@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/org-permissions.d.ts

@@ -0,0 +1,194 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { AglynOrgMember, OrgRole } from '../foundation';
+/**
+ * Granular org permissions (AGL-243) layered on the 4 org roles: each
+ * role maps to a default permission set; custom roles
+ * (`orgs/{orgId}/roles/{roleId}`) and per-member overrides refine it, so
+ * e.g. an editor restricted to one host can also be granted billing
+ * visibility — or an admin stripped of it — without inventing new roles.
+ * The console hides unpermitted surfaces; the org API routes are the
+ * enforcement point.
+ */
+export type CoreOrgPermission = 'org.settings' | 'org.auditLog' | 'billing.view' | 'billing.manage' | 'members.manage' | 'hosts.create' | 'hosts.delete' | 'data.manage' | 'marketplace.publish' | 'plugins.install';
+/**
+ * A key of the catalog: a core key above, or a key a plugin declares into
+ * the catalog through `registerPluginEntitlements` (AGL-2984). A declared key
+ * is stored on custom roles and member overrides, layered and resolved
+ * exactly like a core key.
+ */
+export type OrgPermission = CoreOrgPermission | (string & {});
+/**
+ * Legacy boolean permission map derived from the granular `OrgPermission`
+ * set (AGL-243). Kept for the console surfaces that predate the granular
+ * model; lives here so relocated feature plugins can accept it as a prop
+ * (AGL-395).
+ */
+export interface OrgPermissions {
+    createHosts: boolean;
+    editHosts: boolean;
+    editBilling: boolean;
+    publishToMarketplace: boolean;
+    installPlugins: boolean;
+    manageMembers: boolean;
+}
+export interface OrgPermissionDefinition {
+    key: OrgPermission;
+    label: string;
+    description: string;
+    /** The plugin that declared the key; absent for a core key. */
+    pluginId?: string;
+}
+/**
+ * Every permission, in display order for role editors: the core keys, then
+ * the keys plugins declare through `registerPluginEntitlements`, in the
+ * plugins' catalog order (AGL-2984).
+ *
+ * LIVE, and kept in step in place. A plugin's declarations register at
+ * module scope — at boot on the server, before the first paint in the
+ * console — which can be after a module holding this binding was evaluated.
+ * So this array, the key list, the role defaults and the empty map below are
+ * rewritten in place on every registration instead of being computed once
+ * when this module loads, and whoever holds the binding reads the declared
+ * keys with the core ones.
+ */
+export declare const ORG_PERMISSIONS: readonly OrgPermissionDefinition[];
+export declare const ORG_PERMISSION_KEYS: readonly OrgPermission[];
+/**
+ * Role → default permission set. Owner/admin hold everything (owner-only
+ * actions like org deletion stay role-checked, not permission-checked);
+ * editors work on content but see no money or roster controls; viewers read
+ * only. A declared key's default for each role is the one its declaration
+ * names.
+ */
+export declare const DEFAULT_ROLE_PERMISSIONS: Record<OrgRole, Record<OrgPermission, boolean>>;
+/** `orgs/{orgId}/roles/{roleId}` — a named custom permission set. */
+export interface AglynOrgCustomRole {
+    $id?: string;
+    name?: string;
+    description?: string;
+    /** Full permission map; missing keys read as false. */
+    permissions?: Partial<Record<OrgPermission, boolean>>;
+}
+/**
+ * Effective permission map for a member: the org role's defaults, then
+ * the custom role's map (when the member has `roleId` and the role doc
+ * is supplied), then per-member overrides — later layers win key-by-key.
+ */
+export declare function resolveOrgPermissions(member: (Partial<AglynOrgMember> & {
+    roleId?: string;
+    permissions?: Partial<Record<OrgPermission, boolean>>;
+}) | null | undefined, customRole?: AglynOrgCustomRole | null): Record<OrgPermission, boolean>;
+/**
+ * The values a custom role and a per-member override set EXPLICITLY for
+ * permission keys outside this catalog — the keys plugins declare through
+ * `registerPluginPermissions` (AGL-2974).
+ *
+ * `resolveOrgPermissions` walks the catalog alone, so a plugin key stored on
+ * a custom role or a member document never reached the `resolvedPermissions`
+ * stamp the Firestore rules read. A rule gating on one could then honor
+ * neither a grant to an editor nor a revocation from an admin. This carries
+ * exactly those stored decisions, custom role first and the per-member
+ * override over it, which is the precedence the resolver applies.
+ *
+ * Tier DEFAULTS are deliberately absent. They live in the plugin registry,
+ * which is populated per process by whichever plugin bundles that process
+ * loaded, and a stamp computed from it would differ by which route happened
+ * to write it. A rule supplies the default itself from the member's role,
+ * the way `memberResolves` is always conjoined with a role gate.
+ *
+ * The legacy six camelCase keys are excluded as well: they are the catalog's
+ * older projection, not plugin keys, and no rule reads them.
+ */
+export declare function explicitPluginPermissionValues(member: {
+    roleId?: string;
+    permissions?: Partial<Record<string, unknown>> | null;
+} | null | undefined, customRole?: {
+    permissions?: Partial<Record<string, unknown>> | null;
+} | null): Record<string, boolean>;
+/**
+ * The `resolvedPermissions` map stamped on a member document for the
+ * Firestore rules: the catalog verdict with every layer applied, and beside
+ * it the plugin keys a custom role or an override set explicitly.
+ *
+ * One function for every writer of the stamp, so the org-create transaction
+ * and `syncOrgAuthProjections` cannot project different maps. The catalog
+ * spreads last; the two key spaces do not overlap, and the order keeps it
+ * true that nothing but the resolver decides a catalog key.
+ */
+export declare function projectMemberResolvedPermissions(member: Parameters<typeof resolveOrgPermissions>[0], customRole?: AglynOrgCustomRole | null): Record<string, boolean>;
+/** Single-permission convenience over `resolveOrgPermissions`. */
+export declare function hasOrgPermission(member: Parameters<typeof resolveOrgPermissions>[0], permission: OrgPermission, customRole?: AglynOrgCustomRole | null): boolean;
+/** The catalog label for a key — the words a refusal names — or the key itself. */
+export declare function orgPermissionLabel(permission: OrgPermission): string;
+/** The keys plugins declared into the catalog, in catalog order. */
+export declare function pluginOrgPermissionKeys(): OrgPermission[];
+/** One declared catalog key that moved, and the direction it moved in. */
+export interface PluginPermissionChange {
+    permission: string;
+    granted: boolean;
+}
+/**
+ * The keys PLUGINS declared into the catalog whose value moved between two
+ * maps, in the new map's order — what a member, role or collaborator write
+ * raises `org.permissions.changed` for, once per key, so the plugin that owns
+ * a key can record who moved it.
+ *
+ * A key the new map leaves unset is not a change: on a role it defers to the
+ * base role, on a site toggle to the host role, and neither is a grant or a
+ * revocation of its own. A key set for the first time is a change, because
+ * the verdict it produces is no longer the default's. The core keys and the
+ * legacy six raise nothing; their writes are recorded by the routes' own
+ * activity sentences.
+ */
+export declare function pluginPermissionChanges(before: Partial<Record<string, unknown>> | null | undefined, after: Partial<Record<string, unknown>> | null | undefined): PluginPermissionChange[];
+/**
+ * The granular (dotted) set projected onto the legacy boolean map
+ * (AGL-2350).
+ *
+ * ## Why this lives here rather than in the console hook
+ *
+ * It was a private function in `apps/console/hooks/use-org-permissions.ts`,
+ * which meant the CLIENT translated the stored permission model into the
+ * legacy flags and the SERVER did not translate at all — it derived the
+ * legacy flags straight from the built-in role tier and dropped custom roles
+ * and per-member overrides on the floor. The two disagreed exactly on the
+ * feature `custom-roles.md` sells, in both directions: a permission granted
+ * by a custom role showed in the UI and 403'd on POST, and one revoked by an
+ * override was hidden in the UI and still succeeded on POST.
+ *
+ * One exported copy is what stops them drifting again.
+ *
+ * ## The key spaces are NOT interchangeable, and that is the trap
+ *
+ * Two permission vocabularies exist. The stored one is DOTTED
+ * (`plugins.install`) — `apps/console/app/api/orgs/roles/route.ts` sanitizes
+ * against `ORG_PERMISSION_KEYS` before writing, and `AglynOrgMember`
+ * `permissions` is typed to it. The legacy one is camelCase
+ * (`installPlugins`).
+ *
+ * `resolveRolePermissions` in `org-roles.ts` accepts `overrides` and
+ * `customRoles` arguments keyed by the CAMELCASE space. Feeding it the real
+ * stored documents therefore matches no key and changes nothing — it looks
+ * like wiring the feature up while doing precisely nothing. Those two
+ * parameters are used by nothing but that module's own spec. Translate
+ * through here instead.
+ *
+ * `editHosts` is derived from the ROLE, not from a dotted key: it has no
+ * counterpart in the granular catalog and never had one.
+ */
+export declare function toLegacyPermissions(granted: Record<OrgPermission, boolean>, role: OrgRole | null | undefined): OrgPermissions;

package/src/lib/app-utils/org-permissions.js

@@ -0,0 +1,357 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { listPluginOrgPermissions, subscribePluginEntitlements } from "../plugin-manager/plugin-entitlements.js";
+import { ORG_ROLE_PERMISSION_KEYS } from "./org-roles.js";
+/**
+ * The core keys, in display order for role editors.
+ *
+ * ⚠️ **EVERY KEY HERE MUST BE ENFORCED SERVER-SIDE.** A permission a customer
+ * can tick that changes nothing is worse than its absence, because it implies
+ * a control that does not exist — an owner unticks "delete sites", hands the
+ * role out, and the member deletes sites while the console does not even dim
+ * the button. Three of the eleven were in exactly that state (AGL-2444).
+ *
+ * `marketing.manage` was removed rather than wired, and the reason is worth
+ * keeping: announcement bars, popups and campaigns live at
+ * `hosts/{hostId}/overlays|campaigns|experiments` and are written
+ * client-direct against the security rules, which gate on the HOST role.
+ * There is no org-level boundary for it to sit on, and the action it named is
+ * not org-scoped at all. Wiring it would have meant inventing one and
+ * producing a second permission that looks enforced and is not. If a granular
+ * marketing permission is wanted it belongs in the plugin-declared mechanism
+ * (AGL-435), scoped to a host — a product decision, not this repair.
+ *
+ * `apps/console/specs/org-permissions-are-enforced.spec.ts` fails the build if
+ * a key here, or a key a plugin declares, gains no server-side consumer.
+ */ const CORE_ORG_PERMISSIONS = [
+    {
+        key: 'org.settings',
+        label: 'Organization settings',
+        description: 'Rename the organization, change its slug, transfer it.'
+    },
+    {
+        key: 'org.auditLog',
+        label: 'Activity & audit log',
+        description: 'See the organization activity feed.'
+    },
+    {
+        key: 'billing.view',
+        label: 'View billing',
+        description: 'See the plan, usage meters, and invoices.'
+    },
+    {
+        key: 'billing.manage',
+        label: 'Manage billing',
+        description: 'Change plans, buy add-ons, update payment details.'
+    },
+    {
+        key: 'members.manage',
+        label: 'Manage members',
+        description: 'Invite, remove, and re-role organization members.'
+    },
+    {
+        key: 'hosts.create',
+        label: 'Create sites',
+        description: 'Create new sites in the organization.'
+    },
+    {
+        key: 'hosts.delete',
+        label: 'Delete sites',
+        description: 'Delete sites the member can access.'
+    },
+    {
+        key: 'data.manage',
+        label: 'Manage data',
+        description: 'Create, edit, and delete organization datasets.'
+    },
+    {
+        key: 'marketplace.publish',
+        label: 'Publish to marketplace',
+        description: 'Publish listings under the organization profile.'
+    },
+    {
+        key: 'plugins.install',
+        label: 'Install plugins',
+        description: 'Install or remove marketplace plugins.'
+    }
+];
+/** The core keys: a plugin may add keys beside them and never redefine one. */ const CORE_ORG_PERMISSION_KEYS = new Set(CORE_ORG_PERMISSIONS.map((definition)=>definition.key));
+/** The legacy camelCase projection's keys, which no declaration may take either. */ const LEGACY_PERMISSION_KEYS = new Set(ORG_ROLE_PERMISSION_KEYS);
+/** The core keys each org role holds when nothing refines it. */ const CORE_ROLE_GRANTS = {
+    owner: CORE_ORG_PERMISSION_KEYS,
+    admin: CORE_ORG_PERMISSION_KEYS,
+    editor: new Set([
+        'data.manage',
+        'marketplace.publish',
+        'plugins.install'
+    ]),
+    viewer: new Set()
+};
+const ORG_ROLES = [
+    'owner',
+    'admin',
+    'editor',
+    'viewer'
+];
+/**
+ * Every permission, in display order for role editors: the core keys, then
+ * the keys plugins declare through `registerPluginEntitlements`, in the
+ * plugins' catalog order (AGL-2984).
+ *
+ * LIVE, and kept in step in place. A plugin's declarations register at
+ * module scope — at boot on the server, before the first paint in the
+ * console — which can be after a module holding this binding was evaluated.
+ * So this array, the key list, the role defaults and the empty map below are
+ * rewritten in place on every registration instead of being computed once
+ * when this module loads, and whoever holds the binding reads the declared
+ * keys with the core ones.
+ */ export const ORG_PERMISSIONS = [];
+export const ORG_PERMISSION_KEYS = [];
+const NO_PERMISSIONS = {};
+/**
+ * Role → default permission set. Owner/admin hold everything (owner-only
+ * actions like org deletion stay role-checked, not permission-checked);
+ * editors work on content but see no money or roster controls; viewers read
+ * only. A declared key's default for each role is the one its declaration
+ * names.
+ */ export const DEFAULT_ROLE_PERMISSIONS = {
+    owner: {},
+    admin: {},
+    editor: {},
+    viewer: {}
+};
+/** Refused declarations already logged, so a refusal is reported once. */ const reportedRefusals = new Set();
+function replaceItems(target, items) {
+    const list = target;
+    list.length = 0;
+    list.push(...items);
+}
+function replaceEntries(target, entries) {
+    for (const key of Object.keys(target))delete target[key];
+    Object.assign(target, entries);
+}
+/**
+ * Rebuilds the live catalog: the core keys, then every key a plugin declared.
+ * A declaration naming a core or legacy key is refused — that key keeps its
+ * own meaning and defaults — and logged once.
+ */ function syncCatalog() {
+    const definitions = [
+        ...CORE_ORG_PERMISSIONS
+    ];
+    const declaredDefaults = new Map();
+    for (const declared of listPluginOrgPermissions()){
+        if (CORE_ORG_PERMISSION_KEYS.has(declared.key) || LEGACY_PERMISSION_KEYS.has(declared.key)) {
+            const refusal = `${declared.pluginId}\x00${declared.key}`;
+            if (!reportedRefusals.has(refusal)) {
+                reportedRefusals.add(refusal);
+                console.error(`[plugins] refused catalog permission "${declared.key}" to ` + `"${declared.pluginId}": the key belongs to the core catalog`);
+            }
+            continue;
+        }
+        definitions.push({
+            key: declared.key,
+            label: declared.label,
+            description: declared.description,
+            pluginId: declared.pluginId
+        });
+        declaredDefaults.set(declared.key, declared.roleDefaults);
+    }
+    const keys = definitions.map((definition)=>definition.key);
+    replaceItems(ORG_PERMISSIONS, definitions);
+    replaceItems(ORG_PERMISSION_KEYS, keys);
+    replaceEntries(NO_PERMISSIONS, Object.fromEntries(keys.map((key)=>[
+            key,
+            false
+        ])));
+    for (const role of ORG_ROLES){
+        replaceEntries(DEFAULT_ROLE_PERMISSIONS[role], Object.fromEntries(keys.map((key)=>{
+            var _declaredDefaults_get;
+            return [
+                key,
+                declaredDefaults.has(key) ? ((_declaredDefaults_get = declaredDefaults.get(key)) == null ? void 0 : _declaredDefaults_get[role]) === true : CORE_ROLE_GRANTS[role].has(key)
+            ];
+        })));
+    }
+    CATALOG_AND_LEGACY_KEYS.clear();
+    for (const key of [
+        ...keys,
+        ...LEGACY_PERMISSION_KEYS
+    ]){
+        CATALOG_AND_LEGACY_KEYS.add(key);
+    }
+}
+/**
+ * Effective permission map for a member: the org role's defaults, then
+ * the custom role's map (when the member has `roleId` and the role doc
+ * is supplied), then per-member overrides — later layers win key-by-key.
+ */ export function resolveOrgPermissions(member, customRole) {
+    var _member_role, _DEFAULT_ROLE_PERMISSIONS_role;
+    if (!member) return NO_PERMISSIONS;
+    const role = (_member_role = member.role) != null ? _member_role : 'viewer';
+    const base = (_DEFAULT_ROLE_PERMISSIONS_role = DEFAULT_ROLE_PERMISSIONS[role]) != null ? _DEFAULT_ROLE_PERMISSIONS_role : NO_PERMISSIONS;
+    const merged = _extends({}, base);
+    if (member.roleId && (customRole == null ? void 0 : customRole.permissions)) {
+        for (const key of ORG_PERMISSION_KEYS){
+            const value = customRole.permissions[key];
+            if (typeof value === 'boolean') merged[key] = value;
+        }
+    }
+    if (member.permissions) {
+        for (const key of ORG_PERMISSION_KEYS){
+            const value = member.permissions[key];
+            if (typeof value === 'boolean') merged[key] = value;
+        }
+    }
+    return merged;
+}
+/**
+ * The values a custom role and a per-member override set EXPLICITLY for
+ * permission keys outside this catalog — the keys plugins declare through
+ * `registerPluginPermissions` (AGL-2974).
+ *
+ * `resolveOrgPermissions` walks the catalog alone, so a plugin key stored on
+ * a custom role or a member document never reached the `resolvedPermissions`
+ * stamp the Firestore rules read. A rule gating on one could then honor
+ * neither a grant to an editor nor a revocation from an admin. This carries
+ * exactly those stored decisions, custom role first and the per-member
+ * override over it, which is the precedence the resolver applies.
+ *
+ * Tier DEFAULTS are deliberately absent. They live in the plugin registry,
+ * which is populated per process by whichever plugin bundles that process
+ * loaded, and a stamp computed from it would differ by which route happened
+ * to write it. A rule supplies the default itself from the member's role,
+ * the way `memberResolves` is always conjoined with a role gate.
+ *
+ * The legacy six camelCase keys are excluded as well: they are the catalog's
+ * older projection, not plugin keys, and no rule reads them.
+ */ export function explicitPluginPermissionValues(member, customRole) {
+    const values = {};
+    if (!member) return values;
+    const layers = [
+        member.roleId ? customRole == null ? void 0 : customRole.permissions : undefined,
+        member.permissions
+    ];
+    for (const layer of layers){
+        for (const [key, value] of Object.entries(layer != null ? layer : {})){
+            if (typeof value !== 'boolean') continue;
+            if (CATALOG_AND_LEGACY_KEYS.has(key)) continue;
+            values[key] = value;
+        }
+    }
+    return values;
+}
+/**
+ * Keys {@link explicitPluginPermissionValues} leaves to the catalog: every
+ * catalog key, declared ones included, and the legacy six. Kept in step by
+ * `syncCatalog`.
+ */ const CATALOG_AND_LEGACY_KEYS = new Set();
+/**
+ * The `resolvedPermissions` map stamped on a member document for the
+ * Firestore rules: the catalog verdict with every layer applied, and beside
+ * it the plugin keys a custom role or an override set explicitly.
+ *
+ * One function for every writer of the stamp, so the org-create transaction
+ * and `syncOrgAuthProjections` cannot project different maps. The catalog
+ * spreads last; the two key spaces do not overlap, and the order keeps it
+ * true that nothing but the resolver decides a catalog key.
+ */ export function projectMemberResolvedPermissions(member, customRole) {
+    return _extends({}, explicitPluginPermissionValues(member, customRole), resolveOrgPermissions(member, customRole));
+}
+/** Single-permission convenience over `resolveOrgPermissions`. */ export function hasOrgPermission(member, permission, customRole) {
+    return resolveOrgPermissions(member, customRole)[permission];
+}
+/** The catalog label for a key — the words a refusal names — or the key itself. */ export function orgPermissionLabel(permission) {
+    var _ref;
+    var _ORG_PERMISSIONS_find;
+    return (_ref = (_ORG_PERMISSIONS_find = ORG_PERMISSIONS.find((definition)=>definition.key === permission)) == null ? void 0 : _ORG_PERMISSIONS_find.label) != null ? _ref : permission;
+}
+/** The keys plugins declared into the catalog, in catalog order. */ export function pluginOrgPermissionKeys() {
+    return ORG_PERMISSIONS.filter((definition)=>definition.pluginId).map((definition)=>definition.key);
+}
+/**
+ * The keys PLUGINS declared into the catalog whose value moved between two
+ * maps, in the new map's order — what a member, role or collaborator write
+ * raises `org.permissions.changed` for, once per key, so the plugin that owns
+ * a key can record who moved it.
+ *
+ * A key the new map leaves unset is not a change: on a role it defers to the
+ * base role, on a site toggle to the host role, and neither is a grant or a
+ * revocation of its own. A key set for the first time is a change, because
+ * the verdict it produces is no longer the default's. The core keys and the
+ * legacy six raise nothing; their writes are recorded by the routes' own
+ * activity sentences.
+ */ export function pluginPermissionChanges(before, after) {
+    const changes = [];
+    for (const [key, next] of Object.entries(after != null ? after : {})){
+        if (typeof next !== 'boolean') continue;
+        if (CORE_ORG_PERMISSION_KEYS.has(key) || LEGACY_PERMISSION_KEYS.has(key)) continue;
+        if ((before == null ? void 0 : before[key]) === next) continue;
+        changes.push({
+            permission: key,
+            granted: next
+        });
+    }
+    return changes;
+}
+/**
+ * The granular (dotted) set projected onto the legacy boolean map
+ * (AGL-2350).
+ *
+ * ## Why this lives here rather than in the console hook
+ *
+ * It was a private function in `apps/console/hooks/use-org-permissions.ts`,
+ * which meant the CLIENT translated the stored permission model into the
+ * legacy flags and the SERVER did not translate at all — it derived the
+ * legacy flags straight from the built-in role tier and dropped custom roles
+ * and per-member overrides on the floor. The two disagreed exactly on the
+ * feature `custom-roles.md` sells, in both directions: a permission granted
+ * by a custom role showed in the UI and 403'd on POST, and one revoked by an
+ * override was hidden in the UI and still succeeded on POST.
+ *
+ * One exported copy is what stops them drifting again.
+ *
+ * ## The key spaces are NOT interchangeable, and that is the trap
+ *
+ * Two permission vocabularies exist. The stored one is DOTTED
+ * (`plugins.install`) — `apps/console/app/api/orgs/roles/route.ts` sanitizes
+ * against `ORG_PERMISSION_KEYS` before writing, and `AglynOrgMember`
+ * `permissions` is typed to it. The legacy one is camelCase
+ * (`installPlugins`).
+ *
+ * `resolveRolePermissions` in `org-roles.ts` accepts `overrides` and
+ * `customRoles` arguments keyed by the CAMELCASE space. Feeding it the real
+ * stored documents therefore matches no key and changes nothing — it looks
+ * like wiring the feature up while doing precisely nothing. Those two
+ * parameters are used by nothing but that module's own spec. Translate
+ * through here instead.
+ *
+ * `editHosts` is derived from the ROLE, not from a dotted key: it has no
+ * counterpart in the granular catalog and never had one.
+ */ export function toLegacyPermissions(granted, role) {
+    return {
+        createHosts: granted['hosts.create'],
+        editHosts: role !== 'viewer',
+        editBilling: granted['billing.manage'],
+        publishToMarketplace: granted['marketplace.publish'],
+        installPlugins: granted['plugins.install'],
+        manageMembers: granted['members.manage']
+    };
+}
+syncCatalog();
+subscribePluginEntitlements(syncCatalog);
+
+//# sourceMappingURL=org-permissions.js.map

package/src/lib/app-utils/org-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/org-permissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { AglynOrgMember, OrgRole } from '../foundation'\nimport {\n  listPluginOrgPermissions,\n  subscribePluginEntitlements,\n} from '../plugin-manager/plugin-entitlements'\nimport { ORG_ROLE_PERMISSION_KEYS } from './org-roles'\n\n/**\n * Granular org permissions (AGL-243) layered on the 4 org roles: each\n * role maps to a default permission set; custom roles\n * (`orgs/{orgId}/roles/{roleId}`) and per-member overrides refine it, so\n * e.g. an editor restricted to one host can also be granted billing\n * visibility — or an admin stripped of it — without inventing new roles.\n * The console hides unpermitted surfaces; the org API routes are the\n * enforcement point.\n */\nexport type CoreOrgPermission =\n  | 'org.settings'\n  | 'org.auditLog'\n  | 'billing.view'\n  | 'billing.manage'\n  | 'members.manage'\n  | 'hosts.create'\n  | 'hosts.delete'\n  | 'data.manage'\n  | 'marketplace.publish'\n  | 'plugins.install'\n\n/**\n * A key of the catalog: a core key above, or a key a plugin declares into\n * the catalog through `registerPluginEntitlements` (AGL-2984). A declared key\n * is stored on custom roles and member overrides, layered and resolved\n * exactly like a core key.\n */\nexport type OrgPermission = CoreOrgPermission | (string & {})\n\n/**\n * Legacy boolean permission map derived from the granular `OrgPermission`\n * set (AGL-243). Kept for the console surfaces that predate the granular\n * model; lives here so relocated feature plugins can accept it as a prop\n * (AGL-395).\n */\nexport interface OrgPermissions {\n  createHosts: boolean\n  editHosts: boolean\n  editBilling: boolean\n  publishToMarketplace: boolean\n  installPlugins: boolean\n  manageMembers: boolean\n}\n\nexport interface OrgPermissionDefinition {\n  key: OrgPermission\n  label: string\n  description: string\n  /** The plugin that declared the key; absent for a core key. */\n  pluginId?: string\n}\n\n/**\n * The core keys, in display order for role editors.\n *\n * ⚠️ **EVERY KEY HERE MUST BE ENFORCED SERVER-SIDE.** A permission a customer\n * can tick that changes nothing is worse than its absence, because it implies\n * a control that does not exist — an owner unticks \"delete sites\", hands the\n * role out, and the member deletes sites while the console does not even dim\n * the button. Three of the eleven were in exactly that state (AGL-2444).\n *\n * `marketing.manage` was removed rather than wired, and the reason is worth\n * keeping: announcement bars, popups and campaigns live at\n * `hosts/{hostId}/overlays|campaigns|experiments` and are written\n * client-direct against the security rules, which gate on the HOST role.\n * There is no org-level boundary for it to sit on, and the action it named is\n * not org-scoped at all. Wiring it would have meant inventing one and\n * producing a second permission that looks enforced and is not. If a granular\n * marketing permission is wanted it belongs in the plugin-declared mechanism\n * (AGL-435), scoped to a host — a product decision, not this repair.\n *\n * `apps/console/specs/org-permissions-are-enforced.spec.ts` fails the build if\n * a key here, or a key a plugin declares, gains no server-side consumer.\n */\nconst CORE_ORG_PERMISSIONS: readonly OrgPermissionDefinition[] = [\n  {\n    key: 'org.settings',\n    label: 'Organization settings',\n    description: 'Rename the organization, change its slug, transfer it.',\n  },\n  {\n    key: 'org.auditLog',\n    label: 'Activity & audit log',\n    description: 'See the organization activity feed.',\n  },\n  {\n    key: 'billing.view',\n    label: 'View billing',\n    description: 'See the plan, usage meters, and invoices.',\n  },\n  {\n    key: 'billing.manage',\n    label: 'Manage billing',\n    description: 'Change plans, buy add-ons, update payment details.',\n  },\n  {\n    key: 'members.manage',\n    label: 'Manage members',\n    description: 'Invite, remove, and re-role organization members.',\n  },\n  {\n    key: 'hosts.create',\n    label: 'Create sites',\n    description: 'Create new sites in the organization.',\n  },\n  {\n    key: 'hosts.delete',\n    label: 'Delete sites',\n    description: 'Delete sites the member can access.',\n  },\n  {\n    key: 'data.manage',\n    label: 'Manage data',\n    description: 'Create, edit, and delete organization datasets.',\n  },\n  {\n    key: 'marketplace.publish',\n    label: 'Publish to marketplace',\n    description: 'Publish listings under the organization profile.',\n  },\n  {\n    key: 'plugins.install',\n    label: 'Install plugins',\n    description: 'Install or remove marketplace plugins.',\n  },\n]\n\n/** The core keys: a plugin may add keys beside them and never redefine one. */\nconst CORE_ORG_PERMISSION_KEYS: ReadonlySet<string> = new Set(\n  CORE_ORG_PERMISSIONS.map((definition) => definition.key),\n)\n\n/** The legacy camelCase projection's keys, which no declaration may take either. */\nconst LEGACY_PERMISSION_KEYS: ReadonlySet<string> = new Set<string>(\n  ORG_ROLE_PERMISSION_KEYS,\n)\n\n/** The core keys each org role holds when nothing refines it. */\nconst CORE_ROLE_GRANTS: Record<OrgRole, ReadonlySet<string>> = {\n  owner: CORE_ORG_PERMISSION_KEYS,\n  admin: CORE_ORG_PERMISSION_KEYS,\n  editor: new Set<CoreOrgPermission>([\n    'data.manage',\n    'marketplace.publish',\n    'plugins.install',\n  ]),\n  viewer: new Set<string>(),\n}\n\nconst ORG_ROLES: readonly OrgRole[] = ['owner', 'admin', 'editor', 'viewer']\n\n/**\n * Every permission, in display order for role editors: the core keys, then\n * the keys plugins declare through `registerPluginEntitlements`, in the\n * plugins' catalog order (AGL-2984).\n *\n * LIVE, and kept in step in place. A plugin's declarations register at\n * module scope — at boot on the server, before the first paint in the\n * console — which can be after a module holding this binding was evaluated.\n * So this array, the key list, the role defaults and the empty map below are\n * rewritten in place on every registration instead of being computed once\n * when this module loads, and whoever holds the binding reads the declared\n * keys with the core ones.\n */\nexport const ORG_PERMISSIONS: readonly OrgPermissionDefinition[] = []\n\nexport const ORG_PERMISSION_KEYS: readonly OrgPermission[] = []\n\nconst NO_PERMISSIONS = {} as Record<OrgPermission, boolean>\n\n/**\n * Role → default permission set. Owner/admin hold everything (owner-only\n * actions like org deletion stay role-checked, not permission-checked);\n * editors work on content but see no money or roster controls; viewers read\n * only. A declared key's default for each role is the one its declaration\n * names.\n */\nexport const DEFAULT_ROLE_PERMISSIONS: Record<\n  OrgRole,\n  Record<OrgPermission, boolean>\n> = {\n  owner: {} as Record<OrgPermission, boolean>,\n  admin: {} as Record<OrgPermission, boolean>,\n  editor: {} as Record<OrgPermission, boolean>,\n  viewer: {} as Record<OrgPermission, boolean>,\n}\n\n/** Refused declarations already logged, so a refusal is reported once. */\nconst reportedRefusals = new Set<string>()\n\nfunction replaceItems<T>(target: readonly T[], items: readonly T[]): void {\n  const list = target as T[]\n  list.length = 0\n  list.push(...items)\n}\n\nfunction replaceEntries(\n  target: Record<string, boolean>,\n  entries: Record<string, boolean>,\n): void {\n  for (const key of Object.keys(target)) delete target[key]\n  Object.assign(target, entries)\n}\n\n/**\n * Rebuilds the live catalog: the core keys, then every key a plugin declared.\n * A declaration naming a core or legacy key is refused — that key keeps its\n * own meaning and defaults — and logged once.\n */\nfunction syncCatalog(): void {\n  const definitions: OrgPermissionDefinition[] = [...CORE_ORG_PERMISSIONS]\n  const declaredDefaults = new Map<string, Readonly<Record<OrgRole, boolean>>>()\n  for (const declared of listPluginOrgPermissions()) {\n    if (\n      CORE_ORG_PERMISSION_KEYS.has(declared.key) ||\n      LEGACY_PERMISSION_KEYS.has(declared.key)\n    ) {\n      const refusal = `${declared.pluginId}\\x00${declared.key}`\n      if (!reportedRefusals.has(refusal)) {\n        reportedRefusals.add(refusal)\n        console.error(\n          `[plugins] refused catalog permission \"${declared.key}\" to ` +\n            `\"${declared.pluginId}\": the key belongs to the core catalog`,\n        )\n      }\n      continue\n    }\n    definitions.push({\n      key: declared.key,\n      label: declared.label,\n      description: declared.description,\n      pluginId: declared.pluginId,\n    })\n    declaredDefaults.set(declared.key, declared.roleDefaults)\n  }\n  const keys = definitions.map((definition) => definition.key)\n  replaceItems(ORG_PERMISSIONS, definitions)\n  replaceItems(ORG_PERMISSION_KEYS, keys)\n  replaceEntries(NO_PERMISSIONS, Object.fromEntries(keys.map((key) => [key, false])))\n  for (const role of ORG_ROLES) {\n    replaceEntries(\n      DEFAULT_ROLE_PERMISSIONS[role],\n      Object.fromEntries(\n        keys.map((key) => [\n          key,\n          declaredDefaults.has(key)\n            ? declaredDefaults.get(key)?.[role] === true\n            : CORE_ROLE_GRANTS[role].has(key),\n        ]),\n      ),\n    )\n  }\n  CATALOG_AND_LEGACY_KEYS.clear()\n  for (const key of [...keys, ...LEGACY_PERMISSION_KEYS]) {\n    CATALOG_AND_LEGACY_KEYS.add(key)\n  }\n}\n\n/** `orgs/{orgId}/roles/{roleId}` — a named custom permission set. */\nexport interface AglynOrgCustomRole {\n  $id?: string\n  name?: string\n  description?: string\n  /** Full permission map; missing keys read as false. */\n  permissions?: Partial<Record<OrgPermission, boolean>>\n}\n\n/**\n * Effective permission map for a member: the org role's defaults, then\n * the custom role's map (when the member has `roleId` and the role doc\n * is supplied), then per-member overrides — later layers win key-by-key.\n */\nexport function resolveOrgPermissions(\n  member:\n    | (Partial<AglynOrgMember> & {\n        roleId?: string\n        permissions?: Partial<Record<OrgPermission, boolean>>\n      })\n    | null\n    | undefined,\n  customRole?: AglynOrgCustomRole | null,\n): Record<OrgPermission, boolean> {\n  if (!member) return NO_PERMISSIONS\n  const role = (member.role ?? 'viewer') as OrgRole\n  const base = DEFAULT_ROLE_PERMISSIONS[role] ?? NO_PERMISSIONS\n  const merged: Record<OrgPermission, boolean> = { ...base }\n  if (member.roleId && customRole?.permissions) {\n    for (const key of ORG_PERMISSION_KEYS) {\n      const value = customRole.permissions[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  if (member.permissions) {\n    for (const key of ORG_PERMISSION_KEYS) {\n      const value = member.permissions[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  return merged\n}\n\n/**\n * The values a custom role and a per-member override set EXPLICITLY for\n * permission keys outside this catalog — the keys plugins declare through\n * `registerPluginPermissions` (AGL-2974).\n *\n * `resolveOrgPermissions` walks the catalog alone, so a plugin key stored on\n * a custom role or a member document never reached the `resolvedPermissions`\n * stamp the Firestore rules read. A rule gating on one could then honor\n * neither a grant to an editor nor a revocation from an admin. This carries\n * exactly those stored decisions, custom role first and the per-member\n * override over it, which is the precedence the resolver applies.\n *\n * Tier DEFAULTS are deliberately absent. They live in the plugin registry,\n * which is populated per process by whichever plugin bundles that process\n * loaded, and a stamp computed from it would differ by which route happened\n * to write it. A rule supplies the default itself from the member's role,\n * the way `memberResolves` is always conjoined with a role gate.\n *\n * The legacy six camelCase keys are excluded as well: they are the catalog's\n * older projection, not plugin keys, and no rule reads them.\n */\nexport function explicitPluginPermissionValues(\n  member:\n    | {\n        roleId?: string\n        permissions?: Partial<Record<string, unknown>> | null\n      }\n    | null\n    | undefined,\n  customRole?: { permissions?: Partial<Record<string, unknown>> | null } | null,\n): Record<string, boolean> {\n  const values: Record<string, boolean> = {}\n  if (!member) return values\n  const layers = [\n    member.roleId ? customRole?.permissions : undefined,\n    member.permissions,\n  ]\n  for (const layer of layers) {\n    for (const [key, value] of Object.entries(layer ?? {})) {\n      if (typeof value !== 'boolean') continue\n      if (CATALOG_AND_LEGACY_KEYS.has(key)) continue\n      values[key] = value\n    }\n  }\n  return values\n}\n\n/**\n * Keys {@link explicitPluginPermissionValues} leaves to the catalog: every\n * catalog key, declared ones included, and the legacy six. Kept in step by\n * `syncCatalog`.\n */\nconst CATALOG_AND_LEGACY_KEYS = new Set<string>()\n\n/**\n * The `resolvedPermissions` map stamped on a member document for the\n * Firestore rules: the catalog verdict with every layer applied, and beside\n * it the plugin keys a custom role or an override set explicitly.\n *\n * One function for every writer of the stamp, so the org-create transaction\n * and `syncOrgAuthProjections` cannot project different maps. The catalog\n * spreads last; the two key spaces do not overlap, and the order keeps it\n * true that nothing but the resolver decides a catalog key.\n */\nexport function projectMemberResolvedPermissions(\n  member: Parameters<typeof resolveOrgPermissions>[0],\n  customRole?: AglynOrgCustomRole | null,\n): Record<string, boolean> {\n  return {\n    ...explicitPluginPermissionValues(member, customRole),\n    ...resolveOrgPermissions(member, customRole),\n  }\n}\n\n/** Single-permission convenience over `resolveOrgPermissions`. */\nexport function hasOrgPermission(\n  member: Parameters<typeof resolveOrgPermissions>[0],\n  permission: OrgPermission,\n  customRole?: AglynOrgCustomRole | null,\n): boolean {\n  return resolveOrgPermissions(member, customRole)[permission]\n}\n\n/** The catalog label for a key — the words a refusal names — or the key itself. */\nexport function orgPermissionLabel(permission: OrgPermission): string {\n  return (\n    ORG_PERMISSIONS.find((definition) => definition.key === permission)?.label ??\n    permission\n  )\n}\n\n/** The keys plugins declared into the catalog, in catalog order. */\nexport function pluginOrgPermissionKeys(): OrgPermission[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.pluginId).map(\n    (definition) => definition.key,\n  )\n}\n\n/** One declared catalog key that moved, and the direction it moved in. */\nexport interface PluginPermissionChange {\n  permission: string\n  granted: boolean\n}\n\n/**\n * The keys PLUGINS declared into the catalog whose value moved between two\n * maps, in the new map's order — what a member, role or collaborator write\n * raises `org.permissions.changed` for, once per key, so the plugin that owns\n * a key can record who moved it.\n *\n * A key the new map leaves unset is not a change: on a role it defers to the\n * base role, on a site toggle to the host role, and neither is a grant or a\n * revocation of its own. A key set for the first time is a change, because\n * the verdict it produces is no longer the default's. The core keys and the\n * legacy six raise nothing; their writes are recorded by the routes' own\n * activity sentences.\n */\nexport function pluginPermissionChanges(\n  before: Partial<Record<string, unknown>> | null | undefined,\n  after: Partial<Record<string, unknown>> | null | undefined,\n): PluginPermissionChange[] {\n  const changes: PluginPermissionChange[] = []\n  for (const [key, next] of Object.entries(after ?? {})) {\n    if (typeof next !== 'boolean') continue\n    if (CORE_ORG_PERMISSION_KEYS.has(key) || LEGACY_PERMISSION_KEYS.has(key)) continue\n    if (before?.[key] === next) continue\n    changes.push({ permission: key, granted: next })\n  }\n  return changes\n}\n\n/**\n * The granular (dotted) set projected onto the legacy boolean map\n * (AGL-2350).\n *\n * ## Why this lives here rather than in the console hook\n *\n * It was a private function in `apps/console/hooks/use-org-permissions.ts`,\n * which meant the CLIENT translated the stored permission model into the\n * legacy flags and the SERVER did not translate at all — it derived the\n * legacy flags straight from the built-in role tier and dropped custom roles\n * and per-member overrides on the floor. The two disagreed exactly on the\n * feature `custom-roles.md` sells, in both directions: a permission granted\n * by a custom role showed in the UI and 403'd on POST, and one revoked by an\n * override was hidden in the UI and still succeeded on POST.\n *\n * One exported copy is what stops them drifting again.\n *\n * ## The key spaces are NOT interchangeable, and that is the trap\n *\n * Two permission vocabularies exist. The stored one is DOTTED\n * (`plugins.install`) — `apps/console/app/api/orgs/roles/route.ts` sanitizes\n * against `ORG_PERMISSION_KEYS` before writing, and `AglynOrgMember`\n * `permissions` is typed to it. The legacy one is camelCase\n * (`installPlugins`).\n *\n * `resolveRolePermissions` in `org-roles.ts` accepts `overrides` and\n * `customRoles` arguments keyed by the CAMELCASE space. Feeding it the real\n * stored documents therefore matches no key and changes nothing — it looks\n * like wiring the feature up while doing precisely nothing. Those two\n * parameters are used by nothing but that module's own spec. Translate\n * through here instead.\n *\n * `editHosts` is derived from the ROLE, not from a dotted key: it has no\n * counterpart in the granular catalog and never had one.\n */\nexport function toLegacyPermissions(\n  granted: Record<OrgPermission, boolean>,\n  role: OrgRole | null | undefined,\n): OrgPermissions {\n  return {\n    createHosts: granted['hosts.create'],\n    editHosts: role !== 'viewer',\n    editBilling: granted['billing.manage'],\n    publishToMarketplace: granted['marketplace.publish'],\n    installPlugins: granted['plugins.install'],\n    manageMembers: granted['members.manage'],\n  }\n}\n\nsyncCatalog()\nsubscribePluginEntitlements(syncCatalog)\n"],"names":["listPluginOrgPermissions","subscribePluginEntitlements","ORG_ROLE_PERMISSION_KEYS","CORE_ORG_PERMISSIONS","key","label","description","CORE_ORG_PERMISSION_KEYS","Set","map","definition","LEGACY_PERMISSION_KEYS","CORE_ROLE_GRANTS","owner","admin","editor","viewer","ORG_ROLES","ORG_PERMISSIONS","ORG_PERMISSION_KEYS","NO_PERMISSIONS","DEFAULT_ROLE_PERMISSIONS","reportedRefusals","replaceItems","target","items","list","length","push","replaceEntries","entries","Object","keys","assign","syncCatalog","definitions","declaredDefaults","Map","declared","has","refusal","pluginId","add","console","error","set","roleDefaults","fromEntries","role","get","CATALOG_AND_LEGACY_KEYS","clear","resolveOrgPermissions","member","customRole","base","merged","roleId","permissions","value","explicitPluginPermissionValues","values","layers","undefined","layer","projectMemberResolvedPermissions","hasOrgPermission","permission","orgPermissionLabel","find","pluginOrgPermissionKeys","filter","pluginPermissionChanges","before","after","changes","next","granted","toLegacyPermissions","createHosts","editHosts","editBilling","publishToMarketplace","installPlugins","manageMembers"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,wBAAwB,EACxBC,2BAA2B,QACtB,2CAAuC;AAC9C,SAASC,wBAAwB,QAAQ,iBAAa;AAsDtD;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,MAAMC,uBAA2D;IAC/D;QACEC,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;IACA;QACEF,KAAK;QACLC,OAAO;QACPC,aAAa;IACf;CACD;AAED,6EAA6E,GAC7E,MAAMC,2BAAgD,IAAIC,IACxDL,qBAAqBM,GAAG,CAAC,CAACC,aAAeA,WAAWN,GAAG;AAGzD,kFAAkF,GAClF,MAAMO,yBAA8C,IAAIH,IACtDN;AAGF,+DAA+D,GAC/D,MAAMU,mBAAyD;IAC7DC,OAAON;IACPO,OAAOP;IACPQ,QAAQ,IAAIP,IAAuB;QACjC;QACA;QACA;KACD;IACDQ,QAAQ,IAAIR;AACd;AAEA,MAAMS,YAAgC;IAAC;IAAS;IAAS;IAAU;CAAS;AAE5E;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,kBAAsD,EAAE,CAAA;AAErE,OAAO,MAAMC,sBAAgD,EAAE,CAAA;AAE/D,MAAMC,iBAAiB,CAAC;AAExB;;;;;;CAMC,GACD,OAAO,MAAMC,2BAGT;IACFR,OAAO,CAAC;IACRC,OAAO,CAAC;IACRC,QAAQ,CAAC;IACTC,QAAQ,CAAC;AACX,EAAC;AAED,wEAAwE,GACxE,MAAMM,mBAAmB,IAAId;AAE7B,SAASe,aAAgBC,MAAoB,EAAEC,KAAmB;IAChE,MAAMC,OAAOF;IACbE,KAAKC,MAAM,GAAG;IACdD,KAAKE,IAAI,IAAIH;AACf;AAEA,SAASI,eACPL,MAA+B,EAC/BM,OAAgC;IAEhC,KAAK,MAAM1B,OAAO2B,OAAOC,IAAI,CAACR,QAAS,OAAOA,MAAM,CAACpB,IAAI;IACzD2B,OAAOE,MAAM,CAACT,QAAQM;AACxB;AAEA;;;;CAIC,GACD,SAASI;IACP,MAAMC,cAAyC;WAAIhC;KAAqB;IACxE,MAAMiC,mBAAmB,IAAIC;IAC7B,KAAK,MAAMC,YAAYtC,2BAA4B;QACjD,IACEO,yBAAyBgC,GAAG,CAACD,SAASlC,GAAG,KACzCO,uBAAuB4B,GAAG,CAACD,SAASlC,GAAG,GACvC;YACA,MAAMoC,UAAU,GAAGF,SAASG,QAAQ,CAAC,IAAI,EAAEH,SAASlC,GAAG,EAAE;YACzD,IAAI,CAACkB,iBAAiBiB,GAAG,CAACC,UAAU;gBAClClB,iBAAiBoB,GAAG,CAACF;gBACrBG,QAAQC,KAAK,CACX,CAAC,sCAAsC,EAAEN,SAASlC,GAAG,CAAC,KAAK,CAAC,GAC1D,CAAC,CAAC,EAAEkC,SAASG,QAAQ,CAAC,sCAAsC,CAAC;YAEnE;YACA;QACF;QACAN,YAAYP,IAAI,CAAC;YACfxB,KAAKkC,SAASlC,GAAG;YACjBC,OAAOiC,SAASjC,KAAK;YACrBC,aAAagC,SAAShC,WAAW;YACjCmC,UAAUH,SAASG,QAAQ;QAC7B;QACAL,iBAAiBS,GAAG,CAACP,SAASlC,GAAG,EAAEkC,SAASQ,YAAY;IAC1D;IACA,MAAMd,OAAOG,YAAY1B,GAAG,CAAC,CAACC,aAAeA,WAAWN,GAAG;IAC3DmB,aAAaL,iBAAiBiB;IAC9BZ,aAAaJ,qBAAqBa;IAClCH,eAAeT,gBAAgBW,OAAOgB,WAAW,CAACf,KAAKvB,GAAG,CAAC,CAACL,MAAQ;YAACA;YAAK;SAAM;IAChF,KAAK,MAAM4C,QAAQ/B,UAAW;QAC5BY,eACER,wBAAwB,CAAC2B,KAAK,EAC9BjB,OAAOgB,WAAW,CAChBf,KAAKvB,GAAG,CAAC,CAACL;gBAGJgC;mBAHY;gBAChBhC;gBACAgC,iBAAiBG,GAAG,CAACnC,OACjBgC,EAAAA,wBAAAA,iBAAiBa,GAAG,CAAC7C,yBAArBgC,qBAA2B,CAACY,KAAK,MAAK,OACtCpC,gBAAgB,CAACoC,KAAK,CAACT,GAAG,CAACnC;aAChC;;IAGP;IACA8C,wBAAwBC,KAAK;IAC7B,KAAK,MAAM/C,OAAO;WAAI4B;WAASrB;KAAuB,CAAE;QACtDuC,wBAAwBR,GAAG,CAACtC;IAC9B;AACF;AAWA;;;;CAIC,GACD,OAAO,SAASgD,sBACdC,MAMa,EACbC,UAAsC;QAGxBD,cACDhC;IAFb,IAAI,CAACgC,QAAQ,OAAOjC;IACpB,MAAM4B,QAAQK,eAAAA,OAAOL,IAAI,YAAXK,eAAe;IAC7B,MAAME,QAAOlC,iCAAAA,wBAAwB,CAAC2B,KAAK,YAA9B3B,iCAAkCD;IAC/C,MAAMoC,SAAyC,aAAKD;IACpD,IAAIF,OAAOI,MAAM,KAAIH,8BAAAA,WAAYI,WAAW,GAAE;QAC5C,KAAK,MAAMtD,OAAOe,oBAAqB;YACrC,MAAMwC,QAAQL,WAAWI,WAAW,CAACtD,IAAI;YACzC,IAAI,OAAOuD,UAAU,WAAWH,MAAM,CAACpD,IAAI,GAAGuD;QAChD;IACF;IACA,IAAIN,OAAOK,WAAW,EAAE;QACtB,KAAK,MAAMtD,OAAOe,oBAAqB;YACrC,MAAMwC,QAAQN,OAAOK,WAAW,CAACtD,IAAI;YACrC,IAAI,OAAOuD,UAAU,WAAWH,MAAM,CAACpD,IAAI,GAAGuD;QAChD;IACF;IACA,OAAOH;AACT;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASI,+BACdP,MAMa,EACbC,UAA6E;IAE7E,MAAMO,SAAkC,CAAC;IACzC,IAAI,CAACR,QAAQ,OAAOQ;IACpB,MAAMC,SAAS;QACbT,OAAOI,MAAM,GAAGH,8BAAAA,WAAYI,WAAW,GAAGK;QAC1CV,OAAOK,WAAW;KACnB;IACD,KAAK,MAAMM,SAASF,OAAQ;QAC1B,KAAK,MAAM,CAAC1D,KAAKuD,MAAM,IAAI5B,OAAOD,OAAO,CAACkC,gBAAAA,QAAS,CAAC,GAAI;YACtD,IAAI,OAAOL,UAAU,WAAW;YAChC,IAAIT,wBAAwBX,GAAG,CAACnC,MAAM;YACtCyD,MAAM,CAACzD,IAAI,GAAGuD;QAChB;IACF;IACA,OAAOE;AACT;AAEA;;;;CAIC,GACD,MAAMX,0BAA0B,IAAI1C;AAEpC;;;;;;;;;CASC,GACD,OAAO,SAASyD,iCACdZ,MAAmD,EACnDC,UAAsC;IAEtC,OAAO,aACFM,+BAA+BP,QAAQC,aACvCF,sBAAsBC,QAAQC;AAErC;AAEA,gEAAgE,GAChE,OAAO,SAASY,iBACdb,MAAmD,EACnDc,UAAyB,EACzBb,UAAsC;IAEtC,OAAOF,sBAAsBC,QAAQC,WAAW,CAACa,WAAW;AAC9D;AAEA,iFAAiF,GACjF,OAAO,SAASC,mBAAmBD,UAAyB;;QAExDjD;IADF,gBACEA,wBAAAA,gBAAgBmD,IAAI,CAAC,CAAC3D,aAAeA,WAAWN,GAAG,KAAK+D,gCAAxDjD,sBAAqEb,KAAK,mBAC1E8D;AAEJ;AAEA,kEAAkE,GAClE,OAAO,SAASG;IACd,OAAOpD,gBAAgBqD,MAAM,CAAC,CAAC7D,aAAeA,WAAW+B,QAAQ,EAAEhC,GAAG,CACpE,CAACC,aAAeA,WAAWN,GAAG;AAElC;AAQA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASoE,wBACdC,MAA2D,EAC3DC,KAA0D;IAE1D,MAAMC,UAAoC,EAAE;IAC5C,KAAK,MAAM,CAACvE,KAAKwE,KAAK,IAAI7C,OAAOD,OAAO,CAAC4C,gBAAAA,QAAS,CAAC,GAAI;QACrD,IAAI,OAAOE,SAAS,WAAW;QAC/B,IAAIrE,yBAAyBgC,GAAG,CAACnC,QAAQO,uBAAuB4B,GAAG,CAACnC,MAAM;QAC1E,IAAIqE,CAAAA,0BAAAA,MAAQ,CAACrE,IAAI,MAAKwE,MAAM;QAC5BD,QAAQ/C,IAAI,CAAC;YAAEuC,YAAY/D;YAAKyE,SAASD;QAAK;IAChD;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,OAAO,SAASG,oBACdD,OAAuC,EACvC7B,IAAgC;IAEhC,OAAO;QACL+B,aAAaF,OAAO,CAAC,eAAe;QACpCG,WAAWhC,SAAS;QACpBiC,aAAaJ,OAAO,CAAC,iBAAiB;QACtCK,sBAAsBL,OAAO,CAAC,sBAAsB;QACpDM,gBAAgBN,OAAO,CAAC,kBAAkB;QAC1CO,eAAeP,OAAO,CAAC,iBAAiB;IAC1C;AACF;AAEA3C;AACAjC,4BAA4BiC"}