@astram/identity 0.4.0 → 0.5.0

package/dist/features/scope/scope-closure.service.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NodeHasChildrenError = exports.ScopeClosureService = void 0;
+exports.quarantineCycles = quarantineCycles;
 // astram-framework/packages/identity/src/features/scope/scope-closure.service.ts
 /**
  * `ScopeClosureService` — the LIVE, I/O half of Task 1.2 (Phase 1 of the scoped-hierarchy
@@ -20,6 +21,12 @@ exports.NodeHasChildrenError = exports.ScopeClosureService = void 0;
  *     the moved subtree so active sessions re-derive their (now-changed) subtree WITHOUT re-login
  *     (ADR-0011). A failed rebuild rolls the whole move back — atomic.
  *
+ *   • `attachNode(node)` — a node was just created: rebuild + bump its ancestors (security
+ *     hardening D5), so the creator's subtree includes it without waiting for the hourly reconcile.
+ *
+ *   Callers: `CompanyHierarchyService` (move / delete / attach, with an in-transaction audit hook)
+ *   and the boot/hourly reconcile. A generic company patch can no longer move a node (ADR-0034).
+ *
  *   • `deleteNode(node)` — remove a node (E-2), FAIL-CLOSED: it DENIES (throws) if the node has
  *     children, never letting the DB's old `ON DELETE SET NULL` silently promote a sub-org to a
  *     root (a hierarchy-boundary violation). The `...016` migration also flips the FK to
@@ -31,11 +38,16 @@ exports.NodeHasChildrenError = exports.ScopeClosureService = void 0;
  * invalidation. All SQL values are `?`-bound (never interpolated). `companies` lives in
  * `shield_app`; `scope_closure` lives in `shield_authz` — the shared authz pool reaches both.
  */
+const core_1 = require("@astram/core");
 const guard_1 = require("@astram/guard");
 /** Schema the node tree (`companies`) lives in. */
 const APP = 'shield_app';
 /** Schema the closure table lives in (ADR-0011 / Task 1.1). */
 const AUTHZ = 'shield_authz';
+/** The named lock every hierarchy writer holds (security review F3). */
+const TREE_LOCK = 'shield_scope_closure';
+/** Seconds to wait for it before failing closed. */
+const TREE_LOCK_TIMEOUT_S = 10;
 class ScopeClosureService {
     pool;
     bumper;
@@ -46,27 +58,99 @@ class ScopeClosureService {
     /**
      * Rebuild `scope_closure` from the current `companies.c_parent_uuid` edges. Idempotent
      * (delete-then-insert in a tx → a second run over the same tree writes the identical set).
-     * FAIL-LOUD: an orphaned/cyclic/too-deep edge makes `buildClosureRows` throw and that
-     * propagates (the tx rolls back — never a partial closure). Returns a small summary + logs.
+     * A CYCLIC component is quarantined (no rows for it; logged loudly) so the rest of the forest
+     * still reconciles. FAIL-LOUD for the rest: an orphaned/too-deep edge makes `buildClosureRows`
+     * throw and that propagates (the tx rolls back — never a partial closure). Returns a summary.
      */
     async reconcileClosure() {
-        const edges = await this.readEdges(this.pool);
-        const rows = (0, guard_1.buildClosureRows)(edges); // throws on cycle/depth/orphan — propagate (fail-loud).
+        // Security hardening #2: a cyclic component (and everything hanging under it) is QUARANTINED —
+        // left out of the closure, so its nodes get no rows (their admins fall back to the self node,
+        // non-widening) — instead of one corrupt component aborting the rebuild for EVERY tenant.
+        // Other corruption (orphan / too deep) still throws and propagates (fail-loud).
+        const { clean, quarantined, rows } = await this.inTreeLock(async (conn) => {
+            const split = quarantineCycles(await this.readEdges(conn));
+            const built = (0, guard_1.buildClosureRows)(split.clean);
+            await this.rewriteClosure(conn, built);
+            return { ...split, rows: built };
+        });
+        if (quarantined.length > 0) {
+            console.error(`[scope] closure: QUARANTINED ${quarantined.length} node(s) in or under a parent cycle — ` +
+                `they have no closure rows until the cycle is repaired`);
+        }
+        console.log(`[scope] closure: ${clean.length} nodes, ${rows.length} rows`);
+        return { nodes: clean.length, rows: rows.length, quarantined: quarantined.length };
+    }
+    /**
+     * A node was just CREATED (security hardening D5): rebuild the closure so it has rows at once
+     * (not at the next hourly reconcile), and bump every ANCESTOR's permission version — their
+     * reachable subtree just grew — so their sessions pick the new node up at the next refresh.
+     * One transaction; fail-loud like `moveNode` (a corrupt tree aborts the rebuild). A node inside
+     * a quarantined cycle gets no rows and bumps nothing.
+     */
+    async attachNode(nodeUuid) {
+        await this.inTreeLock(async (conn) => {
+            const { clean } = quarantineCycles(await this.readEdges(conn));
+            const rows = (0, guard_1.buildClosureRows)(clean);
+            await this.rewriteClosure(conn, rows);
+            const ancestors = rows
+                .filter((r) => r.descendant === nodeUuid && r.ancestor !== nodeUuid)
+                .map((r) => r.ancestor);
+            for (const tenantUuid of new Set(ancestors)) {
+                await this.bumper.bumpForTenant(tenantUuid, conn);
+            }
+        });
+    }
+    /**
+     * Run `fn` in ONE transaction while holding the tree's named lock (security review F3). Every
+     * hierarchy writer (move, delete, attach, reconcile) takes the SAME `GET_LOCK` on its own
+     * connection BEFORE `BEGIN`, so they run one at a time and each transaction's first read sees
+     * every move committed before it. Without it, two concurrent moves each pass the cycle check
+     * against the other's pre-move tree and together form a cycle. A lock that cannot be taken in
+     * time fails closed (503, nothing written). The lock is released after commit/rollback.
+     */
+    async inTreeLock(fn) {
         const conn = await this.pool.getConnection();
+        let locked = false;
         try {
+            const got = (await conn.query('SELECT GET_LOCK(?, ?) AS got', [
+                TREE_LOCK,
+                TREE_LOCK_TIMEOUT_S,
+            ]));
+            if (!Array.isArray(got) || Number(got[0]?.got) !== 1) {
+                throw new core_1.AuthorizationUnavailableError('scope hierarchy is busy; try again');
+            }
+            locked = true;
             await conn.beginTransaction();
-            await this.rewriteClosure(conn, rows);
-            await conn.commit();
-        }
-        catch (cause) {
-            await conn.rollback();
-            throw cause;
+            let out;
+            try {
+                out = await fn(conn);
+                await conn.commit();
+            }
+            catch (cause) {
+                await conn.rollback();
+                this.bumper.discardPending?.(conn);
+                throw cause;
+            }
+            // ADR-0035: the committed version bumps reach Redis (best-effort; never fails the write).
+            await this.bumper.publishCommitted?.(conn);
+            return out;
         }
         finally {
-            await conn.release();
+            let releasedLock = !locked;
+            if (locked) {
+                try {
+                    await conn.query('SELECT RELEASE_LOCK(?)', [TREE_LOCK]);
+                    releasedLock = true;
+                }
+                catch {
+                    // handled below: a pooled session that may still hold the lock is destroyed, not reused
+                }
+            }
+            if (!releasedLock && typeof conn.destroy === 'function')
+                conn.destroy();
+            else
+                await conn.release();
         }
-        console.log(`[scope] closure: ${edges.length} nodes, ${rows.length} rows`);
-        return { nodes: edges.length, rows: rows.length };
     }
     /**
      * Re-parent `nodeUuid` under `newParentUuid` (or null for a root). Cycle-checked FIRST via the
@@ -85,62 +169,74 @@ class ScopeClosureService {
      * HIGH stale-subtree-after-move leak: a parent admin kept reaching a moved-away tenant.
      * Nodes on neither side keep their exact set and are not bumped.
      */
-    async moveNode(nodeUuid, newParentUuid) {
+    async moveNode(nodeUuid, newParentUuid, 
+    /** Runs on the move's transaction after the bump (e.g. the audit row) — a throw rolls back. */
+    inTransaction) {
         if (newParentUuid === nodeUuid) {
             // A node cannot be its own parent (a trivial 1-cycle).
             throw new guard_1.ScopeCycleError(nodeUuid);
         }
-        if (newParentUuid !== null) {
-            // Cycle guard: the new parent must NOT be at/under the moved node. A closure hit means
-            // newParent is a descendant of node → re-parenting node under it would form a cycle.
-            const cyclic = (await this.pool.query(`SELECT 1 FROM \`${AUTHZ}\`.\`scope_closure\`
+        // Review F3: every read below runs INSIDE the tree lock + transaction, so a concurrent move
+        // that committed first is visible to the cycle check (two moves can no longer each pass the
+        // check against the other's pre-move tree).
+        await this.inTreeLock(async (conn) => {
+            if (newParentUuid !== null) {
+                // Cycle guard: the new parent must NOT be at/under the moved node. A closure hit means
+                // newParent is a descendant of node → re-parenting node under it would form a cycle.
+                const cyclic = (await conn.query(`SELECT 1 FROM \`${AUTHZ}\`.\`scope_closure\`
           WHERE ancestor_uuid = ? AND descendant_uuid = ? LIMIT 1`, [nodeUuid, newParentUuid]));
-            if (cyclic.length > 0) {
-                throw new guard_1.ScopeCycleError(nodeUuid);
+                if (cyclic.length > 0) {
+                    throw new guard_1.ScopeCycleError(nodeUuid);
+                }
             }
-        }
-        // The moved subtree — the nodes whose ancestry changes (node + all descendants). Read
-        // BEFORE the update (the move doesn't change the subtree's internal membership).
-        const subtreeRows = (await this.pool.query(`SELECT descendant_uuid FROM \`${AUTHZ}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeUuid]));
-        // The FORMER-PARENT ANCESTRY — the nodes ABOVE `node` in the OLD tree (its ancestors,
-        // excluding self). They just LOST `node`'s subtree from their reach, so their admins' cached
-        // session subtrees are now stale (they'd otherwise keep reaching the moved-away tenant — the
-        // HIGH stale-subtree-after-move leak). Read BEFORE the update (the pre-move closure has the
-        // old ancestry). Bump these too so those sessions re-derive their (now-smaller) subtree at
-        // their next refresh (ADR-0011 bound — no forced re-login).
-        const formerAncestryRows = (await this.pool.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
+            // The moved subtree — the nodes whose ancestry changes (node + all descendants). Read
+            // BEFORE the update (the move doesn't change the subtree's internal membership).
+            const subtreeRows = (await conn.query(`SELECT descendant_uuid FROM \`${AUTHZ}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeUuid]));
+            // The FORMER-PARENT ANCESTRY — the nodes ABOVE `node` in the OLD tree (its ancestors,
+            // excluding self). They just LOST `node`'s subtree from their reach, so their admins' cached
+            // session subtrees are now stale (they'd otherwise keep reaching the moved-away tenant — the
+            // HIGH stale-subtree-after-move leak). Read BEFORE the update (the pre-move closure has the
+            // old ancestry). Bump these too so those sessions re-derive their (now-smaller) subtree at
+            // their next refresh (ADR-0011 bound — no forced re-login).
+            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
         WHERE descendant_uuid = ? AND ancestor_uuid <> ?`, [nodeUuid, nodeUuid]));
-        // Fall back to the node itself if the closure has no self-row yet (pre-first-reconcile).
-        const movedSubtree = subtreeRows.length > 0 ? subtreeRows.map((r) => r.descendant_uuid) : [nodeUuid];
-        // The full bump set: the moved subtree (their ancestry grew/changed) UNION the former-parent
-        // ancestry (they lost the moved subtree). Deduped.
-        const affected = [
-            ...new Set([...movedSubtree, ...formerAncestryRows.map((r) => r.ancestor_uuid)]),
-        ];
-        const conn = await this.pool.getConnection();
-        try {
-            await conn.beginTransaction();
-            // 1) Re-parent the edge.
-            await conn.query(`UPDATE \`${APP}\`.\`companies\` SET c_parent_uuid = ? WHERE c_uuid = ?`, [newParentUuid, nodeUuid]);
-            // 2) Rebuild the whole closure from the now-updated edges (full rebuild — safe + simple;
-            //    a targeted subtree rebuild is a later optimization). Re-reads edges over the SAME tx
-            //    connection so it sees the UPDATE. Fail-loud propagates → the whole move rolls back.
-            const edges = await this.readEdges(conn);
-            const rows = (0, guard_1.buildClosureRows)(edges);
-            await this.rewriteClosure(conn, rows);
-            // 3) Session invalidation: bump each moved-subtree tenant so its cached subtree re-derives.
-            for (const tenantUuid of affected) {
-                await this.bumper.bumpForTenant(tenantUuid, conn);
+            // Fall back to the node itself if the closure has no self-row yet (pre-first-reconcile).
+            const movedSubtree = subtreeRows.length > 0 ? subtreeRows.map((r) => r.descendant_uuid) : [nodeUuid];
+            // The full bump set: the moved subtree (their ancestry grew/changed) UNION the former-parent
+            // ancestry (they lost the moved subtree). Deduped.
+            const affected = [
+                ...new Set([...movedSubtree, ...formerAncestryRows.map((r) => r.ancestor_uuid)]),
+            ];
+            {
+                // 1) Re-parent the edge.
+                await conn.query(`UPDATE \`${APP}\`.\`companies\` SET c_parent_uuid = ? WHERE c_uuid = ?`, [
+                    newParentUuid,
+                    nodeUuid,
+                ]);
+                // 2) Rebuild the whole closure from the now-updated edges (full rebuild — safe + simple;
+                //    a targeted subtree rebuild is a later optimization). Re-reads edges over the SAME tx
+                //    connection so it sees the UPDATE. Fail-loud propagates → the whole move rolls back.
+                //    A pre-existing cycle elsewhere is quarantined (not this move's problem); but if THIS
+                //    node lands in a cycle (the closure pre-check can miss one through quarantined nodes,
+                //    which have no closure rows), refuse and roll back.
+                const { clean, quarantined } = quarantineCycles(await this.readEdges(conn));
+                if (quarantined.includes(nodeUuid))
+                    throw new guard_1.ScopeCycleError(nodeUuid);
+                const rows = (0, guard_1.buildClosureRows)(clean);
+                await this.rewriteClosure(conn, rows);
+                // 3) Session invalidation: bump each moved-subtree tenant so its cached subtree re-derives.
+                //    The NEW ancestry gained the subtree too: bump it so its sessions see the move.
+                const newAncestry = rows
+                    .filter((r) => r.descendant === nodeUuid && r.ancestor !== nodeUuid)
+                    .map((r) => r.ancestor);
+                for (const tenantUuid of new Set([...affected, ...newAncestry])) {
+                    await this.bumper.bumpForTenant(tenantUuid, conn);
+                }
+                // 4) Caller hook on the SAME transaction (audit) — a throw rolls the whole move back.
+                if (inTransaction)
+                    await inTransaction(conn);
             }
-            await conn.commit();
-        }
-        catch (cause) {
-            await conn.rollback();
-            throw cause;
-        }
-        finally {
-            await conn.release();
-        }
+        });
     }
     /**
      * Delete `nodeUuid`, FAIL-CLOSED. Refuses (throws) if the node has ANY child company — never
@@ -155,18 +251,20 @@ class ScopeClosureService {
      * the many tenant-scoped app tables that reference the deleted node) is out of scope for v1 and
      * is tracked as a follow-up; deleteNode v1 only guarantees the HIERARCHY stays consistent.
      */
-    async deleteNode(nodeUuid) {
-        const children = (await this.pool.query(`SELECT 1 FROM \`${APP}\`.\`companies\` WHERE c_parent_uuid = ? LIMIT 1`, [nodeUuid]));
-        if (children.length > 0) {
-            throw new NodeHasChildrenError(nodeUuid);
-        }
-        // The former-parent ancestry — the deleted node's ancestors (excluding self). They lose the
-        // node from their reach → bump so their sessions re-derive. Read BEFORE the delete.
-        const formerAncestryRows = (await this.pool.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
-        WHERE descendant_uuid = ? AND ancestor_uuid <> ?`, [nodeUuid, nodeUuid]));
-        const conn = await this.pool.getConnection();
-        try {
-            await conn.beginTransaction();
+    async deleteNode(nodeUuid, 
+    /** Runs on the delete's transaction after the bump (e.g. the audit row) — a throw rolls back. */
+    inTransaction) {
+        // Under the tree lock (review F3): a concurrent move cannot hang a child under this node
+        // between the children check and the delete.
+        await this.inTreeLock(async (conn) => {
+            const children = (await conn.query(`SELECT 1 FROM \`${APP}\`.\`companies\` WHERE c_parent_uuid = ? LIMIT 1`, [nodeUuid]));
+            if (children.length > 0) {
+                throw new NodeHasChildrenError(nodeUuid);
+            }
+            // The former-parent ancestry — the deleted node's ancestors (excluding self). They lose the
+            // node from their reach → bump so their sessions re-derive. Read BEFORE the delete.
+            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
+          WHERE descendant_uuid = ? AND ancestor_uuid <> ?`, [nodeUuid, nodeUuid]));
             // Remove the node's closure rows (self-row + any it appears in as ancestor/descendant).
             await conn.query(`DELETE FROM \`${AUTHZ}\`.\`scope_closure\`
           WHERE ancestor_uuid = ? OR descendant_uuid = ?`, [nodeUuid, nodeUuid]);
@@ -176,15 +274,9 @@ class ScopeClosureService {
             for (const { ancestor_uuid } of formerAncestryRows) {
                 await this.bumper.bumpForTenant(ancestor_uuid, conn);
             }
-            await conn.commit();
-        }
-        catch (cause) {
-            await conn.rollback();
-            throw cause;
-        }
-        finally {
-            await conn.release();
-        }
+            if (inTransaction)
+                await inTransaction(conn);
+        });
     }
     /** Read the node forest's parent edges (`c_uuid` → `c_parent_uuid`) as `ScopeEdge[]`. */
     async readEdges(q) {
@@ -210,6 +302,47 @@ class ScopeClosureService {
     }
 }
 exports.ScopeClosureService = ScopeClosureService;
+/**
+ * Split the edge set into the CLEAN part and the nodes QUARANTINED because their parent chain
+ * reaches a cycle (the cycle's members and everything below them). PURE. Orphans and depth are
+ * left to `buildClosureRows` (still fail-loud): only a cycle is quarantined, because a cycle is
+ * the corruption a tenant admin could once create through the generic company patch (#2).
+ */
+function quarantineCycles(edges) {
+    const parentOf = new Map();
+    for (const e of edges)
+        parentOf.set(e.node, e.parent);
+    const state = new Map();
+    for (const e of edges) {
+        if (state.has(e.node))
+            continue;
+        const path = [];
+        const onPath = new Set();
+        let current = e.node;
+        let verdict = 'ok';
+        for (;;) {
+            if (current === null || current === undefined || !parentOf.has(current))
+                break; // root / orphan
+            const known = state.get(current);
+            if (known !== undefined) {
+                verdict = known;
+                break;
+            }
+            if (onPath.has(current)) {
+                verdict = 'bad'; // revisited a node on this walk → a cycle
+                break;
+            }
+            onPath.add(current);
+            path.push(current);
+            current = parentOf.get(current);
+        }
+        for (const n of path)
+            state.set(n, verdict);
+    }
+    const quarantined = edges.filter((e) => state.get(e.node) === 'bad').map((e) => e.node);
+    const bad = new Set(quarantined);
+    return { clean: edges.filter((e) => !bad.has(e.node)), quarantined };
+}
 /** deleteNode fail-closed guard: the node still has child companies (re-parent/cascade first). */
 class NodeHasChildrenError extends Error {
     constructor(nodeUuid) {

package/dist/features/service-account/service-account.controller.d.ts

@@ -37,7 +37,8 @@ export declare class ServiceAccountController {
         account: import("./service-account.service.js").ServiceAccountView;
     }>;
     /**
-     * Issue a NEW key for an account. Gated `service_account:manage_keys`. Body: `{ expiresAtMs? }`.
+     * Issue a NEW key for an account. Gated `service_account:manage_keys`. Body: `{ expiresAtMs }`
+     * (a future epoch-ms) or `{ neverExpires: true }` — one of the two is required (400 otherwise).
      * Returns the raw `ask_…` key EXACTLY ONCE — copy it now, it is never retrievable again.
      */
     issueKey(req: AuthedRequest, id: string, body: unknown): Promise<{
@@ -45,7 +46,7 @@ export declare class ServiceAccountController {
     }>;
     /**
      * Rotate an account's key. Gated `service_account:manage_keys`. The previous key stops
-     * authenticating; the new raw key is returned EXACTLY ONCE.
+     * authenticating; the new raw key is returned EXACTLY ONCE. Same expiry rule as issue.
      */
     rotateKey(req: AuthedRequest, id: string, body: unknown): Promise<{
         key: import("./service-account.service.js").IssuedKey;

package/dist/features/service-account/service-account.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.controller.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,qBAAqB,EAMtB,MAAM,8BAA8B,CAAC;AAEtC,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AA0CD,qBACa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,qBAAqB;IAEvD,8FAA8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa;;;IAQpC;;;;;OAKG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa;IAQ1C,8FAA8F;IAGxF,GAAG,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;IAQ5D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAiB7D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAuBtF;;;OAGG;IAGG,QAAQ,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAWxF;;;OAGG;IAGG,SAAS,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAWzF;;;OAGG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAQpE"}
+{"version":3,"file":"service-account.controller.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.controller.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,qBAAqB,EAOtB,MAAM,8BAA8B,CAAC;AAGtC,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwDD,qBAEa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,qBAAqB;IAEvD,8FAA8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa;;;IAQpC;;;;;OAKG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa;IAQ1C,8FAA8F;IAGxF,GAAG,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;IAQ5D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAiB7D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAuBtF;;;;OAIG;IAGG,QAAQ,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAUxF;;;OAGG;IAGG,SAAS,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAUzF;;;OAGG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAQpE"}

package/dist/features/service-account/service-account.controller.js

@@ -29,6 +29,7 @@ exports.ServiceAccountController = void 0;
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const service_account_service_js_1 = require("./service-account.service.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 /** Project the resolved Principal to the AdminPrincipal the service consumes. */
 function adminOf(req) {
     const p = req.principal;
@@ -62,14 +63,27 @@ function optStringArray(v, field) {
     }
     return v;
 }
-/** Narrow an OPTIONAL positive-integer expiry (epoch-ms) from a key-issue body. */
-function optExpiry(v) {
-    if (v === undefined || v === null)
-        return undefined;
-    if (typeof v !== 'number' || !Number.isFinite(v) || v <= 0) {
-        throw new common_1.BadRequestException('expiresAtMs must be a positive epoch-ms number');
+/**
+ * Narrow a key-issue/rotate body to its expiry choice (ADR-0033 §4): `expiresAtMs` (epoch-ms) or
+ * `neverExpires: true`. Shape errors are 400 here; "neither", "both" and "not in the future" are
+ * decided by the service (it owns the clock) and also answer 400.
+ */
+function expiryOf(body) {
+    const out = {};
+    const v = body.expiresAtMs;
+    if (v !== undefined && v !== null) {
+        if (typeof v !== 'number' || !Number.isFinite(v) || v <= 0) {
+            throw new common_1.BadRequestException('expiresAtMs must be a positive epoch-ms number');
+        }
+        out.expiresAtMs = v;
     }
-    return v;
+    if (body.neverExpires !== undefined) {
+        if (typeof body.neverExpires !== 'boolean') {
+            throw new common_1.BadRequestException('neverExpires must be true or false');
+        }
+        out.neverExpires = body.neverExpires;
+    }
+    return out;
 }
 let ServiceAccountController = class ServiceAccountController {
     svc;
@@ -158,14 +172,14 @@ let ServiceAccountController = class ServiceAccountController {
         }
     }
     /**
-     * Issue a NEW key for an account. Gated `service_account:manage_keys`. Body: `{ expiresAtMs? }`.
+     * Issue a NEW key for an account. Gated `service_account:manage_keys`. Body: `{ expiresAtMs }`
+     * (a future epoch-ms) or `{ neverExpires: true }` — one of the two is required (400 otherwise).
      * Returns the raw `ask_…` key EXACTLY ONCE — copy it now, it is never retrievable again.
      */
     async issueKey(req, id, body) {
-        const b = (body ?? {});
-        const expiresAtMs = optExpiry(b.expiresAtMs);
+        const expiry = expiryOf((body ?? {}));
         try {
-            const key = await this.svc.issueKey(adminOf(req), id, expiresAtMs !== undefined ? { expiresAtMs } : {});
+            const key = await this.svc.issueKey(adminOf(req), id, expiry);
             return { key };
         }
         catch (e) {
@@ -174,13 +188,12 @@ let ServiceAccountController = class ServiceAccountController {
     }
     /**
      * Rotate an account's key. Gated `service_account:manage_keys`. The previous key stops
-     * authenticating; the new raw key is returned EXACTLY ONCE.
+     * authenticating; the new raw key is returned EXACTLY ONCE. Same expiry rule as issue.
      */
     async rotateKey(req, id, body) {
-        const b = (body ?? {});
-        const expiresAtMs = optExpiry(b.expiresAtMs);
+        const expiry = expiryOf((body ?? {}));
         try {
-            const key = await this.svc.rotateKey(adminOf(req), id, expiresAtMs !== undefined ? { expiresAtMs } : {});
+            const key = await this.svc.rotateKey(adminOf(req), id, expiry);
             return { key };
         }
         catch (e) {
@@ -277,5 +290,6 @@ __decorate([
 ], ServiceAccountController.prototype, "revokeKeys", null);
 exports.ServiceAccountController = ServiceAccountController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [service_account_service_js_1.ServiceAccountService])
 ], ServiceAccountController);

package/dist/features/service-account/service-account.service.d.ts

@@ -84,6 +84,11 @@ export interface AssignableAccess {
     readonly roles: readonly RoleOption[];
     readonly scopeNodes: readonly ScopeNodeOption[];
 }
+/** Key expiry on issue/rotate: a future `expiresAtMs`, or an explicit `neverExpires: true`. */
+export interface KeyExpiryOptions {
+    readonly expiresAtMs?: number;
+    readonly neverExpires?: boolean;
+}
 export declare class ServiceAccountService {
     private readonly accounts;
     private readonly keys;
@@ -179,19 +184,21 @@ export declare class ServiceAccountService {
      * Issue a NEW key for an account (own-tenant). Mints `ask_<id>_<secret>`, hashes the secret, and
      * persists the hash as the next version — carrying the ACCOUNT's current scope/roles onto the key
      * (so the key's Principal reflects the account as it stands). Returns the raw key ONCE.
-     * `expiresAtMs` is optional (a non-expiring key is discouraged; the caller opts in to no expiry).
+     * ADR-0033 §4 (security hardening): the caller must give a FUTURE `expiresAtMs`, or opt in to a
+     * non-expiring key explicitly with `neverExpires: true` — otherwise 400, nothing minted.
+     */
+    issueKey(admin: AdminPrincipal, id: string, opts?: KeyExpiryOptions): Promise<IssuedKey>;
+    /**
+     * The key's expiry from the request: a future epoch-ms, or `undefined` when the caller said
+     * `neverExpires: true`. Neither, both, or a past/invalid time → ServiceAccountInputError (400).
      */
-    issueKey(admin: AdminPrincipal, id: string, opts?: {
-        expiresAtMs?: number;
-    }): Promise<IssuedKey>;
+    private resolveExpiry;
     /**
      * Rotate an account's key: mint a new version (the old version stops being the current one —
      * `getByAccountId` returns the highest, so the previous key no longer authenticates). Returns the
      * new raw key ONCE.
      */
-    rotateKey(admin: AdminPrincipal, id: string, opts?: {
-        expiresAtMs?: number;
-    }): Promise<IssuedKey>;
+    rotateKey(admin: AdminPrincipal, id: string, opts?: KeyExpiryOptions): Promise<IssuedKey>;
     /** Revoke ALL of an account's keys (own-tenant) — fail-closed on the next request. Idempotent. */
     revokeKeys(admin: AdminPrincipal, id: string): Promise<void>;
     /** Shared mint path for issue + rotate: version bump, hash, putVersion, audit, one-time reveal. */

package/dist/features/service-account/service-account.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAerG;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,qBAAqB,CAMtG;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAwBrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAuBjC;;OAEG;YACW,iBAAiB;IAiB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAelE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAyF9B;;;;;OAKG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,SAAS,CAAC;IAMrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,SAAS,CAAC;IAMrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAYxB"}
+{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAwBrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}