@authup/access 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/index.d.mts

@@ -1,7 +1,8 @@
 import { AuthupError, AuthupErrorOptions } from "@authup/errors";
 import { DecisionStrategy } from "@authup/kit";
+import { ICondition } from "@rapiq/core";
 import { Container, Issue, IssueGroup, IssueItem } from "validup";
-import { MongoQuery } from "@ucast/mongo2js";
+import { MongoFiltersParser, MongoFiltersParserInput } from "@rapiq/parser-mongo";
 //#region src/policy/data.d.ts
 interface IPolicyData {
   set(key: string, value: unknown): void;
@@ -30,6 +31,13 @@ type PolicyEvaluationContext = {
   readonly exclude: string[];
   readonly include: string[];
   readonly data: PolicyData;
+  /**
+   * Attach the condition form (`PolicyEvaluationResult.condition`) to pending
+   * subtrees via `IPolicyEvaluator.toCondition`. Off by default — evaluation-only
+   * callers (evaluate / preEvaluate hot paths) must not pay the lowering cost;
+   * query-build callers opt in.
+   */
+  readonly withConditions: boolean;
 };
 type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
 //#endregion
@@ -40,9 +48,50 @@ declare function definePolicyEvaluationContext(input?: PolicyEvaluationContextIn
 type PolicyEvaluators = Record<string, IPolicyEvaluator>;
 type PolicyEvaluationResult = {
   success: boolean;
+  /**
+   * The policy could not be settled yet — a data key it requires is absent from the
+   * evaluation bag (see {@link IPolicyEvaluator.requires}). Pending always rides on
+   * `success: false` (fail-closed: a consumer that ignores the flag behaves like a
+   * deny); only pre-gate style consumers treat pending as a pass.
+   *
+   * Unknown stays unknown: `invert` is never applied to a pending result.
+   */
+  pending?: boolean;
+  /**
+   * EXACT condition form of the pending subtree (see
+   * {@link IPolicyEvaluator.toCondition}): a row satisfies the condition iff the
+   * pending subtree settles true on that row's attributes, given the current bag.
+   * Attached only on pending results, only when the evaluation context requested it
+   * (`withConditions`), and only when the ENTIRE pending subtree is expressible —
+   * a partially expressible tree carries no condition (fail-safe: the consumer
+   * falls back to a per-row post-check).
+   */
+  condition?: ICondition;
   issues?: Issue[];
 };
 interface IPolicyEvaluator {
+  /**
+   * PolicyData keys this policy needs before it can settle (e.g. `identity`,
+   * `attributes`). When any returned key is absent from the evaluation bag, the
+   * engine returns a pending result instead of invoking {@link evaluate}.
+   *
+   * Receives the raw (unvalidated) policy configuration, since data needs may be
+   * config-dependent (e.g. realm-match scope vs. attribute mode). Omit the method
+   * (or return an empty array) for policies evaluable with ambient data only.
+   */
+  requires?(value: Record<string, any>): string[];
+  /**
+   * Express the policy as a condition over row attributes (rapiq `ICondition`)
+   * instead of waiting for the row — the WHERE-pushdown capability. The result is
+   * a partial evaluation against the knowns in `context.data` (e.g. the actor's
+   * realm is baked into a realm-match condition), and must be EXACT: for every
+   * row, `condition(row)` === "this policy settles true with attributes = row".
+   *
+   * Return `null` when this configuration is not expressible (the policy then
+   * stays a per-row post-check — always sound). Omit the method for policies that
+   * never lower (identity, date/time, attributeNames).
+   */
+  toCondition?(value: Record<string, any>, context: PolicyEvaluationContext): Promise<ICondition | null>;
   /**
    * Execute the policy with specific data and a given context.
    */
@@ -146,7 +195,7 @@ declare class AttributeNamesPolicyValidator extends Container<AttributeNamesPoli
 }
 //#endregion
 //#region src/policy/built-in/attributes/types.d.ts
-type AttributesPolicyQuery<T> = MongoQuery<T>;
+type AttributesPolicyQuery<T extends Record<string, any> = Record<string, any>> = MongoFiltersParserInput<T>;
 interface AttributesPolicy<T extends Record<string, any> = Record<string, any>> extends BasePolicy {
   query: AttributesPolicyQuery<T>;
 }
@@ -162,7 +211,10 @@ declare class AttributesPolicyValidator<T extends Record<string, any> = Record<s
 //#region src/policy/built-in/attributes/evaluator.d.ts
 declare class AttributesPolicyEvaluator<T extends Record<string, any> = Record<string, any>> implements IPolicyEvaluator {
   protected validator: AttributesPolicyValidator<T>;
+  protected parser: MongoFiltersParser;
   constructor();
+  requires(): string[];
+  toCondition(value: Record<string, any>): Promise<ICondition | null>;
   accessData(ctx: PolicyEvaluationContext): Promise<T | null>;
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
   protected fixQuery(query: unknown | unknown[]): void;
@@ -173,6 +225,7 @@ declare class AttributeNamesPolicyEvaluator implements IPolicyEvaluator {
   protected validator: AttributeNamesPolicyValidator;
   protected attributesEvaluator: AttributesPolicyEvaluator;
   constructor();
+  requires(): string[];
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
@@ -181,7 +234,7 @@ interface CompositePolicy extends BasePolicy {
   /**
    * How to decide if a policy evaluates to true.
    */
-  decision_strategy?: `${DecisionStrategy}`;
+  decisionStrategy?: `${DecisionStrategy}`;
   /**
    * Child policies.
    */
@@ -230,7 +283,7 @@ interface IdentityPolicy extends BasePolicy {
 }
 type IdentityPolicyData = {
   /**
-   * user, client, robot
+   * user, client
    */
   type: string;
   /**
@@ -266,6 +319,7 @@ declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
   protected validator: IdentityPolicyValidator;
   protected dataValidator: PolicyIdentityDataValidator;
   constructor();
+  requires(): string[];
   accessData(ctx: PolicyEvaluationContext): Promise<IdentityPolicyData | null>;
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
@@ -282,6 +336,7 @@ declare class PermissionBindingPolicyValidator extends Container<PermissionBindi
 declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
   protected validator: PermissionBindingPolicyValidator;
   constructor();
+  requires(): string[];
   evaluate(value: Record<string, any>): Promise<PolicyEvaluationResult>;
 }
 //#endregion
@@ -298,7 +353,7 @@ declare enum RealmScope {
   NONE = "none",
   /** Own realm only — resource realm must equal the actor's realm. */
   OWN = "own",
-  /** Own realm or null/global resources (realm_id === null). */
+  /** Own realm or null/global resources (realmId === null). */
   OWN_OR_NULL = "ownOrNull",
   /** Any realm, including null/global. */
   ANY = "any"
@@ -334,26 +389,26 @@ interface RealmMatchPolicy extends BasePolicy {
   /**
    * Determines how realm-id/name matches are handled.
    */
-  decision_strategy?: `${DecisionStrategy}`;
+  decisionStrategy?: `${DecisionStrategy}`;
   /**
    * Specifies the name(s) of the realm-id/name attribute(s) used for matching.
    * Can be a single attribute name or an array of attribute names.
    */
-  attribute_name?: string | string[];
+  attributeName?: string | string[];
   /**
    * Only match if the attribute is strict equal to the name.
    */
-  attribute_name_strict?: boolean;
+  attributeNameStrict?: boolean;
   /**
    * Determines if resources with null realm-id/name value should match all identity realms.
    * If true, any identity realm can access resources with null realm-id/name values.
    */
-  attribute_null_match_all?: boolean;
+  attributeNullMatchAll?: boolean;
   /**
    * Coarse, actor-relative realm reach (none/own/ownOrNull/any). When set, the evaluator
    * runs in SCOPE MODE: it matches the resource realm read from the REALM_MATCH data key
-   * against the identity realm via `realmScopeMatches`, and ignores `attribute_name` /
-   * `attribute_null_match_all`. With no REALM_MATCH key present it neutral-passes.
+   * against the identity realm via `realmScopeMatches`, and ignores `attributeName` /
+   * `attributeNullMatchAll`. With no REALM_MATCH key present it neutral-passes.
    */
   scope?: `${RealmScope}`;
 }
@@ -369,6 +424,19 @@ declare class RealmMatchPolicyEvaluator implements IPolicyEvaluator {
   protected identityEvaluator: IdentityPolicyEvaluator;
   protected attributesEvaluator: AttributesPolicyEvaluator;
   constructor();
+  requires(value: Record<string, any>): string[];
+  /**
+   * Condition form over the row's realm column, with the actor realm baked in
+   * (mirrors `realmScopeMatches` / the attribute-mode match). Exactness holds for
+   * row-shaped data where the referenced field exists (DB rows) — the object-bag
+   * "key absent → neutral-pass" case has no SQL counterpart. Lowerable configs:
+   * scope mode (field = single-string `attributeName`, default `realmId` — scope-mode
+   * EVALUATION ignores `attributeName`, lowering reuses it as the column override),
+   * and strict attribute mode with a single explicit `attributeName`. Everything
+   * else (multi-key / default-key CONSENSUS, non-strict key expansion) is
+   * row-shape-dependent and stays a post-check.
+   */
+  toCondition(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<ICondition | null>;
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
@@ -397,15 +465,15 @@ interface TimePolicy extends BasePolicy {
   /**
    *  0 (Sunday) - 6 (Saturday)
    */
-  day_of_week?: number;
+  dayOfWeek?: number;
   /**
    * 1 - 31
    */
-  day_of_month?: number;
+  dayOfMonth?: number;
   /**
    * 1 - 365
    */
-  day_of_year?: number;
+  dayOfYear?: number;
 }
 //#endregion
 //#region src/policy/built-in/time/validator.d.ts
@@ -466,7 +534,6 @@ declare const SystemPolicyName: {
   readonly PERMISSION_BINDING: "system.permission-binding";
   readonly REALM_MATCH: "system.realm-match";
   readonly CLIENT_NAMES_SELF_MANAGE: "system.client-names-self-manage";
-  readonly ROBOT_NAMES_SELF_MANAGE: "system.robot-names-self-manage";
   readonly USER_NAMES_SELF_MANAGE: "system.user-names-self-manage";
 };
 //#endregion
@@ -479,6 +546,7 @@ type BuiltInPolicyTypeMapRaw<T extends Record<string, any> = Record<string, any>
   [BuiltInPolicyType.TIME]: TimePolicy;
   [BuiltInPolicyType.IDENTITY]: IdentityPolicy;
   [BuiltInPolicyType.PERMISSION_BINDING]: PermissionBindingPolicy;
+  [BuiltInPolicyType.REALM_MATCH]: RealmMatchPolicy;
 };
 type BuiltInPolicyTypeMap<T extends Record<string, any> = Record<string, any>> = { [K in keyof BuiltInPolicyTypeMapRaw<T> as `${K}`]: BuiltInPolicyTypeMapRaw<T>[K]; };
 type BuiltInPolicies<T extends Record<string, any> = Record<string, any>> = { [K in keyof BuiltInPolicyTypeMap<T>]: BuiltInPolicyTypeMap<T>[K] & {
@@ -542,9 +610,9 @@ declare function isPermissionError(input: unknown): input is PermissionError;
 //#region src/permission/types.d.ts
 type BasePermission = {
   name: string;
-  client_id?: string | null;
-  realm_id?: string | null;
-  decision_strategy?: `${DecisionStrategy}` | null;
+  clientId?: string | null;
+  realmId?: string | null;
+  decisionStrategy?: `${DecisionStrategy}` | null;
 };
 /**
  * A raw permission grant: one permission with its policies and realm reach, as loaded from a
@@ -559,16 +627,16 @@ type PermissionPolicyBinding = {
    * most restrictive `own` (fail-closed). NOT part of the binding identity key
    * (see isPermissionPolicyBindingEqual).
    */
-  realm_scope?: `${RealmScope}`;
+  realmScope?: `${RealmScope}`;
 };
 /**
  * One disjunction term of an aggregated binding: a single grant's realm reach paired with its
- * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realm_scope) ∧ policy`
+ * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realmScope) ∧ policy`
  * across the grants of a permission.
  */
 type PermissionGrant = {
   /** Relative realm reach (none/own/ownOrNull/any), normalized — fail-closed default `own`. */
-  realm_scope: `${RealmScope}`;
+  realmScope: `${RealmScope}`;
   /**
    * The grant's policy: the raw junction policy (its `id` preserved, for propagation) for a
    * single-policy grant, a composite for a multi-policy (Layer-1) binding, or `undefined`
@@ -579,7 +647,7 @@ type PermissionGrant = {
 /**
  * A permission together with the actor's disjunction of grants for it. Output of
  * `aggregatePermissionPolicyBindings` — the honest, lossless replacement for the collapsed
- * `PermissionPolicyBinding` (no top-level realm_scope/policies; the access decision is the
+ * `PermissionPolicyBinding` (no top-level realmScope/policies; the access decision is the
  * OR over `grants`).
  */
 type PermissionPolicyBindingAggregated = {
@@ -590,7 +658,7 @@ type PermissionPolicyBindingAggregated = {
 //#region src/permission/helpers/aggregate.d.ts
 /**
  * Group raw permission-policy bindings by permission key into the actor's disjunction of
- * `(realm_scope, policy)` grants per permission — with NO lossy collapse. Every consumer
+ * `(realmScope, policy)` grants per permission — with NO lossy collapse. Every consumer
  * (the binding evaluator, isSuperset, junction propagation, the memory provider) evaluates the
  * grant disjunction directly, so each grant's realm reach stays paired with the policy that
  * gates it.
@@ -640,6 +708,7 @@ interface IPermissionEvaluator {
   evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
   preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
   preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
+  compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
 type PermissionEvaluatorOptions = {
   provider: IPermissionProvider;
@@ -651,6 +720,16 @@ type PermissionEvaluationOptions = {
   decisionStrategy?: `${DecisionStrategy}`;
   policiesIncluded?: string[];
   policiesExcluded?: string[];
+  /**
+   * How a grant whose policy evaluation is PENDING (a required data key is absent —
+   * see `PolicyEvaluationResult.pending`) is treated:
+   *
+   * - `deny` (default): pending counts as failure — full `evaluate()` semantics,
+   *   matching the historical missing-data deny.
+   * - `permit`: pending counts as pass — the data-availability-derived pre-gate
+   *   (`preEvaluate()`): only a tree that settles false with the current bag denies.
+   */
+  pendingPolicies?: 'deny' | 'permit';
 };
 type PermissionEvaluationContext = {
   name: string | string[];
@@ -659,6 +738,42 @@ type PermissionEvaluationContext = {
   data?: PolicyData;
   options?: PermissionEvaluationOptions;
 };
+type PermissionCompileContext = {
+  /**
+   * Permission name(s). Several names compile as a disjunction — the row is
+   * readable when ANY of them passes (`evaluateOneOf` semantics).
+   */
+  name: string | string[];
+  realmId?: string | null;
+  clientId?: string | null;
+  /**
+   * The knowns bag (typically the actor identity). Row-dependent keys
+   * (`attributes`, `realmMatch`) are deliberately absent — they are what the
+   * compiled condition ranges over.
+   */
+  data?: PolicyData;
+};
+/**
+ * Outcome of compiling a permission's policy trees against the knowns bag
+ * (issue #3286 phase 3) — the query-build counterpart of `evaluate()`:
+ *
+ * - `allow` — settled true for every row; no restriction needed.
+ * - `deny` — settled false for every row; no row can pass.
+ * - `conditional` — the EXACT residual as a rapiq condition over row attributes:
+ *   push it into the row query (WHERE) and skip per-row post-evaluation.
+ * - `post` — some pending policy is not expressible as a condition; fall back to
+ *   loading rows and evaluating per row (always sound).
+ */
+type PermissionCompileResult = {
+  verdict: 'allow';
+} | {
+  verdict: 'deny';
+} | {
+  verdict: 'conditional';
+  condition: ICondition;
+} | {
+  verdict: 'post';
+};
 //#endregion
 //#region src/permission/evaluator/module.d.ts
 declare class PermissionEvaluator implements IPermissionEvaluator {
@@ -675,7 +790,18 @@ declare class PermissionEvaluator implements IPermissionEvaluator {
   evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
   preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
   preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
+  /**
+   * Compile the permission's policy trees against the knowns bag into a
+   * {@link PermissionCompileResult} — the query-build counterpart of
+   * {@link evaluate} (issue #3286 phase 3). Runs the SAME evaluation walk with
+   * `withConditions` enabled: policies that settle with the knowns settle here,
+   * pending subtrees contribute their exact condition form. Multiple names are
+   * a disjunction (any-of), so a single non-expressible name degrades the whole
+   * compilation to `post` — pushing only some disjuncts would wrongly exclude
+   * rows another name would admit.
+   */
+  compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
 //#endregion
-export { AttributeNamesPolicy, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicy, AttributesPolicyEvaluator, AttributesPolicyQuery, AttributesPolicyValidator, BasePermission, BasePolicy, BuiltInPolicies, BuiltInPolicyType, BuiltInPolicyTypeMap, CompositePolicy, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicy, DatePolicyEvaluator, DatePolicyValidator, IPermissionEvaluator, IPermissionProvider, IPolicyData, IPolicyEngine, IPolicyEvaluator, IdentityPolicy, IdentityPolicyData, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicy, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluationContext, PermissionEvaluationOptions, PermissionEvaluator, PermissionEvaluatorOptions, PermissionGetOptions, PermissionGrant, PermissionMemoryProvider, PermissionPolicyBinding, PermissionPolicyBindingAggregated, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyEvaluationContext, PolicyEvaluationContextInput, PolicyEvaluationResult, PolicyEvaluators, PolicyInput, PolicyIssue, PolicyIssueCode, PolicyIssueGroup, PolicyIssueItem, PolicyIssueSeverity, PolicyWithType, REALM_SCOPE_ORDER, RealmMatchPolicy, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicy, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, buildPermissionKey, compareRealmScope, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, realmScopeMatches };
+export { AttributeNamesPolicy, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicy, AttributesPolicyEvaluator, AttributesPolicyQuery, AttributesPolicyValidator, BasePermission, BasePolicy, BuiltInPolicies, BuiltInPolicyType, BuiltInPolicyTypeMap, CompositePolicy, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicy, DatePolicyEvaluator, DatePolicyValidator, IPermissionEvaluator, IPermissionProvider, IPolicyData, IPolicyEngine, IPolicyEvaluator, IdentityPolicy, IdentityPolicyData, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicy, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionCompileContext, PermissionCompileResult, PermissionError, PermissionEvaluationContext, PermissionEvaluationOptions, PermissionEvaluator, PermissionEvaluatorOptions, PermissionGetOptions, PermissionGrant, PermissionMemoryProvider, PermissionPolicyBinding, PermissionPolicyBindingAggregated, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyEvaluationContext, PolicyEvaluationContextInput, PolicyEvaluationResult, PolicyEvaluators, PolicyInput, PolicyIssue, PolicyIssueCode, PolicyIssueGroup, PolicyIssueItem, PolicyIssueSeverity, PolicyWithType, REALM_SCOPE_ORDER, RealmMatchPolicy, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicy, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, buildPermissionKey, compareRealmScope, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, realmScopeMatches };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/module.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/types.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts"],"mappings":";;;;;UAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAEhC,YAAY;EACZ,aAAa;EAEb,SAAU;;cAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;cAGlB,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;KC/CG;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;KAGP,+BAA+B,QAAQ;;;iBCPnC,8BACZ,QAAO,+BACP;;;KCFQ,mBAAmB,eAAe;KAElC;EACR;EACA,SAAS;;UAGI;;;;EAIb,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;KCdxE,WAAW;;;;EAInB,OAAO;;;;EAKP;;KAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;UCZF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;cC0B9D,wBAAwB;YACvB,YAAa,eAAe;cAE1B,aAAY;EAIjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EA2ErE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;aCpIjE;EACR;EACA;;aAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;KC5BQ,kBAAkB;KAClB,mBAAmB;KAEnB,cAAc,kBAAkB;;;iBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;iBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;cCJnE;cAEA,oBAAoB;cACjB,kBAAkB;EAQ9B,SAAS,MAAM;EAIf,UAAU,MAAM;SAIT,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;iBCjClB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;iBAED,yBACZ,kBACA,mBAAmB;;;UCFN,6BAA6B;EAC1C;;;;cCES,sCAAsC,UAAU;EAChD;;;;KCHD,sBAAsB,KAAK,WAAW;UAEjC,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;iBCNjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;cCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;cCAA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;;EAM1C,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YAyBxE,SACN;;;;cCtDK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;UCdrE,wBAAwB;;;;EAIrC,uBAAuB;;;;EAIvB,UAAU;;;;cCLD,iCAAiC,UAAU;EAC3C;;;;cCCA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCXtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;UCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;cCAN,4BAA4B,UAAU;EACtC;;;;cCeA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;UC1BrE,uBAAuB;;;;EAIpC;;KAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;cCvBS,oCAAoC,UAAU;EAC9C;;;;cCFA,gCAAgC,UAAU;EAC1C;;;;cCCA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAOpB,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;UChCrE,gCAAgC;;;cCCpC,yCAAyC,UAAU;EACnD;;;;cCAA,4CAA4C;YAC3C,WAAW;;EAMf,SAAS,OAAO,sBAAsB,QAAQ;;;;;;;;;;;aCJ5C;;EAER;;EAEA;;EAEA;;EAEA;;;cAIS,mBAAmB,UAAU;;;;;;;iBCb1B,oBAAoB,WAAW,yBAAyB;;;;;iBAYxD,kBACZ,OAAO,qBACP,OAAO;;iBAMK,cAAc,QAAQ,SAAS,sCAAsC;;iBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;iBAyCrE,kBACZ,UAAU,iCACV,uDACA,4CACA;;;UClFa,yBAAyB;;;;EAItC,uBAAuB;;;;;EAMvB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;cC1BF,kCAAkC,UAAU;EAC5C;;;;cCEA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQ1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;aCvB1E;EACR;EACA;EACA;EACA;;;;UCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;cC1BS,4BAA4B,UAAU;EACtC;;;;cC0CA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCtDtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;iBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;iBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;aClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;cAMS;;;;;;;;;;;KC/BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;;KAGhC,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;KAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;iBCxBQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;cCGT;;;;;;;;;;;;;;;;;;;;UCAI;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;iBAUW,iBAAiB,QAAO,cAAmB;;;cCtB9C;cAEA,wBAAwB;cACrB,UAAS;EASrB,SAAS,MAAM;EAIf,UAAU,MAAM;SAIT,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,0BAAuB;;;;iBC1CnC,kBAAkB,iBAAiB,SAAS;;;KCChD;EACR;EACA;EACA;EACA,uBAAuB;;;;;;;KAQf;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,iBAAiB;;;;;;;KAQT;;EAER,gBAAgB;;;;;;EAMhB,SAAS;;;;;;;;KASD;EACR,YAAY;EACZ,QAAQ;;;;;;;;;;;iBCJI,kCACZ,OAAO,4BACR;;;iBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;iBCgHL,eAAe,QAAQ,iBAAiB,OAAO;;;iBC7G/C,mBACZ,OAAO;;;KCNC;EACR;EACA;EACA;;UAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;cCLzC,oCAAoC;YACnC,OAAQ,eAAe;cAErB,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;UCxBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;;KAG5C;EACR,UAAU;EACV,eAAe;EACf;EACA;;KAGQ;EACR,sBAAsB;EACtB;EACA;;KAGQ;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;;;cCbD,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;cAIE,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAmH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAchD,iBAAiB,KAAK,8BAA+B"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/module.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/types.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts"],"mappings":";;;;;;UAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAEhC,YAAY;EACZ,aAAa;EAEb,SAAU;;cAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;cAGlB,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;KC/CG;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;KAGD,+BAA+B,QAAQ;;;iBCdnC,8BACZ,QAAO,+BACP;;;KCDQ,mBAAmB,eAAe;KAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;UAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;KC1DxE,WAAW;;;;EAInB,OAAO;;;;EAKP;;KAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;UCZF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;cC2B9D,wBAAwB;YACvB,YAAa,eAAe;cAE1B,aAAY;EAIjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;aC9KjE;EACR;EACA;;aAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;KC5BQ,kBAAkB;KAClB,mBAAmB;KAEnB,cAAc,kBAAkB;;;iBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;iBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;cCJnE;cAEA,oBAAoB;cACjB,kBAAkB;EAQ9B,SAAS,MAAM;EAIf,UAAU,MAAM;SAIT,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;iBCjClB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;iBAED,yBACZ,kBACA,mBAAmB;;;UCFN,6BAA6B;EAC1C;;;;cCES,sCAAsC,UAAU;EAChD;;;;KCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;UAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;iBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;cCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;cCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;cCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAOhC;EAIM,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;UCnBrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;cCLD,iCAAiC,UAAU;EAC3C;;;;cCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;UCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;cCAN,4BAA4B,UAAU;EACtC;;;;cCeA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;UC1BrE,uBAAuB;;;;EAIpC;;KAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;cCvBS,oCAAoC,UAAU;EAC9C;;;;cCFA,gCAAgC,UAAU;EAC1C;;;;cCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;UCrCrE,gCAAgC;;;cCCpC,yCAAyC,UAAU;EACnD;;;;cCCA,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;;;;;;;;aCX5C;;EAER;;EAEA;;EAEA;;EAEA;;;cAIS,mBAAmB,UAAU;;;;;;;iBCb1B,oBAAoB,WAAW,yBAAyB;;;;;iBAYxD,kBACZ,OAAO,qBACP,OAAO;;iBAMK,cAAc,QAAQ,SAAS,sCAAsC;;iBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;iBAyCrE,kBACZ,UAAU,iCACV,uDACA,4CACA;;;UClFa,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;cC1BF,kCAAkC,UAAU;EAC5C;;;;cCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;aC5I1E;EACR;EACA;EACA;EACA;;;;UCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;cC1BS,4BAA4B,UAAU;EACtC;;;;cC0CA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCtDtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;iBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;iBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;aClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;cAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;KAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;KAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;iBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;cCGT;;;;;;;;;;;;;;;;;;;;UCAI;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;iBAUW,iBAAiB,QAAO,cAAmB;;;cCtB9C;cAEA,wBAAwB;cACrB,UAAS;EASrB,SAAS,MAAM;EAIf,UAAU,MAAM;SAIT,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,0BAAuB;;;;iBC1CnC,kBAAkB,iBAAiB,SAAS;;;KCChD;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;KAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;KAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;KASD;EACR,YAAY;EACZ,QAAQ;;;;;;;;;;;iBCJI,kCACZ,OAAO,4BACR;;;iBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;iBCgHL,eAAe,QAAQ,iBAAiB,OAAO;;;iBC7G/C,mBACZ,OAAO;;;KCNC;EACR;EACA;EACA;;UAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;cCLzC,oCAAoC;YACnC,OAAQ,eAAe;cAErB,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;UCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;KAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;KAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;KAGQ;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;KAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;;;;;;KAcC;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;cCnDO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;cAIE,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EA2H7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ"}