@fuzdev/fuz_app 0.114.0 → 0.115.0

package/dist/auth/role_grant_offer_action_specs.js

@@ -22,7 +22,7 @@
  */
 import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.ts';
-import { ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
+import { ERROR_INSUFFICIENT_PERMISSIONS, ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
 import { RoleName } from './role_schema.js';
 import { ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX, RoleGrantOfferJson } from './role_grant_offer_schema.js';
 import { ROLE_GRANT_REVOKED_REASON_LENGTH_MAX } from './account_schema.js';
@@ -43,6 +43,29 @@ export const ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED = 'role_grant_offer_not_autho
 export const ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH = 'role_grant_offer_actor_mismatch';
 /** Error reason — `role_grant_offer_create` was called with a `to_actor_id` that does not belong to `to_account_id`. */
 export const ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH = 'role_grant_offer_actor_account_mismatch';
+/**
+ * Error reason — a grant path was asked to bind a builtin role to a scope
+ * (builtin roles are global-only, see `is_builtin_role`). Refused by
+ * `role_grant_assign`, `role_grant_offer_create`, and `role_grant_offer_accept`.
+ */
+export const ERROR_ROLE_GRANT_BUILTIN_SCOPED = 'role_grant_builtin_scoped';
+/**
+ * Whether a grant input's `scope_kind` + `scope_id` are paired — both absent
+ * (a global grant) or both present (a scoped one), the
+ * `role_grant_scope_kind_paired` / `role_grant_offer_scope_kind_paired`
+ * CHECKs. The grant inputs refine on it so a half-scoped call is a `-32602`
+ * rather than a constraint-violation 500.
+ *
+ * @param input - the grant input's scope pair
+ * @returns `true` when both are set or both are absent
+ */
+export const is_grant_scope_paired = (input) => (input.scope_kind == null) === (input.scope_id == null);
+/** The message a half-scoped grant input fails with — the grant inputs' refine, and the UI's pre-RPC guard. */
+export const GRANT_SCOPE_PAIRED_MESSAGE = "'scope_kind' and 'scope_id' must be given together (both for a scoped grant, neither for a global one)";
+/** The `scope_kind` field both grant inputs share, paired with `scope_id`. */
+const GrantScopeKind = z.string().nullish().meta({
+    description: 'Machine-readable kind tag for `scope_id` — paired-null with `scope_id` (both null for global, both non-null for scoped). Required iff `scope_id` is set.'
+});
 // -- Input/output schemas ---------------------------------------------------
 /**
  * Input for `role_grant_offer_create`.
@@ -55,15 +78,14 @@ export const ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH = 'role_grant_offer_a
  * events. Omit (or pass null) for the account-grain default — any actor
  * on `to_account_id` may accept.
  */
-export const RoleGrantOfferCreateInput = z.strictObject({
+export const RoleGrantOfferCreateInput = z
+    .strictObject({
     to_account_id: Uuid.meta({ description: 'Account id of the recipient.' }),
     to_actor_id: Uuid.nullish().meta({
         description: 'Optional actor-grain target on the recipient account. When set, only this actor may accept and the audit envelope carries it on offer-shape events. Must belong to `to_account_id`.'
     }),
     role: RoleName.meta({ description: 'Role being offered.' }),
-    scope_kind: z.string().nullish().meta({
-        description: 'Machine-readable kind tag for `scope_id` — paired-null with `scope_id` (both null for global, both non-null for scoped). Required iff `scope_id` is set.'
-    }),
+    scope_kind: GrantScopeKind,
     scope_id: Uuid.nullish().meta({
         description: 'Scope id for resource-scoped grants (e.g. classroom id). `null` for global.'
     }),
@@ -73,7 +95,8 @@ export const RoleGrantOfferCreateInput = z.strictObject({
         .nullish()
         .meta({ description: 'Optional free-form note from the grantor.' }),
     acting: ActingActor
-});
+})
+    .refine(is_grant_scope_paired, { message: GRANT_SCOPE_PAIRED_MESSAGE });
 /** Input for `role_grant_offer_accept`. */
 export const RoleGrantOfferAcceptInput = z.strictObject({
     offer_id: Uuid.meta({ description: 'The offer to accept.' }),
@@ -162,10 +185,12 @@ export const RoleGrantRevokeOutput = z.strictObject({
  * Input for `role_grant_assign` — the immediate admin-only conferral path, the
  * consent-free sibling of `role_grant_offer_create`. An admin assigns a
  * role_grant straight onto the target actor; there is no offer for a grantee to
- * accept. No `message` (no offer to carry it on) and no `scope_kind` (`scope_id`
- * alone is the v1 scope discriminator — the grant row's `scope_kind` stays null).
+ * accept. No `message` (no offer to carry it on). `scope_kind` pairs with
+ * `scope_id` exactly as on `role_grant_offer_create` — both or neither — and
+ * the grant row carries the pair.
  */
-export const RoleGrantAssignInput = z.strictObject({
+export const RoleGrantAssignInput = z
+    .strictObject({
     to_account_id: Uuid.meta({ description: 'Account id of the grantee.' }),
     to_actor_id: Uuid.nullish().meta({
         description: "Optional actor-grain target on the grantee account. When set, must belong to `to_account_id`. Omit to resolve the account's sole active actor — a multi-actor account must name one."
@@ -173,11 +198,13 @@ export const RoleGrantAssignInput = z.strictObject({
     role: RoleName.meta({
         description: "Role to assign. Must be admin-grantable (its `grant_paths` includes `'admin'`)."
     }),
+    scope_kind: GrantScopeKind,
     scope_id: Uuid.nullish().meta({
-        description: 'Scope id for resource-scoped grants. `null` for a global role_grant.'
+        description: 'Scope id for resource-scoped grants. `null` for a global role_grant. Builtin roles are global-only.'
     }),
     acting: ActingActor
-});
+})
+    .refine(is_grant_scope_paired, { message: GRANT_SCOPE_PAIRED_MESSAGE });
 /** Output for `role_grant_assign`. */
 export const RoleGrantAssignOutput = z.strictObject({
     ok: z.literal(true),
@@ -203,12 +230,13 @@ export const role_grant_offer_create_action_spec = {
     input: RoleGrantOfferCreateInput,
     output: RoleGrantOfferCreateOutput,
     async: true,
-    description: "Offer a role_grant to another account. Grantor must hold the offered role (or pass a consumer authorize callback); role's `grant_paths` must include `'admin'`.",
+    description: "Offer a role_grant to another account. Admin-only by default (a consumer authorize callback may widen it for app roles); role's `grant_paths` must include `'admin'`. A builtin role is global-only and offered only by a global admin, whatever the callback says.",
     error_reasons: [
         ERROR_ROLE_GRANT_OFFER_SELF_TARGET,
         ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE,
         ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED,
-        ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH
+        ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH,
+        ERROR_ROLE_GRANT_BUILTIN_SCOPED
     ],
     rate_limit: 'account'
 };
@@ -232,12 +260,15 @@ export const role_grant_offer_accept_action_spec = {
     input: RoleGrantOfferAcceptInput,
     output: RoleGrantOfferAcceptOutput,
     async: true,
-    description: 'Accept an offer. Atomically marks the offer accepted, inserts the role_grant, and supersedes sibling pending offers for the same (account, role, scope).',
+    description: 'Accept an offer. Atomically marks the offer accepted, inserts the role_grant, and supersedes sibling pending offers for the same (account, role, scope). A builtin-role offer is refused (and stays pending) when it is `keeper`, scoped, or its grantor no longer holds a global admin.',
     error_reasons: [
         ERROR_ROLE_GRANT_OFFER_NOT_FOUND,
         ERROR_ROLE_GRANT_OFFER_TERMINAL,
         ERROR_ROLE_GRANT_OFFER_EXPIRED,
-        ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH
+        ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH,
+        ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE,
+        ERROR_ROLE_GRANT_BUILTIN_SCOPED,
+        ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED
     ]
 };
 export const role_grant_offer_decline_action_spec = {
@@ -319,8 +350,13 @@ export const role_grant_assign_action_spec = {
     input: RoleGrantAssignInput,
     output: RoleGrantAssignOutput,
     async: true,
-    description: "Immediately assign a role_grant to a target account — admin-only, no consent step (the capability-unlock UX). The role's `grant_paths` must include `'admin'`. Idempotent: re-assigning an active grant returns it. Emits a role_grant_create audit event.",
-    error_reasons: [ERROR_ROLE_NOT_WEB_GRANTABLE, ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH],
+    description: "Immediately assign a role_grant to a target account — global-admin-only, no consent step (the capability-unlock UX). The role's `grant_paths` must include `'admin'`; `scope_kind` + `scope_id` are paired, and a builtin role is global-only. Idempotent: re-assigning an active grant returns it. Emits a role_grant_create audit event.",
+    error_reasons: [
+        ERROR_INSUFFICIENT_PERMISSIONS,
+        ERROR_ROLE_NOT_WEB_GRANTABLE,
+        ERROR_ROLE_GRANT_BUILTIN_SCOPED,
+        ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH
+    ],
     rate_limit: 'account'
 };
 /**

package/dist/auth/role_grant_offer_actions.d.ts

@@ -11,12 +11,18 @@
  * `side_effects: false` so they are addressable via GET.
  *
  * Authorization:
- * - `role_grant_offer_create` — the grantor must hold an active role_grant for the
- *   role being offered, and that role's `grant_paths` must include `'admin'`.
- *   Consumers needing a richer policy (e.g., "teacher may offer student in
- *   *their* classroom") pass an `authorize` callback that overrides the default.
+ * - `role_grant_offer_create` — the role's `grant_paths` must include `'admin'`,
+ *   and by default the grantor must hold a **global** `admin`. Consumers needing
+ *   a richer policy (e.g., "teacher may offer student in *their* classroom")
+ *   pass an `authorize` callback that overrides the default — for app roles
+ *   only: a builtin role (`admin` / `keeper`) is global-only (a scoped one is
+ *   refused with `role_grant_builtin_scoped`) and offered only by a global
+ *   admin, both decided before the callback runs.
  * - `role_grant_offer_accept` / `role_grant_offer_decline` — keyed to the caller's
- *   account; `query_*` helpers enforce the IDOR guard.
+ *   account; `query_*` helpers enforce the IDOR guard. Accept also refuses a
+ *   builtin-role offer that must not mint (`keeper`, scoped, or a grantor who
+ *   no longer holds a global admin), auditing the refusal and leaving the
+ *   offer pending.
  * - `role_grant_offer_retract` — keyed to the caller's actor.
  * - `role_grant_offer_list` / `role_grant_offer_history` — self by default;
  *   `{account_id}` is admin-only.
@@ -24,10 +30,12 @@
  *   dispatcher rejects non-admin callers before the handler runs.
  *   The admin-grant-path gate prevents revoking keeper / daemon-scoped
  *   roles via this surface. Keys on `actor_id` to survive multi-actor accounts.
- * - `role_grant_assign` — spec-level `auth: {role: 'admin'}`; the immediate
- *   consent-free conferral path. The admin-grant-path gate prevents assigning
- *   keeper / daemon-scoped roles via this surface. No holder-propagation — only
- *   admins confer (see participation-gates.md Decision 7).
+ * - `role_grant_assign` — spec-level `auth: {role: 'admin'}` (a **global**
+ *   grant, re-checked in the handler); the immediate consent-free conferral
+ *   path. The admin-grant-path gate prevents assigning keeper / daemon-scoped
+ *   roles via this surface, and a scoped `admin` is refused. No
+ *   holder-propagation — only a global admin confers; holding a role grants
+ *   no power to assign it.
  *
  * Audit events are emitted in-transaction by the query layer (atomic with
  * the role_grant write on accept/revoke) or by the handler via the bound
@@ -77,9 +85,12 @@ export interface RoleGrantOfferActionOptions {
     default_ttl_ms?: number;
     /**
      * Custom authorization for `role_grant_offer_create`. The default requires the
-     * caller to hold an active role_grant for the offered role *and* the role's
-     * `RoleSpec.grant_paths` to include `'admin'`. Consumers with richer
-     * policies (scope-aware, chained roles) override this.
+     * caller to hold a **global** `admin` grant; the role's
+     * `RoleSpec.grant_paths` must include `'admin'` either way. Consumers with
+     * richer policies (scope-aware, chained roles) override this. A builtin
+     * role never reaches the callback unless the caller holds a global `admin`
+     * and the offer is unscoped — the spine decides builtin-role offers itself,
+     * so a callback needs no builtin handling of its own.
      */
     authorize?: RoleGrantOfferCreateAuthorize;
 }

package/dist/auth/role_grant_offer_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AAoC7C;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACvE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACrB,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AAgCD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,iBAAiB,GAAG;IACzB,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CAkiBjB,CAAC"}
+{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AA4B1B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AAyC7C;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACvE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACrB,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AA6CD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,iBAAiB,GAAG;IACzB,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CAsnBjB,CAAC"}

package/dist/auth/role_grant_offer_actions.js

@@ -11,12 +11,18 @@
  * `side_effects: false` so they are addressable via GET.
  *
  * Authorization:
- * - `role_grant_offer_create` — the grantor must hold an active role_grant for the
- *   role being offered, and that role's `grant_paths` must include `'admin'`.
- *   Consumers needing a richer policy (e.g., "teacher may offer student in
- *   *their* classroom") pass an `authorize` callback that overrides the default.
+ * - `role_grant_offer_create` — the role's `grant_paths` must include `'admin'`,
+ *   and by default the grantor must hold a **global** `admin`. Consumers needing
+ *   a richer policy (e.g., "teacher may offer student in *their* classroom")
+ *   pass an `authorize` callback that overrides the default — for app roles
+ *   only: a builtin role (`admin` / `keeper`) is global-only (a scoped one is
+ *   refused with `role_grant_builtin_scoped`) and offered only by a global
+ *   admin, both decided before the callback runs.
  * - `role_grant_offer_accept` / `role_grant_offer_decline` — keyed to the caller's
- *   account; `query_*` helpers enforce the IDOR guard.
+ *   account; `query_*` helpers enforce the IDOR guard. Accept also refuses a
+ *   builtin-role offer that must not mint (`keeper`, scoped, or a grantor who
+ *   no longer holds a global admin), auditing the refusal and leaving the
+ *   offer pending.
  * - `role_grant_offer_retract` — keyed to the caller's actor.
  * - `role_grant_offer_list` / `role_grant_offer_history` — self by default;
  *   `{account_id}` is admin-only.
@@ -24,10 +30,12 @@
  *   dispatcher rejects non-admin callers before the handler runs.
  *   The admin-grant-path gate prevents revoking keeper / daemon-scoped
  *   roles via this surface. Keys on `actor_id` to survive multi-actor accounts.
- * - `role_grant_assign` — spec-level `auth: {role: 'admin'}`; the immediate
- *   consent-free conferral path. The admin-grant-path gate prevents assigning
- *   keeper / daemon-scoped roles via this surface. No holder-propagation — only
- *   admins confer (see participation-gates.md Decision 7).
+ * - `role_grant_assign` — spec-level `auth: {role: 'admin'}` (a **global**
+ *   grant, re-checked in the handler); the immediate consent-free conferral
+ *   path. The admin-grant-path gate prevents assigning keeper / daemon-scoped
+ *   roles via this surface, and a scoped `admin` is refused. No
+ *   holder-propagation — only a global admin confers; holding a role grants
+ *   no power to assign it.
  *
  * Audit events are emitted in-transaction by the query layer (atomic with
  * the role_grant write on accept/revoke) or by the handler via the bound
@@ -45,16 +53,16 @@
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
 import { emit_after_commit } from '../http/pending_effects.js';
-import { builtin_role_specs_by_name, ROLE_ADMIN, role_has_grant_path } from './role_schema.js';
+import { builtin_role_specs_by_name, is_builtin_role, ROLE_ADMIN, role_has_grant_path } from './role_schema.js';
 import { GRANT_PATH_ADMIN } from './grant_path_schema.js';
 import { ROLE_GRANT_OFFER_DEFAULT_TTL_MS, to_role_grant_offer_json } from './role_grant_offer_schema.js';
-import { query_role_grant_offer_create, query_role_grant_offer_decline, query_role_grant_offer_retract, query_role_grant_offer_list, query_role_grant_offer_history_for_account, query_accept_offer, RoleGrantOfferActorAccountMismatchError, RoleGrantOfferActorMismatchError, RoleGrantOfferAlreadyTerminalError, RoleGrantOfferExpiredError, RoleGrantOfferNotFoundError, RoleGrantOfferSelfTargetError } from './role_grant_offer_queries.js';
+import { query_role_grant_offer_create, query_role_grant_offer_decline, query_role_grant_offer_retract, query_role_grant_offer_list, query_role_grant_offer_history_for_account, query_accept_offer, RoleGrantOfferActorAccountMismatchError, RoleGrantOfferActorMismatchError, RoleGrantOfferAlreadyTerminalError, RoleGrantOfferBuiltinRefusedError, RoleGrantOfferExpiredError, RoleGrantOfferNotFoundError, RoleGrantOfferSelfTargetError } from './role_grant_offer_queries.js';
 import { query_create_role_grant, query_role_grant_find_active_role_for_actor, query_revoke_role_grant } from './role_grant_queries.js';
 import { query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { has_scoped_role } from './request_context.js';
 import { build_role_grant_offer_accepted_notification, build_role_grant_offer_declined_notification, build_role_grant_offer_received_notification, build_role_grant_offer_retracted_notification, build_role_grant_offer_supersede_notification, build_role_grant_revoke_notification } from './role_grant_offer_notifications.js';
-import { ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
-import { ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, role_grant_assign_action_spec } from './role_grant_offer_action_specs.js';
+import { ERROR_INSUFFICIENT_PERMISSIONS, ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
+import { ERROR_ROLE_GRANT_BUILTIN_SCOPED, ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, role_grant_assign_action_spec } from './role_grant_offer_action_specs.js';
 // -- Helpers ----------------------------------------------------------------
 /**
  * Fan out a batch of pre-written audit rows to the bound emitter's
@@ -71,13 +79,22 @@ const fan_out_audit_events = (events, audit) => {
         audit.notify(event);
     }
 };
+/**
+ * Whether a grant input binds a builtin role to a scope — refused on every
+ * grant path (see `ERROR_ROLE_GRANT_BUILTIN_SCOPED`).
+ */
+const is_scoped_builtin = (role, scope_id) => scope_id != null && is_builtin_role(role);
+/** The `invalid_params` a scoped builtin-role grant input answers. */
+const builtin_scoped_error = () => jsonrpc_errors.invalid_params('builtin roles are global-only and cannot be scoped', {
+    reason: ERROR_ROLE_GRANT_BUILTIN_SCOPED
+});
 // eslint-disable-next-line @typescript-eslint/require-await
 const default_authorize = async (auth, _input, _deps, _ctx) => {
     // Admin-only conferral: the caller must hold a *global* `admin` grant. Holding
-    // the offered role itself confers no power to offer it (no holder-propagation —
-    // see participation-gates.md Decision 6). The global check (scope_id null) stops
-    // a scoped `admin` escalating into global authority over the offer surface.
-    // Reads the in-memory `auth.role_grants` snapshot; no DB roundtrip.
+    // the offered role itself confers no power to offer it (no holder-propagation).
+    // The global check (scope_id null) stops a scoped `admin` escalating into
+    // global authority over the offer surface. Reads the in-memory
+    // `auth.role_grants` snapshot; no DB roundtrip.
     return has_scoped_role(auth, ROLE_ADMIN, null);
 };
 // -- Action factory ---------------------------------------------------------
@@ -94,11 +111,11 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
     const role_specs = options.roles?.role_specs ?? builtin_role_specs_by_name;
     const default_ttl_ms = options.default_ttl_ms ?? ROLE_GRANT_OFFER_DEFAULT_TTL_MS;
     const authorize = options.authorize ?? default_authorize;
-    // Four denial paths (admin-grant-path gate, authorize, self-target,
-    // actor-account mismatch) all emit the same failure-outcome audit
-    // event. `target_actor_id` is populated when the caller supplied a
-    // `to_actor_id` so failure rows match the success-shape envelope of
-    // actor-targeted offers.
+    // Every denial path (admin-grant-path gate, scoped builtin, builtin without a
+    // global admin, authorize, self-target, actor-account mismatch) emits the
+    // same failure-outcome audit event. `target_actor_id` is populated when the
+    // caller supplied a `to_actor_id` so failure rows match the success-shape
+    // envelope of actor-targeted offers.
     const emit_create_failure_audit = (ctx, auth, input) => {
         audit.emit_role_grant_target(ctx, auth, {
             event_type: 'role_grant_offer_create',
@@ -112,6 +129,46 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             }
         });
     };
+    // Answer (and audit) an accept the query refused as a builtin-role offer that
+    // must not mint. The refusal is a forensic event — someone holds an offer of a
+    // builtin role the spine won't confer — so it is audited as a failed
+    // `role_grant_offer_accept` (pool-routed, surviving the rollback), like
+    // offer-create refusals. Metadata is the success row's shape minus
+    // `role_grant_id` (no grant was minted), plus the wire `reason`. The offer
+    // stays pending. Returns the error the verb answers.
+    const refuse_builtin_accept = (ctx, auth, err) => {
+        let error;
+        switch (err.refusal) {
+            case 'bootstrap_only':
+                // `keeper`'s grant path is bootstrap-only — the offer-create answer
+                // for a role no offer may confer
+                error = jsonrpc_errors.forbidden('role not grantable', {
+                    reason: ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE
+                });
+                break;
+            case 'scoped':
+                error = jsonrpc_errors.invalid_request({ reason: ERROR_ROLE_GRANT_BUILTIN_SCOPED });
+                break;
+            case 'grantor_not_authorized':
+                error = jsonrpc_errors.forbidden("the offer's grantor can no longer confer this role", {
+                    reason: ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED
+                });
+                break;
+        }
+        audit.emit_role_grant_target(ctx, auth, {
+            event_type: 'role_grant_offer_accept',
+            outcome: 'failure',
+            target_account_id: auth.account.id,
+            target_actor_id: auth.actor.id,
+            metadata: {
+                offer_id: err.offer.id,
+                role: err.offer.role,
+                scope_id: err.offer.scope_id,
+                reason: error.data.reason
+            }
+        });
+        return error;
+    };
     // Returns {offer} only — no auto-accept. Recipient must call
     // role_grant_offer_accept; admin tests drive the full consent flow over
     // RPC (see testing/admin_integration.ts `offer_and_accept`), or seed
@@ -126,6 +183,23 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 reason: ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE
             });
         }
+        // Builtin roles are global-only — refused before the injected callback,
+        // so no consumer authorizer can admit a scoped `admin` / `keeper` offer.
+        if (is_scoped_builtin(input.role, input.scope_id)) {
+            emit_create_failure_audit(ctx, auth, input);
+            throw builtin_scoped_error();
+        }
+        // Offering a builtin role is global-admin authority, decided here rather
+        // than by the injected callback: a consumer callback answering by holding
+        // the role (a scope-blind `has_role`) would otherwise let a scoped `admin`
+        // row offer a global `admin` to a second account it controls. Same denial
+        // the default callback gives.
+        if (is_builtin_role(input.role) && !has_scoped_role(auth, ROLE_ADMIN, null)) {
+            emit_create_failure_audit(ctx, auth, input);
+            throw jsonrpc_errors.forbidden('not authorized to offer this role', {
+                reason: ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED
+            });
+        }
         const authorized = await authorize(auth, {
             to_account_id: input.to_account_id,
             role: input.role,
@@ -214,6 +288,9 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                     reason: ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH
                 });
             }
+            if (err instanceof RoleGrantOfferBuiltinRefusedError) {
+                throw refuse_builtin_accept(ctx, auth, err);
+            }
             throw err;
         }
         // Look up the grantor's account_id inside the transaction so the
@@ -448,25 +525,43 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         return { ok: true, revoked: true };
     };
     // The immediate admin-only conferral path — the consent-free sibling of
-    // `role_grant_offer_create`. Admin-gated at the dispatcher (`roles:
-    // ['admin']`), it re-checks admin-grantability (so keeper / CLI-only roles
-    // can't be web-assigned), resolves the target actor, writes the idempotent
-    // grant, and emits a `role_grant_create` audit row — the same event the
-    // offer-accept and self-service paths emit. No WS notification in v1 (the
-    // grantee picks the capability up on its next authenticated request).
+    // `role_grant_offer_create`. Gated at the dispatcher on a **global** admin
+    // (`roles: ['admin']`) and re-checked here, it re-checks admin-grantability
+    // (so keeper / CLI-only roles can't be web-assigned), refuses a scoped
+    // builtin role, resolves the target actor, writes the idempotent grant with
+    // the input's `(scope_kind, scope_id)` pair, and emits a `role_grant_create`
+    // audit row — the same event the offer-accept and self-service paths emit.
+    // No WS notification in v1 (the grantee picks the capability up on its next
+    // authenticated request).
     const assign_handler = async (input, ctx) => {
         const auth = ctx.auth;
+        // Defense in depth behind the dispatcher's role gate: conferring roles is
+        // global-admin authority. A scoped `admin` must never reach the write, or
+        // it could assign itself a global `admin`.
+        if (!has_scoped_role(auth, ROLE_ADMIN, null)) {
+            throw jsonrpc_errors.forbidden('forbidden', { reason: ERROR_INSUFFICIENT_PERMISSIONS });
+        }
         // Admin-grant-path gate — the same registry check the offer/revoke gates
-        // use; keeper / daemon-scoped roles stay CLI-only. Denial is
-        // forensic-audited (`role_grant_id` omitted — no grant was created).
-        if (!role_has_grant_path(role_specs, input.role, GRANT_PATH_ADMIN)) {
+        // use; keeper / daemon-scoped roles stay CLI-only. A builtin role asked
+        // for with a scope is refused the same way, with its own reason: builtin
+        // roles are global-only. Denial is forensic-audited (`role_grant_id`
+        // omitted — no grant was created).
+        const admin_grantable = role_has_grant_path(role_specs, input.role, GRANT_PATH_ADMIN);
+        const builtin_scoped = is_scoped_builtin(input.role, input.scope_id);
+        if (builtin_scoped || !admin_grantable) {
             audit.emit_role_grant_target(ctx, auth, {
                 event_type: 'role_grant_create',
                 outcome: 'failure',
                 target_account_id: input.to_account_id,
                 target_actor_id: input.to_actor_id ?? null,
-                metadata: { role: input.role, scope_id: input.scope_id ?? null }
+                metadata: {
+                    role: input.role,
+                    scope_kind: input.scope_kind ?? null,
+                    scope_id: input.scope_id ?? null
+                }
             });
+            if (builtin_scoped && admin_grantable)
+                throw builtin_scoped_error();
             throw jsonrpc_errors.forbidden('role not web-grantable', {
                 reason: ERROR_ROLE_NOT_WEB_GRANTABLE
             });
@@ -474,9 +569,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         // Resolve the grant's target actor. A supplied `to_actor_id` must be an
         // active actor of `to_account_id`; otherwise the account's sole active
         // actor is used (a multi-actor account must name one). A missing /
-        // actorless account 404-masks. Inlined (not a helper) so the
-        // actor-account-mismatch throw stays in the handler body the
-        // error_reasons drift scan reads.
+        // actorless account 404-masks.
         const actors = await query_active_actors_by_account(ctx, input.to_account_id);
         let target_actor_id;
         if (input.to_actor_id != null) {
@@ -497,12 +590,12 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             throw jsonrpc_errors.invalid_params('to_actor_id is required for a multi-actor account');
         }
         // Idempotent write — re-assigning an already-held grant returns the
-        // existing row. `scope_kind` stays null: `scope_id` alone is the v1
-        // discriminator. `granted_by` is the assigning admin.
+        // existing row. `scope_kind` + `scope_id` land as the pair the input
+        // carried. `granted_by` is the assigning admin.
         const grant = await query_create_role_grant(ctx, {
             actor_id: target_actor_id,
             role: input.role,
-            scope_kind: null,
+            scope_kind: input.scope_kind ?? null,
             scope_id: input.scope_id ?? null,
             granted_by: auth.actor.id
         });
@@ -513,6 +606,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
             metadata: {
                 role: grant.role,
                 role_grant_id: grant.id,
+                scope_kind: input.scope_kind ?? null,
                 scope_id: grant.scope_id
             }
         });

package/dist/auth/role_grant_offer_queries.d.ts

@@ -66,6 +66,35 @@ export declare class RoleGrantOfferSelfTargetError extends Error {
 export declare class RoleGrantOfferActorMismatchError extends Error {
     constructor(offer_id: string);
 }
+/**
+ * Why `query_accept_offer` refused to mint a builtin-role grant.
+ *
+ * Each is a row no current grant path creates but a database can still hold
+ * (a direct `query_role_grant_offer_create` call, or an offer made under a
+ * since-closed path), so accept — the chokepoint where an offer becomes a
+ * `role_grant` — checks them itself.
+ *
+ * - `bootstrap_only` — the offer is of `keeper`, which is bootstrap-only:
+ *   never conferred through an offer, whoever made it.
+ * - `scoped` — the offer binds a builtin role to a scope; builtin roles are
+ *   global-only.
+ * - `grantor_not_authorized` — the grantor no longer holds an active
+ *   **global** `admin` on an active actor of an active account. Conferring a
+ *   builtin role is global-admin authority, so it is re-checked when the
+ *   grant is minted, not only when the offer was made.
+ */
+export type BuiltinOfferRefusal = 'bootstrap_only' | 'scoped' | 'grantor_not_authorized';
+/**
+ * Error thrown by `query_accept_offer` when the offer confers a builtin role
+ * (`admin` / `keeper`) that this accept must not mint — `refusal` names the
+ * rule. Carries the locked (still pending, untouched) offer so the caller can
+ * audit the refusal with the offer's role and scope.
+ */
+export declare class RoleGrantOfferBuiltinRefusedError extends Error {
+    readonly offer: RoleGrantOffer;
+    readonly refusal: BuiltinOfferRefusal;
+    constructor(offer: RoleGrantOffer, refusal: BuiltinOfferRefusal);
+}
 /**
  * Error thrown when `query_role_grant_offer_create` is called with a
  * `to_actor_id` that does not exist or does not belong to `to_account_id`.
@@ -224,6 +253,11 @@ export interface AcceptOfferResult {
  * - `RoleGrantOfferAlreadyTerminalError` — offer is declined, retracted, or
  *   superseded.
  * - `RoleGrantOfferExpiredError` — offer is pending but past `expires_at`.
+ * - `RoleGrantOfferActorMismatchError` — actor-targeted offer, different actor.
+ * - `RoleGrantOfferBuiltinRefusedError` — a builtin-role offer that must not
+ *   mint: `keeper` at all, a builtin bound to a scope, or one whose grantor no
+ *   longer holds an active global `admin` (read under `FOR SHARE`). The offer
+ *   stays pending.
  *
  * Sibling supersede is what closes the "accept a pre-revoke sibling offer
  * to bypass a revoke" path: once A is accepted, B/C/... can no longer be
@@ -236,6 +270,8 @@ export interface AcceptOfferResult {
  * @throws RoleGrantOfferNotFoundError if the offer is missing or belongs to another recipient
  * @throws RoleGrantOfferAlreadyTerminalError if the offer is declined, retracted, or superseded
  * @throws RoleGrantOfferExpiredError if the offer is pending but past `expires_at`
+ * @throws RoleGrantOfferActorMismatchError if the offer is actor-targeted to a different actor
+ * @throws RoleGrantOfferBuiltinRefusedError if a builtin-role offer must not mint (see `BuiltinOfferRefusal`)
  * @throws Error if the accepting `actor_id` does not belong to `to_account_id`, or invariant assertions fail
  */
 export declare const query_accept_offer: (deps: QueryDeps, input: AcceptOfferInput) => Promise<AcceptOfferResult>;

package/dist/auth/role_grant_offer_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD,OAAO,KAAK,EACX,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACxC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACzC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,uCAAwC,SAAQ,KAAK;;CAKjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,cAAc,CAuDxB,CAAC;AAEF,uGAAuG;AACvG,MAAM,WAAW,aAAc,SAAQ,cAAc;IACpD;;;;;OAKG;IACH,eAAe,EAAE,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,EACrB,QAAQ,MAAM,GAAG,IAAI,KACnB,OAAO,CAAC,aAAa,GAAG,IAAI,CAmB9B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,KACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAe/B,CAAC;AA8BF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,eAAe,MAAM,KACnB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAY/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0CAA0C,GACtD,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAW,EACX,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAS/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,cAAc,GAAG,IAAI,CAY/B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,KACb,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAU/B,CAAC;AAEF,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,mGAAmG;IACnG,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,IAAI,CAAC;IACf,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,6HAA6H;AAC7H,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,SAAS,CAAC;IACtB,KAAK,EAAE,cAAc,CAAC;IACtB,oJAAoJ;IACpJ,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1C,yMAAyM;IACzM,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,OAAO,gBAAgB,KACrB,OAAO,CAAC,iBAAiB,CA0N3B,CAAC"}
+{"version":3,"file":"role_grant_offer_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD,OAAO,KAAK,EACX,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACxC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACzC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,wBAAwB,CAAC;AAEzF;;;;;GAKG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAC1B,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB;CAM/D;AAED;;;;;GAKG;AACH,qBAAa,uCAAwC,SAAQ,KAAK;;CAKjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,cAAc,CAuDxB,CAAC;AAEF,uGAAuG;AACvG,MAAM,WAAW,aAAc,SAAQ,cAAc;IACpD;;;;;OAKG;IACH,eAAe,EAAE,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,EACrB,QAAQ,MAAM,GAAG,IAAI,KACnB,OAAO,CAAC,aAAa,GAAG,IAAI,CAmB9B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,KACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAe/B,CAAC;AA8BF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,eAAe,MAAM,KACnB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAY/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0CAA0C,GACtD,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAW,EACX,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAS/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,cAAc,GAAG,IAAI,CAY/B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,KACb,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAU/B,CAAC;AAsCF,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,mGAAmG;IACnG,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,IAAI,CAAC;IACf,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,6HAA6H;AAC7H,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,SAAS,CAAC;IACtB,KAAK,EAAE,cAAc,CAAC;IACtB,oJAAoJ;IACpJ,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1C,yMAAyM;IACzM,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,OAAO,gBAAgB,KACrB,OAAO,CAAC,iBAAiB,CAgP3B,CAAC"}