@portaidentity/server 1.7.0

package/dist/routes/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,WAAW,MAAM,qBAAqB,CAAC;AAEnD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,qBAAqB,CAAC;SAC5B,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACjD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,qBAAqB,CAAC;SAC5B,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACjD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACpD,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;SAC3E,OAAO,CAAC,YAAY,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;SAC3E,OAAO,CAAC,YAAY,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAChD,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAE/E,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;gBACxC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAChC,GAAG,IAAI;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5E,IAAI,CAAC;YACH,oEAAoE;YACpE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC;oBAC/C,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;oBAChC,GAAG,KAAK;iBACT,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,yDAAyD;YACzD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC;gBACvD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBAChC,GAAG,KAAK;aACT,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,UAAU,EACV,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACjC,OAAO,CAAC,yCAAyC;QACnD,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,UAAU,EACV,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,6EAA6E;YAC7E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;gBAAE,OAAO;YAC1F,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACpE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,6CAA6C;IAC7C,oDAAoD;IACpD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,uCAAuC;IACvC,kDAAkD;IAClD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,2CAA2C;IAC3C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,iCAAiC;IACjC,+CAA+C;IAC/C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,eAAe,EACf,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,wCAAwC;IACxC,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,mBAAmB,EACnB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,sDAAsD;IACtD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,sDAAsD;IACtD,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,iBAAiB,EACjB,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,qDAAqD;IACrD,EAAE;IACF,oDAAoD;IACpD,iEAAiE;IACjE,+CAA+C;IAC/C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,2DAA2D;QAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,WAAW,GAAI,GAAG,CAAC,OAAO,CAAC,IAA4C,EAAE,YAAY,CAAC;QAC5F,IAAI,aAAa,KAAK,MAAM,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,6BAA6B;gBACpC,OAAO,EAAE,2EAA2E;aACrF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,2CAA2C;YAC3C,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAEnD,2DAA2D;YAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,QAAQ,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;gBACjE,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,6CAA6C;IAC7C,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,KAA+B,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE;YAC/D,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9C,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,eAAe,EAAE,UAAU,IAAI,SAAS;SACzC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IACpB,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,2DAA2D;IAC3D,EAAE;IACF,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,2CAA2C;IAC3C,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAK3B,CAAC;YAEF,iDAAiD;YACjD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,wEAAwE;YACxE,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC9C,MAAM,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/D,CAAC;YAED,0BAA0B;YAC1B,IAAI,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC;oBAClC,cAAc,EAAE,KAAK;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YAED,kEAAkE;YAClE,MAAM,oBAAoB,CAAC,mBAAmB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAEzD,kCAAkC;YAClC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;YAE3E,6BAA6B;YAC7B,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS;gBACrC,CAAC,CAAC,SAAS,CAAC,UAAU;oBACpB,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE;oBAClD,CAAC,CAAC,SAAS,CAAC,SAAS;gBACvB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC;YAEjC,4CAA4C;YAC5C,MAAM,OAAO,GAA4B,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,eAAe;gBAAE,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YACzE,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM;gBAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACnD,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM;gBAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACtD,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;YAElC,MAAM,qBAAqB,CACzB,IAAI,CAAC,EAAE,EACP,IAAI,EACJ,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAChD,SAAS,CAAC,EAAE,CACb,CAAC;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,uBAAuB,SAAS,EAAE,CAAC;YAExF,4BAA4B;YAC5B,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,eAAe;gBAAE,YAAY,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC9E,YAAY,CAAC,WAAW,GAAG,WAAW,CAAC;YAEvC,MAAM,mBAAmB,CAAC,GAAG,EAAE,CAC7B,mBAAmB,CACjB;gBACE,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EACD;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C,EACD,SAAS,EACT,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,aAAa,IAAI,IAAI,EACxC,YAAY,CACb,CACF,CAAC;YAEF,2BAA2B;YAC3B,aAAa,CAAC;gBACZ,cAAc,EAAE,KAAK;gBACrB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,SAAS,CAAC,EAAE;gBACrB,SAAS,EAAE,cAAc;gBACzB,aAAa,EAAE,OAAO;gBACtB,WAAW,EAAE,yBAAyB;gBACtC,QAAQ,EAAE;oBACR,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe;oBAC1C,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;oBACzC,iBAAiB,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;iBAC5C;aACF,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACjC,GAAG,CAAC,IAAI,GAAG;gBACT,IAAI,EAAE;oBACJ,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO;oBACP,cAAc,EAAE,IAAI;oBACpB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;iBACnC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,kEAAkE;IAClE,EAAE;IACF,wEAAwE;IACxE,2DAA2D;IAC3D,4EAA4E;IAC5E,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAK3B,CAAC;YAEF,wCAAwC;YACxC,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,6BAA6B;YAC7B,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS;gBACrC,CAAC,CAAC,SAAS,CAAC,UAAU;oBACpB,CAAC,CAAC,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE;oBAClD,CAAC,CAAC,SAAS,CAAC,SAAS;gBACvB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC;YAEjC,oCAAoC;YACpC,MAAM,WAAW,GAAG;gBAClB,EAAE,EAAE,sCAAsC;gBAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;aACpC,CAAC;YAEF,gDAAgD;YAChD,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,eAAe;gBAAE,YAAY,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC9E,YAAY,CAAC,WAAW,GAAG,WAAW,CAAC;YAEvC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,WAAW,EACX;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C;YACD,+EAA+E;YAC/E,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,mCAAmC,EAEtE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,aAAa,IAAI,IAAI,EACxC,YAAY,CACb,CAAC;YAEF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAC1B,CAAC,CACH;SACA,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACpC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;KACnB,CAAC,CACH;SACA,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAAa,EACb,KAAwD,EACxD,MAAoF;IAEpF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IACnD,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpD,+CAA+C;IAC/C,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC,yEAAyE,EACzE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAC5B,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAiB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,iCAAiC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,4DAA4D,EAC5D,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAClC,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,6BAA6B,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,wEAAwE,EACxE,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,CAC/C,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CACT,oBAAoB,KAAK,CAAC,iBAAiB,6BAA6B,KAAK,CAAC,aAAa,EAAE,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,GAAkC,CAAC,MAAM,GAAG,GAAG,CAAC;QACjD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE1D,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,gCAAgC;IAChC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;gBAAE,OAAO;YAC1F,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACpE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpD,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,iEAAiE;IACjE,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,oEAAoE;IACpE,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,uCAAuC;IACvC,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,2CAA2C;IAC3C,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EACjD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,iCAAiC;IACjC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5F,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9F,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4CAA4C;IAC5C,MAAM,CAAC,MAAM,CACX,mBAAmB,EACnB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,sDAAsD;IACtD,MAAM,CAAC,IAAI,CACT,uBAAuB,EACvB,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,+CAA+C;IAC/C,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/security/decision-context.d.ts

@@ -0,0 +1,52 @@
+/** Request-local collection and exactly-once emission of terminal security decisions. */
+import type { Context } from 'koa';
+import { type SecurityDecisionEvent, type SecurityDecisionReasonCode, type SecurityReferenceDomain } from './decision-event.js';
+/** Typed normalized facts supplied by a decision boundary. */
+export interface SecurityDecisionFact {
+    /** Boundary which made the decision. */
+    readonly decisionPoint: SecurityDecisionEvent['decisionPoint'];
+    /** Closed reason. */
+    readonly reasonCode: SecurityDecisionReasonCode;
+    /** Explicit outcome when status alone is insufficient. */
+    readonly outcome?: SecurityDecisionEvent['outcome'];
+    /** Optional closed detail. */
+    readonly detail?: SecurityDecisionEvent['detail'];
+}
+/** Mutable request-local state; raw identifiers never leave finalization. */
+interface SecurityDecisionRequestState {
+    readonly requestId: string;
+    fact?: SecurityDecisionFact;
+    readonly identifiers: Partial<Record<SecurityReferenceDomain, string>>;
+    emitted: boolean;
+}
+/** Sink invoked after strict event validation. */
+export type SecurityDecisionSink = (event: SecurityDecisionEvent) => void | Promise<void>;
+declare module 'koa' {
+    interface DefaultState {
+        /** Internal normalized terminal-decision state. */
+        securityDecision?: SecurityDecisionRequestState;
+    }
+}
+/** Create request-local decision state before body parsing or authentication. */
+export declare function initializeSecurityDecision(ctx: Context, requestId: string): void;
+/** Record a typed terminal fact without accepting raw diagnostics. */
+export declare function recordSecurityDecision(ctx: Context, fact: SecurityDecisionFact): void;
+/** Retain one raw identifier only in request-local memory for protected-reference derivation. */
+export declare function recordSecurityReference(ctx: Context, domain: SecurityReferenceDomain, rawIdentifier: string): void;
+/** Return a registered route template without falling back to the raw request path. */
+export declare function normalizedRouteTemplate(ctx: Context): string;
+/** Read the bounded emergency sink-failure counter for operational monitoring. */
+export declare function getSecurityDecisionSinkFailureCount(): number;
+/** Increment the bounded fallback counter when a non-Koa decision sink fails. */
+export declare function recordSecurityDecisionSinkFailure(): void;
+/** Default structured sink used by production request finalization. */
+export declare const logSecurityDecision: SecurityDecisionSink;
+/**
+ * Validate and emit one terminal event.
+ *
+ * Sink failure never changes a denial or other public response. The only fallback is a bounded
+ * in-memory counter; raw event material is not copied into a secondary log message.
+ */
+export declare function finalizeSecurityDecision(ctx: Context, sink?: SecurityDecisionSink): Promise<SecurityDecisionEvent | null>;
+export {};
+//# sourceMappingURL=decision-context.d.ts.map

package/dist/security/decision-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-context.d.ts","sourceRoot":"","sources":["../../src/security/decision-context.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAGnC,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAE7B,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC/D,qBAAqB;IACrB,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACpD,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;CACnD;AAED,6EAA6E;AAC7E,UAAU,4BAA4B;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,kDAAkD;AAClD,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI1F,OAAO,QAAQ,KAAK,CAAC;IACnB,UAAU,YAAY;QACpB,mDAAmD;QACnD,gBAAgB,CAAC,EAAE,4BAA4B,CAAC;KACjD;CACF;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAIrF;AAED,iGAAiG;AACjG,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,uBAAuB,EAC/B,aAAa,EAAE,MAAM,GACpB,IAAI,CAIN;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAa5D;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,IAAI,MAAM,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAED,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAE,oBAEjC,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,oBAA0C,GAC/C,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CA+CvC"}

package/dist/security/decision-context.js

@@ -0,0 +1,150 @@
+/** Request-local collection and exactly-once emission of terminal security decisions. */
+import { config } from '../config/index.js';
+import { logger } from '../lib/logger.js';
+import { createSecurityDecisionEvent, SECURITY_REFERENCE_DOMAINS, SecurityReferenceProtector, } from './decision-event.js';
+let emergencySinkFailureCount = 0;
+/** Create request-local decision state before body parsing or authentication. */
+export function initializeSecurityDecision(ctx, requestId) {
+    ctx.state.securityDecision = { requestId, identifiers: {}, emitted: false };
+}
+/** Record a typed terminal fact without accepting raw diagnostics. */
+export function recordSecurityDecision(ctx, fact) {
+    const state = ctx.state?.securityDecision;
+    if (!state || state.emitted)
+        return;
+    state.fact = fact;
+}
+/** Retain one raw identifier only in request-local memory for protected-reference derivation. */
+export function recordSecurityReference(ctx, domain, rawIdentifier) {
+    const state = ctx.state?.securityDecision;
+    if (!state || state.emitted || rawIdentifier.length === 0 || rawIdentifier.length > 512)
+        return;
+    state.identifiers[domain] = rawIdentifier;
+}
+/** Return a registered route template without falling back to the raw request path. */
+export function normalizedRouteTemplate(ctx) {
+    const matched = Reflect.get(ctx, '_matchedRoute');
+    if (typeof matched === 'string' &&
+        /^\/[A-Za-z0-9:_/*.-]+$/.test(matched) &&
+        !matched.includes('..') &&
+        !matched.includes('//')) {
+        return matched;
+    }
+    if (ctx.path.startsWith('/api/admin'))
+        return '/api/admin/unmatched';
+    if (ctx.path.includes('/auth/'))
+        return '/:organization/auth/unmatched';
+    return '/unmatched';
+}
+/** Read the bounded emergency sink-failure counter for operational monitoring. */
+export function getSecurityDecisionSinkFailureCount() {
+    return emergencySinkFailureCount;
+}
+/** Increment the bounded fallback counter when a non-Koa decision sink fails. */
+export function recordSecurityDecisionSinkFailure() {
+    emergencySinkFailureCount = Math.min(Number.MAX_SAFE_INTEGER, emergencySinkFailureCount + 1);
+}
+/** Default structured sink used by production request finalization. */
+export const logSecurityDecision = (event) => {
+    logger.info({ securityDecision: event }, event.eventName);
+};
+/**
+ * Validate and emit one terminal event.
+ *
+ * Sink failure never changes a denial or other public response. The only fallback is a bounded
+ * in-memory counter; raw event material is not copied into a secondary log message.
+ */
+export async function finalizeSecurityDecision(ctx, sink = logSecurityDecision) {
+    const state = ctx.state?.securityDecision;
+    if (!state || state.emitted)
+        return null;
+    state.emitted = true;
+    const surface = ctx.path.startsWith('/api/admin')
+        ? 'admin-api'
+        : ctx.path.includes('/auth/')
+            ? 'public-auth'
+            : null;
+    if (surface === null)
+        return null;
+    const status = ctx.status;
+    const fact = state.fact ?? fallbackDecisionFact(status);
+    const references = {};
+    const populatedDomains = SECURITY_REFERENCE_DOMAINS.filter((domain) => state.identifiers[domain] !== undefined);
+    let referenceKeyId;
+    if (populatedDomains.length > 0) {
+        const protector = new SecurityReferenceProtector(config.cookieKeys);
+        referenceKeyId = protector.activeKeyId;
+        for (const domain of populatedDomains) {
+            const rawIdentifier = state.identifiers[domain];
+            if (rawIdentifier !== undefined)
+                references[domain] = protector.protect(domain, rawIdentifier);
+        }
+    }
+    const event = createSecurityDecisionEvent({
+        requestId: state.requestId,
+        surface,
+        method: normalizeMethod(ctx.method),
+        routeTemplate: normalizedRouteTemplate(ctx),
+        statusCode: status,
+        outcome: fact.outcome ?? outcomeForStatus(status),
+        decisionPoint: fact.decisionPoint,
+        reasonCode: fact.reasonCode,
+        ...(fact.detail === undefined ? {} : { detail: fact.detail }),
+        ...(referenceKeyId === undefined ? {} : { references, referenceKeyId }),
+    });
+    try {
+        await sink(event);
+    }
+    catch {
+        recordSecurityDecisionSinkFailure();
+    }
+    return event;
+}
+/** Derive the only compatible terminal outcome from a final HTTP status. */
+function outcomeForStatus(status) {
+    if (status >= 500)
+        return 'error';
+    if (status >= 400)
+        return 'deny';
+    return 'allow';
+}
+/** Classify a final response when no earlier boundary supplied a more specific fact. */
+function fallbackDecisionFact(status) {
+    if (status === 401) {
+        return {
+            decisionPoint: 'authentication',
+            reasonCode: 'authentication-required',
+            outcome: 'deny',
+        };
+    }
+    if (status === 403) {
+        return { decisionPoint: 'permission', reasonCode: 'permission-required', outcome: 'deny' };
+    }
+    if (status === 404) {
+        return { decisionPoint: 'resource', reasonCode: 'route-not-found', outcome: 'deny' };
+    }
+    if (status === 405) {
+        return { decisionPoint: 'validation', reasonCode: 'method-not-allowed', outcome: 'deny' };
+    }
+    if (status >= 400 && status < 500) {
+        return { decisionPoint: 'validation', reasonCode: 'schema-invalid', outcome: 'deny' };
+    }
+    if (status >= 500) {
+        return { decisionPoint: 'handler', reasonCode: 'handler-failed', outcome: 'error' };
+    }
+    return { decisionPoint: 'handler', reasonCode: 'allowed', outcome: 'allow' };
+}
+/** Map an arbitrary HTTP method to the closed event vocabulary. */
+function normalizeMethod(method) {
+    switch (method) {
+        case 'GET':
+        case 'POST':
+        case 'PUT':
+        case 'DELETE':
+        case 'PATCH':
+            return method;
+        default:
+            return 'UNKNOWN';
+    }
+}
+//# sourceMappingURL=decision-context.js.map

package/dist/security/decision-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-context.js","sourceRoot":"","sources":["../../src/security/decision-context.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAGzF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,GAI3B,MAAM,qBAAqB,CAAC;AAyB7B,IAAI,yBAAyB,GAAG,CAAC,CAAC;AASlC,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,GAAY,EAAE,SAAiB;IACxE,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC9E,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,IAA0B;IAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO;IACpC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,uBAAuB,CACrC,GAAY,EACZ,MAA+B,EAC/B,aAAqB;IAErB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO;IAChG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC;AAC5C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAClD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QACtC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,+BAA+B,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mCAAmC;IACjD,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iCAAiC;IAC/C,yBAAyB,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,yBAAyB,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAyB,CAAC,KAAK,EAAE,EAAE;IACjE,MAAM,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAY,EACZ,IAAI,GAAyB,mBAAmB;IAEhD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;IACrB,MAAM,OAAO,GAA4C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QACxF,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,UAAU,GAAqD,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,MAAM,CACxD,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,SAAS,CACpD,CAAC;IACF,IAAI,cAAkC,CAAC;IACvC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpE,cAAc,GAAG,SAAS,CAAC,WAAW,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,aAAa,KAAK,SAAS;gBAC7B,UAAU,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,2BAA2B,CAAC;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO;QACP,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QACnC,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC;QAC3C,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC;QACjD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wFAAwF;AACxF,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,aAAa,EAAE,gBAAgB;YAC/B,UAAU,EAAE,yBAAyB;YACrC,OAAO,EAAE,MAAM;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,mEAAmE;AACnE,SAAS,eAAe,CAAC,MAAc;IACrC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/security/decision-event.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Privacy-safe terminal security decision events.
+ *
+ * This module deliberately accepts only typed, normalized facts. Raw request values and thrown
+ * errors have no representation in the event schema, which prevents accidental disclosure at the
+ * logging boundary.
+ */
+import { z } from 'zod';
+/** Stable event name emitted for covered terminal request decisions. */
+export declare const SECURITY_DECISION_EVENT_NAME: 'security.decision.v1';
+/** Closed reasons which may explain a terminal decision. */
+export declare const SECURITY_DECISION_REASON_CODES: readonly ['allowed', 'authentication-required', 'membership-required', 'permission-required', 'resource-not-found', 'malformed-body', 'body-too-large', 'schema-invalid', 'handler-failed', 'transport-parse-failed', 'method-not-allowed', 'route-not-found'];
+/** Closed terminal reason. */
+export type SecurityDecisionReasonCode = (typeof SECURITY_DECISION_REASON_CODES)[number];
+/** Domains supported by privacy-preserving protected references. */
+export declare const SECURITY_REFERENCE_DOMAINS: readonly ['actor', 'tenant', 'resource', 'source'];
+/** Protected-reference domain. */
+export type SecurityReferenceDomain = (typeof SECURITY_REFERENCE_DOMAINS)[number];
+/** Strict runtime schema for a terminal security decision event. */
+export declare const securityDecisionEventSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    eventName: z.ZodLiteral<"security.decision.v1">;
+    occurredAt: z.ZodString;
+    requestId: z.ZodString;
+    surface: z.ZodEnum<{
+        "admin-api": "admin-api";
+        "public-auth": "public-auth";
+        transport: "transport";
+    }>;
+    method: z.ZodEnum<{
+        DELETE: "DELETE";
+        GET: "GET";
+        PATCH: "PATCH";
+        POST: "POST";
+        PUT: "PUT";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    routeTemplate: z.ZodString;
+    statusCode: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+        error: "error";
+    }>;
+    decisionPoint: z.ZodEnum<{
+        authentication: "authentication";
+        handler: "handler";
+        membership: "membership";
+        permission: "permission";
+        resource: "resource";
+        transport: "transport";
+        validation: "validation";
+    }>;
+    reasonCode: z.ZodEnum<{
+        allowed: "allowed";
+        "authentication-required": "authentication-required";
+        "body-too-large": "body-too-large";
+        "handler-failed": "handler-failed";
+        "malformed-body": "malformed-body";
+        "membership-required": "membership-required";
+        "method-not-allowed": "method-not-allowed";
+        "permission-required": "permission-required";
+        "resource-not-found": "resource-not-found";
+        "route-not-found": "route-not-found";
+        "schema-invalid": "schema-invalid";
+        "transport-parse-failed": "transport-parse-failed";
+    }>;
+    referenceKeyId: z.ZodOptional<z.ZodString>;
+    actorRef: z.ZodOptional<z.ZodString>;
+    tenantRef: z.ZodOptional<z.ZodString>;
+    resourceRef: z.ZodOptional<z.ZodString>;
+    sourceRef: z.ZodOptional<z.ZodString>;
+    detail: z.ZodOptional<z.ZodObject<{
+        resourceType: z.ZodOptional<z.ZodString>;
+        permissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        validationSchemaId: z.ZodOptional<z.ZodString>;
+        issueCount: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Validated terminal event. */
+export type SecurityDecisionEvent = z.infer<typeof securityDecisionEventSchema>;
+/** Typed facts accepted when constructing a terminal event. */
+export interface SecurityDecisionEventInput {
+    /** Server-created correlation identifier. */
+    readonly requestId: string;
+    /** Closed public surface. */
+    readonly surface: SecurityDecisionEvent['surface'];
+    /** Closed HTTP method. */
+    readonly method: SecurityDecisionEvent['method'];
+    /** Registered normalized route template. */
+    readonly routeTemplate: string;
+    /** Final public status. */
+    readonly statusCode: number;
+    /** Final decision outcome. */
+    readonly outcome: SecurityDecisionEvent['outcome'];
+    /** Boundary which made the decision. */
+    readonly decisionPoint: SecurityDecisionEvent['decisionPoint'];
+    /** Closed reason code. */
+    readonly reasonCode: SecurityDecisionReasonCode;
+    /** Optional closed detail. */
+    readonly detail?: SecurityDecisionEvent['detail'];
+    /** Optional pre-derived protected references. */
+    readonly references?: Readonly<Partial<Record<SecurityReferenceDomain, string>>>;
+    /** Required when protected references are present. */
+    readonly referenceKeyId?: string;
+    /** Injectable clock for deterministic testing. */
+    readonly occurredAt?: Date;
+}
+/** Create and validate one strict terminal event from normalized typed facts. */
+export declare function createSecurityDecisionEvent(input: SecurityDecisionEventInput): SecurityDecisionEvent;
+/**
+ * Derive and verify domain-separated protected references.
+ *
+ * The first source key creates references. Retained keys are verification-only, matching the
+ * cookie-key rotation contract without storing or logging the source identifiers.
+ */
+export declare class SecurityReferenceProtector {
+    #private;
+    /** Create a protector from the ordered cookie-key ring. */
+    constructor(cookieKeys: readonly string[]);
+    /** Public identifier for the active derived key. */
+    get activeKeyId(): string;
+    /** Derive one protected reference with the active key. */
+    protect(domain: SecurityReferenceDomain, rawIdentifier: string): string;
+    /** Verify a reference against one named active or retained derived key. */
+    verify(domain: SecurityReferenceDomain, rawIdentifier: string, reference: string, keyId: string): boolean;
+}
+//# sourceMappingURL=decision-event.d.ts.map

package/dist/security/decision-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-event.d.ts","sourceRoot":"","sources":["../../src/security/decision-event.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wEAAwE;AACxE,eAAO,MAAM,4BAA4B,EAAG,sBAA+B,CAAC;AAE5E,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,YACzC,SAAS,EACT,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,CACT,CAAC;AAEX,8BAA8B;AAC9B,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzF,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,YAAI,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAE7F,kCAAkC;AAClC,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAoBlF,oEAAoE;AACpE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqHpC,CAAC;AAEL,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,+DAA+D;AAC/D,MAAM,WAAW,0BAA0B;IACzC,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACnD,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACjD,4CAA4C;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2BAA2B;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACnD,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAC/D,0BAA0B;IAC1B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClD,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACjF,sDAAsD;IACtD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;CAC5B;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,0BAA0B,GAChC,qBAAqB,CAoBvB;AAQD;;;;;GAKG;AACH,qBAAa,0BAA0B;;IAGrC,2DAA2D;IAC3D,YAAmB,UAAU,EAAE,SAAS,MAAM,EAAE,EAK/C;IAED,oDAAoD;IACpD,IAAW,WAAW,IAAI,MAAM,CAE/B;IAED,0DAA0D;IACnD,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAM7E;IAED,2EAA2E;IACpE,MAAM,CACX,MAAM,EAAE,uBAAuB,EAC/B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAUT;CA4BF"}

package/dist/security/decision-event.js

@@ -0,0 +1,225 @@
+/**
+ * Privacy-safe terminal security decision events.
+ *
+ * This module deliberately accepts only typed, normalized facts. Raw request values and thrown
+ * errors have no representation in the event schema, which prevents accidental disclosure at the
+ * logging boundary.
+ */
+import { createHash, createHmac, hkdfSync, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+/** Stable event name emitted for covered terminal request decisions. */
+export const SECURITY_DECISION_EVENT_NAME = 'security.decision.v1';
+/** Closed reasons which may explain a terminal decision. */
+export const SECURITY_DECISION_REASON_CODES = [
+    'allowed',
+    'authentication-required',
+    'membership-required',
+    'permission-required',
+    'resource-not-found',
+    'malformed-body',
+    'body-too-large',
+    'schema-invalid',
+    'handler-failed',
+    'transport-parse-failed',
+    'method-not-allowed',
+    'route-not-found',
+];
+/** Domains supported by privacy-preserving protected references. */
+export const SECURITY_REFERENCE_DOMAINS = ['actor', 'tenant', 'resource', 'source'];
+const detailSchema = z
+    .object({
+    resourceType: z
+        .string()
+        .regex(/^[a-z][a-z0-9-]{0,63}$/)
+        .optional(),
+    permissions: z
+        .array(z.string().regex(/^[a-z][a-z0-9:*_-]{0,149}$/))
+        .max(16)
+        .optional(),
+    validationSchemaId: z
+        .string()
+        .regex(/^[a-z][a-z0-9.-]{0,63}$/)
+        .optional(),
+    issueCount: z.number().int().min(1).max(100).optional(),
+})
+    .strict();
+/** Strict runtime schema for a terminal security decision event. */
+export const securityDecisionEventSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    eventName: z.literal(SECURITY_DECISION_EVENT_NAME),
+    occurredAt: z.string().datetime({ offset: true }),
+    requestId: z.string().uuid(),
+    surface: z.enum(['admin-api', 'public-auth', 'transport']),
+    method: z.enum(['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'UNKNOWN']),
+    routeTemplate: z
+        .string()
+        .min(1)
+        .max(180)
+        .regex(/^\/[A-Za-z0-9:_/*.-]+$/)
+        .refine((value) => !value.includes('..') && !value.includes('//')),
+    statusCode: z.number().int().min(100).max(599),
+    outcome: z.enum(['allow', 'deny', 'error']),
+    decisionPoint: z.enum([
+        'transport',
+        'validation',
+        'authentication',
+        'membership',
+        'permission',
+        'resource',
+        'handler',
+    ]),
+    reasonCode: z.enum(SECURITY_DECISION_REASON_CODES),
+    referenceKeyId: z
+        .string()
+        .regex(/^sha256:[a-f0-9]{16}$/)
+        .optional(),
+    actorRef: z
+        .string()
+        .regex(/^hmac-sha256:[a-f0-9]{64}$/)
+        .optional(),
+    tenantRef: z
+        .string()
+        .regex(/^hmac-sha256:[a-f0-9]{64}$/)
+        .optional(),
+    resourceRef: z
+        .string()
+        .regex(/^hmac-sha256:[a-f0-9]{64}$/)
+        .optional(),
+    sourceRef: z
+        .string()
+        .regex(/^hmac-sha256:[a-f0-9]{64}$/)
+        .optional(),
+    detail: detailSchema.optional(),
+})
+    .strict()
+    .superRefine((event, context) => {
+    const references = [event.actorRef, event.tenantRef, event.resourceRef, event.sourceRef];
+    const hasReference = references.some((reference) => reference !== undefined);
+    if (hasReference !== (event.referenceKeyId !== undefined)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['referenceKeyId'],
+            message: 'Protected references and their key identifier must appear together',
+        });
+    }
+    const expectedOutcome = event.statusCode >= 500 ? 'error' : event.statusCode >= 400 ? 'deny' : 'allow';
+    if (event.outcome !== expectedOutcome) {
+        context.addIssue({
+            code: 'custom',
+            path: ['outcome'],
+            message: 'Terminal outcome must match the final HTTP status class',
+        });
+    }
+    if ((event.reasonCode === 'allowed') !== (event.outcome === 'allow')) {
+        context.addIssue({
+            code: 'custom',
+            path: ['reasonCode'],
+            message: 'The allowed reason is valid only for an allowed outcome',
+        });
+    }
+    if ((event.reasonCode === 'handler-failed') !== (event.outcome === 'error')) {
+        context.addIssue({
+            code: 'custom',
+            path: ['reasonCode'],
+            message: 'The handler-failed reason is valid only for an error outcome',
+        });
+    }
+    const requiredDecisionPoints = {
+        allowed: 'handler',
+        'authentication-required': 'authentication',
+        'membership-required': 'membership',
+        'permission-required': 'permission',
+        'resource-not-found': 'resource',
+        'route-not-found': 'resource',
+        'malformed-body': 'validation',
+        'body-too-large': 'validation',
+        'schema-invalid': 'validation',
+        'method-not-allowed': 'validation',
+        'handler-failed': 'handler',
+        'transport-parse-failed': 'transport',
+    };
+    const requiredDecisionPoint = requiredDecisionPoints[event.reasonCode];
+    if (requiredDecisionPoint !== undefined && event.decisionPoint !== requiredDecisionPoint) {
+        context.addIssue({
+            code: 'custom',
+            path: ['decisionPoint'],
+            message: 'Terminal reason must match the boundary which made the decision',
+        });
+    }
+});
+/** Create and validate one strict terminal event from normalized typed facts. */
+export function createSecurityDecisionEvent(input) {
+    return securityDecisionEventSchema.parse({
+        schemaVersion: 1,
+        eventName: SECURITY_DECISION_EVENT_NAME,
+        occurredAt: (input.occurredAt ?? new Date()).toISOString(),
+        requestId: input.requestId,
+        surface: input.surface,
+        method: input.method,
+        routeTemplate: input.routeTemplate,
+        statusCode: input.statusCode,
+        outcome: input.outcome,
+        decisionPoint: input.decisionPoint,
+        reasonCode: input.reasonCode,
+        ...(input.referenceKeyId === undefined ? {} : { referenceKeyId: input.referenceKeyId }),
+        ...(input.references?.actor === undefined ? {} : { actorRef: input.references.actor }),
+        ...(input.references?.tenant === undefined ? {} : { tenantRef: input.references.tenant }),
+        ...(input.references?.resource === undefined ? {} : { resourceRef: input.references.resource }),
+        ...(input.references?.source === undefined ? {} : { sourceRef: input.references.source }),
+        ...(input.detail === undefined ? {} : { detail: input.detail }),
+    });
+}
+/**
+ * Derive and verify domain-separated protected references.
+ *
+ * The first source key creates references. Retained keys are verification-only, matching the
+ * cookie-key rotation contract without storing or logging the source identifiers.
+ */
+export class SecurityReferenceProtector {
+    #keys;
+    /** Create a protector from the ordered cookie-key ring. */
+    constructor(cookieKeys) {
+        if (cookieKeys.length === 0 || cookieKeys.some((key) => key.length < 16)) {
+            throw new Error('A valid protected-reference key ring is required');
+        }
+        this.#keys = [...cookieKeys];
+    }
+    /** Public identifier for the active derived key. */
+    get activeKeyId() {
+        return this.#derive(this.#keys[0], 'actor').id;
+    }
+    /** Derive one protected reference with the active key. */
+    protect(domain, rawIdentifier) {
+        if (rawIdentifier.length === 0 || rawIdentifier.length > 512) {
+            throw new Error('Protected-reference input is outside the accepted bound');
+        }
+        const key = this.#derive(this.#keys[0], domain);
+        return `hmac-sha256:${createHmac('sha256', key.material).update(rawIdentifier).digest('hex')}`;
+    }
+    /** Verify a reference against one named active or retained derived key. */
+    verify(domain, rawIdentifier, reference, keyId) {
+        if (!/^hmac-sha256:[a-f0-9]{64}$/.test(reference))
+            return false;
+        const presented = Buffer.from(reference.slice('hmac-sha256:'.length), 'hex');
+        for (const sourceKey of this.#keys) {
+            const derived = this.#derive(sourceKey, domain);
+            if (derived.id !== keyId)
+                continue;
+            const expected = createHmac('sha256', derived.material).update(rawIdentifier).digest();
+            return expected.length === presented.length && timingSafeEqual(expected, presented);
+        }
+        return false;
+    }
+    /** Derive one domain-specific HMAC key and non-secret identifier. */
+    #derive(sourceKey, domain) {
+        const source = Buffer.from(sourceKey, 'utf8');
+        const material = Buffer.from(hkdfSync('sha256', source, Buffer.from('porta/security-decision/v1', 'utf8'), Buffer.from(`porta/security-decision/v1/${domain}`, 'utf8'), 32));
+        const identifierMaterial = Buffer.from(hkdfSync('sha256', source, Buffer.from('porta/security-decision/v1', 'utf8'), Buffer.from('porta/security-decision/v1/key-id', 'utf8'), 32));
+        return {
+            id: `sha256:${createHash('sha256').update(identifierMaterial).digest('hex').slice(0, 16)}`,
+            material,
+        };
+    }
+}
+//# sourceMappingURL=decision-event.js.map