@wildo-ai/saas-backend-lib 1.1.0 → 1.1.2

package/dist/esm/security/authorizations/initiator-organization-confinement.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"initiator-organization-confinement.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAoBH,sFAAsF;AACtF,MAAM,CAAC,MAAM,wCAAwC,GAAG,gBAAgB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8CAA8C,CAAyB,MAOtF;IACC,MAAM,uBAAuB,GAAG,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,cAAc,CAAC;IACrF,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,4FAA4F;IAC5F,2EAA2E;IAC3E,IAAI,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,wCAAwC,CAAC;WACnE,CAAC,MAAM,CAAC,gBAAgB,CAAC,wCAAwC,CAAC,EACrE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,iCAAiC,CAC5E,MAAM,CAAC,UAAU,EACjB,wCAAwC,CACzC,CAAC;IAEF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YACpF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["/**\n * Initiator-organization confinement — ONE definition, compiled by both adapters (D3).\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines a query to the tenant the\n * caller is acting in.\n *\n * A caller's `initiatorIds.organizationId` is not a value they can choose: the execution-context\n * creator validates a requested organization against their MEMBERSHIPS and refuses one they do\n * not belong to. So it is a trustworthy statement of \"the tenant this request is acting in\", and\n * rows of other tenants are not part of what was asked for.\n *\n * **Why this exists as an authority rather than a repository branch.** PostgreSQL applied this\n * confinement and MongoDB did not — divergence D3, and the only measured divergence where the\n * two adapters disagreed about WHO CAN SEE WHOSE ROWS. Under the layering principle that\n * tenancy is a resource-system rule and adapters carry dialect only, a predicate about who may\n * read what has no business being written twice, or once.\n *\n * **The crossing is the part that was missing, and it is why the PostgreSQL version was wrong.**\n * The platform declares deliberate, reviewed cross-tenant doors per operation variant\n * (`admitsCrossTenantPlatformAdministration`) — `organizationMembers.grantOwnership`, the\n * owner-floor repair door, is one. Those are admitted at the AUTHORIZATION layer, before any\n * repository runs. A confinement that does not know about them lets authorization admit the\n * crossing and then silently filters the query to the operator's own tenant — so the repair door\n * reports success and repairs nothing, which is precisely the failure mode\n * `.claude/rules/administrative-continuity-floors.md` warns about.\n *\n * So: confine by default, and step aside ONLY for an operation that has declared the crossing.\n */\n\n/** What this authority needs from the execution context. Deliberately narrow, like its siblings. */\nexport interface InitiatorOrganizationConfinementSignal {\n  readonly initiatorIds?: { readonly organizationId?: string | null } | null;\n  /**\n   * The operation being executed. Only its crossing declaration is read — an operation that\n   * did NOT declare one is confined, which is what makes the opt-in enumerable rather than a\n   * privilege-based bypass.\n   */\n  readonly operation?: { readonly admitsCrossTenantPlatformAdministration?: boolean } | null;\n}\n\n/** The schema-path operations this rule performs, supplied by the resource layer. */\nexport interface InitiatorOrganizationConfinementPathResolver {\n  findNestedFieldPathsFromZodSchema(mainSchema: any, fieldIdentifier: string): string[];\n  hasNestedPath(target: object, path: string): boolean;\n  setNestedValue(target: object, path: string, value: unknown): void;\n}\n\n/** The field this confinement is keyed on. Named once so no call site can typo it. */\nexport const INITIATOR_ORGANIZATION_CONFINEMENT_FIELD = 'organizationId';\n\n/**\n * Confine `filter` to the caller's organization, unless the operation declares a crossing.\n *\n * Returns whether the confinement was applied, so a caller can report or pin the decision\n * rather than having to re-derive it.\n *\n * Precedence deliberately matches the relationship-FK sibling and NOT the retention hide: an\n * already-present path is left alone. A value at this key was put there by the context layer\n * from the addressed URL scope, which the authorization layer has already reconciled against\n * the caller; overwriting it here would silently re-scope a request that was legitimately\n * addressed elsewhere.\n *\n * `isFieldPersisted` exists because PostgreSQL can be stricter than MongoDB: it knows which\n * columns are actually planned, and filtering on an unplanned one is a SQL error rather than a\n * no-op. MongoDB passes a predicate that is always true.\n */\nexport function assignInitiatorOrganizationConfinementToFilter<TFilter extends object>(params: {\n  readonly filter: TFilter;\n  readonly executionContext: InitiatorOrganizationConfinementSignal;\n  readonly blacklistedFields: ReadonlySet<string>;\n  readonly mainSchema: unknown;\n  readonly schemaPaths: InitiatorOrganizationConfinementPathResolver;\n  readonly isFieldPersisted: (fieldName: string) => boolean;\n}): boolean {\n  const initiatorOrganizationId = params.executionContext.initiatorIds?.organizationId;\n  if (!initiatorOrganizationId) {\n    return false;\n  }\n\n  // A DECLARED crossing is the whole point of the opt-in: the authorization layer has already\n  // admitted this operation across the tenant boundary, and re-confining it here would undo a\n  // decision that was made deliberately, with an audit record, one layer up.\n  if (params.executionContext.operation?.admitsCrossTenantPlatformAdministration === true) {\n    return false;\n  }\n\n  if (\n    params.blacklistedFields.has(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n    || !params.isFieldPersisted(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n  ) {\n    return false;\n  }\n\n  const organizationPaths = params.schemaPaths.findNestedFieldPathsFromZodSchema(\n    params.mainSchema,\n    INITIATOR_ORGANIZATION_CONFINEMENT_FIELD,\n  );\n\n  let applied = false;\n  organizationPaths.forEach((fullPath) => {\n    if (!params.schemaPaths.hasNestedPath(params.filter, fullPath)) {\n      params.schemaPaths.setNestedValue(params.filter, fullPath, initiatorOrganizationId);\n      applied = true;\n    }\n  });\n\n  return applied;\n}\n"]}
+{"version":3,"file":"initiator-organization-confinement.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAoBH,sFAAsF;AACtF,MAAM,CAAC,MAAM,wCAAwC,GAAG,gBAAgB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8CAA8C,CAAyB,MAOtF;IACC,MAAM,uBAAuB,GAAG,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,cAAc,CAAC;IACrF,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,4FAA4F;IAC5F,2EAA2E;IAC3E,IAAI,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,wCAAwC,CAAC;WACnE,CAAC,MAAM,CAAC,gBAAgB,CAAC,wCAAwC,CAAC,EACrE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,iCAAiC,CAC5E,MAAM,CAAC,UAAU,EACjB,wCAAwC,CACzC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YACpF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["/**\n * Initiator-organization confinement — ONE definition, compiled by both adapters (D3).\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines a query to the tenant the\n * caller is acting in.\n *\n * A caller's `initiatorIds.organizationId` is not a value they can choose: the execution-context\n * creator validates a requested organization against their MEMBERSHIPS and refuses one they do\n * not belong to. So it is a trustworthy statement of \"the tenant this request is acting in\", and\n * rows of other tenants are not part of what was asked for.\n *\n * **Why this exists as an authority rather than a repository branch.** PostgreSQL applied this\n * confinement and MongoDB did not — divergence D3, and the only measured divergence where the\n * two adapters disagreed about WHO CAN SEE WHOSE ROWS. Under the layering principle that\n * tenancy is a resource-system rule and adapters carry dialect only, a predicate about who may\n * read what has no business being written twice, or once.\n *\n * **The crossing is the part that was missing, and it is why the PostgreSQL version was wrong.**\n * The platform declares deliberate, reviewed cross-tenant doors per operation variant\n * (`admitsCrossTenantPlatformAdministration`) — `organizationMembers.grantOwnership`, the\n * owner-floor repair door, is one. Those are admitted at the AUTHORIZATION layer, before any\n * repository runs. A confinement that does not know about them lets authorization admit the\n * crossing and then silently filters the query to the operator's own tenant — so the repair door\n * reports success and repairs nothing, which is precisely the failure mode\n * `.claude/rules/administrative-continuity-floors.md` warns about.\n *\n * So: confine by default, and step aside ONLY for an operation that has declared the crossing.\n */\n\n/** What this authority needs from the execution context. Deliberately narrow, like its siblings. */\nexport interface InitiatorOrganizationConfinementSignal {\n  readonly initiatorIds?: { readonly organizationId?: string | null } | null;\n  /**\n   * The operation being executed. Only its crossing declaration is read — an operation that\n   * did NOT declare one is confined, which is what makes the opt-in enumerable rather than a\n   * privilege-based bypass.\n   */\n  readonly operation?: { readonly admitsCrossTenantPlatformAdministration?: boolean } | null;\n}\n\n/** The schema-path operations this rule performs, supplied by the resource layer. */\nexport interface InitiatorOrganizationConfinementPathResolver {\n  findNestedFieldPathsFromZodSchema(mainSchema: any, fieldIdentifier: string): string[];\n  hasNestedPath(target: object, path: string): boolean;\n  setNestedValue(target: object, path: string, value: unknown): void;\n}\n\n/** The field this confinement is keyed on. Named once so no call site can typo it. */\nexport const INITIATOR_ORGANIZATION_CONFINEMENT_FIELD = 'organizationId';\n\n/**\n * Confine `filter` to the caller's organization, unless the operation declares a crossing.\n *\n * Returns whether the confinement was applied, so a caller can report or pin the decision\n * rather than having to re-derive it.\n *\n * Precedence deliberately matches the relationship-FK sibling and NOT the retention hide: an\n * already-present path is left alone. A value at this key was put there by the context layer\n * from the addressed URL scope, which the authorization layer has already reconciled against\n * the caller; overwriting it here would silently re-scope a request that was legitimately\n * addressed elsewhere.\n *\n * `isFieldPersisted` exists because PostgreSQL can be stricter than MongoDB: it knows which\n * columns are actually planned, and filtering on an unplanned one is a SQL error rather than a\n * no-op. MongoDB passes a predicate that is always true.\n */\nexport function assignInitiatorOrganizationConfinementToFilter<TFilter extends object>(params: {\n  readonly filter: TFilter;\n  readonly executionContext: InitiatorOrganizationConfinementSignal;\n  readonly blacklistedFields: ReadonlySet<string>;\n  readonly mainSchema: unknown;\n  readonly schemaPaths: InitiatorOrganizationConfinementPathResolver;\n  readonly isFieldPersisted: (fieldName: string) => boolean;\n}): boolean {\n  const initiatorOrganizationId = params.executionContext.initiatorIds?.organizationId;\n  if (!initiatorOrganizationId) {\n    return false;\n  }\n\n  // A DECLARED crossing is the whole point of the opt-in: the authorization layer has already\n  // admitted this operation across the tenant boundary, and re-confining it here would undo a\n  // decision that was made deliberately, with an audit record, one layer up.\n  if (params.executionContext.operation?.admitsCrossTenantPlatformAdministration === true) {\n    return false;\n  }\n\n  if (\n    params.blacklistedFields.has(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n    || !params.isFieldPersisted(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n  ) {\n    return false;\n  }\n\n  /*\n   * TOP-LEVEL PATHS ONLY — a correction measured on 2026-09-01, in both directions at once.\n   *\n   * `findNestedFieldPathsFromZodSchema` returns EVERY schema path ending in `organizationId`,\n   * and the first control-plane resource to reach this rule over HTTP\n   * (`wildoApplicationActorTasks`) models one NESTED occurrence:\n   * `errorStates.errorItems.initiatorIds.organizationId` — a RECORDED FACT about a past error's\n   * initiator, not a tenancy column. Confining on it failed differently per adapter, and the loud\n   * failure was the harmless one:\n   *\n   * - PostgreSQL: `invalid column reference errorStates.errorItems.initiatorIds.organizationId`\n   *   — a 400 on every LIST. Visible, kind.\n   * - MongoDB: `{ \"errorStates…organizationId\": org }` matches only rows where a nested error\n   *   item CARRIES that value — so every row with no recorded errors would silently vanish from\n   *   its OWN tenant's listings. Invisible, and the dangerous direction\n   *   (`negative-results-require-a-positive-probe.md`: under-reporting reads as truth).\n   *\n   * Top-level is not an approximation of the rule — it IS the rule. The write path's own\n   * invariant (documented at the contextual-filter builder beside\n   * `enrichDataWithContextFields`) is that a scoped resource always carries its scope FK as a\n   * top-level column; tenancy never lives only inside a nested value. A deeper occurrence of the\n   * field NAME is data about something else and was never this confinement's subject.\n   */\n  const organizationPaths = params.schemaPaths.findNestedFieldPathsFromZodSchema(\n    params.mainSchema,\n    INITIATOR_ORGANIZATION_CONFINEMENT_FIELD,\n  ).filter((fullPath) => !fullPath.includes('.'));\n\n  let applied = false;\n  organizationPaths.forEach((fullPath) => {\n    if (!params.schemaPaths.hasNestedPath(params.filter, fullPath)) {\n      params.schemaPaths.setNestedValue(params.filter, fullPath, initiatorOrganizationId);\n      applied = true;\n    }\n  });\n\n  return applied;\n}\n"]}

package/dist/esm/security/authorizations/privileged-access-review.backend.utils.d.ts

@@ -0,0 +1,117 @@
+import { type User } from '@wildo-ai/saas-models';
+import type { AuthExecutionContextFactoryBackendService } from '../../security/authentications/services/auth-execution-context-factory.backend.service';
+import type { ErrorBuilderBackendService } from '../../errors/services/error-builder.backend.service';
+import type { RepositoriesRegistryHandlerBackendService } from '../../base-classes/services/repositories/repositories-registry-handler.backend.service';
+/**
+ * WHO currently holds privileged access — the enumeration a periodic privileged-access review reads.
+ *
+ * assurance-control: WILDO.ACCESS.PRIVILEGED_REVIEW — enumerate the principals holding privileged
+ * access, at both scopes, so a review has an explicitly scoped population to decide over.
+ *
+ * ## What this is, and the three things it deliberately is NOT
+ *
+ * The objective demands four things of an application: privileged access is explicitly SCOPED, it is
+ * PERIODICALLY REVIEWED, the review is DECIDED BY AUTHORIZED PEOPLE, and the outcome is RETAINED as
+ * traceable evidence. Wildo supplies the first honestly and can supply the raw material for the
+ * second. It supplies neither of the last two, and this module must not look as though it does.
+ *
+ * - **It does not schedule.** Nothing here fires periodically; a caller decides when to look.
+ * - **It does not decide.** No row is marked reviewed, approved or revoked. A reviewer's judgement is
+ *   a human act with named accountability, and a framework that recorded one would be asserting a
+ *   decision nobody made — the same line the governed-document fact families draw.
+ * - **It records no evidence.** The review OCCURRENCE — who reviewed, when, what they concluded — is
+ *   the application's to supply as a declared host artifact, because Wildo cannot witness it. The
+ *   general question of where a control's evidence lives is a separate design (#269), and answering
+ *   it here for one control is exactly the one-off this route was chosen to avoid.
+ *
+ * The objective's own caveat survives all of this and is worth restating where the code is: evidence
+ * is retained *without implying remediation completion*. A review record proves a review happened,
+ * never that what it found was fixed. Nothing this module returns should be read as remediation.
+ *
+ * ## Why it OWNS its execution context
+ *
+ * Same reason as `measureOrganizationsMissingUsableOwner`, and the failure recorded there is exactly
+ * the one that would bite here: an estate-wide read needs an `INTERNALLY_INITIATED_REQUEST` context to
+ * escape scope-root collection confinement, and a caller-supplied context that is role-less — or that
+ * carries a plausible-but-wrong execution-type string — silently confines the read to no tenants and
+ * returns an EMPTY population. An empty privileged-access review is indistinguishable from a healthy
+ * one, and it is the direction that reads as good news.
+ *
+ * ## Conferring roles come from the LIVE table, and are the caller's to resolve
+ *
+ * Both floors resolve their conferring set from the role table through `inheritFrom` rather than
+ * comparing role strings, because a custom role that inherits the authority confers it. This takes
+ * both sets as parameters for the same reason those functions do: the resolvers are lazy container
+ * bindings, and taking the answer keeps this module free of the container.
+ */
+/** One principal holding APPLICATION-scope privileged access. */
+export interface PrivilegedApplicationAccessHolder {
+    readonly userId: string;
+    readonly email?: string;
+    /** The roles this principal holds that confer the authority — what a reviewer decides about. */
+    readonly conferringRolesHeld: readonly string[];
+}
+/** One principal holding ORGANIZATION-scope privileged access, and where. */
+export interface PrivilegedOrganizationAccessHolder {
+    readonly organizationId: string;
+    readonly organizationName?: string;
+    readonly membershipId: string;
+    readonly userId?: string;
+    readonly conferringRolesHeld: readonly string[];
+}
+/**
+ * The privileged-access population as it stands, at both scopes.
+ *
+ * `observedAt` is the instant the enumeration was taken, and it is the caller's to supply — this
+ * module reads no clock, so the same estate enumerates to the same value twice. A report that stamped
+ * its own "now" would be a different artifact on every run for reasons unrelated to access.
+ */
+export interface PrivilegedAccessPopulation {
+    readonly observedAt: string;
+    readonly applicationScopeConferringRoles: readonly string[];
+    readonly organizationScopeConferringRoles: readonly string[];
+    readonly applicationScopeHolders: readonly PrivilegedApplicationAccessHolder[];
+    readonly organizationScopeHolders: readonly PrivilegedOrganizationAccessHolder[];
+    /**
+     * Tenants the enumeration could not read a membership list for.
+     *
+     * REPORTED rather than skipped: a tenant silently absent from a privileged-access review reads as a
+     * tenant with no privileged access, which is the wrong direction to be wrong in
+     * (`.claude/rules/negative-results-require-a-positive-probe.md`). A reviewer must be told what was
+     * not looked at.
+     */
+    readonly unreadableOrganizationIds: readonly string[];
+}
+/**
+ * Enumerate every principal holding privileged access, at both scopes.
+ *
+ * Fail-closed on the APPLICATION scope and best-effort per tenant on the ORGANIZATION scope, and the
+ * asymmetry is deliberate. A missing users repository makes the whole population unknowable, so
+ * answering at all would be a guess; one unreadable tenant leaves the rest of the review perfectly
+ * usable, provided the reviewer is told which tenant is missing — which `unreadableOrganizationIds`
+ * is for.
+ */
+export declare function enumeratePrivilegedAccessPopulation(params: {
+    authExecutionContextFactory: AuthExecutionContextFactoryBackendService;
+    repositoriesRegistry: RepositoriesRegistryHandlerBackendService;
+    errorBuilder: ErrorBuilderBackendService;
+    /** From `resolveSuperAdminConferringRoles` — the live table's answer, not a role-string comparison. */
+    applicationScopeConferringRoles: readonly string[];
+    /** From `resolveOrganizationOwnerConferringRoles`. */
+    organizationScopeConferringRoles: readonly string[];
+    /** The instant this enumeration describes. Supplied, never read from a clock here. */
+    observedAt: string;
+}): Promise<PrivilegedAccessPopulation>;
+/**
+ * Whether a membership's LINKED USER can still authenticate.
+ *
+ * Exported because a reviewer's most common question about an organization-scope holder is whether
+ * the person behind it is still able to act, and the answer lives on a different row than the one the
+ * enumeration returns. Kept as a predicate over a supplied user rather than a second read, so a
+ * caller batches the lookup it already needs.
+ *
+ * The two statuses are the owner floor's own vocabulary
+ * ({@link ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES}), not a second list.
+ */
+export declare function privilegedOrganizationHolderCanAuthenticate(user: Pick<User, 'status'> | undefined | null): boolean;
+//# sourceMappingURL=privileged-access-review.backend.utils.d.ts.map

package/dist/esm/security/authorizations/privileged-access-review.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privileged-access-review.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/privileged-access-review.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgE,KAAK,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAEhH,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAGnH,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAYrK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,iEAAiE;AACjE,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gGAAgG;IAChG,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,6EAA6E;AAC7E,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5D,QAAQ,CAAC,gCAAgC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7D,QAAQ,CAAC,uBAAuB,EAAE,SAAS,iCAAiC,EAAE,CAAC;IAC/E,QAAQ,CAAC,wBAAwB,EAAE,SAAS,kCAAkC,EAAE,CAAC;IACjF;;;;;;;OAOG;IACH,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;CACvD;AAUD;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,CAAC,MAAM,EAAE;IAChE,2BAA2B,EAAE,yCAAyC,CAAC;IACvE,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,uGAAuG;IACvG,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,sDAAsD;IACtD,gCAAgC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAqFtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2CAA2C,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAElH"}

package/dist/esm/security/authorizations/privileged-access-review.backend.utils.js

@@ -0,0 +1,104 @@
+import { CoreResourceType } from '@wildo-ai/saas-models';
+import { ErrorType } from '@wildo-ai/saas-models';
+import { ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES, createOrganizationOwnerFloorPopulationContext, isAdministrativelyUsableMembershipStatus, isAdministrativelyUsableOwnerUserStatus, rolesConferOrganizationOwner, } from './organization-owner-floor.backend.utils.js';
+import { ADMINISTRATIVELY_USABLE_USER_STATUSES, isUsableSuperAdmin } from './super-admin-floor.backend.utils.js';
+function readRows(candidates) {
+    return Array.isArray(candidates) ? candidates : [];
+}
+/**
+ * Enumerate every principal holding privileged access, at both scopes.
+ *
+ * Fail-closed on the APPLICATION scope and best-effort per tenant on the ORGANIZATION scope, and the
+ * asymmetry is deliberate. A missing users repository makes the whole population unknowable, so
+ * answering at all would be a guess; one unreadable tenant leaves the rest of the review perfectly
+ * usable, provided the reviewer is told which tenant is missing — which `unreadableOrganizationIds`
+ * is for.
+ */
+export async function enumeratePrivilegedAccessPopulation(params) {
+    const executionContext = await createOrganizationOwnerFloorPopulationContext(params.authExecutionContextFactory);
+    const userRepository = params.repositoriesRegistry.getRepository(CoreResourceType.USERS);
+    if (!userRepository) {
+        throw params.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {
+            context: {
+                message: 'Cannot enumerate privileged access: the users repository is not registered',
+                resourceType: CoreResourceType.USERS,
+            },
+        });
+    }
+    /*
+     * The query narrows on the conferring roles and the usable statuses, and the predicate re-checks
+     * both. Not redundant: the query is what keeps this from materialising every user, and the
+     * predicate is what makes the answer exact when a row's status is out of vocabulary — the second
+     * way an ownerless tenant escaped the owner-floor backstop, recorded there.
+     */
+    const applicationCandidates = await userRepository.list(executionContext, {
+        appRoles: { $in: [...params.applicationScopeConferringRoles] },
+        status: { $in: [...ADMINISTRATIVELY_USABLE_USER_STATUSES] },
+    });
+    const applicationScopeHolders = readRows(applicationCandidates)
+        .filter((user) => isUsableSuperAdmin(user, params.applicationScopeConferringRoles))
+        .map((user) => ({
+        userId: String(user._id),
+        ...(typeof user.email === 'string' ? { email: user.email } : {}),
+        conferringRolesHeld: (Array.isArray(user.appRoles) ? user.appRoles : []).filter((role) => typeof role === 'string' && params.applicationScopeConferringRoles.includes(role)),
+    }));
+    const organizationRepository = params.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATIONS);
+    const membershipRepository = params.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_MEMBERS);
+    const organizationScopeHolders = [];
+    const unreadableOrganizationIds = [];
+    if (organizationRepository && membershipRepository) {
+        const organizations = readRows(await organizationRepository.list(executionContext, {}));
+        const nameByOrganizationId = new Map(organizations.map((organization) => [String(organization._id), organization.name]));
+        for (const organization of organizations) {
+            const organizationId = String(organization._id);
+            let memberships;
+            try {
+                memberships = readRows(await membershipRepository.list(executionContext, {
+                    organizationId,
+                    roles: { $in: [...params.organizationScopeConferringRoles] },
+                    status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },
+                }));
+            }
+            catch {
+                unreadableOrganizationIds.push(organizationId);
+                continue;
+            }
+            for (const membership of memberships) {
+                if (!rolesConferOrganizationOwner(membership.roles, params.organizationScopeConferringRoles))
+                    continue;
+                if (!isAdministrativelyUsableMembershipStatus(membership.status))
+                    continue;
+                organizationScopeHolders.push({
+                    organizationId,
+                    ...(nameByOrganizationId.get(organizationId) ? { organizationName: nameByOrganizationId.get(organizationId) } : {}),
+                    membershipId: String(membership._id),
+                    ...(membership.userId ? { userId: String(membership.userId) } : {}),
+                    conferringRolesHeld: (Array.isArray(membership.roles) ? membership.roles : []).filter((role) => typeof role === 'string' && params.organizationScopeConferringRoles.includes(role)),
+                });
+            }
+        }
+    }
+    return {
+        observedAt: params.observedAt,
+        applicationScopeConferringRoles: [...params.applicationScopeConferringRoles],
+        organizationScopeConferringRoles: [...params.organizationScopeConferringRoles],
+        applicationScopeHolders,
+        organizationScopeHolders,
+        unreadableOrganizationIds,
+    };
+}
+/**
+ * Whether a membership's LINKED USER can still authenticate.
+ *
+ * Exported because a reviewer's most common question about an organization-scope holder is whether
+ * the person behind it is still able to act, and the answer lives on a different row than the one the
+ * enumeration returns. Kept as a predicate over a supplied user rather than a second read, so a
+ * caller batches the lookup it already needs.
+ *
+ * The two statuses are the owner floor's own vocabulary
+ * ({@link ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES}), not a second list.
+ */
+export function privilegedOrganizationHolderCanAuthenticate(user) {
+    return isAdministrativelyUsableOwnerUserStatus(user?.status);
+}
+//# sourceMappingURL=privileged-access-review.backend.utils.js.map

package/dist/esm/security/authorizations/privileged-access-review.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privileged-access-review.backend.utils.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/privileged-access-review.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAyD,MAAM,uBAAuB,CAAC;AAIhH,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIlD,OAAO,EACL,oDAAoD,EAEpD,6CAA6C,EAC7C,wCAAwC,EACxC,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qCAAqC,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AA0F9G,SAAS,QAAQ,CAAO,UAAmB;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,UAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,MAUzD;IACC,MAAM,gBAAgB,GAA0B,MAAM,6CAA6C,CACjG,MAAM,CAAC,2BAA2B,CACnC,CAAC;IAEF,MAAM,cAAc,GAAG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC9E,OAAO,EAAE;gBACP,OAAO,EAAE,4EAA4E;gBACrF,YAAY,EAAE,gBAAgB,CAAC,KAAK;aACrC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,qBAAqB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAoB,gBAAgB,EAAE;QAC3F,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,+BAA+B,CAAC,EAAE;QAC9D,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,qCAAqC,CAAC,EAAE;KAC5D,CAAC,CAAC;IAEH,MAAM,uBAAuB,GAAwC,QAAQ,CAAoB,qBAAqB,CAAC;SACpH,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,mBAAmB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAC7E,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,+BAA+B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC5G;KACF,CAAC,CAAC,CAAC;IAEN,MAAM,sBAAsB,GAAG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACzG,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAC9G,MAAM,wBAAwB,GAAyC,EAAE,CAAC;IAC1E,MAAM,yBAAyB,GAAa,EAAE,CAAC;IAE/C,IAAI,sBAAsB,IAAI,oBAAoB,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,QAAQ,CAA4B,MAAM,sBAAsB,CAAC,IAAI,CAA4B,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9I,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzH,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,WAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,WAAW,GAAG,QAAQ,CACpB,MAAM,oBAAoB,CAAC,IAAI,CAA0B,gBAAgB,EAAE;oBACzE,cAAc;oBACd,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,gCAAgC,CAAC,EAAE;oBAC5D,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,oDAAoD,CAAC,EAAE;iBAC3E,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,gCAAgC,CAAC;oBAAE,SAAS;gBACvG,IAAI,CAAC,wCAAwC,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC3E,wBAAwB,CAAC,IAAI,CAAC;oBAC5B,cAAc;oBACd,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpH,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;oBACpC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,mBAAmB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACnF,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,gCAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC7G;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,+BAA+B,EAAE,CAAC,GAAG,MAAM,CAAC,+BAA+B,CAAC;QAC5E,gCAAgC,EAAE,CAAC,GAAG,MAAM,CAAC,gCAAgC,CAAC;QAC9E,uBAAuB;QACvB,wBAAwB;QACxB,yBAAyB;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2CAA2C,CAAC,IAA6C;IACvG,OAAO,uCAAuC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import { CoreResourceType, type Organization, type OrganizationMember, type User } from '@wildo-ai/saas-models';\n\nimport type { AuthExecutionContextFactoryBackendService } from '~wildo-backend-lib/security/authentications/services/auth-execution-context-factory.backend.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ErrorType } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\n\nimport {\n  ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES,\n  ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES,\n  createOrganizationOwnerFloorPopulationContext,\n  isAdministrativelyUsableMembershipStatus,\n  isAdministrativelyUsableOwnerUserStatus,\n  rolesConferOrganizationOwner,\n} from './organization-owner-floor.backend.utils';\nimport { ADMINISTRATIVELY_USABLE_USER_STATUSES, isUsableSuperAdmin } from './super-admin-floor.backend.utils';\n\n/**\n * WHO currently holds privileged access — the enumeration a periodic privileged-access review reads.\n *\n * assurance-control: WILDO.ACCESS.PRIVILEGED_REVIEW — enumerate the principals holding privileged\n * access, at both scopes, so a review has an explicitly scoped population to decide over.\n *\n * ## What this is, and the three things it deliberately is NOT\n *\n * The objective demands four things of an application: privileged access is explicitly SCOPED, it is\n * PERIODICALLY REVIEWED, the review is DECIDED BY AUTHORIZED PEOPLE, and the outcome is RETAINED as\n * traceable evidence. Wildo supplies the first honestly and can supply the raw material for the\n * second. It supplies neither of the last two, and this module must not look as though it does.\n *\n * - **It does not schedule.** Nothing here fires periodically; a caller decides when to look.\n * - **It does not decide.** No row is marked reviewed, approved or revoked. A reviewer's judgement is\n *   a human act with named accountability, and a framework that recorded one would be asserting a\n *   decision nobody made — the same line the governed-document fact families draw.\n * - **It records no evidence.** The review OCCURRENCE — who reviewed, when, what they concluded — is\n *   the application's to supply as a declared host artifact, because Wildo cannot witness it. The\n *   general question of where a control's evidence lives is a separate design (#269), and answering\n *   it here for one control is exactly the one-off this route was chosen to avoid.\n *\n * The objective's own caveat survives all of this and is worth restating where the code is: evidence\n * is retained *without implying remediation completion*. A review record proves a review happened,\n * never that what it found was fixed. Nothing this module returns should be read as remediation.\n *\n * ## Why it OWNS its execution context\n *\n * Same reason as `measureOrganizationsMissingUsableOwner`, and the failure recorded there is exactly\n * the one that would bite here: an estate-wide read needs an `INTERNALLY_INITIATED_REQUEST` context to\n * escape scope-root collection confinement, and a caller-supplied context that is role-less — or that\n * carries a plausible-but-wrong execution-type string — silently confines the read to no tenants and\n * returns an EMPTY population. An empty privileged-access review is indistinguishable from a healthy\n * one, and it is the direction that reads as good news.\n *\n * ## Conferring roles come from the LIVE table, and are the caller's to resolve\n *\n * Both floors resolve their conferring set from the role table through `inheritFrom` rather than\n * comparing role strings, because a custom role that inherits the authority confers it. This takes\n * both sets as parameters for the same reason those functions do: the resolvers are lazy container\n * bindings, and taking the answer keeps this module free of the container.\n */\n\n/** One principal holding APPLICATION-scope privileged access. */\nexport interface PrivilegedApplicationAccessHolder {\n  readonly userId: string;\n  readonly email?: string;\n  /** The roles this principal holds that confer the authority — what a reviewer decides about. */\n  readonly conferringRolesHeld: readonly string[];\n}\n\n/** One principal holding ORGANIZATION-scope privileged access, and where. */\nexport interface PrivilegedOrganizationAccessHolder {\n  readonly organizationId: string;\n  readonly organizationName?: string;\n  readonly membershipId: string;\n  readonly userId?: string;\n  readonly conferringRolesHeld: readonly string[];\n}\n\n/**\n * The privileged-access population as it stands, at both scopes.\n *\n * `observedAt` is the instant the enumeration was taken, and it is the caller's to supply — this\n * module reads no clock, so the same estate enumerates to the same value twice. A report that stamped\n * its own \"now\" would be a different artifact on every run for reasons unrelated to access.\n */\nexport interface PrivilegedAccessPopulation {\n  readonly observedAt: string;\n  readonly applicationScopeConferringRoles: readonly string[];\n  readonly organizationScopeConferringRoles: readonly string[];\n  readonly applicationScopeHolders: readonly PrivilegedApplicationAccessHolder[];\n  readonly organizationScopeHolders: readonly PrivilegedOrganizationAccessHolder[];\n  /**\n   * Tenants the enumeration could not read a membership list for.\n   *\n   * REPORTED rather than skipped: a tenant silently absent from a privileged-access review reads as a\n   * tenant with no privileged access, which is the wrong direction to be wrong in\n   * (`.claude/rules/negative-results-require-a-positive-probe.md`). A reviewer must be told what was\n   * not looked at.\n   */\n  readonly unreadableOrganizationIds: readonly string[];\n}\n\ntype PrivilegedUserRow = Pick<User, '_id' | 'appRoles' | 'status' | 'email'>;\ntype PrivilegedMembershipRow = Pick<OrganizationMember, '_id' | 'roles' | 'status' | 'userId' | 'organizationId'>;\ntype PrivilegedOrganizationRow = Pick<Organization, '_id' | 'name'>;\n\nfunction readRows<TRow>(candidates: unknown): TRow[] {\n  return Array.isArray(candidates) ? (candidates as TRow[]) : [];\n}\n\n/**\n * Enumerate every principal holding privileged access, at both scopes.\n *\n * Fail-closed on the APPLICATION scope and best-effort per tenant on the ORGANIZATION scope, and the\n * asymmetry is deliberate. A missing users repository makes the whole population unknowable, so\n * answering at all would be a guess; one unreadable tenant leaves the rest of the review perfectly\n * usable, provided the reviewer is told which tenant is missing — which `unreadableOrganizationIds`\n * is for.\n */\nexport async function enumeratePrivilegedAccessPopulation(params: {\n  authExecutionContextFactory: AuthExecutionContextFactoryBackendService;\n  repositoriesRegistry: RepositoriesRegistryHandlerBackendService;\n  errorBuilder: ErrorBuilderBackendService;\n  /** From `resolveSuperAdminConferringRoles` — the live table's answer, not a role-string comparison. */\n  applicationScopeConferringRoles: readonly string[];\n  /** From `resolveOrganizationOwnerConferringRoles`. */\n  organizationScopeConferringRoles: readonly string[];\n  /** The instant this enumeration describes. Supplied, never read from a clock here. */\n  observedAt: string;\n}): Promise<PrivilegedAccessPopulation> {\n  const executionContext: ExecutionContext<any> = await createOrganizationOwnerFloorPopulationContext(\n    params.authExecutionContextFactory,\n  );\n\n  const userRepository = params.repositoriesRegistry.getRepository(CoreResourceType.USERS);\n  if (!userRepository) {\n    throw params.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      context: {\n        message: 'Cannot enumerate privileged access: the users repository is not registered',\n        resourceType: CoreResourceType.USERS,\n      },\n    });\n  }\n\n  /*\n   * The query narrows on the conferring roles and the usable statuses, and the predicate re-checks\n   * both. Not redundant: the query is what keeps this from materialising every user, and the\n   * predicate is what makes the answer exact when a row's status is out of vocabulary — the second\n   * way an ownerless tenant escaped the owner-floor backstop, recorded there.\n   */\n  const applicationCandidates = await userRepository.list<PrivilegedUserRow>(executionContext, {\n    appRoles: { $in: [...params.applicationScopeConferringRoles] },\n    status: { $in: [...ADMINISTRATIVELY_USABLE_USER_STATUSES] },\n  });\n\n  const applicationScopeHolders: PrivilegedApplicationAccessHolder[] = readRows<PrivilegedUserRow>(applicationCandidates)\n    .filter((user) => isUsableSuperAdmin(user, params.applicationScopeConferringRoles))\n    .map((user) => ({\n      userId: String(user._id),\n      ...(typeof user.email === 'string' ? { email: user.email } : {}),\n      conferringRolesHeld: (Array.isArray(user.appRoles) ? user.appRoles : []).filter(\n        (role): role is string => typeof role === 'string' && params.applicationScopeConferringRoles.includes(role),\n      ),\n    }));\n\n  const organizationRepository = params.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATIONS);\n  const membershipRepository = params.repositoriesRegistry.getRepository(CoreResourceType.ORGANIZATION_MEMBERS);\n  const organizationScopeHolders: PrivilegedOrganizationAccessHolder[] = [];\n  const unreadableOrganizationIds: string[] = [];\n\n  if (organizationRepository && membershipRepository) {\n    const organizations = readRows<PrivilegedOrganizationRow>(await organizationRepository.list<PrivilegedOrganizationRow>(executionContext, {}));\n    const nameByOrganizationId = new Map(organizations.map((organization) => [String(organization._id), organization.name]));\n\n    for (const organization of organizations) {\n      const organizationId = String(organization._id);\n      let memberships: PrivilegedMembershipRow[];\n      try {\n        memberships = readRows<PrivilegedMembershipRow>(\n          await membershipRepository.list<PrivilegedMembershipRow>(executionContext, {\n            organizationId,\n            roles: { $in: [...params.organizationScopeConferringRoles] },\n            status: { $in: [...ADMINISTRATIVELY_USABLE_ORGANIZATION_MEMBER_STATUSES] },\n          }),\n        );\n      } catch {\n        unreadableOrganizationIds.push(organizationId);\n        continue;\n      }\n\n      for (const membership of memberships) {\n        if (!rolesConferOrganizationOwner(membership.roles, params.organizationScopeConferringRoles)) continue;\n        if (!isAdministrativelyUsableMembershipStatus(membership.status)) continue;\n        organizationScopeHolders.push({\n          organizationId,\n          ...(nameByOrganizationId.get(organizationId) ? { organizationName: nameByOrganizationId.get(organizationId)! } : {}),\n          membershipId: String(membership._id),\n          ...(membership.userId ? { userId: String(membership.userId) } : {}),\n          conferringRolesHeld: (Array.isArray(membership.roles) ? membership.roles : []).filter(\n            (role): role is string => typeof role === 'string' && params.organizationScopeConferringRoles.includes(role),\n          ),\n        });\n      }\n    }\n  }\n\n  return {\n    observedAt: params.observedAt,\n    applicationScopeConferringRoles: [...params.applicationScopeConferringRoles],\n    organizationScopeConferringRoles: [...params.organizationScopeConferringRoles],\n    applicationScopeHolders,\n    organizationScopeHolders,\n    unreadableOrganizationIds,\n  };\n}\n\n/**\n * Whether a membership's LINKED USER can still authenticate.\n *\n * Exported because a reviewer's most common question about an organization-scope holder is whether\n * the person behind it is still able to act, and the answer lives on a different row than the one the\n * enumeration returns. Kept as a predicate over a supplied user rather than a second read, so a\n * caller batches the lookup it already needs.\n *\n * The two statuses are the owner floor's own vocabulary\n * ({@link ADMINISTRATIVELY_USABLE_OWNER_USER_STATUSES}), not a second list.\n */\nexport function privilegedOrganizationHolderCanAuthenticate(user: Pick<User, 'status'> | undefined | null): boolean {\n  return isAdministrativelyUsableOwnerUserStatus(user?.status);\n}\n"]}

package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts

@@ -211,6 +211,13 @@ export declare class AuthorizationsBackendService {
      *
      * Read from the OPERATION rather than inferred from the context, so the public carve-out above
      * cannot be satisfied by the caller's side of the request alone.
+     *
+     * Delegates to {@link requiredRolesDeclarePublicAccess}, the ONE named source for what
+     * `APP_PUBLIC` means. This used to be a private re-derivation of the same two-line test, and it
+     * was one of FOUR such copies (this one, the authentication tier's `operationAdmitsPublicAccess`,
+     * and the two role gates that did not have one and therefore refused credentialed callers). A
+     * policy expressed as a module-private constant reaches exactly the sites that already agree with
+     * it — see `.claude/rules/invariant-call-site-enumeration.md` #13.
      */
     private operationDeclaresPublicAccess;
     authorizeInRepositoryAndService(id_or_ids: IdOrIdsOrFilterType, operation: ResourceConfiguration_Operation<any, any, any>, executionContext: ExecutionContext<any>): Promise<void>;
@@ -394,8 +401,46 @@ export declare class AuthorizationsBackendService {
      */
     private buildTenantBoundaryNotFound;
     private authorizeOrganizations;
+    /**
+     * Does this resource DERIVE tenant-anchorless rows rather than store rows under the application?
+     *
+     * An INTROSPECTION resource declaring {@link IntrospectionTenancyStance.APPLICATION_STRUCTURE} or
+     * {@link IntrospectionTenancyStance.APPLICATION_RUNTIME} has no per-row application anchor, and
+     * that is its contract rather than an omission: its rows are DERIVED per read (from a companion
+     * behavior over the application's source, or from the companion's own runtime services), there is
+     * no store to hold a foreign key, and both stances say outright that there is no tenant dimension
+     * for a scope predicate to filter on. What separates the two stances is the READ POSTURE
+     * (structure may be `APP_PUBLIC`; runtime must be role-gated), which is the operation variants'
+     * job and ran before this method — not the anchor question answered here.
+     *
+     * Fails CLOSED in both directions that matter. With no registry bound the answer is `false`, so
+     * the anchor check below still runs; and the stance must be one of the two enumerated anchorless
+     * members, so an introspection resource that projects anything else — including a future scoped
+     * stance — keeps the check.
+     */
+    private projectsAnchorlessIntrospection;
     /**
      * Authorize APPLICATION scope
+     *
+     * ## What the per-row anchor check does, and what it cannot do
+     *
+     * The application is a SINGLETON per database — `ExecutionContextCreator.getApplicationId()` reads
+     * the APPLICATION row with an empty filter, on the stated grounds that "there is one APPLICATION
+     * row, so nothing can usefully narrow this read". So `appIdFromResource !== applicationId` cannot
+     * discriminate between applications within a database: both sides resolve to the same row. It is a
+     * consistency assertion about correctly-populated rows, not a cross-application isolation control.
+     *
+     * The `!appIdFromResource` branch is the one with teeth, and for a STORED resource it is right —
+     * every `APPLICATION`-anchored resource in the engine declares
+     * `parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION]`, so its
+     * rows carry the FK and a row without one is malformed.
+     *
+     * A projection cannot satisfy it at all, which is why the stance is consulted first. Measured
+     * before the carve-out existed: an addressed READ on `workbenchApplicationModules` answered 200 to
+     * an anonymous caller (the public-execution path returns before this method) and 403 to an
+     * authenticated one, while LIST answered 200 to both (collection operations run no row check). The
+     * resource could not be fixed from the application side without inventing a field its schema does
+     * not declare.
      */
     private authorizeApplication;
     /**
@@ -471,6 +516,29 @@ export declare class AuthorizationsBackendService {
      * - id_or_ids must be a valid string or array
      * - Authorization additionally verifies access to the specific resource(s)
      */
+    /**
+     * Authorize an operation on ROLES ALONE, with no row to fetch.
+     *
+     * ## Why this exists, and why it is deliberately narrow
+     *
+     * Every other entry point here authorizes an operation against ROWS — it pre-fetches them, checks
+     * scope, checks FK reachability, then checks roles. That is right whenever there is a row.
+     *
+     * A WebSocket SCOPE subscription has none. It says "tell me when anything of this type changes
+     * under this scope", which addresses no instance, so the row-shaped questions have no subject and
+     * only the role question remains. Passing a scope id in the row's place is the trap this avoids:
+     * it would authorize a READ of a row of the subscribed type whose id happens to be an application
+     * id, which is not a question anyone asked and which fails for the wrong reason.
+     *
+     * **This is strictly WEAKER than `authorizeInController` and must never be substituted for it on a
+     * path that has an id.** It answers "may this principal invoke this operation at all", not "may
+     * this principal reach this row". Its only caller is the scope-subscription gate, where the
+     * notification it admits carries row identities the caller could have listed anyway.
+     *
+     * Unit narrowing still applies: `resourceIdentifier` is forwarded, so a unit-scoped grant can
+     * rescue a failing role check exactly as it does everywhere else.
+     */
+    authorizeOperationRolesOnly(operation: ResourceConfiguration_Operation<any, any, any>, executionContext: ExecutionContext<any>): Promise<void>;
     authorizeInController(id_or_ids: string | string[] | undefined, executionContext: ExecutionContext<any>): Promise<void>;
     /**
      * Authorize a NON-CONTROLLER surface that will itself perform row-scoped reads.
@@ -576,11 +644,24 @@ export declare class AuthorizationsBackendService {
      * This prevents users from accessing resources assigned to or created by other users
      * by manipulating the URL path.
      *
-     * Authorization behavior by execution type:
-     * - USER_REQUEST: Must match the authenticated user's ID
-     * - API_KEY: Allowed - API keys have broader access within their scope
-     * - INTERNAL: Allowed - internal operations bypass FK validation
-     * - PUBLIC: Allowed - public operations don't have identity context
+     * The gate is on IDENTITY, not on execution type (issue #321). A context is admitted on a user-FK
+     * path when it carries a `userId` AND that id equals the one in the path — whatever established the
+     * identity. Two execution types carry a `userId`:
+     * - USER_REQUEST — the session's own user;
+     * - CONSUMABLE_TOKEN — the `userId` the token was MINTED for (`createExecutionContextFromRequest`
+     *   copies `consumableTokenObject.userId` onto `initiatorIds`). It is server-minted, so a bearer can
+     *   only act as that subject on that path — the same trust a session confers.
+     * Machine principals, INTERNAL, PUBLIC, WEBHOOK and ANONYMOUS_SESSION never reach the gate: the
+     * early return below skips FK matching for them entirely (machine principals have broader access
+     * within their scope; the others carry no person to match). So the identity gate is evaluated for
+     * exactly two execution types — USER_REQUEST and CONSUMABLE_TOKEN — and a context of either kind
+     * WITHOUT a `userId` is refused: a user-FK path names a person, and a caller with no person cannot
+     * be that person.
+     *
+     * History: after the early return, this used to refuse every non-USER_REQUEST type — which, given
+     * that return, meant exactly CONSUMABLE_TOKEN — on the stated premise that "only USER_REQUEST has a
+     * userId". The premise was false when written (the token bridge already set it); the effect was
+     * that no token could act on a user-FK path even for the very user it was minted for.
      */
     private validateFKRelationshipAccess;
     /**
@@ -597,7 +678,21 @@ export declare class AuthorizationsBackendService {
      * Validate that user's roles satisfy the required operation roles
      * Considers role hierarchy within the given scope
      *
-     * @returns true if user has at least one of the required roles
+     * The SECOND role gate in this class, and the reason the `APP_PUBLIC` admission below is repeated
+     * rather than inherited: an ORGANIZATIONS-scoped operation resolves its roles HERE, inside
+     * `validateParentScopeAccess`, and never reaches {@link validateOperationRoles} —
+     * `authorizeCollectionOperation` skips that call for ORGANIZATIONS scope precisely because this
+     * branch has already answered the question. A public declaration honoured at only one of the two
+     * would mean `APP_PUBLIC` worked on APPLICATION-scoped resources and refused on organization-scoped
+     * ones, which is the same defect one scope over.
+     *
+     * The caller has ALREADY proven tenancy by the time this runs — the ORGANIZATIONS branch resolves
+     * an `orgRoleInfo` for this specific organization, and the scope-root branch confines the read
+     * separately — so admitting on a public declaration here grants the right to ASK, never a wider
+     * set of rows.
+     *
+     * @returns true if user has at least one of the required roles, or the operation declares public
+     *   access (in which case it requires none)
      */
     private validateRolesForScope;
 }

package/dist/esm/security/authorizations/services/authorizations.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorizations.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authorizations/services/authorizations.backend.service.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EACL,+BAA+B,EAM/B,oBAAoB,EAMpB,kBAAkB,EAClB,cAAc,EAGd,KAAK,EACL,QAAQ,EACR,QAAQ,EAKT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAGvG,qBACa,4BAA4B;IAUF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACpG;;;;;;OAMG;IAC6D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnG;;;;OAIG;IACkD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IAC8B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IA5C9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAGxF,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAqB;gBAGiB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC;IAC/I;;;;;;OAMG;IAC8E,iBAAiB,CAAC,EAAE,+BAA+B;IACpI;;;;OAIG;IACmE,YAAY,CAAC,EAAE,YAAY;IACjG;;;;;;;;;;;;;;;;;;;OAmBG;IAC+C,SAAS,CAAC,EAAE,SAAS;IAUzE;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACI,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAIvE;;OAEG;IACH,OAAO,CAAC,cAAc;IA4Cf,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAI7D,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,WAAW,IAAI,kBAAkB;IAIjC,WAAW,IAAI,kBAAkB;IAIjC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAavE,oBAAoB,IAAI,IAAI;IAKnC;;OAEG;IACI,8BAA8B,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAK5E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACU,0CAA0C,CACrD,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;YAIF,wCAAwC;IAiEtD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH;;;;;;;;;;;;;;;;;OAiBG;YACW,iCAAiC;YAkBjC,2BAA2B;IA+BzC;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAKnC;;;;;OAKG;IACH,OAAO,CAAC,6BAA6B;IAKxB,+BAA+B,CAAC,SAAS,EAAG,mBAAmB,EAAE,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsThM;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;OAEG;YACW,gCAAgC;IAyC9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,iBAAiB;IA6D/B;;OAEG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uCAAuC;IAgDrD;;;;;;;;;OASG;IACH;;;;;;;OAOG;YACW,iCAAiC;YASjC,4BAA4B;IA4C1C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;IAOrC,gGAAgG;IAChG,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,qCAAqC;IA8C7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,2BAA2B;YAarB,sBAAsB;IA8FpC;;OAEG;YACW,oBAAoB;IAgDlC;;;;OAIG;YACW,kBAAkB;IAchC;;OAEG;YACW,sBAAsB;IAkEpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,4BAA4B;IA+E1C;;;;;;OAMG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;OAaG;IACU,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCpI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFG;IACU,8BAA8B,CACzC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;;OASG;YACW,4BAA4B;IAmE1C;;;;;;;;;;;;;;;;OAgBG;YACW,4BAA4B;IAuF1C;;;;;;;;OAQG;YACW,yBAAyB;IAoPvC;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;CAY9B"}
+{"version":3,"file":"authorizations.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authorizations/services/authorizations.backend.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAEhI,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAC1G,OAAO,EACL,+BAA+B,EAQ/B,oBAAoB,EAMpB,kBAAkB,EAClB,cAAc,EAGd,KAAK,EACL,QAAQ,EACR,QAAQ,EAKT,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAGvG,qBACa,4BAA4B;IAUF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACpG;;;;;;OAMG;IAC6D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnG;;;;OAIG;IACkD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IAC8B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IA5C9D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAGxF,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAqB;gBAGiB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACzB,oBAAoB,EAAE,yCAAyC;IAC/I;;;;;;OAMG;IAC8E,iBAAiB,CAAC,EAAE,+BAA+B;IACpI;;;;OAIG;IACmE,YAAY,CAAC,EAAE,YAAY;IACjG;;;;;;;;;;;;;;;;;;;OAmBG;IAC+C,SAAS,CAAC,EAAE,SAAS;IAUzE;;OAEG;IACH,OAAO,CAAC,eAAe;IAavB;;OAEG;IACI,yBAAyB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAIvE;;OAEG;IACH,OAAO,CAAC,cAAc;IA4Cf,sBAAsB,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAI7D,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IAanE,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS;IAIzD,WAAW,IAAI,kBAAkB;IAIjC,WAAW,IAAI,kBAAkB;IAIjC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,UAAU,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO;IAItC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAavE,oBAAoB,IAAI,IAAI;IAKnC;;OAEG;IACI,8BAA8B,CAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI;IAK5E;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACU,0CAA0C,CACrD,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;YAIF,wCAAwC;IAiEtD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH;;;;;;;;;;;;;;;;;OAiBG;YACW,iCAAiC;YAkBjC,2BAA2B;IA+BzC;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAKnC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,6BAA6B;IAIxB,+BAA+B,CAAC,SAAS,EAAG,mBAAmB,EAAE,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA4WhM;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;OAEG;YACW,gCAAgC;IAyC9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,iBAAiB;IA6D/B;;OAEG;IACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;YACW,uCAAuC;IAgDrD;;;;;;;;;OASG;IACH;;;;;;;OAOG;YACW,iCAAiC;YASjC,4BAA4B;IA4C1C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,6BAA6B;IAOrC,gGAAgG;IAChG,OAAO,CAAC,wBAAwB;IAMhC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,qCAAqC;IA8C7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,OAAO,CAAC,2BAA2B;YAarB,sBAAsB;IA8FpC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,+BAA+B;IAQvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,oBAAoB;IA4DlC;;;;OAIG;YACW,kBAAkB;IAchC;;OAEG;YACW,sBAAsB;IA0FpC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAK/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,4BAA4B;IA+E1C;;;;;;OAMG;YACW,qBAAqB;IAkBnC;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,2BAA2B,CACtC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAKH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCpI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgFG;IACU,8BAA8B,CACzC,SAAS,EAAE,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EACzD,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;;OASG;YACW,4BAA4B;IAmE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,4BAA4B;IA0E1C;;;;;;;;OAQG;YACW,yBAAyB;IAoPvC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,qBAAqB;CAc9B"}