@astram/identity 0.20.0 → 0.22.0

package/dist/features/authz/access-change-notifier.d.ts

@@ -0,0 +1,109 @@
+import type { ModuleRegistry, Principal } from '@astram/core';
+import { type NotificationQuery, type NotificationPostInput, type NotificationPostResult } from '@astram/guard';
+import type { IdentitySchemaNames } from '../../schema.js';
+/** DI token: the module's one notifier (attached to `SHIELD_NOTIFICATIONS` when guard has it). */
+export declare const ACCESS_CHANGE_NOTIFIER: unique symbol;
+export declare const ACCESS_CHANGED_KIND = "shield.access_changed";
+export declare const ACCESS_CHANGED_TITLE = "Your access changed";
+export declare const ACCESS_NOTICE_SAVEPOINT = "shield_access_notice";
+/** SPEC §10 limits (mirror guard's `NOTIFICATION_BODY_MAX` / `NOTIFICATION_RECIPIENTS_MAX`). */
+export declare const ACCESS_NOTICE_LABELS_PER_LINE = 10;
+export declare const ACCESS_NOTICE_BODY_MAX = 1000;
+export declare const ACCESS_NOTICE_RECIPIENTS_MAX = 1000;
+/** The part of guard's `NotificationService` the notifier uses. */
+export interface AccessNoticePoster {
+    post(input: NotificationPostInput, opts?: {
+        query?: NotificationQuery;
+    }): Promise<NotificationPostResult>;
+}
+/** One user in one tenant (server-derived; never request input). */
+export interface AccessPair {
+    readonly userId: string;
+    readonly tenantId: string;
+}
+/** A pair's effective exact keys at snapshot time. */
+export interface AccessEntry extends AccessPair {
+    readonly keys: ReadonlySet<string>;
+}
+/** A successful snapshot, keyed by `pairKey(pair)`. */
+export interface AccessSnapshot {
+    readonly ok: true;
+    readonly entries: ReadonlyMap<string, AccessEntry>;
+}
+/** A holder or snapshot read failed: carries counts and the error class only. */
+export interface AccessReadFailure {
+    readonly ok: false;
+    /** Pairs the read was for (`null` when unknown, e.g. the holder read itself failed). */
+    readonly pairCount: number | null;
+    readonly errorClass: string;
+}
+export interface AccessNoticeResult {
+    readonly created: number;
+    readonly dropped: number;
+}
+export interface AccessChangeNotifierLogger {
+    warn(message: string): void;
+}
+/**
+ * The notice failed and its savepoint could not be rolled back: the caller's transaction is gone,
+ * so the caller fails and rolls back like any database error (SPEC v3 §5A). The message holds no
+ * value; the original error rides on `cause`.
+ */
+export declare class AccessNoticeTransactionLostError extends Error {
+    constructor(cause: unknown);
+}
+/** Locale-independent code-point order (JS `<` compares UTF-16 code units). */
+export declare function compareCodePoints(a: string, b: string): number;
+/**
+ * SPEC §10 body: sorted labels, ≤ 10 per line, then labels folded into the `and N more` tail
+ * (from the line showing more, ties from the longer line) while the body exceeds 1000 characters.
+ * `null` when nothing was gained or lost.
+ */
+export declare function accessNoticeBody(gained: readonly string[], lost: readonly string[]): string | null;
+/**
+ * The step-1 generated label of a key with no catalog label (G-027 step 1 SPEC §10), computed as
+ * guard's catalog reconciler does (`catalog-reconciler.ts` `generatedText`, not exported): engine
+ * `permissionTextOf` over a one-action declaration, type label from the registry descriptor when
+ * it differs from the typeKey. An unresolvable key gets `"<Type>: <action>"`, never the raw key.
+ */
+export declare function generatedPermissionLabel(registry: ModuleRegistry, key: string): string;
+export declare class AccessChangeNotifier {
+    private readonly registry;
+    /** Injectable clock (epoch-ms) for the posting window, bound as `?` integers. */
+    private readonly now;
+    private service;
+    private readonly logger;
+    private readonly app;
+    private readonly authz;
+    constructor(registry: ModuleRegistry, schemas: IdentitySchemaNames, logger?: AccessChangeNotifierLogger, 
+    /** Injectable clock (epoch-ms) for the posting window, bound as `?` integers. */
+    now?: () => number);
+    /** Bind guard's `NotificationService` (`null` ⇒ every method is a no-op). */
+    attach(service: AccessNoticePoster | null): void;
+    /** Whether a change by `actor` would be notified (service attached, not the org bootstrap). */
+    enabledFor(actor: Principal): boolean;
+    /**
+     * Users holding `roleUuid` through an in-effect posting of their active membership, with
+     * `u_status = 'active'` (the `readRoleIdsForTenant` predicates), per tenant. Never throws.
+     */
+    holdersOfRole(query: NotificationQuery, roleUuid: string): Promise<readonly AccessPair[] | AccessReadFailure>;
+    /**
+     * Effective keys per pair on the caller's open transaction (sees its uncommitted rows): one
+     * roles query for all pairs (chunked at 500), one `role_permission` query for all roles, then
+     * `expandGrantKeys`. A pair with no roles has an empty set. Never throws.
+     */
+    snapshot(query: NotificationQuery, pairs: readonly AccessPair[] | AccessReadFailure): Promise<AccessSnapshot | AccessReadFailure>;
+    /**
+     * Diff `before` and `after` per pair and post one notice to each changed user, under the
+     * `shield_access_notice` savepoint on `query`. Never throws. `dropped` = the pairs that would
+     * have been notified (on a snapshot failure: the pairs the failed read was for, when known).
+     */
+    notify(query: NotificationQuery, actor: Principal, before: AccessSnapshot | AccessReadFailure, after: AccessSnapshot | AccessReadFailure): Promise<AccessNoticeResult>;
+    /** One parameterized catalog read; a missing, blank or raw-key label ⇒ the generated label. */
+    private labelsOf;
+    private isBootstrap;
+    private warnDropped;
+    private rowsOf;
+    private pairsOf;
+}
+//# sourceMappingURL=access-change-notifier.d.ts.map

package/dist/features/authz/access-change-notifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-change-notifier.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-change-notifier.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,kGAAkG;AAClG,eAAO,MAAM,sBAAsB,eAA4C,CAAC;AAEhF,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,yBAAyB,CAAC;AAC9D,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAChD,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAajD,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,IAAI,CACF,KAAK,EAAE,qBAAqB,EAC5B,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,iBAAiB,CAAA;KAAE,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACpD;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,wFAAwF;IACxF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;GAIG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;gBAC7C,KAAK,EAAE,OAAO;CAI3B;AAYD,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAS9D;AAoBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,GAAG,IAAI,CAoBf;AAOD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAqBtF;AAED,qBAAa,oBAAoB;IAO7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAGzB,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,GAAG;IAVtB,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,QAAQ,EAAE,cAAc,EACzC,OAAO,EAAE,mBAAmB,EAC5B,MAAM,CAAC,EAAE,0BAA0B;IACnC,iFAAiF;IAChE,GAAG,GAAE,MAAM,MAAiB;IAO/C,6EAA6E;IAC7E,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI;IAIhD,+FAA+F;IAC/F,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO;IAIrC;;;OAGG;IACG,aAAa,CACjB,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,UAAU,EAAE,GAAG,iBAAiB,CAAC;IAoBrD;;;;OAIG;IACG,QAAQ,CACZ,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,iBAAiB,GAC/C,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;IAwE9C;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,cAAc,GAAG,iBAAiB,EAC1C,KAAK,EAAE,cAAc,GAAG,iBAAiB,GACxC,OAAO,CAAC,kBAAkB,CAAC;IAiF9B,+FAA+F;YACjF,QAAQ;IA4BtB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,OAAO;CAWhB"}

package/dist/features/authz/access-change-notifier.js

@@ -0,0 +1,421 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessChangeNotifier = exports.AccessNoticeTransactionLostError = exports.ACCESS_NOTICE_RECIPIENTS_MAX = exports.ACCESS_NOTICE_BODY_MAX = exports.ACCESS_NOTICE_LABELS_PER_LINE = exports.ACCESS_NOTICE_SAVEPOINT = exports.ACCESS_CHANGED_TITLE = exports.ACCESS_CHANGED_KIND = exports.ACCESS_CHANGE_NOTIFIER = void 0;
+exports.compareCodePoints = compareCodePoints;
+exports.accessNoticeBody = accessNoticeBody;
+exports.generatedPermissionLabel = generatedPermissionLabel;
+/**
+ * `AccessChangeNotifier` — G-027 step 3 (notifying-user SPEC §5A, §10, §11): one personal
+ * `shield.access_changed` notice to each user whose EFFECTIVE permission keys changed, posted on
+ * the change's own transaction `query` so a rolled-back change sends nothing.
+ *
+ * Effective keys follow `readRoleIdsForTenant` exactly (active membership `cm_is_active = 1`,
+ * `u_status = 'active'`, in-effect posting window bound as epoch-ms integers) → `role_permission`
+ * → `expandGrantKeys` against the registry's `listActions()`: a notice never claims access
+ * `decide()` would not give. Holders come from memberships only, so service accounts never appear.
+ *
+ * Failure model (SPEC v3 §5A): a notice failure never fails the change, with ONE exception.
+ * - `holdersOfRole` / `snapshot` never throw: they return an {@link AccessReadFailure} on a read
+ *   error; `snapshot` passes a failure through. `notify` given a failure on either side logs and drops.
+ * - `notify` runs under `SAVEPOINT shield_access_notice` (label read + every `post`): any error ⇒
+ *   `ROLLBACK TO SAVEPOINT`, one `[notifications] access-change notices dropped` warning with
+ *   counts and the error class only (never SQL, values or labels), `{ created: 0, dropped }`.
+ *   The caller's change continues and commits.
+ * - Exception: when that `ROLLBACK TO SAVEPOINT` itself fails, the database already ended the
+ *   caller's transaction (e.g. a deadlock on the notice insert), so `notify` throws
+ *   {@link AccessNoticeTransactionLostError} and the caller must fail and roll back: never catch it
+ *   to continue, or the audit row and later writes would autocommit without the change.
+ * - Without an attached `NotificationService` (guard `auth: false`) every method is a no-op with
+ *   no SQL; an actor bound to `shield:org-bootstrap` gets `notify` ⇒ `{ 0, 0 }` with no SQL
+ *   (`enabledFor(actor)` lets a caller skip its snapshots too).
+ *
+ * Text (SPEC §10): title `Your access changed`; `You can now: a, b.` / `You can no longer: c.`
+ * joined by `\n`; labels sorted by code point, at most 10 per line then `, and N more.`, folded
+ * further while the body would exceed 1000 characters. No actor, other user, role, company, raw
+ * key or uuid. Users of one tenant with the same text share one `post` (≤ 1000 recipients).
+ */
+const common_1 = require("@nestjs/common");
+const engine_1 = require("@astram/engine");
+const guard_1 = require("@astram/guard");
+const org_bootstrap_manifest_js_1 = require("../org-bootstrap/org-bootstrap.manifest.js");
+const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
+/** DI token: the module's one notifier (attached to `SHIELD_NOTIFICATIONS` when guard has it). */
+exports.ACCESS_CHANGE_NOTIFIER = Symbol('IDENTITY_ACCESS_CHANGE_NOTIFIER');
+exports.ACCESS_CHANGED_KIND = 'shield.access_changed';
+exports.ACCESS_CHANGED_TITLE = 'Your access changed';
+exports.ACCESS_NOTICE_SAVEPOINT = 'shield_access_notice';
+/** SPEC §10 limits (mirror guard's `NOTIFICATION_BODY_MAX` / `NOTIFICATION_RECIPIENTS_MAX`). */
+exports.ACCESS_NOTICE_LABELS_PER_LINE = 10;
+exports.ACCESS_NOTICE_BODY_MAX = 1000;
+exports.ACCESS_NOTICE_RECIPIENTS_MAX = 1000;
+/** Pairs per batched roles query (2 placeholders each). */
+const PAIR_CHUNK = 500;
+/** Values per `IN (…)` list (roles, permission keys); review F-2. */
+const IN_CHUNK = 1000;
+/** `items` in slices of at most `size`. */
+function chunksOf(items, size) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+/**
+ * The notice failed and its savepoint could not be rolled back: the caller's transaction is gone,
+ * so the caller fails and rolls back like any database error (SPEC v3 §5A). The message holds no
+ * value; the original error rides on `cause`.
+ */
+class AccessNoticeTransactionLostError extends Error {
+    constructor(cause) {
+        super('access-change notice: transaction lost', { cause });
+        this.name = 'AccessNoticeTransactionLostError';
+    }
+}
+exports.AccessNoticeTransactionLostError = AccessNoticeTransactionLostError;
+/** The class name of an error, never its message (core 50 #10). */
+function errorClassOf(err) {
+    if (err instanceof Error)
+        return err.constructor?.name || 'Error';
+    return typeof err;
+}
+function pairKey(p) {
+    return `${p.tenantId}|${p.userId}`;
+}
+/** Locale-independent code-point order (JS `<` compares UTF-16 code units). */
+function compareCodePoints(a, b) {
+    const x = Array.from(a);
+    const y = Array.from(b);
+    const n = Math.min(x.length, y.length);
+    for (let i = 0; i < n; i++) {
+        const d = x[i].codePointAt(0) - y[i].codePointAt(0);
+        if (d !== 0)
+            return d;
+    }
+    return x.length - y.length;
+}
+function codePointLength(s) {
+    return Array.from(s).length;
+}
+// C0, DEL, C1 and the Unicode line/paragraph separators (review F-4): a label is one line of text.
+// Built from a string so no raw separator character sits in the source.
+const CONTROL_CHARS = new RegExp(`[\u0000-\u001f\u007f-\u009f${String.fromCharCode(0x2028, 0x2029)}]`, 'g');
+function line(prefix, labels, shown) {
+    const rest = labels.length - shown;
+    const head = labels.slice(0, shown).join(', ');
+    if (rest <= 0)
+        return `${prefix}: ${head}.`;
+    return shown === 0 ? `${prefix}: ${rest} more.` : `${prefix}: ${head}, and ${rest} more.`;
+}
+/**
+ * SPEC §10 body: sorted labels, ≤ 10 per line, then labels folded into the `and N more` tail
+ * (from the line showing more, ties from the longer line) while the body exceeds 1000 characters.
+ * `null` when nothing was gained or lost.
+ */
+function accessNoticeBody(gained, lost) {
+    const g = [...gained].sort(compareCodePoints);
+    const l = [...lost].sort(compareCodePoints);
+    if (g.length === 0 && l.length === 0)
+        return null;
+    let sg = Math.min(g.length, exports.ACCESS_NOTICE_LABELS_PER_LINE);
+    let sl = Math.min(l.length, exports.ACCESS_NOTICE_LABELS_PER_LINE);
+    const render = () => [
+        ...(g.length > 0 ? [line('You can now', g, sg)] : []),
+        ...(l.length > 0 ? [line('You can no longer', l, sl)] : []),
+    ].join('\n');
+    let body = render();
+    while (codePointLength(body) > exports.ACCESS_NOTICE_BODY_MAX && sg + sl > 0) {
+        const gl = g.length > 0 ? codePointLength(line('You can now', g, sg)) : 0;
+        const ll = l.length > 0 ? codePointLength(line('You can no longer', l, sl)) : 0;
+        if (sg > sl || (sg === sl && gl >= ll))
+            sg -= 1;
+        else
+            sl -= 1;
+        body = render();
+    }
+    return body;
+}
+function humanize(s) {
+    const spaced = s.replace(/_/g, ' ');
+    return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+/**
+ * The step-1 generated label of a key with no catalog label (G-027 step 1 SPEC §10), computed as
+ * guard's catalog reconciler does (`catalog-reconciler.ts` `generatedText`, not exported): engine
+ * `permissionTextOf` over a one-action declaration, type label from the registry descriptor when
+ * it differs from the typeKey. An unresolvable key gets `"<Type>: <action>"`, never the raw key.
+ */
+function generatedPermissionLabel(registry, key) {
+    const registered = registry.resolveByPermissionKey(key);
+    const parts = key.split(':');
+    const typeKey = registered?.action.typeKey ?? parts[1] ?? 'permission';
+    const actionKey = registered?.action.actionKey ?? parts[2] ?? 'use';
+    if (registered !== undefined) {
+        const descriptorLabel = registry.resolveObjectType(typeKey)?.label;
+        const label = descriptorLabel && descriptorLabel !== typeKey ? descriptorLabel : undefined;
+        const isCrud = guard_1.IDENTITY_ACTIONS.includes(actionKey);
+        try {
+            const [t] = (0, engine_1.permissionTextOf)({
+                typeKey,
+                ...(label !== undefined ? { label } : {}),
+                ...(isCrud ? {} : { crudActions: false, actions: [actionKey] }),
+            }).filter((p) => p.action === actionKey);
+            if (t)
+                return t.label;
+        }
+        catch (err) {
+            if (!(err instanceof engine_1.RegistrationError))
+                throw err;
+        }
+    }
+    return `${humanize(typeKey)}: ${actionKey.replace(/_/g, ' ')}`;
+}
+class AccessChangeNotifier {
+    registry;
+    now;
+    service = null;
+    logger;
+    app;
+    authz;
+    constructor(registry, schemas, logger, 
+    /** Injectable clock (epoch-ms) for the posting window, bound as `?` integers. */
+    now = Date.now) {
+        this.registry = registry;
+        this.now = now;
+        this.logger = logger ?? new common_1.Logger('IdentityAccessChangeNotifier');
+        this.app = `\`${schemas.app}\``;
+        this.authz = `\`${schemas.authz}\``;
+    }
+    /** Bind guard's `NotificationService` (`null` ⇒ every method is a no-op). */
+    attach(service) {
+        this.service = service;
+    }
+    /** Whether a change by `actor` would be notified (service attached, not the org bootstrap). */
+    enabledFor(actor) {
+        return this.service !== null && !this.isBootstrap(actor);
+    }
+    /**
+     * Users holding `roleUuid` through an in-effect posting of their active membership, with
+     * `u_status = 'active'` (the `readRoleIdsForTenant` predicates), per tenant. Never throws.
+     */
+    async holdersOfRole(query, roleUuid) {
+        if (this.service === null)
+            return [];
+        try {
+            const nowMs = this.now();
+            const rows = await query(`SELECT DISTINCT cm.cm_user_uuid AS user_id, cm.cm_company_uuid AS tenant_id
+           FROM ${this.app}.\`company_membership\` cm
+           JOIN ${this.app}.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
+           JOIN ${this.app}.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+          WHERE mp.mp_role_uuid = ? AND cm.cm_is_active = 1
+            AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
+            AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [roleUuid, nowMs, nowMs]);
+            return this.pairsOf(rows);
+        }
+        catch (err) {
+            return { ok: false, pairCount: null, errorClass: errorClassOf(err) };
+        }
+    }
+    /**
+     * Effective keys per pair on the caller's open transaction (sees its uncommitted rows): one
+     * roles query for all pairs (chunked at 500), one `role_permission` query for all roles, then
+     * `expandGrantKeys`. A pair with no roles has an empty set. Never throws.
+     */
+    async snapshot(query, pairs) {
+        if (!Array.isArray(pairs))
+            return pairs;
+        const entries = new Map();
+        if (this.service === null)
+            return { ok: true, entries };
+        const wanted = new Map();
+        for (const p of pairs) {
+            const userId = (0, engine_1.canonicalUuid)(p.userId);
+            const tenantId = (0, engine_1.canonicalUuid)(p.tenantId);
+            if (userId === null || tenantId === null)
+                continue;
+            const pair = { userId, tenantId };
+            wanted.set(pairKey(pair), pair);
+        }
+        if (wanted.size === 0)
+            return { ok: true, entries };
+        try {
+            const nowMs = this.now();
+            const rolesByPair = new Map();
+            const all = [...wanted.values()];
+            for (let i = 0; i < all.length; i += PAIR_CHUNK) {
+                const chunk = all.slice(i, i + PAIR_CHUNK);
+                const where = chunk
+                    .map(() => '(cm.cm_user_uuid = ? AND cm.cm_company_uuid = ?)')
+                    .join(' OR ');
+                const rows = await query(`SELECT DISTINCT cm.cm_user_uuid AS user_id, cm.cm_company_uuid AS tenant_id,
+                  mp.mp_role_uuid AS role_uuid
+             FROM ${this.app}.\`company_membership\` cm
+             JOIN ${this.app}.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
+             JOIN ${this.app}.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+            WHERE (${where}) AND cm.cm_is_active = 1
+              AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
+              AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [...chunk.flatMap((p) => [p.userId, p.tenantId]), nowMs, nowMs]);
+                for (const r of this.rowsOf(rows)) {
+                    const userId = (0, engine_1.canonicalUuid)(r.user_id);
+                    const tenantId = (0, engine_1.canonicalUuid)(r.tenant_id);
+                    const role = (0, engine_1.canonicalUuid)(r.role_uuid);
+                    if (userId === null || tenantId === null || role === null)
+                        continue;
+                    const k = pairKey({ userId, tenantId });
+                    if (!wanted.has(k))
+                        continue;
+                    const set = rolesByPair.get(k) ?? new Set();
+                    set.add(role);
+                    rolesByPair.set(k, set);
+                }
+            }
+            const roles = [...new Set([...rolesByPair.values()].flatMap((s) => [...s]))];
+            const keysByRole = new Map();
+            for (const slice of chunksOf(roles, IN_CHUNK)) {
+                const rows = await query(`SELECT rp_role_uuid AS role_uuid, rp_perm_key FROM ${this.authz}.\`role_permission\`
+            WHERE rp_role_uuid IN (${slice.map(() => '?').join(', ')})`, slice);
+                for (const r of this.rowsOf(rows)) {
+                    const role = (0, engine_1.canonicalUuid)(r.role_uuid);
+                    if (role === null || typeof r.rp_perm_key !== 'string')
+                        continue;
+                    const list = keysByRole.get(role) ?? [];
+                    list.push(r.rp_perm_key);
+                    keysByRole.set(role, list);
+                }
+            }
+            const allKeys = this.registry.listActions().map((a) => a.permissionKey);
+            for (const [k, pair] of wanted) {
+                const raw = [...(rolesByPair.get(k) ?? [])].flatMap((role) => keysByRole.get(role) ?? []);
+                entries.set(k, { ...pair, keys: new Set((0, db_permission_facts_adapter_js_1.expandGrantKeys)(raw, allKeys)) });
+            }
+            return { ok: true, entries };
+        }
+        catch (err) {
+            return { ok: false, pairCount: wanted.size, errorClass: errorClassOf(err) };
+        }
+    }
+    /**
+     * Diff `before` and `after` per pair and post one notice to each changed user, under the
+     * `shield_access_notice` savepoint on `query`. Never throws. `dropped` = the pairs that would
+     * have been notified (on a snapshot failure: the pairs the failed read was for, when known).
+     */
+    async notify(query, actor, before, after) {
+        const service = this.service;
+        if (service === null || this.isBootstrap(actor))
+            return { created: 0, dropped: 0 };
+        if (!before.ok || !after.ok) {
+            const failure = (!before.ok ? before : after);
+            const known = [before, after].map((s) => (s.ok ? s.entries.size : (s.pairCount ?? 0)));
+            const dropped = Math.max(...known);
+            this.warnDropped(dropped, failure.errorClass);
+            return { created: 0, dropped };
+        }
+        const changes = [];
+        const keys = new Set([...before.entries.keys(), ...after.entries.keys()]);
+        for (const k of keys) {
+            const b = before.entries.get(k);
+            const a = after.entries.get(k);
+            const pair = (a ?? b);
+            const was = b?.keys ?? new Set();
+            const now = a?.keys ?? new Set();
+            const gained = [...now].filter((x) => !was.has(x));
+            const lost = [...was].filter((x) => !now.has(x));
+            if (gained.length > 0 || lost.length > 0) {
+                changes.push({ pair: { userId: pair.userId, tenantId: pair.tenantId }, gained, lost });
+            }
+        }
+        if (changes.length === 0)
+            return { created: 0, dropped: 0 };
+        try {
+            await query(`SAVEPOINT ${exports.ACCESS_NOTICE_SAVEPOINT}`);
+        }
+        catch (err) {
+            this.warnDropped(changes.length, errorClassOf(err));
+            return { created: 0, dropped: changes.length };
+        }
+        try {
+            const labels = await this.labelsOf(query, [
+                ...new Set(changes.flatMap((c) => [...c.gained, ...c.lost])),
+            ]);
+            // tenant + body ⇒ recipients (same text in the same tenant shares one post).
+            const groups = new Map();
+            for (const c of changes) {
+                const body = accessNoticeBody(c.gained.map((k) => labels.get(k)), c.lost.map((k) => labels.get(k)));
+                if (body === null)
+                    continue;
+                const g = `${c.pair.tenantId}\n${body}`;
+                const group = groups.get(g) ?? { tenantId: c.pair.tenantId, body, recipients: [] };
+                group.recipients.push(c.pair.userId);
+                groups.set(g, group);
+            }
+            let created = 0;
+            for (const group of groups.values()) {
+                for (let i = 0; i < group.recipients.length; i += exports.ACCESS_NOTICE_RECIPIENTS_MAX) {
+                    const res = await service.post({
+                        tenantId: group.tenantId,
+                        recipients: group.recipients.slice(i, i + exports.ACCESS_NOTICE_RECIPIENTS_MAX),
+                        kind: exports.ACCESS_CHANGED_KIND,
+                        title: exports.ACCESS_CHANGED_TITLE,
+                        body: group.body,
+                    }, { query });
+                    created += res.created;
+                }
+            }
+            await query(`RELEASE SAVEPOINT ${exports.ACCESS_NOTICE_SAVEPOINT}`);
+            return { created, dropped: 0 };
+        }
+        catch (err) {
+            try {
+                await query(`ROLLBACK TO SAVEPOINT ${exports.ACCESS_NOTICE_SAVEPOINT}`);
+            }
+            catch {
+                // The database already ended the caller's transaction (e.g. a deadlock rolled it back,
+                // savepoint included): its later writes would autocommit, so the change must fail (SPEC v3 §5A).
+                throw new AccessNoticeTransactionLostError(err);
+            }
+            this.warnDropped(changes.length, errorClassOf(err));
+            return { created: 0, dropped: changes.length };
+        }
+    }
+    /** One parameterized catalog read; a missing, blank or raw-key label ⇒ the generated label. */
+    async labelsOf(query, keys) {
+        const stored = new Map();
+        for (const slice of chunksOf(keys, IN_CHUNK)) {
+            const rows = await query(`SELECT perm_key, perm_label FROM ${this.authz}.\`permission\`
+          WHERE perm_key IN (${slice.map(() => '?').join(', ')})`, slice);
+            for (const r of this.rowsOf(rows)) {
+                if (typeof r.perm_key === 'string' && typeof r.perm_label === 'string') {
+                    stored.set(r.perm_key, r.perm_label);
+                }
+            }
+        }
+        const out = new Map();
+        for (const key of keys) {
+            const label = (stored.get(key) ?? '').replace(CONTROL_CHARS, ' ').trim();
+            out.set(key, label !== '' && label !== key ? label : generatedPermissionLabel(this.registry, key));
+        }
+        return out;
+    }
+    isBootstrap(actor) {
+        return (0, engine_1.operationOf)(actor)?.operationKey === org_bootstrap_manifest_js_1.ORG_BOOTSTRAP_OPERATION;
+    }
+    warnDropped(pairs, errorClass) {
+        this.logger.warn(`[notifications] access-change notices dropped: pairs=${pairs} cause=${errorClass}`);
+    }
+    rowsOf(rows) {
+        if (!Array.isArray(rows))
+            throw new TypeError('unexpected result');
+        return rows;
+    }
+    pairsOf(rows) {
+        const out = new Map();
+        for (const r of this.rowsOf(rows)) {
+            const userId = (0, engine_1.canonicalUuid)(r.user_id);
+            const tenantId = (0, engine_1.canonicalUuid)(r.tenant_id);
+            if (userId === null || tenantId === null)
+                continue;
+            const pair = { userId, tenantId };
+            out.set(pairKey(pair), pair);
+        }
+        return [...out.values()];
+    }
+}
+exports.AccessChangeNotifier = AccessChangeNotifier;

package/dist/features/authz/grant-admin.service.d.ts

@@ -4,6 +4,7 @@ import { type AuditPort } from '@astram/engine';
 import { PermissionVersionBumper } from './permission-version.bumper.js';
 import { AccessBundleStore } from './access-bundle-store.js';
 import { GrantCeiling } from './grant-ceiling.js';
+import type { AccessChangeNotifier } from './access-change-notifier.js';
 import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The caller's reachable subtree, threaded from `req.principal` (Task 4.2). It scopes the
@@ -65,6 +66,12 @@ export declare class GrantAdminService {
     private readonly ceiling?;
     private readonly audit?;
     private readonly schemas;
+    /**
+     * G-027 step 3 (notifying-user SPEC §5B, §5C): personal access-change notices on the grant's
+     * own transaction. OPTIONAL (absent ⇒ no notices, no extra reads); the identity module
+     * always wires it.
+     */
+    private readonly accessNotifier?;
     private readonly bundles;
     /**
      * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold") plus the
@@ -76,7 +83,13 @@ export declare class GrantAdminService {
      *   connection, fail-closed. The identity module ALWAYS wires the engine `MariaDbAuditSink`.
      * @param schemas Resolved framework names (absent ⇒ resolved from the namespace, once, here).
      */
-    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined, audit?: AuditPort | undefined, schemas?: IdentitySchemaNames);
+    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined, audit?: AuditPort | undefined, schemas?: IdentitySchemaNames, 
+    /**
+     * G-027 step 3 (notifying-user SPEC §5B, §5C): personal access-change notices on the grant's
+     * own transaction. OPTIONAL (absent ⇒ no notices, no extra reads); the identity module
+     * always wires it.
+     */
+    accessNotifier?: AccessChangeNotifier | undefined);
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
     listCatalog(): Promise<{
         catalog: CatalogRow[];
@@ -108,6 +121,19 @@ export declare class GrantAdminService {
      * to AuthorizationUnavailableError (503).
      */
     private writeGrants;
+    /**
+     * G-027 step 3 (SPEC §5B, §5C): read the role's holders and their effective keys on the grant's
+     * own transaction `conn`, BEFORE the `role_permission` write. `null` (no reads at all) when no
+     * notifier is wired or it is disabled for this actor (guard `auth: false`, the org bootstrap).
+     * Never throws: a failed read is carried as an `AccessReadFailure`.
+     */
+    private beginAccessNotice;
+    /**
+     * After the write and the bump: the after-snapshot and the notices, on the same connection (a
+     * rollback removes them with the grant). Returns the audit detail addition: `noticesDropped: n`
+     * when n > 0, `'unknown'` when a holder or snapshot read failed, else nothing (byte-identical).
+     */
+    private finishAccessNotice;
     /**
      * Write the grant-administration audit row(s) on the transaction connection (D6). One row per
      * distinct tenant among the actor's tenant and every tenant the change bumped, so each affected

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKlD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiCpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED;;;;GAIG;AACH,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IAK3E,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA6C5E;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAiBhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA2DzB;;;;;;OAMG;YACW,gBAAgB;IAiE9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EACV,oBAAoB,EAIrB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AA6CpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED;;;;GAIG;AACH,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAxBlC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IACzE;;;;OAIG;IACc,cAAc,CAAC,EAAE,oBAAoB,YAAA;IAKxD,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA6C5E;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAiBhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IAkEzB;;;;;OAKG;YACW,iBAAiB;IAa/B;;;;OAIG;YACW,kBAAkB;IAYhC;;;;;;OAMG;YACW,gBAAgB;IAiE9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0DtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}