@astram/guard 0.5.1 → 0.7.0

package/dist/auth/auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;;;;;;;;;;;;;;;AAEH,2CAWwB;AACxB,6CAAsD;AAYtD,2CAA0C;AAC1C,4FAAoE;AACpE,2CAqBqB;AAKrB,iEAAyD;AACzD,yDAAwE;AAExE,+EAAmG;AACnG,2CAAsD;AAqBtD;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,qBAA8B,EAAE,CAAC,CAAC;AAEtF,+EAA+E;AAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,4BAAqC,EAAE,CAAC,CAAC;AAEvF,iEAAiE;AACjE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB;IAC1B,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB;IAC3B,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe;IACtB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,mBAAU,CAAC,iBAAiB,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,GAAyB;IACjD,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,MAAM,EAAE;YACN,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;YACnC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY;SACtC;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,4FAA4F;AAC5F,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAGN;IAEA;IACA;IAOA;IAOA;IAOA;IAIA;IAIA;IAIA;IAIA;IAIA;IAKA;IAOA;IASA;IAIA;IAQA;IAKA;IAKA;IAOA;IASA;IAWA;IASA;IAYA;IAzInB,YAEmB,aAA4B,EAE5B,gBAAkC,EAClC,UAA2B,EAO3B,WAAgC,EAOhC,eAAiC,EAOjC,kBAA8C,EAI9C,eAAwC,EAIxC,WAAgC,EAIhC,gBAA0C,EAI1C,cAAsC,EAItC,cAA+B,EAK/B,gBAAyB,EAOzB,aAAwC,EASxC,YAAoC,EAIpC,eAAuC,EAQvC,aAAqC,EAKrC,iBAAyC,EAKzC,YAAoC,EAOpC,SAA4B,EAS5B,qBAAoD,EAWpD,oBAAkD,EASlD,iBAA4C,EAY5C,eAAsD;QAvItD,kBAAa,GAAb,aAAa,CAAe;QAE5B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAiB;QAO3B,gBAAW,GAAX,WAAW,CAAqB;QAOhC,oBAAe,GAAf,eAAe,CAAkB;QAOjC,uBAAkB,GAAlB,kBAAkB,CAA4B;QAI9C,oBAAe,GAAf,eAAe,CAAyB;QAIxC,gBAAW,GAAX,WAAW,CAAqB;QAIhC,qBAAgB,GAAhB,gBAAgB,CAA0B;QAI1C,mBAAc,GAAd,cAAc,CAAwB;QAItC,mBAAc,GAAd,cAAc,CAAiB;QAK/B,qBAAgB,GAAhB,gBAAgB,CAAS;QAOzB,kBAAa,GAAb,aAAa,CAA2B;QASxC,iBAAY,GAAZ,YAAY,CAAwB;QAIpC,oBAAe,GAAf,eAAe,CAAwB;QAQvC,kBAAa,GAAb,aAAa,CAAwB;QAKrC,sBAAiB,GAAjB,iBAAiB,CAAwB;QAKzC,iBAAY,GAAZ,YAAY,CAAwB;QAOpC,cAAS,GAAT,SAAS,CAAmB;QAS5B,0BAAqB,GAArB,qBAAqB,CAA+B;QAWpD,yBAAoB,GAApB,oBAAoB,CAA8B;QASlD,sBAAiB,GAAjB,iBAAiB,CAA2B;QAY5C,oBAAe,GAAf,eAAe,CAAuC;IACtE,CAAC;IAEJ;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CACvB,GAAyB,EACzB,SAAoB,EACpB,YAAY,GAAG,KAAK;QAEpB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5E,mFAAmF;QACnF,uFAAuF;QACvF,+EAA+E;QAC/E,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACvD,qFAAqF;QACrF,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,yFAAyF;QACzF,gFAAgF;QAChF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CACzB,GAAG,CAAC,MAAM,CAAC,WAAW,EACtB;gBACE,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;gBAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,SAAS,CAAC,MAAM,KAAK,IAAI;gBACjC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;gBAChC,0EAA0E;gBAC1E,6DAA6D;gBAC7D,YAAY;gBACZ,gEAAgE;gBAChE,8EAA8E;gBAC9E,wEAAwE;gBACxE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,kFAAkF;gBAClF,mFAAmF;gBACnF,uFAAuF;gBACvF,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,EACD,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CAAC,SAAoB;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3E,+EAA+E;QAC/E,gFAAgF;QAChF,mCAAmC;QACnC,OAAO,KAAK,IAAI,SAAS,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmB,EACnB,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,mBAAmB,CAC/B,SAAoB;QAEpB,OAAO,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,sBAAsB,CAClC,QAAgB;QAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACxD,0EAA0E;YAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,kFAAkF;YAClF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,gBAAgB,CAAC,SAAoB;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,2CAA2C;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,uBAAuB,CACnC,GAAyB,EACzB,SAAoB,EACpB,KAAqC;QAErC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO;YACL,GAAG,gBAAgB,CAAC,GAAG,CAAC;YACxB,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,mBAAmB,CAAC,MAA+B;QACzD,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,8FAA8F;QAC9F,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,EAAE;YACF,iBAAiB,EAAE,QAAQ;YAC3B,mBAAmB,EAAE,CAAC,QAAQ,CAAC;YAC/B,QAAQ;YACR,OAAO;YACP,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED;;;;OAIG;IAIG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAkB;QACpC,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,6EAA6E;QAC7E,+EAA+E;QAC/E,gFAAgF;QAChF,iFAAiF;QACjF,qEAAqE;QACrE,MAAM,QAAQ,GAAG,SAAS,YAAY,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,iFAAiF;YACjF,gFAAgF;YAChF,0EAA0E;YAC1E,mFAAmF;YACnF,gDAAgD;YAChD,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAyB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACxE,YAAY,EACZ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAC/B,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,8EAA8E;YAC9E,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvC,kFAAkF;YAClF,mFAAmF;YACnF,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YACtC,+EAA+E;YAC/E,8EAA8E;YAC9E,gFAAgF;YAChF,6EAA6E;YAC7E,yCAAyC;YACzC,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QAED,0EAA0E;QAC1E,+EAA+E;QAC/E,2BAA2B;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,8EAA8E;YAC9E,oEAAoE;YACpE,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,oFAAoF;QACpF,mFAAmF;QACnF,oFAAoF;QACpF,gFAAgF;QAChF,qFAAqF;QACrF,+EAA+E;QAC/E,kFAAkF;QAClF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,CAAC,mBAAmB,CAAC;oBACvB,MAAM,EAAE,mBAAmB;oBAC3B,YAAY;oBACZ,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;oBACpC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAIG,AAAN,KAAK,CAAC,EAAE,CAA2B,aAAsB;QACvD,8EAA8E;QAC9E,kFAAkF;QAClF,iFAAiF;QACjF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,yEAAyE;YACzE,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,mBAAU,CAAC,YAAY,CACxB,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAA,8CAAuB,EAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QAED,8EAA8E;QAC9E,iFAAiF;QACjF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,mBAAU,CAAC,eAAe,CAC3B,CAAC;QACJ,CAAC;QAED,IAAI,OAAkC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,+DAA+D;YAC/D,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,mBAAU,CAAC,qBAAqB,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,+EAA+E;YAC/E,0DAA0D;YAC1D,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,AAAN,KAAK,CAAC,WAAW,CACP,IAA+B,EACb,aAAsB;QAEhD,qFAAqF;QACrF,kFAAkF;QAClF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAG,IAAA,yCAAkB,EAAC,aAAa,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;QAC/E,CAAC;QAED,qFAAqF;QACrF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,yFAAyF;QACzF,uFAAuF;QACvF,sFAAsF;QACtF,yBAAyB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;QAED,qFAAqF;QACrF,sFAAsF;QACtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAC9C,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,iBAAiB,EAAE,YAAY;YAC/B,mBAAmB,EAAE,CAAC,YAAY,CAAC;YACnC,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC;QAE3C,uFAAuF;QACvF,sFAAsF;QACtF,uFAAuF;QACvF,uFAAuF;QACvF,gCAAgC;QAChC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CACjD,KAAK,EACL,MAAM,CAAC,SAAS,EAChB,YAAY,EACZ,OAAO,CACR,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,AAAN,KAAK,CAAC,cAAc,CACV,IAA+B,EAIjC,EAAU;QAEhB,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAEhC,oFAAoF;QACpF,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,+EAA+E;QAC/E,sFAAsF;QACtF,iFAAiF;QACjF,MAAM,KAAK,GAAG,aAAa,EAAE,IAAI,YAAY,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,UAAU,IAAI,EAAE,CAAC;QAEjC,kFAAkF;QAClF,mFAAmF;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxF,qFAAqF;QACrF,qFAAqF;QACrF,MAAM,WAAW,GACf,IAAI,CAAC,iBAAiB,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjG,qFAAqF;QACrF,kFAAkF;QAClF,sFAAsF;QACtF,mFAAmF;QACnF,2EAA2E;QAC3E,oFAAoF;QACpF,iFAAiF;QACjF,6EAA6E;QAC7E,oFAAoF;QACpF,gFAAgF;QAChF,sFAAsF;QACtF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,oFAAoF;QACpF,8EAA8E;QAC9E,KAAK,IAAI,CAAC,aAAa;YACrB,EAAE,aAAa,CAAC,KAAK,CAAC;aACrB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;gBAC3E,IAAI,CAAC,mBAAmB,CAAC;oBACvB,MAAM,EAAE,gCAAgC;oBACxC,YAAY,EAAE,IAAI,IAAI,IAAI;oBAC1B,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;oBACpC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,mFAAmF;QACnF,oFAAoF;QACpF,mFAAmF;QACnF,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,iFAAiF;QACjF,6BAA6B;QAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,iBAAiB;gBACzB,EAAE,aAAa,CAAC,OAAO,CAAC;iBACvB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;oBACnF,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,qCAAqC;wBAC7C,YAAY,EAAE,IAAI;wBAClB,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,+EAA+E;QAC/E,iFAAiF;QACjF,IAAI,SAAS,IAAI,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,+DAA+D;YAC/D,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACnE,+EAA+E;YACjF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;IACxF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,IAAY,EACZ,QAA4B,EAC5B,KAAsB,EACtB,MAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,gDAAgD;QAE/E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA8C,CAAC;QACvE,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QAE5E,kFAAkF;QAClF,oFAAoF;QACpF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;YAAE,OAAO;QAChF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YACjD,EAAE,EAAE,WAAW;YACf,8FAA8F;YAC9F,iBAAiB,EAAE,QAAQ;YAC3B,mBAAmB,EAAE,CAAC,QAAQ,CAAC;YAC/B,QAAQ;YACR,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,KAAK;YAAE,OAAO;QAE5B,oEAAoE;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,sCAAsC,CAAC;QAC7E,MAAM,IAAI,GAAG,GAAG,IAAI,UAAU,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,OAAO,CAAC,KAAK;YACjB,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,wBAAwB,IAAI,EAAE;YACpC,IAAI,EAAE,oCAAoC,IAAI,KAAK,IAAI,UAAU;SAClE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IAIG,AAAN,KAAK,CAAC,aAAa,CACT,IAA8C,EAEhD,EAAU;QAEhB,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,mFAAmF;QACnF,oFAAoF;QACpF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,iFAAiF;QACjF,kFAAkF;QAClF,qFAAqF;QACrF,MAAM,QAAQ,GAAG,YAAY,EAAE,IAAI,YAAY,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,+EAA+E;YAC/E,iFAAiF;YACjF,kFAAkF;YAClF,kFAAkF;YAClF,eAAe,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,oBAAoB,CAAC,CAAC;QACvF,CAAC;QACD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7G,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,eAAe,CAAC,CAAC;QAClF,CAAC;QAED,+EAA+E;QAC/E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,iFAAiF;YACjF,mFAAmF;YACnF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,qFAAqF;YACrF,4EAA4E;YAC5E,mFAAmF;YACnF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC5C,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,4BAA4B;wBACpC,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAE/C,oFAAoF;QACpF,yDAAyD;QACzD,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEzC,kFAAkF;QAClF,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC/D,CAAC;QACD,mFAAmF;QACnF,MAAM,KAAK,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IAIG,AAAN,KAAK,CAAC,GAAG,CAAS,IAAgB;QAChC,MAAM,cAAc,GAAG,OAAO,IAAI,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAE5B,8EAA8E;QAC9E,+EAA+E;QAC/E,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAE5C,gFAAgF;QAChF,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,8EAA8E;QAC9E,yCAAyC;QACzC,IAAI,MAAM,KAAK,MAAM;YAAE,mBAAmB,EAAE,CAAC;QAE7C,MAAM,MAAM,GAAyB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACxE,OAAO,CAAC,YAAY,EACpB,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAC7D,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvC,+EAA+E;YAC/E,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED,+EAA+E;QAC/E,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAmD,EACnD,IAAY;QAEZ,yEAAyE;QACzE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YAClE,mBAAmB,EAAE,CAAC;QACxB,CAAC;QACD,4EAA4E;QAC5E,+EAA+E;QAC/E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,QAAQ,IAAI,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAiC,CAAC;QAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW;YAAE,mBAAmB,EAAE,CAAC;QAExC,+EAA+E;QAC/E,gFAAgF;QAChF,gFAAgF;QAChF,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,WAAW,GAAG,YAAY,WAAW,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrF,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,6EAA6E;QAC7E,2DAA2D;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,6EAA6E;YAC7E,+EAA+E;YAC/E,sEAAsE;YACtE,oFAAoF;YACpF,mEAAmE;YACnE,gFAAgF;YAChF,kFAAkF;YAClF,mEAAmE;YACnE,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBACpE,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;oBAC/C,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,0BAA0B;wBAClC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;wBACtE,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAE/C,gFAAgF;QAChF,mEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAE9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACpD,iFAAiF;QACjF,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAE7C,gFAAgF;QAChF,qFAAqF;QACrF,iFAAiF;QACjF,mFAAmF;QACnF,mFAAmF;QACnF,0EAA0E;QAC1E,IAAI,CAAC,mBAAmB,CAAC;YACvB,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,SAAS,CAAC,EAAE;YACrB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,qFAAqF;QACrF,mFAAmF;QACnF,sFAAsF;QACtF,oDAAoD;QACpD,OAAO,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;;OAQG;IACK,kBAAkB,CAAC,WAAmB,EAAE,QAAgB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,8EAA8E;QACxF,CAAC;QACD,KAAK,CAAC,KAAK,IAAmB,EAAE;YAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;gBACrC,EAAE,EAAE,WAAW;gBACf,8FAA8F;gBAC9F,iBAAiB,EAAE,QAAQ;gBAC3B,mBAAmB,EAAE,CAAC,QAAQ,CAAC;gBAC/B,QAAQ;gBACR,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,KAAK;gBAAE,OAAO,CAAC,sDAAsD;YACnF,MAAM,MAAM,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,OAAO,CAAC,KAAK;gBACjB,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EACF,4DAA4D;oBAC5D,4EAA4E;oBAC5E,kFAAkF;gBACpF,IAAI,EACF,kEAAkE;oBAClE,oFAAoF;oBACpF,yEAAyE;oBACzE,2BAA2B;aAC9B,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,iEAAiE;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,mBAAmB,CAAC,MAO3B;QACC,mFAAmF;QACnF,mFAAmF;QACnF,kFAAkF;QAClF,2DAA2D;QAC3D,MAAM,UAAU,GAA4B;YAC1C,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;QACF,KAAK,IAAI,CAAC,SAAS;YACjB,EAAE,MAAM,CAAC;YACP,IAAI,EAAE,gBAAgB;YACtB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU;SACX,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,8DAA8D;QAChE,CAAC,CAAC,CAAC;QAEL,mFAAmF;QACnF,oFAAoF;QACpF,gFAAgF;QAChF,oFAAoF;QACpF,kCAAkC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;QAC5D,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,OAAO,CAAS,IAAoB;QACxC,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7D,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC5E,mFAAmF;gBACnF,iFAAiF;gBACjF,iFAAiF;gBACjF,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,iEAAiE;gBACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAC3C,GAAG,CAAC,OAAO,CAAC,WAAW,EACvB,GAAG,CAAC,OAAO,CAAC,QAAQ,CACrB,CAAC;gBACF,yFAAyF;gBACzF,2FAA2F;gBAC3F,2FAA2F;gBAC3F,qFAAqF;gBACrF,qFAAqF;gBACrF,gFAAgF;gBAChF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC7E,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CACnC,GAAG,CAAC,MAAM,CAAC,WAAW,EACtB,GAAG,CAAC,OAAO,CAAC,SAAS,EACrB,KAAK,EACL,UAAU,EACV,YAAY,CACb,CAAC;YACJ,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,8EAA8E;YAC9E,uDAAuD;YACvD,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;OAIG;IAIG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAmB;QACtC,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,SAAoB;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;CACF,CAAA;AAjvCY,wCAAc;AA4WnB;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2CAyElB;AAwBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACd,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;wCA0CjC;AAoCK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,cAAc,CAAC;IACpB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IAErB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;iDA0E1B;AAyBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,aAAI,GAAE,CAAA;IAIN,WAAA,IAAA,WAAE,GAAE,CAAA;;;;oDA8FN;AAqEK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,aAAI,GAAE,CAAA;IAEN,WAAA,IAAA,WAAE,GAAE,CAAA;;;;mDAsEN;AAqBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,KAAK,CAAC;IACX,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACb,WAAA,IAAA,aAAI,GAAE,CAAA;;;;yCAwChB;AAoPK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAyCpB;AAUK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAClB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4CAanB;yBAluCU,cAAc;IAD1B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAGd,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAOhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;IAMnC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;IAM/B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAGlC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAGhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAG3B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAGhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAG9B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAI9B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAMlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAQlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAG5B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;IAO/B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,iCAAqB,CAAC,CAAA;IAI7B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAIlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAM5B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,6BAAiB,CAAC,CAAA;IAQzB,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,0CAA8B,CAAC,CAAA;IAUtC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,yCAA6B,CAAC,CAAA;IAQrC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,qCAAyB,CAAC,CAAA;IAWjC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;qDAnIH,sCAAe;GANnC,cAAc,CAivC1B;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAA4B;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/auth/auth.module.d.ts

@@ -65,6 +65,8 @@
 import { type DynamicModule } from '@nestjs/common';
 import type { CredentialResolver, HmacSha1, FactorVerifier } from '@astram/core';
 import type { SessionFactsProjector } from './ports/session-facts-projector.js';
+import type { ScopeSubtreeResolver } from './ports/scope-subtree-resolver.js';
+import type { MembershipChecker } from './ports/membership-checker.js';
 import type { ProfileResolver } from './profile-resolver.js';
 import type { CredentialWriter } from './ports/credential-writer.js';
 import type { ResetTokenStore } from './ports/reset-token-store.js';
@@ -188,6 +190,25 @@ export interface AuthModuleOptions {
      * gate 5 serves them from the request's `cachedFacts`. Only meaningful under `auth: true`.
      */
     readonly sessionFactsProjector?: SessionFactsProjector;
+    /**
+     * OPTIONAL active-scope-subtree resolver (Task 2.2, ADR-0027 / ADR-0024, the
+     * {@link ScopeSubtreeResolver} port). Threaded exactly like the facts projector:
+     * supplied → bound app-wide under {@link SHIELD_SCOPE_SUBTREE_RESOLVER}; omitted → bound
+     * `null`, so the auth controller omits `scopeSubtreeNodeIds` and the per-request path
+     * falls back to the self-node `[tenantId]` (today's flat isolation). When supplied, login
+     * resolves the principal's closure subtree ONCE and caches it on the session binding so the
+     * per-request tenant gate reads it with zero DB. Only meaningful under `auth: true`.
+     */
+    readonly scopeSubtreeResolver?: ScopeSubtreeResolver;
+    /**
+     * OPTIONAL scope-switch membership checker (Task 5.2, ADR-0027 / ADR-0024, the
+     * {@link MembershipChecker} port). Threaded exactly like the subtree resolver: supplied →
+     * bound app-wide under {@link SHIELD_MEMBERSHIP_CHECKER}; omitted → bound `null`, so
+     * `POST /auth/scope-switch` fails CLOSED (cannot verify the target binding → deny). When
+     * supplied, the scope-switch gate confirms the principal holds an active membership at the
+     * target node before re-binding the session. Only meaningful under `auth: true`.
+     */
+    readonly membershipChecker?: MembershipChecker;
 }
 /**
  * The auth composition module. Imports {@link PersistenceModule} (the live

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AA8DtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAiVD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAuHD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAkH/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AAgEtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAwWD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AA4ID;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAgI/D"}

package/dist/auth/auth.module.js

@@ -132,6 +132,8 @@ const pending_mfa_store_js_1 = require("./pending-mfa-store.js");
 const tokens_js_1 = require("./tokens.js");
 const attempt_limiter_js_1 = require("./rate-limit/attempt-limiter.js");
 const tokens_js_2 = require("../request-auth/tokens.js");
+const mariadb_api_key_store_js_1 = require("../authentication/mariadb-api-key-store.js");
+const core_1 = require("@astram/core");
 const session_token_binder_js_1 = require("../request-auth/session-token-binder.js");
 /**
  * The injected HMAC-SHA1 primitive the core TOTP verifier needs (Core is zero-dep
@@ -263,6 +265,27 @@ const sessionTokenBinderProvider = {
     useFactory: (redis) => new session_token_binder_js_1.SessionTokenBinder(redis),
     inject: [tokens_js_1.SHIELD_REDIS],
 };
+/**
+ * The service-account API-key authenticator (ADR-0033) — resolves an `Authorization: Bearer ask_…`
+ * into a `service_account` Principal. Built HERE (in the guard's own AuthModule) over the live
+ * {@link SHIELD_DB_POOL} + the framework Argon2id hasher, and EXPORTED so the `APP_GUARD` (in this
+ * same module tree) injects it — the SAME reason the {@link sessionTokenBinderProvider} lives here.
+ *
+ * WHY HERE, not in the consumer's identity module: the enforcement guard is provided by ShieldModule;
+ * a token provided in a later, sibling feature module is NOT visible to it (that DI boundary made an
+ * identity-module-provided authenticator resolve to `undefined` → an `ask_…` bearer 401'd). Providing
+ * it alongside the guard (like the binder) is what makes the machine auth path work out-of-the-box
+ * under `auth: true`. The store reads `shield_authz.service_account_key` (created by the framework
+ * migration); the account admin surface lives in @astram/identity, but AUTHENTICATION is the guard's.
+ */
+const serviceAuthenticatorProvider = {
+    provide: tokens_js_2.SHIELD_SERVICE_AUTHENTICATOR,
+    useFactory: (pool) => (0, core_1.createServiceAuthenticator)({
+        store: new mariadb_api_key_store_js_1.MariaDbApiKeyStore(pool),
+        hasher: new argon2id_password_hasher_js_1.Argon2idPasswordHasher(),
+    }),
+    inject: [tokens_js_1.SHIELD_DB_POOL],
+};
 /**
  * The password-login rate limiter (spec §5 / H1) — a Redis-injected
  * {@link AttemptLimiter}, 10 failures / 15-min window, keyed `login:<hint>`. Same
@@ -556,6 +579,26 @@ function makeAuditSinkProvider(override) {
 function makeSessionFactsProjectorProvider(override) {
     return { provide: tokens_js_1.SHIELD_SESSION_FACTS_PROJECTOR, useValue: override ?? null };
 }
+/**
+ * Bind the OPTIONAL active-scope-subtree resolver (Task 2.2). Same value-provider pattern
+ * as {@link makeSessionFactsProjectorProvider}: the supplied impl when present, else `null`
+ * so the auth controller's `@Optional()` injection resolves cleanly to "no resolver" (→ it
+ * omits `scopeSubtreeNodeIds` → the per-request path falls back to the self-node). Always
+ * provided so the DI token exists.
+ */
+function makeScopeSubtreeResolverProvider(override) {
+    return { provide: tokens_js_1.SHIELD_SCOPE_SUBTREE_RESOLVER, useValue: override ?? null };
+}
+/**
+ * Bind the OPTIONAL scope-switch membership checker (Task 5.2). Same value-provider pattern
+ * as {@link makeScopeSubtreeResolverProvider}: the supplied impl when present, else `null` so
+ * the auth controller's `@Optional()` injection resolves to "no checker" (→ `POST
+ * /auth/scope-switch` fails closed, denying every switch — cannot verify the binding). Always
+ * provided so the DI token exists.
+ */
+function makeMembershipCheckerProvider(override) {
+    return { provide: tokens_js_1.SHIELD_MEMBERSHIP_CHECKER, useValue: override ?? null };
+}
 /**
  * The reset-link base URL the forgot-password handler builds the emailed link from
  * (`${base}?token=<rawToken>`). A plain string VALUE (not a seam) resolved from the
@@ -625,6 +668,14 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // The eager session-facts projector (ADR-0011; null when absent → the auth
                 // controller omits cachedFacts → gate 5 DB-reloads). Consumed by AuthController.
                 makeSessionFactsProjectorProvider(options.sessionFactsProjector),
+                // The active-scope-subtree resolver (Task 2.2; null when absent → the auth controller
+                // omits scopeSubtreeNodeIds → the per-request path falls back to the self-node).
+                // Consumed by AuthController at login.
+                makeScopeSubtreeResolverProvider(options.scopeSubtreeResolver),
+                // The scope-switch membership gate (Task 5.2; null when absent → POST /auth/scope-switch
+                // fails closed, denying every switch — cannot verify the target binding). Consumed by
+                // AuthController's scopeSwitch handler.
+                makeMembershipCheckerProvider(options.membershipChecker),
                 // The framework-DEFAULT permission-facts adapter backing AuthFactsController
                 // (`/identity/auth-facts` + `/identity/permissions-version`). Reads role grants +
                 // per-tenant version from the pool; expands `identity:*` wildcards against the
@@ -653,6 +704,9 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 pending_mfa_store_js_1.PendingMfaStore,
                 // The request-auth token binder (access-token → principal claims).
                 sessionTokenBinderProvider,
+                // The service-account API-key authenticator (ADR-0033) — `ask_…` bearer → service_account
+                // Principal. Provided here (with the guard) so the APP_GUARD sees it; exported below.
+                serviceAuthenticatorProvider,
                 // The anti-brute-force rate limiters (spec §5): login (H1) + recovery, each
                 // a Redis-injected AttemptLimiter with its own threshold. Injected into
                 // AuthController (@Optional()).
@@ -673,6 +727,9 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER,
                 // Exported so the (app-wide) enforcement guard can inject it.
                 tokens_js_2.SHIELD_SESSION_TOKEN_BINDER,
+                // Exported so the (app-wide) enforcement guard injects it → the `ask_…` machine auth path
+                // (ADR-0033) works out-of-the-box under `auth: true`.
+                tokens_js_2.SHIELD_SERVICE_AUTHENTICATOR,
                 // The account/credential-surface seams — exported so the consumer's impls
                 // and the account/auth controllers see them app-wide through @Global Shield.
                 tokens_js_1.SHIELD_CREDENTIAL_WRITER,

package/dist/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgIH,kDAKC;AAWD,0DAGC;AAjJD,2CAA2E;AAC3E,6CAAyC;AA4BzC,2DAA+E;AAC/E,iEAAwD;AACxD,+FAA+G;AAC/G,qGAA6F;AAC7F,+FAAuF;AACvF,iGAAyF;AACzF,2FAAmF;AACnF,iGAAwF;AACxF,qGAA4F;AAC5F,+FAAsF;AACtF,6FAAqF;AACrF,+EAAuE;AACvE,+FAA+E;AAC/E,yFAAwF;AACxF,mFAA2E;AAC3E,kDAW6B;AAC7B,mEAA4D;AAC5D,6DAAsD;AACtD,mEAA4D;AAC5D,iEAAyD;AACzD,2CA4BqB;AAIrB,wEAAiE;AAUjE,yDAAwE;AACxE,qFAA6E;AAE7E;;;;;GAKG;AACI,MAAM,QAAQ,GAAa,CAAC,GAAe,EAAE,OAAmB,EAAc,EAAE,CACrF,IAAI,UAAU,CAAC,IAAA,wBAAU,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AADhF,QAAA,QAAQ,YACwE;AAE7F;;;;;;;;;;;GAWG;AACH,SAAgB,mBAAmB,CACjC,QAA2C,EAC3C,eAA+B;IAE/B,OAAO,QAAQ,IAAI,eAAe,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,uBAAuB;IAC3C,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;IACtD,OAAO,wBAAwB,CAAC,EAAE,QAAQ,EAAR,gBAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAEnD,CAAC;AAEtB,IAAI,UAAmC,CAAC;AAExC;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,QAAQ;IACrB,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,CAAC;QACH,mFAAmF;QACnF,UAAU,GAAG,CAAC,wDAAa,cAAc,GAAC,CAA2B,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAgB,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E,uHAAuH;AACvH,MAAM,sBAAsB,GAAa;IACvC,OAAO,EAAE,oDAAsB;IAC/B,UAAU,EAAE,GAAmB,EAAE,CAAC,IAAI,oDAAsB,EAAE;CAC/D,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,SAAS,8BAA8B,CAAC,QAA6B;IACnE,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,sCAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC7D,CAAC,CAAC;YACE,OAAO,EAAE,sCAA0B;YACnC,UAAU,EAAE,CAAC,IAAU,EAAsB,EAAE,CAAC,IAAI,0DAAyB,CAAC,IAAI,CAAC;YACnF,MAAM,EAAE,CAAC,0BAAc,CAAC;SACzB,CAAC;AACR,CAAC;AAED,mFAAmF;AACnF,MAAM,0BAA0B,GAAa;IAC3C,OAAO,EAAE,sCAA2B;IACpC,UAAU,EAAE,CAAC,IAAU,EAAsB,EAAE,CAAC,IAAI,oCAAyB,CAAC,IAAI,CAAC;IACnF,MAAM,EAAE,CAAC,0BAAc,CAAC;CACzB,CAAC;AAEF,wEAAwE;AACxE,MAAM,uBAAuB,GAAa;IACxC,OAAO,EAAE,mCAAwB;IACjC,UAAU,EAAE,CAAC,KAAY,EAAmB,EAAE,CAAC,IAAI,+BAAoB,CAAC,KAAK,CAAC;IAC9E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,0BAA0B,GAAa;IAC3C,OAAO,EAAE,uCAA2B;IACpC,UAAU,EAAE,CAAC,KAAY,EAAsB,EAAE,CAAC,IAAI,4CAAkB,CAAC,KAAK,CAAC;IAC/E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAa;IACrC,OAAO,EAAE,gCAAoB;IAC7B,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAa;IACxC,OAAO,EAAE,mCAAuB;IAChC,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAa;IACtC,OAAO,EAAE,iCAAqB;IAC9B,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAa;IAC1C,OAAO,EAAE,sCAA0B;IACnC,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAa;IACrC,OAAO,EAAE,gCAAoB;IAC7B,UAAU,EAAE,CAAC,KAAY,EAAkB,EAAE,CAC3C,IAAI,mCAAc,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1E,MAAM,EAAE,CAAC,wBAAY,CAAC;CACvB,CAAC;AAEF,oDAAoD;AACpD,MAAM,sBAAsB,GAAa;IACvC,OAAO,EAAE,iCAAsB;IAC/B,UAAU,EAAE,GAAmB,EAAE,CAAC,IAAI,+BAAoB,EAAE;CAC7D,CAAC;AAEF;;;;GAIG;AACH,MAAM,qBAAqB,GAAa;IACtC,OAAO,EAAE,gCAAqB;IAC9B,UAAU,EAAE,CAAC,MAAiB,EAAsB,EAAE,CACpD,IAAI,mCAAwB,CAAC,IAAA,oCAAoB,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,EAAE,CAAC,6BAAU,CAAC;CACrB,CAAC;AAEF,oBAAoB;AACpB,MAAM,aAAa,GAAa;IAC9B,OAAO,EAAE,uBAAY;IACrB,UAAU,EAAE,GAAU,EAAE,CAAC,IAAI,sBAAW,EAAE;CAC3C,CAAC;AAEF,+EAA+E;AAE/E,0EAA0E;AAC1E,MAAM,wBAAwB,GAAa;IACzC,OAAO,EAAE,oCAAwB;IACjC,kFAAkF;IAClF,UAAU,EAAE,KAAK,EACf,WAA+B,EAC/B,QAAyB,EACzB,cAA8B,EAC9B,aAAiC,EACjC,KAAY,EACZ,MAAiB,EACU,EAAE;QAC7B,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACpD,OAAO,sBAAsB,CAAC;YAC5B,WAAW;YACX,QAAQ;YACR,cAAc;YACd,aAAa;YACb,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE;QACN,sCAA2B;QAC3B,mCAAwB;QACxB,iCAAsB;QACtB,gCAAqB;QACrB,uBAAY;QACZ,6BAAU;KACX;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAa;IACtC,OAAO,EAAE,gCAAoB;IAC7B,oFAAoF;IACpF,UAAU,EAAE,KAAK,EACf,MAAsB,EACtB,QAA4B,EAC5B,YAAmC,EACnC,OAAiC,EACjC,cAA8B,EACN,EAAE;QAC1B,MAAM,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,GAC3E,MAAM,QAAQ,EAAE,CAAC;QACnB,gFAAgF;QAChF,4EAA4E;QAC5E,uEAAuE;QACvE,kFAAkF;QAClF,qEAAqE;QACrE,MAAM,IAAI,GAAG,mBAAmB,CAAC,YAAY,EAAE,wBAAwB,CAAC,EAAE,QAAQ,EAAR,gBAAQ,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,IAAI,4CAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACtD,OAAO,mBAAmB,CAAC;YACzB,MAAM;YACN,QAAQ;YACR,wDAAwD;YACxD,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,cAAc,EAAE,oBAAoB,CAAC,EAAE,eAAe,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YACxE,eAAe,EAAE,CAAC,IAAI,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE;QACN,oDAAsB;QACtB,sCAA0B;QAC1B,yCAA6B;QAC7B,2BAAe;QACf,mCAAuB;KACxB;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,gCAAgC,CAAC,QAAyB;IACjE,OAAO,EAAE,OAAO,EAAE,yCAA6B,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,OAA2B;IACtD,OAAO,EAAE,OAAO,EAAE,2BAAe,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAa;IACrC,OAAO,EAAE,gCAAoB;IAC7B,UAAU,EAAE,KAAK,IAA6B,EAAE;QAC9C,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACtD,OAAO,wBAAwB,CAAC,EAAE,QAAQ,EAAR,gBAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;CACF,CAAC;AA2GF;;;;;;;;;;;;;;GAcG;AACH,SAAS,2BAA2B,CAAC,QAA0B;IAC7D,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,mCAAuB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC1D,CAAC,CAAC;YACE,OAAO,EAAE,mCAAuB;YAChC,UAAU,EAAE,CAAC,IAAU,EAAmB,EAAE,CAAC,IAAI,oDAAsB,CAAC,IAAI,CAAC;YAC7E,MAAM,EAAE,CAAC,0BAAc,CAAC;SACzB,CAAC;AACR,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,QAA2B;IAC/D,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,oCAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC3D,CAAC,CAAC;YACE,OAAO,EAAE,oCAAwB;YACjC,UAAU,EAAE,CAAC,IAAU,EAAoB,EAAE,CAAC,IAAI,sDAAuB,CAAC,IAAI,CAAC;YAC/E,MAAM,EAAE,CAAC,0BAAc,CAAC;SACzB,CAAC;AACR,CAAC;AACD,SAAS,2BAA2B,CAAC,QAA0B;IAC7D,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,oCAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC3D,CAAC,CAAC;YACE,OAAO,EAAE,oCAAwB;YACjC,UAAU,EAAE,CAAC,IAAU,EAAmB,EAAE,CAAC,IAAI,qDAAsB,CAAC,IAAI,CAAC;YAC7E,MAAM,EAAE,CAAC,0BAAc,CAAC;SACzB,CAAC;AACR,CAAC;AACD,SAAS,uBAAuB,CAAC,QAAsB;IACrD,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,+BAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACtD,CAAC,CAAC,EAAE,OAAO,EAAE,+BAAmB,EAAE,UAAU,EAAE,GAAgB,EAAE,CAAC,IAAI,oCAAc,EAAE,EAAE,CAAC;AAC5F,CAAC;AACD,SAAS,6BAA6B,CAAC,QAA4B;IACjE,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,sCAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC7D,CAAC,CAAC;YACE,OAAO,EAAE,sCAA0B;YACnC,UAAU,EAAE,CAAC,IAAU,EAAE,MAAsB,EAAqB,EAAE,CACpE,IAAI,yDAAwB,CAAC,IAAI,EAAE,MAAM,CAAC;YAC5C,MAAM,EAAE,CAAC,0BAAc,EAAE,oDAAsB,CAAC;SACjD,CAAC;AACR,CAAC;AACD,SAAS,yBAAyB,CAAC,QAAwB;IACzD,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACxD,CAAC,CAAC;YACE,OAAO,EAAE,iCAAqB;YAC9B,UAAU,EAAE,CAAC,IAAU,EAAiB,EAAE,CAAC,IAAI,gDAAoB,CAAC,IAAI,CAAC;YACzE,MAAM,EAAE,CAAC,0BAAc,CAAC;SACzB,CAAC;AACR,CAAC;AACD,SAAS,0BAA0B,CAAC,QAAyB;IAC3D,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,kCAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACzD,CAAC,CAAC;YACE,OAAO,EAAE,kCAAsB;YAC/B,UAAU,EAAE,CAAC,IAAU,EAAE,MAA0B,EAAkB,EAAE,CACrE,IAAI,kDAAqB,CAAC,IAAI,EAAE,MAAM,CAAC;YACzC,MAAM,EAAE,CAAC,0BAAc,EAAE,uCAA2B,CAAC;SACtD,CAAC;AACR,CAAC;AACD,SAAS,0BAA0B,CAAC,QAAyB;IAC3D,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,mCAAuB,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC1D,CAAC,CAAC;YACE,OAAO,EAAE,mCAAuB;YAChC,UAAU,EAAE,CAAC,IAAU,EAAkB,EAAE,CAAC,IAAI,mDAAqB,CAAC,IAAI,CAAC;YAC3E,MAAM,EAAE,CAAC,0BAAc,CAAC;SACzB,CAAC;AACR,CAAC;AACD,SAAS,qBAAqB,CAAC,QAAoB;IACjD,OAAO,EAAE,OAAO,EAAE,6BAAiB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACpE,CAAC;AACD;;;;;GAKG;AACH,SAAS,iCAAiC,CAAC,QAAgC;IACzE,OAAO,EAAE,OAAO,EAAE,0CAA8B,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACjF,CAAC;AACD;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,QAA+B;IACvE,OAAO,EAAE,OAAO,EAAE,yCAA6B,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,6BAA6B,CAAC,QAA4B;IACjE,OAAO,EAAE,OAAO,EAAE,qCAAyB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAa;IACzC,OAAO,EAAE,sCAA0B;IACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,sCAAsC;CACpF,CAAC;AAEF;;;;;;GAMG;AAEI,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,UAA6B,EAAE;QAC5C,2EAA2E;QAC3E,iFAAiF;QACjF,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC5D,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI,EAAE,CAAC;QACxE,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE,CAAC,yCAAiB,CAAC,OAAO,EAAE,CAAC;YACtC,wDAAwD;YACxD,4EAA4E;YAC5E,2EAA2E;YAC3E,8DAA8D;YAC9D,4EAA4E;YAC5E,oFAAoF;YACpF,WAAW,EAAE,CAAC,mCAAc,EAAE,yCAAiB,EAAE,8CAAmB,CAAC;YACrE,SAAS,EAAE;gBACT,sBAAsB;gBACtB,8BAA8B,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBAC1D,2EAA2E;gBAC3E,2BAA2B,CAAC,OAAO,CAAC,eAAe,CAAC;gBACpD,uEAAuE;gBACvE,4BAA4B,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBACtD,2BAA2B,CAAC,OAAO,CAAC,eAAe,CAAC;gBACpD,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC5C,6BAA6B,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACxD,yBAAyB,CAAC,OAAO,CAAC,aAAa,CAAC;gBAChD,0BAA0B,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClD,gFAAgF;gBAChF,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxC,qEAAqE;gBACrE,0BAA0B,CAAC,OAAO,CAAC,cAAc,CAAC;gBAClD,wEAAwE;gBACxE,gEAAgE;gBAChE,gCAAgC,CAAC,OAAO,CAAC,YAAY,CAAC;gBACtD,+DAA+D;gBAC/D,qEAAqE;gBACrE,8CAA8C;gBAC9C,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpC,2EAA2E;gBAC3E,iFAAiF;gBACjF,iCAAiC,CAAC,OAAO,CAAC,qBAAqB,CAAC;gBAChE,sFAAsF;gBACtF,iFAAiF;gBACjF,uCAAuC;gBACvC,gCAAgC,CAAC,OAAO,CAAC,oBAAoB,CAAC;gBAC9D,yFAAyF;gBACzF,sFAAsF;gBACtF,wCAAwC;gBACxC,6BAA6B,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACxD,6EAA6E;gBAC7E,kFAAkF;gBAClF,+EAA+E;gBAC/E,qFAAqF;gBACrF,sFAAsF;gBACtF,gFAAgF;gBAChF;oBACE,OAAO,EAAE,mCAAuB;oBAChC,UAAU,EAAE,CAAC,IAAU,EAAiC,EAAE,CACxD,IAAI,2DAA6B,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;oBAC7F,MAAM,EAAE,CAAC,0BAAc,CAAC;iBACzB;gBACD,8EAA8E;gBAC9E,0EAA0E;gBAC1E,wBAAwB;gBACxB,0BAA0B;gBAC1B,uBAAuB;gBACvB,sBAAsB;gBACtB,qBAAqB;gBACrB,aAAa;gBACb,wBAAwB;gBACxB,qBAAqB;gBACrB,4EAA4E;gBAC5E,oBAAoB;gBACpB,sEAAsE;gBACtE,qEAAqE;gBACrE,sCAAe;gBACf,mEAAmE;gBACnE,0BAA0B;gBAC1B,4EAA4E;gBAC5E,wEAAwE;gBACxE,gCAAgC;gBAChC,oBAAoB;gBACpB,uBAAuB;gBACvB,+EAA+E;gBAC/E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,0DAA0D;gBAC1D,qBAAqB;gBACrB,yBAAyB;gBACzB,oBAAoB;aACrB;YACD,OAAO,EAAE;gBACP,gCAAoB;gBACpB,oCAAwB;gBACxB,sCAA0B;gBAC1B,oDAAsB;gBACtB,8DAA8D;gBAC9D,uCAA2B;gBAC3B,0EAA0E;gBAC1E,6EAA6E;gBAC7E,oCAAwB;gBACxB,oCAAwB;gBACxB,+BAAmB;gBACnB,sCAA0B;gBAC1B,iCAAqB;gBACrB,kCAAsB;gBACtB,2EAA2E;gBAC3E,6BAAiB;gBACjB,mEAAmE;gBACnE,mCAAuB;gBACvB,qEAAqE;gBACrE,sCAA0B;gBAC1B,8EAA8E;gBAC9E,gCAAoB;gBACpB,kEAAkE;gBAClE,0CAA8B;aAC/B;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjIY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAiItB"}

package/dist/auth/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/auth/connections.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;;;;;;;;;;;;;AAkBH,oCAcC;AASD,8CAIC;AA3CD,2CAAkE;AAClE,sDAA6C;AAC7C,sDAA4B;AAG5B;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,MAAiB;IAC5C,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAC5B,OAAO,iBAAO,CAAC,UAAU,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW;QAC/C,4EAA4E;QAC5E,cAAc,EAAE,MAAM;QACtB,sEAAsE;QACtE,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAAC,MAAiB;IACjD,iFAAiF;IACjF,2EAA2E;IAC3E,OAAO,IAAI,iBAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEX;IACA;IAFnB,YACmB,IAAU,EACV,KAAY;QADZ,SAAI,GAAJ,IAAI,CAAM;QACV,UAAK,GAAL,KAAK,CAAO;IAC5B,CAAC;IAEJ,KAAK,CAAC,eAAe;QACnB,oEAAoE;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;CACF,CAAA;AAnBY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;6CAIe,iBAAK;GAHpB,mBAAmB,CAmB/B"}

package/dist/auth/dto.d.ts

@@ -52,6 +52,27 @@ export interface SessionTokensView {
     readonly accessToken: string;
     readonly refreshToken: string;
 }
+/**
+ * The caller's own coarse authorization-fact projection — the EXACT shape
+ * `GET /identity/auth-facts` returns. Inlined into the login / mfa success body
+ * (ADDITIVE, optional) so the frontend can seed its permission-gated nav from
+ * the login result in ONE round-trip, instead of a second `/identity/auth-facts`
+ * fetch after login resolves. Carries `permissionsVersion` so the SDK's
+ * version-staleness contract still holds: a later poke detects a bump and
+ * refetches. A single ALLOWED fact per granted key (an absent fact is the
+ * fail-closed deny). Carries NO secret.
+ */
+export interface AuthFactsView {
+    readonly principalId: string;
+    readonly facts: ReadonlyArray<{
+        readonly action: string;
+        readonly allowed: boolean;
+        readonly resource?: string;
+        readonly reasonCode?: string;
+    }>;
+    readonly projectedAt: number;
+    readonly permissionsVersion?: number;
+}
 /** A successful session establishment payload (login / mfa / refresh success). */
 export interface SessionSuccess {
     readonly session: SessionView;
@@ -64,6 +85,17 @@ export interface SessionSuccess {
      * the enforced re-enroll flow. Carries NO secret — a pure signal flag.
      */
     readonly mfaRecoveryUsed?: boolean;
+    /**
+     * The caller's own auth-facts projection (same shape as `/identity/auth-facts`),
+     * inlined so the permission-gated nav is ready the instant login returns — no
+     * second round-trip on the login path. ADDITIVE + OPTIONAL: absent when the
+     * projector isn't wired or a projection couldn't be computed (best-effort — a
+     * projection failure NEVER fails the login); the frontend then falls back to
+     * its separate `/identity/auth-facts` fetch (graceful degradation for an older
+     * server too). Attached on login + mfa success; NEVER on the mfa-CHALLENGE
+     * branch (no session yet ⇒ no facts).
+     */
+    readonly authFacts?: AuthFactsView;
 }
 /** `POST /auth/login` request body. */
 export interface LoginRequest {

package/dist/auth/dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dto.d.ts","sourceRoot":"","sources":["../../src/auth/dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9D,oBAAoB;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oBAAoB;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAMD,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAMlE;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,cAAc,CAAC;AAMzC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAM7C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;CACxB"}
+{"version":3,"file":"dto.d.ts","sourceRoot":"","sources":["../../src/auth/dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9D,oBAAoB;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oBAAoB;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;CACpC;AAMD,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,oBAAoB,CAAC;AAMlE;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,cAAc,CAAC;AAMzC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAM7C;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;CACxB"}

package/dist/auth/dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dto.js","sourceRoot":"","sources":["../../src/auth/dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG"}

package/dist/auth/pending-mfa-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-mfa-store.js","sourceRoot":"","sources":["../../src/auth/pending-mfa-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;;;AAEH,6CAA0C;AAW1C,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,wFAAwF;AACxF,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;;GAGG;AACH,MAAa,eAAe;IAIP;IAEA;IALF,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE3D,YACmB,QAAgB,cAAc;IAC/C,iEAAiE;IAChD,QAAsB,IAAI,CAAC,GAAG;QAF9B,UAAK,GAAL,KAAK,CAAyB;QAE9B,UAAK,GAAL,KAAK,CAAyB;IAC9C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,YAAoB,EAAE,QAAgB;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;YACtB,YAAY;YACZ,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK;SACvC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAAa;QACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,4EAA4E;QAC5E,+EAA+E;QAC/E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED,mFAAmF;IAC3E,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,GAAG,IAAI,KAAK,CAAC,WAAW;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAlDD,0CAkDC"}

package/dist/auth/persistence.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.module.js","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;;;;;;;;AAEH,2CAA2E;AAI3E,iEAAwD;AACxD,2CAA2D;AAC3D,qDAAwF;AAExF;;;;GAIG;AACH,MAAM,cAAc,GAAa;IAC/B,OAAO,EAAE,0BAAc;IACvB,UAAU,EAAE,CAAC,MAAiB,EAAQ,EAAE,CAAC,IAAA,6BAAY,EAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,CAAC,6BAAU,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,aAAa,GAAa;IAC9B,OAAO,EAAE,wBAAY;IACrB,UAAU,EAAE,CAAC,MAAiB,EAAS,EAAE,CAAC,IAAA,kCAAiB,EAAC,MAAM,CAAC;IACnE,MAAM,EAAE,CAAC,6BAAU,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAa;IAClC,OAAO,EAAE,oCAAmB;IAC5B,UAAU,EAAE,CAAC,IAAU,EAAE,KAAY,EAAuB,EAAE,CAC5D,IAAI,oCAAmB,CAAC,IAAI,EAAE,KAAK,CAAC;IACtC,MAAM,EAAE,CAAC,0BAAc,EAAE,wBAAY,CAAC;CACvC,CAAC;AAEF;;;;GAIG;AAEI,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAC5B,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,MAAM,EAAE,mBAAiB;YACzB,SAAS,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC;YAC7D,OAAO,EAAE,CAAC,0BAAc,EAAE,wBAAY,CAAC;SACxC,CAAC;IACJ,CAAC;CACF,CAAA;AARY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,iBAAiB,CAQ7B"}

package/dist/auth/ports/audit-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sink.js","sourceRoot":"","sources":["../../../src/auth/ports/audit-sink.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/auth/ports/credential-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-writer.js","sourceRoot":"","sources":["../../../src/auth/ports/credential-writer.ts"],"names":[],"mappings":""}

package/dist/auth/ports/email-sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-sender.js","sourceRoot":"","sources":["../../../src/auth/ports/email-sender.ts"],"names":[],"mappings":""}

package/dist/auth/ports/membership-checker.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The `MembershipChecker` PORT (Task 5.2 of the scoped-hierarchy tenancy program,
+ * ADR-0027 / ADR-0024) — the OPT-IN seam the auth surface uses to GATE a SCOPE-SWITCH:
+ * before a principal may re-bind its session to act under a different active node, the
+ * framework MUST confirm the principal actually HOLDS a binding at that node (an active
+ * `company_membership`). This is the fail-closed gate that stops a principal switching
+ * to a FOREIGN node it is not bound at (which would be a fail-open tenancy hole).
+ *
+ * ── ONE QUESTION ────────────────────────────────────────────────────────────────────
+ * `hasActiveMembership(principalId, nodeId)` → does `principalId` hold an ACTIVE
+ * membership at `nodeId`? The identity impl answers with a single existence read over
+ * `shield_app.company_membership` (`cm_is_active = 1 AND cm_status = 'active'`).
+ *
+ * ── LAYERING ────────────────────────────────────────────────────────────────────────
+ * The PORT is DEFINED here in `@astram/guard`; the IMPLEMENTATION lives in
+ * `@astram/identity` (`DbMembershipChecker`, which owns the app schema + the
+ * `company_membership` table). The consumer injects an instance through
+ * `ShieldModule.forRoot({ membershipChecker })` — the sanctioned direction (port in
+ * guard, impl in identity). Guard never imports identity. Mirrors `ScopeSubtreeResolver`.
+ *
+ * ── FAIL-CLOSED (the security point) ────────────────────────────────────────────────
+ * A scope-switch is DENIED unless the checker AFFIRMATIVELY returns `true`:
+ *   - ABSENT (no checker wired) → the switch fails closed (cannot verify the binding →
+ *     do not grant it). An unwired checker NEVER allows a switch.
+ *   - `false` (no active membership at the target) → DENIED (403). The old binding stands.
+ *   - a THROW (store outage) → treated as DENY (cannot verify → fail closed).
+ * The framework NEVER trusts `targetNodeId` from the client without this affirmative
+ * binding check — that would be the fail-open hole (a principal switching to a node it
+ * isn't bound at, inheriting that node's subtree + authority).
+ */
+export interface MembershipChecker {
+    /**
+     * Does `principalId` hold an ACTIVE membership at `nodeId` (an active
+     * `company_membership` — `cm_is_active = 1 AND cm_status = 'active'`)? Returns `true`
+     * ONLY when such a binding exists. The scope-switch gate treats anything but a
+     * `true` (a `false`, or a thrown store outage the caller swallows) as a DENY —
+     * fail-closed, never fail-open.
+     */
+    hasActiveMembership(principalId: string, nodeId: string): Promise<boolean>;
+}
+//# sourceMappingURL=membership-checker.d.ts.map

package/dist/auth/ports/membership-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-checker.d.ts","sourceRoot":"","sources":["../../../src/auth/ports/membership-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5E"}

package/dist/auth/ports/membership-checker.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * The `MembershipChecker` PORT (Task 5.2 of the scoped-hierarchy tenancy program,
+ * ADR-0027 / ADR-0024) — the OPT-IN seam the auth surface uses to GATE a SCOPE-SWITCH:
+ * before a principal may re-bind its session to act under a different active node, the
+ * framework MUST confirm the principal actually HOLDS a binding at that node (an active
+ * `company_membership`). This is the fail-closed gate that stops a principal switching
+ * to a FOREIGN node it is not bound at (which would be a fail-open tenancy hole).
+ *
+ * ── ONE QUESTION ────────────────────────────────────────────────────────────────────
+ * `hasActiveMembership(principalId, nodeId)` → does `principalId` hold an ACTIVE
+ * membership at `nodeId`? The identity impl answers with a single existence read over
+ * `shield_app.company_membership` (`cm_is_active = 1 AND cm_status = 'active'`).
+ *
+ * ── LAYERING ────────────────────────────────────────────────────────────────────────
+ * The PORT is DEFINED here in `@astram/guard`; the IMPLEMENTATION lives in
+ * `@astram/identity` (`DbMembershipChecker`, which owns the app schema + the
+ * `company_membership` table). The consumer injects an instance through
+ * `ShieldModule.forRoot({ membershipChecker })` — the sanctioned direction (port in
+ * guard, impl in identity). Guard never imports identity. Mirrors `ScopeSubtreeResolver`.
+ *
+ * ── FAIL-CLOSED (the security point) ────────────────────────────────────────────────
+ * A scope-switch is DENIED unless the checker AFFIRMATIVELY returns `true`:
+ *   - ABSENT (no checker wired) → the switch fails closed (cannot verify the binding →
+ *     do not grant it). An unwired checker NEVER allows a switch.
+ *   - `false` (no active membership at the target) → DENIED (403). The old binding stands.
+ *   - a THROW (store outage) → treated as DENY (cannot verify → fail closed).
+ * The framework NEVER trusts `targetNodeId` from the client without this affirmative
+ * binding check — that would be the fail-open hole (a principal switching to a node it
+ * isn't bound at, inheriting that node's subtree + authority).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/ports/membership-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-checker.js","sourceRoot":"","sources":["../../../src/auth/ports/membership-checker.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}

package/dist/auth/ports/mfa-device-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-device-store.js","sourceRoot":"","sources":["../../../src/auth/ports/mfa-device-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG"}

package/dist/auth/ports/profile-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-writer.js","sourceRoot":"","sources":["../../../src/auth/ports/profile-writer.ts"],"names":[],"mappings":""}

package/dist/auth/ports/recovery-code-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-code-store.js","sourceRoot":"","sources":["../../../src/auth/ports/recovery-code-store.ts"],"names":[],"mappings":""}

package/dist/auth/ports/reset-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-token-store.js","sourceRoot":"","sources":["../../../src/auth/ports/reset-token-store.ts"],"names":[],"mappings":""}

package/dist/auth/ports/scope-subtree-resolver.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The `ScopeSubtreeResolver` PORT (Task 2.2 of the scoped-hierarchy tenancy program,
+ * ADR-0027 / ADR-0024) — the OPT-IN seam the auth surface uses to resolve a principal's
+ * ACTIVE-SCOPE SUBTREE (its active scope node + all descendants) ONCE at LOGIN time, so
+ * the resolved set can be cached on the session binding and the per-request tenant gate
+ * reads it from the binding with ZERO extra DB (the parity guarantee).
+ *
+ * ── WHY A DEDICATED PORT (a sibling to `SessionFactsProjector`, not an extension) ─────
+ * The subtree is a TENANCY-ISOLATION concern (the reach of a principal's active scope),
+ * distinct from `SessionFactsProjector`'s PERFORMANCE opt-in (caching coarse grants to
+ * skip a gate-5 DB reload). They are wired INDEPENDENTLY: a deployment may want the real
+ * hierarchical subtree without turning on facts-caching (the reference consumer wires no
+ * facts projector today). One tiny single-responsibility interface, its own fail-safe
+ * semantics — no coupling of tenancy correctness to a caching opt-in.
+ *
+ * ── LAYERING ──────────────────────────────────────────────────────────────────────
+ * The PORT is DEFINED here in `@astram/guard`; the IMPLEMENTATION lives in
+ * `@astram/identity` (`DbScopeSubtreeResolver`, which owns the app/authz schemas + the
+ * `scope_closure` the subtree is read from). The consumer injects an instance through
+ * `ShieldModule.forRoot({ scopeSubtreeResolver })` — the sanctioned direction (port in
+ * guard, impl in identity). Guard never imports identity.
+ *
+ * ── OPT-IN / ADDITIVE / FAIL-SAFE ──────────────────────────────────────────────────
+ * ABSENT (the default): the auth controller omits `scopeSubtreeNodeIds` when binding the
+ * session → the per-request `principalFromClaims` falls back to `[tenantId]` (the self
+ * node) = today's exact flat self-tenant isolation (non-widening).
+ * PRESENT: the controller calls `resolveSubtree(activeScopeNodeId)` at login and stores
+ * the returned set on the binding, so the per-request tenant gate reads the real subtree.
+ * A resolver that THROWS is swallowed best-effort at login (→ subtree omitted → self-node
+ * fallback): a resolution failure NEVER fails the login and NEVER widens reach. An EMPTY
+ * result is likewise treated as "omit" → self-node fallback (non-widening).
+ *
+ * ── ROOT ──────────────────────────────────────────────────────────────────────────
+ * The subtree is resolved the SAME way for every principal; a root's extra cross-tree span
+ * comes from `isRoot` in the tenant gate (authoritative), NOT from a widened subtree here.
+ */
+export interface ScopeSubtreeResolver {
+    /**
+     * Resolve the active-scope subtree for `activeScopeNodeId` — that node plus all its
+     * descendants — from the scope closure, at login time (ADR-0027). Returns the set of node
+     * ids to cache on the session binding. Implementations return `[activeScopeNodeId]` (the
+     * self-node, non-widening) when the closure has no rows for the node yet (pre-first-reconcile),
+     * and THROW on a store outage (the auth controller swallows it best-effort → the binding
+     * omits the subtree → the per-request path falls back to the self-node).
+     */
+    resolveSubtree(activeScopeNodeId: string): Promise<readonly string[]>;
+}
+//# sourceMappingURL=scope-subtree-resolver.d.ts.map

package/dist/auth/ports/scope-subtree-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-subtree-resolver.d.ts","sourceRoot":"","sources":["../../../src/auth/ports/scope-subtree-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACvE"}

package/dist/auth/ports/scope-subtree-resolver.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * The `ScopeSubtreeResolver` PORT (Task 2.2 of the scoped-hierarchy tenancy program,
+ * ADR-0027 / ADR-0024) — the OPT-IN seam the auth surface uses to resolve a principal's
+ * ACTIVE-SCOPE SUBTREE (its active scope node + all descendants) ONCE at LOGIN time, so
+ * the resolved set can be cached on the session binding and the per-request tenant gate
+ * reads it from the binding with ZERO extra DB (the parity guarantee).
+ *
+ * ── WHY A DEDICATED PORT (a sibling to `SessionFactsProjector`, not an extension) ─────
+ * The subtree is a TENANCY-ISOLATION concern (the reach of a principal's active scope),
+ * distinct from `SessionFactsProjector`'s PERFORMANCE opt-in (caching coarse grants to
+ * skip a gate-5 DB reload). They are wired INDEPENDENTLY: a deployment may want the real
+ * hierarchical subtree without turning on facts-caching (the reference consumer wires no
+ * facts projector today). One tiny single-responsibility interface, its own fail-safe
+ * semantics — no coupling of tenancy correctness to a caching opt-in.
+ *
+ * ── LAYERING ──────────────────────────────────────────────────────────────────────
+ * The PORT is DEFINED here in `@astram/guard`; the IMPLEMENTATION lives in
+ * `@astram/identity` (`DbScopeSubtreeResolver`, which owns the app/authz schemas + the
+ * `scope_closure` the subtree is read from). The consumer injects an instance through
+ * `ShieldModule.forRoot({ scopeSubtreeResolver })` — the sanctioned direction (port in
+ * guard, impl in identity). Guard never imports identity.
+ *
+ * ── OPT-IN / ADDITIVE / FAIL-SAFE ──────────────────────────────────────────────────
+ * ABSENT (the default): the auth controller omits `scopeSubtreeNodeIds` when binding the
+ * session → the per-request `principalFromClaims` falls back to `[tenantId]` (the self
+ * node) = today's exact flat self-tenant isolation (non-widening).
+ * PRESENT: the controller calls `resolveSubtree(activeScopeNodeId)` at login and stores
+ * the returned set on the binding, so the per-request tenant gate reads the real subtree.
+ * A resolver that THROWS is swallowed best-effort at login (→ subtree omitted → self-node
+ * fallback): a resolution failure NEVER fails the login and NEVER widens reach. An EMPTY
+ * result is likewise treated as "omit" → self-node fallback (non-widening).
+ *
+ * ── ROOT ──────────────────────────────────────────────────────────────────────────
+ * The subtree is resolved the SAME way for every principal; a root's extra cross-tree span
+ * comes from `isRoot` in the tenant gate (authoritative), NOT from a widened subtree here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/ports/scope-subtree-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-subtree-resolver.js","sourceRoot":"","sources":["../../../src/auth/ports/scope-subtree-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG"}

package/dist/auth/ports/session-facts-projector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-facts-projector.js","sourceRoot":"","sources":["../../../src/auth/ports/session-facts-projector.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}

package/dist/auth/ports/session-sweeper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sweeper.js","sourceRoot":"","sources":["../../../src/auth/ports/session-sweeper.ts"],"names":[],"mappings":""}

package/dist/auth/profile-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-resolver.js","sourceRoot":"","sources":["../../src/auth/profile-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/auth/rate-limit/attempt-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempt-limiter.js","sourceRoot":"","sources":["../../../src/auth/rate-limit/attempt-limiter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;;;AAEH,2CAAwC;AAWxC,MAAa,cAAc;IAKN;IACA;IALnB,oFAAoF;IAC5E,MAAM,CAAU,MAAM,GAAG,IAAI,eAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAEjE,YACmB,KAAY,EACZ,GAAyB;QADzB,UAAK,GAAL,KAAK,CAAO;QACZ,QAAG,GAAH,GAAG,CAAsB;IACzC,CAAC;IAEJ;;;;;OAKG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;IAC9B,CAAC;IAED,iFAAiF;IACzE,CAAC,CAAC,GAAW;QACnB,OAAO,mBAAmB,GAAG,EAAE,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,+EAA+E;YAC/E,cAAc,CAAC,MAAM,CAAC,IAAI,CACxB,+EAA+E,aAAa,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,+EAA+E;YAC/E,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5D,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+EAA+E;YAC/E,6EAA6E;YAC7E,gFAAgF;YAChF,8DAA8D;YAC9D,cAAc,CAAC,MAAM,CAAC,IAAI,CACxB,uEAAuE,aAAa,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;;AAtFH,wCAuFC;AAED,sFAAsF;AACtF,SAAS,aAAa,CAAC,GAAY;IACjC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/auth/tokens.d.ts

@@ -185,6 +185,31 @@ export declare const SHIELD_ROOT_IDS: unique symbol;
  * `auth: true`.
  */
 export declare const SHIELD_SESSION_FACTS_PROJECTOR: unique symbol;
+/**
+ * OPTIONAL {@link import('./ports/scope-subtree-resolver.js').ScopeSubtreeResolver} — the
+ * Task 2.2 (ADR-0027 / ADR-0024) active-scope-subtree seam. Threaded through
+ * `ShieldModule.forRoot({ scopeSubtreeResolver })` → `AuthModule.forRoot`, `@Optional()`
+ * (bound `null` when absent). When PRESENT, the auth controller calls
+ * `resolveSubtree(activeScopeNodeId)` ONCE at login and caches the returned node-id set on
+ * the session binding (`scopeSubtreeNodeIds`), so the per-request tenant gate reads the real
+ * closure-resolved subtree from the binding with ZERO extra DB (the parity guarantee). ABSENT
+ * → the controller omits `scopeSubtreeNodeIds` → the per-request path falls back to the
+ * self-node `[tenantId]` (today's flat isolation, non-widening). Fail-safe: a resolver that
+ * throws NEVER fails login. Purely additive + opt-in. Only consulted under `auth: true`.
+ */
+export declare const SHIELD_SCOPE_SUBTREE_RESOLVER: unique symbol;
+/**
+ * OPTIONAL {@link import('./ports/membership-checker.js').MembershipChecker} — the Task 5.2
+ * (ADR-0027 / ADR-0024) SCOPE-SWITCH gate seam. Threaded through
+ * `ShieldModule.forRoot({ membershipChecker })` → `AuthModule.forRoot`, `@Optional()` (bound
+ * `null` when absent). When PRESENT, `POST /auth/scope-switch` calls
+ * `hasActiveMembership(principalId, targetNodeId)` BEFORE re-binding the session to the new
+ * active node — a principal may only switch to a node it HOLDS an active membership at. ABSENT
+ * (or a `false`/thrown result) → the switch is DENIED (fail-closed: cannot verify the binding →
+ * do not grant it; `targetNodeId` is NEVER trusted without this affirmative check). Only
+ * consulted under `auth: true`. Mirrors {@link SHIELD_SCOPE_SUBTREE_RESOLVER}'s wiring.
+ */
+export declare const SHIELD_MEMBERSHIP_CHECKER: unique symbol;
 /**
  * The password-login {@link AttemptLimiter} (spec §5 / IdP-hardening H1) — keyed
  * `login:<identityHint>`, default 10 failures / 15-min window. Consumed at the TOP

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAW3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAUvF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAW3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC"}