@astrale-os/kernel-core 0.4.1

package/dist/auth/expression/builder.js

@@ -0,0 +1,287 @@
+/**
+ * Fluent SDK for Identity Expression Composition
+ *
+ * Provides a builder pattern for composing identity expressions with
+ * union, intersect, exclude, and scope operations. Supports method chaining
+ * and factory functions for flexible expression building.
+ *
+ * @example
+ * ```typescript
+ * // Factory functions
+ * const expr = union(
+ *   identity("X").scope({ nodes: ["node-A"] }),
+ *   identity("Y")
+ * )
+ *
+ * // Method chaining
+ * const expr2 = identity("A")
+ *   .union(identity("B"))
+ *   .intersect(identity("C"))
+ *   .exclude(identity("D"))
+ *
+ * // Build to raw IdentityExpr
+ * const rawExpr = expr.build()
+ * ```
+ */
+/**
+ * Type guard to check if value is an ExprBuilder.
+ */
+export function isExprBuilder(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'build' in value &&
+        typeof value.build === 'function');
+}
+// =============================================================================
+// EXPR ABSTRACT BASE CLASS
+// =============================================================================
+/**
+ * Base class for all expression builders.
+ * Provides composition methods (union, intersect, exclude, scope) available on all expressions.
+ */
+export class Expr {
+    /**
+     * Create a union of this expression with another.
+     * A ∪ B: grants access if either A or B grants access.
+     * Flattens nested unions: (A ∪ B) ∪ C → union([A, B, C])
+     */
+    union(other) {
+        if (this instanceof NaryExpr && this.kind === 'union') {
+            return new NaryExpr('union', [...this.operands, other]);
+        }
+        return new NaryExpr('union', [this, other]);
+    }
+    /**
+     * Create an intersection of this expression with another.
+     * A ∩ B: grants access only if both A and B grant access.
+     * Flattens nested intersects: (A ∩ B) ∩ C → intersect([A, B, C])
+     */
+    intersect(other) {
+        if (this instanceof NaryExpr && this.kind === 'intersect') {
+            return new NaryExpr('intersect', [...this.operands, other]);
+        }
+        return new NaryExpr('intersect', [this, other]);
+    }
+    /**
+     * Exclude another expression from this one.
+     * A \ B: grants access if A grants but B does not.
+     * Flattens chained excludes: (A \ B) \ C → exclude(A, [B, C])
+     */
+    exclude(other) {
+        if (this instanceof ExcludeExpr) {
+            return new ExcludeExpr(this.base, [...this.excluded, other]);
+        }
+        return new ExcludeExpr(this, [other]);
+    }
+    /**
+     * Wrap this expression with a scope restriction.
+     * Returns a ScopeExpr. Chaining .scope() accumulates scopes (OR'd).
+     */
+    scope(s) {
+        return new ScopeExpr([s], this);
+    }
+}
+// =============================================================================
+// IDENTITY LEAF BUILDER
+// =============================================================================
+/**
+ * Builder for identity leaf expressions.
+ * Represents a single identity.
+ */
+export class IdentityExprBuilder extends Expr {
+    id;
+    constructor(id) {
+        super();
+        this.id = id;
+    }
+    build() {
+        return { kind: 'identity', id: this.id };
+    }
+}
+// =============================================================================
+// SCOPE EXPRESSION BUILDER
+// =============================================================================
+/**
+ * Builder for scope-wrapped expressions.
+ * Wraps an inner expression with scope restrictions (OR'd).
+ */
+export class ScopeExpr extends Expr {
+    scopes;
+    inner;
+    constructor(scopes, inner) {
+        super();
+        this.scopes = scopes;
+        this.inner = inner;
+    }
+    /**
+     * Add another scope (OR'd with existing scopes).
+     * Returns a new ScopeExpr (immutable).
+     */
+    scope(s) {
+        return new ScopeExpr([...this.scopes, s], this.inner);
+    }
+    build() {
+        return { kind: 'scope', scopes: this.scopes, expr: this.inner.build() };
+    }
+}
+// =============================================================================
+// RAW EXPRESSION WRAPPER
+// =============================================================================
+/**
+ * Wrapper for raw IdentityExpr values.
+ * Allows mixing raw expressions (e.g., from evalIdentity) with builders.
+ */
+export class RawExpr extends Expr {
+    expr;
+    constructor(expr) {
+        super();
+        this.expr = expr;
+    }
+    build() {
+        return this.expr;
+    }
+}
+// =============================================================================
+// N-ARY EXPRESSION BUILDER (union, intersect)
+// =============================================================================
+/**
+ * Builder for n-ary expressions (union, intersect).
+ */
+export class NaryExpr extends Expr {
+    kind;
+    operands;
+    constructor(kind, operands) {
+        super();
+        this.kind = kind;
+        this.operands = operands;
+    }
+    build() {
+        return {
+            kind: this.kind,
+            operands: this.operands.map((op) => op.build()),
+        };
+    }
+}
+// =============================================================================
+// EXCLUDE EXPRESSION BUILDER
+// =============================================================================
+/**
+ * Builder for exclude expressions (base \ excluded[]).
+ */
+export class ExcludeExpr extends Expr {
+    base;
+    excluded;
+    constructor(base, excluded) {
+        super();
+        this.base = base;
+        this.excluded = excluded;
+    }
+    build() {
+        return {
+            kind: 'exclude',
+            base: this.base.build(),
+            excluded: this.excluded.map((e) => e.build()),
+        };
+    }
+}
+// =============================================================================
+// FACTORY FUNCTIONS
+// =============================================================================
+/**
+ * Create an identity leaf expression.
+ *
+ * @param id - The identity ID
+ * @param scopes - Optional scope restriction(s). If provided, wraps in a scope node.
+ *
+ * @example
+ * ```typescript
+ * identity("USER1")
+ * identity("USER1", { nodes: ["ws1"] })
+ * identity("USER1", [{ nodes: ["ws1"] }, { perms: 1 }])
+ * ```
+ */
+export function identity(id, scopes) {
+    if (typeof id !== 'string' || id.length === 0) {
+        throw new Error('identity id must be a non-empty string');
+    }
+    const leaf = new IdentityExprBuilder(id);
+    if (scopes) {
+        const scopeArray = (Array.isArray(scopes) ? scopes : [scopes]).filter(Boolean);
+        if (scopeArray.length > 0) {
+            return new ScopeExpr(scopeArray, leaf);
+        }
+    }
+    return leaf;
+}
+/**
+ * Alias for identity() - shorter form.
+ */
+export const id = identity;
+/**
+ * Wrap a raw IdentityExpr in an Expr builder.
+ * Useful for mixing resolved expressions with builders.
+ *
+ * @param expr - A raw IdentityExpr (e.g., from evalIdentity or evalExpr)
+ */
+export function raw(expr) {
+    if (!expr || typeof expr !== 'object' || !('kind' in expr)) {
+        throw new Error('raw() requires a valid IdentityExpr object');
+    }
+    if (!['identity', 'scope', 'union', 'intersect', 'exclude'].includes(expr.kind)) {
+        throw new Error(`Invalid expression kind: ${expr.kind}`);
+    }
+    return new RawExpr(expr);
+}
+/**
+ * Create a union of multiple expressions.
+ * Variadic: union(a, b, c) = union([a, b, c])
+ *
+ * @throws Error if fewer than 2 expressions provided
+ */
+export function union(...exprs) {
+    if (exprs.length < 2) {
+        throw new Error('union requires at least 2 expressions');
+    }
+    return new NaryExpr('union', exprs);
+}
+/**
+ * Create an intersection of multiple expressions.
+ * Variadic: intersect(a, b, c) = intersect([a, b, c])
+ *
+ * @throws Error if fewer than 2 expressions provided
+ */
+export function intersect(...exprs) {
+    if (exprs.length < 2) {
+        throw new Error('intersect requires at least 2 expressions');
+    }
+    return new NaryExpr('intersect', exprs);
+}
+/**
+ * Create an exclude expression.
+ * exclude(base, excluded) = base \ excluded
+ */
+export function exclude(base, excluded) {
+    return new ExcludeExpr(base, [excluded]);
+}
+// =============================================================================
+// GRANT BUILDER
+// =============================================================================
+/**
+ * Builder for creating Grant objects with a single expression.
+ */
+export class GrantBuilder {
+    expr;
+    constructor(expr) {
+        this.expr = expr;
+    }
+    build() {
+        return { expr: this.expr.build() };
+    }
+}
+/**
+ * Create a GrantBuilder for composing a grant expression.
+ */
+export function grant(expr) {
+    return new GrantBuilder(expr);
+}
+//# sourceMappingURL=builder.js.map

package/dist/auth/expression/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../../auth/expression/builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAmBH;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,IAAI,KAAK;QAChB,OAAQ,KAAqB,CAAC,KAAK,KAAK,UAAU,CACnD,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,OAAgB,IAAI;IAGxB;;;;OAIG;IACH,KAAK,CAAC,KAAW;QACf,IAAI,IAAI,YAAY,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAW;QACnB,IAAI,IAAI,YAAY,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC1D,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACjD,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAW;QACjB,IAAI,IAAI,YAAY,WAAW,EAAE,CAAC;YAChC,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,CAAQ;QACZ,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACjC,CAAC;CACF;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,IAAI;IACd,EAAE;IAA/B,YAA6B,EAAc;QACzC,KAAK,EAAE,CAAA;kBADoB,EAAE;IAE/B,CAAC;IAED,KAAK;QACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;IAC1C,CAAC;CACF;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,OAAO,SAAU,SAAQ,IAAI;IAEtB,MAAM;IACE,KAAK;IAFxB,YACW,MAAe,EACP,KAAW;QAE5B,KAAK,EAAE,CAAA;sBAHE,MAAM;qBACE,KAAK;IAGxB,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,CAAQ;QACrB,OAAO,IAAI,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC;IAED,KAAK;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACzE,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,OAAO,OAAQ,SAAQ,IAAI;IACF,IAAI;IAAjC,YAA6B,IAAkB;QAC7C,KAAK,EAAE,CAAA;oBADoB,IAAI;IAEjC,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF;AAED,gFAAgF;AAChF,8CAA8C;AAC9C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,IAAI;IAErB,IAAI;IACJ,QAAQ;IAFnB,YACW,IAA2B,EAC3B,QAAgB;QAEzB,KAAK,EAAE,CAAA;oBAHE,IAAI;wBACJ,QAAQ;IAGnB,CAAC;IAED,KAAK;QACH,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;SAChD,CAAA;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,IAAI;IAExB,IAAI;IACJ,QAAQ;IAFnB,YACW,IAAU,EACV,QAAgB;QAEzB,KAAK,EAAE,CAAA;oBAHE,IAAI;wBACJ,QAAQ;IAGnB,CAAC;IAED,KAAK;QACH,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;SAC9C,CAAA;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAc,EAAE,MAAwB;IAC/D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAA;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAA;AAE1B;;;;;GAKG;AACH,MAAM,UAAU,GAAG,CAAC,IAAkB;IACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,KAAa;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAG,KAAa;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAU,EAAE,QAAc;IAChD,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,YAAY;IACM,IAAI;IAAjC,YAA6B,IAAU;oBAAV,IAAI;IAAS,CAAC;IAE3C,KAAK;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAA;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,KAAK,CAAC,IAAU;IAC9B,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC"}

package/dist/auth/expression/codec.d.ts

@@ -0,0 +1,28 @@
+/**
+ * PayloadCodec — Encoding Strategy for JWT Payloads
+ *
+ * Configurable codec for encoding/decoding identity expressions in JWT payloads.
+ * Default: 'json' (current behavior, no transformation).
+ * Alternatives: 'compact' (~60% smaller), 'binary' (~79% smaller via base64).
+ */
+import type { IdentityExpr } from './types';
+export type ExpressionEncoding = 'json' | 'compact' | 'binary';
+export interface PayloadCodec {
+    encodeExpr(expr: IdentityExpr): unknown;
+    decodeExpr(encoded: unknown): IdentityExpr;
+}
+export declare const jsonCodec: PayloadCodec;
+export declare const compactCodec: PayloadCodec;
+export declare const binaryCodec: PayloadCodec;
+/**
+ * Get a PayloadCodec for the given encoding strategy.
+ *
+ * @param encoding - 'json' | 'compact' | 'binary'
+ * @param options.dedup - Enable structural deduplication (only effective with 'binary').
+ *   Repeated subtrees are extracted into shared definitions, reducing size 30-80%.
+ *   No overhead when no duplicates exist. Default: false.
+ */
+export declare function getCodec(encoding: ExpressionEncoding, options?: {
+    dedup?: boolean;
+}): PayloadCodec;
+//# sourceMappingURL=codec.d.ts.map

package/dist/auth/expression/codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../../auth/expression/codec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAU3C,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE9D,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAA;IACvC,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAA;CAC3C;AAMD,eAAO,MAAM,SAAS,EAAE,YAOvB,CAAA;AAMD,eAAO,MAAM,YAAY,EAAE,YAO1B,CAAA;AAMD,eAAO,MAAM,WAAW,EAAE,YAwBzB,CAAA;AA8CD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B,YAAY,CAYd"}

package/dist/auth/expression/codec.js

@@ -0,0 +1,123 @@
+/**
+ * PayloadCodec — Encoding Strategy for JWT Payloads
+ *
+ * Configurable codec for encoding/decoding identity expressions in JWT payloads.
+ * Default: 'json' (current behavior, no transformation).
+ * Alternatives: 'compact' (~60% smaller), 'binary' (~79% smaller via base64).
+ */
+import { toCompact, fromCompact } from './compact';
+import { isDedupedExpr, expand, dedup } from './dedup';
+import { encode, decode } from './encoding';
+// =============================================================================
+// JSON CODEC (default — identity/no-op)
+// =============================================================================
+export const jsonCodec = {
+    encodeExpr(expr) {
+        return expr;
+    },
+    decodeExpr(encoded) {
+        return encoded;
+    },
+};
+// =============================================================================
+// COMPACT CODEC
+// =============================================================================
+export const compactCodec = {
+    encodeExpr(expr) {
+        return toCompact(expr);
+    },
+    decodeExpr(encoded) {
+        return fromCompact(encoded);
+    },
+};
+// =============================================================================
+// BINARY CODEC (base64 for JSON transport)
+// =============================================================================
+export const binaryCodec = {
+    encodeExpr(expr) {
+        const binary = encode(expr);
+        let binaryString = '';
+        for (let i = 0; i < binary.length; i++) {
+            binaryString += String.fromCharCode(binary[i]);
+        }
+        return btoa(binaryString);
+    },
+    decodeExpr(encoded) {
+        if (typeof encoded !== 'string') {
+            throw new Error('Binary codec expects a base64 string');
+        }
+        const binaryString = atob(encoded);
+        const bytes = new Uint8Array(binaryString.length);
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i);
+        }
+        const result = decode(bytes);
+        if (isDedupedExpr(result)) {
+            return expand(result);
+        }
+        return result;
+    },
+};
+// =============================================================================
+// DEDUP BINARY CODEC
+// =============================================================================
+/**
+ * Binary codec with structural deduplication.
+ *
+ * On encode: dedup(expr) → if shared defs found, encode DedupedExpr; else encode plain.
+ * On decode: decode bytes → if deduped, expand; else return as-is.
+ *
+ * Use when expressions may have repeated subtrees (30-80% additional savings).
+ * No overhead when no duplicates exist (falls back to plain binary).
+ */
+const dedupBinaryCodec = {
+    encodeExpr(expr) {
+        const deduped = dedup(expr);
+        const binary = deduped.defs.length > 0 ? encode(deduped) : encode(expr);
+        let s = '';
+        for (let i = 0; i < binary.length; i++) {
+            s += String.fromCharCode(binary[i]);
+        }
+        return btoa(s);
+    },
+    decodeExpr(encoded) {
+        if (typeof encoded !== 'string') {
+            throw new Error('Binary codec expects a base64 string');
+        }
+        const s = atob(encoded);
+        const bytes = new Uint8Array(s.length);
+        for (let i = 0; i < s.length; i++) {
+            bytes[i] = s.charCodeAt(i);
+        }
+        const result = decode(bytes);
+        if (isDedupedExpr(result)) {
+            return expand(result);
+        }
+        return result;
+    },
+};
+// =============================================================================
+// FACTORY
+// =============================================================================
+/**
+ * Get a PayloadCodec for the given encoding strategy.
+ *
+ * @param encoding - 'json' | 'compact' | 'binary'
+ * @param options.dedup - Enable structural deduplication (only effective with 'binary').
+ *   Repeated subtrees are extracted into shared definitions, reducing size 30-80%.
+ *   No overhead when no duplicates exist. Default: false.
+ */
+export function getCodec(encoding, options) {
+    if (options?.dedup && encoding === 'binary') {
+        return dedupBinaryCodec;
+    }
+    switch (encoding) {
+        case 'json':
+            return jsonCodec;
+        case 'compact':
+            return compactCodec;
+        case 'binary':
+            return binaryCodec;
+    }
+}
+//# sourceMappingURL=codec.js.map

package/dist/auth/expression/codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../../auth/expression/codec.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAa3C,gFAAgF;AAChF,wCAAwC;AACxC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAiB;IACrC,UAAU,CAAC,IAAkB;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,UAAU,CAAC,OAAgB;QACzB,OAAO,OAAuB,CAAA;IAChC,CAAC;CACF,CAAA;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,UAAU,CAAC,IAAkB;QAC3B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,UAAU,CAAC,OAAgB;QACzB,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;CACF,CAAA;AAED,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAEhF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,UAAU,CAAC,IAAkB;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,YAAY,GAAG,EAAE,CAAA;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3B,CAAC;IACD,UAAU,CAAC,OAAgB;QACzB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAiB;IACrC,UAAU,CAAC,IAAkB;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACvE,IAAI,CAAC,GAAG,EAAE,CAAA;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IACD,UAAU,CAAC,OAAgB;QACzB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CACtB,QAA4B,EAC5B,OAA6B;IAE7B,IAAI,OAAO,EAAE,KAAK,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,KAAK,SAAS;YACZ,OAAO,YAAY,CAAA;QACrB,KAAK,QAAQ;YACX,OAAO,WAAW,CAAA;IACtB,CAAC;AACH,CAAC"}

package/dist/auth/expression/compact.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Compact JSON Encoding for Identity Expressions
+ *
+ * Encoding:
+ * - Identity:  ["i", id]
+ * - Scope:     ["s", CompactScope[], innerExpr]
+ * - Union:     ["u", [operand1, operand2, ...]]
+ * - Intersect: ["n", [operand1, operand2, ...]]
+ * - Exclude:   ["x", base, [excl1, excl2, ...]]
+ *
+ * Scopes: { n?: nodes[], p?: perms[], r?: principals[] }
+ */
+import type { IdentityExpr } from './types';
+export type CompactScope = {
+    n?: string[];
+    p?: number;
+    r?: string[];
+};
+export type CompactExpr = ['i', string] | ['s', CompactScope[], CompactExpr] | ['u', CompactExpr[]] | ['n', CompactExpr[]] | ['x', CompactExpr, CompactExpr[]];
+export declare function toCompact(expr: IdentityExpr, depth?: number): CompactExpr;
+export declare function fromCompact(input: unknown, depth?: number): IdentityExpr;
+export declare function toCompactJSON(expr: IdentityExpr): string;
+export declare function fromCompactJSON(json: string): IdentityExpr;
+//# sourceMappingURL=compact.d.ts.map

package/dist/auth/expression/compact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact.d.ts","sourceRoot":"","sources":["../../../auth/expression/compact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAS,MAAM,SAAS,CAAA;AAKlD,MAAM,MAAM,YAAY,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAErE,MAAM,MAAM,WAAW,GACnB,CAAC,GAAG,EAAE,MAAM,CAAC,GACb,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,GAClC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,GACpB,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,GACpB,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAA;AAcrC,wBAAgB,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,SAAI,GAAG,WAAW,CAmBpE;AA+BD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,YAAY,CAgDnE;AAMD,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAExD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAE1D"}

package/dist/auth/expression/compact.js

@@ -0,0 +1,143 @@
+/**
+ * Compact JSON Encoding for Identity Expressions
+ *
+ * Encoding:
+ * - Identity:  ["i", id]
+ * - Scope:     ["s", CompactScope[], innerExpr]
+ * - Union:     ["u", [operand1, operand2, ...]]
+ * - Intersect: ["n", [operand1, operand2, ...]]
+ * - Exclude:   ["x", base, [excl1, excl2, ...]]
+ *
+ * Scopes: { n?: nodes[], p?: perms[], r?: principals[] }
+ */
+import { ALL_PERMS } from '#auth/permissions';
+// Max recursion depth to prevent stack overflow from malicious input
+const MAX_DEPTH = 100;
+// =============================================================================
+// ENCODE (Verbose → Compact)
+// =============================================================================
+function compactScope(scope) {
+    const r = {};
+    if (scope.nodes?.length)
+        r.n = scope.nodes;
+    if (scope.perms !== undefined)
+        r.p = scope.perms;
+    if (scope.principals?.length)
+        r.r = scope.principals;
+    return r;
+}
+export function toCompact(expr, depth = 0) {
+    if (depth > MAX_DEPTH)
+        throw new Error('Expression too deeply nested');
+    switch (expr.kind) {
+        case 'identity':
+            return ['i', expr.id];
+        case 'scope':
+            return ['s', expr.scopes.map(compactScope), toCompact(expr.expr, depth + 1)];
+        case 'union':
+            return ['u', expr.operands.map((op) => toCompact(op, depth + 1))];
+        case 'intersect':
+            return ['n', expr.operands.map((op) => toCompact(op, depth + 1))];
+        case 'exclude':
+            return [
+                'x',
+                toCompact(expr.base, depth + 1),
+                expr.excluded.map((ex) => toCompact(ex, depth + 1)),
+            ];
+    }
+}
+// =============================================================================
+// DECODE (Compact → Verbose)
+// =============================================================================
+function isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === 'string');
+}
+function expandScope(c) {
+    if (typeof c !== 'object' || c === null || Array.isArray(c))
+        throw new Error('Invalid scope');
+    const s = c;
+    const r = {};
+    if (s.n !== undefined) {
+        if (!isStringArray(s.n))
+            throw new Error('Invalid scope.nodes');
+        if (s.n.length)
+            r.nodes = s.n;
+    }
+    if (s.p !== undefined) {
+        if (typeof s.p !== 'number' || !Number.isInteger(s.p) || s.p < 0 || s.p > ALL_PERMS) {
+            throw new Error('Invalid scope.perms: must be a non-negative 31-bit integer');
+        }
+        r.perms = s.p;
+    }
+    if (s.r !== undefined) {
+        if (!isStringArray(s.r))
+            throw new Error('Invalid scope.principals');
+        if (s.r.length)
+            r.principals = s.r;
+    }
+    return r;
+}
+export function fromCompact(input, depth = 0) {
+    if (depth > MAX_DEPTH)
+        throw new Error('Expression too deeply nested');
+    if (!Array.isArray(input) || input.length < 2)
+        throw new Error('Invalid expression');
+    const [kind, ...rest] = input;
+    switch (kind) {
+        case 'i': {
+            const id = rest[0];
+            if (typeof id !== 'string' || !id)
+                throw new Error('Invalid identity id');
+            return { kind: 'identity', id: id };
+        }
+        case 's': {
+            if (rest.length !== 2)
+                throw new Error('Invalid scope expression');
+            const scopes = rest[0];
+            if (!Array.isArray(scopes))
+                throw new Error('Invalid scope scopes');
+            const expanded = scopes.map(expandScope);
+            if (expanded.length === 0)
+                throw new Error('Scope must have at least one scope');
+            return { kind: 'scope', scopes: expanded, expr: fromCompact(rest[1], depth + 1) };
+        }
+        case 'u':
+        case 'n': {
+            const operands = rest[0];
+            if (!Array.isArray(operands) || operands.length < 2) {
+                throw new Error(`${kind === 'u' ? 'union' : 'intersect'} must have at least 2 operands`);
+            }
+            const kindMap = { u: 'union', n: 'intersect' };
+            return {
+                kind: kindMap[kind],
+                operands: operands.map((op) => fromCompact(op, depth + 1)),
+            };
+        }
+        case 'x': {
+            if (rest.length !== 2)
+                throw new Error('Invalid exclude expression');
+            const base = fromCompact(rest[0], depth + 1);
+            const excluded = rest[1];
+            if (!Array.isArray(excluded) || excluded.length < 1) {
+                throw new Error('exclude must have at least 1 excluded operand');
+            }
+            return {
+                kind: 'exclude',
+                base,
+                excluded: excluded.map((ex) => fromCompact(ex, depth + 1)),
+            };
+        }
+        default:
+            throw new Error('Unknown expression kind');
+    }
+}
+// =============================================================================
+// JSON HELPERS
+// =============================================================================
+export function toCompactJSON(expr) {
+    return JSON.stringify(toCompact(expr));
+}
+export function fromCompactJSON(json) {
+    return fromCompact(JSON.parse(json));
+}
+//# sourceMappingURL=compact.js.map

package/dist/auth/expression/compact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact.js","sourceRoot":"","sources":["../../../auth/expression/compact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAI7C,qEAAqE;AACrE,MAAM,SAAS,GAAG,GAAG,CAAA;AAWrB,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,SAAS,YAAY,CAAC,KAAY;IAChC,MAAM,CAAC,GAAiB,EAAE,CAAA;IAC1B,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM;QAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;IAC1C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;IAChD,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM;QAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAA;IACpD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAkB,EAAE,KAAK,GAAG,CAAC;IACrD,IAAI,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAEtE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACvB,KAAK,OAAO;YACV,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAC9E,KAAK,OAAO;YACV,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,KAAK,WAAW;YACd,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnE,KAAK,SAAS;YACZ,OAAO;gBACL,GAAG;gBACH,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;aACpD,CAAA;IACL,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;IAC7F,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,MAAM,CAAC,GAAU,EAAE,CAAA;IACnB,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAC/D,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAa,CAAA;IAC3C,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC/E,CAAC;QACD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;IACf,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACpE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAiB,CAAA;IACpD,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACnD,IAAI,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAEpF,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAA;IAE7B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG,EAAE,CAAC;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;YACzE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAgB,EAAE,CAAA;QACnD,CAAC;QACD,KAAK,GAAG,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;YACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YAChF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;QACnF,CAAC;QACD,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,EAAE,CAAC;YACT,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,gCAAgC,CAAC,CAAA;YAC1F,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAW,CAAA;YACvD,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAiB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;aACpE,CAAA;QACH,CAAC;QACD,KAAK,GAAG,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YACpE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;YAClE,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI;gBACJ,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;aACpE,CAAA;QACH,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;AACtC,CAAC"}