAAC;QACpD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,2BAAkB,CAC1B,mEAAmE;YACjE,uEAAuE;YACvE,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,mBAAmB,CAC/B,OAAyB,EACzB,cAA8B;QAE9B,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC3E,MAAM,IAAI,2BAAkB,CAC1B,kFAAkF;gBAChF,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAMzC,CAAC;QACL,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAkB,EAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,4EAA4E;YAC5E,MAAM,IAAI,8BAAqB,CAC7B,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAEvC,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,8EAA8E;QAC9E,8EAA8E;QAC9E,oFAAoF;QACpF,kFAAkF;QAClF,oFAAoF;QACpF,iFAAiF;QACjF,8EAA8E;QAC9E,gCAAgC;QAChC,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,GAAG,CAAC;YACzC,IAAI,CAAC,IAAA,yCAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,2BAAkB,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAE1B,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,qFAAqF;QACrF,iFAAiF;QACjF,oFAAoF;QACpF,yDAAyD;QACzD,EAAE;QACF,8EAA8E;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,EAAE;QACF,sFAAsF;QACtF,oFAAoF;QACpF,6EAA6E;QAC7E,MAAM,UAAU,GAAsB;YACpC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,kBAAkB,IAAI,CAAC;SAChE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,+CAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CACnE,IAAI,CAAC,iBAAkB,CAAC,MAAM,CAC5B,SAAS,EACT,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,EAC9B,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,EACvF,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8EAA8E;QAC9E,MAAM,IAAI,2BAAkB,CAC1B,yCAAyC,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,OAAO,GAAG,CAC/F,CAAC;IACJ,CAAC;CACF,CAAA;AA7IY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,4CAAyB,CAAC,CAAA;IAEjC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;qCALR,gBAAS;GAF5B,sBAAsB,CA6IlC"}

package/dist/enforcement/reenroll-allowlist.d.ts

@@ -0,0 +1,49 @@
+/**
+ * REENROLL_ALLOWED — the enforced-re-enroll allowlist (spec §4.2).
+ *
+ * A session established via a recovery-code login carries `mustReenroll: true` in its
+ * bound claims (see {@link import('../request-auth/session-token-binder.js').BoundPrincipalClaims}).
+ * The {@link import('./global-enforcement.guard.js').GlobalEnforcementGuard} restricts
+ * such a session to ONLY the routes below — the minimal set needed to RE-SECURE the
+ * account (add a fresh authenticator device + refresh recovery codes) and to observe
+ * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
+ * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
+ *
+ * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
+ * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
+ * that a re-enrolling user must reach means adding it HERE, deliberately.
+ *
+ * NOTE — allowlisted ≠ gate-clearing (spec §4.3): being on this list only lets the
+ * request THROUGH the gate; it does NOT clear `mustReenroll`. ONLY a successful
+ * `POST /account/mfa/devices/confirm` clears the flag (the account controller calls
+ * `binder.clearReenroll`). Regenerating codes is allowed but does not re-secure.
+ */
+/** One allowlisted route: an HTTP method + the path SUFFIX it must end with. */
+export interface ReenrollAllowedRoute {
+    readonly method: string;
+    /** The route path (no query string, no trailing slash), matched by suffix. */
+    readonly path: string;
+}
+/**
+ * The allowlist (spec §4.2). Paths are the framework-owned route paths; matched
+ * robustly by method + normalized-path suffix (see {@link isReenrollAllowed}) so a
+ * future global prefix, a trailing slash, or a query string never defeats the match.
+ */
+export declare const REENROLL_ALLOWED: readonly ReenrollAllowedRoute[];
+/**
+ * Normalize a raw request path for matching: drop the query string and any fragment,
+ * collapse a trailing slash (except the root). Never throws.
+ */
+export declare function normalizeRequestPath(rawUrl: unknown): string;
+/**
+ * True iff the (method, path) is on the enforced-re-enroll allowlist. Matching is
+ * case-insensitive on the method and SUFFIX-based on the normalized path — so
+ * `/api/account/mfa/devices/confirm` (a prefixed mount) still matches
+ * `/account/mfa/devices/confirm`. The path boundary is inherent: every `route.path`
+ * BEGINS with `/`, so `endsWith(route.path)` cannot spuriously match a longer segment
+ * name (`/evilaccount/...` does NOT end with `/account/...` — there is no `/` before
+ * `account`). `/account/mfa/devices/confirm-evil` also fails (its suffix is `confirm-evil`,
+ * not `/confirm`).
+ */
+export declare function isReenrollAllowed(method: unknown, rawUrl: unknown): boolean;
+//# sourceMappingURL=reenroll-allowlist.d.ts.map

package/dist/enforcement/reenroll-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reenroll-allowlist.d.ts","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAO1D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAU3E"}

package/dist/enforcement/reenroll-allowlist.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * REENROLL_ALLOWED — the enforced-re-enroll allowlist (spec §4.2).
+ *
+ * A session established via a recovery-code login carries `mustReenroll: true` in its
+ * bound claims (see {@link import('../request-auth/session-token-binder.js').BoundPrincipalClaims}).
+ * The {@link import('./global-enforcement.guard.js').GlobalEnforcementGuard} restricts
+ * such a session to ONLY the routes below — the minimal set needed to RE-SECURE the
+ * account (add a fresh authenticator device + refresh recovery codes) and to observe
+ * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
+ * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
+ *
+ * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
+ * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
+ * that a re-enrolling user must reach means adding it HERE, deliberately.
+ *
+ * NOTE — allowlisted ≠ gate-clearing (spec §4.3): being on this list only lets the
+ * request THROUGH the gate; it does NOT clear `mustReenroll`. ONLY a successful
+ * `POST /account/mfa/devices/confirm` clears the flag (the account controller calls
+ * `binder.clearReenroll`). Regenerating codes is allowed but does not re-secure.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REENROLL_ALLOWED = void 0;
+exports.normalizeRequestPath = normalizeRequestPath;
+exports.isReenrollAllowed = isReenrollAllowed;
+/**
+ * The allowlist (spec §4.2). Paths are the framework-owned route paths; matched
+ * robustly by method + normalized-path suffix (see {@link isReenrollAllowed}) so a
+ * future global prefix, a trailing slash, or a query string never defeats the match.
+ */
+exports.REENROLL_ALLOWED = Object.freeze([
+    { method: 'POST', path: '/account/mfa/devices/begin' },
+    { method: 'POST', path: '/account/mfa/devices/confirm' },
+    { method: 'POST', path: '/account/mfa/recovery-codes/regenerate' },
+    { method: 'GET', path: '/account/mfa/devices' },
+    { method: 'GET', path: '/auth/me' },
+    { method: 'POST', path: '/auth/logout' },
+]);
+/**
+ * Normalize a raw request path for matching: drop the query string and any fragment,
+ * collapse a trailing slash (except the root). Never throws.
+ */
+function normalizeRequestPath(rawUrl) {
+    if (typeof rawUrl !== 'string' || rawUrl.length === 0)
+        return '';
+    // Strip query (?...) and fragment (#...).
+    let path = rawUrl.split('?', 1)[0].split('#', 1)[0];
+    // Collapse a single trailing slash (but keep the root "/").
+    if (path.length > 1 && path.endsWith('/'))
+        path = path.slice(0, -1);
+    return path;
+}
+/**
+ * True iff the (method, path) is on the enforced-re-enroll allowlist. Matching is
+ * case-insensitive on the method and SUFFIX-based on the normalized path — so
+ * `/api/account/mfa/devices/confirm` (a prefixed mount) still matches
+ * `/account/mfa/devices/confirm`. The path boundary is inherent: every `route.path`
+ * BEGINS with `/`, so `endsWith(route.path)` cannot spuriously match a longer segment
+ * name (`/evilaccount/...` does NOT end with `/account/...` — there is no `/` before
+ * `account`). `/account/mfa/devices/confirm-evil` also fails (its suffix is `confirm-evil`,
+ * not `/confirm`).
+ */
+function isReenrollAllowed(method, rawUrl) {
+    if (typeof method !== 'string')
+        return false;
+    const m = method.toUpperCase();
+    const path = normalizeRequestPath(rawUrl);
+    if (path === '')
+        return false;
+    for (const route of exports.REENROLL_ALLOWED) {
+        if (route.method !== m)
+            continue;
+        if (path === route.path || path.endsWith(route.path))
+            return true;
+    }
+    return false;
+}

package/dist/enforcement/reenroll-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reenroll-allowlist.js","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AA2BH,oDAOC;AAYD,8CAUC;AA/CD;;;;GAIG;AACU,QAAA,gBAAgB,GAAoC,MAAM,CAAC,MAAM,CAAC;IAC7E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE;IAClE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC/C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;IACnC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;CACzC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,MAAe;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,0CAA0C;IAC1C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACtD,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,MAAe,EAAE,MAAe;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,wBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}