@astram/identity 0.15.0 → 0.17.0

package/dist/features/security-policy/security-policy.service.d.ts

@@ -0,0 +1,94 @@
+import { type FrameworkSchemas, type Principal } from '@astram/core';
+import { RecordsService, type RecordId, type RecordView } from '@astram/engine';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
+import { type ListParams } from '../shared/list-query.js';
+import { type SecurityPolicyVersionBump } from './security-policy-version-bump.js';
+/** `POST /identity/security-policies` body, already stripped to the documented fields. */
+export interface CreateSecurityPolicyInput {
+    /** Canonical company uuid (controller `optionalUuidField`); absent ⇒ the actor's active node. */
+    readonly scopeNodeUuid?: string;
+    readonly platform?: unknown;
+    readonly targetKind?: unknown;
+    readonly targetValue?: unknown;
+    readonly graceDays?: unknown;
+}
+/** `PUT /identity/security-policies/:uuid` body: the two changeable fields. */
+export interface UpdateSecurityPolicyInput {
+    readonly targetValue?: unknown;
+    readonly graceDays?: unknown;
+}
+/**
+ * SecurityPolicyService — mandatory-2FA policies (auth capabilities R2.6, R2.9) over the engine:
+ * every write runs the engine's gate (`decide()` on `identity:security_policy:<action>`, the
+ * subtree read/write wall) and these authority rules on top:
+ *
+ *  - **Create or tighten** (add a policy, widen its target, shorten its grace): the permission
+ *    holder, for a node inside their subtree (root anywhere). Tightening only adds a requirement
+ *    every user meets by self-service enrolment, so no grant ceiling or dominance applies.
+ *  - **Lower or delete** (remove, narrow or move the target, lengthen grace): a `role` policy needs
+ *    the grant ceiling over every key the role grants (`assertCanAssignRoles`); a `permission`
+ *    policy over its listed key (`assertCanGrant`); a `tenant` policy all of `identity:*`
+ *    (`assertCanGrant(['identity:*'])`: the actor's keys at their tenant, which is the node or an
+ *    ancestor since the node is in their subtree). Judged on the policy AS STORED. Root bypasses.
+ *  - **Platform floor**: root only, for every write.
+ *  - **Rules set from above** (D-12): each policy stores the node its creator acted at
+ *    (`createdAtNode`, from the session); lowering or deleting it also needs the actor to act at
+ *    that node or an ancestor (root bypasses), so a subsidiary admin cannot weaken a group rule.
+ *
+ * Each write is one engine transaction: lock the row, re-read and re-check it (CONVENTIONS: no
+ * check-then-write across transactions), write, a `permission_change` audit row on the same
+ * transaction, and the permission-version bump of every tenant in the policy's scope on the same
+ * transaction (published to Redis after the commit), so guard's recompute sees the change on each
+ * user's next request. No bump wired ⇒ every write is refused (503): a policy never lands silently.
+ * Error messages are fixed and name no ids.
+ */
+export declare class SecurityPolicyService {
+    private readonly records;
+    private readonly ceiling;
+    private readonly versionBump?;
+    private readonly audit;
+    /** `<app>`, where `roles` lives (the root existence check for a role target). */
+    private readonly appSchema;
+    /** Epoch-ms clock (a field, not a constructor parameter: Nest injects every parameter). */
+    private readonly now;
+    constructor(records: RecordsService, ceiling: GrantCeiling, versionBump?: (SecurityPolicyVersionBump | null) | undefined, schemas?: FrameworkSchemas | null);
+    /** List policies (walled to the caller's subtree by the engine; platform rows: root only). */
+    listPolicies(params?: ListParams): Promise<{
+        rows: RecordView[];
+        total: number;
+    }>;
+    /** Read one policy (walled read). */
+    getPolicy(uuid: string): Promise<RecordView | null>;
+    /** Create a policy (create/tighten authority; platform floor root only). */
+    createPolicy(actor: Principal, input: CreateSecurityPolicyInput): Promise<RecordId>;
+    /** Change a policy's target or grace (tighten freely; lower under the R2.6 lower rules). */
+    updatePolicy(actor: Principal, uuid: string, patch: UpdateSecurityPolicyInput): Promise<void>;
+    /** Delete a policy (always a lower: R2.6 lower rules; platform floor root only). */
+    deletePolicy(actor: Principal, uuid: string): Promise<void>;
+    private requireBump;
+    private inSubtree;
+    /** Lock the row, re-read it on the transaction, and apply the reach and floor rules. */
+    private lockAndRead;
+    /**
+     * Decision (6) of slice D: a role target must exist and be visible to the actor. Non-root: the
+     * role's owner company is in the actor's subtree (G-013 owner rule, the one grant administration
+     * uses, `GrantCeiling.roleOwnedInReach`); an owner implies the role exists, and an ownerless role
+     * is root only. Root: the role row exists (read on the write's transaction). Otherwise 404 with a
+     * fixed message (no existence oracle, no id).
+     */
+    private assertRoleTarget;
+    /**
+     * The R2.6 lower rule for the policy as stored. Root bypasses. D-12 (rules set from above): the
+     * actor must also act at the node the policy was created at or an ancestor of it, i.e. that node
+     * is in the actor's subtree; a legacy row with no creator node is judged at its scope node.
+     */
+    private assertMayLower;
+    /**
+     * One engine transaction with the transaction's own connection exposed for the audit row and the
+     * version bump; versions are published after the commit, dropped after a rollback.
+     */
+    private write;
+    /** The `permission_change` row on the write's transaction (fail closed: it rolls back with it). */
+    private recordAudit;
+}
+//# sourceMappingURL=security-policy.service.d.ts.map

package/dist/features/security-policy/security-policy.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.service.d.ts","sourceRoot":"","sources":["../../../src/features/security-policy/security-policy.service.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,SAAS,EAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,cAAc,EAGd,KAAK,QAAQ,EACb,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAgC,MAAM,2BAA2B,CAAC;AACvF,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAS1E,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAM3C,0FAA0F;AAC1F,MAAM,WAAW,yBAAyB;IACxC,iGAAiG;IACjG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAmHD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBACa,qBAAqB;IAQ9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAX/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,yBAAyB,GAAG,IAAI,aAAA,EAG/D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAMnC,8FAA8F;IACxF,YAAY,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvF,qCAAqC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAKzD,4EAA4E;IACtE,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8DzF,4FAA4F;IACtF,YAAY,CAChB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,IAAI,CAAC;IA+ChB,oFAAoF;IAC9E,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjE,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,SAAS;IAIjB,wFAAwF;YAC1E,WAAW;IAqBzB;;;;;;OAMG;YACW,gBAAgB;IAc9B;;;;OAIG;YACW,cAAc;IAqB5B;;;OAGG;YACW,KAAK;IAiCnB,mGAAmG;YACrF,WAAW;CAkB1B"}

package/dist/features/security-policy/security-policy.service.js

@@ -0,0 +1,429 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityPolicyService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+const internal_1 = require("@astram/engine/internal");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const list_query_js_1 = require("../shared/list-query.js");
+const http_js_1 = require("../shared/http.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
+const schema_js_1 = require("../../schema.js");
+const security_policy_version_bump_js_1 = require("./security-policy-version-bump.js");
+const TYPE = 'security_policy';
+const SEARCH_FIELDS = ['targetValue'];
+const SORT_FIELDS = ['targetKind', 'graceDays', 'createdAtMs', 'updatedAtMs'];
+/** The prefix a grant wildcard covers (`identity:*`, bare `identity` → `identity:`), else null. */
+function wildcardPrefix(key) {
+    if (key.endsWith(':*'))
+        return key.slice(0, -1);
+    if (!key.includes(':'))
+        return `${key}:`;
+    return null;
+}
+/** True when key `a` covers every key `b` covers (`b` is equal to or under `a`'s wildcard). */
+function keyCovers(a, b) {
+    const pa = wildcardPrefix(a);
+    const pb = wildcardPrefix(b);
+    if (pa === null)
+        return a === b;
+    return (pb ?? b).startsWith(pa);
+}
+function parsePlatform(v) {
+    if (v === undefined || v === null)
+        return false;
+    if (typeof v !== 'boolean')
+        throw new identity_errors_js_1.IdentityBadRequestError('platform must be true or false.');
+    return v;
+}
+function parseKind(v) {
+    if (typeof v === 'string' && core_1.SECURITY_POLICY_TARGET_KINDS.includes(v)) {
+        return v;
+    }
+    throw new identity_errors_js_1.IdentityBadRequestError('targetKind must be one of: tenant, role, permission.');
+}
+function parseGrace(v) {
+    if (typeof v === 'number' && Number.isInteger(v) && v >= 0 && v <= core_1.MAX_MFA_GRACE_DAYS)
+        return v;
+    throw new identity_errors_js_1.IdentityBadRequestError(`graceDays must be a whole number from 0 to ${core_1.MAX_MFA_GRACE_DAYS}.`);
+}
+function parseTarget(kind, v) {
+    if (kind === 'tenant') {
+        if (v === undefined || v === null)
+            return null;
+        throw new identity_errors_js_1.IdentityBadRequestError('An organisation-wide policy has no target.');
+    }
+    if (kind === 'role') {
+        const id = (0, engine_1.canonicalUuid)(v);
+        if (id === null)
+            throw new identity_errors_js_1.IdentityBadRequestError('Choose a role for this policy.');
+        return id;
+    }
+    if (typeof v === 'string' && (0, core_1.isSecurityPolicyPermissionTarget)(v))
+        return v;
+    throw new identity_errors_js_1.IdentityBadRequestError('Enter a permission key such as identity:user:update, or a wildcard such as identity:*.');
+}
+function toStored(fields) {
+    const p = fields.platform;
+    const grace = Number(fields.graceDays);
+    return {
+        scopeNodeUuid: typeof fields.scopeNodeUuid === 'string' ? fields.scopeNodeUuid : null,
+        createdAtNode: typeof fields.createdAtNode === 'string' ? fields.createdAtNode : null,
+        platform: p === true || p === 1 || p === '1',
+        targetKind: String(fields.targetKind ?? ''),
+        targetValue: typeof fields.targetValue === 'string' ? fields.targetValue : null,
+        // An unreadable stored grace counts as 0 (the strictest), so a lengthening is judged a lower.
+        graceDays: Number.isInteger(grace) ? grace : 0,
+    };
+}
+/**
+ * A stored policy as the HTTP response carries it (QA2 B8): the BIGINT epoch-ms columns come back
+ * from the driver as a `bigint` (or a numeric string), which `JSON.stringify` refuses (a 500), and
+ * the TINYINT flag as 0/1. Coerce them to the documented `number` / `boolean`.
+ */
+function toJsonView(view) {
+    const f = view.fields;
+    const p = f.platform;
+    return {
+        ...view,
+        fields: {
+            ...f,
+            platform: p === true || p === 1 || p === '1',
+            graceDays: Number(f.graceDays),
+            createdAtMs: (0, http_js_1.asEpochMs)(f.createdAtMs),
+            updatedAtMs: (0, http_js_1.asEpochMs)(f.updatedAtMs),
+        },
+    };
+}
+/** The fixed 403 text for a refused lower or delete (R2.6, D-12); names no ids. */
+function lowerRefusal(p) {
+    return p.targetKind === 'role' || p.targetKind === 'permission'
+        ? 'You cannot relax this policy: it covers permissions you do not hold.'
+        : 'Relaxing an organisation-wide policy needs full identity administration.';
+}
+/** The driver errno of an engine/driver error, also through one `cause` level. */
+function errnoOf(e) {
+    const own = e?.errno;
+    if (typeof own === 'number')
+        return own;
+    const inner = e?.cause?.errno;
+    return typeof inner === 'number' ? inner : undefined;
+}
+/**
+ * SecurityPolicyService — mandatory-2FA policies (auth capabilities R2.6, R2.9) over the engine:
+ * every write runs the engine's gate (`decide()` on `identity:security_policy:<action>`, the
+ * subtree read/write wall) and these authority rules on top:
+ *
+ *  - **Create or tighten** (add a policy, widen its target, shorten its grace): the permission
+ *    holder, for a node inside their subtree (root anywhere). Tightening only adds a requirement
+ *    every user meets by self-service enrolment, so no grant ceiling or dominance applies.
+ *  - **Lower or delete** (remove, narrow or move the target, lengthen grace): a `role` policy needs
+ *    the grant ceiling over every key the role grants (`assertCanAssignRoles`); a `permission`
+ *    policy over its listed key (`assertCanGrant`); a `tenant` policy all of `identity:*`
+ *    (`assertCanGrant(['identity:*'])`: the actor's keys at their tenant, which is the node or an
+ *    ancestor since the node is in their subtree). Judged on the policy AS STORED. Root bypasses.
+ *  - **Platform floor**: root only, for every write.
+ *  - **Rules set from above** (D-12): each policy stores the node its creator acted at
+ *    (`createdAtNode`, from the session); lowering or deleting it also needs the actor to act at
+ *    that node or an ancestor (root bypasses), so a subsidiary admin cannot weaken a group rule.
+ *
+ * Each write is one engine transaction: lock the row, re-read and re-check it (CONVENTIONS: no
+ * check-then-write across transactions), write, a `permission_change` audit row on the same
+ * transaction, and the permission-version bump of every tenant in the policy's scope on the same
+ * transaction (published to Redis after the commit), so guard's recompute sees the change on each
+ * user's next request. No bump wired ⇒ every write is refused (503): a policy never lands silently.
+ * Error messages are fixed and name no ids.
+ */
+let SecurityPolicyService = class SecurityPolicyService {
+    records;
+    ceiling;
+    versionBump;
+    audit;
+    /** `<app>`, where `roles` lives (the root existence check for a role target). */
+    appSchema;
+    /** Epoch-ms clock (a field, not a constructor parameter: Nest injects every parameter). */
+    now = Date.now;
+    constructor(records, ceiling, versionBump, schemas) {
+        this.records = records;
+        this.ceiling = ceiling;
+        this.versionBump = versionBump;
+        this.audit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
+        this.appSchema = (schemas ?? (0, schema_js_1.frameworkSchemasFromEnv)()).app;
+    }
+    /** List policies (walled to the caller's subtree by the engine; platform rows: root only). */
+    async listPolicies(params) {
+        const page = await this.records.list(TYPE, (0, list_query_js_1.buildListQuery)(params, SEARCH_FIELDS, SORT_FIELDS));
+        return { rows: page.rows.map(toJsonView), total: page.total };
+    }
+    /** Read one policy (walled read). */
+    async getPolicy(uuid) {
+        const view = await this.records.get(TYPE, uuid);
+        return view === null ? null : toJsonView(view);
+    }
+    /** Create a policy (create/tighten authority; platform floor root only). */
+    async createPolicy(actor, input) {
+        const bump = this.requireBump();
+        const isRoot = actor.isRoot === true;
+        const platform = parsePlatform(input.platform);
+        const targetKind = parseKind(input.targetKind);
+        const targetValue = parseTarget(targetKind, input.targetValue);
+        const graceDays = input.graceDays === undefined ? 0 : parseGrace(input.graceDays);
+        let scopeNodeUuid;
+        if (platform) {
+            if (!isRoot) {
+                throw new identity_errors_js_1.IdentityForbiddenError('Only a platform administrator can set a platform-wide policy.');
+            }
+            if (input.scopeNodeUuid !== undefined) {
+                throw new identity_errors_js_1.IdentityBadRequestError('A platform-wide policy applies to every organisation; do not choose one.');
+            }
+            scopeNodeUuid = null;
+        }
+        else {
+            scopeNodeUuid = input.scopeNodeUuid ?? actor.activeScopeNodeId ?? actor.tenantId;
+            if (!isRoot && !this.inSubtree(actor, scopeNodeUuid)) {
+                throw new identity_errors_js_1.IdentityForbiddenError('You can only set a policy for an organisation you manage.');
+            }
+        }
+        // D-12: the node the creator acts at, from the session (never the body). A platform row has
+        // none (root only, judged by the floor rule).
+        const createdAtNode = platform ? null : (actor.activeScopeNodeId ?? actor.tenantId);
+        const nowMs = this.now();
+        // A NULL column (the scope node of a platform row, the target of a `tenant` policy) is left
+        // out: the engine's validate stage refuses `null` for a typed field, and the column defaults
+        // to NULL (task 22 live run: every tenant and platform policy was refused with a 400).
+        const fields = {
+            ...(scopeNodeUuid !== null ? { scopeNodeUuid } : {}),
+            platform,
+            targetKind,
+            ...(targetValue !== null ? { targetValue } : {}),
+            graceDays,
+            ...(createdAtNode !== null ? { createdAtNode } : {}),
+            createdAtMs: nowMs,
+            updatedAtMs: nowMs,
+        };
+        return this.write(bump, async (tx, conn) => {
+            if (targetKind === 'role')
+                await this.assertRoleTarget(actor, targetValue, conn);
+            const id = await tx.create(TYPE, { fields });
+            await this.recordAudit(conn, actor, 'created', id, {
+                scopeNodeId: scopeNodeUuid,
+                platform,
+                targetKind,
+                targetValue,
+                graceDays,
+                direction: 'tighten',
+            });
+            return { result: id, changed: true, scope: scopeNodeUuid };
+        });
+    }
+    /** Change a policy's target or grace (tighten freely; lower under the R2.6 lower rules). */
+    async updatePolicy(actor, uuid, patch) {
+        const bump = this.requireBump();
+        const newGrace = patch.graceDays === undefined ? undefined : parseGrace(patch.graceDays);
+        await this.write(bump, async (tx, conn) => {
+            const current = await this.lockAndRead(tx, actor, uuid);
+            const newTarget = patch.targetValue === undefined
+                ? undefined
+                : parseTarget(current.targetKind, patch.targetValue);
+            const fields = {};
+            const directions = [];
+            if (newGrace !== undefined && newGrace !== current.graceDays) {
+                fields.graceDays = newGrace;
+                directions.push(newGrace < current.graceDays ? 'tighten' : 'lower');
+            }
+            if (newTarget !== undefined && newTarget !== current.targetValue) {
+                if (current.targetKind === 'role') {
+                    await this.assertRoleTarget(actor, newTarget, conn);
+                }
+                fields.targetValue = newTarget;
+                const widens = current.targetKind === 'permission' &&
+                    current.targetValue !== null &&
+                    keyCovers(newTarget, current.targetValue);
+                directions.push(widens ? 'tighten' : 'lower');
+            }
+            if (directions.length === 0)
+                return { result: undefined, changed: false, scope: null };
+            const direction = directions.includes('lower') ? 'lower' : 'tighten';
+            if (direction === 'lower')
+                await this.assertMayLower(actor, current);
+            fields.updatedAtMs = this.now();
+            await tx.update(TYPE, uuid, { fields });
+            await this.recordAudit(conn, actor, 'updated', uuid, {
+                scopeNodeId: current.scopeNodeUuid,
+                platform: current.platform,
+                targetKind: current.targetKind,
+                targetValue: fields.targetValue ?? current.targetValue,
+                graceDays: fields.graceDays ?? current.graceDays,
+                previousTargetValue: current.targetValue,
+                previousGraceDays: current.graceDays,
+                direction,
+            });
+            return { result: undefined, changed: true, scope: current.scopeNodeUuid };
+        });
+    }
+    /** Delete a policy (always a lower: R2.6 lower rules; platform floor root only). */
+    async deletePolicy(actor, uuid) {
+        const bump = this.requireBump();
+        await this.write(bump, async (tx, conn) => {
+            const current = await this.lockAndRead(tx, actor, uuid);
+            await this.assertMayLower(actor, current);
+            await tx.delete(TYPE, uuid);
+            await this.recordAudit(conn, actor, 'deleted', uuid, {
+                scopeNodeId: current.scopeNodeUuid,
+                platform: current.platform,
+                targetKind: current.targetKind,
+                targetValue: current.targetValue,
+                graceDays: current.graceDays,
+                direction: 'lower',
+            });
+            return { result: undefined, changed: true, scope: current.scopeNodeUuid };
+        });
+    }
+    // ── internals ────────────────────────────────────────────────────────────────────────────
+    requireBump() {
+        const bump = this.versionBump;
+        if (!bump) {
+            throw new core_1.AuthorizationUnavailableError('security policy version bump is not configured');
+        }
+        return bump;
+    }
+    inSubtree(actor, node) {
+        return (0, grant_ceiling_js_1.subtreeOf)(actor).some((n) => (0, http_js_1.sameUuid)(n, node));
+    }
+    /** Lock the row, re-read it on the transaction, and apply the reach and floor rules. */
+    async lockAndRead(tx, actor, uuid) {
+        await tx.lockForUpdate(TYPE, uuid);
+        const view = await tx.get(TYPE, uuid);
+        if (view === null)
+            throw new identity_errors_js_1.IdentityNotFoundError('Security policy not found.');
+        const current = toStored(view.fields);
+        if (actor.isRoot === true)
+            return current;
+        if (current.platform) {
+            throw new identity_errors_js_1.IdentityForbiddenError('Only a platform administrator can change a platform-wide policy.');
+        }
+        if (current.scopeNodeUuid === null || !this.inSubtree(actor, current.scopeNodeUuid)) {
+            throw new identity_errors_js_1.IdentityNotFoundError('Security policy not found.');
+        }
+        return current;
+    }
+    /**
+     * Decision (6) of slice D: a role target must exist and be visible to the actor. Non-root: the
+     * role's owner company is in the actor's subtree (G-013 owner rule, the one grant administration
+     * uses, `GrantCeiling.roleOwnedInReach`); an owner implies the role exists, and an ownerless role
+     * is root only. Root: the role row exists (read on the write's transaction). Otherwise 404 with a
+     * fixed message (no existence oracle, no id).
+     */
+    async assertRoleTarget(actor, roleUuid, conn) {
+        let visible;
+        if (actor.isRoot === true) {
+            const rows = (await conn.query(`SELECT 1 AS ok FROM \`${this.appSchema}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
+            visible = Array.isArray(rows) && rows.length > 0;
+        }
+        else {
+            visible = (await this.ceiling.roleOwnedInReach(actor, roleUuid)) === true;
+        }
+        if (!visible)
+            throw new identity_errors_js_1.IdentityNotFoundError('Role not found.');
+    }
+    /**
+     * The R2.6 lower rule for the policy as stored. Root bypasses. D-12 (rules set from above): the
+     * actor must also act at the node the policy was created at or an ancestor of it, i.e. that node
+     * is in the actor's subtree; a legacy row with no creator node is judged at its scope node.
+     */
+    async assertMayLower(actor, p) {
+        if (actor.isRoot === true)
+            return;
+        const creatorNode = p.createdAtNode ?? p.scopeNodeUuid;
+        if (creatorNode === null || !this.inSubtree(actor, creatorNode)) {
+            throw new identity_errors_js_1.IdentityForbiddenError(lowerRefusal(p));
+        }
+        try {
+            if (p.targetKind === 'role' && p.targetValue !== null) {
+                await this.ceiling.assertCanAssignRoles(actor, [p.targetValue]);
+            }
+            else if (p.targetKind === 'permission' && p.targetValue !== null) {
+                await this.ceiling.assertCanGrant(actor, [p.targetValue]);
+            }
+            else {
+                // `tenant` (or anything unreadable): full identity administration at the node or above.
+                await this.ceiling.assertCanGrant(actor, ['identity:*']);
+            }
+        }
+        catch (cause) {
+            if (!(cause instanceof grant_ceiling_js_1.GrantCeilingError))
+                throw cause;
+            throw new identity_errors_js_1.IdentityForbiddenError(lowerRefusal(p));
+        }
+    }
+    /**
+     * One engine transaction with the transaction's own connection exposed for the audit row and the
+     * version bump; versions are published after the commit, dropped after a rollback.
+     */
+    async write(bump, fn) {
+        let conn;
+        try {
+            const result = await this.records.transaction(async (tx) => {
+                const query = (0, internal_1.transactionQueryOf)(tx);
+                const c = { query: (sql, params) => query(sql, params) };
+                conn = c;
+                const out = await fn(tx, c);
+                if (out.changed)
+                    await bump.bump(await bump.tenantsInScope(out.scope, c), c);
+                return out.result;
+            });
+            if (conn)
+                await bump.publishCommitted(conn);
+            return result;
+        }
+        catch (e) {
+            if (conn)
+                bump.discardPending(conn);
+            const errno = errnoOf(e);
+            // 1452: the chosen organisation does not exist (FK); 4025: a CHECK the input passed but the
+            // database refused. Fixed text, never the driver's.
+            if (errno === 1452)
+                throw new identity_errors_js_1.IdentityBadRequestError('Choose an existing organisation.');
+            if (errno === 4025)
+                throw new identity_errors_js_1.IdentityBadRequestError('This policy is not valid.');
+            throw e;
+        }
+    }
+    /** The `permission_change` row on the write's transaction (fail closed: it rolls back with it). */
+    async recordAudit(conn, actor, what, id, attributes) {
+        const event = {
+            type: 'permission_change',
+            occurredAtMs: this.now(),
+            actorId: actor.id,
+            tenantId: actor.tenantId,
+            action: { key: `security_policy.${what}` },
+            resource: { level: 'record', typeKey: TYPE, tenantId: actor.tenantId, recordId: String(id) },
+            attributes,
+        };
+        await this.audit.record(event, (sql, params) => conn.query(sql, params));
+    }
+};
+exports.SecurityPolicyService = SecurityPolicyService;
+exports.SecurityPolicyService = SecurityPolicyService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(security_policy_version_bump_js_1.SECURITY_POLICY_VERSION_BUMP)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS)),
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling, Object, Object])
+], SecurityPolicyService);

package/dist/features/service-account/service-account.service.d.ts

@@ -155,11 +155,21 @@ export declare class ServiceAccountService {
      * back to placeholder names instead of failing a write that already happened.
      */
     private auditNames;
+    /**
+     * G-013 (spec §5.D, R2): every requested role is OWNED by the account's company — another
+     * company's role, an ownerless role or an unknown id is a 400 with one fixed message (no name, no
+     * id: the role catalog read is not caller-scoped). Applies to every admin, root included, and runs
+     * BEFORE the ceiling. Store errors propagate (→ 503).
+     */
+    /** The ids among `roleIds` owned by `companyUuid` (G-013), in their order. Store errors propagate. */
+    private ownedBy;
+    private assertRolesOwnedBy;
     /**
      * What the caller may grant (the picker source for create/edit), computed from the SAME
-     * {@link ceilingOf} the write check enforces. Root → every role + every company; non-root → the
-     * roles they hold + the nodes of their reachable subtree. Nodes come back tree-ordered with a
-     * `parentId` only when the parent is also assignable.
+     * {@link ceilingOf} the write check enforces. Roles: only those OWNED by the company a new agent
+     * is created in (the admin's tenant, G-013) — root gets all of them, a non-root admin those it
+     * also holds. Companies: root every company; non-root the nodes of its reachable subtree. Nodes
+     * come back tree-ordered with a `parentId` only when the parent is also assignable.
      */
     assignable(admin: AdminPrincipal): Promise<AssignableAccess>;
     /** List the admin's own-tenant accounts (by label; ids are handles). */

package/dist/features/service-account/service-account.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAKD,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AA+DD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IA0G9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}
+{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAKD,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AA+DD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACH,sGAAsG;YACxF,OAAO;YAYP,kBAAkB;IAchC;;;;;;OAMG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAelE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAyC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAqH9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}