@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/auth/principal-cache/principal-cache.service.js

@@ -0,0 +1,381 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var PrincipalCache_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrincipalCache = exports.PRINCIPAL_CACHE_CLOCK = exports.PRINCIPAL_CACHE_MAX_ENTRIES = exports.PRINCIPAL_INVALIDATE_CHANNEL = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const ports_1 = require("../../ports");
+const local_event_bus_1 = require("./local-event-bus");
+const principal_cache_config_1 = require("./principal-cache.config");
+const credential_binding_1 = require("../credential-binding");
+// =============================================================================
+// PrincipalCache — short-TTL principals for JWT validation (PP-1.12, #683)
+// =============================================================================
+//
+// Every JWT request used to run a four-level join (user → userRoles → role →
+// rolePermissions → permission) before its controller ran. This cache holds
+// the result of that join for at most `AUTH_PRINCIPAL_CACHE_TTL_SECONDS`
+// (default 30; `0` turns it off), keyed by `(userId, orgId, tokenKind)`
+// (PP-6.4, #724): the active org and the credential kind are part of what a
+// request's principal is, so an entry is never served to a request bound to
+// another org. Invalidation is per USER (`invalidateUser`): it drops every
+// entry of that user, whatever the org or kind.
+//
+// THE SECURITY PROPERTY IT MUST NOT BREAK (docs/SECURITY-ARCHITECTURE.md §1):
+// the database is authoritative for roles and `isActive`, so a role change or
+// a deactivation reaches the very next request. That survives because every
+// code path that changes what a principal resolves to calls `invalidate()`
+// AFTER its write commits:
+//
+//   - locally, synchronously: the entry is gone before `invalidate` returns,
+//     so the next request on THIS replica reads the database again;
+//   - remotely, through the event bus (`auth.principal.invalidate`): every
+//     other replica drops its entry within bus latency;
+//   - and if the bus is down, the TTL is the backstop: a stale entry lives at
+//     most `ttlMs`, far below the 15-minute access-token lifetime.
+//
+// `test/auth/principal-invalidation-sites.spec.ts` fails the build when a new
+// `userRole` / `user.update` write appears in a file that never invalidates.
+//
+// WHAT IS NOT CACHED, deliberately:
+//   - the device-session (`did`) liveness check — it runs on every request, so
+//     `DELETE /api/auth/device/sessions/{id}` stays immediate;
+//   - PAT and node credentials — their token row must be read per request for
+//     revocation and expiry anyway;
+//   - token material of any kind. An entry is the user/role/permission row
+//     graph the join already loaded, nothing more.
+//
+// BOUNDED: at most `PRINCIPAL_CACHE_MAX_ENTRIES`, evicted in insertion order.
+// FROZEN: an entry is a deep-frozen clone, so no request can mutate a
+// principal another request will be handed.
+// RACE-SAFE: see `generation()` — a read that started before an invalidation
+// can never store its (stale) result after it.
+// =============================================================================
+/**
+ * The bus channel every replica listens on. Payload: {@link PrincipalInvalidation}.
+ *
+ * @stability stable
+ */
+exports.PRINCIPAL_INVALIDATE_CHANNEL = 'auth.principal.invalidate';
+/**
+ * The most principals one process holds. Insertion-order eviction past it.
+ *
+ * @stability stable
+ */
+exports.PRINCIPAL_CACHE_MAX_ENTRIES = 10_000;
+/**
+ * Optional DI token for the clock (ms since epoch). Tests inject one; production uses `Date.now`.
+ *
+ * @stability experimental
+ */
+exports.PRINCIPAL_CACHE_CLOCK = Symbol.for('@marinoscar/platform/identity/PRINCIPAL_CACHE_CLOCK');
+/** The map key. NUL separators: none of the three parts can contain one. */
+function keyString(key) {
+    return `${key.userId}\u0000${key.orgId ?? ''}\u0000${key.tokenKind}`;
+}
+/**
+ * A deep copy of a Prisma row graph: plain objects, arrays, `Date`s and
+ * primitives. Anything else (a class instance, a function) throws, and the
+ * caller declines to cache — never true of the join `validateJwtPayload`
+ * runs. Hand-rolled rather than `structuredClone` so a copied `Date` belongs
+ * to the caller's realm (Jest runs specs in a VM context).
+ */
+function deepCopy(value) {
+    if (value === null || typeof value !== 'object') {
+        if (typeof value === 'function' || typeof value === 'symbol') {
+            throw new TypeError('not a plain value');
+        }
+        return value;
+    }
+    if (value instanceof Date) {
+        return new Date(value.getTime());
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => deepCopy(item));
+    }
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) {
+        throw new TypeError('not a plain object');
+    }
+    const copy = {};
+    for (const [key, item] of Object.entries(value)) {
+        copy[key] = deepCopy(item);
+    }
+    return copy;
+}
+function deepFreeze(value) {
+    if (value !== null && typeof value === 'object' && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const key of Object.keys(value)) {
+            deepFreeze(value[key]);
+        }
+    }
+    return value;
+}
+function isInvalidation(payload) {
+    if (!payload || typeof payload !== 'object')
+        return false;
+    const p = payload;
+    return p.all === true || (typeof p.userId === 'string' && p.userId.length > 0);
+}
+/**
+ * Short-TTL cache of validated JWT principals (#683), invalidated across
+ * replicas on the event bus. Every write that changes what a user's token
+ * resolves to calls {@link PrincipalCache.invalidateUser} after it commits; an
+ * app that writes users, roles or memberships itself does the same.
+ *
+ * @stability stable
+ */
+let PrincipalCache = PrincipalCache_1 = class PrincipalCache {
+    now;
+    logger = new common_1.Logger(PrincipalCache_1.name);
+    /** 0 = disabled: `get` always misses and `set` never stores. */
+    ttlMs;
+    entries = new Map();
+    /** userId → the keys of its entries, so `invalidateUser` drops them all. */
+    keysByUser = new Map();
+    // ---------------------------------------------------------------------------
+    // Generations (the in-flight read race)
+    // ---------------------------------------------------------------------------
+    // A request that started its database read BEFORE an invalidation could
+    // otherwise `set()` the pre-change principal AFTER it, re-poisoning the
+    // cache for a whole TTL. So every invalidation moves a counter, the reader
+    // captures `generation(userId)` before it reads, and `set()` refuses when
+    // the value has moved since.
+    //
+    // One monotonic counter serves both scopes: a per-user invalidation stamps
+    // that user with a fresh value, an `all` invalidation stamps the epoch (and
+    // forgets the per-user stamps, which the new epoch outranks). A user's
+    // generation is the larger of the two, so it changes whenever ANY
+    // invalidation that covers the user happens.
+    counter = 0;
+    epoch = 0;
+    generations = new Map();
+    hits = 0;
+    misses = 0;
+    invalidations = 0;
+    unsubscribe = null;
+    /** The process's bus; a private in-process one only in a graph without the host core's `EVENT_BUS`. */
+    bus;
+    constructor(config, bus, now = Date.now) {
+        this.now = now;
+        this.bus = bus ?? new local_event_bus_1.LocalIdentityEventBus();
+        const seconds = config.get('auth.principalCacheTtlSeconds');
+        const ttlSeconds = typeof seconds === 'number' && Number.isSafeInteger(seconds) && seconds >= 0
+            ? seconds
+            : principal_cache_config_1.DEFAULT_PRINCIPAL_CACHE_TTL_SECONDS;
+        this.ttlMs = ttlSeconds * 1000;
+    }
+    /** Whether the cache stores anything at all. */
+    get enabled() {
+        return this.ttlMs > 0;
+    }
+    /** Subscribes to {@link PRINCIPAL_INVALIDATE_CHANNEL}. */
+    onModuleInit() {
+        this.logger.debug(this.enabled
+            ? `JWT principal cache enabled: TTL ${this.ttlMs / 1000}s, at most ${exports.PRINCIPAL_CACHE_MAX_ENTRIES} entries, ` +
+                `invalidated on "${exports.PRINCIPAL_INVALIDATE_CHANNEL}" (${this.bus.adapter} bus)`
+            : 'JWT principal cache disabled (AUTH_PRINCIPAL_CACHE_TTL_SECONDS=0)');
+        if (this.unsubscribe)
+            return;
+        // Subscribed even when disabled: it costs nothing, and keeps the
+        // generation counter moving so a mixed-TTL fleet mid-rollout stays safe.
+        this.unsubscribe = this.bus.subscribe(exports.PRINCIPAL_INVALIDATE_CHANNEL, (payload, meta) => {
+            // Local deliveries were already applied synchronously by `invalidate`.
+            if (meta.local)
+                return;
+            if (!isInvalidation(payload)) {
+                this.logger.warn(`Ignoring a malformed message on "${exports.PRINCIPAL_INVALIDATE_CHANNEL}"`);
+                return;
+            }
+            this.drop(payload);
+        });
+    }
+    /** Unsubscribes and drops every entry. */
+    onModuleDestroy() {
+        this.unsubscribe?.();
+        this.unsubscribe = null;
+        this.entries.clear();
+        this.keysByUser.clear();
+    }
+    /** A key of `userId`'s entries: a live one first, else any (so `get` expires it). */
+    anyKeyOf(userId) {
+        const keys = [...(this.keysByUser.get(userId) ?? [])];
+        const now = this.now();
+        return keys.find((id) => (this.entries.get(id)?.expiresAt ?? 0) > now) ?? keys[0];
+    }
+    /** Removes one entry and its index slot. */
+    deleteEntry(id) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            return;
+        this.entries.delete(id);
+        const keys = this.keysByUser.get(entry.userId);
+        keys?.delete(id);
+        if (keys && keys.size === 0)
+            this.keysByUser.delete(entry.userId);
+    }
+    /**
+     * The cached principal, or `undefined` when absent, expired or disabled.
+     *
+     * With a bare user id (diagnostics and tests): any live entry of that user,
+     * whatever its org or credential kind. Request paths always pass the full
+     * {@link PrincipalCacheKey}.
+     */
+    get(key) {
+        if (!this.enabled)
+            return undefined;
+        const id = typeof key === 'string' ? this.anyKeyOf(key) : keyString(key);
+        const entry = id === undefined ? undefined : this.entries.get(id);
+        if (!entry) {
+            this.misses += 1;
+            return undefined;
+        }
+        if (entry.expiresAt <= this.now()) {
+            this.deleteEntry(id);
+            this.misses += 1;
+            return undefined;
+        }
+        this.hits += 1;
+        return entry.value;
+    }
+    /**
+     * The value to capture BEFORE reading the database for `userId`, and to
+     * hand back to {@link set}. Moves whenever an invalidation covering
+     * `userId` happens, locally or from another replica.
+     */
+    generation(userId) {
+        return Math.max(this.epoch, this.generations.get(userId) ?? 0);
+    }
+    /**
+     * Stores a deep-frozen copy of `value`, BOUND to the key (#724: its
+     * `activeOrgId` is `key.orgId` when that is set, its `tokenKind` is
+     * `key.tokenKind`; see `credential-binding.ts`), and returns it — unless
+     * the cache is disabled, or `expectedGeneration` is no longer current (an
+     * invalidation happened while the caller was reading), in which case
+     * nothing is stored and `undefined` is returned. Never throws.
+     */
+    set(key, value, expectedGeneration) {
+        if (!this.enabled)
+            return undefined;
+        const { userId } = key;
+        if (this.generation(userId) !== expectedGeneration)
+            return undefined;
+        let frozen;
+        try {
+            frozen = deepFreeze((0, credential_binding_1.stampCredential)(deepCopy(value), {
+                activeOrgId: key.orgId ?? undefined,
+                tokenKind: key.tokenKind,
+            }));
+        }
+        catch {
+            // Not cloneable (never true of a Prisma row graph). Do not cache it.
+            return undefined;
+        }
+        // Re-insert so a refreshed key moves to the back of the eviction order.
+        const id = keyString(key);
+        this.entries.delete(id);
+        this.entries.set(id, { userId, value: frozen, expiresAt: this.now() + this.ttlMs });
+        let keys = this.keysByUser.get(userId);
+        if (!keys) {
+            keys = new Set();
+            this.keysByUser.set(userId, keys);
+        }
+        keys.add(id);
+        while (this.entries.size > exports.PRINCIPAL_CACHE_MAX_ENTRIES) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.deleteEntry(oldest);
+        }
+        return frozen;
+    }
+    /**
+     * Drops every entry of `userId` (every org, every credential kind) here and
+     * on every other replica: {@link invalidate} with `{ userId }`. The one call
+     * the principal-changing writes make (#724), after their transaction
+     * commits: membership create, delete, status or role change; system role
+     * change; user deactivation; PAT revoke; device-session revoke. Never throws.
+     */
+    invalidateUser(userId) {
+        this.invalidate({ userId });
+    }
+    /**
+     * Drops the entry (or every entry) in THIS process synchronously, then
+     * publishes the same invalidation to every other replica. Call it after
+     * the write commits, outside any `$transaction`. Never throws.
+     */
+    invalidate(target) {
+        try {
+            this.drop(target);
+        }
+        catch (error) {
+            // `drop` only touches Maps; this is belt and braces for "never throws".
+            this.logger.error(`Principal cache invalidation failed locally: ${String(error)}`);
+        }
+        try {
+            // `publish` never rejects (bus rule 5); the catch is for a bus that breaks it.
+            this.bus.publish(exports.PRINCIPAL_INVALIDATE_CHANNEL, target).catch(() => undefined);
+        }
+        catch {
+            // Same: a synchronous throw from a misbehaving adapter never reaches the caller.
+        }
+    }
+    /** The health of the bus invalidations travel on. Synchronous, no I/O. */
+    busHealth() {
+        return this.bus.health();
+    }
+    /** A synchronous snapshot for the Doctor. No I/O. */
+    stats() {
+        return {
+            size: this.entries.size,
+            hits: this.hits,
+            misses: this.misses,
+            invalidations: this.invalidations,
+        };
+    }
+    drop(target) {
+        this.invalidations += 1;
+        this.counter += 1;
+        if ('all' in target) {
+            this.epoch = this.counter;
+            this.generations.clear();
+            this.entries.clear();
+            this.keysByUser.clear();
+            return;
+        }
+        for (const id of this.keysByUser.get(target.userId) ?? [])
+            this.entries.delete(id);
+        this.keysByUser.delete(target.userId);
+        this.generations.delete(target.userId);
+        this.generations.set(target.userId, this.counter);
+        // Bound the stamp map too. Advancing the epoch instead is conservative:
+        // it only makes in-flight reads skip storing, never keeps a stale entry.
+        if (this.generations.size > exports.PRINCIPAL_CACHE_MAX_ENTRIES) {
+            this.epoch = this.counter;
+            this.generations.clear();
+        }
+    }
+};
+exports.PrincipalCache = PrincipalCache;
+exports.PrincipalCache = PrincipalCache = PrincipalCache_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(ports_1.IDENTITY_EVENT_BUS)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(exports.PRINCIPAL_CACHE_CLOCK)),
+    __metadata("design:paramtypes", [config_1.ConfigService, Object, Function])
+], PrincipalCache);
+//# sourceMappingURL=principal-cache.service.js.map

package/dist/identity/auth/principal-cache/principal-cache.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-cache.service.js","sourceRoot":"","sources":["../../../../src/identity/auth/principal-cache/principal-cache.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,2CAA+C;AAG/C,uCAKqB;AACrB,uDAA0D;AAE1D,qEAA+E;AAC/E,8DAAwD;AAExD,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,gDAAgD;AAChD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2BAA2B;AAC3B,EAAE;AACF,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,wDAAwD;AACxD,8EAA8E;AAC9E,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,oCAAoC;AACpC,+EAA+E;AAC/E,+DAA+D;AAC/D,8EAA8E;AAC9E,oCAAoC;AACpC,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,sEAAsE;AACtE,4CAA4C;AAC5C,6EAA6E;AAC7E,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;GAIG;AACU,QAAA,4BAA4B,GAAG,2BAA2B,CAAC;AAExE;;;;GAIG;AACU,QAAA,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;GAIG;AACU,QAAA,qBAAqB,GAAkB,MAAM,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;AAoCtH,4EAA4E;AAC5E,SAAS,SAAS,CAAC,GAAsB;IACvC,OAAO,GAAG,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,SAAS,GAAG,CAAC,SAAS,EAAE,CAAC;AACvE,CAAC;AAwBD;;;;;;GAMG;AACH,SAAS,QAAQ,CAAI,KAAQ;IAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAM,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAM,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,EAAE,CAAC;YAC/C,UAAU,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,OAAgB;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AAEI,IAAM,cAAc,sBAApB,MAAM,cAAc;IA6CqC;IA5C7C,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAE1D,gEAAgE;IACvD,KAAK,CAAS;IAEN,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEpD,4EAA4E;IAC3D,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE7D,8EAA8E;IAC9E,wCAAwC;IACxC,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,6BAA6B;IAC7B,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,kEAAkE;IAClE,6CAA6C;IACrC,OAAO,GAAG,CAAC,CAAC;IACZ,KAAK,GAAG,CAAC,CAAC;IACD,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,IAAI,GAAG,CAAC,CAAC;IACT,MAAM,GAAG,CAAC,CAAC;IACX,aAAa,GAAG,CAAC,CAAC;IAElB,WAAW,GAAwB,IAAI,CAAC;IAEhD,uGAAuG;IACtF,GAAG,CAAW;IAE/B,YACE,MAAqB,EAKmB,GAAc,EACM,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;QAExF,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,IAAI,uCAAqB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAS,+BAA+B,CAAC,CAAC;QACpE,MAAM,UAAU,GACd,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YAC1E,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,4DAAmC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;IACjC,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,0DAA0D;IAC1D,YAAY;QACV,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,IAAI,CAAC,OAAO;YACV,CAAC,CAAC,oCAAoC,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,mCAA2B,YAAY;gBACxG,mBAAmB,oCAA4B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,OAAO;YAChF,CAAC,CAAC,mEAAmE,CACxE,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,iEAAiE;QACjE,yEAAyE;QACzE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CACnC,oCAA4B,EAC5B,CAAC,OAAgB,EAAE,IAAkB,EAAE,EAAE;YACvC,uEAAuE;YACvE,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO;YACvB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,oCAA4B,GAAG,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,eAAe;QACb,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,qFAAqF;IAC7E,QAAQ,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,4CAA4C;IACpC,WAAW,CAAC,EAAU;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjB,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,GAA+B;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,EAAE,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,EAAG,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACf,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;OAOG;IACH,GAAG,CAAC,GAAsB,EAAE,KAAwB,EAAE,kBAA0B;QAC9E,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,kBAAkB;YAAE,OAAO,SAAS,CAAC;QAErE,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,UAAU,CACjB,IAAA,oCAAe,EAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAC/B,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;gBACnC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEb,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,mCAA2B,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc;QAC3B,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,MAA6B;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC;YACH,+EAA+E;YAC/E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oCAA4B,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,iFAAiF;QACnF,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,qDAAqD;IACrD,KAAK;QACH,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAEO,IAAI,CAAC,MAA6B;QACxC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAElB,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;YAC1B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAElD,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,mCAA2B,EAAE,CAAC;YACxD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;YAC1B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;CACF,CAAA;AA1QY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IA6CR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;IACtC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,6BAAqB,CAAC,CAAA;qCANlC,sBAAa;GAvCZ,cAAc,CA0Q1B"}

package/dist/identity/auth/principal.factory.d.ts

@@ -0,0 +1,191 @@
+import type { BuiltinCredentialKind, CredentialKind, NodePrincipal, Principal, TenancyMode, UserPrincipal } from '../../core/index';
+/**
+ * What every credential path loads with the user: system roles with their
+ * permissions, and every membership with its organization's default flag and
+ * its org role's permissions. Shared by `AuthService.validateJwtPayload`,
+ * `PatService.resolveToken` and `NodeCredentialService.validateToken`; one
+ * extra join per authenticated request, absorbed by the principal cache on
+ * the JWT path.
+ *
+ * @internal
+ */
+export declare const PRINCIPAL_USER_INCLUDE: {
+    readonly userRoles: {
+        readonly include: {
+            readonly role: {
+                readonly include: {
+                    readonly rolePermissions: {
+                        readonly include: {
+                            readonly permission: true;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    readonly memberships: {
+        readonly include: {
+            readonly org: {
+                readonly select: {
+                    readonly id: true;
+                    readonly isDefault: true;
+                };
+            };
+            readonly role: {
+                readonly include: {
+                    readonly rolePermissions: {
+                        readonly include: {
+                            readonly permission: true;
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * A role as the factory reads it. `rolePermissions` may be absent where only names are loaded.
+ *
+ * @internal
+ */
+export interface PrincipalRole {
+    name: string;
+    rolePermissions?: ReadonlyArray<{
+        permission: {
+            name: string;
+        };
+    }>;
+}
+/**
+ * A membership as the factory reads it.
+ *
+ * @internal
+ */
+export interface PrincipalMembership {
+    orgId: string;
+    status: 'active' | 'suspended';
+    lastActiveAt: Date | null;
+    createdAt?: Date;
+    org?: {
+        id: string;
+        isDefault: boolean;
+    } | null;
+    role: PrincipalRole;
+}
+/**
+ * The part of a loaded user the factory reads. `memberships` absent means none were loaded.
+ *
+ * @internal
+ */
+export interface PrincipalSource {
+    userRoles: ReadonlyArray<{
+        role: PrincipalRole;
+    }>;
+    memberships?: ReadonlyArray<PrincipalMembership>;
+    /**
+     * The org the credential is bound to (#724): a string for a user
+     * credential, `null` for a system-scoped node credential, absent when the
+     * graph was loaded outside a request (the sign-in rule then picks it).
+     */
+    activeOrgId?: string | null;
+}
+/**
+ * The effective access of one user, in one tenancy mode.
+ *
+ * @internal
+ */
+export interface EffectiveAccess {
+    /** Names of the roles held in `user_roles` (system roles). */
+    systemRoles: string[];
+    /** The membership of the current organization, or `null` (none, or suspended). */
+    membership: PrincipalMembership | null;
+    /** The org role on that membership, or `null`. */
+    orgRole: string | null;
+    /** System role names, then the org role name, deduplicated. */
+    roles: string[];
+    /** Effective permission strings, deduplicated, system grants first. */
+    permissions: string[];
+}
+/**
+ * The membership whose role counts: see the file header for the rule.
+ *
+ * @param activeOrgId - the org the credential is bound to: a string selects
+ *   that org's membership, `null` selects none (system-scoped), `undefined`
+ *   applies the sign-in rule for `mode`.
+ * @returns the membership, or `null` when there is none or it is suspended.
+ *
+ * @internal
+ */
+export declare function selectCurrentMembership(memberships: ReadonlyArray<PrincipalMembership> | undefined, mode: TenancyMode, activeOrgId?: string | null): PrincipalMembership | null;
+/**
+ * The effective roles and permissions of a loaded user. Pure.
+ *
+ * @param user - loaded with {@link PRINCIPAL_USER_INCLUDE} (or a narrower graph).
+ * @param mode - the deployment's tenancy mode.
+ *
+ * @internal
+ */
+export declare function resolveEffectiveAccess(user: PrincipalSource, mode: TenancyMode): EffectiveAccess;
+/**
+ * Builds effective access and `Principal` values (the #687 contract) from a
+ * loaded user. Stateless; the tenancy mode is read per call. Injectable for
+ * services, and available as {@link principalFactory} for the pure call sites
+ * (`toRequestUser` in the guards).
+ *
+ * @internal
+ */
+export declare class PrincipalFactory {
+    /** The tenancy mode the current-org rule uses (recorded by `TenancyService` at startup). */
+    mode(): TenancyMode;
+    /** Effective roles and permissions; see {@link resolveEffectiveAccess}. */
+    access(user: PrincipalSource): EffectiveAccess;
+    /**
+     * A `UserPrincipal` for a human caller (#724). `activeOrgId` is the org the
+     * credential is bound to (or, for a graph without one, the sign-in rule's
+     * pick); `roles` carries the system role names plus that org's role name;
+     * `memberships` every membership, suspended ones included, with its org
+     * role and status; `groups` is empty until groups exist (PP-7).
+     */
+    forUser(user: PrincipalSource & {
+        id: string;
+        email: string;
+    }, credential: Exclude<BuiltinCredentialKind, 'node'>): UserPrincipal;
+    /**
+     * A `NodePrincipal`: system-scoped (ADR 0001, #724). No active
+     * organization, so only the owning user's SYSTEM grants count; no org role
+     * contributes, whatever `user.activeOrgId` says.
+     */
+    forNode(user: PrincipalSource & {
+        id: string;
+        email: string;
+    }, nodeId?: string): NodePrincipal;
+}
+/**
+ * The shared, stateless instance for call sites without dependency injection.
+ *
+ * @internal
+ */
+export declare const principalFactory: PrincipalFactory;
+/**
+ * The runtime mapper ADR 0001 specifies (#724): the request's `Principal`
+ * from the loaded user graph and the credential kind `JwtAuthGuard` admitted
+ * it with. A node credential yields a system-scoped `NodePrincipal` (no
+ * `activeOrgId`); every other kind a `UserPrincipal` bound to
+ * `user.activeOrgId`.
+ *
+ * DEFAULT DENY (PP-14.14). The credential kind must be registered
+ * (`registerCredentialKind`) and map to the `user` principal kind (or be the
+ * platform's own `node`); anything else is refused with a 401 and the reason
+ * is not echoed. A custom credential kind therefore never becomes a
+ * `NodePrincipal`, and an unregistered one never becomes any principal.
+ *
+ * @throws UnauthorizedException for an unregistered credential kind, or one
+ *   whose principal kind has no factory here (an app builds that principal itself).
+ *
+ * @internal
+ */
+export declare function toPrincipal(user: PrincipalSource & {
+    id: string;
+    email: string;
+}, credential: CredentialKind, nodeId?: string): Principal;
+//# sourceMappingURL=principal.factory.d.ts.map

package/dist/identity/auth/principal.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.factory.d.ts","sourceRoot":"","sources":["../../../src/identity/auth/principal.factory.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,aAAa,EAEb,SAAS,EACT,WAAW,EACX,aAAa,EACd,MAAM,kBAAkB,CAAC;AAS1B;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQzB,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,aAAa,CAAC;QAAE,UAAU,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACnE;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC/B,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD,IAAI,EAAE,aAAa,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAClD,WAAW,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kFAAkF;IAClF,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvC,kDAAkD;IAClD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAUD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAAG,SAAS,EAC3D,IAAI,EAAE,WAAW,EACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,mBAAmB,GAAG,IAAI,CAa5B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,eAAe,CAchG;AAED;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAC3B,4FAA4F;IAC5F,IAAI,IAAI,WAAW;IAInB,2EAA2E;IAC3E,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe;IAI9C;;;;;;OAMG;IACH,OAAO,CACL,IAAI,EAAE,eAAe,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EACrD,UAAU,EAAE,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,GACjD,aAAa;IAiBhB;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa;CAY/F;AAUD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,kBAAyB,CAAC;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACrD,UAAU,EAAE,cAAc,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,SAAS,CAgBX"}