life-as-api 0.2.0

package/dist/auth/production-scoped-life-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-scoped-life-api.js","sourceRoot":"","sources":["../../src/auth/production-scoped-life-api.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,iFAAiF;AACjF,yFAAyF;AACzF,EAAE;AACF,gFAAgF;AAChF,gEAAgE;AAChE,oFAAoF;AACpF,+FAA+F;AAC/F,2FAA2F;AAC3F,2FAA2F;AAC3F,+EAA+E;AAC/E,qDAAqD;AACrD,8EAA8E;AAC9E,4EAA4E;AAC5E,sFAAsF;AACtF,kFAAkF;AAClF,6FAA6F;AAC7F,8FAA8F;AAC9F,8DAA8D;AAC9D,uGAAuG;AACvG,yGAAyG;AACzG,0GAA0G;AAC1G,sGAAsG;AACtG,sCAAsC;AACtC,2FAA2F;AAC3F,wGAAwG;AACxG,yFAAyF;AACzF,wGAAwG;AACxG,2FAA2F;AAC3F,gFAAgF;AAChF,EAAE;AACF,gCAAgC;AAChC,2FAA2F;AAC3F,oDAAoD;AACpD,+FAA+F;AAC/F,8DAA8D;AAC9D,yFAAyF;AACzF,uCAAuC;AACvC,yFAAyF;AACzF,sDAAsD;AACtD,gGAAgG;AAChG,wFAAwF;AACxF,8DAA8D;AAC9D,4FAA4F;AAC5F,2FAA2F;AAC3F,oCAAoC;AACpC,yEAAyE;AACzE,uFAAuF;AACvF,EAAE;AACF,4CAA4C;AAC5C,oFAAoF;AACpF,iFAAiF;AACjF,oFAAoF;AACpF,2FAA2F;AAC3F,0FAA0F;AAC1F,uFAAuF;AACvF,oFAAoF;AACpF,8FAA8F;AAC9F,iFAAiF;AACjF,2EAA2E;AAC3E,2FAA2F;AAC3F,yFAAyF;AACzF,sDAAsD;AACtD,gFAAgF;AAChF,yFAAyF;AACzF,2FAA2F;AAW3F,OAAO,EAAE,eAAe,EAAE,MAAoC,uBAAuB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAA0C,iBAAiB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAA+B,8BAA8B,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAA8B,+BAA+B,CAAC;AAG9F,OAAO,EAAE,OAAO,EAAE,MAA4C,4BAA4B,CAAC;AAE3F,OAAO,EAAE,UAAU,EAAE,MAAyC,6BAA6B,CAAC;AAqD5F,iFAAiF;AACjF,4EAA4E;AAC5E,kFAAkF;AAClF,2FAA2F;AAC3F,EAAE;AACF,2FAA2F;AAC3F,0FAA0F;AAC1F,iGAAiG;AAEjG,MAAM,UAAU,yBAAyB,CACvC,OAAmB,EACnB,SAAwB;IAExB,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0DAA0D,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI;YACpF,gFAAgF,CACjF,EACD,EAAE,IAAI,EAAE,yCAAyC,EAAE,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAkC,CAAC;IAC9D,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,iFAAiF;YACjF,yDAAyD,CAC1D,EACD,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,kEAAkE;AAClE,4DAA4D;AAC5D,MAAM,UAAU,uCAAuC,CACrD,QAAmB,EACnB,SAAwB;IAExB,MAAM,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC;IACrC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wFAAwF;YACxF,8BAA8B,CAC/B,EACD,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,gGAAgG;YAChG,8BAA8B,CAC/B,EACD,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAW,CAAC;IACzD,iDAAiD;IACjD,kEAAkE;IAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAkC,CAAC;IAC9D,IAAI,QAAQ,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0FAA0F,CAC3F,EACD,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,mEAAmE;AACnE,2FAA2F;AAC3F,yGAAyG;AACzG,2DAA2D;AAC3D,gCAAgC;AAChC,SAAS,oBAAoB,CAAC,QAAkB;IAC9C,MAAM,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC;IACrC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAW,CAAC;AACpC,CAAC;AAED,iFAAiF;AACjF,8EAA8E;AAC9E,6BAA6B;AAC7B,iHAAiH;AACjH,6EAA6E;AAC7E,gCAAgC;AAChC,SAAS,0BAA0B,CAAC,SAAwB;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;IAEpC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAkC,CAAC;QAC9D,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,CAAC;QACxD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,qEAAqE;gBACrE,sGAAsG,CACvG,EACD,EAAE,IAAI,EAAE,mEAAmE,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,+DAA+D;QAC/D,iBAAiB,IAAI,sCAAsC,CAC5D,EACD,EAAE,IAAI,EAAE,6DAA6D,EAAE,CACxE,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,MAAM,OAAO,2BAA2B;IAQnB;IACA;IACA;IACA;IACA;IACA;IACA;IAbF,WAAW,CAAwB;IACnC,YAAY,CAAwB;IAErD,4FAA4F;IAC5F,8FAA8F;IAC9F,uEAAuE;IACvE,YACmB,IAA0B,EAC1B,OAAgC,EAChC,MAA2B,EAC3B,YAA2B,EAC3B,IAA6B,EAC7B,OAAyB,EACzB,gBAAkC;QANlC,SAAI,GAAJ,IAAI,CAAsB;QAC1B,YAAO,GAAP,OAAO,CAAyB;QAChC,WAAM,GAAN,MAAM,CAAqB;QAC3B,iBAAY,GAAZ,YAAY,CAAe;QAC3B,SAAI,GAAJ,IAAI,CAAyB;QAC7B,YAAO,GAAP,OAAO,CAAkB;QACzB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAEnD,IAAI,CAAC,WAAW,GAAI,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpG,CAAC;IAED,oEAAoE;IACpE,iDAAiD;IACzC,oBAAoB,CAC1B,SAAiB,EACjB,MAAuC,EACvC,WAAoB;QAEpB,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,2BAA2B,EAAE,CAAC,EAAE;YAChE,SAAS,EAAE,6BAA6B;YACxC,SAAS;YACT,MAAM;YACN,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,wFAAwF;IAChF,KAAK,CAAC,iBAAiB,CAAC,KAAiB;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;gBACpB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B;gBAClD,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,mBAAmB;gBACxE,OAAO,EAAE,oDAAoD;gBAC7D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,CAAC,EAAE;gBAC1D,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ;aAC3F,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,sFAAsF,CACvF,EACD,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IAEO,IAAI;QACV,OAAO,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,mFAAmF;IACnF,+EAA+E;IACvE,eAAe;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAED,uFAAuF;IACvF,uFAAuF;IAC/E,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,aAAqB;QACzE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,CAAC,yCAAyC;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACvC,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,MAAM;YAC3B,UAAU,EAAW,8BAA8B;YACnD,mBAAmB,EAAE,YAAY,SAAS,SAAS,MAAM,EAAE;YAC3D,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,gBAAgB,EAAK,IAAI;YACzB,MAAM;YACN,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;SACjC,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,gDAAgD,SAAS,uBAAuB;YAChF,4CAA4C,aAAa,GAAG,CAC7D,EACD,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,0EAA0E;IAC1E,yEAAyE;IACjE,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAClD,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACvC,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,MAAM;YAC3B,UAAU,EAAW,8BAA8B;YACnD,mBAAmB,EAAE,YAAY,SAAS,SAAS,MAAM,EAAE;YAC3D,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,gBAAgB,EAAK,IAAI;YACzB,MAAM;YACN,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;SACjC,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,6EAA6E;YAC7E,4DAA4D,CAC7D,EACD,EAAE,IAAI,EAAE,6BAA6B,EAAE,CACxC,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,2FAA2F;IAC3F,iGAAiG;IACjG,gGAAgG;IAChG,qEAAqE;IACrE,6FAA6F;IAC7F,gGAAgG;IAChG,KAAK,CAAC,cAAc,CAAC,OAAiB;QACpC,iFAAiF;QACjF,4DAA4D;QAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,KAAK,iDAAiD;gBAC3E,CAAC,CAAC,8BAAuC;gBACzC,CAAC,CAAC,sBAA+B,CAAC;YACpC,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU;gBACV,mBAAmB,EAAE,mBAAmB,OAAO,EAAE;gBACjD,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAkC,CAAC;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,CAC9C,IAAI,KAAK,kCAAkC;gBAC3C,IAAI,KAAK,oCAAoC;gBAC7C,IAAI,KAAK,4BAA4B,CACtC,CAAC;YACF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;oBACpB,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC;oBACvD,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,gBAAgB;oBACrE,OAAO,EAAE,6DAA6D;oBACtE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,CAAC,EAAE;oBAC1D,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ;iBACxF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,8EAA8E;IAC9E,KAAK,CAAC,gBAAgB,CAAC,OAAiB;QACtC,iFAAiF;QACjF,4DAA4D;QAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,KAAK,iDAAiD;gBAC3E,CAAC,CAAC,8BAAuC;gBACzC,CAAC,CAAC,sBAA+B,CAAC;YACpC,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU;gBACV,mBAAmB,EAAE,mBAAmB,OAAO,EAAE;gBACjD,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAkC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,OAAO;YAC5B,UAAU,EAAW,wBAAwB;YAC7C,mBAAmB,EAAE,0BAA0B,OAAO,EAAE;YACxD,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;YAChC,GAAG,IAAI,CAAC,eAAe,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,uFAAuF;IACvF,yFAAyF;IACzF,uDAAuD;IACvD,uFAAuF;IACvF,uFAAuF;IACvF,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,wFAAwF;IACxF,0EAA0E;IAC1E,qFAAqF;IACrF,2DAA2D;IAC3D,KAAK,CAAC,cAAc,CAAC,UAAsB,EAAE,OAAsB;QACjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC3E,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,MAAM,MAAM,GACV,IAAI,KAAK,kCAAkC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpE,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,iGAAiG;IACjG,iGAAiG;IACjG,sEAAsE;IACtE,KAAK,CAAC,cAAc,CAAC,KAAoB;QACvC,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAEvC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,kCAAkC;oBACvD,mBAAmB,EAAE,wCAAwC;oBAC7D,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,iEAAiE;oBACjE,mCAAmC,CACpC,EACD,EAAE,IAAI,EAAE,+DAA+D,EAAE,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,+BAA+B;oBACpD,mBAAmB,EAAE,qCAAqC;oBAC1D,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,2DAA2D;oBAC3D,qDAAqD,CACtD,EACD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACpE,CAAC;YACJ,CAAC;YACD,MAAM,oBAAoB,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAW,CAAC;YAC7D,IAAI,oBAAoB,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC/C,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,+BAA+B;oBACpD,mBAAmB,EAAE,+CAA+C,oBAAoB,EAAE;oBAC1F,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,iEAAiE;oBACjE,0FAA0F,CAC3F,EACD,EAAE,IAAI,EAAE,+DAA+D,EAAE,CAC1E,CAAC;YACJ,CAAC;YACD,0FAA0F;YAC1F,MAAM,eAAe,GAAG,eAAe,CAAC;gBACtC,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,OAAO;gBAC5B,UAAU,EAAW,kBAAkB;gBACvC,mBAAmB,EAAE,2BAA2B,oBAAoB,mBAAmB,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE;gBACrH,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBACjD,IAAI,CAAC;oBAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAAC,CAAC;gBACvD,OAAO,GAAY,EAAE,CAAC;oBACpB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;wBACpB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B;wBAClD,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,gBAAgB;wBACrE,OAAO,EAAE,oDAAoD;wBAC7D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzD,CAAC,CAAC;oBACH,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,CAAC,EAAE;wBAC1D,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ;qBACxF,CAAC,CAAC;oBACH,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,sFAAsF,CAAC,EACjG,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAyC,EAAE,KAAK,CAAC,CAAC;YACjG,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7D,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,kEAAkE;YAClE,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAC3D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,6BAA6B;oBAClD,mBAAmB,EAAE,mCAAmC;oBACxD,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,uEAAuE;oBACvE,mFAAmF,CACpF,EACD,EAAE,IAAI,EAAE,qEAAqE,EAAE,CAChF,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,kCAAkC;oBACvD,mBAAmB,EAAE,wCAAwC;oBAC7D,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,iEAAiE;oBACjE,mCAAmC,CACpC,EACD,EAAE,IAAI,EAAE,+DAA+D,EAAE,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,+BAA+B;oBACpD,mBAAmB,EAAE,qCAAqC;oBAC1D,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,2DAA2D;oBAC3D,qDAAqD,CACtD,EACD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACpE,CAAC;YACJ,CAAC;YACD,MAAM,oBAAoB,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAW,CAAC;YAC7D,IAAI,oBAAoB,KAAK,kBAAkB,EAAE,CAAC;gBAChD,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,+BAA+B;oBACpD,mBAAmB,EAAE,+CAA+C,oBAAoB,EAAE;oBAC1F,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;gBACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,2DAA2D;oBAC3D,0DAA0D,CAC3D,EACD,EAAE,IAAI,EAAE,yDAAyD,EAAE,CACpE,CAAC;YACJ,CAAC;YACD,0FAA0F;YAC1F,MAAM,eAAe,GAAG,eAAe,CAAC;gBACtC,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,OAAO;gBAC5B,UAAU,EAAW,kBAAkB;gBACvC,mBAAmB,EAAE,2BAA2B,oBAAoB,mBAAmB,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE;gBACrH,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBACjD,IAAI,CAAC;oBAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAAC,CAAC;gBACvD,OAAO,GAAY,EAAE,CAAC;oBACpB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;wBACpB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B;wBAClD,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,gBAAgB;wBACrE,OAAO,EAAE,oDAAoD;wBAC7D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzD,CAAC,CAAC;oBACH,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,CAAC,EAAE;wBAC1D,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ;qBACxF,CAAC,CAAC;oBACH,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,sFAAsF,CAAC,EACjG,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAA8B,EAAE,KAAK,CAAC,CAAC;YACtF,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC7D,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,MAAM;YAC3B,UAAU,EAAW,qCAAqC;YAC1D,mBAAmB,EAAE,gCAAgC,IAAI,EAAE;YAC3D,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;YAChC,GAAG,IAAI,CAAC,eAAe,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,iEAAiE;YACjE,iBAAiB,IAAI,wCAAwC,CAC9D,EACD,EAAE,IAAI,EAAE,+DAA+D,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,iDAAiD;IACjD,iDAAiD;IACjD,0GAA0G;IAC1G,KAAK,CAAC,WAAW,CAAC,UAAsB;QACtC,gGAAgG;QAChG,sEAAsE;QACtE,6EAA6E;QAC7E,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,aAAa,GAChB,GAAyB,CAAC,IAAI,KAAK,mEAAmE,CAAC;YAC1G,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU,EAAW,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0CAA0C;gBAC9G,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,mCAAmC;gBACvG,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8FAA8F;QAC9F,yBAAyB;QACzB,2DAA2D;QAC3D,8CAA8C;QAC9C,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,8BAA8B;oBACnD,mBAAmB,EAAE,8BAA8B;oBACnD,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;YAC9D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;oBACvC,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,8BAA8B;oBACnD,mBAAmB,EAAE,8BAA8B;oBACnD,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;oBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;YAC9D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,OAAO;YAC5B,UAAU,EAAW,uBAAuB;YAC5C,mBAAmB,EAAE,4BAA4B,UAAU,EAAE;YAC7D,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;YAChC,GAAG,IAAI,CAAC,eAAe,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,2DAA2D;IAC3D,6DAA6D;IAC7D,iDAAiD;IACjD,8EAA8E;IAC9E,KAAK,CAAC,aAAa,CAAC,KAA0B;QAC5C,gGAAgG;QAChG,6EAA6E;QAC7E,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,aAAa,GAChB,GAAyB,CAAC,IAAI,KAAK,mEAAmE,CAAC;YAC1G,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU,EAAW,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0CAA0C;gBAC9G,mBAAmB,EAAE,2BAA2B;gBAChD,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,iFAAiF;QACjF,mFAAmF;QACnF,MAAM,SAAS,GAAG,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAErE,8DAA8D;QAC9D,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC9B,MAAM,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,YAAY,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,OAAO;YAC5B,UAAU,EAAW,uBAAuB;YAC5C,mBAAmB,EAAE,4BAA4B,QAAQ,CAAC,MAAM,EAAE;YAClE,WAAW,EAAU,QAAQ,CAAC,MAAM;YACpC,cAAc,EAAO,EAAE;YACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;YAChC,GAAG,IAAI,CAAC,eAAe,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,gDAAgD;IAChD,mDAAmD;IACnD,2FAA2F;IAC3F,uDAAuD;IACvD,KAAK,CAAC,cAAc,CAAC,UAAsB,EAAE,OAAsB;QACjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QACrE,mFAAmF;QACnF,kGAAkG;QAClG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU,EAAW,qCAAqC;gBAC1D,mBAAmB,EAAE,8BAA8B,UAAU,iBAAiB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE;gBACzG,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjF,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,gEAAgE;gBAChE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,qDAAqD,CACnF,EACD,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAC5D,CAAC;QACJ,CAAC;QACD,uDAAuD;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU,EAAW,oBAAoB;gBACzC,mBAAmB,EAAE,8BAA8B,UAAU,EAAE;gBAC/D,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjF,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,uEAAuE,CACxE,EACD,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAC9D,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,CAAC;YACH,uCAAuC,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU,EAAW,+BAA+B;gBACpD,mBAAmB,EAAE,8BAA8B,UAAU,EAAE;gBAC/D,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;gBAChC,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,0FAA0F;QAC1F,MAAM,gBAAgB,GAAG,eAAe,CAAC;YACvC,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,OAAO;YAC5B,UAAU,EAAW,kBAAkB;YACvC,mBAAmB,EAAE,8BAA8B,UAAU,EAAE;YAC/D,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,GAAG,EAAkB,IAAI,CAAC,IAAI,EAAE;YAChC,GAAG,IAAI,CAAC,eAAe,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAClD,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAAC,CAAC;YACxD,MAAM,CAAC;gBACL,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,CAAC,EAAE;oBAC1D,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ;iBACxF,CAAC,CAAC;gBACH,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACjF,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,sFAAsF,CAAC,EACjG,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;YACJ,CAAC;YACD,uEAAuE;YACvE,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAC7B,IAAI,CAAC,OAAO,CAAC,OAAqC,EAClD,UAAU,EACV,OAAO,CAAC,MAAM,CACf,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO,YAAY,CAAC;IACtB,CAAC;CACF"}

package/dist/auth/proposal-scope-inspector.d.ts

@@ -0,0 +1,3 @@
+import type { Proposal } from "../types/proposal.js";
+import type { MintedContext } from "./types.js";
+export declare function inspectProposalScope(proposal: Proposal, minted: MintedContext): string;

package/dist/auth/proposal-scope-inspector.js

@@ -0,0 +1,42 @@
+// AUTH_PROPOSAL_ACCEPT_SCOPE_CHECKED_001 — Production-01d-a
+//
+// Pure helper — synchronous only, no I/O, no LifeApi calls, no ProposalQueue access.
+// Inspects candidateClaims to determine if a proposal is within the authorized subject scope.
+//
+// AUTH_PROPOSAL_CANDIDATE_CLAIMS_SCOPED_001:
+//   AppendClaimInput.subject is always required (PersonId) — candidateClaims are always
+//   subject-scoped. There is no absent-subject case. No payload inspection for authorization.
+//
+// AUTH_PROPOSAL_ID_NOT_SUBJECT_FREE_001:
+//   ProposalId alone is not authorization proof — it routes to candidateClaims which carry
+//   subject-scoped data. Always inspect candidateClaims, never trust ProposalId alone.
+//
+// Rules (in order):
+//   1. candidateClaims.length === 0 → AUTH_PROPOSAL_EMPTY_CANDIDATES_DENIED_001
+//   2. uniqueSubjects.size !== 1    → AUTH_PROPOSAL_MULTI_SUBJECT_DENIED_001
+//   3. authorizedPersonId absent    → AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001
+//   4. authorizedPersonId mismatch  → AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001
+//   5. success                      → return proposalSubject
+export function inspectProposalScope(proposal, minted) {
+    const { candidateClaims } = proposal;
+    if (candidateClaims.length === 0) {
+        throw Object.assign(new Error("AUTH_PROPOSAL_EMPTY_CANDIDATES_DENIED_001: proposal has zero candidateClaims — " +
+            "scope cannot be determined; fail closed"), { code: "AUTH_PROPOSAL_EMPTY_CANDIDATES_DENIED_001" });
+    }
+    const uniqueSubjects = new Set(candidateClaims.map(c => c.subject));
+    if (uniqueSubjects.size !== 1) {
+        throw Object.assign(new Error("AUTH_PROPOSAL_MULTI_SUBJECT_DENIED_001: proposal candidateClaims span more than one " +
+            "distinct subject — multi-subject proposals are fail-closed for subject-scoped Owners"), { code: "AUTH_PROPOSAL_MULTI_SUBJECT_DENIED_001" });
+    }
+    const proposalSubject = [...uniqueSubjects][0];
+    if (minted.authorizedPersonId === undefined) {
+        throw Object.assign(new Error("AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001: MintedContext.authorizedPersonId is absent — " +
+            "unscoped context must not use ProposalScopeInspector; call LifeApi directly"), { code: "AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001" });
+    }
+    if (minted.authorizedPersonId !== proposalSubject) {
+        throw Object.assign(new Error("AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001: MintedContext.authorizedPersonId does not " +
+            "match the proposalSubject derived from candidateClaims"), { code: "AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001" });
+    }
+    return proposalSubject;
+}
+//# sourceMappingURL=proposal-scope-inspector.js.map

package/dist/auth/proposal-scope-inspector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-scope-inspector.js","sourceRoot":"","sources":["../../src/auth/proposal-scope-inspector.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,qFAAqF;AACrF,8FAA8F;AAC9F,EAAE;AACF,6CAA6C;AAC7C,wFAAwF;AACxF,8FAA8F;AAC9F,EAAE;AACF,yCAAyC;AACzC,2FAA2F;AAC3F,uFAAuF;AACvF,EAAE;AACF,oBAAoB;AACpB,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,6DAA6D;AAK7D,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,MAAqB;IAC5E,MAAM,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC;IAErC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,iFAAiF;YACjF,yCAAyC,CAC1C,EACD,EAAE,IAAI,EAAE,2CAA2C,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpE,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,sFAAsF;YACtF,sFAAsF,CACvF,EACD,EAAE,IAAI,EAAE,wCAAwC,EAAE,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAW,CAAC;IAEzD,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0FAA0F;YAC1F,6EAA6E,CAC9E,EACD,EAAE,IAAI,EAAE,2CAA2C,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,eAAe,EAAE,CAAC;QAClD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,uFAAuF;YACvF,wDAAwD,CACzD,EACD,EAAE,IAAI,EAAE,2CAA2C,EAAE,CACtD,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/auth/proposal-scoped-life-api.d.ts

@@ -0,0 +1,21 @@
+import type { ProposalId } from "../types/ids.js";
+import type { AcceptOptions, Proposal } from "../types/proposal.js";
+import type { LifeApi } from "../sdk/life-api.js";
+import type { MintedContext } from "./types.js";
+import type { AuditLog } from "../audit/audit-log.js";
+import type { UnitOfWork } from "../persistence/unit-of-work.js";
+import type { Logger } from "../observability/logger.js";
+export declare class ProposalScopedLifeApi {
+    private readonly _api;
+    private readonly _minted;
+    private readonly _audit;
+    private readonly _mutationLog;
+    private readonly _uow;
+    private readonly _logger?;
+    constructor(_api: LifeApi, _minted: MintedContext, _audit: AuditLog, _mutationLog: AuditLog, _uow: UnitOfWork, _logger?: Logger | undefined);
+    private _writeAuditOrFail;
+    private _actorLabel;
+    private _guardianFields;
+    acceptProposal(proposalId: ProposalId, options: AcceptOptions): Promise<Proposal>;
+}
+export declare function createProposalScopedLifeApi(api: LifeApi, minted: MintedContext, audit: AuditLog, mutationLog: AuditLog, uow: UnitOfWork, logger?: Logger): ProposalScopedLifeApi;

package/dist/auth/proposal-scoped-life-api.js

@@ -0,0 +1,168 @@
+// AUTH_PROPOSAL_ACCEPT_SCOPE_CHECKED_001 — Production-01d-a
+//
+// Facade: binds LifeApi + MintedContext for the proposal surface.
+// Does NOT implement LifeApi — narrower, scope-checked surface.
+// No ctx parameter on any facade method — context is bound at construction time.
+//
+// Production-01d-a surface: acceptProposal only.
+//
+// Accept-time enforcement (in order):
+//   1. getProposal(minted.context, proposalId) — fetch to inspect candidateClaims
+//   2. inspectProposalScope(proposal, minted)  — fires BEFORE any accept delegation
+//   3. api.acceptProposal(minted.context, ...)  — only if scope check passes
+//
+// AUTH_PROPOSAL_ID_NOT_SUBJECT_FREE_001:
+//   ProposalId alone is not authorization proof — candidateClaims carry subject-scoped data.
+// AUTH_PROPOSAL_CANDIDATE_CLAIMS_SCOPED_001:
+//   Every candidateClaim has subject: PersonId (required).
+//
+// Erasure pre-check deferred to Production-01d-b.
+// FactStore-level suppression (Slice-21a) applies at accept time.
+//
+// Deferred (not in 01d-a):
+//   getProposal  — existence-leak risk; AUTH_PROPOSAL_UNAUTHORIZED_AS_NOT_FOUND_001
+//   listProposals — silent exclusion; AUTH_PROPOSAL_LIST_FILTER_REQUIRED_001; needs ProposalQueue inspection
+//   rejectProposal — same scope check required; safe not-found semantics need code inspection
+//   createProposal — no top-level subject in ProposalInput
+//   ProposalId-only is not subject-free proof (AUTH_PROPOSAL_ID_NOT_SUBJECT_FREE_001)
+import { buildAuditEvent } from "../audit/audit-log.js";
+import { asISOTime } from "../types/ids.js";
+import { inspectProposalScope } from "./proposal-scope-inspector.js";
+import { safeLog } from "../observability/logger.js";
+export class ProposalScopedLifeApi {
+    _api;
+    _minted;
+    _audit;
+    _mutationLog;
+    _uow;
+    _logger;
+    // PRODUCTION_AUDIT_ALLOW_MUTATION_ATOMIC_001 (C2a): _mutationLog is the internal allow-path
+    // audit log sharing the SQLite connection; _uow wraps the allow-path audit write + the
+    // delegated mutation in one SAVEPOINT scope. _audit is the caller-supplied deny-path log.
+    constructor(_api, _minted, _audit, _mutationLog, _uow, _logger) {
+        this._api = _api;
+        this._minted = _minted;
+        this._audit = _audit;
+        this._mutationLog = _mutationLog;
+        this._uow = _uow;
+        this._logger = _logger;
+    }
+    // PRODUCTION_AUDIT_FAIL_CLOSED_001: if the audit write fails, throw the fail-closed
+    // error — NOT the original denial. The mutation must not proceed without a recorded event.
+    async _writeAuditOrFail(event) {
+        try {
+            await this._audit.write(event);
+        }
+        catch (err) {
+            safeLog(this._logger, {
+                level: "error", code: "LOG_AUDIT_WRITE_FAILED_001",
+                component: "ProposalScopedLifeApi", operation: "_writeAuditOrFail",
+                message: "audit write failed — proposal operation aborted fail-closed",
+                timestamp: new Date().toISOString(),
+                ...(err instanceof Error ? { errorName: err.name } : {}),
+            });
+            throw Object.assign(new Error("PRODUCTION_AUDIT_FAIL_CLOSED_001: audit write failed — proposal operation aborted fail-closed"), { code: "PRODUCTION_AUDIT_FAIL_CLOSED_001" });
+        }
+    }
+    _actorLabel() {
+        return `${this._minted.principalType}:${this._minted.principalId}`;
+    }
+    // Platform-03 — Guardianship: spread into every buildAuditEvent call in this file.
+    // GUARDIAN_AUDIT_MARKED_001: only set when this context is a guardian context.
+    _guardianFields() {
+        return this._minted.guardianOf !== undefined
+            ? { actingAsGuardian: true, wardId: this._minted.guardianOf }
+            : {};
+    }
+    async acceptProposal(proposalId, options) {
+        const now = asISOTime(new Date().toISOString());
+        // Step 1: fetch the Proposal so candidateClaims can be inspected
+        const proposal = this._api.getProposal(this._minted.context, proposalId);
+        if (proposal === undefined) {
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode: "PROPOSAL_NOT_FOUND",
+                selectorFingerprint: "proposal:accept:not-found",
+                resultCount: 0,
+                resultClaimIds: [],
+                now,
+                ...this._guardianFields(),
+            }));
+            throw Object.assign(new Error(`AUTH_PROPOSAL_ACCEPT_NOT_FOUND_001: proposal ${proposalId} not found`), { code: "AUTH_PROPOSAL_ACCEPT_NOT_FOUND_001" });
+        }
+        // Step 2: inspect scope — AUTH_PROPOSAL_ACCEPT_SCOPE_CHECKED_001
+        // Throws AUTH_PROPOSAL_EMPTY_CANDIDATES_DENIED_001, AUTH_PROPOSAL_MULTI_SUBJECT_DENIED_001,
+        // or AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001 on any violation.
+        try {
+            inspectProposalScope(proposal, this._minted);
+        }
+        catch (err) {
+            const code = err.code;
+            let reasonCode;
+            switch (code) {
+                case "AUTH_PROPOSAL_EMPTY_CANDIDATES_DENIED_001":
+                    reasonCode = "PROPOSAL_EMPTY_CANDIDATES_DENIED";
+                    break;
+                case "AUTH_PROPOSAL_MULTI_SUBJECT_DENIED_001":
+                    reasonCode = "PROPOSAL_MULTI_SUBJECT_DENIED";
+                    break;
+                case "AUTH_PROPOSAL_SUBJECT_SCOPE_VIOLATION_001":
+                    reasonCode = this._minted.authorizedPersonId === undefined
+                        ? "PROPOSAL_BROAD_GRANT_DENIED"
+                        : "PROPOSAL_CROSS_SUBJECT_DENIED";
+                    break;
+                default:
+                    reasonCode = "PROPOSAL_CROSS_SUBJECT_DENIED";
+            }
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode,
+                selectorFingerprint: `proposal:accept:proposalId=${proposalId}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now,
+                ...this._guardianFields(),
+            }));
+            throw err;
+        }
+        // Step 3: allow path — PRODUCTION_AUDIT_ALLOW_MUTATION_ATOMIC_001 (C2a).
+        // Audit write + mutation share one SAVEPOINT scope: if acceptProposal rolls back
+        // (including the nested SourceAwareClaimAppender.appendAll SAVEPOINT), the PROPOSAL_ALLOWED
+        // event rolls back with it. No ghost allow event survives a failed mutation.
+        // GUARDIAN_PROPOSAL_ACCEPT_AUDITED_001: guardian contexts use GUARDIAN_PROPOSAL_ACCEPTED
+        // instead of PROPOSAL_ALLOWED.
+        const allowEvent = buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "allow",
+            reasonCode: this._minted.guardianOf !== undefined ? "GUARDIAN_PROPOSAL_ACCEPTED" : "PROPOSAL_ALLOWED",
+            selectorFingerprint: `proposal:accept:proposalId=${proposalId}`,
+            resultCount: 0,
+            resultClaimIds: [],
+            now,
+            ...this._guardianFields(),
+        });
+        return await this._uow.run(async () => {
+            try {
+                await this._mutationLog.write(allowEvent);
+            }
+            catch (err) {
+                safeLog(this._logger, {
+                    level: "error", code: "LOG_AUDIT_WRITE_FAILED_001",
+                    component: "ProposalScopedLifeApi", operation: "acceptProposal",
+                    message: "audit write failed — proposal operation aborted fail-closed",
+                    timestamp: new Date().toISOString(),
+                    ...(err instanceof Error ? { errorName: err.name } : {}),
+                });
+                throw Object.assign(new Error("PRODUCTION_AUDIT_FAIL_CLOSED_001: audit write failed — proposal operation aborted fail-closed"), { code: "PRODUCTION_AUDIT_FAIL_CLOSED_001" });
+            }
+            // Step 4: delegate with minted.context only — never a caller-supplied context
+            return this._api.acceptProposal(this._minted.context, proposalId, options);
+        });
+    }
+}
+export function createProposalScopedLifeApi(api, minted, audit, mutationLog, uow, logger) {
+    return new ProposalScopedLifeApi(api, minted, audit, mutationLog, uow, logger);
+}
+//# sourceMappingURL=proposal-scoped-life-api.js.map

package/dist/auth/proposal-scoped-life-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-scoped-life-api.js","sourceRoot":"","sources":["../../src/auth/proposal-scoped-life-api.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,kEAAkE;AAClE,gEAAgE;AAChE,iFAAiF;AACjF,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sCAAsC;AACtC,kFAAkF;AAClF,oFAAoF;AACpF,6EAA6E;AAC7E,EAAE;AACF,yCAAyC;AACzC,6FAA6F;AAC7F,6CAA6C;AAC7C,2DAA2D;AAC3D,EAAE;AACF,kDAAkD;AAClD,kEAAkE;AAClE,EAAE;AACF,2BAA2B;AAC3B,oFAAoF;AACpF,6GAA6G;AAC7G,8FAA8F;AAC9F,2DAA2D;AAC3D,sFAAsF;AAOtF,OAAO,EAAE,eAAe,EAAE,MAAuB,uBAAuB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAA8B,iBAAiB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAkB,+BAA+B,CAAC;AAGjF,OAAO,EAAE,OAAO,EAAE,MAAgC,4BAA4B,CAAC;AAE/E,MAAM,OAAO,qBAAqB;IAKb;IACA;IACA;IACA;IACA;IACA;IATnB,4FAA4F;IAC5F,uFAAuF;IACvF,0FAA0F;IAC1F,YACmB,IAAoB,EACpB,OAA0B,EAC1B,MAAqB,EACrB,YAAsB,EACtB,IAAuB,EACvB,OAAmB;QALnB,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAe;QACrB,iBAAY,GAAZ,YAAY,CAAU;QACtB,SAAI,GAAJ,IAAI,CAAmB;QACvB,YAAO,GAAP,OAAO,CAAY;IACnC,CAAC;IAEJ,oFAAoF;IACpF,2FAA2F;IACnF,KAAK,CAAC,iBAAiB,CAAC,KAAiB;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;gBACpB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B;gBAClD,SAAS,EAAE,uBAAuB,EAAE,SAAS,EAAE,mBAAmB;gBAClE,OAAO,EAAE,6DAA6D;gBACtE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,+FAA+F,CAChG,EACD,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IAED,mFAAmF;IACnF,+EAA+E;IACvE,eAAe;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAsB,EAAE,OAAsB;QACjE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAEhD,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU,EAAW,oBAAoB;gBACzC,mBAAmB,EAAE,2BAA2B;gBAChD,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG;gBACH,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,gDAAgD,UAAU,YAAY,CAAC,EACjF,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,4FAA4F;QAC5F,iEAAiE;QACjE,IAAI,CAAC;YACH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,IAAI,UAA2B,CAAC;YAChC,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,2CAA2C;oBAC9C,UAAU,GAAG,kCAAkC,CAAC;oBAChD,MAAM;gBACR,KAAK,wCAAwC;oBAC3C,UAAU,GAAG,+BAA+B,CAAC;oBAC7C,MAAM;gBACR,KAAK,2CAA2C;oBAC9C,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;wBACxD,CAAC,CAAC,6BAA6B;wBAC/B,CAAC,CAAC,+BAA+B,CAAC;oBACpC,MAAM;gBACR;oBACE,UAAU,GAAG,+BAA+B,CAAC;YACjD,CAAC;YACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBAC3C,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;gBACvC,QAAQ,EAAa,MAAM;gBAC3B,UAAU;gBACV,mBAAmB,EAAE,8BAA8B,UAAU,EAAE;gBAC/D,WAAW,EAAU,CAAC;gBACtB,cAAc,EAAO,EAAE;gBACvB,GAAG;gBACH,GAAG,IAAI,CAAC,eAAe,EAAE;aAC1B,CAAC,CAAC,CAAC;YACJ,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,yEAAyE;QACzE,iFAAiF;QACjF,4FAA4F;QAC5F,6EAA6E;QAC7E,yFAAyF;QACzF,+BAA+B;QAC/B,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,KAAK,EAAgB,IAAI,CAAC,WAAW,EAAE;YACvC,QAAQ,EAAa,OAAO;YAC5B,UAAU,EAAW,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,kBAAkB;YAC9G,mBAAmB,EAAE,8BAA8B,UAAU,EAAE;YAC/D,WAAW,EAAU,CAAC;YACtB,cAAc,EAAO,EAAE;YACvB,GAAG;YACH,GAAG,IAAI,CAAC,eAAe,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACpC,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAClD,OAAO,GAAY,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;oBACpB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B;oBAClD,SAAS,EAAE,uBAAuB,EAAE,SAAS,EAAE,gBAAgB;oBAC/D,OAAO,EAAE,6DAA6D;oBACtE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+FAA+F,CAAC,EAC1G,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;YACJ,CAAC;YACD,8EAA8E;YAC9E,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAC7B,IAAI,CAAC,OAAO,CAAC,OAAqC,EAClD,UAAU,EACV,OAAO,CACR,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CAWF;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAoB,EACpB,MAA0B,EAC1B,KAAqB,EACrB,WAAqB,EACrB,GAAuB,EACvB,MAAmB;IAEnB,OAAO,IAAI,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACjF,CAAC"}

package/dist/auth/rate-limited-context-minting-boundary.d.ts

@@ -0,0 +1,27 @@
+import type { ContextMintingBoundary, MintedContext } from "./types.js";
+/**
+ * Host-injectable rate-limiting boundary.
+ * Implementations: Redis sliding window, token bucket, in-memory map, etc.
+ * Contract:
+ *   - Returns void if the key is under its configured limit.
+ *   - Throws with { code: "RATE_LIMIT_EXCEEDED_001" } if over limit.
+ *   - Should handle own infrastructure failures internally.
+ *   - Unexpected throws are handled by onLimiterError config.
+ */
+export interface RateLimiter {
+    checkLimit(key: string): Promise<void>;
+}
+export interface RateLimitedContextMintingBoundaryConfig {
+    readonly inner: ContextMintingBoundary;
+    readonly rateLimiter: RateLimiter;
+    readonly keyFn?: (principalId: string, tenantId: string) => string;
+    readonly onLimiterError?: "allow" | "deny";
+}
+export declare class RateLimitedContextMintingBoundary implements ContextMintingBoundary {
+    private readonly _inner;
+    private readonly _limiter;
+    private readonly _keyFn;
+    private readonly _onError;
+    constructor(config: RateLimitedContextMintingBoundaryConfig);
+    mint(credential: string, targetPersonId: string, requestedKind: "owner" | "agent" | "system" | "audit"): Promise<MintedContext>;
+}

package/dist/auth/rate-limited-context-minting-boundary.js

@@ -0,0 +1,77 @@
+// src/auth/rate-limited-context-minting-boundary.ts
+// INTERNAL — not exported from src/index.ts.
+// RateLimitedContextMintingBoundary wraps any ContextMintingBoundary and adds
+// principal-level rate limiting after inner.mint() produces a verified MintedContext.
+//
+// CRYPTO_BOUNDARY_ONLY_001: does NOT import crypto primitives at runtime.
+//
+// AUTH_FACTORY_AUTH_ADAPTER_OPAQUE_001: the production factory does not
+// import this file. It is the host's responsibility to construct and inject.
+//
+// RATE_LIMIT_VERIFY_BEFORE_CHECK_001:
+//   inner.mint() is called before rateLimiter.checkLimit() on every mint().
+//   Rate limiting always operates on verified principal data.
+//
+// RATE_LIMIT_KEY_NO_CREDENTIAL_001:
+//   The key passed to checkLimit() is derived only from principalId and tenantId.
+//   Raw credential and all cryptographic secret material are excluded.
+//
+// RATE_LIMIT_MINTED_CONTEXT_NOT_RETURNED_ON_DENY_001:
+//   When RATE_LIMIT_EXCEEDED_001 is thrown, the MintedContext is never returned.
+//
+// RATE_LIMIT_STORE_ERROR_CONFIGURABLE_001:
+//   Unexpected checkLimit() errors: default "allow" (fail-open); opt-in "deny".
+//
+// See docs/specs/post-mvp-rate-limiting-spec.md
+import { throwErr } from "./jwt-core.js";
+// ─── RateLimitedContextMintingBoundary ───────────────────────────────────────
+export class RateLimitedContextMintingBoundary {
+    _inner;
+    _limiter;
+    _keyFn;
+    _onError;
+    constructor(config) {
+        this._inner = config.inner;
+        this._limiter = config.rateLimiter;
+        this._keyFn = config.keyFn ?? ((principalId, tenantId) => `${tenantId}:${principalId}`);
+        this._onError = config.onLimiterError ?? "allow";
+    }
+    async mint(credential, targetPersonId, requestedKind) {
+        // Step 1: Delegate to inner boundary — verification occurs here.
+        // All inner errors propagate unchanged; checkLimit is never called on failure.
+        const minted = await this._inner.mint(credential, targetPersonId, requestedKind);
+        // Step 2: Derive rate-limit key from verified principal data only.
+        // Raw credential is not accessible here — the key contains no secret material.
+        let key;
+        try {
+            key = this._keyFn(minted.principalId, minted.tenantId);
+        }
+        catch {
+            // keyFn threw — treat as limiter error, apply onLimiterError policy.
+            if (this._onError === "deny") {
+                throwErr("RATE_LIMIT_STORE_ERROR_001", "rate limiter key derivation failed");
+            }
+            return minted; // fail-open
+        }
+        // Step 3: Check rate limit — at most once per mint().
+        try {
+            await this._limiter.checkLimit(key);
+        }
+        catch (e) {
+            if (typeof e === "object" &&
+                e !== null &&
+                e.code === "RATE_LIMIT_EXCEEDED_001") {
+                // Over limit — deny; minted context is discarded.
+                throwErr("RATE_LIMIT_EXCEEDED_001", "rate limit exceeded");
+            }
+            // Unexpected store error — apply onLimiterError policy.
+            if (this._onError === "deny") {
+                throwErr("RATE_LIMIT_STORE_ERROR_001", "rate limiter unavailable");
+            }
+            // fail-open: fall through and return minted context.
+        }
+        // Step 4: Return minted context (not rate-limited, or limiter failed-open).
+        return minted;
+    }
+}
+//# sourceMappingURL=rate-limited-context-minting-boundary.js.map

package/dist/auth/rate-limited-context-minting-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limited-context-minting-boundary.js","sourceRoot":"","sources":["../../src/auth/rate-limited-context-minting-boundary.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,6CAA6C;AAC7C,8EAA8E;AAC9E,sFAAsF;AACtF,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,sCAAsC;AACtC,4EAA4E;AAC5E,8DAA8D;AAC9D,EAAE;AACF,oCAAoC;AACpC,kFAAkF;AAClF,uEAAuE;AACvE,EAAE;AACF,sDAAsD;AACtD,iFAAiF;AACjF,EAAE;AACF,2CAA2C;AAC3C,gFAAgF;AAChF,EAAE;AACF,gDAAgD;AAGhD,OAAO,EAAE,QAAQ,EAAE,MAAyC,eAAe,CAAC;AAgC5E,gFAAgF;AAEhF,MAAM,OAAO,iCAAiC;IAC3B,MAAM,CAA8B;IACpC,QAAQ,CAAiB;IACzB,MAAM,CAAyD;IAC/D,QAAQ,CAAsB;IAE/C,YAAY,MAA+C;QACzD,IAAI,CAAC,MAAM,GAAK,MAAM,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,MAAM,GAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,OAAO,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAsB,EACtB,cAAsB,EACtB,aAAsD;QAEtD,iEAAiE;QACjE,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;QAEjF,mEAAmE;QACnE,+EAA+E;QAC/E,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC7B,QAAQ,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,YAAY;QAC7B,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IACE,OAAO,CAAC,KAAK,QAAQ;gBACrB,CAAC,KAAK,IAAI;gBACT,CAAwB,CAAC,IAAI,KAAK,yBAAyB,EAC5D,CAAC;gBACD,kDAAkD;gBAClD,QAAQ,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;YAC7D,CAAC;YACD,wDAAwD;YACxD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC7B,QAAQ,CAAC,4BAA4B,EAAE,0BAA0B,CAAC,CAAC;YACrE,CAAC;YACD,qDAAqD;QACvD,CAAC;QAED,4EAA4E;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/auth/revocation-aware-auth-adapter.d.ts

@@ -0,0 +1,21 @@
+import type { AuthAdapter, VerifiedPrincipal } from "./types.js";
+/**
+ * Host-injectable denylist boundary.
+ * Returns true if the jti is currently revoked; false otherwise.
+ * MUST throw on infrastructure failure — fail-closed guarantee.
+ */
+export interface TokenRevocationStore {
+    isRevoked(jti: string): Promise<boolean>;
+}
+export interface RevocationAwareAuthAdapterConfig {
+    readonly inner: AuthAdapter;
+    readonly revocationStore: TokenRevocationStore;
+    readonly requireJti?: boolean;
+}
+export declare class RevocationAwareAuthAdapter implements AuthAdapter {
+    private readonly _inner;
+    private readonly _store;
+    private readonly _requireJti;
+    constructor(config: RevocationAwareAuthAdapterConfig);
+    verify(credential: string): Promise<VerifiedPrincipal>;
+}

package/dist/auth/revocation-aware-auth-adapter.js

@@ -0,0 +1,88 @@
+// src/auth/revocation-aware-auth-adapter.ts
+// INTERNAL — not exported from src/index.ts.
+// RevocationAwareAuthAdapter wraps any AuthAdapter and adds JTI denylist checking.
+// JTI is extracted from the unverified payload before inner.verify() is called.
+//
+// CRYPTO_BOUNDARY_ONLY_001: does NOT import crypto primitives at runtime.
+// All cryptographic verification is delegated to the inner adapter.
+//
+// AUTH_FACTORY_AUTH_ADAPTER_OPAQUE_001: the production factory does not
+// import this file. It is the host's responsibility to construct and inject.
+//
+// SESSION_REVOCATION_DENYLIST_CHECKED_BEFORE_VERIFY_001:
+//   isRevoked() is called before inner.verify() on every verify() invocation
+//   that has a non-absent JTI.
+//
+// SESSION_REVOCATION_STORE_ERROR_FAIL_CLOSED_001:
+//   Any thrown error from revocationStore.isRevoked() results in
+//   SESSION_REVOCATION_STORE_ERROR_001. Never allows on store failure.
+//
+// SESSION_REVOCATION_AT_MOST_ONE_STORE_CALL_001:
+//   At most one isRevoked() call is made per verify() invocation.
+//
+// See docs/specs/post-mvp-session-revocation-spec.md
+import { throwErr } from "./jwt-core.js";
+// ─── extractJtiUnsafe ────────────────────────────────────────────────────────
+// Extracts the `jti` string from the raw (unverified) JWT payload segment.
+// Returns undefined on any parse failure, structural mismatch, or absent/non-string jti.
+// Never throws. Does NOT verify the signature — the jti is used as a denylist key only.
+function extractJtiUnsafe(credential) {
+    try {
+        const parts = credential.split(".");
+        if (parts.length !== 3)
+            return undefined;
+        const payloadSeg = parts[1];
+        if (!payloadSeg || payloadSeg.length === 0)
+            return undefined;
+        const bytes = Buffer.from(payloadSeg, "base64url");
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            return undefined;
+        }
+        const jti = parsed["jti"];
+        if (typeof jti !== "string" || jti.length === 0)
+            return undefined;
+        return jti;
+    }
+    catch {
+        return undefined;
+    }
+}
+// ─── RevocationAwareAuthAdapter ──────────────────────────────────────────────
+export class RevocationAwareAuthAdapter {
+    _inner;
+    _store;
+    _requireJti;
+    constructor(config) {
+        this._inner = config.inner;
+        this._store = config.revocationStore;
+        this._requireJti = config.requireJti === true;
+    }
+    async verify(credential) {
+        // Step 1: Extract JTI from unverified payload (no signature check here)
+        const jti = extractJtiUnsafe(credential);
+        // Step 2: Enforce requireJti policy
+        if (jti === undefined) {
+            if (this._requireJti) {
+                throwErr("SESSION_REVOCATION_JTI_MISSING_001", "jti claim required but absent");
+            }
+            // No JTI and not required — skip denylist, delegate directly
+            return this._inner.verify(credential);
+        }
+        // Step 3: Query revocation store — fail-closed on any error
+        let revoked;
+        try {
+            revoked = await this._store.isRevoked(jti);
+        }
+        catch {
+            throwErr("SESSION_REVOCATION_STORE_ERROR_001", "revocation store unavailable");
+        }
+        // Step 4: Deny if revoked
+        if (revoked) {
+            throwErr("SESSION_REVOCATION_TOKEN_REVOKED_001", "token has been revoked");
+        }
+        // Step 5: Delegate to inner adapter (signature + claim verification)
+        return this._inner.verify(credential);
+    }
+}
+//# sourceMappingURL=revocation-aware-auth-adapter.js.map

package/dist/auth/revocation-aware-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation-aware-auth-adapter.js","sourceRoot":"","sources":["../../src/auth/revocation-aware-auth-adapter.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,6CAA6C;AAC7C,mFAAmF;AACnF,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,yDAAyD;AACzD,6EAA6E;AAC7E,+BAA+B;AAC/B,EAAE;AACF,kDAAkD;AAClD,iEAAiE;AACjE,uEAAuE;AACvE,EAAE;AACF,iDAAiD;AACjD,kEAAkE;AAClE,EAAE;AACF,qDAAqD;AAGrD,OAAO,EAAE,QAAQ,EAAE,MAAkC,eAAe,CAAC;AAuBrE,gFAAgF;AAEhF,2EAA2E;AAC3E,yFAAyF;AACzF,wFAAwF;AACxF,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7D,MAAM,KAAK,GAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAI,MAAkC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,0BAA0B;IACpB,MAAM,CAAmB;IACzB,MAAM,CAA4B;IAClC,WAAW,CAAU;IAEtC,YAAY,MAAwC;QAClD,IAAI,CAAC,MAAM,GAAQ,MAAM,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,MAAM,GAAQ,MAAM,CAAC,eAAe,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,wEAAwE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEzC,oCAAoC;QACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,QAAQ,CAAC,oCAAoC,EAAE,+BAA+B,CAAC,CAAC;YAClF,CAAC;YACD,6DAA6D;YAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAED,4DAA4D;QAC5D,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,oCAAoC,EAAE,8BAA8B,CAAC,CAAC;QACjF,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,sCAAsC,EAAE,wBAAwB,CAAC,CAAC;QAC7E,CAAC;QAED,qEAAqE;QACrE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/auth/sqlite-grant-resolver.d.ts

@@ -0,0 +1,8 @@
+import Database from "better-sqlite3";
+import type { Clock, GrantDescriptor, GrantResolver } from "./types.js";
+export declare class SQLiteGrantResolver implements GrantResolver {
+    private readonly _clock;
+    private readonly _stmt;
+    constructor(db: Database.Database, clock: Clock);
+    resolveActiveGrant(agentId: string, grantId: string, tenantId: string): Promise<GrantDescriptor | undefined>;
+}

package/dist/auth/sqlite-grant-resolver.js

@@ -0,0 +1,78 @@
+// SQLite-backed GrantResolver — Production-02d-b.
+// Do NOT export from src/index.ts.
+//
+// AUTH_SQLITE_GRANT_RESOLVER_BACKEND_001: implements GrantResolver with a
+//   Database.Database-backed read path; behaviorally identical to InMemoryGrantResolver
+//   for all denial and pass cases.
+// AUTH_SQLITE_GRANT_STATUS_CHECKED_001: resolveActiveGrant rejects status === "revoked"
+//   rows; revoked grants return undefined regardless of time window.
+// AUTH_SQLITE_GRANT_TIME_WINDOW_CHECKED_001: uses Date.parse epoch ms (not raw string
+//   comparison) for not_before/not_after checks.
+// AUTH_SQLITE_AUTH_BACKEND_FAIL_CLOSED_001: any invalid stored time string causes
+//   resolveActiveGrant to throw — not return undefined; data integrity errors are
+//   distinguishable from "no active grant".
+// AUTH_SQLITE_GRANT_SCHEMA_001: constructor throws this code when auth_grants table
+//   is absent — signals missing runMigrations call, not a runtime auth denial.
+//
+// Storage-failure behavior: SQLite errors propagate as thrown — never converted
+//   to undefined (a real storage failure is not the same as "no active grant").
+//
+// PRODUCTION_AUTH_GRANT_PERSON_SCOPE_PROPAGATED_001: person_id is read from the store and
+//   propagated to GrantDescriptor.personId (null → undefined).
+import { asPersonId } from "../types/ids.js";
+const SCHEMA_CODE = "AUTH_SQLITE_GRANT_SCHEMA_001";
+const FAIL_CLOSED_CODE = "AUTH_SQLITE_AUTH_BACKEND_FAIL_CLOSED_001";
+export class SQLiteGrantResolver {
+    _clock;
+    _stmt;
+    constructor(db, clock) {
+        // AUTH_SQLITE_GRANT_SCHEMA_001: fail if migration has not run
+        const tablePresent = db
+            .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='auth_grants'")
+            .get() !== undefined;
+        if (!tablePresent) {
+            throw Object.assign(new Error(`[${SCHEMA_CODE}] auth_grants table absent — call runMigrations before constructing SQLiteGrantResolver`), { code: SCHEMA_CODE });
+        }
+        this._clock = clock;
+        // Uses auth_grants_lookup index: (agent_id, tenant_id, grant_id)
+        this._stmt = db.prepare("SELECT grant_id, agent_id, tenant_id, status, not_before, not_after, person_id " +
+            "FROM auth_grants WHERE grant_id = ? AND agent_id = ? AND tenant_id = ?");
+    }
+    async resolveActiveGrant(agentId, grantId, tenantId) {
+        // SQLite errors propagate — they are NOT caught here.
+        const row = this._stmt.get(grantId, agentId, tenantId);
+        if (row === undefined)
+            return undefined;
+        // AUTH_SQLITE_GRANT_STATUS_CHECKED_001: revoked grants are permanently denied
+        if (row.status === "revoked")
+            return undefined;
+        // AUTH_SQLITE_GRANT_TIME_WINDOW_CHECKED_001 + AUTH_SQLITE_AUTH_BACKEND_FAIL_CLOSED_001:
+        // Parse via Date.parse epoch ms — never compare raw strings with < / >.
+        const notBeforeMs = Date.parse(row.not_before);
+        const notAfterMs = Date.parse(row.not_after);
+        if (isNaN(notBeforeMs)) {
+            throw Object.assign(new Error(`[${FAIL_CLOSED_CODE}] auth_grants.not_before "${row.not_before}" is not a valid ISO-8601 string for grant ${row.grant_id}`), { code: FAIL_CLOSED_CODE, grantId: row.grant_id });
+        }
+        if (isNaN(notAfterMs)) {
+            throw Object.assign(new Error(`[${FAIL_CLOSED_CODE}] auth_grants.not_after "${row.not_after}" is not a valid ISO-8601 string for grant ${row.grant_id}`), { code: FAIL_CLOSED_CODE, grantId: row.grant_id });
+        }
+        const nowMs = Date.parse(this._clock.now());
+        // Not-yet-active
+        if (nowMs < notBeforeMs)
+            return undefined;
+        // AUTH_GRANT_EXPIRED_DENIED_001: expired at or after notAfter
+        if (nowMs >= notAfterMs)
+            return undefined;
+        // All checks passed — return descriptor.
+        // PRODUCTION_AUTH_GRANT_PERSON_SCOPE_PROPAGATED_001: person scope read from the store.
+        return {
+            grantId: row.grant_id,
+            agentId: row.agent_id,
+            tenantId: row.tenant_id,
+            notAfter: row.not_after,
+            // exactOptionalPropertyTypes: omit the property entirely when NULL.
+            ...(row.person_id !== null ? { personId: asPersonId(row.person_id) } : {}),
+        };
+    }
+}
+//# sourceMappingURL=sqlite-grant-resolver.js.map