@vorionsys/platform-core 0.1.0

package/dist/common/alerts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/common/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,MAAM,WAAW,SAAS;IACxB,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IACpC,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB;IACzB,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IAC7C,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4BAA4B;IAC5B,QAAQ,EAAE,CAAC,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC;IAC1D,qCAAqC;IACrC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,EAoJlC,CAAC;AAMF,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;AAI5E;;GAEG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAErD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAuBtE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,SAAS,EAAE,CAEhF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,CAEvD"}

package/dist/common/alerts.js

@@ -0,0 +1,216 @@
+/**
+ * Critical Alert Definitions
+ *
+ * Defines alerting rules for trust-critical operations across all Vorion services.
+ * These alerts are consumed by monitoring backends (Grafana, PagerDuty, etc.)
+ * and exported as OpenTelemetry metric-based alerts.
+ *
+ * Priority levels:
+ *   P0 — Immediate: Data integrity at risk (proof chain, signatures)
+ *   P1 — Urgent: Security/trust degradation (auth failures, scoring latency)
+ *   P2 — Important: Service health (error rates, circuit breakers)
+ *   P3 — Warning: Performance (latency budgets, queue depth)
+ */
+import { createLogger } from './logger.js';
+const logger = createLogger({ component: 'alerts' });
+/**
+ * Critical alert rules for the Vorion ecosystem.
+ */
+export const ALERT_RULES = [
+    // ==========================================================================
+    // P0 — Immediate: Data Integrity
+    // ==========================================================================
+    {
+        id: 'proof-chain-hash-mismatch',
+        name: 'Proof Chain Hash Mismatch',
+        priority: 'P0',
+        description: 'Cryptographic proof chain integrity violation detected. Possible tampering or corruption.',
+        metric: 'vorion.proof.hash_mismatch_total',
+        operator: 'gt',
+        threshold: 0,
+        windowSeconds: 60,
+        channels: ['pagerduty', 'slack'],
+        tags: ['security', 'proof', 'integrity'],
+    },
+    {
+        id: 'signature-verification-failure',
+        name: 'Signature Verification Failure Spike',
+        priority: 'P0',
+        description: 'Ed25519 signature verification failures exceed threshold. Key compromise possible.',
+        metric: 'vorion.signatures.verification_failure_rate',
+        operator: 'gt',
+        threshold: 0.01, // >1% failure rate
+        windowSeconds: 300,
+        channels: ['pagerduty', 'slack'],
+        tags: ['security', 'signatures', 'crypto'],
+    },
+    // ==========================================================================
+    // P1 — Urgent: Security & Trust
+    // ==========================================================================
+    {
+        id: 'auth-failure-rate-high',
+        name: 'Authentication Failure Rate High',
+        priority: 'P1',
+        description: 'API authentication failure rate exceeds 5%. Possible credential stuffing or misconfiguration.',
+        metric: 'vorion.auth.failure_rate',
+        operator: 'gt',
+        threshold: 0.05,
+        windowSeconds: 300,
+        channels: ['pagerduty', 'slack'],
+        tags: ['security', 'auth'],
+    },
+    {
+        id: 'trust-scoring-latency-high',
+        name: 'Trust Scoring Latency High',
+        priority: 'P1',
+        description: 'Trust score computation P95 latency exceeds 1 second. May cause governance decision timeouts.',
+        metric: 'vorion.trust.scoring_latency_p95',
+        operator: 'gt',
+        threshold: 1000, // 1 second in ms
+        windowSeconds: 300,
+        channels: ['slack', 'email'],
+        tags: ['performance', 'trust'],
+    },
+    {
+        id: 'circuit-breaker-open',
+        name: 'Circuit Breaker Opened',
+        priority: 'P1',
+        description: 'A critical circuit breaker has entered OPEN state. Dependent service is unavailable.',
+        metric: 'vorion.circuit_breaker.open_total',
+        operator: 'gt',
+        threshold: 0,
+        windowSeconds: 60,
+        channels: ['slack'],
+        tags: ['reliability', 'circuit-breaker'],
+    },
+    {
+        id: 'tripwire-cascade-detected',
+        name: 'Tripwire Cascade Detected',
+        priority: 'P1',
+        description: 'Multiple tripwire violations from a single entity. Possible coordinated attack.',
+        metric: 'vorion.tripwires.cascade_count',
+        operator: 'gte',
+        threshold: 3,
+        windowSeconds: 300,
+        channels: ['pagerduty', 'slack'],
+        tags: ['security', 'tripwires'],
+    },
+    // ==========================================================================
+    // P2 — Important: Service Health
+    // ==========================================================================
+    {
+        id: 'api-error-rate-elevated',
+        name: 'API Error Rate Elevated',
+        priority: 'P2',
+        description: 'API 5xx error rate exceeds 1%. Service may be partially degraded.',
+        metric: 'vorion.api.error_rate_5xx',
+        operator: 'gt',
+        threshold: 0.01,
+        windowSeconds: 300,
+        channels: ['slack'],
+        tags: ['reliability', 'api'],
+    },
+    {
+        id: 'database-connection-pool-exhaustion',
+        name: 'Database Connection Pool Near Exhaustion',
+        priority: 'P2',
+        description: 'Database connection pool utilization exceeds 90%.',
+        metric: 'vorion.db.pool_utilization',
+        operator: 'gt',
+        threshold: 0.9,
+        windowSeconds: 120,
+        channels: ['slack'],
+        tags: ['database', 'reliability'],
+    },
+    {
+        id: 'redis-connection-failure',
+        name: 'Redis Connection Failures',
+        priority: 'P2',
+        description: 'Redis connection failures detected. Cache may be degrading to no-op mode.',
+        metric: 'vorion.redis.connection_failure_total',
+        operator: 'gt',
+        threshold: 5,
+        windowSeconds: 300,
+        channels: ['slack'],
+        tags: ['cache', 'redis'],
+    },
+    // ==========================================================================
+    // P3 — Warning: Performance
+    // ==========================================================================
+    {
+        id: 'api-latency-budget-exceeded',
+        name: 'API Latency Budget Exceeded',
+        priority: 'P3',
+        description: 'API P95 latency exceeds 500ms budget for read operations.',
+        metric: 'vorion.api.latency_p95',
+        operator: 'gt',
+        threshold: 500,
+        windowSeconds: 600,
+        channels: ['slack'],
+        tags: ['performance', 'api'],
+    },
+    {
+        id: 'velocity-throttle-rate-high',
+        name: 'Velocity Throttle Rate High',
+        priority: 'P3',
+        description: 'More than 10% of requests are being throttled by velocity limiter.',
+        metric: 'vorion.velocity.throttle_rate',
+        operator: 'gt',
+        threshold: 0.10,
+        windowSeconds: 600,
+        channels: ['slack'],
+        tags: ['performance', 'velocity'],
+    },
+];
+let _callbacks = [];
+/**
+ * Register a callback for when an alert fires.
+ */
+export function onAlert(callback) {
+    _callbacks.push(callback);
+}
+/**
+ * Evaluate a metric value against all matching alert rules.
+ */
+export function evaluateAlerts(metricName, value) {
+    const matching = ALERT_RULES.filter((r) => r.metric === metricName);
+    for (const rule of matching) {
+        let fired = false;
+        switch (rule.operator) {
+            case 'gt':
+                fired = value > rule.threshold;
+                break;
+            case 'lt':
+                fired = value < rule.threshold;
+                break;
+            case 'gte':
+                fired = value >= rule.threshold;
+                break;
+            case 'lte':
+                fired = value <= rule.threshold;
+                break;
+            case 'eq':
+                fired = value === rule.threshold;
+                break;
+        }
+        if (fired) {
+            logger.warn({ alertId: rule.id, priority: rule.priority, value, threshold: rule.threshold }, `Alert fired: ${rule.name}`);
+            for (const cb of _callbacks) {
+                cb(rule, value);
+            }
+        }
+    }
+}
+/**
+ * Get all alert rules for a specific priority.
+ */
+export function getAlertsByPriority(priority) {
+    return ALERT_RULES.filter((r) => r.priority === priority);
+}
+/**
+ * Get all alert rules tagged with a specific tag.
+ */
+export function getAlertsByTag(tag) {
+    return ALERT_RULES.filter((r) => r.tags.includes(tag));
+}
+//# sourceMappingURL=alerts.js.map

package/dist/common/alerts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alerts.js","sourceRoot":"","sources":["../../src/common/alerts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AA6BrD;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,6EAA6E;IAC7E,iCAAiC;IACjC,6EAA6E;IAC7E;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,2FAA2F;QACxG,MAAM,EAAE,kCAAkC;QAC1C,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,EAAE;QACjB,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC;KACzC;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,sCAAsC;QAC5C,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,oFAAoF;QACjG,MAAM,EAAE,6CAA6C;QACrD,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI,EAAE,mBAAmB;QACpC,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC;KAC3C;IAED,6EAA6E;IAC7E,gCAAgC;IAChC,6EAA6E;IAC7E;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,kCAAkC;QACxC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,+FAA+F;QAC5G,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;KAC3B;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,+FAA+F;QAC5G,MAAM,EAAE,kCAAkC;QAC1C,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI,EAAE,iBAAiB;QAClC,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;KAC/B;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,sFAAsF;QACnG,MAAM,EAAE,mCAAmC;QAC3C,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,EAAE;QACjB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC,aAAa,EAAE,iBAAiB,CAAC;KACzC;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,iFAAiF;QAC9F,MAAM,EAAE,gCAAgC;QACxC,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KAChC;IAED,6EAA6E;IAC7E,iCAAiC;IACjC,6EAA6E;IAC7E;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,mEAAmE;QAChF,MAAM,EAAE,2BAA2B;QACnC,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,qCAAqC;QACzC,IAAI,EAAE,0CAA0C;QAChD,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,mDAAmD;QAChE,MAAM,EAAE,4BAA4B;QACpC,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,GAAG;QACd,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;KAClC;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,2EAA2E;QACxF,MAAM,EAAE,uCAAuC;QAC/C,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;KACzB;IAED,6EAA6E;IAC7E,4BAA4B;IAC5B,6EAA6E;IAC7E;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,2DAA2D;QACxE,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,GAAG;QACd,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,oEAAoE;QACjF,MAAM,EAAE,+BAA+B;QACvC,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;KAClC;CACF,CAAC;AAQF,IAAI,UAAU,GAAoB,EAAE,CAAC;AAErC;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,QAAuB;IAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,KAAa;IAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,KAAK,IAAI;gBAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;gBAAC,MAAM;YACjD,KAAK,IAAI;gBAAE,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;gBAAC,MAAM;YACjD,KAAK,KAAK;gBAAE,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC;gBAAC,MAAM;YACnD,KAAK,KAAK;gBAAE,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC;gBAAC,MAAM;YACnD,KAAK,IAAI;gBAAE,KAAK,GAAG,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC;gBAAC,MAAM;QACrD,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC/E,gBAAgB,IAAI,CAAC,IAAI,EAAE,CAC5B,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA+B;IACjE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/common/authorization.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Authorization Utilities
+ *
+ * Provides role-based access control (RBAC) utilities for API endpoints.
+ * Includes comprehensive audit logging for access denial events.
+ *
+ * @packageDocumentation
+ */
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import { AuthorizationResult as CanonicalAuthorizationResult, AuthorizationConstraints, GovernanceDenialReason, authorizationResultSchema, authorizationConstraintsSchema, governanceDenialReasonSchema } from '@vorionsys/contracts/canonical/governance';
+export { CanonicalAuthorizationResult, AuthorizationConstraints, GovernanceDenialReason, authorizationResultSchema, authorizationConstraintsSchema, governanceDenialReasonSchema, };
+/**
+ * User payload extracted from JWT token
+ */
+export interface AuthUser {
+    sub?: string;
+    tenantId?: string;
+    roles?: string[];
+    groups?: string[];
+    [key: string]: unknown;
+}
+/**
+ * Authorization check result
+ *
+ * @deprecated Use `CanonicalAuthorizationResult` from `@vorionsys/contracts` for new code.
+ *             This interface is maintained for backwards compatibility and is a subset
+ *             of the canonical type. The canonical type includes additional fields for
+ *             denial reasons, permissions, constraints, and remediations.
+ */
+export interface AuthorizationResult {
+    allowed: boolean;
+    reason?: string;
+    matchedRoles?: string[];
+}
+/**
+ * Policy endpoint role definitions
+ */
+export declare const POLICY_ROLES: {
+    /** Roles that can read policies */
+    readonly READ: readonly ["admin", "tenant:admin", "policy:admin", "policy_reader", "policy_writer"];
+    /** Roles that can create and update policies */
+    readonly WRITE: readonly ["admin", "tenant:admin", "policy:admin", "policy_writer"];
+    /** Roles that can delete policies */
+    readonly DELETE: readonly ["admin", "tenant:admin", "policy:admin"];
+};
+/**
+ * Check if user has any of the required roles
+ *
+ * @param userRoles - Array of roles the user has
+ * @param requiredRoles - Array of roles that would grant access
+ * @returns Authorization result with matched roles if allowed
+ */
+export declare function hasAnyRole(userRoles: string[] | undefined, requiredRoles: readonly string[]): AuthorizationResult;
+/**
+ * Check if user has all of the required roles
+ *
+ * @param userRoles - Array of roles the user has
+ * @param requiredRoles - Array of roles that are all required
+ * @returns Authorization result
+ */
+export declare function hasAllRoles(userRoles: string[] | undefined, requiredRoles: readonly string[]): AuthorizationResult;
+/**
+ * Extract user information from Fastify request
+ *
+ * @param request - Fastify request object (with JWT user property)
+ * @returns AuthUser extracted from JWT payload
+ */
+export declare function getAuthUser(request: FastifyRequest): AuthUser;
+/**
+ * Authorization error response structure
+ */
+export interface AuthorizationError {
+    code: 'FORBIDDEN';
+    message: string;
+    requiredRoles?: readonly string[];
+}
+/**
+ * Create a standard 403 Forbidden response
+ *
+ * @param reason - Reason for denial
+ * @param requiredRoles - Optional list of required roles to include in response
+ * @returns Formatted error response
+ */
+export declare function createForbiddenResponse(reason: string, requiredRoles?: readonly string[]): {
+    error: AuthorizationError;
+};
+/**
+ * Higher-order function to create an authorization guard for route handlers
+ *
+ * @param requiredRoles - Roles that grant access to this endpoint
+ * @param options - Additional options for the guard
+ * @returns A preHandler hook function for Fastify
+ *
+ * @example
+ * ```typescript
+ * api.get('/policies', {
+ *   preHandler: requireRoles(POLICY_ROLES.READ),
+ * }, async (request, reply) => {
+ *   // Handler code
+ * });
+ * ```
+ */
+export declare function requireRoles(requiredRoles: readonly string[], options?: {
+    /** Log authorization failures */
+    logFailures?: boolean;
+    /** Custom message for authorization failures */
+    customMessage?: string;
+    /** Record access denial in audit log (default: true) */
+    auditDenials?: boolean;
+}): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+/**
+ * Inline authorization check for use within route handlers
+ * Returns true if authorized, sends 403 response and returns false if not
+ *
+ * @param request - Fastify request object
+ * @param reply - Fastify reply object
+ * @param requiredRoles - Roles that grant access
+ * @param options - Additional options
+ * @returns true if authorized, false if not (response already sent)
+ *
+ * @example
+ * ```typescript
+ * api.delete('/policies/:id', async (request, reply) => {
+ *   if (!await checkAuthorization(request, reply, POLICY_ROLES.DELETE)) {
+ *     return; // Response already sent
+ *   }
+ *   // Handler code
+ * });
+ * ```
+ */
+export declare function checkAuthorization(request: FastifyRequest, reply: FastifyReply, requiredRoles: readonly string[], options?: {
+    logFailures?: boolean;
+    customMessage?: string;
+    /** Record access denial in audit log (default: true) */
+    auditDenials?: boolean;
+}): Promise<boolean>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/common/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/common/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK5D,OAAO,EACL,mBAAmB,IAAI,4BAA4B,EACnD,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC7B,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,CAAC;AAkEF;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB,mCAAmC;;IAEnC,gDAAgD;;IAEhD,qCAAqC;;CAE7B,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/B,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,mBAAmB,CAuBrB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/B,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,mBAAmB,CAuBrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,QAAQ,CAI7D;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAW/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,GAAE;IACP,iCAAiC;IACjC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,YAAY,CAAC,EAAE,OAAO,CAAC;CACnB,GACL,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAgDjE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,YAAY,CAAC,EAAE,OAAO,CAAC;CACnB,GACL,OAAO,CAAC,OAAO,CAAC,CA+ClB"}

package/dist/common/authorization.js

@@ -0,0 +1,270 @@
+/**
+ * Authorization Utilities
+ *
+ * Provides role-based access control (RBAC) utilities for API endpoints.
+ * Includes comprehensive audit logging for access denial events.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from './logger.js';
+import { createAuditService } from '../audit/service.js';
+// Import canonical types from @vorionsys/contracts
+import { GovernanceDenialReason, authorizationResultSchema, authorizationConstraintsSchema, governanceDenialReasonSchema, } from '@vorionsys/contracts/canonical/governance';
+// Re-export canonical types for backwards compatibility
+export { GovernanceDenialReason, authorizationResultSchema, authorizationConstraintsSchema, governanceDenialReasonSchema, };
+const authzLogger = createLogger({ component: 'authorization' });
+// Lazy-initialized audit service for access denial logging
+let auditService = null;
+function getAuditService() {
+    if (!auditService) {
+        auditService = createAuditService();
+    }
+    return auditService;
+}
+/**
+ * Record an access denied audit event
+ * This is called whenever authorization fails to maintain a security audit trail
+ */
+async function recordAccessDeniedAudit(request, user, requiredRoles, reason) {
+    try {
+        const service = getAuditService();
+        const tenantId = user.tenantId;
+        // Even without tenant context, we should log the denial attempt
+        // Use a system tenant ID for cross-tenant/unauthenticated access attempts
+        const effectiveTenantId = tenantId || 'system';
+        await service.record({
+            tenantId: effectiveTenantId,
+            eventType: 'access.denied',
+            actor: {
+                type: 'user',
+                id: user.sub || 'unknown',
+                ip: request.ip,
+            },
+            target: {
+                type: 'system',
+                id: request.url,
+            },
+            action: 'access',
+            outcome: 'failure',
+            reason,
+            metadata: {
+                method: request.method,
+                path: request.url,
+                requiredRoles: [...requiredRoles],
+                userRoles: user.roles || [],
+                userAgent: request.headers['user-agent'],
+                referrer: request.headers['referer'],
+            },
+            requestId: request.id,
+        });
+    }
+    catch (error) {
+        // Don't let audit failures break the authorization flow
+        authzLogger.error({ error, path: request.url, method: request.method }, 'Failed to record access denied audit event');
+    }
+}
+/**
+ * Policy endpoint role definitions
+ */
+export const POLICY_ROLES = {
+    /** Roles that can read policies */
+    READ: ['admin', 'tenant:admin', 'policy:admin', 'policy_reader', 'policy_writer'],
+    /** Roles that can create and update policies */
+    WRITE: ['admin', 'tenant:admin', 'policy:admin', 'policy_writer'],
+    /** Roles that can delete policies */
+    DELETE: ['admin', 'tenant:admin', 'policy:admin'],
+};
+/**
+ * Check if user has any of the required roles
+ *
+ * @param userRoles - Array of roles the user has
+ * @param requiredRoles - Array of roles that would grant access
+ * @returns Authorization result with matched roles if allowed
+ */
+export function hasAnyRole(userRoles, requiredRoles) {
+    const roles = userRoles ?? [];
+    if (roles.length === 0) {
+        return {
+            allowed: false,
+            reason: 'No roles found in token',
+        };
+    }
+    const matchedRoles = roles.filter((role) => requiredRoles.includes(role));
+    if (matchedRoles.length > 0) {
+        return {
+            allowed: true,
+            matchedRoles,
+        };
+    }
+    return {
+        allowed: false,
+        reason: `Required roles: ${requiredRoles.join(', ')}. User roles: ${roles.join(', ')}`,
+    };
+}
+/**
+ * Check if user has all of the required roles
+ *
+ * @param userRoles - Array of roles the user has
+ * @param requiredRoles - Array of roles that are all required
+ * @returns Authorization result
+ */
+export function hasAllRoles(userRoles, requiredRoles) {
+    const roles = userRoles ?? [];
+    if (roles.length === 0) {
+        return {
+            allowed: false,
+            reason: 'No roles found in token',
+        };
+    }
+    const missingRoles = requiredRoles.filter((role) => !roles.includes(role));
+    if (missingRoles.length === 0) {
+        return {
+            allowed: true,
+            matchedRoles: [...requiredRoles],
+        };
+    }
+    return {
+        allowed: false,
+        reason: `Missing required roles: ${missingRoles.join(', ')}`,
+    };
+}
+/**
+ * Extract user information from Fastify request
+ *
+ * @param request - Fastify request object (with JWT user property)
+ * @returns AuthUser extracted from JWT payload
+ */
+export function getAuthUser(request) {
+    // The JWT plugin adds the user property to the request
+    // Cast through unknown to avoid strict type checking
+    return request.user;
+}
+/**
+ * Create a standard 403 Forbidden response
+ *
+ * @param reason - Reason for denial
+ * @param requiredRoles - Optional list of required roles to include in response
+ * @returns Formatted error response
+ */
+export function createForbiddenResponse(reason, requiredRoles) {
+    const error = {
+        code: 'FORBIDDEN',
+        message: reason,
+    };
+    if (requiredRoles) {
+        error.requiredRoles = requiredRoles;
+    }
+    return { error };
+}
+/**
+ * Higher-order function to create an authorization guard for route handlers
+ *
+ * @param requiredRoles - Roles that grant access to this endpoint
+ * @param options - Additional options for the guard
+ * @returns A preHandler hook function for Fastify
+ *
+ * @example
+ * ```typescript
+ * api.get('/policies', {
+ *   preHandler: requireRoles(POLICY_ROLES.READ),
+ * }, async (request, reply) => {
+ *   // Handler code
+ * });
+ * ```
+ */
+export function requireRoles(requiredRoles, options = {}) {
+    const { logFailures = true, customMessage, auditDenials = true } = options;
+    return async (request, reply) => {
+        const user = getAuthUser(request);
+        const result = hasAnyRole(user.roles, requiredRoles);
+        if (!result.allowed) {
+            if (logFailures) {
+                authzLogger.warn({
+                    userId: user.sub,
+                    tenantId: user.tenantId,
+                    userRoles: user.roles,
+                    requiredRoles: [...requiredRoles],
+                    path: request.url,
+                    method: request.method,
+                    reason: result.reason,
+                }, 'Authorization denied');
+            }
+            // Record access denial in audit log for security compliance
+            if (auditDenials) {
+                const reason = result.reason ?? `Required roles: ${requiredRoles.join(', ')}`;
+                // Don't await - fire and forget to avoid blocking the response
+                recordAccessDeniedAudit(request, user, requiredRoles, reason).catch(() => {
+                    // Error already logged in recordAccessDeniedAudit
+                });
+            }
+            const message = customMessage ?? `Access denied: ${result.reason}`;
+            return reply.status(403).send(createForbiddenResponse(message, requiredRoles));
+        }
+        // Authorization passed - log at debug level for audit trail
+        authzLogger.debug({
+            userId: user.sub,
+            tenantId: user.tenantId,
+            matchedRoles: result.matchedRoles,
+            path: request.url,
+            method: request.method,
+        }, 'Authorization granted');
+    };
+}
+/**
+ * Inline authorization check for use within route handlers
+ * Returns true if authorized, sends 403 response and returns false if not
+ *
+ * @param request - Fastify request object
+ * @param reply - Fastify reply object
+ * @param requiredRoles - Roles that grant access
+ * @param options - Additional options
+ * @returns true if authorized, false if not (response already sent)
+ *
+ * @example
+ * ```typescript
+ * api.delete('/policies/:id', async (request, reply) => {
+ *   if (!await checkAuthorization(request, reply, POLICY_ROLES.DELETE)) {
+ *     return; // Response already sent
+ *   }
+ *   // Handler code
+ * });
+ * ```
+ */
+export async function checkAuthorization(request, reply, requiredRoles, options = {}) {
+    const { logFailures = true, customMessage, auditDenials = true } = options;
+    const user = getAuthUser(request);
+    const result = hasAnyRole(user.roles, requiredRoles);
+    if (!result.allowed) {
+        if (logFailures) {
+            authzLogger.warn({
+                userId: user.sub,
+                tenantId: user.tenantId,
+                userRoles: user.roles,
+                requiredRoles: [...requiredRoles],
+                path: request.url,
+                method: request.method,
+                reason: result.reason,
+            }, 'Authorization denied');
+        }
+        // Record access denial in audit log for security compliance
+        if (auditDenials) {
+            const reason = result.reason ?? `Required roles: ${requiredRoles.join(', ')}`;
+            // Don't await - fire and forget to avoid blocking the response
+            recordAccessDeniedAudit(request, user, requiredRoles, reason).catch(() => {
+                // Error already logged in recordAccessDeniedAudit
+            });
+        }
+        const message = customMessage ?? `Access denied: ${result.reason}`;
+        await reply.status(403).send(createForbiddenResponse(message, requiredRoles));
+        return false;
+    }
+    authzLogger.debug({
+        userId: user.sub,
+        tenantId: user.tenantId,
+        matchedRoles: result.matchedRoles,
+        path: request.url,
+        method: request.method,
+    }, 'Authorization granted');
+    return true;
+}
+//# sourceMappingURL=authorization.js.map

package/dist/common/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/common/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAqB,MAAM,qBAAqB,CAAC;AAE5E,mDAAmD;AACnD,OAAO,EAGL,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,2CAA2C,CAAC;AAEnD,wDAAwD;AACxD,OAAO,EAGL,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,CAAC;AAEF,MAAM,WAAW,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;AAEjE,2DAA2D;AAC3D,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C,SAAS,eAAe;IACtB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,kBAAkB,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAAuB,EACvB,IAAc,EACd,aAAgC,EAChC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,gEAAgE;QAChE,0EAA0E;QAC1E,MAAM,iBAAiB,GAAG,QAAQ,IAAI,QAAQ,CAAC;QAE/C,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,QAAQ,EAAE,iBAAiB;YAC3B,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,SAAS;gBACzB,EAAE,EAAE,OAAO,CAAC,EAAE;aACf;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,OAAO,CAAC,GAAG;aAChB;YACD,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,SAAS;YAClB,MAAM;YACN,QAAQ,EAAE;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,OAAO,CAAC,GAAG;gBACjB,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC;gBACjC,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC3B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACxC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;aACrC;YACD,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wDAAwD;QACxD,WAAW,CAAC,KAAK,CACf,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACpD,4CAA4C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AA2BD;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,mCAAmC;IACnC,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC;IACjF,gDAAgD;IAChD,KAAK,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,CAAC;IACjE,qCAAqC;IACrC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC;CACzC,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,SAA+B,EAC/B,aAAgC;IAEhC,MAAM,KAAK,GAAG,SAAS,IAAI,EAAE,CAAC;IAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yBAAyB;SAClC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY;SACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACvF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,SAA+B,EAC/B,aAAgC;IAEhC,MAAM,KAAK,GAAG,SAAS,IAAI,EAAE,CAAC;IAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yBAAyB;SAClC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,CAAC,GAAG,aAAa,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,2BAA2B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,uDAAuD;IACvD,qDAAqD;IACrD,OAAQ,OAAyC,CAAC,IAAI,CAAC;AACzD,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,aAAiC;IAEjC,MAAM,KAAK,GAAuB;QAChC,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,MAAM;KAChB,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAgC,EAChC,UAOI,EAAE;IAEN,MAAM,EAAE,WAAW,GAAG,IAAI,EAAE,aAAa,EAAE,YAAY,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAE3E,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAErD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,CAAC,IAAI,CACd;oBACE,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,IAAI,CAAC,KAAK;oBACrB,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC;oBACjC,IAAI,EAAE,OAAO,CAAC,GAAG;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,EACD,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9E,+DAA+D;gBAC/D,uBAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACvE,kDAAkD;gBACpD,CAAC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,aAAa,IAAI,kBAAkB,MAAM,CAAC,MAAM,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACjF,CAAC;QAED,4DAA4D;QAC5D,WAAW,CAAC,KAAK,CACf;YACE,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,IAAI,EAAE,OAAO,CAAC,GAAG;YACjB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,EACD,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,KAAmB,EACnB,aAAgC,EAChC,UAKI,EAAE;IAEN,MAAM,EAAE,WAAW,GAAG,IAAI,EAAE,aAAa,EAAE,YAAY,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC3E,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,CACd;gBACE,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC;gBACjC,IAAI,EAAE,OAAO,CAAC,GAAG;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,EACD,sBAAsB,CACvB,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,+DAA+D;YAC/D,uBAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACvE,kDAAkD;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,IAAI,kBAAkB,MAAM,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,KAAK,CACf;QACE,MAAM,EAAE,IAAI,CAAC,GAAG;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,OAAO,CAAC,GAAG;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,EACD,uBAAuB,CACxB,CAAC;IAEF,OAAO,IAAI,CAAC;AACd,CAAC"}