@aglyn/aglyn 1.0.0-beta.285 → 1.0.0-beta.288

package/src/lib/app-utils/host-permissions.js

@@ -13,9 +13,12 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { listPluginOrgPermissions } from "../plugin-manager/plugin-entitlements.js";
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { refinePermissionMap } from "../plugin-manager/plugin-permissions.js";
 import { hostRoleFor, isOrgWideMember } from "./organizations.js";
-import { resolveOrgPermissions } from "./org-permissions.js";
+import { CORE_SITE_ROLE_PRESETS } from "./org-role-grants.js";
+import { permissionRefusalText, ORG_PERMISSION_REFINEMENTS, ORG_PERMISSIONS, resolveOrgPermissions } from "./org-permissions.js";
+import { orgRoleTier } from "./org-roles.js";
 /**
  * Catalog keys a site collaborator holds PER SITE (AGL-2984), resolved on one
  * of two axes.
@@ -35,14 +38,23 @@ import { resolveOrgPermissions } from "./org-permissions.js";
  * names no site at all: there is no host role to read a default from, and
  * guessing one would let a request reach around the per-site toggle by
  * omitting the site.
- */ /** The catalog keys a collaborator can hold per site, in catalog order. */ export function hostPermissionKeys() {
-    return listPluginOrgPermissions().filter((permission)=>permission.hostRoleDefaults !== undefined).map((permission)=>permission.key);
+ */ /**
+ * The catalog keys a collaborator can hold per site, in catalog order: every
+ * key with host-role defaults, the core's site keys (AGL-4047) and the ones
+ * plugins declare.
+ */ export function hostPermissionKeys() {
+    return ORG_PERMISSIONS.filter((definition)=>definition.hostRoleDefaults !== undefined).map((definition)=>definition.key);
 }
-/** What a host role grants for every per-site key, before any toggle. */ export function hostRolePermissionDefaults(role) {
+/**
+ * What a host role grants a site collaborator for every per-site key, before
+ * any toggle. A key whose site-role preset holds for members of the whole
+ * workspace only (`workspaceMembersOnly`, AGL-4047) grants a collaborator
+ * nothing, whatever their site role.
+ */ export function hostRolePermissionDefaults(role) {
     const defaults = {};
-    for (const permission of listPluginOrgPermissions()){
-        if (!permission.hostRoleDefaults) continue;
-        defaults[permission.key] = permission.hostRoleDefaults[role] === true;
+    for (const definition of ORG_PERMISSIONS){
+        if (!definition.hostRoleDefaults) continue;
+        defaults[definition.key] = !definition.workspaceMembersOnly && definition.hostRoleDefaults[role] === true;
     }
     return defaults;
 }
@@ -52,6 +64,13 @@ import { resolveOrgPermissions } from "./org-permissions.js";
             false
         ]));
 }
+/**
+ * The catalog's refinements whose key and broader key are both in `map`
+ * (AGL-4047): the links a per-site map can settle on its own. A link to a
+ * key the map does not carry would read that key as refused and add it.
+ */ function refinementsWithin(map) {
+    return ORG_PERMISSION_REFINEMENTS.filter(([key, parent])=>key in map && parent in map);
+}
 /**
  * A collaborator's verdict on ONE site for every per-site key, or null where
  * they have no access to that site at all. An absent toggle reads as the host
@@ -70,7 +89,314 @@ import { resolveOrgPermissions } from "./org-permissions.js";
             if (typeof value === 'boolean') merged[key] = value;
         }
     }
-    return merged;
+    // A per-site key that follows or refines another per-site key (AGL-4047)
+    // takes its verdict from that key on this site where the site sets nothing
+    // for it, as the org catalog's resolver does with a custom role.
+    return refinePermissionMap(merged, refinementsWithin(merged), [
+        toggles
+    ]);
+}
+/*
+ * KEYS WHOSE PRESET IS THE SITE ROLE (AGL-4047).
+ *
+ * Some checks were written against the member's role on a site: who may book
+ * a walk-in, change a stay or edit a site's reservations asked whether their
+ * `memberRoles` entry was Admin, Editor or Author. Roles are only presets of
+ * permissions, so those checks became keys, and a key that replaces a gate
+ * on the site role keeps that role as its preset (`presetFromSiteRole`):
+ *
+ *   1. the member's role ON THE SITE (`hostRoleFor`): Admin for the owner and
+ *      admins, a workspace-wide editor's or viewer's own role unless the site
+ *      gives them other access there, narrower or wider, and a collaborator's
+ *      site role; no access to the site holds nothing;
+ *   2. that role's `hostRoleDefaults` verdict for the key;
+ *   3. then, for a workspace-wide member, their custom role's verdict and
+ *      their own permissions' verdict, when either sets the key;
+ *   4. then the site's own toggle for them (`hostPermissions[hostId][key]`).
+ *
+ * With nothing set at 3 or 4, the verdict is exactly what the role gate
+ * answered, for every member on every site, which is how the built-in roles
+ * keep the access they had. A collaborator has no custom role and no
+ * workspace standing to refine, so only the site's toggle moves their
+ * verdict, as for every other per-site key.
+ *
+ * A key declared `workspaceMembersOnly` replaces a gate that asked for an
+ * admin of the whole workspace who is also this site's admin: its preset at
+ * 2 is the site role's for a member of the whole workspace and refusal for a
+ * collaborator, whose site role (even Admin) never carried it. The site's
+ * toggle at 4 still grants it to them.
+ *
+ * These keys narrow nothing (`narrowsPerSite` is dropped): the site role is
+ * already their preset. With no site named, the org catalog's verdict
+ * (`roleDefaults`, then the layers) stands, which is the same answer for a
+ * workspace-wide member on a site where their access is their workspace role.
+ */ /** The catalog keys whose preset is the member's role on the site, in catalog order. */ export function siteRolePresetPermissionKeys() {
+    return ORG_PERMISSIONS.filter((definition)=>definition.presetFromSiteRole).map((definition)=>definition.key);
+}
+/** Is this a key whose preset is the member's role on the site? */ export function isSiteRolePresetPermission(permission) {
+    return ORG_PERMISSIONS.some((definition)=>definition.key === permission && definition.presetFromSiteRole === true);
+}
+/**
+ * A member's verdict on ONE site for every key whose preset is their role
+ * there (see above). `customRole` is their custom role document when they
+ * carry a `roleId` and the caller has it, and is ignored for a collaborator.
+ * No site named, or no access to it, refuses every such key.
+ */ export function resolveSiteRolePresetPermissions(member, hostId, customRole) {
+    var _member_hostPermissions;
+    const definitions = ORG_PERMISSIONS.filter((definition)=>definition.presetFromSiteRole);
+    if (!definitions.length) return {};
+    const role = member && hostId ? hostRoleFor(member, hostId) : null;
+    if (!member || !hostId || !role) {
+        return Object.fromEntries(definitions.map((definition)=>[
+                definition.key,
+                false
+            ]));
+    }
+    const toggles = (_member_hostPermissions = member.hostPermissions) == null ? void 0 : _member_hostPermissions[hostId];
+    const workspaceMember = isOrgWideMember(member);
+    const layers = workspaceMember ? [
+        member.roleId ? customRole == null ? void 0 : customRole.permissions : undefined,
+        member.permissions,
+        toggles
+    ] : [
+        toggles
+    ];
+    const out = {};
+    for (const definition of definitions){
+        var _definition_hostRoleDefaults;
+        let verdict = (workspaceMember || !definition.workspaceMembersOnly) && ((_definition_hostRoleDefaults = definition.hostRoleDefaults) == null ? void 0 : _definition_hostRoleDefaults[role]) === true;
+        for (const layer of layers){
+            const value = layer == null ? void 0 : layer[definition.key];
+            if (typeof value === 'boolean') verdict = value;
+        }
+        out[definition.key] = verdict;
+    }
+    return refinePermissionMap(out, refinementsWithin(out), layers);
+}
+/**
+ * `granted` with every key whose preset is the site role decided for this
+ * site. With no site named it is `granted` as given, so a resolver can call
+ * it unconditionally.
+ */ export function applySiteRolePresets(granted, member, hostId, customRole) {
+    if (!hostId) return granted;
+    return _extends({}, granted, resolveSiteRolePresetPermissions(member, hostId, customRole));
+}
+/**
+ * The verdict the site's own stamp gives a member for one key whose preset
+ * is the site role, as the Firestore rules read it (AGL-4047): the site's
+ * `memberPermissions[uid][key]` when the projection wrote one, else the
+ * preset of the role the site's `memberRoles` projection holds for them.
+ *
+ * For a door that has the host document in hand and asks what the rules
+ * ask, so the two cannot disagree: the stamp is written beside
+ * `memberRoles` by the same projection, with every layer applied, and a
+ * site the projection has not reached since the key existed answers exactly
+ * as the role gate it replaced. `presetFor` is the declaring plugin's own
+ * table, so the answer does not depend on which plugins this process loaded.
+ */ export function hostStampedSitePermission(host, uid, permission, presetFor) {
+    var _host_memberPermissions_uid, _host_memberPermissions, _host_memberRoles;
+    const stamped = host == null ? void 0 : (_host_memberPermissions = host.memberPermissions) == null ? void 0 : (_host_memberPermissions_uid = _host_memberPermissions[uid]) == null ? void 0 : _host_memberPermissions_uid[permission];
+    if (typeof stamped === 'boolean') return stamped;
+    const role = host == null ? void 0 : (_host_memberRoles = host.memberRoles) == null ? void 0 : _host_memberRoles[uid];
+    return typeof role === 'string' && presetFor[role] === true;
+}
+/**
+ * The same for a key whose preset holds for members of the whole workspace
+ * only (`workspaceMembersOnly`, AGL-4047), which `memberRoles` alone cannot
+ * answer: an admin of one site and an admin of the whole workspace project
+ * the same `'admin'` there. The site's stamp when the projection wrote one;
+ * else the preset of the role `memberRoles` holds for them AND of the role
+ * the fresh resolution gives them on the site, for a member of the whole
+ * workspace only. Exactly the gate these keys replaced: the projection's
+ * role, `orgWide` and the fresh site role, all three.
+ */ export function hostStampedWorkspaceSitePermission(host, uid, permission, presetFor, membership) {
+    var _host_memberPermissions_uid, _host_memberPermissions;
+    const stamped = host == null ? void 0 : (_host_memberPermissions = host.memberPermissions) == null ? void 0 : (_host_memberPermissions_uid = _host_memberPermissions[uid]) == null ? void 0 : _host_memberPermissions_uid[permission];
+    if (typeof stamped === 'boolean') return stamped;
+    if (membership.orgWide !== true) return false;
+    const fresh = membership.hostRole;
+    return typeof fresh === 'string' && presetFor[fresh] === true && hostStampedSitePermission({
+        memberRoles: host == null ? void 0 : host.memberRoles
+    }, uid, permission, presetFor);
+}
+/*
+ * A SITE NARROWS A WORKSPACE-WIDE MEMBER (AGL-4047).
+ *
+ * An editor who works across the workspace can be given Viewer or Author
+ * access to one site (`hostAccess[hostId]`, which `hostRoleFor` reads ahead
+ * of `allHosts`). That narrowed their content rights there and nothing else,
+ * so a key the workspace grants an editor, such as working a site's
+ * register, still held on the site they were narrowed on.
+ *
+ * A plugin marks the keys a site CAN narrow with `narrowsPerSite`, and
+ * whether each one does is a control with three layers, the nearest set one
+ * winning (`siteNarrowingChoices`):
+ *
+ *   - the member's own choice (`member.siteNarrowing[key]`);
+ *   - else their custom role's (`customRole.siteNarrowing[key]`);
+ *   - else the built-in role's default the declaration names.
+ *
+ * `true` is "Follow the site role", `false` is "Keep this permission". On a
+ * site that narrows the member, each key that follows the site role is
+ * decided for that site:
+ *
+ *   1. the site's own verdict for the key (`hostPermissions[hostId][key]`),
+ *      when the site set one;
+ *   2. else, for a key that refines another key that also follows the site
+ *      role, that key's verdict on this site, never more than the workspace
+ *      grants;
+ *   3. else the narrower access's default for the key, never more than the
+ *      workspace grants;
+ *
+ * and a key they keep is the workspace's verdict, as everywhere else. A finer
+ * key they hold on the site (one the site grants, or one they keep and the
+ * workspace grants) brings the key it refines on this site with it, unless
+ * the site refuses that key, because a refining key is never held without
+ * it. The other finer keys do not follow that implied grant: allowing "sell"
+ * on a site is not allowing refunds.
+ *
+ * A member whose access to every site matches their workspace role (the
+ * owner and admins always do), one who keeps every key a site can narrow,
+ * and a site collaborator, whose keys come from their site role already, all
+ * resolve exactly as before.
+ */ /** Host roles from the widest down, for "is this site's access narrower?". */ const HOST_ROLE_RANK = {
+    admin: 3,
+    editor: 2,
+    author: 1,
+    viewer: 0
+};
+/** The catalog keys a site CAN narrow (`narrowsPerSite`), in catalog order. */ export function siteNarrowedPermissionKeys() {
+    return ORG_PERMISSIONS.filter((definition)=>definition.narrowsPerSite).map((definition)=>definition.key);
+}
+/**
+ * Could any site narrow a member of this org role? Not the owner or an
+ * admin, who are admins of every site, and not a role whose site access has
+ * nothing narrower below it (a viewer). The editors' control is the one that
+ * changes anything; the role editor says so beside it.
+ */ export function roleCanBeNarrowed(role) {
+    if (role === 'owner' || role === 'admin') return false;
+    return HOST_ROLE_RANK[orgRoleTier(role)] > 0;
+}
+/**
+ * Whether each key a site can narrow follows the site role for this member
+ * (`true`) or is kept (`false`): their own choice, else their custom role's
+ * (when they carry its id and it was supplied), else the built-in role's
+ * default.
+ */ export function siteNarrowingChoices(member, customRole) {
+    var _ref, _ref1, _ref2;
+    const role = (_ref = member == null ? void 0 : member.role) != null ? _ref : 'viewer';
+    const own = (_ref1 = member == null ? void 0 : member.siteNarrowing) != null ? _ref1 : {};
+    const fromRole = (member == null ? void 0 : member.roleId) ? (_ref2 = customRole == null ? void 0 : customRole.siteNarrowing) != null ? _ref2 : {} : {};
+    const out = {};
+    for (const definition of ORG_PERMISSIONS){
+        if (!definition.narrowsPerSite) continue;
+        const key = definition.key;
+        const mine = own[key];
+        const theirRole = fromRole[key];
+        out[key] = typeof mine === 'boolean' ? mine : typeof theirRole === 'boolean' ? theirRole : definition.narrowsPerSite[role] === true;
+    }
+    return out;
+}
+/**
+ * Is this member's access to this site narrower than their workspace role?
+ * The cheap half of `siteNarrowingFor`, which needs no custom role: a caller
+ * that has to read one asks this first, and reads nothing for everyone else.
+ */ export function siteMayNarrow(member, hostId) {
+    if (!member || !hostId || !isOrgWideMember(member)) return null;
+    const role = hostRoleFor(member, hostId);
+    if (!role) return null;
+    const workspaceRole = orgRoleTier(member.role);
+    if (HOST_ROLE_RANK[role] >= HOST_ROLE_RANK[workspaceRole]) return null;
+    return role;
+}
+/**
+ * How this site narrows this member, or null where it does not: a member
+ * who is not workspace-wide, has no access to the site, whose access there
+ * is as wide as their workspace role (owners and admins always), or who
+ * keeps every key a site can narrow. `customRole` is their custom role
+ * document when they carry a `roleId`; without it, only their own choices
+ * and the built-in defaults decide.
+ */ export function siteNarrowingFor(member, hostId, customRole) {
+    var _ref;
+    var _member_hostPermissions;
+    const role = siteMayNarrow(member, hostId);
+    if (!role) return null;
+    const narrows = siteNarrowingChoices(member, customRole);
+    if (!Object.values(narrows).some(Boolean)) return null;
+    return {
+        role,
+        grants: (_ref = member == null ? void 0 : (_member_hostPermissions = member.hostPermissions) == null ? void 0 : _member_hostPermissions[hostId]) != null ? _ref : {},
+        narrows
+    };
+}
+/** The keys that follow the site role under a narrowing, in catalog order; none without one. */ export function narrowedPermissionKeysOf(narrowing) {
+    if (!narrowing) return [];
+    return siteNarrowedPermissionKeys().filter((key)=>narrowing.narrows[key] === true);
+}
+/** What a site access holds by default for a key: its site default, else its tier's (Author on the Viewer tier). */ function narrowedDefault(definition, role) {
+    var _definition_hostRoleDefaults;
+    const site = (_definition_hostRoleDefaults = definition.hostRoleDefaults) == null ? void 0 : _definition_hostRoleDefaults[role];
+    if (typeof site === 'boolean') return site;
+    return definition.roleDefaults[orgRoleTier(role)] === true;
+}
+/**
+ * A workspace-wide member's resolved map with the keys that follow the site
+ * role decided for that site (see above). With no narrowing it is the map
+ * as given, so every resolver can call it unconditionally.
+ */ export function narrowPermissionsToSite(granted, narrowing) {
+    if (!narrowing) return granted;
+    const definitions = ORG_PERMISSIONS.filter((definition)=>definition.narrowsPerSite);
+    if (!definitions.length) return granted;
+    const narrowable = new Set(definitions.map((definition)=>definition.key));
+    const follows = (key)=>narrowing.narrows[key] === true;
+    // A finer key's broader key, among the keys a site can narrow.
+    const broader = new Map();
+    for (const [key, parent, kind] of ORG_PERMISSION_REFINEMENTS){
+        if (kind !== 'follows' && narrowable.has(key) && narrowable.has(parent)) broader.set(key, parent);
+    }
+    const siteVerdict = (key)=>{
+        const value = narrowing.grants[key];
+        return typeof value === 'boolean' ? value : undefined;
+    };
+    const depth = (key)=>{
+        const seen = new Set();
+        let steps = 0;
+        for(let current = key; broader.has(current) && !seen.has(current); steps += 1){
+            seen.add(current);
+            current = broader.get(current);
+        }
+        return steps;
+    };
+    const out = _extends({}, granted);
+    for (const definition of [
+        ...definitions
+    ].sort((a, b)=>depth(a.key) - depth(b.key))){
+        const key = definition.key;
+        const workspace = granted[key] === true;
+        // Kept: the workspace's verdict, as on every other site.
+        if (!follows(key)) {
+            out[key] = workspace;
+            continue;
+        }
+        const own = siteVerdict(key);
+        const parent = broader.get(key);
+        if (own !== undefined) out[key] = own;
+        else if (parent && follows(parent)) out[key] = out[parent] === true && workspace;
+        else out[key] = workspace && narrowedDefault(definition, narrowing.role);
+    }
+    for (const definition of definitions){
+        const key = definition.key;
+        const held = follows(key) ? siteVerdict(key) === true : granted[key] === true;
+        if (!held) continue;
+        const seen = new Set();
+        for(let parent = broader.get(key); parent && !seen.has(parent); parent = broader.get(parent)){
+            seen.add(parent);
+            // A kept broader key is the workspace's verdict already.
+            if (!follows(parent) || siteVerdict(parent) === false) break;
+            out[parent] = true;
+        }
+    }
+    return refinePermissionMap(out, ORG_PERMISSION_REFINEMENTS);
 }
 /**
  * A member's verdict for every per-site key, on whichever axis their
@@ -80,14 +406,26 @@ import { resolveOrgPermissions } from "./org-permissions.js";
  * `roleId` and the caller has it in hand, and is ignored for a collaborator,
  * whose org role is a seat-accounting fact rather than a grant. `hostId` is
  * the site the request is about; an org-wide member resolves the same on
- * every site and with none named.
+ * every site and with none named, except on a site that narrows them.
+ *
+ * An org-wide member's map also carries every key a site can narrow
+ * (AGL-4047), decided for `hostId`, so the site's `memberPermissions`
+ * projection answers the rules what the server answers. A collaborator's
+ * map does not: their register and waivers keys come from their site role
+ * and their own overrides, which the rules read from their member document
+ * as before.
  */ export function resolveMemberHostPermissions(options) {
     var _resolveCollaboratorHostPermissions;
     const { member, customRole, hostId } = options;
     if (!member) return noHostPermissions();
     if (isOrgWideMember(member)) {
-        const granted = resolveOrgPermissions(member, customRole != null ? customRole : null);
-        return Object.fromEntries(hostPermissionKeys().map((key)=>[
+        // The keys whose preset is the site role (AGL-4047) are decided for this
+        // site last; they narrow nothing, so the narrowing pass leaves them be.
+        const granted = applySiteRolePresets(narrowPermissionsToSite(resolveOrgPermissions(member, customRole != null ? customRole : null), siteNarrowingFor(member, hostId, customRole != null ? customRole : null)), member, hostId, customRole != null ? customRole : null);
+        return Object.fromEntries([
+            ...hostPermissionKeys(),
+            ...siteNarrowedPermissionKeys()
+        ].map((key)=>[
                 key,
                 granted[key] === true
             ]));
@@ -115,5 +453,39 @@ import { resolveOrgPermissions } from "./org-permissions.js";
     }
     return projection;
 }
+/**
+ * Does this member hold one of the core's site keys on this site (AGL-4047)?
+ * The door's twin of the rules' `canWriteHostContent`,
+ * `canPublishHostContent`, `canReadHostSensitive` and site-settings checks:
+ * the site's `memberPermissions` stamp, else the preset of the member's
+ * `memberRoles` entry (`hostStampedSitePermission`), so a route that asks it
+ * answers what the rules answer for the same write. For the routes that read
+ * the host document already; it costs no read.
+ */ export function holdsSiteKey(hostDoc, uid, key) {
+    var _CORE_SITE_ROLE_PRESETS_key;
+    return holdsStampedSiteKey(hostDoc, uid, key, (_CORE_SITE_ROLE_PRESETS_key = CORE_SITE_ROLE_PRESETS[key]) != null ? _CORE_SITE_ROLE_PRESETS_key : {});
+}
+/**
+ * The same for a plugin's key whose preset is the site role (AGL-4047): the
+ * site's `memberPermissions` stamp, else `presetFor` read for the member's
+ * `memberRoles` entry. `presetFor` is the declaring plugin's own table, so the
+ * answer does not depend on which plugins this process loaded. For the doors
+ * and the cards that hold the host document already; it costs no read.
+ */ export function holdsStampedSiteKey(hostDoc, uid, key, presetFor) {
+    if (!hostDoc || !uid) return false;
+    // `hostDoc`, not `host`: the host-field deny guard reads every `host.…`
+    // in this folder as a field of the host document, and `get` is none.
+    const read = (field)=>typeof hostDoc.get === 'function' ? hostDoc.get(field) : hostDoc[field];
+    return hostStampedSitePermission({
+        memberPermissions: read('memberPermissions'),
+        memberRoles: read('memberRoles')
+    }, uid, key, presetFor);
+}
+/**
+ * The refusal a door answers when a member does not hold a site key
+ * (AGL-4047): it names the permission and who can change it, never a role.
+ */ export function siteKeyRefusal(key) {
+    return permissionRefusalText(key);
+}
 
 //# sourceMappingURL=host-permissions.js.map

package/src/lib/app-utils/host-permissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/host-permissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  AglynOrgMember,\n  HostAccessRole,\n  HostPermissionKey,\n  HostUid,\n} from '../foundation'\nimport { listPluginOrgPermissions } from '../plugin-manager/plugin-entitlements'\nimport { hostRoleFor, isOrgWideMember } from './organizations'\nimport { resolveOrgPermissions, type AglynOrgCustomRole } from './org-permissions'\n\n/**\n * Catalog keys a site collaborator holds PER SITE (AGL-2984), resolved on one\n * of two axes.\n *\n * A plugin that declares a catalog key with `hostRoleDefaults` makes it a\n * per-site key. For the people whose membership spans the workspace, the key\n * is an ordinary catalog key: their org role's default, refined by a custom\n * role and by per-member overrides, the same on every site. A site\n * collaborator has no org standing to refine — their membership exists only\n * to carry access to named sites — so for them the key is decided PER SITE,\n * from the host role they hold there, refined by `hostPermissions[hostId]` on\n * their member document.\n *\n * Which axis applies is `isOrgWideMember`, the predicate the rules projection\n * and the scope resolver already share. A collaborator asked about a site\n * they were never granted resolves to nothing, and so does one whose request\n * names no site at all: there is no host role to read a default from, and\n * guessing one would let a request reach around the per-site toggle by\n * omitting the site.\n */\n\n/** The catalog keys a collaborator can hold per site, in catalog order. */\nexport function hostPermissionKeys(): HostPermissionKey[] {\n  return listPluginOrgPermissions()\n    .filter((permission) => permission.hostRoleDefaults !== undefined)\n    .map((permission) => permission.key)\n}\n\n/** What a host role grants for every per-site key, before any toggle. */\nexport function hostRolePermissionDefaults(\n  role: HostAccessRole,\n): Record<HostPermissionKey, boolean> {\n  const defaults: Record<HostPermissionKey, boolean> = {}\n  for (const permission of listPluginOrgPermissions()) {\n    if (!permission.hostRoleDefaults) continue\n    defaults[permission.key] = permission.hostRoleDefaults[role] === true\n  }\n  return defaults\n}\n\n/** Every per-site key, refused. */\nfunction noHostPermissions(): Record<HostPermissionKey, boolean> {\n  return Object.fromEntries(hostPermissionKeys().map((key) => [key, false]))\n}\n\n/**\n * A collaborator's verdict on ONE site for every per-site key, or null where\n * they have no access to that site at all. An absent toggle reads as the host\n * role's default, which is what makes a member document written before\n * `hostPermissions` existed resolve exactly as it did before.\n */\nexport function resolveCollaboratorHostPermissions(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n): Record<HostPermissionKey, boolean> | null {\n  if (!member || !hostId) return null\n  const role = hostRoleFor(member, hostId)\n  if (!role) return null\n  const merged = hostRolePermissionDefaults(role)\n  const toggles = member.hostPermissions?.[hostId]\n  if (toggles) {\n    for (const key of Object.keys(merged)) {\n      const value = toggles[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  return merged\n}\n\n/**\n * A member's verdict for every per-site key, on whichever axis their\n * membership is on.\n *\n * `customRole` is the member's custom role document when they carry a\n * `roleId` and the caller has it in hand, and is ignored for a collaborator,\n * whose org role is a seat-accounting fact rather than a grant. `hostId` is\n * the site the request is about; an org-wide member resolves the same on\n * every site and with none named.\n */\nexport function resolveMemberHostPermissions(options: {\n  member: Partial<AglynOrgMember> | null | undefined\n  customRole?: AglynOrgCustomRole | null\n  hostId?: HostUid | null\n}): Record<HostPermissionKey, boolean> {\n  const { member, customRole, hostId } = options\n  if (!member) return noHostPermissions()\n  if (isOrgWideMember(member)) {\n    const granted = resolveOrgPermissions(member, customRole ?? null)\n    return Object.fromEntries(\n      hostPermissionKeys().map((key) => [key, granted[key] === true]),\n    )\n  }\n  return resolveCollaboratorHostPermissions(member, hostId) ?? noHostPermissions()\n}\n\n/**\n * The `memberPermissions` projection stamped on a host document beside\n * `memberRoles`: every member who can reach the site, with the verdict for\n * every per-site key they hold ON it. Org-wide members are resolved against\n * the custom roles the caller loaded (one read per distinct role, as\n * `syncOrgAuthProjections` already does for `resolvedPermissions`);\n * collaborators against their host role. A member who cannot reach the site\n * has no entry, matching `projectHostMemberRoles`.\n */\nexport function projectHostMemberPermissions(\n  members: ReadonlyArray<Partial<AglynOrgMember> & { $id: string }>,\n  hostId: HostUid,\n  customRoles: ReadonlyMap<string, AglynOrgCustomRole | null>,\n): Record<string, Record<HostPermissionKey, boolean>> {\n  const projection: Record<string, Record<HostPermissionKey, boolean>> = {}\n  for (const member of members) {\n    if (!hostRoleFor(member, hostId)) continue\n    projection[member.$id] = resolveMemberHostPermissions({\n      member,\n      customRole: member.roleId ? (customRoles.get(member.roleId) ?? null) : null,\n      hostId,\n    })\n  }\n  return projection\n}\n"],"names":["listPluginOrgPermissions","hostRoleFor","isOrgWideMember","resolveOrgPermissions","hostPermissionKeys","filter","permission","hostRoleDefaults","undefined","map","key","hostRolePermissionDefaults","role","defaults","noHostPermissions","Object","fromEntries","resolveCollaboratorHostPermissions","member","hostId","merged","toggles","hostPermissions","keys","value","resolveMemberHostPermissions","options","customRole","granted","projectHostMemberPermissions","members","customRoles","projection","$id","roleId","get"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAQD,SAASA,wBAAwB,QAAQ,2CAAuC;AAChF,SAASC,WAAW,EAAEC,eAAe,QAAQ,qBAAiB;AAC9D,SAASC,qBAAqB,QAAiC,uBAAmB;AAElF;;;;;;;;;;;;;;;;;;;CAmBC,GAED,yEAAyE,GACzE,OAAO,SAASC;IACd,OAAOJ,2BACJK,MAAM,CAAC,CAACC,aAAeA,WAAWC,gBAAgB,KAAKC,WACvDC,GAAG,CAAC,CAACH,aAAeA,WAAWI,GAAG;AACvC;AAEA,uEAAuE,GACvE,OAAO,SAASC,2BACdC,IAAoB;IAEpB,MAAMC,WAA+C,CAAC;IACtD,KAAK,MAAMP,cAAcN,2BAA4B;QACnD,IAAI,CAACM,WAAWC,gBAAgB,EAAE;QAClCM,QAAQ,CAACP,WAAWI,GAAG,CAAC,GAAGJ,WAAWC,gBAAgB,CAACK,KAAK,KAAK;IACnE;IACA,OAAOC;AACT;AAEA,iCAAiC,GACjC,SAASC;IACP,OAAOC,OAAOC,WAAW,CAACZ,qBAAqBK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK;SAAM;AAC1E;AAEA;;;;;CAKC,GACD,OAAO,SAASO,mCACdC,MAAkD,EAClDC,MAAkC;QAMlBD;IAJhB,IAAI,CAACA,UAAU,CAACC,QAAQ,OAAO;IAC/B,MAAMP,OAAOX,YAAYiB,QAAQC;IACjC,IAAI,CAACP,MAAM,OAAO;IAClB,MAAMQ,SAAST,2BAA2BC;IAC1C,MAAMS,WAAUH,0BAAAA,OAAOI,eAAe,qBAAtBJ,uBAAwB,CAACC,OAAO;IAChD,IAAIE,SAAS;QACX,KAAK,MAAMX,OAAOK,OAAOQ,IAAI,CAACH,QAAS;YACrC,MAAMI,QAAQH,OAAO,CAACX,IAAI;YAC1B,IAAI,OAAOc,UAAU,WAAWJ,MAAM,CAACV,IAAI,GAAGc;QAChD;IACF;IACA,OAAOJ;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASK,6BAA6BC,OAI5C;QASQT;IARP,MAAM,EAAEC,MAAM,EAAES,UAAU,EAAER,MAAM,EAAE,GAAGO;IACvC,IAAI,CAACR,QAAQ,OAAOJ;IACpB,IAAIZ,gBAAgBgB,SAAS;QAC3B,MAAMU,UAAUzB,sBAAsBe,QAAQS,qBAAAA,aAAc;QAC5D,OAAOZ,OAAOC,WAAW,CACvBZ,qBAAqBK,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAKkB,OAAO,CAAClB,IAAI,KAAK;aAAK;IAElE;IACA,QAAOO,sCAAAA,mCAAmCC,QAAQC,mBAA3CF,sCAAsDH;AAC/D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASe,6BACdC,OAAiE,EACjEX,MAAe,EACfY,WAA2D;IAE3D,MAAMC,aAAiE,CAAC;IACxE,KAAK,MAAMd,UAAUY,QAAS;YAIGC;QAH/B,IAAI,CAAC9B,YAAYiB,QAAQC,SAAS;QAClCa,UAAU,CAACd,OAAOe,GAAG,CAAC,GAAGR,6BAA6B;YACpDP;YACAS,YAAYT,OAAOgB,MAAM,IAAIH,mBAAAA,YAAYI,GAAG,CAACjB,OAAOgB,MAAM,aAA7BH,mBAAkC,OAAQ;YACvEZ;QACF;IACF;IACA,OAAOa;AACT"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/host-permissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  AglynOrgMember,\n  HostAccessRole,\n  HostPermissionKey,\n  HostUid,\n  OrgRole,\n} from '../foundation'\nimport { refinePermissionMap, type PermissionRefinement } from '../plugin-manager/plugin-permissions'\nimport { hostRoleFor, isOrgWideMember } from './organizations'\nimport { CORE_SITE_ROLE_PRESETS } from './org-role-grants'\nimport {\n  permissionRefusalText,\n  ORG_PERMISSION_REFINEMENTS,\n  ORG_PERMISSIONS,\n  resolveOrgPermissions,\n  type AglynOrgCustomRole,\n  type OrgPermissionDefinition,\n} from './org-permissions'\nimport { orgRoleTier } from './org-roles'\n\n/**\n * Catalog keys a site collaborator holds PER SITE (AGL-2984), resolved on one\n * of two axes.\n *\n * A plugin that declares a catalog key with `hostRoleDefaults` makes it a\n * per-site key. For the people whose membership spans the workspace, the key\n * is an ordinary catalog key: their org role's default, refined by a custom\n * role and by per-member overrides, the same on every site. A site\n * collaborator has no org standing to refine — their membership exists only\n * to carry access to named sites — so for them the key is decided PER SITE,\n * from the host role they hold there, refined by `hostPermissions[hostId]` on\n * their member document.\n *\n * Which axis applies is `isOrgWideMember`, the predicate the rules projection\n * and the scope resolver already share. A collaborator asked about a site\n * they were never granted resolves to nothing, and so does one whose request\n * names no site at all: there is no host role to read a default from, and\n * guessing one would let a request reach around the per-site toggle by\n * omitting the site.\n */\n\n/**\n * The catalog keys a collaborator can hold per site, in catalog order: every\n * key with host-role defaults, the core's site keys (AGL-4047) and the ones\n * plugins declare.\n */\nexport function hostPermissionKeys(): HostPermissionKey[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.hostRoleDefaults !== undefined).map(\n    (definition) => definition.key,\n  )\n}\n\n/**\n * What a host role grants a site collaborator for every per-site key, before\n * any toggle. A key whose site-role preset holds for members of the whole\n * workspace only (`workspaceMembersOnly`, AGL-4047) grants a collaborator\n * nothing, whatever their site role.\n */\nexport function hostRolePermissionDefaults(\n  role: HostAccessRole,\n): Record<HostPermissionKey, boolean> {\n  const defaults: Record<HostPermissionKey, boolean> = {}\n  for (const definition of ORG_PERMISSIONS) {\n    if (!definition.hostRoleDefaults) continue\n    defaults[definition.key] = !definition.workspaceMembersOnly && definition.hostRoleDefaults[role] === true\n  }\n  return defaults\n}\n\n/** Every per-site key, refused. */\nfunction noHostPermissions(): Record<HostPermissionKey, boolean> {\n  return Object.fromEntries(hostPermissionKeys().map((key) => [key, false]))\n}\n\n/**\n * The catalog's refinements whose key and broader key are both in `map`\n * (AGL-4047): the links a per-site map can settle on its own. A link to a\n * key the map does not carry would read that key as refused and add it.\n */\nfunction refinementsWithin(map: Readonly<Record<string, boolean>>): PermissionRefinement[] {\n  return ORG_PERMISSION_REFINEMENTS.filter(([key, parent]) => key in map && parent in map)\n}\n\n/**\n * A collaborator's verdict on ONE site for every per-site key, or null where\n * they have no access to that site at all. An absent toggle reads as the host\n * role's default, which is what makes a member document written before\n * `hostPermissions` existed resolve exactly as it did before.\n */\nexport function resolveCollaboratorHostPermissions(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n): Record<HostPermissionKey, boolean> | null {\n  if (!member || !hostId) return null\n  const role = hostRoleFor(member, hostId)\n  if (!role) return null\n  const merged = hostRolePermissionDefaults(role)\n  const toggles = member.hostPermissions?.[hostId]\n  if (toggles) {\n    for (const key of Object.keys(merged)) {\n      const value = toggles[key]\n      if (typeof value === 'boolean') merged[key] = value\n    }\n  }\n  // A per-site key that follows or refines another per-site key (AGL-4047)\n  // takes its verdict from that key on this site where the site sets nothing\n  // for it, as the org catalog's resolver does with a custom role.\n  return refinePermissionMap(merged, refinementsWithin(merged), [toggles])\n}\n\n/*\n * KEYS WHOSE PRESET IS THE SITE ROLE (AGL-4047).\n *\n * Some checks were written against the member's role on a site: who may book\n * a walk-in, change a stay or edit a site's reservations asked whether their\n * `memberRoles` entry was Admin, Editor or Author. Roles are only presets of\n * permissions, so those checks became keys, and a key that replaces a gate\n * on the site role keeps that role as its preset (`presetFromSiteRole`):\n *\n *   1. the member's role ON THE SITE (`hostRoleFor`): Admin for the owner and\n *      admins, a workspace-wide editor's or viewer's own role unless the site\n *      gives them other access there, narrower or wider, and a collaborator's\n *      site role; no access to the site holds nothing;\n *   2. that role's `hostRoleDefaults` verdict for the key;\n *   3. then, for a workspace-wide member, their custom role's verdict and\n *      their own permissions' verdict, when either sets the key;\n *   4. then the site's own toggle for them (`hostPermissions[hostId][key]`).\n *\n * With nothing set at 3 or 4, the verdict is exactly what the role gate\n * answered, for every member on every site, which is how the built-in roles\n * keep the access they had. A collaborator has no custom role and no\n * workspace standing to refine, so only the site's toggle moves their\n * verdict, as for every other per-site key.\n *\n * A key declared `workspaceMembersOnly` replaces a gate that asked for an\n * admin of the whole workspace who is also this site's admin: its preset at\n * 2 is the site role's for a member of the whole workspace and refusal for a\n * collaborator, whose site role (even Admin) never carried it. The site's\n * toggle at 4 still grants it to them.\n *\n * These keys narrow nothing (`narrowsPerSite` is dropped): the site role is\n * already their preset. With no site named, the org catalog's verdict\n * (`roleDefaults`, then the layers) stands, which is the same answer for a\n * workspace-wide member on a site where their access is their workspace role.\n */\n\n/** The catalog keys whose preset is the member's role on the site, in catalog order. */\nexport function siteRolePresetPermissionKeys(): string[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.presetFromSiteRole).map(\n    (definition) => definition.key,\n  )\n}\n\n/** Is this a key whose preset is the member's role on the site? */\nexport function isSiteRolePresetPermission(permission: string): boolean {\n  return ORG_PERMISSIONS.some(\n    (definition) => definition.key === permission && definition.presetFromSiteRole === true,\n  )\n}\n\n/**\n * A member's verdict on ONE site for every key whose preset is their role\n * there (see above). `customRole` is their custom role document when they\n * carry a `roleId` and the caller has it, and is ignored for a collaborator.\n * No site named, or no access to it, refuses every such key.\n */\nexport function resolveSiteRolePresetPermissions(\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'permissions'> | null,\n): Record<string, boolean> {\n  const definitions = ORG_PERMISSIONS.filter((definition) => definition.presetFromSiteRole)\n  if (!definitions.length) return {}\n  const role = member && hostId ? hostRoleFor(member, hostId) : null\n  if (!member || !hostId || !role) {\n    return Object.fromEntries(definitions.map((definition) => [definition.key, false]))\n  }\n  const toggles = member.hostPermissions?.[hostId]\n  const workspaceMember = isOrgWideMember(member)\n  const layers: ReadonlyArray<Readonly<Partial<Record<string, unknown>>> | null | undefined> =\n    workspaceMember\n      ? [member.roleId ? customRole?.permissions : undefined, member.permissions, toggles]\n      : [toggles]\n  const out: Record<string, boolean> = {}\n  for (const definition of definitions) {\n    let verdict =\n      (workspaceMember || !definition.workspaceMembersOnly) && definition.hostRoleDefaults?.[role] === true\n    for (const layer of layers) {\n      const value = layer?.[definition.key]\n      if (typeof value === 'boolean') verdict = value\n    }\n    out[definition.key] = verdict\n  }\n  return refinePermissionMap(out, refinementsWithin(out), layers)\n}\n\n/**\n * `granted` with every key whose preset is the site role decided for this\n * site. With no site named it is `granted` as given, so a resolver can call\n * it unconditionally.\n */\nexport function applySiteRolePresets<T extends Record<string, boolean>>(\n  granted: T,\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'permissions'> | null,\n): T {\n  if (!hostId) return granted\n  return { ...granted, ...resolveSiteRolePresetPermissions(member, hostId, customRole) }\n}\n\n/**\n * The verdict the site's own stamp gives a member for one key whose preset\n * is the site role, as the Firestore rules read it (AGL-4047): the site's\n * `memberPermissions[uid][key]` when the projection wrote one, else the\n * preset of the role the site's `memberRoles` projection holds for them.\n *\n * For a door that has the host document in hand and asks what the rules\n * ask, so the two cannot disagree: the stamp is written beside\n * `memberRoles` by the same projection, with every layer applied, and a\n * site the projection has not reached since the key existed answers exactly\n * as the role gate it replaced. `presetFor` is the declaring plugin's own\n * table, so the answer does not depend on which plugins this process loaded.\n */\nexport function hostStampedSitePermission(\n  host: { memberPermissions?: unknown; memberRoles?: unknown } | null | undefined,\n  uid: string,\n  permission: string,\n  presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>,\n): boolean {\n  const stamped = (host?.memberPermissions as Record<string, Record<string, unknown> | undefined> | undefined)?.[uid]?.[\n    permission\n  ]\n  if (typeof stamped === 'boolean') return stamped\n  const role = (host?.memberRoles as Record<string, unknown> | undefined)?.[uid]\n  return typeof role === 'string' && presetFor[role as HostAccessRole] === true\n}\n\n/**\n * The same for a key whose preset holds for members of the whole workspace\n * only (`workspaceMembersOnly`, AGL-4047), which `memberRoles` alone cannot\n * answer: an admin of one site and an admin of the whole workspace project\n * the same `'admin'` there. The site's stamp when the projection wrote one;\n * else the preset of the role `memberRoles` holds for them AND of the role\n * the fresh resolution gives them on the site, for a member of the whole\n * workspace only. Exactly the gate these keys replaced: the projection's\n * role, `orgWide` and the fresh site role, all three.\n */\nexport function hostStampedWorkspaceSitePermission(\n  host: { memberPermissions?: unknown; memberRoles?: unknown } | null | undefined,\n  uid: string,\n  permission: string,\n  presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>,\n  membership: { orgWide: boolean; hostRole: string | null | undefined },\n): boolean {\n  const stamped = (host?.memberPermissions as Record<string, Record<string, unknown> | undefined> | undefined)?.[uid]?.[\n    permission\n  ]\n  if (typeof stamped === 'boolean') return stamped\n  if (membership.orgWide !== true) return false\n  const fresh = membership.hostRole\n  return (\n    typeof fresh === 'string' &&\n    presetFor[fresh as HostAccessRole] === true &&\n    hostStampedSitePermission({ memberRoles: host?.memberRoles }, uid, permission, presetFor)\n  )\n}\n\n/*\n * A SITE NARROWS A WORKSPACE-WIDE MEMBER (AGL-4047).\n *\n * An editor who works across the workspace can be given Viewer or Author\n * access to one site (`hostAccess[hostId]`, which `hostRoleFor` reads ahead\n * of `allHosts`). That narrowed their content rights there and nothing else,\n * so a key the workspace grants an editor, such as working a site's\n * register, still held on the site they were narrowed on.\n *\n * A plugin marks the keys a site CAN narrow with `narrowsPerSite`, and\n * whether each one does is a control with three layers, the nearest set one\n * winning (`siteNarrowingChoices`):\n *\n *   - the member's own choice (`member.siteNarrowing[key]`);\n *   - else their custom role's (`customRole.siteNarrowing[key]`);\n *   - else the built-in role's default the declaration names.\n *\n * `true` is \"Follow the site role\", `false` is \"Keep this permission\". On a\n * site that narrows the member, each key that follows the site role is\n * decided for that site:\n *\n *   1. the site's own verdict for the key (`hostPermissions[hostId][key]`),\n *      when the site set one;\n *   2. else, for a key that refines another key that also follows the site\n *      role, that key's verdict on this site, never more than the workspace\n *      grants;\n *   3. else the narrower access's default for the key, never more than the\n *      workspace grants;\n *\n * and a key they keep is the workspace's verdict, as everywhere else. A finer\n * key they hold on the site (one the site grants, or one they keep and the\n * workspace grants) brings the key it refines on this site with it, unless\n * the site refuses that key, because a refining key is never held without\n * it. The other finer keys do not follow that implied grant: allowing \"sell\"\n * on a site is not allowing refunds.\n *\n * A member whose access to every site matches their workspace role (the\n * owner and admins always do), one who keeps every key a site can narrow,\n * and a site collaborator, whose keys come from their site role already, all\n * resolve exactly as before.\n */\n\n/** Host roles from the widest down, for \"is this site's access narrower?\". */\nconst HOST_ROLE_RANK: Readonly<Record<HostAccessRole, number>> = {\n  admin: 3,\n  editor: 2,\n  author: 1,\n  viewer: 0,\n}\n\n/** How one site narrows a workspace-wide member: the access they hold there, the site's verdicts, and which keys follow it. */\nexport interface SiteNarrowing {\n  /** Their role on the site, narrower than their workspace role. */\n  role: HostAccessRole\n  /** `hostPermissions[hostId]`: the verdicts the site set for them. */\n  grants: Readonly<Partial<Record<string, unknown>>>\n  /**\n   * Every key a site can narrow, `true` where it follows the site role for\n   * this member and `false` where they keep it (`siteNarrowingChoices`).\n   */\n  narrows: Readonly<Record<string, boolean>>\n}\n\n/** The catalog keys a site CAN narrow (`narrowsPerSite`), in catalog order. */\nexport function siteNarrowedPermissionKeys(): string[] {\n  return ORG_PERMISSIONS.filter((definition) => definition.narrowsPerSite).map(\n    (definition) => definition.key,\n  )\n}\n\n/**\n * Could any site narrow a member of this org role? Not the owner or an\n * admin, who are admins of every site, and not a role whose site access has\n * nothing narrower below it (a viewer). The editors' control is the one that\n * changes anything; the role editor says so beside it.\n */\nexport function roleCanBeNarrowed(role: string | null | undefined): boolean {\n  if (role === 'owner' || role === 'admin') return false\n  return HOST_ROLE_RANK[orgRoleTier(role) as HostAccessRole] > 0\n}\n\n/**\n * Whether each key a site can narrow follows the site role for this member\n * (`true`) or is kept (`false`): their own choice, else their custom role's\n * (when they carry its id and it was supplied), else the built-in role's\n * default.\n */\nexport function siteNarrowingChoices(\n  member: (Partial<AglynOrgMember> & { roleId?: string | null }) | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'siteNarrowing'> | null,\n): Record<string, boolean> {\n  const role = (member?.role ?? 'viewer') as OrgRole\n  const own = member?.siteNarrowing ?? {}\n  const fromRole = member?.roleId ? (customRole?.siteNarrowing ?? {}) : {}\n  const out: Record<string, boolean> = {}\n  for (const definition of ORG_PERMISSIONS) {\n    if (!definition.narrowsPerSite) continue\n    const key = definition.key\n    const mine = own[key]\n    const theirRole = fromRole[key]\n    out[key] =\n      typeof mine === 'boolean'\n        ? mine\n        : typeof theirRole === 'boolean'\n          ? theirRole\n          : definition.narrowsPerSite[role] === true\n  }\n  return out\n}\n\n/**\n * Is this member's access to this site narrower than their workspace role?\n * The cheap half of `siteNarrowingFor`, which needs no custom role: a caller\n * that has to read one asks this first, and reads nothing for everyone else.\n */\nexport function siteMayNarrow(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n): HostAccessRole | null {\n  if (!member || !hostId || !isOrgWideMember(member)) return null\n  const role = hostRoleFor(member, hostId)\n  if (!role) return null\n  const workspaceRole = orgRoleTier(member.role) as HostAccessRole\n  if (HOST_ROLE_RANK[role] >= HOST_ROLE_RANK[workspaceRole]) return null\n  return role\n}\n\n/**\n * How this site narrows this member, or null where it does not: a member\n * who is not workspace-wide, has no access to the site, whose access there\n * is as wide as their workspace role (owners and admins always), or who\n * keeps every key a site can narrow. `customRole` is their custom role\n * document when they carry a `roleId`; without it, only their own choices\n * and the built-in defaults decide.\n */\nexport function siteNarrowingFor(\n  member: Partial<AglynOrgMember> | null | undefined,\n  hostId: HostUid | null | undefined,\n  customRole?: Pick<AglynOrgCustomRole, 'siteNarrowing'> | null,\n): SiteNarrowing | null {\n  const role = siteMayNarrow(member, hostId)\n  if (!role) return null\n  const narrows = siteNarrowingChoices(member, customRole)\n  if (!Object.values(narrows).some(Boolean)) return null\n  return { role, grants: member?.hostPermissions?.[hostId as HostUid] ?? {}, narrows }\n}\n\n/** The keys that follow the site role under a narrowing, in catalog order; none without one. */\nexport function narrowedPermissionKeysOf(narrowing: SiteNarrowing | null | undefined): string[] {\n  if (!narrowing) return []\n  return siteNarrowedPermissionKeys().filter((key) => narrowing.narrows[key] === true)\n}\n\n/** What a site access holds by default for a key: its site default, else its tier's (Author on the Viewer tier). */\nfunction narrowedDefault(definition: OrgPermissionDefinition, role: HostAccessRole): boolean {\n  const site = definition.hostRoleDefaults?.[role]\n  if (typeof site === 'boolean') return site\n  return definition.roleDefaults[orgRoleTier(role)] === true\n}\n\n/**\n * A workspace-wide member's resolved map with the keys that follow the site\n * role decided for that site (see above). With no narrowing it is the map\n * as given, so every resolver can call it unconditionally.\n */\nexport function narrowPermissionsToSite<T extends Record<string, boolean>>(\n  granted: T,\n  narrowing: SiteNarrowing | null | undefined,\n): T {\n  if (!narrowing) return granted\n  const definitions = ORG_PERMISSIONS.filter((definition) => definition.narrowsPerSite)\n  if (!definitions.length) return granted\n  const narrowable = new Set(definitions.map((definition) => definition.key))\n  const follows = (key: string): boolean => narrowing.narrows[key] === true\n  // A finer key's broader key, among the keys a site can narrow.\n  const broader = new Map<string, string>()\n  for (const [key, parent, kind] of ORG_PERMISSION_REFINEMENTS) {\n    if (kind !== 'follows' && narrowable.has(key) && narrowable.has(parent)) broader.set(key, parent)\n  }\n  const siteVerdict = (key: string): boolean | undefined => {\n    const value = narrowing.grants[key]\n    return typeof value === 'boolean' ? value : undefined\n  }\n  const depth = (key: string): number => {\n    const seen = new Set<string>()\n    let steps = 0\n    for (let current = key; broader.has(current) && !seen.has(current); steps += 1) {\n      seen.add(current)\n      current = broader.get(current) as string\n    }\n    return steps\n  }\n  const out: Record<string, boolean> = { ...granted }\n  for (const definition of [...definitions].sort((a, b) => depth(a.key) - depth(b.key))) {\n    const key = definition.key\n    const workspace = granted[key] === true\n    // Kept: the workspace's verdict, as on every other site.\n    if (!follows(key)) {\n      out[key] = workspace\n      continue\n    }\n    const own = siteVerdict(key)\n    const parent = broader.get(key)\n    if (own !== undefined) out[key] = own\n    else if (parent && follows(parent)) out[key] = out[parent] === true && workspace\n    else out[key] = workspace && narrowedDefault(definition, narrowing.role)\n  }\n  for (const definition of definitions) {\n    const key = definition.key\n    const held = follows(key) ? siteVerdict(key) === true : granted[key] === true\n    if (!held) continue\n    const seen = new Set<string>()\n    for (let parent = broader.get(key); parent && !seen.has(parent); parent = broader.get(parent)) {\n      seen.add(parent)\n      // A kept broader key is the workspace's verdict already.\n      if (!follows(parent) || siteVerdict(parent) === false) break\n      out[parent] = true\n    }\n  }\n  return refinePermissionMap(out, ORG_PERMISSION_REFINEMENTS) as T\n}\n\n/**\n * A member's verdict for every per-site key, on whichever axis their\n * membership is on.\n *\n * `customRole` is the member's custom role document when they carry a\n * `roleId` and the caller has it in hand, and is ignored for a collaborator,\n * whose org role is a seat-accounting fact rather than a grant. `hostId` is\n * the site the request is about; an org-wide member resolves the same on\n * every site and with none named, except on a site that narrows them.\n *\n * An org-wide member's map also carries every key a site can narrow\n * (AGL-4047), decided for `hostId`, so the site's `memberPermissions`\n * projection answers the rules what the server answers. A collaborator's\n * map does not: their register and waivers keys come from their site role\n * and their own overrides, which the rules read from their member document\n * as before.\n */\nexport function resolveMemberHostPermissions(options: {\n  member: Partial<AglynOrgMember> | null | undefined\n  customRole?: AglynOrgCustomRole | null\n  hostId?: HostUid | null\n}): Record<HostPermissionKey, boolean> {\n  const { member, customRole, hostId } = options\n  if (!member) return noHostPermissions()\n  if (isOrgWideMember(member)) {\n    // The keys whose preset is the site role (AGL-4047) are decided for this\n    // site last; they narrow nothing, so the narrowing pass leaves them be.\n    const granted = applySiteRolePresets(\n      narrowPermissionsToSite(\n        resolveOrgPermissions(member, customRole ?? null),\n        siteNarrowingFor(member, hostId, customRole ?? null),\n      ),\n      member,\n      hostId,\n      customRole ?? null,\n    )\n    return Object.fromEntries(\n      [...hostPermissionKeys(), ...siteNarrowedPermissionKeys()].map((key) => [key, granted[key] === true]),\n    )\n  }\n  return resolveCollaboratorHostPermissions(member, hostId) ?? noHostPermissions()\n}\n\n/**\n * The `memberPermissions` projection stamped on a host document beside\n * `memberRoles`: every member who can reach the site, with the verdict for\n * every per-site key they hold ON it. Org-wide members are resolved against\n * the custom roles the caller loaded (one read per distinct role, as\n * `syncOrgAuthProjections` already does for `resolvedPermissions`);\n * collaborators against their host role. A member who cannot reach the site\n * has no entry, matching `projectHostMemberRoles`.\n */\nexport function projectHostMemberPermissions(\n  members: ReadonlyArray<Partial<AglynOrgMember> & { $id: string }>,\n  hostId: HostUid,\n  customRoles: ReadonlyMap<string, AglynOrgCustomRole | null>,\n): Record<string, Record<HostPermissionKey, boolean>> {\n  const projection: Record<string, Record<HostPermissionKey, boolean>> = {}\n  for (const member of members) {\n    if (!hostRoleFor(member, hostId)) continue\n    projection[member.$id] = resolveMemberHostPermissions({\n      member,\n      customRole: member.roleId ? (customRoles.get(member.roleId) ?? null) : null,\n      hostId,\n    })\n  }\n  return projection\n}\n\n/** The core's site keys (AGL-4047): `CORE_SITE_ROLE_PRESETS`. */\nexport type CoreSiteKey = 'site.edit' | 'site.publish' | 'site.sensitive' | 'site.manage'\n\n/** A host document, as a snapshot (`get`) or as its data. */\nexport type HostDocumentLike =\n  | { get(field: string): unknown }\n  | { memberPermissions?: unknown; memberRoles?: unknown }\n  | null\n  | undefined\n\n/**\n * Does this member hold one of the core's site keys on this site (AGL-4047)?\n * The door's twin of the rules' `canWriteHostContent`,\n * `canPublishHostContent`, `canReadHostSensitive` and site-settings checks:\n * the site's `memberPermissions` stamp, else the preset of the member's\n * `memberRoles` entry (`hostStampedSitePermission`), so a route that asks it\n * answers what the rules answer for the same write. For the routes that read\n * the host document already; it costs no read.\n */\nexport function holdsSiteKey(hostDoc: HostDocumentLike, uid: string, key: CoreSiteKey): boolean {\n  return holdsStampedSiteKey(hostDoc, uid, key, CORE_SITE_ROLE_PRESETS[key] ?? {})\n}\n\n/**\n * The same for a plugin's key whose preset is the site role (AGL-4047): the\n * site's `memberPermissions` stamp, else `presetFor` read for the member's\n * `memberRoles` entry. `presetFor` is the declaring plugin's own table, so the\n * answer does not depend on which plugins this process loaded. For the doors\n * and the cards that hold the host document already; it costs no read.\n */\nexport function holdsStampedSiteKey(\n  hostDoc: HostDocumentLike,\n  uid: string | null | undefined,\n  key: string,\n  presetFor: Readonly<Partial<Record<HostAccessRole, boolean>>>,\n): boolean {\n  if (!hostDoc || !uid) return false\n  // `hostDoc`, not `host`: the host-field deny guard reads every `host.…`\n  // in this folder as a field of the host document, and `get` is none.\n  const read = (field: string): unknown =>\n    typeof (hostDoc as { get?: unknown }).get === 'function'\n      ? (hostDoc as { get(field: string): unknown }).get(field)\n      : (hostDoc as Record<string, unknown>)[field]\n  return hostStampedSitePermission(\n    { memberPermissions: read('memberPermissions'), memberRoles: read('memberRoles') },\n    uid,\n    key,\n    presetFor,\n  )\n}\n\n/**\n * The refusal a door answers when a member does not hold a site key\n * (AGL-4047): it names the permission and who can change it, never a role.\n */\nexport function siteKeyRefusal(key: string): string {\n  return permissionRefusalText(key)\n}\n\n"],"names":["refinePermissionMap","hostRoleFor","isOrgWideMember","CORE_SITE_ROLE_PRESETS","permissionRefusalText","ORG_PERMISSION_REFINEMENTS","ORG_PERMISSIONS","resolveOrgPermissions","orgRoleTier","hostPermissionKeys","filter","definition","hostRoleDefaults","undefined","map","key","hostRolePermissionDefaults","role","defaults","workspaceMembersOnly","noHostPermissions","Object","fromEntries","refinementsWithin","parent","resolveCollaboratorHostPermissions","member","hostId","merged","toggles","hostPermissions","keys","value","siteRolePresetPermissionKeys","presetFromSiteRole","isSiteRolePresetPermission","permission","some","resolveSiteRolePresetPermissions","customRole","definitions","length","workspaceMember","layers","roleId","permissions","out","verdict","layer","applySiteRolePresets","granted","hostStampedSitePermission","host","uid","presetFor","stamped","memberPermissions","memberRoles","hostStampedWorkspaceSitePermission","membership","orgWide","fresh","hostRole","HOST_ROLE_RANK","admin","editor","author","viewer","siteNarrowedPermissionKeys","narrowsPerSite","roleCanBeNarrowed","siteNarrowingChoices","own","siteNarrowing","fromRole","mine","theirRole","siteMayNarrow","workspaceRole","siteNarrowingFor","narrows","values","Boolean","grants","narrowedPermissionKeysOf","narrowing","narrowedDefault","site","roleDefaults","narrowPermissionsToSite","narrowable","Set","follows","broader","Map","kind","has","set","siteVerdict","depth","seen","steps","current","add","get","sort","a","b","workspace","held","resolveMemberHostPermissions","options","projectHostMemberPermissions","members","customRoles","projection","$id","holdsSiteKey","hostDoc","holdsStampedSiteKey","read","field","siteKeyRefusal"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AASD,SAASA,mBAAmB,QAAmC,0CAAsC;AACrG,SAASC,WAAW,EAAEC,eAAe,QAAQ,qBAAiB;AAC9D,SAASC,sBAAsB,QAAQ,uBAAmB;AAC1D,SACEC,qBAAqB,EACrBC,0BAA0B,EAC1BC,eAAe,EACfC,qBAAqB,QAGhB,uBAAmB;AAC1B,SAASC,WAAW,QAAQ,iBAAa;AAEzC;;;;;;;;;;;;;;;;;;;CAmBC,GAED;;;;CAIC,GACD,OAAO,SAASC;IACd,OAAOH,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWC,gBAAgB,KAAKC,WAAWC,GAAG,CAC1F,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA;;;;;CAKC,GACD,OAAO,SAASC,2BACdC,IAAoB;IAEpB,MAAMC,WAA+C,CAAC;IACtD,KAAK,MAAMP,cAAcL,gBAAiB;QACxC,IAAI,CAACK,WAAWC,gBAAgB,EAAE;QAClCM,QAAQ,CAACP,WAAWI,GAAG,CAAC,GAAG,CAACJ,WAAWQ,oBAAoB,IAAIR,WAAWC,gBAAgB,CAACK,KAAK,KAAK;IACvG;IACA,OAAOC;AACT;AAEA,iCAAiC,GACjC,SAASE;IACP,OAAOC,OAAOC,WAAW,CAACb,qBAAqBK,GAAG,CAAC,CAACC,MAAQ;YAACA;YAAK;SAAM;AAC1E;AAEA;;;;CAIC,GACD,SAASQ,kBAAkBT,GAAsC;IAC/D,OAAOT,2BAA2BK,MAAM,CAAC,CAAC,CAACK,KAAKS,OAAO,GAAKT,OAAOD,OAAOU,UAAUV;AACtF;AAEA;;;;;CAKC,GACD,OAAO,SAASW,mCACdC,MAAkD,EAClDC,MAAkC;QAMlBD;IAJhB,IAAI,CAACA,UAAU,CAACC,QAAQ,OAAO;IAC/B,MAAMV,OAAOhB,YAAYyB,QAAQC;IACjC,IAAI,CAACV,MAAM,OAAO;IAClB,MAAMW,SAASZ,2BAA2BC;IAC1C,MAAMY,WAAUH,0BAAAA,OAAOI,eAAe,qBAAtBJ,uBAAwB,CAACC,OAAO;IAChD,IAAIE,SAAS;QACX,KAAK,MAAMd,OAAOM,OAAOU,IAAI,CAACH,QAAS;YACrC,MAAMI,QAAQH,OAAO,CAACd,IAAI;YAC1B,IAAI,OAAOiB,UAAU,WAAWJ,MAAM,CAACb,IAAI,GAAGiB;QAChD;IACF;IACA,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,OAAOhC,oBAAoB4B,QAAQL,kBAAkBK,SAAS;QAACC;KAAQ;AACzE;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GAED,sFAAsF,GACtF,OAAO,SAASI;IACd,OAAO3B,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWuB,kBAAkB,EAAEpB,GAAG,CAC9E,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA,iEAAiE,GACjE,OAAO,SAASoB,2BAA2BC,UAAkB;IAC3D,OAAO9B,gBAAgB+B,IAAI,CACzB,CAAC1B,aAAeA,WAAWI,GAAG,KAAKqB,cAAczB,WAAWuB,kBAAkB,KAAK;AAEvF;AAEA;;;;;CAKC,GACD,OAAO,SAASI,iCACdZ,MAAiF,EACjFC,MAAkC,EAClCY,UAA2D;QAQ3Cb;IANhB,MAAMc,cAAclC,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAWuB,kBAAkB;IACxF,IAAI,CAACM,YAAYC,MAAM,EAAE,OAAO,CAAC;IACjC,MAAMxB,OAAOS,UAAUC,SAAS1B,YAAYyB,QAAQC,UAAU;IAC9D,IAAI,CAACD,UAAU,CAACC,UAAU,CAACV,MAAM;QAC/B,OAAOI,OAAOC,WAAW,CAACkB,YAAY1B,GAAG,CAAC,CAACH,aAAe;gBAACA,WAAWI,GAAG;gBAAE;aAAM;IACnF;IACA,MAAMc,WAAUH,0BAAAA,OAAOI,eAAe,qBAAtBJ,uBAAwB,CAACC,OAAO;IAChD,MAAMe,kBAAkBxC,gBAAgBwB;IACxC,MAAMiB,SACJD,kBACI;QAAChB,OAAOkB,MAAM,GAAGL,8BAAAA,WAAYM,WAAW,GAAGhC;QAAWa,OAAOmB,WAAW;QAAEhB;KAAQ,GAClF;QAACA;KAAQ;IACf,MAAMiB,MAA+B,CAAC;IACtC,KAAK,MAAMnC,cAAc6B,YAAa;YAEuB7B;QAD3D,IAAIoC,UACF,AAACL,CAAAA,mBAAmB,CAAC/B,WAAWQ,oBAAoB,AAAD,KAAMR,EAAAA,+BAAAA,WAAWC,gBAAgB,qBAA3BD,4BAA6B,CAACM,KAAK,MAAK;QACnG,KAAK,MAAM+B,SAASL,OAAQ;YAC1B,MAAMX,QAAQgB,yBAAAA,KAAO,CAACrC,WAAWI,GAAG,CAAC;YACrC,IAAI,OAAOiB,UAAU,WAAWe,UAAUf;QAC5C;QACAc,GAAG,CAACnC,WAAWI,GAAG,CAAC,GAAGgC;IACxB;IACA,OAAO/C,oBAAoB8C,KAAKvB,kBAAkBuB,MAAMH;AAC1D;AAEA;;;;CAIC,GACD,OAAO,SAASM,qBACdC,OAAU,EACVxB,MAAiF,EACjFC,MAAkC,EAClCY,UAA2D;IAE3D,IAAI,CAACZ,QAAQ,OAAOuB;IACpB,OAAO,aAAKA,SAAYZ,iCAAiCZ,QAAQC,QAAQY;AAC3E;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASY,0BACdC,IAA+E,EAC/EC,GAAW,EACXjB,UAAkB,EAClBkB,SAA6D;QAE7C,6BAACF,yBAIHA;IAJd,MAAMG,UAAWH,yBAAAA,0BAAAA,KAAMI,iBAAiB,sBAAxB,8BAAA,AAACJ,uBAA6F,CAACC,IAAI,qBAAnG,2BAAqG,CACnHjB,WACD;IACD,IAAI,OAAOmB,YAAY,WAAW,OAAOA;IACzC,MAAMtC,OAAQmC,yBAAAA,oBAAAA,KAAMK,WAAW,qBAAlB,AAACL,iBAA2D,CAACC,IAAI;IAC9E,OAAO,OAAOpC,SAAS,YAAYqC,SAAS,CAACrC,KAAuB,KAAK;AAC3E;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASyC,mCACdN,IAA+E,EAC/EC,GAAW,EACXjB,UAAkB,EAClBkB,SAA6D,EAC7DK,UAAqE;QAErD,6BAACP;IAAjB,MAAMG,UAAWH,yBAAAA,0BAAAA,KAAMI,iBAAiB,sBAAxB,8BAAA,AAACJ,uBAA6F,CAACC,IAAI,qBAAnG,2BAAqG,CACnHjB,WACD;IACD,IAAI,OAAOmB,YAAY,WAAW,OAAOA;IACzC,IAAII,WAAWC,OAAO,KAAK,MAAM,OAAO;IACxC,MAAMC,QAAQF,WAAWG,QAAQ;IACjC,OACE,OAAOD,UAAU,YACjBP,SAAS,CAACO,MAAwB,KAAK,QACvCV,0BAA0B;QAAEM,WAAW,EAAEL,wBAAAA,KAAMK,WAAW;IAAC,GAAGJ,KAAKjB,YAAYkB;AAEnF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GAED,4EAA4E,GAC5E,MAAMS,iBAA2D;IAC/DC,OAAO;IACPC,QAAQ;IACRC,QAAQ;IACRC,QAAQ;AACV;AAeA,6EAA6E,GAC7E,OAAO,SAASC;IACd,OAAO9D,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAW0D,cAAc,EAAEvD,GAAG,CAC1E,CAACH,aAAeA,WAAWI,GAAG;AAElC;AAEA;;;;;CAKC,GACD,OAAO,SAASuD,kBAAkBrD,IAA+B;IAC/D,IAAIA,SAAS,WAAWA,SAAS,SAAS,OAAO;IACjD,OAAO8C,cAAc,CAACvD,YAAYS,MAAwB,GAAG;AAC/D;AAEA;;;;;CAKC,GACD,OAAO,SAASsD,qBACd7C,MAAiF,EACjFa,UAA6D;;IAE7D,MAAMtB,eAAQS,0BAAAA,OAAQT,IAAI,mBAAI;IAC9B,MAAMuD,eAAM9C,0BAAAA,OAAQ+C,aAAa,oBAAI,CAAC;IACtC,MAAMC,WAAWhD,CAAAA,0BAAAA,OAAQkB,MAAM,aAAIL,8BAAAA,WAAYkC,aAAa,oBAAI,CAAC,IAAK,CAAC;IACvE,MAAM3B,MAA+B,CAAC;IACtC,KAAK,MAAMnC,cAAcL,gBAAiB;QACxC,IAAI,CAACK,WAAW0D,cAAc,EAAE;QAChC,MAAMtD,MAAMJ,WAAWI,GAAG;QAC1B,MAAM4D,OAAOH,GAAG,CAACzD,IAAI;QACrB,MAAM6D,YAAYF,QAAQ,CAAC3D,IAAI;QAC/B+B,GAAG,CAAC/B,IAAI,GACN,OAAO4D,SAAS,YACZA,OACA,OAAOC,cAAc,YACnBA,YACAjE,WAAW0D,cAAc,CAACpD,KAAK,KAAK;IAC9C;IACA,OAAO6B;AACT;AAEA;;;;CAIC,GACD,OAAO,SAAS+B,cACdnD,MAAkD,EAClDC,MAAkC;IAElC,IAAI,CAACD,UAAU,CAACC,UAAU,CAACzB,gBAAgBwB,SAAS,OAAO;IAC3D,MAAMT,OAAOhB,YAAYyB,QAAQC;IACjC,IAAI,CAACV,MAAM,OAAO;IAClB,MAAM6D,gBAAgBtE,YAAYkB,OAAOT,IAAI;IAC7C,IAAI8C,cAAc,CAAC9C,KAAK,IAAI8C,cAAc,CAACe,cAAc,EAAE,OAAO;IAClE,OAAO7D;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAAS8D,iBACdrD,MAAkD,EAClDC,MAAkC,EAClCY,UAA6D;;QAMtCb;IAJvB,MAAMT,OAAO4D,cAAcnD,QAAQC;IACnC,IAAI,CAACV,MAAM,OAAO;IAClB,MAAM+D,UAAUT,qBAAqB7C,QAAQa;IAC7C,IAAI,CAAClB,OAAO4D,MAAM,CAACD,SAAS3C,IAAI,CAAC6C,UAAU,OAAO;IAClD,OAAO;QAAEjE;QAAMkE,MAAM,UAAEzD,2BAAAA,0BAAAA,OAAQI,eAAe,qBAAvBJ,uBAAyB,CAACC,OAAkB,mBAAI,CAAC;QAAGqD;IAAQ;AACrF;AAEA,8FAA8F,GAC9F,OAAO,SAASI,yBAAyBC,SAA2C;IAClF,IAAI,CAACA,WAAW,OAAO,EAAE;IACzB,OAAOjB,6BAA6B1D,MAAM,CAAC,CAACK,MAAQsE,UAAUL,OAAO,CAACjE,IAAI,KAAK;AACjF;AAEA,kHAAkH,GAClH,SAASuE,gBAAgB3E,UAAmC,EAAEM,IAAoB;QACnEN;IAAb,MAAM4E,QAAO5E,+BAAAA,WAAWC,gBAAgB,qBAA3BD,4BAA6B,CAACM,KAAK;IAChD,IAAI,OAAOsE,SAAS,WAAW,OAAOA;IACtC,OAAO5E,WAAW6E,YAAY,CAAChF,YAAYS,MAAM,KAAK;AACxD;AAEA;;;;CAIC,GACD,OAAO,SAASwE,wBACdvC,OAAU,EACVmC,SAA2C;IAE3C,IAAI,CAACA,WAAW,OAAOnC;IACvB,MAAMV,cAAclC,gBAAgBI,MAAM,CAAC,CAACC,aAAeA,WAAW0D,cAAc;IACpF,IAAI,CAAC7B,YAAYC,MAAM,EAAE,OAAOS;IAChC,MAAMwC,aAAa,IAAIC,IAAInD,YAAY1B,GAAG,CAAC,CAACH,aAAeA,WAAWI,GAAG;IACzE,MAAM6E,UAAU,CAAC7E,MAAyBsE,UAAUL,OAAO,CAACjE,IAAI,KAAK;IACrE,+DAA+D;IAC/D,MAAM8E,UAAU,IAAIC;IACpB,KAAK,MAAM,CAAC/E,KAAKS,QAAQuE,KAAK,IAAI1F,2BAA4B;QAC5D,IAAI0F,SAAS,aAAaL,WAAWM,GAAG,CAACjF,QAAQ2E,WAAWM,GAAG,CAACxE,SAASqE,QAAQI,GAAG,CAAClF,KAAKS;IAC5F;IACA,MAAM0E,cAAc,CAACnF;QACnB,MAAMiB,QAAQqD,UAAUF,MAAM,CAACpE,IAAI;QACnC,OAAO,OAAOiB,UAAU,YAAYA,QAAQnB;IAC9C;IACA,MAAMsF,QAAQ,CAACpF;QACb,MAAMqF,OAAO,IAAIT;QACjB,IAAIU,QAAQ;QACZ,IAAK,IAAIC,UAAUvF,KAAK8E,QAAQG,GAAG,CAACM,YAAY,CAACF,KAAKJ,GAAG,CAACM,UAAUD,SAAS,EAAG;YAC9ED,KAAKG,GAAG,CAACD;YACTA,UAAUT,QAAQW,GAAG,CAACF;QACxB;QACA,OAAOD;IACT;IACA,MAAMvD,MAA+B,aAAKI;IAC1C,KAAK,MAAMvC,cAAc;WAAI6B;KAAY,CAACiE,IAAI,CAAC,CAACC,GAAGC,IAAMR,MAAMO,EAAE3F,GAAG,IAAIoF,MAAMQ,EAAE5F,GAAG,GAAI;QACrF,MAAMA,MAAMJ,WAAWI,GAAG;QAC1B,MAAM6F,YAAY1D,OAAO,CAACnC,IAAI,KAAK;QACnC,yDAAyD;QACzD,IAAI,CAAC6E,QAAQ7E,MAAM;YACjB+B,GAAG,CAAC/B,IAAI,GAAG6F;YACX;QACF;QACA,MAAMpC,MAAM0B,YAAYnF;QACxB,MAAMS,SAASqE,QAAQW,GAAG,CAACzF;QAC3B,IAAIyD,QAAQ3D,WAAWiC,GAAG,CAAC/B,IAAI,GAAGyD;aAC7B,IAAIhD,UAAUoE,QAAQpE,SAASsB,GAAG,CAAC/B,IAAI,GAAG+B,GAAG,CAACtB,OAAO,KAAK,QAAQoF;aAClE9D,GAAG,CAAC/B,IAAI,GAAG6F,aAAatB,gBAAgB3E,YAAY0E,UAAUpE,IAAI;IACzE;IACA,KAAK,MAAMN,cAAc6B,YAAa;QACpC,MAAMzB,MAAMJ,WAAWI,GAAG;QAC1B,MAAM8F,OAAOjB,QAAQ7E,OAAOmF,YAAYnF,SAAS,OAAOmC,OAAO,CAACnC,IAAI,KAAK;QACzE,IAAI,CAAC8F,MAAM;QACX,MAAMT,OAAO,IAAIT;QACjB,IAAK,IAAInE,SAASqE,QAAQW,GAAG,CAACzF,MAAMS,UAAU,CAAC4E,KAAKJ,GAAG,CAACxE,SAASA,SAASqE,QAAQW,GAAG,CAAChF,QAAS;YAC7F4E,KAAKG,GAAG,CAAC/E;YACT,yDAAyD;YACzD,IAAI,CAACoE,QAAQpE,WAAW0E,YAAY1E,YAAY,OAAO;YACvDsB,GAAG,CAACtB,OAAO,GAAG;QAChB;IACF;IACA,OAAOxB,oBAAoB8C,KAAKzC;AAClC;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASyG,6BAA6BC,OAI5C;QAmBQtF;IAlBP,MAAM,EAAEC,MAAM,EAAEa,UAAU,EAAEZ,MAAM,EAAE,GAAGoF;IACvC,IAAI,CAACrF,QAAQ,OAAON;IACpB,IAAIlB,gBAAgBwB,SAAS;QAC3B,yEAAyE;QACzE,wEAAwE;QACxE,MAAMwB,UAAUD,qBACdwC,wBACElF,sBAAsBmB,QAAQa,qBAAAA,aAAc,OAC5CwC,iBAAiBrD,QAAQC,QAAQY,qBAAAA,aAAc,QAEjDb,QACAC,QACAY,qBAAAA,aAAc;QAEhB,OAAOlB,OAAOC,WAAW,CACvB;eAAIb;eAAyB2D;SAA6B,CAACtD,GAAG,CAAC,CAACC,MAAQ;gBAACA;gBAAKmC,OAAO,CAACnC,IAAI,KAAK;aAAK;IAExG;IACA,QAAOU,sCAAAA,mCAAmCC,QAAQC,mBAA3CF,sCAAsDL;AAC/D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS4F,6BACdC,OAAiE,EACjEtF,MAAe,EACfuF,WAA2D;IAE3D,MAAMC,aAAiE,CAAC;IACxE,KAAK,MAAMzF,UAAUuF,QAAS;YAIGC;QAH/B,IAAI,CAACjH,YAAYyB,QAAQC,SAAS;QAClCwF,UAAU,CAACzF,OAAO0F,GAAG,CAAC,GAAGN,6BAA6B;YACpDpF;YACAa,YAAYb,OAAOkB,MAAM,IAAIsE,mBAAAA,YAAYV,GAAG,CAAC9E,OAAOkB,MAAM,aAA7BsE,mBAAkC,OAAQ;YACvEvF;QACF;IACF;IACA,OAAOwF;AACT;AAYA;;;;;;;;CAQC,GACD,OAAO,SAASE,aAAaC,OAAyB,EAAEjE,GAAW,EAAEtC,GAAgB;QACrCZ;IAA9C,OAAOoH,oBAAoBD,SAASjE,KAAKtC,MAAKZ,8BAAAA,sBAAsB,CAACY,IAAI,YAA3BZ,8BAA+B,CAAC;AAChF;AAEA;;;;;;CAMC,GACD,OAAO,SAASoH,oBACdD,OAAyB,EACzBjE,GAA8B,EAC9BtC,GAAW,EACXuC,SAA6D;IAE7D,IAAI,CAACgE,WAAW,CAACjE,KAAK,OAAO;IAC7B,wEAAwE;IACxE,qEAAqE;IACrE,MAAMmE,OAAO,CAACC,QACZ,OAAO,AAACH,QAA8Bd,GAAG,KAAK,aAC1C,AAACc,QAA4Cd,GAAG,CAACiB,SACjD,AAACH,OAAmC,CAACG,MAAM;IACjD,OAAOtE,0BACL;QAAEK,mBAAmBgE,KAAK;QAAsB/D,aAAa+D,KAAK;IAAe,GACjFnE,KACAtC,KACAuC;AAEJ;AAEA;;;CAGC,GACD,OAAO,SAASoE,eAAe3G,GAAW;IACxC,OAAOX,sBAAsBW;AAC/B"}