@fuzdev/fuz_app 0.104.0 → 0.106.0

package/dist/auth/role_grant_offer_action_specs.js

@@ -23,7 +23,7 @@ import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
 import { RoleName } from './role_schema.js';
-import { ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX, RoleGrantOfferJson, } from './role_grant_offer_schema.js';
+import { ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX, RoleGrantOfferJson } from './role_grant_offer_schema.js';
 import { ROLE_GRANT_REVOKED_REASON_LENGTH_MAX } from './account_schema.js';
 import { ActingActor } from '../http/auth_shape.js';
 /** Error reason — caller tried to offer themselves a role_grant. */
@@ -57,26 +57,26 @@ export const ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH = 'role_grant_offer_a
 export const RoleGrantOfferCreateInput = z.strictObject({
     to_account_id: Uuid.meta({ description: 'Account id of the recipient.' }),
     to_actor_id: Uuid.nullish().meta({
-        description: 'Optional actor-grain target on the recipient account. When set, only this actor may accept and the audit envelope carries it on offer-shape events. Must belong to `to_account_id`.',
+        description: 'Optional actor-grain target on the recipient account. When set, only this actor may accept and the audit envelope carries it on offer-shape events. Must belong to `to_account_id`.'
     }),
     role: RoleName.meta({ description: 'Role being offered.' }),
     scope_kind: z.string().nullish().meta({
-        description: 'Machine-readable kind tag for `scope_id` — paired-null with `scope_id` (both null for global, both non-null for scoped). Required iff `scope_id` is set.',
+        description: 'Machine-readable kind tag for `scope_id` — paired-null with `scope_id` (both null for global, both non-null for scoped). Required iff `scope_id` is set.'
     }),
     scope_id: Uuid.nullish().meta({
-        description: 'Scope id for resource-scoped grants (e.g. classroom id). `null` for global.',
+        description: 'Scope id for resource-scoped grants (e.g. classroom id). `null` for global.'
     }),
     message: z
         .string()
         .max(ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX)
         .nullish()
         .meta({ description: 'Optional free-form note from the grantor.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Input for `role_grant_offer_accept`. */
 export const RoleGrantOfferAcceptInput = z.strictObject({
     offer_id: Uuid.meta({ description: 'The offer to accept.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Input for `role_grant_offer_decline`. */
 export const RoleGrantOfferDeclineInput = z.strictObject({
@@ -86,20 +86,20 @@ export const RoleGrantOfferDeclineInput = z.strictObject({
         .max(ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX)
         .nullish()
         .meta({ description: 'Optional free-form reason given on decline.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Input for `role_grant_offer_retract`. */
 export const RoleGrantOfferRetractInput = z.strictObject({
     offer_id: Uuid.meta({ description: 'The offer to retract.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Input for `role_grant_offer_list`. `account_id` is admin-only (inspect another account's inbox). */
 export const RoleGrantOfferListInput = z
     .strictObject({
     account_id: Uuid.nullish().meta({
-        description: 'Admin-only — list offers for another account. Defaults to the caller.',
+        description: 'Admin-only — list offers for another account. Defaults to the caller.'
     }),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /**
@@ -113,9 +113,9 @@ export const RoleGrantRevokeInput = z.strictObject({
     actor_id: Uuid.meta({ description: 'Actor whose role_grant to revoke.' }),
     role_grant_id: Uuid.meta({ description: 'The role_grant to revoke.' }),
     reason: z.string().max(ROLE_GRANT_REVOKED_REASON_LENGTH_MAX).nullish().meta({
-        description: 'Optional free-form reason; stamped on `role_grant.revoked_reason` and surfaced on the revokee WS notification.',
+        description: 'Optional free-form reason; stamped on `role_grant.revoked_reason` and surfaced on the revokee WS notification.'
     }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /**
  * Input for `role_grant_offer_history`. Returns every offer involving the account
@@ -125,26 +125,26 @@ export const RoleGrantRevokeInput = z.strictObject({
 export const RoleGrantOfferHistoryInput = z
     .strictObject({
     account_id: Uuid.nullish().meta({
-        description: 'Admin-only — history for another account. Defaults to the caller.',
+        description: 'Admin-only — history for another account. Defaults to the caller.'
     }),
     limit: z.number().int().min(1).max(500).nullish().meta({
-        description: 'Max rows to return (default 100).',
+        description: 'Max rows to return (default 100).'
     }),
     offset: z.number().int().min(0).nullish().meta({
-        description: 'Pagination offset (default 0).',
+        description: 'Pagination offset (default 0).'
     }),
-    acting: ActingActor,
+    acting: ActingActor
 })
     .default({});
 /** Output for `role_grant_offer_create`. */
 export const RoleGrantOfferCreateOutput = z.strictObject({
-    offer: RoleGrantOfferJson,
+    offer: RoleGrantOfferJson
 });
 /** Output for `role_grant_offer_accept`. */
 export const RoleGrantOfferAcceptOutput = z.strictObject({
     role_grant_id: Uuid,
     offer: RoleGrantOfferJson,
-    superseded_offer_ids: z.array(Uuid),
+    superseded_offer_ids: z.array(Uuid)
 });
 /** Output for `role_grant_offer_decline` / `role_grant_offer_retract`. */
 export const RoleGrantOfferOkOutput = z.strictObject({ ok: z.literal(true) });
@@ -155,7 +155,7 @@ export const RoleGrantOfferHistoryOutput = z.strictObject({ offers: z.array(Role
 /** Output for `role_grant_revoke`. */
 export const RoleGrantRevokeOutput = z.strictObject({
     ok: z.literal(true),
-    revoked: z.literal(true),
+    revoked: z.literal(true)
 });
 /**
  * Input for `role_grant_assign` — the immediate admin-only conferral path, the
@@ -167,20 +167,20 @@ export const RoleGrantRevokeOutput = z.strictObject({
 export const RoleGrantAssignInput = z.strictObject({
     to_account_id: Uuid.meta({ description: 'Account id of the grantee.' }),
     to_actor_id: Uuid.nullish().meta({
-        description: "Optional actor-grain target on the grantee account. When set, must belong to `to_account_id`. Omit to resolve the account's sole active actor — a multi-actor account must name one.",
+        description: "Optional actor-grain target on the grantee account. When set, must belong to `to_account_id`. Omit to resolve the account's sole active actor — a multi-actor account must name one."
     }),
     role: RoleName.meta({
-        description: "Role to assign. Must be admin-grantable (its `grant_paths` includes `'admin'`).",
+        description: "Role to assign. Must be admin-grantable (its `grant_paths` includes `'admin'`)."
     }),
     scope_id: Uuid.nullish().meta({
-        description: 'Scope id for resource-scoped grants. `null` for a global role_grant.',
+        description: 'Scope id for resource-scoped grants. `null` for a global role_grant.'
     }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 /** Output for `role_grant_assign`. */
 export const RoleGrantAssignOutput = z.strictObject({
     ok: z.literal(true),
-    role_grant_id: Uuid,
+    role_grant_id: Uuid
 });
 // -- Action specs -----------------------------------------------------------
 /**
@@ -207,15 +207,26 @@ export const role_grant_offer_create_action_spec = {
         ERROR_ROLE_GRANT_OFFER_SELF_TARGET,
         ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE,
         ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED,
-        ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH,
+        ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH
     ],
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
+/**
+ * `credential_types: ['session']` — see `docs/security.md` §Credential-channel
+ * gating. The only offer verb that moves the *caller's own* authority:
+ * accepting a pending admin offer over a leaked API token is a privilege pivot
+ * in the same family the credential-lifecycle mutations are gated to prevent
+ * (the token is account-wide and non-expiring, and the resulting role_grant
+ * outlives revoking it). Consent inherently belongs to a human at a browser,
+ * and no automation accepts an offer on its own behalf. The sibling verbs stay
+ * ungated deliberately — `_create` is the offering side, and `_decline` /
+ * `_retract` destroy a pending offer and confer nothing.
+ */
 export const role_grant_offer_accept_action_spec = {
     method: 'role_grant_offer_accept',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { account: 'required', actor: 'required' },
+    auth: { account: 'required', actor: 'required', credential_types: ['session'] },
     side_effects: true,
     input: RoleGrantOfferAcceptInput,
     output: RoleGrantOfferAcceptOutput,
@@ -225,8 +236,8 @@ export const role_grant_offer_accept_action_spec = {
         ERROR_ROLE_GRANT_OFFER_NOT_FOUND,
         ERROR_ROLE_GRANT_OFFER_TERMINAL,
         ERROR_ROLE_GRANT_OFFER_EXPIRED,
-        ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH,
-    ],
+        ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH
+    ]
 };
 export const role_grant_offer_decline_action_spec = {
     method: 'role_grant_offer_decline',
@@ -238,7 +249,7 @@ export const role_grant_offer_decline_action_spec = {
     output: RoleGrantOfferOkOutput,
     async: true,
     description: 'Decline an offer. Recipient-only.',
-    error_reasons: [ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL],
+    error_reasons: [ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL]
 };
 export const role_grant_offer_retract_action_spec = {
     method: 'role_grant_offer_retract',
@@ -250,7 +261,7 @@ export const role_grant_offer_retract_action_spec = {
     output: RoleGrantOfferOkOutput,
     async: true,
     description: 'Retract an offer. Grantor-only, pre-decision.',
-    error_reasons: [ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL],
+    error_reasons: [ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_TERMINAL]
 };
 export const role_grant_offer_list_action_spec = {
     method: 'role_grant_offer_list',
@@ -261,7 +272,7 @@ export const role_grant_offer_list_action_spec = {
     input: RoleGrantOfferListInput,
     output: RoleGrantOfferListOutput,
     async: true,
-    description: 'List pending, non-expired offers for the caller. Admins may pass `account_id` to inspect another account.',
+    description: 'List pending, non-expired offers for the caller. Admins may pass `account_id` to inspect another account.'
 };
 export const role_grant_offer_history_action_spec = {
     method: 'role_grant_offer_history',
@@ -272,7 +283,7 @@ export const role_grant_offer_history_action_spec = {
     input: RoleGrantOfferHistoryInput,
     output: RoleGrantOfferHistoryOutput,
     async: true,
-    description: 'List every offer involving the caller (either direction), including terminal rows, newest first. Admins may pass `account_id` to inspect another account.',
+    description: 'List every offer involving the caller (either direction), including terminal rows, newest first. Admins may pass `account_id` to inspect another account.'
 };
 /**
  * `rate_limit: 'account'` bounds admin-side burn of `role_grant_revoke` —
@@ -291,7 +302,7 @@ export const role_grant_revoke_action_spec = {
     async: true,
     description: 'Revoke an active role_grant on a target actor. Admin-only. Supersedes any pending offers for the same (account, role, scope). Fires role_grant_revoke + role_grant_offer_supersede notifications.',
     error_reasons: [ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE],
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * `rate_limit: 'account'` bounds admin-side burn of `role_grant_assign` — the
@@ -309,7 +320,7 @@ export const role_grant_assign_action_spec = {
     async: true,
     description: "Immediately assign a role_grant to a target account — admin-only, no consent step (the capability-unlock UX). The role's `grant_paths` must include `'admin'`. Idempotent: re-assigning an active grant returns it. Emits a role_grant_create audit event.",
     error_reasons: [ERROR_ROLE_NOT_WEB_GRANTABLE, ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH],
-    rate_limit: 'account',
+    rate_limit: 'account'
 };
 /**
  * All role-grant-offer action specs — a codegen-ready registry. Consumers spread
@@ -324,5 +335,5 @@ export const all_role_grant_offer_action_specs = [
     role_grant_offer_list_action_spec,
     role_grant_offer_history_action_spec,
     role_grant_revoke_action_spec,
-    role_grant_assign_action_spec,
+    role_grant_assign_action_spec
 ];

package/dist/auth/role_grant_offer_actions.d.ts

@@ -42,10 +42,11 @@
  *
  * @module
  */
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type ActionContext, type RpcAction } from '../actions/action_rpc.js';
 import { type RoleSchemaResult } from './role_schema.js';
 import { type RequestContext } from './request_context.js';
-import type { RouteFactoryDeps } from './deps.js';
+import type { ActionFactoryDeps } from './deps.js';
 import { type NotificationSender } from './role_grant_offer_notifications.js';
 /**
  * Authorization callback for `role_grant_offer_create`. Returns `true` to allow,
@@ -60,7 +61,9 @@ export type RoleGrantOfferCreateAuthorize = (auth: RequestContext, input: {
     to_account_id: string;
     role: string;
     scope_id: string | null;
-}, deps: Pick<RouteFactoryDeps, 'log'>, ctx: ActionContext) => boolean | Promise<boolean>;
+}, deps: {
+    log: Logger;
+}, ctx: ActionContext) => boolean | Promise<boolean>;
 /** Options for `create_role_grant_offer_actions`. */
 export interface RoleGrantOfferActionOptions {
     /**
@@ -84,11 +87,11 @@ export interface RoleGrantOfferActionOptions {
  * Create the eight role-grant-offer RPC actions (six offer-lifecycle methods
  * plus `role_grant_revoke` and the immediate `role_grant_assign`).
  *
- * @param deps - `RouteFactoryDeps` (`log`, `audit`, …) plus optional `notification_sender` for WS fan-out — when absent, WS fan-out is silently skipped (DB-only side effects still happen). Consumers wiring `BackendWebsocketTransport` assign its instance directly (the transport's `send_to_account` signature accepts the broader `JsonrpcMessageFromServerToClient`, which is contravariantly compatible)
+ * @param deps - `ActionFactoryDeps` (`log`, `audit`) plus optional `notification_sender` for WS fan-out — when absent, WS fan-out is silently skipped (DB-only side effects still happen). Consumers wiring `BackendWebsocketTransport` assign its instance directly (the transport's `send_to_account` signature accepts the broader `JsonrpcMessageFromServerToClient`, which is contravariantly compatible)
  * @param options - role schema, default TTL, authorization override
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  */
-export declare const create_role_grant_offer_actions: (deps: Pick<RouteFactoryDeps, "log" | "audit"> & {
+export declare const create_role_grant_offer_actions: (deps: ActionFactoryDeps & {
     notification_sender?: NotificationSender | null;
 }, options?: RoleGrantOfferActionOptions) => Array<RpcAction>;
 //# sourceMappingURL=role_grant_offer_actions.d.ts.map

package/dist/auth/role_grant_offer_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,EAA4C,KAAK,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpG,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEhD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AAoC7C;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,EACrE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EACnC,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AAgCD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IAC/C,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CAkiBjB,CAAC"}
+{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AAoC7C;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACvE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACrB,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AAgCD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,iBAAiB,GAAG;IACzB,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CAkiBjB,CAAC"}

package/dist/auth/role_grant_offer_actions.js

@@ -42,19 +42,19 @@
  *
  * @module
  */
-import { rpc_action, } from '../actions/action_rpc.js';
+import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
 import { emit_after_commit } from '../http/pending_effects.js';
-import { builtin_role_specs_by_name, ROLE_ADMIN, role_has_grant_path, } from './role_schema.js';
+import { builtin_role_specs_by_name, ROLE_ADMIN, role_has_grant_path } from './role_schema.js';
 import { GRANT_PATH_ADMIN } from './grant_path_schema.js';
-import { ROLE_GRANT_OFFER_DEFAULT_TTL_MS, to_role_grant_offer_json, } from './role_grant_offer_schema.js';
-import { query_role_grant_offer_create, query_role_grant_offer_decline, query_role_grant_offer_retract, query_role_grant_offer_list, query_role_grant_offer_history_for_account, query_accept_offer, RoleGrantOfferActorAccountMismatchError, RoleGrantOfferActorMismatchError, RoleGrantOfferAlreadyTerminalError, RoleGrantOfferExpiredError, RoleGrantOfferNotFoundError, RoleGrantOfferSelfTargetError, } from './role_grant_offer_queries.js';
-import { query_create_role_grant, query_role_grant_find_active_role_for_actor, query_revoke_role_grant, } from './role_grant_queries.js';
+import { ROLE_GRANT_OFFER_DEFAULT_TTL_MS, to_role_grant_offer_json } from './role_grant_offer_schema.js';
+import { query_role_grant_offer_create, query_role_grant_offer_decline, query_role_grant_offer_retract, query_role_grant_offer_list, query_role_grant_offer_history_for_account, query_accept_offer, RoleGrantOfferActorAccountMismatchError, RoleGrantOfferActorMismatchError, RoleGrantOfferAlreadyTerminalError, RoleGrantOfferExpiredError, RoleGrantOfferNotFoundError, RoleGrantOfferSelfTargetError } from './role_grant_offer_queries.js';
+import { query_create_role_grant, query_role_grant_find_active_role_for_actor, query_revoke_role_grant } from './role_grant_queries.js';
 import { query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { has_scoped_role } from './request_context.js';
-import { build_role_grant_offer_accepted_notification, build_role_grant_offer_declined_notification, build_role_grant_offer_received_notification, build_role_grant_offer_retracted_notification, build_role_grant_offer_supersede_notification, build_role_grant_revoke_notification, } from './role_grant_offer_notifications.js';
+import { build_role_grant_offer_accepted_notification, build_role_grant_offer_declined_notification, build_role_grant_offer_received_notification, build_role_grant_offer_retracted_notification, build_role_grant_offer_supersede_notification, build_role_grant_revoke_notification } from './role_grant_offer_notifications.js';
 import { ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
-import { ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, role_grant_assign_action_spec, } from './role_grant_offer_action_specs.js';
+import { ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, role_grant_assign_action_spec } from './role_grant_offer_action_specs.js';
 // -- Helpers ----------------------------------------------------------------
 /**
  * Fan out a batch of pre-written audit rows to the bound emitter's
@@ -85,7 +85,7 @@ const default_authorize = async (auth, _input, _deps, _ctx) => {
  * Create the eight role-grant-offer RPC actions (six offer-lifecycle methods
  * plus `role_grant_revoke` and the immediate `role_grant_assign`).
  *
- * @param deps - `RouteFactoryDeps` (`log`, `audit`, …) plus optional `notification_sender` for WS fan-out — when absent, WS fan-out is silently skipped (DB-only side effects still happen). Consumers wiring `BackendWebsocketTransport` assign its instance directly (the transport's `send_to_account` signature accepts the broader `JsonrpcMessageFromServerToClient`, which is contravariantly compatible)
+ * @param deps - `ActionFactoryDeps` (`log`, `audit`) plus optional `notification_sender` for WS fan-out — when absent, WS fan-out is silently skipped (DB-only side effects still happen). Consumers wiring `BackendWebsocketTransport` assign its instance directly (the transport's `send_to_account` signature accepts the broader `JsonrpcMessageFromServerToClient`, which is contravariantly compatible)
  * @param options - role schema, default TTL, authorization override
  * @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
  */
@@ -108,8 +108,8 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             metadata: {
                 role: input.role,
                 scope_id: input.scope_id ?? null,
-                to_account_id: input.to_account_id,
-            },
+                to_account_id: input.to_account_id
+            }
         });
     };
     // Returns {offer} only — no auto-accept. Recipient must call
@@ -123,18 +123,18 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         if (!role_has_grant_path(role_specs, input.role, GRANT_PATH_ADMIN)) {
             emit_create_failure_audit(ctx, auth, input);
             throw jsonrpc_errors.forbidden('role not grantable', {
-                reason: ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE,
+                reason: ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE
             });
         }
         const authorized = await authorize(auth, {
             to_account_id: input.to_account_id,
             role: input.role,
-            scope_id: input.scope_id ?? null,
+            scope_id: input.scope_id ?? null
         }, { log }, ctx);
         if (!authorized) {
             emit_create_failure_audit(ctx, auth, input);
             throw jsonrpc_errors.forbidden('not authorized to offer this role', {
-                reason: ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED,
+                reason: ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED
             });
         }
         let offer;
@@ -147,20 +147,20 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 scope_kind: input.scope_kind ?? null,
                 scope_id: input.scope_id ?? null,
                 message: input.message ?? null,
-                expires_at: new Date(Date.now() + default_ttl_ms),
+                expires_at: new Date(Date.now() + default_ttl_ms)
             });
         }
         catch (err) {
             if (err instanceof RoleGrantOfferSelfTargetError) {
                 emit_create_failure_audit(ctx, auth, input);
                 throw jsonrpc_errors.invalid_params('cannot offer to self', {
-                    reason: ERROR_ROLE_GRANT_OFFER_SELF_TARGET,
+                    reason: ERROR_ROLE_GRANT_OFFER_SELF_TARGET
                 });
             }
             if (err instanceof RoleGrantOfferActorAccountMismatchError) {
                 emit_create_failure_audit(ctx, auth, input);
                 throw jsonrpc_errors.invalid_params('to_actor_id does not belong to to_account_id', {
-                    reason: ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH,
+                    reason: ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH
                 });
             }
             throw err;
@@ -177,8 +177,8 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 offer_id: offer.id,
                 role: offer.role,
                 scope_id: offer.scope_id,
-                to_account_id: offer.to_account_id,
-            },
+                to_account_id: offer.to_account_id
+            }
         });
         const offer_json = to_role_grant_offer_json(offer);
         if (notification_sender) {
@@ -196,7 +196,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 offer_id: input.offer_id,
                 to_account_id: auth.account.id,
                 actor_id: auth.actor.id,
-                ip: ctx.client_ip,
+                ip: ctx.client_ip
             });
         }
         catch (err) {
@@ -211,7 +211,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             }
             if (err instanceof RoleGrantOfferActorMismatchError) {
                 throw jsonrpc_errors.forbidden('offer is targeted to a different actor', {
-                    reason: ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH,
+                    reason: ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH
                 });
             }
             throw err;
@@ -227,7 +227,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         const offer_json = to_role_grant_offer_json(result.offer);
         const supersede_payloads = result.superseded_offers.map((sib) => ({
             offer: to_role_grant_offer_json(sib),
-            from_account_id: sib.from_account_id,
+            from_account_id: sib.from_account_id
         }));
         // Audit events are written in-transaction by query_accept_offer; wire
         // them through `audit.notify` post-commit so SSE/WS broadcasts fire.
@@ -245,7 +245,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                     notification_sender.send_to_account(sib.from_account_id, build_role_grant_offer_supersede_notification({
                         offer: sib.offer,
                         reason: 'sibling_accepted',
-                        cause_id: result.offer.id,
+                        cause_id: result.offer.id
                     }));
                 }
             }
@@ -253,7 +253,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         return {
             role_grant_id: result.role_grant.id,
             offer: offer_json,
-            superseded_offer_ids: result.superseded_offers.map((o) => o.id),
+            superseded_offer_ids: result.superseded_offers.map((o) => o.id)
         };
     };
     const decline_handler = async (input, ctx) => {
@@ -284,8 +284,8 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 offer_id: declined.id,
                 role: declined.role,
                 scope_id: declined.scope_id,
-                reason: input.reason ?? undefined,
-            },
+                reason: input.reason ?? undefined
+            }
         });
         if (notification_sender) {
             // Grantor's account_id rides on `declined.from_account_id` from
@@ -325,8 +325,8 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             metadata: {
                 offer_id: retracted.id,
                 role: retracted.role,
-                scope_id: retracted.scope_id,
-            },
+                scope_id: retracted.scope_id
+            }
         });
         if (notification_sender) {
             const offer_json = to_role_grant_offer_json(retracted);
@@ -381,10 +381,10 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 outcome: 'failure',
                 target_account_id,
                 target_actor_id,
-                metadata: { role: role_grant_row.role, role_grant_id: input.role_grant_id },
+                metadata: { role: role_grant_row.role, role_grant_id: input.role_grant_id }
             });
             throw jsonrpc_errors.forbidden('role not web-grantable', {
-                reason: ERROR_ROLE_NOT_WEB_GRANTABLE,
+                reason: ERROR_ROLE_NOT_WEB_GRANTABLE
             });
         }
         const result = await query_revoke_role_grant(ctx, input.role_grant_id, input.actor_id, auth.actor.id, input.reason ?? null);
@@ -401,8 +401,8 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 role: result.role,
                 role_grant_id: result.id,
                 scope_id: result.scope_id,
-                reason: input.reason ?? undefined,
-            },
+                reason: input.reason ?? undefined
+            }
         });
         // Supersede cascade — the recipient is known (`offer.to_account_id`),
         // so populate `target_account_id` rather than leaving it null;
@@ -418,14 +418,14 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                     role: offer.role,
                     scope_id: offer.scope_id,
                     reason: 'role_grant_revoked',
-                    cause_id: result.id,
-                },
+                    cause_id: result.id
+                }
             });
         }
         if (notification_sender) {
             const superseded = result.superseded_offers.map((o) => ({
                 offer: to_role_grant_offer_json(o),
-                from_account_id: o.from_account_id,
+                from_account_id: o.from_account_id
             }));
             const cause_id = result.id;
             const reason = input.reason ?? null;
@@ -434,13 +434,13 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                     role_grant_id: result.id,
                     role: result.role,
                     scope_id: result.scope_id,
-                    reason,
+                    reason
                 }));
                 for (const sib of superseded) {
                     notification_sender.send_to_account(sib.from_account_id, build_role_grant_offer_supersede_notification({
                         offer: sib.offer,
                         reason: 'role_grant_revoked',
-                        cause_id,
+                        cause_id
                     }));
                 }
             });
@@ -465,10 +465,10 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 outcome: 'failure',
                 target_account_id: input.to_account_id,
                 target_actor_id: input.to_actor_id ?? null,
-                metadata: { role: input.role, scope_id: input.scope_id ?? null },
+                metadata: { role: input.role, scope_id: input.scope_id ?? null }
             });
             throw jsonrpc_errors.forbidden('role not web-grantable', {
-                reason: ERROR_ROLE_NOT_WEB_GRANTABLE,
+                reason: ERROR_ROLE_NOT_WEB_GRANTABLE
             });
         }
         // Resolve the grant's target actor. A supplied `to_actor_id` must be an
@@ -482,7 +482,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         if (input.to_actor_id != null) {
             if (!actors.some((a) => a.id === input.to_actor_id)) {
                 throw jsonrpc_errors.invalid_params('to_actor_id does not belong to to_account_id', {
-                    reason: ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH,
+                    reason: ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH
                 });
             }
             target_actor_id = input.to_actor_id;
@@ -504,7 +504,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             role: input.role,
             scope_kind: null,
             scope_id: input.scope_id ?? null,
-            granted_by: auth.actor.id,
+            granted_by: auth.actor.id
         });
         audit.emit_role_grant_target(ctx, auth, {
             event_type: 'role_grant_create',
@@ -513,8 +513,8 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             metadata: {
                 role: grant.role,
                 role_grant_id: grant.id,
-                scope_id: grant.scope_id,
-            },
+                scope_id: grant.scope_id
+            }
         });
         return { ok: true, role_grant_id: grant.id };
     };
@@ -526,6 +526,6 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         rpc_action(role_grant_offer_list_action_spec, list_handler),
         rpc_action(role_grant_offer_history_action_spec, history_handler),
         rpc_action(role_grant_revoke_action_spec, revoke_handler),
-        rpc_action(role_grant_assign_action_spec, assign_handler),
+        rpc_action(role_grant_assign_action_spec, assign_handler)
     ];
 };

package/dist/auth/role_grant_offer_notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_notifications.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAqB,KAAK,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAIrE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,oBAAoB,CAAC;AAM5D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,KAAK,MAAM,CAAC;CAC5E;AAID,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAIzE,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF,yEAAyE;AACzE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;kBAExC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;kBAIxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;kBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUjB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWjB,CAAC;AAEzC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;CAUR,CAAC;AAIzC;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,KAAK,CAAC,SAAS,CAOhE,CAAC;AAIF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,oCAAoC,GAChD,QAAQ,qBAAqB,KAC3B,mBACwE,CAAC"}
+{"version":3,"file":"role_grant_offer_notifications.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsB,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAIvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAM9D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,KAAK,MAAM,CAAC;CAC5E;AAID,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAIzE,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF,yEAAyE;AACzE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;kBAExC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;kBAIxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;kBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUjB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWjB,CAAC;AAEzC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;CAUR,CAAC;AAIzC;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,KAAK,CAAC,SAAS,CAOhE,CAAC;AAIF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,oCAAoC,GAChD,QAAQ,qBAAqB,KAC3B,mBACwE,CAAC"}