@volcanicminds/backend 3.6.1 → 4.0.0

package/dist/lib/loader/router.js

@@ -58,21 +58,50 @@ async function loadMiddlewares(base, middlewares = []) {
     }
     return midds;
 }
-export function processRoute(route, index, file, dir, base, defaultConfig, authMiddlewares, validRoutes) {
-    const errors = [];
-    const { method: methodCase, path: pathName = '/', handler, roles: rs = [], config = {}, middlewares = [], rateLimit, cache: cacheInput } = route;
-    const rsp = !rs.length ? [roles.public] : rs;
-    let requiredRoles = [];
-    try {
-        requiredRoles = rsp.some((r) => r.code === roles.admin.code) ? rsp : [...rsp, roles.admin];
+function resolveRequiredRoles(rs, capability, where, roleErrors) {
+    const declared = [];
+    for (const ref of rs) {
+        if (ref == null) {
+            roleErrors.push(`${where} → references an undefined role`);
+        }
+        else if (typeof ref === 'string') {
+            const resolved = roles[ref];
+            if (resolved)
+                declared.push(resolved);
+            else
+                roleErrors.push(`${where} → unknown role '${ref}' (not declared in config/roles.ts)`);
+        }
+        else if (ref.code) {
+            declared.push(ref);
+        }
+        else {
+            roleErrors.push(`${where} → a declared role has no code`);
+        }
     }
-    catch (err) {
-        if (log.e)
-            log.error(`Error in loading roles for ${methodCase} ${pathName} (${handler})`);
-        if (log.t)
-            log.trace(err);
-        config.enable = false;
+    const capRoles = capability
+        ? Object.values(roles).filter((r) => Array.isArray(r.capabilities) && r.capabilities.includes(capability))
+        : [];
+    if (capability && capRoles.length === 0 && log?.w) {
+        log.warn(`Route ${where} requires capability '${capability}' held by no role — admin-only`);
+    }
+    const seen = new Set();
+    const out = [];
+    for (const r of [...declared, ...capRoles]) {
+        if (r?.code && !seen.has(r.code)) {
+            seen.add(r.code);
+            out.push(r);
+        }
     }
+    if (out.length === 0 && !capability)
+        out.push(roles.public);
+    if (!out.some((r) => r.code === roles.admin.code))
+        out.push(roles.admin);
+    return out;
+}
+export function processRoute(route, index, file, dir, base, defaultConfig, authMiddlewares, validRoutes, roleErrors = []) {
+    const errors = [];
+    const { method: methodCase, path: pathName = '/', handler, roles: rs = [], requireCapability, config = {}, middlewares = [], rateLimit, cache: cacheInput } = route;
+    const requiredRoles = resolveRequiredRoles(rs, requireCapability, `${methodCase} ${pathName} (${handler})`, roleErrors);
     const reqAuth = middlewares.some((m) => authMiddlewares.includes(m)) ||
         requiredRoles.every((r) => r.code !== roles.public.code);
     if (!config?.security && reqAuth) {
@@ -149,6 +178,7 @@ export function processRoute(route, index, file, dir, base, defaultConfig, authM
 }
 async function load() {
     const validRoutes = [];
+    const roleErrors = [];
     const patterns = normalizePatterns(['..', 'api', '**', 'routes.{ts,js}'], ['src', 'api', '**', 'routes.{ts,js}']);
     const authMiddlewares = ['global.isAuthenticated', 'global.isAdmin'];
     for (const pattern of patterns) {
@@ -167,13 +197,19 @@ async function load() {
             if (log.t)
                 log.trace(`* Add ${routes.length} routes from ${file}`);
             routes.forEach((route, index) => {
-                const configuredRoute = processRoute(route, index, file, dir, base, defaultConfig, authMiddlewares, validRoutes);
+                const configuredRoute = processRoute(route, index, file, dir, base, defaultConfig, authMiddlewares, validRoutes, roleErrors);
                 if (configuredRoute) {
                     validRoutes.push(configuredRoute);
                 }
             });
         }
     }
+    if (roleErrors.length) {
+        const message = `Route/role integrity check failed — every route role must be declared in config/roles.ts:\n  - ${roleErrors.join('\n  - ')}`;
+        if (log?.f)
+            log.fatal(message);
+        throw new Error(message);
+    }
     return validRoutes;
 }
 async function applyRoutes(server, routes) {

package/dist/lib/loader/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../lib/loader/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,eAAe,CAAA;AAG9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AAE1C,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAE5E,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAA;IACjC,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACd,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,aAAqB,EAAE;IACjE,MAAM,GAAG,GAAG,SAAS,CAAA;IACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,IAAI,YAAY,GAAQ,IAAI,CAAA;IAE5B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,kBAAkB,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;QACjF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,kBAAkB,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;QAEnF,YAAY,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAA;QAElE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;YAC1E,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,cAAc,GAAG,UAAU,CAAC,CAAA;QACtE,YAAY,GAAG,MAAM,aAAa,CAAC,aAAa,GAAG,KAAK,CAAC,CAAA;QACzD,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,MAAM,aAAa,CAAC,aAAa,GAAG,KAAK,CAAC,CAAA;QAC5E,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAA;IACtE,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,cAAc,UAAU,aAAa,CAAC,CAAA;QAChD,MAAM,IAAI,KAAK,CAAC,cAAc,UAAU,aAAa,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,cAAwB,EAAE;IACrE,MAAM,KAAK,GAA6B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAChD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;YAClC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAGD,MAAM,UAAU,YAAY,CAC1B,KAAY,EACZ,KAAa,EACb,IAAY,EACZ,GAAW,EACX,IAAY,EACZ,aAAkB,EAClB,eAAyB,EACzB,WAA8B;IAE9B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,EACJ,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,QAAQ,GAAG,GAAG,EACpB,OAAO,EACP,KAAK,EAAE,EAAE,GAAG,EAAE,EACd,MAAM,GAAG,EAAiB,EAC1B,WAAW,GAAG,EAAE,EAChB,SAAS,EACT,KAAK,EAAE,UAAU,EAClB,GAAG,KAAK,CAAA;IAET,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5C,IAAI,aAAa,GAAW,EAAE,CAAA;IAE9B,IAAI,CAAC;QAIH,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,8BAA8B,UAAU,IAAI,QAAQ,KAAK,OAAO,GAAG,CAAC,CAAA;QACzF,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACzB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAA;IACvB,CAAC;IAED,MAAM,OAAO,GACX,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpD,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE1D,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC5B,CAAC;IAED,MAAM,EACJ,KAAK,GAAG,EAAE,EACV,WAAW,GAAG,EAAE,EAChB,MAAM,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EACvC,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,EAChD,aAAa,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,EACrD,IAAI,GAAG,aAAa,CAAC,IAAI,EACzB,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,EAAE,EACrC,QAAQ,GAAG,aAAa,CAAC,QAAQ,EACjC,KAAK,EACL,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,GAAG,KAAK,EAChB,GAAG,MAAM,IAAI,EAAE,CAAA;IAEhB,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAA;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAA;IACrB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEvC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,eAAe,QAAQ,iBAAiB,GAAG,EAAE,CAAC,CAAA;QAC1G,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,MAAM,iBAAiB,GAAG,EAAE,CAAC,CAAA;QAC1G,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,kBAAkB,OAAO,iBAAiB,GAAG,EAAE,CAAC,CAAA;QAK5G,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,QAAQ,GAAG,OAAO,EAAE,CAAA;QAC7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,sBAAsB,QAAQ,iBAAiB,GAAG,EAAE,CAAC,CAAA;QACpF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,CAAC;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,GAAG,CAAC,CAAC;YACP,GAAG,CAAC,KAAK,CACP,aAAa,MAAM,UAAU,QAAQ,YAAY,OAAO,iBACtD,WAAW,EAAE,MAAM,IAAI,CACzB,cAAc,CACf,CAAA;IACL,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,UAAU,QAAQ,YAAY,OAAO,kBAAkB,CAAC,CAAA;IACjG,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK;YACd,WAAW;YACX,UAAU;YACV,IAAI;YACJ,OAAO;YACP,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;YAC7D,QAAQ;SACF,CAAA;QAER,IAAI,KAAK;YAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAA;QAClC,IAAI,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;QAC/B,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;QACzB,IAAI,QAAQ;YAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAA;QAErC,OAAO;YACL,OAAO;YACP,MAAM;YACN,IAAI,EAAE,GAAG,GAAG,QAAQ;YACpB,WAAW;YACX,KAAK,EAAE,aAAa;YACpB,MAAM;YACN,aAAa;YACb,OAAO;YACP,SAAS;YAGT,KAAK,EAAE,mBAAmB,CAAC,UAAU,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC;YACnE,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,IAAI,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACrB,GAAG,EAAE,GAAG;YAGR,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,IAAI,aAAa,EAAE,QAAQ,EAAE,KAAK;YAChE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI,aAAa,EAAE,QAAQ,EAAE,QAAQ;SAC1E,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAsB,EAAE,CAAA;IACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAA;IACjH,MAAM,eAAe,GAAG,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAA;IAEpE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAA;QAE/D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAE7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAA;YAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAA;YACzC,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,QAAQ,IAAI,EAAE,CAAA;YAElE,IAAI,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,gBAAgB,IAAI,EAAE,CAAC,CAAA;YAElE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAY,EAAE,KAAa,EAAE,EAAE;gBAC7C,MAAM,eAAe,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,CAAC,CAAA;gBAChH,IAAI,eAAe,EAAE,CAAC;oBACpB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAW,EAAE,MAAyB;IAC/D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;QACnD,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,8BAA8B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAEvF,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,GAClH,KAAK,CAAA;YAEP,IAAI,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,cAAc,OAAO,EAAE,CAAC,CAAA;YACzE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;YAItD,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAIxG,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACpB,IAAI,GAAG,CAAC,CAAC;wBACP,GAAG,CAAC,IAAI,CACN,kBAAkB,MAAM,IAAI,IAAI,2FAA2F,CAC5H,CAAA;gBACL,CAAC;qBAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;oBACjB,MAAM,KAAK,GAAa,EAAE,CAAA;oBAC1B,IAAI,KAAK,EAAE,OAAO;wBAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,GAAG,IAAI,SAAS,eAAe,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAA;oBACxG,IAAI,KAAK,EAAE,WAAW,EAAE,MAAM;wBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC3F,GAAG,CAAC,KAAK,CAAC,kBAAkB,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,GAAG;gBACX,GAAG,KAAK;gBACR,MAAM,EAAE;oBACN,aAAa,EAAE,KAAK,IAAI,EAAE;oBAC1B,OAAO,EAAE,OAAO,IAAI,KAAK;oBACzB,SAAS,EAAE,SAAS,IAAI,SAAS;oBACjC,aAAa,EAAE,aAAa;oBAC5B,KAAK,EAAE,KAAK,IAAI,SAAS;iBAC1B;gBACD,OAAO,EAAE,KAAK,WAAW,GAAmB,EAAE,KAAmB;oBAC/D,IAAI,MAAM,CAAA;oBACV,IAAI,CAAC;wBACH,IAAI,CAAC;4BACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAA;wBACrC,CAAC;wBAAC,MAAM,CAAC;4BACP,IAAI,CAAC;gCACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAA;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,CAAC,CAAC;4BAAE,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,KAAK,GAAG,EAAE,CAAC,CAAA;wBAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;oBAClE,CAAC;oBAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;wBAClD,IAAI,GAAG,CAAC,CAAC;4BAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,iBAAiB,IAAI,EAAE,CAAC,CAAA;wBAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;oBAClE,CAAC;oBAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACvC,CAAC;aACF,CAAA;YAED,IAAI,UAAU,EAAE,UAAU,EAAE,CAAC;gBAG3B,QAAQ,CAAC,UAAU,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAE,KAAa,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAA;YACrF,CAAC;YACD,IAAI,UAAU,EAAE,MAAM;gBAAE,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAE3D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAEtB,WAAW,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,MAAW;IACrC,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;IAG3B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAC1C,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../lib/loader/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,eAAe,CAAA;AAG9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AAEnC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AAE1C,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAE5E,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAA;IACjC,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACd,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,aAAqB,EAAE;IACjE,MAAM,GAAG,GAAG,SAAS,CAAA;IACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,IAAI,YAAY,GAAQ,IAAI,CAAA;IAE5B,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,kBAAkB,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;QACjF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,kBAAkB,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;QAEnF,YAAY,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAA;QAElE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,iBAAiB,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;YAC1E,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,cAAc,GAAG,UAAU,CAAC,CAAA;QACtE,YAAY,GAAG,MAAM,aAAa,CAAC,aAAa,GAAG,KAAK,CAAC,CAAA;QACzD,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,MAAM,aAAa,CAAC,aAAa,GAAG,KAAK,CAAC,CAAA;QAC5E,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAA;IACtE,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,cAAc,UAAU,aAAa,CAAC,CAAA;QAChD,MAAM,IAAI,KAAK,CAAC,cAAc,UAAU,aAAa,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,cAAwB,EAAE;IACrE,MAAM,KAAK,GAA6B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAChD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;YAClC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAQD,SAAS,oBAAoB,CAC3B,EAAqB,EACrB,UAA8B,EAC9B,KAAa,EACb,UAAoB;IAEpB,MAAM,QAAQ,GAAW,EAAE,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,EAAE,EAAE,CAAC;QACrB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAA;QAC5D,CAAC;aAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;;gBAChC,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,GAAG,qCAAqC,CAAC,CAAA;QAC5F,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAW,UAAU;QACjC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC1G,CAAC,CAAC,EAAE,CAAA;IACN,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,yBAAyB,UAAU,gCAAgC,CAAC,CAAA;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAW,EAAE,CAAA;IACtB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACxE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAY,EACZ,KAAa,EACb,IAAY,EACZ,GAAW,EACX,IAAY,EACZ,aAAkB,EAClB,eAAyB,EACzB,WAA8B,EAC9B,aAAuB,EAAE;IAEzB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,EACJ,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,QAAQ,GAAG,GAAG,EACpB,OAAO,EACP,KAAK,EAAE,EAAE,GAAG,EAAE,EACd,iBAAiB,EACjB,MAAM,GAAG,EAAiB,EAC1B,WAAW,GAAG,EAAE,EAChB,SAAS,EACT,KAAK,EAAE,UAAU,EAClB,GAAG,KAAK,CAAA;IAET,MAAM,aAAa,GAAG,oBAAoB,CACxC,EAAE,EACF,iBAAiB,EACjB,GAAG,UAAU,IAAI,QAAQ,KAAK,OAAO,GAAG,EACxC,UAAU,CACX,CAAA;IAED,MAAM,OAAO,GACX,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpD,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE1D,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC5B,CAAC;IAED,MAAM,EACJ,KAAK,GAAG,EAAE,EACV,WAAW,GAAG,EAAE,EAChB,MAAM,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EACvC,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,EAChD,aAAa,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,EACrD,IAAI,GAAG,aAAa,CAAC,IAAI,EACzB,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,EAAE,EACrC,QAAQ,GAAG,aAAa,CAAC,QAAQ,EACjC,KAAK,EACL,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,OAAO,GAAG,KAAK,EAChB,GAAG,MAAM,IAAI,EAAE,CAAA;IAEhB,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAA;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAA;IACrB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEvC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,eAAe,QAAQ,iBAAiB,GAAG,EAAE,CAAC,CAAA;QAC1G,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,MAAM,iBAAiB,GAAG,EAAE,CAAC,CAAA;QAC1G,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,kBAAkB,OAAO,iBAAiB,GAAG,EAAE,CAAC,CAAA;QAK5G,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,QAAQ,GAAG,OAAO,EAAE,CAAA;QAC7C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,sBAAsB,QAAQ,iBAAiB,GAAG,EAAE,CAAC,CAAA;QACpF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,CAAC;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,GAAG,CAAC,CAAC;YACP,GAAG,CAAC,KAAK,CACP,aAAa,MAAM,UAAU,QAAQ,YAAY,OAAO,iBACtD,WAAW,EAAE,MAAM,IAAI,CACzB,cAAc,CACf,CAAA;IACL,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,UAAU,QAAQ,YAAY,OAAO,kBAAkB,CAAC,CAAA;IACjG,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK;YACd,WAAW;YACX,UAAU;YACV,IAAI;YACJ,OAAO;YACP,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ;YAC7D,QAAQ;SACF,CAAA;QAER,IAAI,KAAK;YAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAA;QAClC,IAAI,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;QAC/B,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;QACzB,IAAI,QAAQ;YAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAA;QAErC,OAAO;YACL,OAAO;YACP,MAAM;YACN,IAAI,EAAE,GAAG,GAAG,QAAQ;YACpB,WAAW;YACX,KAAK,EAAE,aAAa;YACpB,MAAM;YACN,aAAa;YACb,OAAO;YACP,SAAS;YAGT,KAAK,EAAE,mBAAmB,CAAC,UAAU,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC;YACnE,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,UAAU,IAAI,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACrB,GAAG,EAAE,GAAG;YAGR,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,IAAI,aAAa,EAAE,QAAQ,EAAE,KAAK;YAChE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI,aAAa,EAAE,QAAQ,EAAE,QAAQ;SAC1E,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,WAAW,GAAsB,EAAE,CAAA;IACzC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAA;IACjH,MAAM,eAAe,GAAG,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAA;IAEpE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAA;QAE/D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAE7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAA;YAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAA;YACzC,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,QAAQ,IAAI,EAAE,CAAA;YAElE,IAAI,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,gBAAgB,IAAI,EAAE,CAAC,CAAA;YAElE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAY,EAAE,KAAa,EAAE,EAAE;gBAC7C,MAAM,eAAe,GAAG,YAAY,CAClC,KAAK,EACL,KAAK,EACL,IAAI,EACJ,GAAG,EACH,IAAI,EACJ,aAAa,EACb,eAAe,EACf,WAAW,EACX,UAAU,CACX,CAAA;gBACD,IAAI,eAAe,EAAE,CAAC;oBACpB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,kGAAkG,UAAU,CAAC,IAAI,CAC/H,QAAQ,CACT,EAAE,CAAA;QACH,IAAI,GAAG,EAAE,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAW,EAAE,MAAyB;IAC/D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;QACnD,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,SAAS,MAAM,CAAC,MAAM,8BAA8B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAEvF,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,GAClH,KAAK,CAAA;YAEP,IAAI,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,cAAc,OAAO,EAAE,CAAC,CAAA;YACzE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;YAItD,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAIxG,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACpB,IAAI,GAAG,CAAC,CAAC;wBACP,GAAG,CAAC,IAAI,CACN,kBAAkB,MAAM,IAAI,IAAI,2FAA2F,CAC5H,CAAA;gBACL,CAAC;qBAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;oBACjB,MAAM,KAAK,GAAa,EAAE,CAAA;oBAC1B,IAAI,KAAK,EAAE,OAAO;wBAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,GAAG,IAAI,SAAS,eAAe,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAA;oBACxG,IAAI,KAAK,EAAE,WAAW,EAAE,MAAM;wBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC3F,GAAG,CAAC,KAAK,CAAC,kBAAkB,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAQ;gBACpB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,GAAG;gBACX,GAAG,KAAK;gBACR,MAAM,EAAE;oBACN,aAAa,EAAE,KAAK,IAAI,EAAE;oBAC1B,OAAO,EAAE,OAAO,IAAI,KAAK;oBACzB,SAAS,EAAE,SAAS,IAAI,SAAS;oBACjC,aAAa,EAAE,aAAa;oBAC5B,KAAK,EAAE,KAAK,IAAI,SAAS;iBAC1B;gBACD,OAAO,EAAE,KAAK,WAAW,GAAmB,EAAE,KAAmB;oBAC/D,IAAI,MAAM,CAAA;oBACV,IAAI,CAAC;wBACH,IAAI,CAAC;4BACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAA;wBACrC,CAAC;wBAAC,MAAM,CAAC;4BACP,IAAI,CAAC;gCACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAA;4BACrC,CAAC;4BAAC,MAAM,CAAC;gCACP,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,GAAG,CAAC,CAAC;4BAAE,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,KAAK,GAAG,EAAE,CAAC,CAAA;wBAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;oBAClE,CAAC;oBAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;wBAClD,IAAI,GAAG,CAAC,CAAC;4BAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,iBAAiB,IAAI,EAAE,CAAC,CAAA;wBAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;oBAClE,CAAC;oBAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACvC,CAAC;aACF,CAAA;YAED,IAAI,UAAU,EAAE,UAAU,EAAE,CAAC;gBAG3B,QAAQ,CAAC,UAAU,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAE,KAAa,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAA;YACrF,CAAC;YACD,IAAI,UAAU,EAAE,MAAM;gBAAE,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAE3D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAEtB,WAAW,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,MAAW;IACrC,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAA;IAG3B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAC1C,CAAC"}

package/dist/lib/util/authz.d.ts

@@ -0,0 +1,4 @@
+export declare function roleCodes(value: unknown): string[];
+export declare function includesRole(value: unknown, code: string): boolean;
+export declare function isFounderEmail(email: unknown): boolean;
+//# sourceMappingURL=authz.d.ts.map

package/dist/lib/util/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../../lib/util/authz.ts"],"names":[],"mappings":"AAKA,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAMlD;AAGD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAMD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGtD"}

package/dist/lib/util/authz.js

@@ -0,0 +1,16 @@
+export function roleCodes(value) {
+    if (!Array.isArray(value))
+        return [];
+    const codes = value
+        .map((r) => (typeof r === 'string' ? r : r?.code))
+        .filter((c) => !!c);
+    return [...new Set(codes)];
+}
+export function includesRole(value, code) {
+    return roleCodes(value).includes(code);
+}
+export function isFounderEmail(email) {
+    const founder = process.env.ADMIN_EMAIL?.trim().toLowerCase();
+    return !!founder && typeof email === 'string' && email.trim().toLowerCase() === founder;
+}
+//# sourceMappingURL=authz.js.map

package/dist/lib/util/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../../lib/util/authz.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,KAAK;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA8B,EAAE,IAAI,CAAC,CAAC;SAC/E,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAClC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5B,CAAC;AAGD,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,IAAY;IACvD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAMD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAA;AACzF,CAAC"}

package/dist/types/global.d.ts

@@ -27,6 +27,10 @@ export interface Role {
   code: string
   name: string
   description: string
+  // Capabilities granted to this role (see docs/AUTHORIZATION_MODEL.md §3). Named only
+  // in config, resolved at boot, never at runtime. `admin`/`public` are protected
+  // built-ins and never carry capabilities (locked by the roles loader).
+  capabilities?: string[]
 }
 
 export interface Roles {
@@ -94,7 +98,12 @@ export interface Route {
   method: string
   path: string
   handler: string
-  roles: Role[]
+  // Role objects (from the global `roles` catalog) or bare string codes; string codes
+  // are resolved and validated against the catalog at load (unknown code → fail-fast).
+  roles: (Role | string)[]
+  // Gate on a capability: the allowed set becomes admin + every role that declares it.
+  // A capability held by no role leaves the route admin-only. See docs/AUTHORIZATION_MODEL.md §3.
+  requireCapability?: string
   middlewares: string[]
   config?: RouteConfig
   rateLimit?: any

package/lib/api/admin/controller/manifest.ts

@@ -2,8 +2,8 @@ import { FastifyReply, FastifyRequest } from 'fastify'
 import { generateManifest } from '../../../manifest/generator.js'
 
 // GET /admin/manifest — full Manifest v2 (declared roles). Gating is enforced by the
-// route (roles:[admin, backoffice] + isAuthenticated); the manifest itself is not
-// per-user — clients filter capabilities against the declared per-capability roles.
+// route (`manifest` capability + isAuthenticated); the manifest itself is not per-user
+// — clients filter capabilities against the declared per-capability roles.
 export function get(req: FastifyRequest, reply: FastifyReply) {
   const server = (req.server as any) || global.server
   return reply.send(generateManifest(server))

package/lib/api/admin/routes.ts

@@ -14,10 +14,9 @@ export default {
     {
       method: 'GET',
       path: '/manifest',
-      // `backoffice` is allowed too: operators with limited roles still need the
-      // manifest to boot the admin UI — the client hides what their roles cannot
-      // reach (declared per-capability `roles`), and every API route still enforces.
-      roles: [roles.admin, roles.backoffice],
+      // A role granted the `manifest` capability can load the admin console; the client
+      // hides what the caller's roles cannot reach and every API route still enforces.
+      requireCapability: 'manifest',
       handler: 'manifest.get',
       middlewares: ['global.isAuthenticated'],
       config: {

package/lib/api/auth/controller/auth.ts

@@ -50,21 +50,18 @@ export async function register(req: FastifyRequest, reply: FastifyReply) {
     return reply.status(400).send({ statusCode: 400, error: 'Bad Request', message: 'Repeated password not match' })
   }
 
-  let existings = await req.server['userManager'].retrieveUserByEmail(data.email, req.runner)
+  const existings = await req.server['userManager'].retrieveUserByEmail(data.email, req.runner)
   if (existings) {
     return reply.status(400).send({ statusCode: 400, error: 'Bad Request', message: 'Email already registered' })
   }
 
-  if ((data.requiredRoles || []).includes('admin')) {
-    existings = await req.server['userManager'].findQuery({ 'roles:in': 'admin' }, req.runner)
-    if (existings?.records?.length) {
-      return reply.status(400).send({ statusCode: 400, error: 'Bad Request', message: 'User admin already registered' })
-    }
-  }
-
-  // public is the default
+  // Registration never grants the admin role — the admin apex is provisioned only at boot
+  // from ADMIN_EMAIL (see docs/AUTHORIZATION_MODEL.md §6). `public` is the default.
   const publicRole = global.roles?.public?.code || 'public'
-  data.roles = (data.requiredRoles || []).map((r) => global.roles[r]?.code).filter((r) => !!r)
+  const adminRole = global.roles?.admin?.code || 'admin'
+  data.roles = (data.requiredRoles || [])
+    .map((r) => global.roles[r]?.code)
+    .filter((r) => !!r && r !== adminRole)
   if (!data.roles.includes(publicRole)) {
     data.roles.push(publicRole)
   }

package/lib/api/token/controller/token.ts

@@ -1,4 +1,15 @@
 import { FastifyReply, FastifyRequest } from 'fastify'
+import { includesRole } from '../../../util/authz.js'
+
+// Rule A: only an admin may grant a token the admin role, and only with
+// allow_multiple_admin — otherwise a `tokens` capability holder could mint an admin
+// token and escalate. Tokens carry roles used for authorization (see onRequest).
+function assignsAdmin(req: FastifyRequest, roleValue: unknown): boolean {
+  return (
+    includesRole(roleValue, roles.admin.code) &&
+    (!req.hasRole(roles.admin) || config.options?.allow_multiple_admin !== true)
+  )
+}
 
 export async function count(req: FastifyRequest, _reply: FastifyReply) {
   return await req.server['tokenManager'].countQuery(req.data(), req.runner)
@@ -30,6 +41,10 @@ export async function create(req: FastifyRequest, reply: FastifyReply) {
     data.roles.push(publicRole)
   }
 
+  if (assignsAdmin(req, data.roles)) {
+    return reply.status(403).send({ statusCode: 403, error: 'Forbidden', message: 'Cannot assign the admin role to a token' })
+  }
+
   let token = await req.server['tokenManager'].createToken(data, req.runner)
   if (!token || !token.getId() || !token.externalId) {
     return reply.status(400).send({ statusCode: 400, error: 'Bad Request', message: 'Token not registered' })
@@ -76,14 +91,13 @@ export async function update(req: FastifyRequest, reply: FastifyReply) {
   }
 
   const data = req.data() || {}
+  if (assignsAdmin(req, data.roles)) {
+    return reply.status(403).send({ statusCode: 403, error: 'Forbidden', message: 'Cannot assign the admin role to a token' })
+  }
   return req.server['tokenManager'].updateTokenById(token.getId(), data, req.runner)
 }
 
-export async function block(req: FastifyRequest, reply: FastifyReply) {
-  if (!req.hasRole(roles.admin) && !req.hasRole(roles.backoffice)) {
-    return reply.status(403).send({ statusCode: 403, code: 'ROLE_NOT_ALLOWED', message: 'Not allowed to block a user' })
-  }
-
+export async function block(req: FastifyRequest, _reply: FastifyReply) {
   const { id: userId } = req.parameters()
   const { reason } = req.data()
 
@@ -92,13 +106,7 @@ export async function block(req: FastifyRequest, reply: FastifyReply) {
   return { ok: !!token.getId() }
 }
 
-export async function unblock(req: FastifyRequest, reply: FastifyReply) {
-  if (!req.hasRole(roles.admin) && !req.hasRole(roles.backoffice)) {
-    return reply
-      .status(403)
-      .send({ statusCode: 403, code: 'ROLE_NOT_ALLOWED', message: 'Not allowed to unblock a user' })
-  }
-
+export async function unblock(req: FastifyRequest, _reply: FastifyReply) {
   const { id: userId } = req.parameters()
   await req.server['tokenManager'].unblockTokenById(userId, req.runner)
   const token = await req.server['tokenManager'].retrieveTokenById(userId, req.runner)

package/lib/api/token/routes.ts

@@ -12,7 +12,7 @@ export default {
     {
       method: 'GET',
       path: '/',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.find',
       middlewares: [],
       config: {
@@ -31,7 +31,7 @@ export default {
     {
       method: 'GET',
       path: '/count',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.count',
       middlewares: [],
       config: {
@@ -48,7 +48,7 @@ export default {
     {
       method: 'GET',
       path: '/:id',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.findOne',
       middlewares: [],
       config: {
@@ -66,7 +66,7 @@ export default {
     {
       method: 'POST',
       path: '/',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.create',
       middlewares: ['global.isAuthenticated'],
       config: {
@@ -84,7 +84,7 @@ export default {
     {
       method: 'PUT',
       path: '/:id',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.update',
       middlewares: ['global.isAuthenticated'],
       config: {
@@ -103,7 +103,7 @@ export default {
     {
       method: 'DELETE',
       path: '/:id',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.remove',
       middlewares: ['global.isAuthenticated'],
       config: {
@@ -118,7 +118,7 @@ export default {
     {
       method: 'POST',
       path: '/block/:id',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.block',
       middlewares: ['global.isAuthenticated'],
       config: {
@@ -134,7 +134,7 @@ export default {
     {
       method: 'POST',
       path: '/unblock/:id',
-      roles: [roles.admin, roles.backoffice],
+      requireCapability: 'tokens',
       handler: 'token.unblock',
       middlewares: ['global.isAuthenticated'],
       config: {

package/lib/api/users/controller/user.ts

@@ -1,6 +1,17 @@
 import { FastifyReply, FastifyRequest } from 'fastify'
 import type { AuthenticatedUser } from '../../../../types/global.js'
 import { MfaPolicy } from '../../../config/constants.js'
+import { includesRole, isFounderEmail } from '../../../util/authz.js'
+
+const forbidden = (reply: FastifyReply, message: string) =>
+  reply.status(403).send({ statusCode: 403, error: 'Forbidden', message })
+
+// The admin role is a restricted apex (default single, see allow_multiple_admin). This
+// guards against dropping to zero admins, which would lock the instance out.
+async function isLastAdmin(req: FastifyRequest): Promise<boolean> {
+  const total = await req.server['userManager'].countQuery({ 'roles:in': roles.admin.code }, req.runner)
+  return Number(total) <= 1
+}
 
 export async function getRoles(_req: FastifyRequest, reply: FastifyReply) {
   const allRoles = Object.keys(roles).map((key) => roles[key])
@@ -23,21 +34,15 @@ export async function findOne(req: FastifyRequest, reply: FastifyReply) {
 }
 
 export async function create(req: FastifyRequest, reply: FastifyReply) {
-  if (!req.hasRole(roles.admin)) {
-    return reply.status(403).send({ statusCode: 403, error: 'Forbidden', message: 'Only admins can create users' })
-  }
-
   const { id: _id, ...data } = req.data()
 
-  // Roles may arrive as string codes (JSON body: ['admin']) or as role objects
-  // ({ code: 'admin', ... }); normalize to codes before checking.
-  const roleCodes = (data.roles || []).map((r: string | { code?: string }) => (typeof r === 'string' ? r : r?.code))
-  if (roleCodes.includes(roles.admin.code)) {
-    if (config.options?.allow_multiple_admin !== true) {
-      return reply
-        .status(403)
-        .send({ statusCode: 403, error: 'Forbidden', message: 'Cannot assign admin role to a user' })
-    }
+  // Rule A: assigning the admin role requires an admin caller AND allow_multiple_admin.
+  // The `users` capability alone can manage users but never mint an admin.
+  if (
+    includesRole(data.roles, roles.admin.code) &&
+    (!req.hasRole(roles.admin) || config.options?.allow_multiple_admin !== true)
+  ) {
+    return forbidden(reply, 'Cannot assign the admin role')
   }
 
   // Pass req.runner so creation lands in the resolved tenant schema (multi-tenant);
@@ -68,6 +73,42 @@ export async function update(req: FastifyRequest, reply: FastifyReply) {
   }
 
   const { id: _id, ...userData } = req.data()
+
+  const target = await req.server['userManager'].retrieveUserById(id, req.runner)
+  const targetIsAdmin = includesRole(target?.roles, roles.admin.code)
+  const changingRoles = Object.prototype.hasOwnProperty.call(userData, 'roles')
+
+  // Sovereign founder: cannot be demoted or have its email changed via the API
+  // (transfer happens via env + redeploy).
+  if (isFounderEmail(target?.email)) {
+    if (changingRoles && !includesRole(userData.roles, roles.admin.code)) {
+      return forbidden(reply, 'Cannot demote the sovereign admin')
+    }
+    if (
+      typeof userData.email === 'string' &&
+      userData.email.trim().toLowerCase() !== (target.email || '').trim().toLowerCase()
+    ) {
+      return forbidden(reply, 'Cannot change the sovereign admin email')
+    }
+  }
+
+  // Rule B: only an admin may modify an admin subject.
+  if (targetIsAdmin && !req.hasRole(roles.admin)) {
+    return forbidden(reply, 'Cannot modify an admin user')
+  }
+  // Rule A: assigning the admin role requires an admin caller AND allow_multiple_admin.
+  if (
+    changingRoles &&
+    includesRole(userData.roles, roles.admin.code) &&
+    (!req.hasRole(roles.admin) || config.options?.allow_multiple_admin !== true)
+  ) {
+    return forbidden(reply, 'Cannot assign the admin role')
+  }
+  // Never drop to zero admins: refuse demoting the last admin.
+  if (targetIsAdmin && changingRoles && !includesRole(userData.roles, roles.admin.code) && (await isLastAdmin(req))) {
+    return forbidden(reply, 'Cannot demote the last admin')
+  }
+
   return await req.server['userManager'].updateUserById(id, userData, req.runner)
 }
 
@@ -76,6 +117,23 @@ export async function remove(req: FastifyRequest, reply: FastifyReply) {
   if (!id) {
     return reply.status(404).send()
   }
+
+  const target = await req.server['userManager'].retrieveUserById(id, req.runner)
+  const targetIsAdmin = includesRole(target?.roles, roles.admin.code)
+
+  // Sovereign founder: cannot be deleted.
+  if (isFounderEmail(target?.email)) {
+    return forbidden(reply, 'Cannot delete the sovereign admin')
+  }
+  // Rule B: only an admin may delete an admin subject.
+  if (targetIsAdmin && !req.hasRole(roles.admin)) {
+    return forbidden(reply, 'Cannot delete an admin user')
+  }
+  // Never drop to zero admins.
+  if (targetIsAdmin && (await isLastAdmin(req))) {
+    return forbidden(reply, 'Cannot delete the last admin')
+  }
+
   return await req.server['userManager'].deleteUser(id, req.runner)
 }
 
@@ -126,13 +184,24 @@ export async function block(req: FastifyRequest, reply: FastifyReply) {
     throw new Error('Not implemented')
   }
 
-  if (!req.hasRole(roles.admin) && !req.hasRole(roles.backoffice)) {
-    return reply.status(403).send({ statusCode: 403, code: 'ROLE_NOT_ALLOWED', message: 'Not allowed to block a user' })
-  }
-
   const { id: userId } = req.parameters()
   const { reason } = req.data()
 
+  const target = await req.server['userManager'].retrieveUserById(userId, req.runner)
+  const targetIsAdmin = includesRole(target?.roles, roles.admin.code)
+  // Sovereign founder: cannot be blocked.
+  if (isFounderEmail(target?.email)) {
+    return forbidden(reply, 'Cannot block the sovereign admin')
+  }
+  // Rule B: only an admin may block an admin subject.
+  if (targetIsAdmin && !req.hasRole(roles.admin)) {
+    return forbidden(reply, 'Cannot block an admin user')
+  }
+  // Never drop to zero admins (blocking the last admin locks the instance out).
+  if (targetIsAdmin && (await isLastAdmin(req))) {
+    return forbidden(reply, 'Cannot block the last admin')
+  }
+
   let user = await req.server['userManager'].blockUserById(userId, reason, req.runner)
   user = await req.server['userManager'].resetExternalId(user.getId(), req.runner)
   return { ok: !!user.getId() }
@@ -143,13 +212,14 @@ export async function unblock(req: FastifyRequest, reply: FastifyReply) {
     throw new Error('Not implemented')
   }
 
-  if (!req.hasRole(roles.admin) && !req.hasRole(roles.backoffice)) {
-    return reply
-      .status(403)
-      .send({ statusCode: 403, code: 'ROLE_NOT_ALLOWED', message: 'Not allowed to unblock a user' })
+  const { id: userId } = req.parameters()
+
+  const target = await req.server['userManager'].retrieveUserById(userId, req.runner)
+  // Rule B: only an admin may unblock an admin subject.
+  if (includesRole(target?.roles, roles.admin.code) && !req.hasRole(roles.admin)) {
+    return forbidden(reply, 'Cannot unblock an admin user')
   }
 
-  const { id: userId } = req.parameters()
   const user = await req.server['userManager'].unblockUserById(userId, req.runner)
   return { ok: !!user.getId() }
 }
@@ -165,6 +235,11 @@ export async function resetMfaByAdmin(req: FastifyRequest, reply: FastifyReply)
     return reply.status(400).send({ statusCode: 400, error: 'Bad Request', message: 'Missing user id' })
   }
 
+  const mfaTarget = await req.server['userManager'].retrieveUserById(id, req.runner)
+  if (isFounderEmail(mfaTarget?.email) && !isFounderEmail(req.user?.email)) {
+    return forbidden(reply, 'Cannot reset the sovereign admin MFA')
+  }
+
   try {
     await req.server['userManager'].disableMfa(id, req.runner)
     return { ok: true }
@@ -200,6 +275,10 @@ export async function resetPasswordByAdmin(req: FastifyRequest, reply: FastifyRe
       return reply.status(404).send({ statusCode: 404, error: 'Not Found', message: 'User not found' })
     }
 
+    if (isFounderEmail(user.email) && !isFounderEmail(req.user?.email)) {
+      return forbidden(reply, 'Cannot reset the sovereign admin password')
+    }
+
     await req.server['userManager'].resetPassword(user, password, req.runner)
     return { ok: true }
   } catch (error) {