@astram/guard 0.2.0 → 0.4.0

package/dist/index.js

@@ -16,7 +16,8 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PendingMfaStore = exports.AuthController = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = void 0;
+exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = void 0;
+exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = void 0;
 // The single registration seam.
 var shield_module_js_1 = require("./module/shield.module.js");
 Object.defineProperty(exports, "ShieldModule", { enumerable: true, get: function () { return shield_module_js_1.ShieldModule; } });
@@ -26,6 +27,38 @@ var classification_decorator_js_1 = require("./enforcement/classification.decora
 Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return classification_decorator_js_1.Public; } });
 Object.defineProperty(exports, "Classified", { enumerable: true, get: function () { return classification_decorator_js_1.Classified; } });
 Object.defineProperty(exports, "CLASSIFICATION_METADATA", { enumerable: true, get: function () { return classification_decorator_js_1.CLASSIFICATION_METADATA; } });
+Object.defineProperty(exports, "DEFAULT_CLASSIFIED_ACTION", { enumerable: true, get: function () { return classification_decorator_js_1.DEFAULT_CLASSIFIED_ACTION; } });
+Object.defineProperty(exports, "normalizeClassification", { enumerable: true, get: function () { return classification_decorator_js_1.normalizeClassification; } });
+// Auto-catalog: boot-time route reflection + catalog reconcile (register a @Classified
+// route → its permission auto-appears; route-less permissions orphaned). The consumer
+// supplies the CatalogStore DB impl (ADR-0003 — guard does no DB).
+var operation_inventory_scanner_js_1 = require("./completeness/operation-inventory-scanner.js");
+Object.defineProperty(exports, "OperationInventoryScanner", { enumerable: true, get: function () { return operation_inventory_scanner_js_1.OperationInventoryScanner; } });
+var catalog_reconciler_js_1 = require("./completeness/catalog-reconciler.js");
+Object.defineProperty(exports, "CatalogReconciler", { enumerable: true, get: function () { return catalog_reconciler_js_1.CatalogReconciler; } });
+Object.defineProperty(exports, "CatalogGatabilityError", { enumerable: true, get: function () { return catalog_reconciler_js_1.CatalogGatabilityError; } });
+// The request-auth layer (access token → Principal → decide()). The binder token is
+// exported so advanced consumers can inspect/override it; `SessionTokenBinder` +
+// `resolveRequestPrincipal` are exported for testing + reuse. The guard wires these
+// internally — a consumer does NOT hand-wire request auth.
+var tokens_js_1 = require("./request-auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_TOKEN_BINDER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SESSION_TOKEN_BINDER; } });
+var session_token_binder_js_1 = require("./request-auth/session-token-binder.js");
+Object.defineProperty(exports, "SessionTokenBinder", { enumerable: true, get: function () { return session_token_binder_js_1.SessionTokenBinder; } });
+var request_principal_js_1 = require("./request-auth/request-principal.js");
+Object.defineProperty(exports, "resolveRequestPrincipal", { enumerable: true, get: function () { return request_principal_js_1.resolveRequestPrincipal; } });
+Object.defineProperty(exports, "principalFromClaims", { enumerable: true, get: function () { return request_principal_js_1.principalFromClaims; } });
+Object.defineProperty(exports, "extractBearerToken", { enumerable: true, get: function () { return request_principal_js_1.extractBearerToken; } });
+// The per-request session-facts hot path (ADR-0011): the SINGLE shared
+// `AsyncLocalStorage` the enforcement guard ENTERS around decide() and the consumer's
+// app-owned `SessionFactsReader` READS. The consumer imports THIS exact singleton to
+// build an ALS-backed reader (swapping the null-facts slot in its authz wiring), so
+// both sides share one instance — the guard writes THIS request's cached grants, the
+// reader serves them to gate 5. `SessionFactsStore` is the store shape (mirrors core's
+// SessionFactsReader 1:1); `NO_SESSION_FACTS` is the fail-closed empty store.
+var session_facts_als_js_1 = require("./request-auth/session-facts-als.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_ALS", { enumerable: true, get: function () { return session_facts_als_js_1.SHIELD_SESSION_FACTS_ALS; } });
+Object.defineProperty(exports, "NO_SESSION_FACTS", { enumerable: true, get: function () { return session_facts_als_js_1.NO_SESSION_FACTS; } });
 // The global enforcement guard (framework-owned; exported so the enforcement
 // point is inspectable/testable, not so consumers re-wire it).
 //
@@ -68,6 +101,83 @@ Object.defineProperty(exports, "systemClockProvider", { enumerable: true, get: f
 Object.defineProperty(exports, "SHIELD_TOKEN_GENERATOR", { enumerable: true, get: function () { return index_js_1.SHIELD_TOKEN_GENERATOR; } });
 Object.defineProperty(exports, "SHIELD_REFRESH_HASHER", { enumerable: true, get: function () { return index_js_1.SHIELD_REFRESH_HASHER; } });
 Object.defineProperty(exports, "SHIELD_CLOCK", { enumerable: true, get: function () { return index_js_1.SHIELD_CLOCK; } });
+// The record-permit ADMIN-rule adapter (ADR-0003 / design §5.1): the concrete
+// `RecordPermissionRulePort` over the `record_permission_rule` table. Reads ADMIN
+// rules only; the framework-owned OWNER baseline is core's job (not a row here). An
+// empty table ⇒ owner-only access (core baseline), NOT a lockout. Injected into core's
+// wired decision authority by the consumer's authz wiring.
+var mariadb_record_rule_adapter_js_1 = require("./authz/mariadb-record-rule-adapter.js");
+Object.defineProperty(exports, "MariaDbRecordPermissionRuleAdapter", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_RULE_PORT", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.SHIELD_RECORD_RULE_PORT; } });
+// The per-record SHARE adapter (ADR-0003 / design §6): the concrete `RecordSharePort` over
+// the `record_share` table. Answers `hasShare` (user- OR role-granted shares, exact-or-`*`
+// action). No share ⇒ false; store outage ⇒ AuthorizationUnavailableError. Injected into
+// core's wired decision authority by the consumer's authz wiring.
+var mariadb_record_share_adapter_js_1 = require("./authz/mariadb-record-share-adapter.js");
+Object.defineProperty(exports, "MariaDbRecordShareAdapter", { enumerable: true, get: function () { return mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_SHARE_PORT", { enumerable: true, get: function () { return mariadb_record_share_adapter_js_1.SHIELD_RECORD_SHARE_PORT; } });
+// The WHO-MAY-SHARE write path (design §6.2, the Phase-3 invariant): share CREATION is
+// framework-bounded — only the record's OWNER (fetched tenant-scoped, never trusted from
+// input) may share an `owned`-type record; non-owners + grantees are rejected by
+// construction. Idempotent INSERT, DELETE on unshare, best-effort audit. Exposed as a
+// provider the consumer's share/unshare surface calls. The consumer supplies a
+// `ShareTypeResolver` (over the engine registry) + an optional `ShareAuditSink` — keeping
+// guard decoupled from `@astram/engine`.
+var record_share_writer_js_1 = require("./authz/record-share-writer.js");
+Object.defineProperty(exports, "RecordShareWriter", { enumerable: true, get: function () { return record_share_writer_js_1.RecordShareWriter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_SHARE_WRITER", { enumerable: true, get: function () { return record_share_writer_js_1.SHIELD_RECORD_SHARE_WRITER; } });
+Object.defineProperty(exports, "ShareNotPermittedError", { enumerable: true, get: function () { return record_share_writer_js_1.ShareNotPermittedError; } });
+Object.defineProperty(exports, "ShareStoreUnavailableError", { enumerable: true, get: function () { return record_share_writer_js_1.ShareStoreUnavailableError; } });
+// The delete-cascade (design §6.2 orphan-share cleanup): builds the guard-owned
+// `(typeKey, recordId, tenantId) => Promise<void>` the consumer wires into the engine's
+// OPTIONAL `onRecordDeleted` hook (the engine never imports guard — ADR-0003). Removes a
+// deleted record's `record_share` rows, tenant-scoped.
+var record_share_cascade_js_1 = require("./authz/record-share-cascade.js");
+Object.defineProperty(exports, "makeShareDeleteCascade", { enumerable: true, get: function () { return record_share_cascade_js_1.makeShareDeleteCascade; } });
+// The CROSS-TENANT GRANT adapter (ADR-0009 / Phase 4): the concrete `CrossTenantGrantPort` over
+// the `cross_tenant_grant` table. Answers `findActiveGrant` — the ONE active (accepted, unexpired,
+// unrevoked) consented grant matching (owning tenant, type, grantee user/role, scope+record). No
+// active grant ⇒ null; store outage ⇒ AuthorizationUnavailableError. Injected into core's wired
+// decision authority by the consumer's authz wiring.
+var mariadb_cross_tenant_grant_adapter_js_1 = require("./authz/mariadb-cross-tenant-grant-adapter.js");
+Object.defineProperty(exports, "MariaDbCrossTenantGrantAdapter", { enumerable: true, get: function () { return mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter; } });
+Object.defineProperty(exports, "SHIELD_CROSS_TENANT_GRANT_PORT", { enumerable: true, get: function () { return mariadb_cross_tenant_grant_adapter_js_1.SHIELD_CROSS_TENANT_GRANT_PORT; } });
+// The WHO-MAY-GRANT lifecycle write path (ADR-0009, the Phase-4 invariant): grant offer/accept/
+// revoke is framework-bounded — only an OWNING-tenant admin may OFFER (the grantee's own tenant
+// can NEVER mint a grant), only a GRANTEE-tenant member may ACCEPT, EITHER side may REVOKE. Hard
+// non-wildcard/non-empty action ceiling + mandatory future expiry enforced at offer. Audit on
+// BOTH tenants (both tenant ids in structured fields, no raw uuid in a message). Exposed as a
+// provider the consumer's grant surface calls. The consumer supplies a `GrantAuthorizeFn`
+// (may this principal perform share/accept/revoke in this tenant? — resolved via the app's own
+// `decide()`) + an optional `GrantAuditSink` — keeping guard decoupled from `@astram/engine` +
+// the app.
+var cross_tenant_grant_writer_js_1 = require("./authz/cross-tenant-grant-writer.js");
+Object.defineProperty(exports, "CrossTenantGrantWriter", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.CrossTenantGrantWriter; } });
+Object.defineProperty(exports, "SHIELD_CROSS_TENANT_GRANT_WRITER", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.SHIELD_CROSS_TENANT_GRANT_WRITER; } });
+Object.defineProperty(exports, "GrantNotPermittedError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.GrantNotPermittedError; } });
+Object.defineProperty(exports, "InvalidGrantError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.InvalidGrantError; } });
+Object.defineProperty(exports, "GrantStoreUnavailableError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.GrantStoreUnavailableError; } });
+// The DELEGATION / trusted-operation authority adapter (ADR-0008 / Phase 4): the concrete
+// `OperationAuthorityPort` over a DECLARED operation manifest (no DB — declared metadata). Answers
+// `resolveDelegatedAuthority` — a scoped, non-wildcard authority for a trusted operation's step,
+// or undefined (pass-through, the common case). A malformed / wildcard declared entry is dropped
+// (fail-closed ⇒ undefined). An EMPTY manifest ⇒ every lookup undefined = pass-through. Injected
+// into core's wired decision authority by the consumer's authz wiring.
+var manifest_operation_authority_adapter_js_1 = require("./authz/manifest-operation-authority-adapter.js");
+Object.defineProperty(exports, "ManifestOperationAuthorityAdapter", { enumerable: true, get: function () { return manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter; } });
+Object.defineProperty(exports, "SHIELD_OPERATION_AUTHORITY_PORT", { enumerable: true, get: function () { return manifest_operation_authority_adapter_js_1.SHIELD_OPERATION_AUTHORITY_PORT; } });
+// The framework-owned record-tier WIRING (design §9, Phase 5): constructs the four
+// record-tier adapters over a supplied pool + manifest and returns the fully-wired core
+// DecisionAuthority. `ShieldModule.forRoot({ recordAuthorization })` uses this internally
+// (the preferred path — the app never touches the adapters). Exported so a consumer's
+// TESTS can build the same wired authority directly from the app-owned inputs WITHOUT
+// re-implementing the adapter construction (the app still cannot substitute a record
+// adapter — it supplies only `RecordAuthorizationInputs`, which is re-exported from the
+// ShieldModule seam above). NOTE: this value-imports `@astram/core` + the adapters;
+// `ShieldModule` itself does NOT import it statically (it lazy-loads it) to keep the
+// enforcement-only path core-free.
+var wire_record_authorization_js_1 = require("./authz/wire-record-authorization.js");
+Object.defineProperty(exports, "buildRecordAuthorization", { enumerable: true, get: function () { return wire_record_authorization_js_1.buildRecordAuthorization; } });
 // Boot infrastructure (ADR-0018 connection-pool budget assertion). `BootModule`
 // itself is NOT exported — it is composed internally by `ShieldModule.forRoot()`.
 var boot_sequence_js_1 = require("./boot/boot-sequence.js");
@@ -106,12 +216,28 @@ Object.defineProperty(exports, "DEFAULT_REDIS_URL", { enumerable: true, get: fun
 // ---------------------------------------------------------------------------
 // Shared DI provider tokens (the seams the teams bind/consume — see tokens.ts for
 // who provides/consumes each).
-var tokens_js_1 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_1.SHIELD_DB_POOL; } });
-Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_1.SHIELD_REDIS; } });
-Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_CREDENTIAL_RESOLVER; } });
-Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_1.SHIELD_AUTHENTICATOR; } });
-Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SESSION_AUTHORITY; } });
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_2.SHIELD_DB_POOL; } });
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUTHENTICATOR; } });
+Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_AUTHORITY; } });
+// Account & credential-surface seams (forgot/reset, change-password, MFA
+// enrollment, profile edit) — all OPTIONAL, consumer-plugged through
+// ShieldModule.forRoot. See tokens.ts for who provides/consumes each.
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_WRITER; } });
+Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RESET_TOKEN_STORE; } });
+Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_EMAIL_SENDER; } });
+Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RECOVERY_CODE_STORE; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_WRITER; } });
+Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_SWEEPER; } });
+// The auth-surface audit sink seam (the first auth audit event — recovery login).
+Object.defineProperty(exports, "SHIELD_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUDIT_SINK; } });
+// The multi-device MFA store seam (multiple independent authenticator devices).
+Object.defineProperty(exports, "SHIELD_MFA_DEVICE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_MFA_DEVICE_STORE; } });
+// The login totp-verifier OVERRIDE seam (Phase 2 — plug an OR-matching verifier).
+Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_TOTP_VERIFIER_OVERRIDE; } });
 // The credential-store contract (skeleton — Team A implements the SELECT).
 var mariadb_credential_resolver_js_1 = require("./authentication/mariadb-credential-resolver.js");
 Object.defineProperty(exports, "MariaDbCredentialResolver", { enumerable: true, get: function () { return mariadb_credential_resolver_js_1.MariaDbCredentialResolver; } });
@@ -122,6 +248,19 @@ var persistence_module_js_1 = require("./auth/persistence.module.js");
 Object.defineProperty(exports, "PersistenceModule", { enumerable: true, get: function () { return persistence_module_js_1.PersistenceModule; } });
 var auth_module_js_1 = require("./auth/auth.module.js");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_js_1.AuthModule; } });
+// Phase-2 verifier-seam helpers. `makeDefaultTotpVerifier()` builds the framework's
+// DEFAULT single-secret TOTP FactorVerifier (loading the ESM-only core factory lazily,
+// the CJS↔ESM invariant) so a CONSUMER can WRAP it (e.g. an OR-matching multi-device
+// verifier delegates to it per device secret) WITHOUT importing `@astram/core`
+// directly. `resolveTotpVerifier(override, default)` is the pure `override ?? default`
+// decision the authenticator composition uses (exported for unit testing the seam).
+// `hmacSha1` is the node:crypto HMAC-SHA1 primitive the core TOTP verifier needs.
+var auth_module_js_2 = require("./auth/auth.module.js");
+Object.defineProperty(exports, "makeDefaultTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.makeDefaultTotpVerifier; } });
+Object.defineProperty(exports, "resolveTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.resolveTotpVerifier; } });
+Object.defineProperty(exports, "hmacSha1", { enumerable: true, get: function () { return auth_module_js_2.hmacSha1; } });
+var tokens_js_3 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_3.SHIELD_SESSION_FACTS_PROJECTOR; } });
 // The framework-owned `/auth/*` HTTP controller (Team C) + its pending-MFA store.
 // The controller CONSUMES SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY and the
 // PendingMfaStore. It is EXPORTED so AuthModule (Team B) / the integration owner
@@ -131,3 +270,16 @@ var auth_controller_js_1 = require("./auth/auth.controller.js");
 Object.defineProperty(exports, "AuthController", { enumerable: true, get: function () { return auth_controller_js_1.AuthController; } });
 var pending_mfa_store_js_1 = require("./auth/pending-mfa-store.js");
 Object.defineProperty(exports, "PendingMfaStore", { enumerable: true, get: function () { return pending_mfa_store_js_1.PendingMfaStore; } });
+// The pure TOTP-enrollment helpers (Phase 4 MFA). Re-exported for consumers/tests
+// that need them; the multi-device MFA routes (Phase 3) reuse them to mint a device
+// secret + provisioning URI + recovery codes. (The old in-memory
+// PendingEnrollmentStore is gone — a pending device is now a row in the MfaDeviceStore.)
+var totp_enrollment_js_1 = require("./auth/totp-enrollment.js");
+Object.defineProperty(exports, "generateTotpSecret", { enumerable: true, get: function () { return totp_enrollment_js_1.generateTotpSecret; } });
+Object.defineProperty(exports, "buildOtpauthUri", { enumerable: true, get: function () { return totp_enrollment_js_1.buildOtpauthUri; } });
+Object.defineProperty(exports, "generateRecoveryCodes", { enumerable: true, get: function () { return totp_enrollment_js_1.generateRecoveryCodes; } });
+// The framework-owned `/account/*` self-scoped HTTP controller — the authenticated
+// user acting on THEIR OWN credential/profile (change-password today; MFA/profile
+// later). Registered by AuthModule alongside AuthController under `auth: true`.
+var account_controller_js_1 = require("./auth/account.controller.js");
+Object.defineProperty(exports, "AccountController", { enumerable: true, get: function () { return account_controller_js_1.AccountController; } });

package/dist/module/shield-tokens.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Framework DI tokens that must be importable WITHOUT pulling in `ShieldModule`
+ * itself (which would create import cycles: `ShieldModule` → `EnforcementModule` →
+ * the guard → back to a token declared in `ShieldModule`). Declaring the shared
+ * tokens here lets both `shield.module.ts` and the enforcement guard depend on them
+ * with no cycle. `shield.module.ts` re-exports these for the public barrel.
+ */
+/**
+ * The Core decision authority (`@astram/core`'s `DecisionAuthority`) — the single
+ * ADR-0001 decision entry both the global enforcement guard and the engine's
+ * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
+ * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ */
+export declare const SHIELD_DECISION_AUTHORITY: unique symbol;
+//# sourceMappingURL=shield-tokens.d.ts.map

package/dist/module/shield-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-tokens.d.ts","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC"}

package/dist/module/shield-tokens.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Framework DI tokens that must be importable WITHOUT pulling in `ShieldModule`
+ * itself (which would create import cycles: `ShieldModule` → `EnforcementModule` →
+ * the guard → back to a token declared in `ShieldModule`). Declaring the shared
+ * tokens here lets both `shield.module.ts` and the enforcement guard depend on them
+ * with no cycle. `shield.module.ts` re-exports these for the public barrel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHIELD_DECISION_AUTHORITY = void 0;
+/**
+ * The Core decision authority (`@astram/core`'s `DecisionAuthority`) — the single
+ * ADR-0001 decision entry both the global enforcement guard and the engine's
+ * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
+ * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ */
+exports.SHIELD_DECISION_AUTHORITY = Symbol('SHIELD_DECISION_AUTHORITY');

package/dist/module/shield.module.d.ts

@@ -1,15 +1,21 @@
 import { type DynamicModule } from '@nestjs/common';
-import type { CredentialResolver } from '@astram/core';
+import type { CredentialResolver, FactorVerifier } from '@astram/core';
+import type { RecordAuthorizationInputs } from '../authz/wire-record-authorization.js';
+import type { ProfileResolver } from '../auth/profile-resolver.js';
+import type { CredentialWriter } from '../auth/ports/credential-writer.js';
+import type { ResetTokenStore } from '../auth/ports/reset-token-store.js';
+import type { EmailSender } from '../auth/ports/email-sender.js';
+import type { RecoveryCodeStore } from '../auth/ports/recovery-code-store.js';
+import type { ProfileWriter } from '../auth/ports/profile-writer.js';
+import type { SessionSweeper } from '../auth/ports/session-sweeper.js';
+import type { MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+import type { AuditSink } from '../auth/ports/audit-sink.js';
+import type { SessionFactsProjector } from '../auth/ports/session-facts-projector.js';
 import type { CoreDecisionAuthority } from '../enforcement/core-seam.js';
 import { type AppConfig } from '../config/app-config.js';
-/**
- * DI token for the Core decision authority (the ADR-0001 single decision
- * authority) that the enforcement guard consults. The consumer supplies the real
- * `@astram/core` authority through {@link ShieldModule.forRoot}; when omitted the
- * framework binds the fail-closed {@link stubDecisionAuthority} (deny-by-default),
- * so a mis-wiring cannot silently open a door.
- */
-export declare const SHIELD_DECISION_AUTHORITY: unique symbol;
+import { SHIELD_DECISION_AUTHORITY } from './shield-tokens.js';
+export { SHIELD_DECISION_AUTHORITY };
+export type { RecordAuthorizationInputs } from '../authz/wire-record-authorization.js';
 /**
  * Options for {@link ShieldModule.forRoot}. Intentionally minimal (ADR-0023 §7 —
  * no speculative abstraction): the consumer declares Shield through this ONE seam.
@@ -22,6 +28,27 @@ export interface ShieldModuleOptions {
      * the real Core authority — the guard's call site does not change.
      */
     readonly decisionAuthority?: CoreDecisionAuthority;
+    /**
+     * ⛔ FRAMEWORK-OWNED RECORD-TIER WIRING (design §9, Phase 5 — the preferred path).
+     *
+     * Supply the PIECES the framework needs to build the real Core decision authority
+     * ITSELF, instead of a pre-built {@link decisionAuthority}. When present, ShieldModule
+     * INTERNALLY constructs the four record-tier adapters
+     * (`MariaDbRecordPermissionRuleAdapter` / `MariaDbRecordShareAdapter` /
+     * `MariaDbCrossTenantGrantAdapter` / `ManifestOperationAuthorityAdapter`) over the
+     * supplied `pool`/`operationManifest` and calls core's `createWiredDecisionAuthority`
+     * with them + the app-owned `permissionFacts` / `sessionFacts` / `registry`.
+     *
+     * The app supplies ONLY: the DB `pool`, the two app-owned ports (`permissionFacts`,
+     * `sessionFacts`), the module `registry`, and the operation-manifest DATA. It CANNOT
+     * supply — or weaken — the four record-tier read adapters: they are framework-owned and
+     * un-overridable BY CONSTRUCTION (a planted fail-open record adapter is impossible —
+     * the whole point of the "framework-owns-the-data-layer" initiative).
+     *
+     * MUTUALLY EXCLUSIVE with {@link decisionAuthority} — supplying BOTH is a misconfig and
+     * throws at registration. Supplying NEITHER binds the fail-closed stub (unchanged).
+     */
+    readonly recordAuthorization?: RecordAuthorizationInputs;
     /**
      * Application config (port/environment/ADR-0018 pool budget). Omit to load from
      * the environment via {@link loadAppConfig}. Supplied here so a consumer can
@@ -41,7 +68,7 @@ export interface ShieldModuleOptions {
      * `true`: imports {@link AuthModule.forRoot} (which pulls the live connections +
      * composes the authenticator + session authority + registers the four `/auth/*`
      * routes) and re-exports {@link SHIELD_AUTHENTICATOR} / {@link SHIELD_SESSION_AUTHORITY}
-     * app-wide. An auth-enabled app fails LOUD at boot if `SHIELD_REFRESH_HMAC_KEY`
+     * app-wide. An auth-enabled app fails LOUD at boot if `REFRESH_HMAC_KEY`
      * is blank — auth can never compose unkeyed.
      */
     readonly auth?: boolean;
@@ -59,6 +86,68 @@ export interface ShieldModuleOptions {
      * (generic 401); throwing = fail-closed transient — exactly the default contract.
      */
     readonly credentialResolver?: CredentialResolver;
+    /**
+     * OPTIONAL current-user profile resolver backing `GET /auth/me`. Omit → `/auth/me`
+     * returns an honest 501 (the framework is agnostic to your ORG schema, so it cannot
+     * name the user/company/roles without your tables). Supply an implementation of the
+     * {@link ProfileResolver} port to return the signed-in user's display profile
+     * (names, never UUIDs). Only consulted when `auth: true`.
+     */
+    readonly profileResolver?: ProfileResolver;
+    /**
+     * OPTIONAL account/credential-surface seams (forgot/reset, change-password, MFA
+     * enrollment, profile edit). Each is threaded straight through to
+     * {@link AuthModule.forRoot} (bound under its token, or `null` when absent → the
+     * route returns 501). Only consulted when `auth: true`. Supply a consumer
+     * implementation of the matching `@astram/guard` port to enable the route.
+     */
+    readonly credentialWriter?: CredentialWriter;
+    readonly resetTokenStore?: ResetTokenStore;
+    readonly emailSender?: EmailSender;
+    readonly recoveryCodeStore?: RecoveryCodeStore;
+    readonly profileWriter?: ProfileWriter;
+    readonly sessionSweeper?: SessionSweeper;
+    /**
+     * OPTIONAL auth-surface audit sink — see {@link AuthModuleOptions.auditSink}.
+     * Threaded straight through to {@link AuthModule.forRoot} (bound under its token, or
+     * `null` when absent → the recovery-login audit no-ops). Only consulted when
+     * `auth: true`.
+     */
+    readonly auditSink?: AuditSink;
+    /**
+     * OPTIONAL multi-device MFA store — see {@link AuthModuleOptions.mfaDeviceStore}.
+     * Threaded straight through to {@link AuthModule.forRoot} (bound under its token,
+     * or `null` when absent → the device routes 501). Only consulted when `auth: true`.
+     */
+    readonly mfaDeviceStore?: MfaDeviceStore;
+    /**
+     * OPTIONAL login `totp` verifier override — see {@link AuthModuleOptions.totpVerifier}.
+     * Threaded straight through to {@link AuthModule.forRoot} (replaces the default
+     * single-secret verifier in the composed authenticator; absent → the default). A
+     * consumer plugs an OR-matching multi-device verifier here. Only consulted when
+     * `auth: true`.
+     */
+    readonly totpVerifier?: FactorVerifier;
+    /**
+     * OPTIONAL root allowlist — the server-side, trusted set of canonical
+     * principal ids (user uuids) that ARE roots. Threaded straight through
+     * to {@link AuthModule.forRoot} → `createIdentityBroker({ internalRootIds })`.
+     * ROOT SAFETY: this is the ONLY way a login mints a root (the
+     * Internal identity adapter keys the trusted signal off THIS list, never off a
+     * claim). Omit → `[]` → default-deny (nobody is a root). Only consulted when
+     * `auth: true`.
+     */
+    readonly rootIds?: readonly string[];
+    /**
+     * OPTIONAL eager session-facts projector (ADR-0011) — see
+     * {@link AuthModuleOptions.sessionFactsProjector}. Threaded straight through to
+     * {@link AuthModule.forRoot} (bound under {@link SHIELD_SESSION_FACTS_PROJECTOR}, or
+     * `null` when absent → the auth controller omits `cachedFacts` and gate 5 DB-reloads
+     * every request, today's behavior). When supplied, login/refresh cache the principal's
+     * coarse grants on the session binding so gate 5 serves them from the request's
+     * `cachedFacts`. Only consulted when `auth: true`.
+     */
+    readonly sessionFactsProjector?: SessionFactsProjector;
 }
 /** Async variant of {@link ShieldModuleOptions} (DI-computed config). */
 export interface ShieldModuleAsyncOptions {
@@ -87,6 +176,61 @@ export interface ShieldModuleAsyncOptions {
      * async-resolved options. Only consulted when `auth: true`.
      */
     readonly credentialResolver?: CredentialResolver;
+    /**
+     * OPTIONAL current-user profile resolver — see {@link ShieldModuleOptions.profileResolver}.
+     * STATIC here (like {@link credentialResolver}): a registration-time collaborator
+     * threaded into the statically-composed {@link AuthModule} import. Only consulted
+     * when `auth: true`.
+     */
+    readonly profileResolver?: ProfileResolver;
+    /**
+     * OPTIONAL account/credential-surface seams — see
+     * {@link ShieldModuleOptions.credentialWriter} et al. STATIC here (like the other
+     * seams): registration-time collaborators threaded into the statically-composed
+     * {@link AuthModule} import, so they cannot depend on the async-resolved options.
+     * Only consulted when `auth: true`.
+     */
+    readonly credentialWriter?: CredentialWriter;
+    readonly resetTokenStore?: ResetTokenStore;
+    readonly emailSender?: EmailSender;
+    readonly recoveryCodeStore?: RecoveryCodeStore;
+    readonly profileWriter?: ProfileWriter;
+    readonly sessionSweeper?: SessionSweeper;
+    /**
+     * OPTIONAL auth-surface audit sink — see {@link ShieldModuleOptions.auditSink}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import. Only consulted when `auth: true`.
+     */
+    readonly auditSink?: AuditSink;
+    /**
+     * OPTIONAL multi-device MFA store — see {@link ShieldModuleOptions.mfaDeviceStore}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import. Only consulted when `auth: true`.
+     */
+    readonly mfaDeviceStore?: MfaDeviceStore;
+    /**
+     * OPTIONAL login `totp` verifier override — see {@link ShieldModuleOptions.totpVerifier}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import. Only consulted when `auth: true`.
+     */
+    readonly totpVerifier?: FactorVerifier;
+    /**
+     * OPTIONAL root allowlist — see {@link ShieldModuleOptions.rootIds}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import (it is passed to the broker at
+     * authenticator-composition time, not part of the async factory result). A consumer
+     * that must COMPUTE the list at boot (e.g. read it from a DB) uses `forRootAsync`'s
+     * `useFactory` to build the whole options object — the resolved `rootIds` is
+     * then threaded exactly like the static case. Only consulted when `auth: true`.
+     */
+    readonly rootIds?: readonly string[];
+    /**
+     * OPTIONAL eager session-facts projector — see {@link ShieldModuleOptions.sessionFactsProjector}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into the
+     * statically-composed {@link AuthModule} import, so it cannot depend on the async-resolved
+     * options. Only consulted when `auth: true`.
+     */
+    readonly sessionFactsProjector?: SessionFactsProjector;
 }
 /**
  * `ShieldModule` — the SINGLE registration seam (ADR-0023 §4).

package/dist/module/shield.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAMnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AASxE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAgDhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAwDtE"}
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAIrC,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAyFvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAiFhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAqFtE"}