@astram/guard 0.2.0 → 0.4.0

package/dist/enforcement/classification.decorator.d.ts

@@ -4,22 +4,40 @@
  * Every HTTP handler in Shield must carry a classification. The global
  * enforcement guard (see {@link GlobalEnforcementGuard}) reads these keys and,
  * for any route WITHOUT one, denies the request (deny-by-default). This is the
- * structurally-unavoidable, fail-closed posture ADR-0002 mandates — present from
- * day one, even though the Scaffold stub does not yet consult a real decision
- * authority.
+ * structurally-unavoidable, fail-closed posture ADR-0002 mandates.
+ *
+ * The `@Classified(...)` value now carries the {@link Classification} the guard
+ * maps to a `decide(principal, action, resource, context)` call (the request-auth
+ * layer): `{ typeKey, action }`. A bare string is still accepted (deprecated
+ * back-compat) and treated as `typeKey` with a default `action` of `'access'`.
  */
 export declare const CLASSIFICATION_METADATA: {
     /** Marks a route as an explicit, code-reviewed public opt-out. */
     readonly PUBLIC: "shield:classification:public";
     /**
-     * Marks a route as classified against a permission/tier. In the Scaffold this
-     * is a placeholder value only — a LATER layer (ADR-0004 tiers, ADR-0012
-     * authoring) resolves it to a real decision. Its mere PRESENCE is what the
-     * stub guard checks: a classified route is "declared", an undeclared route is
-     * denied.
+     * Marks a route as classified. The value is a {@link Classification}
+     * (`{ typeKey, action }`) the guard uses to build the `decide()` request; a bare
+     * string is accepted for back-compat (→ `{ typeKey: <string>, action: 'access' }`).
      */
     readonly CLASSIFIED: "shield:classification:classified";
 };
+/**
+ * What a `@Classified` route gates on — the object-type key + the action the
+ * caller is attempting. The guard maps this to the Core `decide()` inputs:
+ * `Action = { key: action }`, `Resource = { level: 'object_type', typeKey,
+ * tenantId: <principal's tenant> }`. Stable keys (never route strings), matching
+ * the Core metadata contract (ADR-0004/ADR-0012).
+ */
+export interface Classification {
+    /** Stable object-type key the action operates on (e.g. `'company'`). */
+    readonly typeKey: string;
+    /** Stable action key (e.g. `'read'`, `'create'`, `'update'`, `'delete'`). */
+    readonly action: string;
+}
+/** Default action when a bare-string `@Classified('typeKey')` is used (back-compat). */
+export declare const DEFAULT_CLASSIFIED_ACTION = "access";
+/** Normalize either form of the decorator value to a {@link Classification}. */
+export declare function normalizeClassification(value: string | Classification | undefined): Classification | null;
 /**
  * `@Public()` — the explicit, deny-by-default opt-OUT (ADR-0002).
  *
@@ -30,12 +48,13 @@ export declare const CLASSIFICATION_METADATA: {
  */
 export declare const Public: () => MethodDecorator & ClassDecorator;
 /**
- * `@Classified(...)` — declare a route's permission/tier classification.
+ * `@Classified({ typeKey, action })` — declare what a route gates on.
  *
- * SCAFFOLD STUB: this only records that the route was classified; it does not
- * yet gate on a real permission. A later authorization layer replaces the stub
- * with an actual decision. Present here so business routes can be authored with
- * the final API shape from the start.
+ * The global enforcement guard reconstructs the caller's `Principal` from the
+ * request's bearer token, builds `Action`/`Resource` from this classification, and
+ * calls the Core `decide()` — allowing the request iff the decision is `allow`
+ * (deny-by-default otherwise). A bare string (`@Classified('company')`) is accepted
+ * for back-compat (→ action `'access'`), but the structured form is preferred.
  */
-export declare const Classified: (classification: string) => MethodDecorator & ClassDecorator;
+export declare const Classified: (classification: string | Classification) => MethodDecorator & ClassDecorator;
 //# sourceMappingURL=classification.decorator.d.ts.map

package/dist/enforcement/classification.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classification.decorator.d.ts","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB;IAClC,kEAAkE;;IAElE;;;;;;OAMG;;CAEK,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,QAAO,eAAe,GAAG,cACO,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,GAAI,gBAAgB,MAAM,KAAG,eAAe,GAAG,cACL,CAAC"}
+{"version":3,"file":"classification.decorator.d.ts","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;IAClC,kEAAkE;;IAElE;;;;OAIG;;CAEK,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,GACzC,cAAc,GAAG,IAAI,CAcvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,QAAO,eAAe,GAAG,cACO,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACrB,gBAAgB,MAAM,GAAG,cAAc,KACtC,eAAe,GAAG,cAC4C,CAAC"}

package/dist/enforcement/classification.decorator.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Classified = exports.Public = exports.CLASSIFICATION_METADATA = void 0;
+exports.Classified = exports.Public = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = void 0;
+exports.normalizeClassification = normalizeClassification;
 const common_1 = require("@nestjs/common");
 /**
  * Route-classification metadata keys (ADR-0002).
@@ -8,22 +9,40 @@ const common_1 = require("@nestjs/common");
  * Every HTTP handler in Shield must carry a classification. The global
  * enforcement guard (see {@link GlobalEnforcementGuard}) reads these keys and,
  * for any route WITHOUT one, denies the request (deny-by-default). This is the
- * structurally-unavoidable, fail-closed posture ADR-0002 mandates — present from
- * day one, even though the Scaffold stub does not yet consult a real decision
- * authority.
+ * structurally-unavoidable, fail-closed posture ADR-0002 mandates.
+ *
+ * The `@Classified(...)` value now carries the {@link Classification} the guard
+ * maps to a `decide(principal, action, resource, context)` call (the request-auth
+ * layer): `{ typeKey, action }`. A bare string is still accepted (deprecated
+ * back-compat) and treated as `typeKey` with a default `action` of `'access'`.
  */
 exports.CLASSIFICATION_METADATA = {
     /** Marks a route as an explicit, code-reviewed public opt-out. */
     PUBLIC: 'shield:classification:public',
     /**
-     * Marks a route as classified against a permission/tier. In the Scaffold this
-     * is a placeholder value only — a LATER layer (ADR-0004 tiers, ADR-0012
-     * authoring) resolves it to a real decision. Its mere PRESENCE is what the
-     * stub guard checks: a classified route is "declared", an undeclared route is
-     * denied.
+     * Marks a route as classified. The value is a {@link Classification}
+     * (`{ typeKey, action }`) the guard uses to build the `decide()` request; a bare
+     * string is accepted for back-compat (→ `{ typeKey: <string>, action: 'access' }`).
      */
     CLASSIFIED: 'shield:classification:classified',
 };
+/** Default action when a bare-string `@Classified('typeKey')` is used (back-compat). */
+exports.DEFAULT_CLASSIFIED_ACTION = 'access';
+/** Normalize either form of the decorator value to a {@link Classification}. */
+function normalizeClassification(value) {
+    if (value === undefined)
+        return null;
+    if (typeof value === 'string') {
+        return value.length > 0 ? { typeKey: value, action: exports.DEFAULT_CLASSIFIED_ACTION } : null;
+    }
+    if (typeof value.typeKey === 'string' &&
+        value.typeKey.length > 0 &&
+        typeof value.action === 'string' &&
+        value.action.length > 0) {
+        return { typeKey: value.typeKey, action: value.action };
+    }
+    return null;
+}
 /**
  * `@Public()` — the explicit, deny-by-default opt-OUT (ADR-0002).
  *
@@ -35,12 +54,13 @@ exports.CLASSIFICATION_METADATA = {
 const Public = () => (0, common_1.SetMetadata)(exports.CLASSIFICATION_METADATA.PUBLIC, true);
 exports.Public = Public;
 /**
- * `@Classified(...)` — declare a route's permission/tier classification.
+ * `@Classified({ typeKey, action })` — declare what a route gates on.
  *
- * SCAFFOLD STUB: this only records that the route was classified; it does not
- * yet gate on a real permission. A later authorization layer replaces the stub
- * with an actual decision. Present here so business routes can be authored with
- * the final API shape from the start.
+ * The global enforcement guard reconstructs the caller's `Principal` from the
+ * request's bearer token, builds `Action`/`Resource` from this classification, and
+ * calls the Core `decide()` — allowing the request iff the decision is `allow`
+ * (deny-by-default otherwise). A bare string (`@Classified('company')`) is accepted
+ * for back-compat (→ action `'access'`), but the structured form is preferred.
  */
 const Classified = (classification) => (0, common_1.SetMetadata)(exports.CLASSIFICATION_METADATA.CLASSIFIED, classification);
 exports.Classified = Classified;

package/dist/enforcement/global-enforcement.guard.d.ts

@@ -1,31 +1,41 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import type { CoreDecisionAuthority } from './core-seam.js';
+import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
 /**
- * Global, fail-closed enforcement guard (ADR-0002).
+ * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
+ * authorization for classified routes.
  *
  * This guard is the SINGLE, structurally-unavoidable point every request passes
- * through. It is bound as an `APP_GUARD` through the ONE registration seam,
- * `ShieldModule.forRoot()` (which composes the internal `EnforcementModule` that
- * holds the sole binding) — NOT opt-in per controller — so no endpoint can escape
- * it. Its posture is **deny-by-default**:
+ * through (bound as the sole `APP_GUARD` via `ShieldModule.forRoot()`). Posture is
+ * **deny-by-default**:
  *
- *   - A route marked `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
- *   - A route marked `@Classified()`  → allowed to PROCEED in the Scaffold stub
- *       (a LATER layer will consult the real Core `DecisionAuthority` here; see
- *       {@link ../enforcement/core-seam.ts}). Its presence proves the route was
- *       declared.
- *   - A route with NO classification  → DENIED (403). A forgotten declaration
- *       locks the door instead of opening it.
+ *   - `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
+ *   - `@Classified({typeKey, action})` → the request-auth path runs:
+ *       1. extract the bearer access token from `Authorization`,
+ *       2. resolve it to a `Principal` (via the {@link SessionTokenBinder}),
+ *       3. build `Action`/`Resource` from the classification,
+ *       4. call the Core `decide()` — ALLOW iff `effect === 'allow'`, else 403.
+ *       No/invalid token → 401 (fail-closed). This replaces the old scaffold stub
+ *       that let classified routes through unconditionally.
+ *   - No classification → DENIED (403). A forgotten declaration locks the door.
  *
- * SCAFFOLD SCOPE: this does not yet perform real authorization. It only proves
- * the fail-closed, globally-unavoidable, deny-by-default seam exists from day
- * one. When the Authorization layer lands, the `@Classified` branch calls the
- * Core decision authority (wired via the core-seam) — the deny-by-default
- * structure here does not change.
+ * OPT-IN / GRACEFUL DEGRADE: the request-auth dependencies (the token binder) exist
+ * only when `auth: true`. When they are ABSENT (enforcement-only, no-`.env` boot),
+ * the guard cannot authenticate a request — so a classified route with the
+ * request-auth path unavailable is DENIED (403), never allowed-through. This keeps
+ * the enforcement-only app booting AND fail-closed: an app that declares classified
+ * routes but hasn't enabled auth gets a clear deny, not a silent open door. (The
+ * decision authority defaults to the deny-by-default stub, so even a wired-but-
+ * unconfigured authority denies.)
  */
 export declare class GlobalEnforcementGuard implements CanActivate {
     private readonly reflector;
-    constructor(reflector: Reflector);
-    canActivate(context: ExecutionContext): boolean;
+    private readonly decisionAuthority?;
+    private readonly tokenBinder?;
+    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    /** The real authorization path for a classified route (fail-closed throughout). */
+    private authorizeClassified;
 }
 //# sourceMappingURL=global-enforcement.guard.d.ts.map

package/dist/enforcement/global-enforcement.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAkC,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAEjD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAsChD"}
+{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAQlF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBANZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAG7C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}

package/dist/enforcement/global-enforcement.guard.js

@@ -8,40 +8,56 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GlobalEnforcementGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const classification_decorator_js_1 = require("./classification.decorator.js");
+const shield_tokens_js_1 = require("../module/shield-tokens.js");
+const tokens_js_1 = require("../request-auth/tokens.js");
+const request_principal_js_1 = require("../request-auth/request-principal.js");
+const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
+const reenroll_allowlist_js_1 = require("./reenroll-allowlist.js");
 /**
- * Global, fail-closed enforcement guard (ADR-0002).
+ * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
+ * authorization for classified routes.
  *
  * This guard is the SINGLE, structurally-unavoidable point every request passes
- * through. It is bound as an `APP_GUARD` through the ONE registration seam,
- * `ShieldModule.forRoot()` (which composes the internal `EnforcementModule` that
- * holds the sole binding) — NOT opt-in per controller — so no endpoint can escape
- * it. Its posture is **deny-by-default**:
+ * through (bound as the sole `APP_GUARD` via `ShieldModule.forRoot()`). Posture is
+ * **deny-by-default**:
  *
- *   - A route marked `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
- *   - A route marked `@Classified()`  → allowed to PROCEED in the Scaffold stub
- *       (a LATER layer will consult the real Core `DecisionAuthority` here; see
- *       {@link ../enforcement/core-seam.ts}). Its presence proves the route was
- *       declared.
- *   - A route with NO classification  → DENIED (403). A forgotten declaration
- *       locks the door instead of opening it.
+ *   - `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
+ *   - `@Classified({typeKey, action})` → the request-auth path runs:
+ *       1. extract the bearer access token from `Authorization`,
+ *       2. resolve it to a `Principal` (via the {@link SessionTokenBinder}),
+ *       3. build `Action`/`Resource` from the classification,
+ *       4. call the Core `decide()` — ALLOW iff `effect === 'allow'`, else 403.
+ *       No/invalid token → 401 (fail-closed). This replaces the old scaffold stub
+ *       that let classified routes through unconditionally.
+ *   - No classification → DENIED (403). A forgotten declaration locks the door.
  *
- * SCAFFOLD SCOPE: this does not yet perform real authorization. It only proves
- * the fail-closed, globally-unavoidable, deny-by-default seam exists from day
- * one. When the Authorization layer lands, the `@Classified` branch calls the
- * Core decision authority (wired via the core-seam) — the deny-by-default
- * structure here does not change.
+ * OPT-IN / GRACEFUL DEGRADE: the request-auth dependencies (the token binder) exist
+ * only when `auth: true`. When they are ABSENT (enforcement-only, no-`.env` boot),
+ * the guard cannot authenticate a request — so a classified route with the
+ * request-auth path unavailable is DENIED (403), never allowed-through. This keeps
+ * the enforcement-only app booting AND fail-closed: an app that declares classified
+ * routes but hasn't enabled auth gets a clear deny, not a silent open door. (The
+ * decision authority defaults to the deny-by-default stub, so even a wired-but-
+ * unconfigured authority denies.)
  */
 let GlobalEnforcementGuard = class GlobalEnforcementGuard {
     reflector;
-    constructor(reflector) {
+    decisionAuthority;
+    tokenBinder;
+    constructor(reflector, decisionAuthority, tokenBinder) {
         this.reflector = reflector;
+        this.decisionAuthority = decisionAuthority;
+        this.tokenBinder = tokenBinder;
     }
-    canActivate(context) {
+    async canActivate(context) {
         // Only HTTP requests are classified here. Non-HTTP contexts (if ever added)
         // must be handled explicitly rather than silently allowed.
         if (context.getType() !== 'http') {
@@ -57,20 +73,87 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         if (isPublic === true) {
             return true;
         }
-        // 2. Classified route → declared. Scaffold stub lets it proceed (a real
-        //    decision authority is wired in a later layer via the core-seam).
-        const classification = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, controller]);
-        if (typeof classification === 'string' && classification.length > 0) {
-            return true;
+        // 2. Classified route → run the request-auth + decide() path.
+        const raw = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, controller]);
+        const classification = (0, classification_decorator_js_1.normalizeClassification)(raw);
+        if (classification !== null) {
+            return this.authorizeClassified(context, classification);
         }
         // 3. No classification at all → DENY (ADR-0002 deny-by-default / fail-closed).
         throw new common_1.ForbiddenException('Shield enforcement: this route carries no access classification. ' +
             'It is denied by default (ADR-0002). Mark it @Public() to opt out, or ' +
             '@Classified(...) to declare its permission.');
     }
+    /** The real authorization path for a classified route (fail-closed throughout). */
+    async authorizeClassified(context, classification) {
+        // Request-auth is only possible when the token binder is wired (auth: true).
+        // Absent → we cannot authenticate the caller → DENY (never allow-through).
+        if (this.tokenBinder === undefined || this.decisionAuthority === undefined) {
+            throw new common_1.ForbiddenException('Shield enforcement: this route is @Classified but request authentication is not ' +
+                "enabled (ShieldModule.forRoot({ auth: true })). It is denied by default.");
+        }
+        const req = context.switchToHttp().getRequest();
+        const authHeader = req?.headers?.['authorization'];
+        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authHeader, this.tokenBinder);
+        if (resolved === null) {
+            // No/invalid/expired token → not authenticated. 401 (distinct from a deny).
+            throw new common_1.UnauthorizedException('Shield enforcement: missing or invalid access token for a classified route.');
+        }
+        const { principal, claims } = resolved;
+        // ENFORCED-RE-ENROLL GATE (spec §4.2): a session established via a recovery-code
+        // login is restricted to the re-secure allowlist until a fresh device is confirmed.
+        // Checked AFTER authentication, BEFORE decide() — a marked session hitting any route
+        // NOT on REENROLL_ALLOWED is 403 `reenrollment_required` (a distinct code the
+        // frontend recognizes → forces the re-enroll screen). Fail-closed: this is an
+        // allowlist, so an unknown/unclassified route with a marked session also 403s. This
+        // runs only on @Classified routes (the @Public re-secure routes self-authenticate
+        // and check nothing here). The classified route being gated here is, by definition,
+        // NOT on the allowlist (the allowlist is @Public), so a marked session is always
+        // denied — the isReenrollAllowed check below is defense-in-depth for a future
+        // classified allowlisted route.
+        if (claims.mustReenroll === true) {
+            const method = req?.method;
+            const url = req?.originalUrl ?? req?.url;
+            if (!(0, reenroll_allowlist_js_1.isReenrollAllowed)(method, url)) {
+                throw new common_1.ForbiddenException({ error: 'reenrollment_required' });
+            }
+        }
+        // Attach the resolved principal so downstream handlers can act as this user.
+        req.principal = principal;
+        // ── ADR-0011 SESSION-FACTS HOT PATH ──────────────────────────────────────────
+        // Enter the per-request session-facts ALS scope with THIS request's cached grants
+        // (from the binding — same bearer token → same principal → same facts) around the
+        // decide() call. The app-owned `SessionFactsReader` (an ALS-backed reader wired into
+        // the decision authority) reads the SAME `SHIELD_SESSION_FACTS_ALS` store inside
+        // decide(), so gate 5 gets these facts and can serve the coarse decision from cache
+        // (no DB reload) when the cached version is still fresh.
+        //
+        // CROSS-PRINCIPAL ISOLATION: `als.run(store, cb)` binds `store` to this async
+        // context and everything decide() awaits, and ONLY that context — a concurrent
+        // request runs its own `run()` with its own store, so getStore() never returns
+        // another request's facts. The store is built HERE from THIS request's claims.
+        //
+        // FAIL-CLOSED: no projector wired / absent / malformed binding → `claims.cachedFacts`
+        // is undefined → the store carries `cachedFacts: null` → gate 5 DB-reloads (today's
+        // behavior). The cache is only ever consulted; it never fabricates a permit.
+        const factsStore = {
+            cachedFacts: claims.cachedFacts ?? null,
+            permissionsVersion: claims.cachedFacts?.permissionsVersion ?? 0,
+        };
+        const decision = await session_facts_als_js_1.SHIELD_SESSION_FACTS_ALS.run(factsStore, () => this.decisionAuthority.decide(principal, { key: classification.action }, { level: 'object_type', typeKey: classification.typeKey, tenantId: principal.tenantId }, { isAuthenticated: true }));
+        if (decision.effect === 'allow') {
+            return true;
+        }
+        // Deny (or any non-allow) → 403. Do NOT leak the reason detail to the caller.
+        throw new common_1.ForbiddenException(`Shield enforcement: access denied for ${classification.action} on ${classification.typeKey}.`);
+    }
 };
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard;
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [core_1.Reflector])
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(shield_tokens_js_1.SHIELD_DECISION_AUTHORITY)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object, Function])
 ], GlobalEnforcementGuard);

package/dist/enforcement/reenroll-allowlist.d.ts

@@ -0,0 +1,49 @@
+/**
+ * REENROLL_ALLOWED — the enforced-re-enroll allowlist (spec §4.2).
+ *
+ * A session established via a recovery-code login carries `mustReenroll: true` in its
+ * bound claims (see {@link import('../request-auth/session-token-binder.js').BoundPrincipalClaims}).
+ * The {@link import('./global-enforcement.guard.js').GlobalEnforcementGuard} restricts
+ * such a session to ONLY the routes below — the minimal set needed to RE-SECURE the
+ * account (add a fresh authenticator device + refresh recovery codes) and to observe
+ * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
+ * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
+ *
+ * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
+ * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
+ * that a re-enrolling user must reach means adding it HERE, deliberately.
+ *
+ * NOTE — allowlisted ≠ gate-clearing (spec §4.3): being on this list only lets the
+ * request THROUGH the gate; it does NOT clear `mustReenroll`. ONLY a successful
+ * `POST /account/mfa/devices/confirm` clears the flag (the account controller calls
+ * `binder.clearReenroll`). Regenerating codes is allowed but does not re-secure.
+ */
+/** One allowlisted route: an HTTP method + the path SUFFIX it must end with. */
+export interface ReenrollAllowedRoute {
+    readonly method: string;
+    /** The route path (no query string, no trailing slash), matched by suffix. */
+    readonly path: string;
+}
+/**
+ * The allowlist (spec §4.2). Paths are the framework-owned route paths; matched
+ * robustly by method + normalized-path suffix (see {@link isReenrollAllowed}) so a
+ * future global prefix, a trailing slash, or a query string never defeats the match.
+ */
+export declare const REENROLL_ALLOWED: readonly ReenrollAllowedRoute[];
+/**
+ * Normalize a raw request path for matching: drop the query string and any fragment,
+ * collapse a trailing slash (except the root). Never throws.
+ */
+export declare function normalizeRequestPath(rawUrl: unknown): string;
+/**
+ * True iff the (method, path) is on the enforced-re-enroll allowlist. Matching is
+ * case-insensitive on the method and SUFFIX-based on the normalized path — so
+ * `/api/account/mfa/devices/confirm` (a prefixed mount) still matches
+ * `/account/mfa/devices/confirm`. The path boundary is inherent: every `route.path`
+ * BEGINS with `/`, so `endsWith(route.path)` cannot spuriously match a longer segment
+ * name (`/evilaccount/...` does NOT end with `/account/...` — there is no `/` before
+ * `account`). `/account/mfa/devices/confirm-evil` also fails (its suffix is `confirm-evil`,
+ * not `/confirm`).
+ */
+export declare function isReenrollAllowed(method: unknown, rawUrl: unknown): boolean;
+//# sourceMappingURL=reenroll-allowlist.d.ts.map

package/dist/enforcement/reenroll-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reenroll-allowlist.d.ts","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAO1D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAU3E"}

package/dist/enforcement/reenroll-allowlist.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * REENROLL_ALLOWED — the enforced-re-enroll allowlist (spec §4.2).
+ *
+ * A session established via a recovery-code login carries `mustReenroll: true` in its
+ * bound claims (see {@link import('../request-auth/session-token-binder.js').BoundPrincipalClaims}).
+ * The {@link import('./global-enforcement.guard.js').GlobalEnforcementGuard} restricts
+ * such a session to ONLY the routes below — the minimal set needed to RE-SECURE the
+ * account (add a fresh authenticator device + refresh recovery codes) and to observe
+ * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
+ * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
+ *
+ * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
+ * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
+ * that a re-enrolling user must reach means adding it HERE, deliberately.
+ *
+ * NOTE — allowlisted ≠ gate-clearing (spec §4.3): being on this list only lets the
+ * request THROUGH the gate; it does NOT clear `mustReenroll`. ONLY a successful
+ * `POST /account/mfa/devices/confirm` clears the flag (the account controller calls
+ * `binder.clearReenroll`). Regenerating codes is allowed but does not re-secure.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REENROLL_ALLOWED = void 0;
+exports.normalizeRequestPath = normalizeRequestPath;
+exports.isReenrollAllowed = isReenrollAllowed;
+/**
+ * The allowlist (spec §4.2). Paths are the framework-owned route paths; matched
+ * robustly by method + normalized-path suffix (see {@link isReenrollAllowed}) so a
+ * future global prefix, a trailing slash, or a query string never defeats the match.
+ */
+exports.REENROLL_ALLOWED = Object.freeze([
+    { method: 'POST', path: '/account/mfa/devices/begin' },
+    { method: 'POST', path: '/account/mfa/devices/confirm' },
+    { method: 'POST', path: '/account/mfa/recovery-codes/regenerate' },
+    { method: 'GET', path: '/account/mfa/devices' },
+    { method: 'GET', path: '/auth/me' },
+    { method: 'POST', path: '/auth/logout' },
+]);
+/**
+ * Normalize a raw request path for matching: drop the query string and any fragment,
+ * collapse a trailing slash (except the root). Never throws.
+ */
+function normalizeRequestPath(rawUrl) {
+    if (typeof rawUrl !== 'string' || rawUrl.length === 0)
+        return '';
+    // Strip query (?...) and fragment (#...).
+    let path = rawUrl.split('?', 1)[0].split('#', 1)[0];
+    // Collapse a single trailing slash (but keep the root "/").
+    if (path.length > 1 && path.endsWith('/'))
+        path = path.slice(0, -1);
+    return path;
+}
+/**
+ * True iff the (method, path) is on the enforced-re-enroll allowlist. Matching is
+ * case-insensitive on the method and SUFFIX-based on the normalized path — so
+ * `/api/account/mfa/devices/confirm` (a prefixed mount) still matches
+ * `/account/mfa/devices/confirm`. The path boundary is inherent: every `route.path`
+ * BEGINS with `/`, so `endsWith(route.path)` cannot spuriously match a longer segment
+ * name (`/evilaccount/...` does NOT end with `/account/...` — there is no `/` before
+ * `account`). `/account/mfa/devices/confirm-evil` also fails (its suffix is `confirm-evil`,
+ * not `/confirm`).
+ */
+function isReenrollAllowed(method, rawUrl) {
+    if (typeof method !== 'string')
+        return false;
+    const m = method.toUpperCase();
+    const path = normalizeRequestPath(rawUrl);
+    if (path === '')
+        return false;
+    for (const route of exports.REENROLL_ALLOWED) {
+        if (route.method !== m)
+            continue;
+        if (path === route.path || path.endsWith(route.path))
+            return true;
+    }
+    return false;
+}

package/dist/index.d.ts

@@ -14,21 +14,53 @@
  * Depends on `@astram/core` (workspace); PEER-depends on `@nestjs/common`,
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
-export { ShieldModule, SHIELD_DECISION_AUTHORITY, type ShieldModuleOptions, type ShieldModuleAsyncOptions, } from './module/shield.module.js';
-export { Public, Classified, CLASSIFICATION_METADATA, } from './enforcement/classification.decorator.js';
+export { ShieldModule, SHIELD_DECISION_AUTHORITY, type ShieldModuleOptions, type ShieldModuleAsyncOptions, type RecordAuthorizationInputs, } from './module/shield.module.js';
+export { Public, Classified, CLASSIFICATION_METADATA, DEFAULT_CLASSIFIED_ACTION, normalizeClassification, } from './enforcement/classification.decorator.js';
+export type { Classification } from './enforcement/classification.decorator.js';
+export { OperationInventoryScanner } from './completeness/operation-inventory-scanner.js';
+export { CatalogReconciler, CatalogGatabilityError } from './completeness/catalog-reconciler.js';
+export type { CatalogStore, CatalogPermissionRow, ReconcileReport, } from './completeness/ports/catalog-store.js';
+export { SHIELD_SESSION_TOKEN_BINDER } from './request-auth/tokens.js';
+export { SessionTokenBinder } from './request-auth/session-token-binder.js';
+export type { BoundPrincipalClaims } from './request-auth/session-token-binder.js';
+export { resolveRequestPrincipal, principalFromClaims, extractBearerToken, } from './request-auth/request-principal.js';
+export { SHIELD_SESSION_FACTS_ALS, NO_SESSION_FACTS, type SessionFactsStore, } from './request-auth/session-facts-als.js';
 export { GlobalEnforcementGuard } from './enforcement/global-enforcement.guard.js';
 export { stubDecisionAuthority, type Effect, type CoreDecisionAuthority, type CoreDecision, type Principal, } from './enforcement/core-seam.js';
 export { Argon2idPasswordHasher, argon2idHasherProvider, SHIELD_PASSWORD_HASHER, type Argon2idParams, } from './authentication/argon2id-password-hasher.js';
 export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, } from './session/index.js';
+export { MariaDbRecordPermissionRuleAdapter, SHIELD_RECORD_RULE_PORT, type RuleQueryable, } from './authz/mariadb-record-rule-adapter.js';
+export { MariaDbRecordShareAdapter, SHIELD_RECORD_SHARE_PORT, type ShareQueryable, } from './authz/mariadb-record-share-adapter.js';
+export { RecordShareWriter, SHIELD_RECORD_SHARE_WRITER, ShareNotPermittedError, ShareStoreUnavailableError, type ShareInput, type ShareGranteeKind, type ShareTypeInfo, type ShareTypeResolver, type ShareAuditEvent, type ShareAuditSink, } from './authz/record-share-writer.js';
+export { makeShareDeleteCascade, type RecordDeletedHook, type ShareQueryFn, } from './authz/record-share-cascade.js';
+export { MariaDbCrossTenantGrantAdapter, SHIELD_CROSS_TENANT_GRANT_PORT, type GrantQueryable, } from './authz/mariadb-cross-tenant-grant-adapter.js';
+export { CrossTenantGrantWriter, SHIELD_CROSS_TENANT_GRANT_WRITER, GrantNotPermittedError, InvalidGrantError, GrantStoreUnavailableError, type GrantAuthorizeFn, type GrantAuditEvent, type GrantAuditSink, type GrantGranteeKind, type GrantScope, type OfferGrantInput, type AcceptGrantInput, type RevokeGrantInput, } from './authz/cross-tenant-grant-writer.js';
+export { ManifestOperationAuthorityAdapter, SHIELD_OPERATION_AUTHORITY_PORT, type OperationManifestEntry, } from './authz/manifest-operation-authority-adapter.js';
+export { buildRecordAuthorization } from './authz/wire-record-authorization.js';
 export { BootSequence, assertPoolBudget } from './boot/boot-sequence.js';
 export { APP_CONFIG } from './config/config.module.js';
 export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, } from './config/app-config.js';
-export { SHIELD_DB_POOL, SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, } from './auth/tokens.js';
+export { SHIELD_DB_POOL, SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
 export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
 export type { SessionView, SessionTokensView, SessionSuccess, LoginRequest, MfaChallengeResponse, LoginResponse, MfaRequest, MfaResponse, RefreshRequest, RefreshResponse, LogoutRequest, LogoutAck, } from './auth/dto.js';
 export { PersistenceModule } from './auth/persistence.module.js';
 export { AuthModule, type AuthModuleOptions } from './auth/auth.module.js';
+export { makeDefaultTotpVerifier, resolveTotpVerifier, hmacSha1 } from './auth/auth.module.js';
 export type { CredentialResolver, ResolvedCredential, RequiredFactor, } from '@astram/core';
+export type { FactorVerifier, FactorVerdict, Credential } from '@astram/core';
+export type { ProfileResolver, CurrentUserProfile, ProfileRole, ProfileTenant, } from './auth/profile-resolver.js';
+export type { CredentialWriter } from './auth/ports/credential-writer.js';
+export type { ResetTokenStore } from './auth/ports/reset-token-store.js';
+export type { EmailSender, EmailMessage } from './auth/ports/email-sender.js';
+export type { RecoveryCodeStore } from './auth/ports/recovery-code-store.js';
+export type { ProfileWriter } from './auth/ports/profile-writer.js';
+export type { SessionSweeper } from './auth/ports/session-sweeper.js';
+export type { MfaDeviceStore, MfaDevice } from './auth/ports/mfa-device-store.js';
+export type { AuditSink, AuthAuditEvent } from './auth/ports/audit-sink.js';
+export type { SessionFactsProjector } from './auth/ports/session-facts-projector.js';
+export { SHIELD_SESSION_FACTS_PROJECTOR } from './auth/tokens.js';
 export { AuthController } from './auth/auth.controller.js';
 export { PendingMfaStore } from './auth/pending-mfa-store.js';
+export { generateTotpSecret, buildOtpauthUri, generateRecoveryCodes, } from './auth/totp-enrollment.js';
+export { AccountController } from './auth/account.controller.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AAUnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAS3E,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAOtB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAMhD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}