@proteinjs/user-server 1.11.0 → 1.12.0

package/dist/test/Roles.integration.test.js

@@ -114,7 +114,14 @@ describe('Roles service — grant/revoke outcomes and audit trail', function ()
                     ];
                     reflection_1.SourceRepository.get().objectCache['@proteinjs/user/RoleCatalogEntry'] = [
                         { role: 'ops', description: 'Run the ops cockpit' },
+                        { role: 'dev', description: 'Drive the dev tooling' },
+                        // Admin-grant-only entry (the consumer compliance-grant shape): granting requires the
+                        // caller to BE an admin; the ordinary 'roles' grant does not cover it.
+                        { role: 'data-access', description: 'Compliance decrypt grant', adminGrantOnly: true },
                     ];
+                    // The admin-grant-only check resolves the CALLER through UserAuth — same session-backed
+                    // repo the services use.
+                    reflection_1.SourceRepository.get().objectCache['@proteinjs/user-auth/AuthenticatedUserRepo'] = [new user_1.UserRepo()];
                     jest.spyOn(db_1.Db, 'getDefaultDbDriver').mockImplementation(function () { return spannerDriver; });
                     return [4 /*yield*/, test_1.SpannerEmulatorProvisioner.ensureProvisioned({
                             projectId: 'proteinjs-test',
@@ -257,7 +264,7 @@ describe('Roles service — grant/revoke outcomes and audit trail', function ()
                     return [4 /*yield*/, roles.grantRole(targetId, 'ops')];
                 case 1:
                     _b.sent();
-                    return [4 /*yield*/, roles.grantRole(targetId, 'admin')];
+                    return [4 /*yield*/, roles.grantRole(targetId, 'dev')];
                 case 2:
                     _b.sent();
                     return [4 /*yield*/, roles.revokeRole(targetId, 'ops')];
@@ -266,7 +273,7 @@ describe('Roles service — grant/revoke outcomes and audit trail', function ()
                     _a = expect;
                     return [4 /*yield*/, targetRoles()];
                 case 4:
-                    _a.apply(void 0, [_b.sent()]).toEqual(['admin']);
+                    _a.apply(void 0, [_b.sent()]).toEqual(['dev']);
                     return [4 /*yield*/, auditRows()];
                 case 5:
                     events = _b.sent();
@@ -277,6 +284,58 @@ describe('Roles service — grant/revoke outcomes and audit trail', function ()
             }
         });
     }); }, 60000);
+    it('refuses to grant the break-glass role, and writes nothing — the only path to admin is a manual UPDATE in Spanner Studio', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: 
+                // The error teaches: names break-glass, refuses the grant, and points at the one real path.
+                return [4 /*yield*/, expect(new Roles_1.Roles().grantRole(targetId, 'admin')).rejects.toThrow(/break-glass role — this service refuses to grant it.*manual UPDATE on the user row in Spanner Studio/)];
+                case 1:
+                    // The error teaches: names break-glass, refuses the grant, and points at the one real path.
+                    _c.sent();
+                    // A refusal is not a role change: no user write, no audit row (the trail records what
+                    // happened, and nothing happened).
+                    _a = expect;
+                    return [4 /*yield*/, targetRoles()];
+                case 2:
+                    // A refusal is not a role change: no user write, no audit row (the trail records what
+                    // happened, and nothing happened).
+                    _a.apply(void 0, [_c.sent()]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 60000);
+    it('revokes the break-glass role — de-escalation through the audited path stays available', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, events;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: 
+                // Admin arrives only via the manual database path; mirror that here with a system write.
+                return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, { id: targetId, roles: ['admin'] })];
+                case 1:
+                    // Admin arrives only via the manual database path; mirror that here with a system write.
+                    _b.sent();
+                    return [4 /*yield*/, new Roles_1.Roles().revokeRole(targetId, 'admin')];
+                case 2:
+                    _b.sent();
+                    _a = expect;
+                    return [4 /*yield*/, targetRoles()];
+                case 3:
+                    _a.apply(void 0, [_b.sent()]).toEqual([]);
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    events = _b.sent();
+                    expect(events).toHaveLength(1);
+                    expect(events[0]).toMatchObject({ actor: 'actor-1', target: targetId, role: 'admin', action: 'revoke' });
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 60000);
     it('revoking a role the user does not hold changes nothing and writes no audit row', function () { return __awaiter(void 0, void 0, void 0, function () {
         var _a, _b;
         return __generator(this, function (_c) {
@@ -330,5 +389,85 @@ describe('Roles service — grant/revoke outcomes and audit trail', function ()
             }
         });
     }); }, 60000);
+    it('refuses to grant an admin-grant-only role when the caller is not an admin — and writes nothing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    // A user-admin's full day-to-day grant set — pointedly including 'roles' (the door this
+                    // service sits behind) — must NOT be able to hand out an admin-grant-only role.
+                    new user_1.UserRepo().setUser(__assign(__assign({}, actor), { roles: ['users', 'roles', 'sessions'] }));
+                    _c.label = 1;
+                case 1:
+                    _c.trys.push([1, , 5, 6]);
+                    return [4 /*yield*/, expect(new Roles_1.Roles().grantRole(targetId, 'data-access')).rejects.toThrow(/can only be granted by an admin/)];
+                case 2:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, targetRoles()];
+                case 3:
+                    _a.apply(void 0, [_c.sent()]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 4:
+                    _b.apply(void 0, [_c.sent()]).toHaveLength(0);
+                    return [3 /*break*/, 6];
+                case 5:
+                    new user_1.UserRepo().setUser(actor);
+                    return [7 /*endfinally*/];
+                case 6: return [2 /*return*/];
+            }
+        });
+    }); }, 60000);
+    it('grants an admin-grant-only role when the caller IS an admin, audited like any grant', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, events;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, new Roles_1.Roles().grantRole(targetId, 'data-access')];
+                case 1:
+                    _b.sent();
+                    _a = expect;
+                    return [4 /*yield*/, targetRoles()];
+                case 2:
+                    _a.apply(void 0, [_b.sent()]).toEqual(['data-access']);
+                    return [4 /*yield*/, auditRows()];
+                case 3:
+                    events = _b.sent();
+                    expect(events).toHaveLength(1);
+                    expect(events[0]).toMatchObject({ actor: 'actor-1', target: targetId, role: 'data-access', action: 'grant' });
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 60000);
+    it('a roles-holder can still REVOKE an admin-grant-only role — de-escalation stays open (the break-glass precedent)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, new Roles_1.Roles().grantRole(targetId, 'data-access')];
+                case 1:
+                    _c.sent();
+                    new user_1.UserRepo().setUser(__assign(__assign({}, actor), { roles: ['roles'] }));
+                    _c.label = 2;
+                case 2:
+                    _c.trys.push([2, , 6, 7]);
+                    return [4 /*yield*/, new Roles_1.Roles().revokeRole(targetId, 'data-access')];
+                case 3:
+                    _c.sent();
+                    _a = expect;
+                    return [4 /*yield*/, targetRoles()];
+                case 4:
+                    _a.apply(void 0, [_c.sent()]).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, auditRows()];
+                case 5:
+                    _b.apply(void 0, [(_c.sent()).map(function (event) { return event.action; }).sort()]).toEqual(['grant', 'revoke']);
+                    return [3 /*break*/, 7];
+                case 6:
+                    new user_1.UserRepo().setUser(actor);
+                    return [7 /*endfinally*/];
+                case 7: return [2 /*return*/];
+            }
+        });
+    }); }, 60000);
 });
 //# sourceMappingURL=Roles.integration.test.js.map

package/dist/test/Roles.integration.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.integration.test.js","sourceRoot":"","sources":["../../test/Roles.integration.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAAyD;AACzD,kEAA6D;AAC7D,0DAAiG;AACjG,oDAAyD;AACzD,oDAAiF;AACjF,wCAAuF;AACvF,+CAA8C;AAE9C;;;;;;;GAOG;AAEH;IAAA;QACE,gBAAW,GAAG,MAAgB,CAAC;IAUjC,CAAC;IAPC,wCAAO,GAAP,UAAQ,IAAiB;QACvB,sBAAsB,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC;IAED,wCAAO,GAAP;QACE,OAAO,sBAAsB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC;IARM,mCAAY,GAAkC,EAAE,AAApC,CAAqC;IAS1D,6BAAC;CAAA,AAXD,IAWC;AAED,IAAM,aAAa,GAAG,IAAI,iCAAa,CAAC;IACtC,SAAS,EAAE,gBAAgB;IAC3B,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,MAAM;CACrB,CAAC,CAAC;AAEH;IAAA;IAIA,CAAC;IAHC,qCAAW,GAAX;QACE,OAAO,aAAa,CAAC;IACvB,CAAC;IACH,sBAAC;AAAD,CAAC,AAJD,IAIC;AAED,IAAM,KAAK,GAAG;IACZ,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,IAAI;IACnB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;IACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;IACjB,EAAE,EAAE,SAAS;CACd,CAAC;AAEF,IAAM,SAAS,GAAG,IAAA,uBAAgB,EAAC,aAAa,CAAC,CAAC;AAElD,QAAQ,CAAC,uDAAuD,EAAE;IAChE,SAAS,CAAC;;;;oBACP,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;oBAC7G,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,0CAA0C,CAAC,GAAG;wBACxF,IAAI,sBAAsB,EAAE;qBAC7B,CAAC;oBACD,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,kCAAkC,CAAC,GAAG;wBAChF,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAsB;qBACxE,CAAC;oBACF,IAAI,CAAC,KAAK,CAAC,OAAE,EAAE,oBAAoB,CAAC,CAAC,kBAAkB,CAAC,cAAM,OAAA,aAAa,EAAb,CAAa,CAAC,CAAC;oBAE7E,qBAAM,iCAA0B,CAAC,iBAAiB,CAAC;4BACjD,SAAS,EAAE,gBAAgB;4BAC3B,YAAY,EAAE,gBAAgB;4BAC9B,YAAY,EAAE,MAAM;yBACrB,CAAC,EAAA;;oBAJF,SAIE,CAAC;oBACH,qBAAM,SAAS,CAAC,aAAM,CAAC,IAAkB,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,SAAS,CAAC,aAAM,CAAC,cAA4B,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBACrD,qBAAM,aAAa,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,aAAM,CAAC,IAAI,CAAC,EAAA;;oBAA5D,SAA4D,CAAC;oBAC7D,qBAAM,aAAa,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,aAAM,CAAC,cAAc,CAAC,EAAA;;oBAAtE,SAAsE,CAAC;oBAEvE,oBAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5E,IAAI,eAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;;;SAC/B,EAAE,MAAM,CAAC,CAAC;IAEX,QAAQ,CAAC;;;wBACP,qBAAM,SAAS,CAAC,aAAM,CAAC,IAAkB,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,SAAS,CAAC,aAAM,CAAC,cAA4B,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBACrD,qBAAM,iCAA0B,CAAC,OAAO,EAAE,EAAA;;oBAA1C,SAA0C,CAAC;;;;SAC5C,EAAE,KAAK,CAAC,CAAC;IAEV,IAAI,QAAgB,CAAC;IAErB,UAAU,CAAC;;;;;oBACH,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;oBAAhC,SAAgC,CAAC;oBACjC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,eAAO,KAAK,EAAG,EAAA;;oBAA1C,SAA0C,CAAC;oBAC5B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BAC1C,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE,mBAAmB;4BAC1B,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,IAAI;4BACnB,KAAK,EAAE,EAAE;yBACV,CAAC,EAAA;;oBANI,MAAM,GAAG,SAMb;oBACF,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;;;;SACtB,EAAE,KAAK,CAAC,CAAC;IAEV,IAAM,WAAW,GAAG;;oBAAa,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAA;oBAAzD,sBAAA,CAAC,SAAwD,CAAE,CAAC,KAAK,EAAA;;aAAA,CAAC;IAClG,IAAM,SAAS,GAAG;;oBAAY,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;oBAAtD,sBAAA,SAAsD,EAAA;;aAAA,CAAC;IAErF,EAAE,CAAC,mDAAmD,EAAE;;QACtD,MAAM,CAAC,MAAA,MAAA,IAAI,aAAK,EAAE,CAAC,eAAe,0CAAE,IAAI,0CAAE,UAAU,CAAC,CAAC,IAAI,CAAC,uBAAgB,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE;;;;wBAC5D,qBAAM,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAE7C,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC9B,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACtG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;;;;SACzC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,uEAAuE,EAAE;;;;;oBACpE,KAAK,GAAG,IAAI,aAAK,EAAE,CAAC;oBAC1B,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBACvC,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBAEvC,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC7C,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,+CAA+C,EAAE;;;;;oBAC5C,KAAK,GAAG,IAAI,aAAK,EAAE,CAAC;oBAC1B,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBACvC,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAA;;oBAAxC,SAAwC,CAAC;oBACzC,qBAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAvC,SAAuC,CAAC;oBAExC,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBAChC,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBACzB,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAzB,CAAyB,CAAC,CAAC;oBACjE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;;;SACnF,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,gFAAgF,EAAE;;;;wBACnF,qBAAM,IAAI,aAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAA7C,SAA6C,CAAC;oBAE9C,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,8DAA8D,EAAE;;;;wBACjE,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtE,iEAAiE,CAClE,EAAA;;oBAFD,SAEC,CAAC;oBACF,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,+CAA+C,EAAE;;;;wBAClD,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,EAAA;;oBAAxG,SAAwG,CAAC;oBACzG,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"Roles.integration.test.js","sourceRoot":"","sources":["../../test/Roles.integration.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAAyD;AACzD,kEAA6D;AAC7D,0DAAiG;AACjG,oDAAyD;AACzD,oDAAiF;AACjF,wCAAuF;AACvF,+CAA8C;AAE9C;;;;;;;GAOG;AAEH;IAAA;QACE,gBAAW,GAAG,MAAgB,CAAC;IAUjC,CAAC;IAPC,wCAAO,GAAP,UAAQ,IAAiB;QACvB,sBAAsB,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC;IAED,wCAAO,GAAP;QACE,OAAO,sBAAsB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC;IARM,mCAAY,GAAkC,EAAE,AAApC,CAAqC;IAS1D,6BAAC;CAAA,AAXD,IAWC;AAED,IAAM,aAAa,GAAG,IAAI,iCAAa,CAAC;IACtC,SAAS,EAAE,gBAAgB;IAC3B,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,MAAM;CACrB,CAAC,CAAC;AAEH;IAAA;IAIA,CAAC;IAHC,qCAAW,GAAX;QACE,OAAO,aAAa,CAAC;IACvB,CAAC;IACH,sBAAC;AAAD,CAAC,AAJD,IAIC;AAED,IAAM,KAAK,GAAG;IACZ,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,IAAI;IACnB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,OAAO,EAAE,IAAA,gBAAM,GAAE;IACjB,OAAO,EAAE,IAAA,gBAAM,GAAE;IACjB,EAAE,EAAE,SAAS;CACd,CAAC;AAEF,IAAM,SAAS,GAAG,IAAA,uBAAgB,EAAC,aAAa,CAAC,CAAC;AAElD,QAAQ,CAAC,uDAAuD,EAAE;IAChE,SAAS,CAAC;;;;oBACP,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;oBAC7G,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,0CAA0C,CAAC,GAAG;wBACxF,IAAI,sBAAsB,EAAE;qBAC7B,CAAC;oBACD,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,kCAAkC,CAAC,GAAG;wBAChF,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAsB;wBACvE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,uBAAuB,EAAsB;wBACzE,sFAAsF;wBACtF,uEAAuE;wBACvE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,cAAc,EAAE,IAAI,EAAsB;qBAC3G,CAAC;oBACF,wFAAwF;oBACxF,yBAAyB;oBACxB,6BAAgB,CAAC,GAAG,EAAU,CAAC,WAAW,CAAC,4CAA4C,CAAC,GAAG,CAAC,IAAI,eAAQ,EAAE,CAAC,CAAC;oBAC7G,IAAI,CAAC,KAAK,CAAC,OAAE,EAAE,oBAAoB,CAAC,CAAC,kBAAkB,CAAC,cAAM,OAAA,aAAa,EAAb,CAAa,CAAC,CAAC;oBAE7E,qBAAM,iCAA0B,CAAC,iBAAiB,CAAC;4BACjD,SAAS,EAAE,gBAAgB;4BAC3B,YAAY,EAAE,gBAAgB;4BAC9B,YAAY,EAAE,MAAM;yBACrB,CAAC,EAAA;;oBAJF,SAIE,CAAC;oBACH,qBAAM,SAAS,CAAC,aAAM,CAAC,IAAkB,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,SAAS,CAAC,aAAM,CAAC,cAA4B,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBACrD,qBAAM,aAAa,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,aAAM,CAAC,IAAI,CAAC,EAAA;;oBAA5D,SAA4D,CAAC;oBAC7D,qBAAM,aAAa,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,aAAM,CAAC,cAAc,CAAC,EAAA;;oBAAtE,SAAsE,CAAC;oBAEvE,oBAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5E,IAAI,eAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;;;SAC/B,EAAE,MAAM,CAAC,CAAC;IAEX,QAAQ,CAAC;;;wBACP,qBAAM,SAAS,CAAC,aAAM,CAAC,IAAkB,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,SAAS,CAAC,aAAM,CAAC,cAA4B,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBACrD,qBAAM,iCAA0B,CAAC,OAAO,EAAE,EAAA;;oBAA1C,SAA0C,CAAC;;;;SAC5C,EAAE,KAAK,CAAC,CAAC;IAEV,IAAI,QAAgB,CAAC;IAErB,UAAU,CAAC;;;;;oBACH,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;;oBAA1C,SAA0C,CAAC;oBAC3C,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;oBAAhC,SAAgC,CAAC;oBACjC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,eAAO,KAAK,EAAG,EAAA;;oBAA1C,SAA0C,CAAC;oBAC5B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BAC1C,IAAI,EAAE,aAAa;4BACnB,KAAK,EAAE,mBAAmB;4BAC1B,QAAQ,EAAE,MAAM;4BAChB,aAAa,EAAE,IAAI;4BACnB,KAAK,EAAE,EAAE;yBACV,CAAC,EAAA;;oBANI,MAAM,GAAG,SAMb;oBACF,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;;;;SACtB,EAAE,KAAK,CAAC,CAAC;IAEV,IAAM,WAAW,GAAG;;oBAAa,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAA;oBAAzD,sBAAA,CAAC,SAAwD,CAAE,CAAC,KAAK,EAAA;;aAAA,CAAC;IAClG,IAAM,SAAS,GAAG;;oBAAY,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,CAAC,EAAA;oBAAtD,sBAAA,SAAsD,EAAA;;aAAA,CAAC;IAErF,EAAE,CAAC,mDAAmD,EAAE;;QACtD,MAAM,CAAC,MAAA,MAAA,IAAI,aAAK,EAAE,CAAC,eAAe,0CAAE,IAAI,0CAAE,UAAU,CAAC,CAAC,IAAI,CAAC,uBAAgB,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE;;;;wBAC5D,qBAAM,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAE7C,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC9B,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACtG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;;;;SACzC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,uEAAuE,EAAE;;;;;oBACpE,KAAK,GAAG,IAAI,aAAK,EAAE,CAAC;oBAC1B,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBACvC,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBAEvC,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC7C,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,+CAA+C,EAAE;;;;;oBAC5C,KAAK,GAAG,IAAI,aAAK,EAAE,CAAC;oBAC1B,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBACvC,qBAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAtC,SAAsC,CAAC;oBACvC,qBAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAAvC,SAAuC,CAAC;oBAExC,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC9B,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBACzB,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAzB,CAAyB,CAAC,CAAC;oBACjE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;;;SACnF,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,yHAAyH,EAAE;;;;;gBAC5H,4FAA4F;gBAC5F,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpE,sGAAsG,CACvG,EAAA;;oBAHD,4FAA4F;oBAC5F,SAEC,CAAC;oBAEF,sFAAsF;oBACtF,mCAAmC;oBACnC,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAF1B,sFAAsF;oBACtF,mCAAmC;oBACnC,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,uFAAuF,EAAE;;;;;gBAC1F,yFAAyF;gBACzF,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAD7E,yFAAyF;oBACzF,SAA6E,CAAC;oBAE9E,qBAAM,IAAI,aAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAA;;oBAA/C,SAA+C,CAAC;oBAEhD,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACzB,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;;;;SAC1G,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,gFAAgF,EAAE;;;;wBACnF,qBAAM,IAAI,aAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAA;;oBAA7C,SAA6C,CAAC;oBAE9C,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,8DAA8D,EAAE;;;;wBACjE,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtE,iEAAiE,CAClE,EAAA;;oBAFD,SAEC,CAAC;oBACF,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,+CAA+C,EAAE;;;;wBAClD,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,EAAA;;oBAAxG,SAAwG,CAAC;oBACzG,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SAC3C,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,gGAAgG,EAAE;;;;;oBACnG,wFAAwF;oBACxF,gFAAgF;oBAChF,IAAI,eAAQ,EAAE,CAAC,OAAO,uBAAM,KAAK,KAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,IAAG,CAAC;;;;oBAE1E,qBAAM,MAAM,CAAC,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAA;;oBAA/G,SAA+G,CAAC;oBAChH,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,EAAE,EAAA;;oBAAxB,kBAAO,SAAiB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;oBAE1C,IAAI,eAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;;;;SAEjC,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,qFAAqF,EAAE;;;;wBACxF,qBAAM,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBAErD,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;oBACtC,qBAAM,SAAS,EAAE,EAAA;;oBAA1B,MAAM,GAAG,SAAiB;oBAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;;;;SAC/G,EAAE,KAAK,CAAC,CAAC;IAEV,EAAE,CAAC,iHAAiH,EAAE;;;;wBACpH,qBAAM,IAAI,aAAK,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAA;;oBAApD,SAAoD,CAAC;oBACrD,IAAI,eAAQ,EAAE,CAAC,OAAO,uBAAM,KAAK,KAAE,KAAK,EAAE,CAAC,OAAO,CAAC,IAAG,CAAC;;;;oBAErD,qBAAM,IAAI,aAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAA;;oBAArD,SAAqD,CAAC;oBACtD,KAAA,MAAM,CAAA;oBAAC,qBAAM,WAAW,EAAE,EAAA;;oBAA1B,kBAAO,SAAmB,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAE,qBAAM,SAAS,EAAE,EAAA;;oBAAzB,kBAAO,CAAC,SAAiB,CAAC,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,MAAM,EAAZ,CAAY,CAAC,CAAC,IAAI,EAAE,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;;;oBAE7F,IAAI,eAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;;;;SAEjC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC"}

package/dist/test/SweepMalformedAccessGrants.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SweepMalformedAccessGrants.integration.test.d.ts.map

package/dist/test/SweepMalformedAccessGrants.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SweepMalformedAccessGrants.integration.test.d.ts","sourceRoot":"","sources":["../../test/SweepMalformedAccessGrants.integration.test.ts"],"names":[],"mappings":""}

package/dist/test/SweepMalformedAccessGrants.integration.test.js

@@ -0,0 +1,424 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var reflection_1 = require("@proteinjs/reflection");
+var user_1 = require("@proteinjs/user");
+var SweepMalformedAccessGrants_1 = require("../src/migrations/SweepMalformedAccessGrants");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+var objectCache = function () { return reflection_1.SourceRepository.get().objectCache; };
+/** Same harness cast as MachineAccounts.integration.test.ts: recompute the static watcher map on the next Db. */
+var resetTableWatcherMap = function () {
+    var runner = (0, db_1.getDbAsSystem)().tableWatcherRunner;
+    runner.constructor.tableWatcherMap = undefined;
+};
+/**
+ * Observes access_grant deletes the way the app's watchers do (ContentReferenceAccessGrantTableWatcher
+ * lives in space-common, above this package): a delete that rides the Db layer lands here with the
+ * deleted rows; a raw-SQL delete never would.
+ */
+var RecordingAccessGrantWatcher = /** @class */ (function () {
+    function RecordingAccessGrantWatcher() {
+    }
+    RecordingAccessGrantWatcher.prototype.name = function () {
+        return 'RecordingAccessGrantWatcher';
+    };
+    RecordingAccessGrantWatcher.prototype.table = function () {
+        return user_1.tables.AccessGrant;
+    };
+    RecordingAccessGrantWatcher.prototype.afterDelete = function (_count, deletedRecords) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _i, deletedRecords_1, record;
+            return __generator(this, function (_a) {
+                for (_i = 0, deletedRecords_1 = deletedRecords; _i < deletedRecords_1.length; _i++) {
+                    record = deletedRecords_1[_i];
+                    RecordingAccessGrantWatcher.deletedIds.push(record.id);
+                }
+                return [2 /*return*/];
+            });
+        });
+    };
+    RecordingAccessGrantWatcher.deletedIds = [];
+    return RecordingAccessGrantWatcher;
+}());
+/**
+ * SweepMalformedAccessGrants (one-time migration): the AccessGrant well-formedness invariant now
+ * refuses a grant with no principal or resource id, but the rows its two pre-fix producers left
+ * behind (the test environment's NULL-principal `thought` grant that crashed Deploy to Test
+ * 32614670162) are still there. The sweep deletes EXACTLY the invariant's complement
+ * (`principal IS NULL OR resource IS NULL`) by id through the Db layer — watchers fire — and
+ * nothing else: well-formed grants survive, and DANGLING grants (non-null ids pointing at purged
+ * rows) are reported, never deleted. Idempotent.
+ *
+ * Red-first: written against the contract; a no-op sweep fails the delete legs, and a sweep on
+ * the wrong predicate fails the well-formed-survives legs.
+ */
+describe('SweepMalformedAccessGrants — deletes exactly the malformed rows through the Db layer; reports dangling; idempotent', function () {
+    var owner;
+    var grantee;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    // The dangling report resolves resource tables by name off the source graph (none is loaded
+                    // in tests) — register exactly this package's tables, as the app's composition would.
+                    objectCache()['@proteinjs/db/Table'] = Object.values(user_1.tables);
+                    objectCache()['@proteinjs/db/TableWatcher'] = [new RecordingAccessGrantWatcher()];
+                    resetTableWatcherMap();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    delete objectCache()['@proteinjs/db/Table'];
+                    delete objectCache()['@proteinjs/db/TableWatcher'];
+                    resetTableWatcherMap();
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 60000);
+    beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var db;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    db = (0, db_1.getDbAsSystem)();
+                    return [4 /*yield*/, db.delete(user_1.tables.AccessGrant, {})];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.User, {})];
+                case 2:
+                    _a.sent();
+                    RecordingAccessGrantWatcher.deletedIds = [];
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Owner', email: 'owner@test.local' })];
+                case 3:
+                    owner = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Grantee', email: 'grantee@test.local' })];
+                case 4:
+                    grantee = _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    /** A well-formed grant, inserted as system (the invariant admits it). Resource rides the user table here. */
+    function insertGrant(args) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function () {
+            var resourceTable;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        resourceTable = (_a = args.resourceTable) !== null && _a !== void 0 ? _a : user_1.tables.User.name;
+                        return [4 /*yield*/, (0, db_1.getDbAsSystem)().insert(user_1.tables.AccessGrant, {
+                                principal: new db_1.Reference(user_1.tables.User.name, args.principalId),
+                                resource: new db_1.Reference(resourceTable, args.resourceId),
+                                resourceTable: resourceTable,
+                                accessLevel: args.accessLevel,
+                            })];
+                    case 1: return [2 /*return*/, _b.sent()];
+                }
+            });
+        });
+    }
+    /**
+     * Seed the malformed shape BENEATH the insert invariant (which rightly refuses it now): insert
+     * well-formed, then null the reference in place — the row the environment actually holds.
+     */
+    function nullOut(grantId, field) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.AccessGrant, (_a = {}, _a[field] = null, _a), { id: grantId })];
+                    case 1:
+                        _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    }
+    function grantById(id) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.AccessGrant, { id: id })];
+                    case 1: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    }
+    function allGrantIds() {
+        return __awaiter(this, void 0, void 0, function () {
+            var grants;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.AccessGrant, new db_1.QueryBuilder(user_1.tables.AccessGrant.name))];
+                    case 1:
+                        grants = _a.sent();
+                        return [2 /*return*/, grants.map(function (grant) { return grant.id; }).sort()];
+                }
+            });
+        });
+    }
+    it('dry run reports without deleting; real run deletes exactly the malformed rows (watchers fire); well-formed and dangling survive; re-run is a no-op', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ownerGrant, readGrant, nullPrincipal, nullResource, purgedPrincipal, purgedResource, unregisteredTable, _a, _b, seededIds, _c, sweep, dry, _d, real, _e, _f, _g, _h, _j, _k, _l, _m, dangling, _o, again, _p;
+        var _q, _r, _s, _t, _u, _v;
+        return __generator(this, function (_w) {
+            switch (_w.label) {
+                case 0: return [4 /*yield*/, insertGrant({ principalId: owner.id, resourceId: owner.id, accessLevel: 'owner' })];
+                case 1:
+                    ownerGrant = _w.sent();
+                    return [4 /*yield*/, insertGrant({ principalId: grantee.id, resourceId: owner.id, accessLevel: 'read' })];
+                case 2:
+                    readGrant = _w.sent();
+                    return [4 /*yield*/, insertGrant({ principalId: grantee.id, resourceId: owner.id, accessLevel: 'write' })];
+                case 3:
+                    nullPrincipal = _w.sent();
+                    return [4 /*yield*/, nullOut(nullPrincipal.id, 'principal')];
+                case 4:
+                    _w.sent();
+                    return [4 /*yield*/, insertGrant({ principalId: grantee.id, resourceId: owner.id, accessLevel: 'admin' })];
+                case 5:
+                    nullResource = _w.sent();
+                    return [4 /*yield*/, nullOut(nullResource.id, 'resource')];
+                case 6:
+                    _w.sent();
+                    return [4 /*yield*/, insertGrant({
+                            principalId: 'purged-user',
+                            resourceId: owner.id,
+                            accessLevel: 'read',
+                        })];
+                case 7:
+                    purgedPrincipal = _w.sent();
+                    return [4 /*yield*/, insertGrant({
+                            principalId: grantee.id,
+                            resourceId: 'purged-row',
+                            accessLevel: 'read',
+                        })];
+                case 8:
+                    purgedResource = _w.sent();
+                    return [4 /*yield*/, insertGrant({
+                            principalId: grantee.id,
+                            resourceId: 'some-thought',
+                            resourceTable: 'thought',
+                            accessLevel: 'write',
+                        })];
+                case 9:
+                    unregisteredTable = _w.sent();
+                    _a = expect;
+                    return [4 /*yield*/, grantById(nullPrincipal.id)];
+                case 10:
+                    _a.apply(void 0, [(_r = (_q = (_w.sent())) === null || _q === void 0 ? void 0 : _q.principal) !== null && _r !== void 0 ? _r : null]).toBeNull();
+                    _b = expect;
+                    return [4 /*yield*/, grantById(nullResource.id)];
+                case 11:
+                    _b.apply(void 0, [(_t = (_s = (_w.sent())) === null || _s === void 0 ? void 0 : _s.resource) !== null && _t !== void 0 ? _t : null]).toBeNull();
+                    seededIds = [
+                        ownerGrant.id,
+                        readGrant.id,
+                        nullPrincipal.id,
+                        nullResource.id,
+                        purgedPrincipal.id,
+                        purgedResource.id,
+                        unregisteredTable.id,
+                    ].sort();
+                    _c = expect;
+                    return [4 /*yield*/, allGrantIds()];
+                case 12:
+                    _c.apply(void 0, [_w.sent()]).toEqual(seededIds);
+                    sweep = new SweepMalformedAccessGrants_1.SweepMalformedAccessGrants();
+                    return [4 /*yield*/, sweep.sweep({ dryRun: true })];
+                case 13:
+                    dry = _w.sent();
+                    expect(dry.dryRun).toBe(true);
+                    expect(dry.malformed).toBe(2);
+                    expect(dry.rows.map(function (row) { return row.id; }).sort()).toEqual([nullPrincipal.id, nullResource.id].sort());
+                    expect(dry.rows.find(function (row) { return row.id === nullPrincipal.id; })).toMatchObject({
+                        resourceTable: user_1.tables.User.name,
+                        accessLevel: 'write',
+                    });
+                    expect(dry.rows.every(function (row) { return typeof row.created === 'string' && row.created.length > 0; })).toBe(true);
+                    _d = expect;
+                    return [4 /*yield*/, allGrantIds()];
+                case 14:
+                    _d.apply(void 0, [_w.sent()]).toEqual(seededIds);
+                    expect(RecordingAccessGrantWatcher.deletedIds).toEqual([]);
+                    return [4 /*yield*/, sweep.sweep({ dryRun: false })];
+                case 15:
+                    real = _w.sent();
+                    expect(real.dryRun).toBe(false);
+                    expect(real.malformed).toBe(2);
+                    _e = expect;
+                    return [4 /*yield*/, grantById(nullPrincipal.id)];
+                case 16:
+                    _e.apply(void 0, [_w.sent()]).toBeUndefined();
+                    _f = expect;
+                    return [4 /*yield*/, grantById(nullResource.id)];
+                case 17:
+                    _f.apply(void 0, [_w.sent()]).toBeUndefined();
+                    // The after-delete watchers saw precisely the deleted rows — the delete rode the Db layer.
+                    expect(RecordingAccessGrantWatcher.deletedIds.sort()).toEqual([nullPrincipal.id, nullResource.id].sort());
+                    // Well-formed rows intact, levels unchanged.
+                    _g = expect;
+                    return [4 /*yield*/, grantById(ownerGrant.id)];
+                case 18:
+                    // Well-formed rows intact, levels unchanged.
+                    _g.apply(void 0, [(_u = (_w.sent())) === null || _u === void 0 ? void 0 : _u.accessLevel]).toBe('owner');
+                    _h = expect;
+                    return [4 /*yield*/, grantById(readGrant.id)];
+                case 19:
+                    _h.apply(void 0, [(_v = (_w.sent())) === null || _v === void 0 ? void 0 : _v.accessLevel]).toBe('read');
+                    // Dangling rows intact — reported below, not deleted.
+                    _j = expect;
+                    return [4 /*yield*/, grantById(purgedPrincipal.id)];
+                case 20:
+                    // Dangling rows intact — reported below, not deleted.
+                    _j.apply(void 0, [_w.sent()]).toBeDefined();
+                    _k = expect;
+                    return [4 /*yield*/, grantById(purgedResource.id)];
+                case 21:
+                    _k.apply(void 0, [_w.sent()]).toBeDefined();
+                    _l = expect;
+                    return [4 /*yield*/, grantById(unregisteredTable.id)];
+                case 22:
+                    _l.apply(void 0, [_w.sent()]).toBeDefined();
+                    _m = expect;
+                    return [4 /*yield*/, allGrantIds()];
+                case 23:
+                    _m.apply(void 0, [_w.sent()]).toEqual([ownerGrant.id, readGrant.id, purgedPrincipal.id, purgedResource.id, unregisteredTable.id].sort());
+                    return [4 /*yield*/, sweep.reportDangling()];
+                case 24:
+                    dangling = _w.sent();
+                    expect(dangling.danglingPrincipal).toBe(1);
+                    expect(dangling.danglingResource).toBe(2);
+                    expect(dangling.rows.find(function (row) { return row.id === purgedPrincipal.id; })).toMatchObject({
+                        principal: 'purged-user',
+                        reason: 'principal missing',
+                    });
+                    expect(dangling.rows.find(function (row) { return row.id === purgedResource.id; })).toMatchObject({
+                        resource: 'purged-row',
+                        reason: 'resource missing',
+                    });
+                    expect(dangling.rows.find(function (row) { return row.id === unregisteredTable.id; })).toMatchObject({
+                        resourceTable: 'thought',
+                        reason: 'resource table not registered',
+                    });
+                    expect(dangling.rows.map(function (row) { return row.id; })).not.toContain(ownerGrant.id);
+                    expect(dangling.rows.map(function (row) { return row.id; })).not.toContain(readGrant.id);
+                    _o = expect;
+                    return [4 /*yield*/, allGrantIds()];
+                case 25:
+                    _o.apply(void 0, [_w.sent()]).toEqual([ownerGrant.id, readGrant.id, purgedPrincipal.id, purgedResource.id, unregisteredTable.id].sort());
+                    // ---------- IDEMPOTENCY: a second real run finds nothing, deletes nothing ----------
+                    RecordingAccessGrantWatcher.deletedIds = [];
+                    return [4 /*yield*/, sweep.sweep({ dryRun: false })];
+                case 26:
+                    again = _w.sent();
+                    expect(again.malformed).toBe(0);
+                    expect(again.rows).toEqual([]);
+                    expect(RecordingAccessGrantWatcher.deletedIds).toEqual([]);
+                    _p = expect;
+                    return [4 /*yield*/, allGrantIds()];
+                case 27:
+                    _p.apply(void 0, [_w.sent()]).toEqual([ownerGrant.id, readGrant.id, purgedPrincipal.id, purgedResource.id, unregisteredTable.id].sort());
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    it('the migration record runs dry-run pass, delete pass, and dangling report; its output carries the rows; a second run is zero', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var ownerGrant, nullPrincipal, purgedPrincipal, migration, output, _a, second, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, insertGrant({ principalId: owner.id, resourceId: owner.id, accessLevel: 'owner' })];
+                case 1:
+                    ownerGrant = _c.sent();
+                    return [4 /*yield*/, insertGrant({ principalId: grantee.id, resourceId: owner.id, accessLevel: 'read' })];
+                case 2:
+                    nullPrincipal = _c.sent();
+                    return [4 /*yield*/, nullOut(nullPrincipal.id, 'principal')];
+                case 3:
+                    _c.sent();
+                    return [4 /*yield*/, insertGrant({
+                            principalId: 'purged-user',
+                            resourceId: owner.id,
+                            accessLevel: 'read',
+                        })];
+                case 4:
+                    purgedPrincipal = _c.sent();
+                    migration = new SweepMalformedAccessGrants_1.SweepMalformedAccessGrants();
+                    expect(migration.table.name).toBe('migration');
+                    return [4 /*yield*/, migration.record.run()];
+                case 5:
+                    output = _c.sent();
+                    expect(output).toMatchObject({
+                        malformedDryRun: 1,
+                        malformed: 1,
+                        danglingPrincipal: 1,
+                        danglingResource: 0,
+                    });
+                    expect(output.malformedRows.map(function (row) { return row.id; })).toEqual([nullPrincipal.id]);
+                    expect(output.danglingRows.map(function (row) { return row.id; })).toEqual([purgedPrincipal.id]);
+                    _a = expect;
+                    return [4 /*yield*/, allGrantIds()];
+                case 6:
+                    _a.apply(void 0, [_c.sent()]).toEqual([ownerGrant.id, purgedPrincipal.id].sort());
+                    expect(RecordingAccessGrantWatcher.deletedIds).toEqual([nullPrincipal.id]);
+                    return [4 /*yield*/, migration.record.run()];
+                case 7:
+                    second = _c.sent();
+                    expect(second).toMatchObject({ malformedDryRun: 0, malformed: 0, danglingPrincipal: 1, danglingResource: 0 });
+                    expect(second.malformedRows).toEqual([]);
+                    _b = expect;
+                    return [4 /*yield*/, allGrantIds()];
+                case 8:
+                    _b.apply(void 0, [_c.sent()]).toEqual([ownerGrant.id, purgedPrincipal.id].sort());
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+});
+//# sourceMappingURL=SweepMalformedAccessGrants.integration.test.js.map