@authup/access 1.0.0-beta.65 → 1.0.0-beta.66

package/dist/index.d.mts

@@ -3,12 +3,14 @@ import { DecisionStrategy } from "@authup/kit";
 import { ICondition } from "@rapiq/core";
 import { Issue, IssueGroup, IssueItem } from "@ebec/core";
 import { Container } from "validup";
+import { z } from "zod";
 import { MongoFiltersParser, MongoFiltersParserInput } from "@rapiq/parser-mongo";
 //#region src/policy/data.d.ts
 export interface IPolicyData {
   set(key: string, value: unknown): void;
   has(key: string): boolean;
   get<T = unknown>(key: string): T;
+  delete(key: string): void;
   isValidated(key: string): boolean;
   setValidated(key: string): void;
   clone(): IPolicyData;
@@ -20,6 +22,7 @@ export declare class PolicyData implements IPolicyData {
   set<T = unknown>(key: string, value: T): void;
   get<T = unknown>(key: string): T;
   has(key: string): boolean;
+  delete(key: string): void;
   setValidated(key: string): void;
   isValidated(key: string): boolean;
   clone(): PolicyData;
@@ -39,6 +42,15 @@ export type PolicyEvaluationContext = {
    * query-build callers opt in.
    */
   readonly withConditions: boolean;
+  /**
+   * Row column the realm reach is LOWERED onto, for a caller whose rows carry the
+   * realm under another name (a junction's `roleRealmId` / `clientRealmId` / …).
+   * Default `realmId`. It reaches `RealmMatchPolicyEvaluator` scope mode as
+   * `attributeName`, which that mode reads only while lowering — settled
+   * evaluation takes the resource realm from the `realmMatch` data key and never
+   * consults a column name, so this can never change an evaluate() outcome.
+   */
+  readonly realmAttributeName?: string;
 };
 export type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
 //#endregion
@@ -322,22 +334,6 @@ export declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
-//#region src/policy/built-in/permission-binding/types.d.ts
-export interface PermissionBindingPolicy extends BasePolicy {}
-//#endregion
-//#region src/policy/built-in/permission-binding/validator.d.ts
-export declare class PermissionBindingPolicyValidator extends Container<PermissionBindingPolicy> {
-  initialize(): void;
-}
-//#endregion
-//#region src/policy/built-in/permission-binding/module.d.ts
-export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
-  protected validator: PermissionBindingPolicyValidator;
-  constructor();
-  requires(): string[];
-  evaluate(value: Record<string, any>): Promise<PolicyEvaluationResult>;
-}
-//#endregion
 //#region src/permission/realm-scope/constants.d.ts
 /**
  * Actor-relative realm reach of a permission grant.
@@ -382,6 +378,54 @@ export declare function minRealmScope(values: Array<`${RealmScope}` | null | und
  */
 export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | string[] | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
 //#endregion
+//#region src/permission/types.d.ts
+export type BasePermission = {
+  name: string;
+  clientId?: string | null;
+  realmId?: string | null;
+  decisionStrategy?: `${DecisionStrategy}` | null;
+};
+/**
+ * A raw permission grant: one permission with its policies and realm reach, as loaded from a
+ * role/identity junction. `aggregatePermissionPolicyBindings` groups these per permission into
+ * a `PermissionPolicyBindingAggregated` (the lossless disjunction of grants).
+ */
+export type PermissionPolicyBinding = {
+  permission: BasePermission;
+  policies?: BasePolicy[];
+  /**
+   * Relative realm reach of this grant (none/own/ownOrNull/any). Absent coerces to the
+   * most restrictive `own` (fail-closed). NOT part of the binding identity key
+   * (see isPermissionPolicyBindingEqual).
+   */
+  realmScope?: `${RealmScope}`;
+};
+/**
+ * One disjunction term of an aggregated binding: a single grant's realm reach paired with its
+ * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realmScope) ∧ policy`
+ * across the grants of a permission.
+ */
+export type PermissionGrant = {
+  /** Relative realm reach (none/own/ownOrNull/any), normalized — fail-closed default `own`. */
+  realmScope: `${RealmScope}`;
+  /**
+   * The grant's policy: the raw junction policy (its `id` preserved, for propagation) for a
+   * single-policy grant, a composite for a multi-policy (Layer-1) binding, or `undefined`
+   * when the grant carries no restriction.
+   */
+  policy?: BasePolicy;
+};
+/**
+ * A permission together with the actor's disjunction of grants for it. Output of
+ * `aggregatePermissionPolicyBindings` — the honest, lossless replacement for the collapsed
+ * `PermissionPolicyBinding` (no top-level realmScope/policies; the access decision is the
+ * OR over `grants`).
+ */
+export type PermissionPolicyBindingAggregated = {
+  permission: BasePermission;
+  grants: PermissionGrant[];
+};
+//#endregion
 //#region src/policy/built-in/realm-match/types.d.ts
 export interface RealmMatchPolicy extends BasePolicy {
   /**
@@ -438,6 +482,37 @@ export declare class RealmMatchPolicyEvaluator implements IPolicyEvaluator {
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
+//#region src/policy/built-in/permission-binding/types.d.ts
+export interface PermissionBindingPolicy extends BasePolicy {}
+//#endregion
+//#region src/policy/built-in/permission-binding/validator.d.ts
+export declare class PermissionBindingPolicyValidator extends Container<PermissionBindingPolicy> {
+  initialize(): void;
+}
+//#endregion
+//#region src/policy/built-in/permission-binding/identity-evaluator.d.ts
+type IdentityPermissionProvider = {
+  getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+};
+export declare class IdentityPermissionBindingPolicyEvaluator implements IPolicyEvaluator {
+  protected validator: PermissionBindingPolicyValidator;
+  protected identityEvaluator: IdentityPolicyEvaluator;
+  protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
+  protected identityPermissionProvider: IdentityPermissionProvider;
+  constructor(identityPermissionProvider: IdentityPermissionProvider);
+  requires(): string[];
+  accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
+  evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
+}
+//#endregion
+//#region src/policy/built-in/permission-binding/module.d.ts
+export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
+  protected validator: PermissionBindingPolicyValidator;
+  constructor();
+  requires(): string[];
+  evaluate(value: Record<string, any>): Promise<PolicyEvaluationResult>;
+}
+//#endregion
 //#region src/policy/built-in/time/constants.d.ts
 export declare enum TimePolicyInterval {
   DAILY = "daily",
@@ -603,54 +678,6 @@ export declare class PermissionError extends AuthupError {
 //#region src/permission/error/check.d.ts
 export declare function isPermissionError(input: unknown): input is PermissionError;
 //#endregion
-//#region src/permission/types.d.ts
-export type BasePermission = {
-  name: string;
-  clientId?: string | null;
-  realmId?: string | null;
-  decisionStrategy?: `${DecisionStrategy}` | null;
-};
-/**
- * A raw permission grant: one permission with its policies and realm reach, as loaded from a
- * role/identity junction. `aggregatePermissionPolicyBindings` groups these per permission into
- * a `PermissionPolicyBindingAggregated` (the lossless disjunction of grants).
- */
-export type PermissionPolicyBinding = {
-  permission: BasePermission;
-  policies?: BasePolicy[];
-  /**
-   * Relative realm reach of this grant (none/own/ownOrNull/any). Absent coerces to the
-   * most restrictive `own` (fail-closed). NOT part of the binding identity key
-   * (see isPermissionPolicyBindingEqual).
-   */
-  realmScope?: `${RealmScope}`;
-};
-/**
- * One disjunction term of an aggregated binding: a single grant's realm reach paired with its
- * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realmScope) ∧ policy`
- * across the grants of a permission.
- */
-export type PermissionGrant = {
-  /** Relative realm reach (none/own/ownOrNull/any), normalized — fail-closed default `own`. */
-  realmScope: `${RealmScope}`;
-  /**
-   * The grant's policy: the raw junction policy (its `id` preserved, for propagation) for a
-   * single-policy grant, a composite for a multi-policy (Layer-1) binding, or `undefined`
-   * when the grant carries no restriction.
-   */
-  policy?: BasePolicy;
-};
-/**
- * A permission together with the actor's disjunction of grants for it. Output of
- * `aggregatePermissionPolicyBindings` — the honest, lossless replacement for the collapsed
- * `PermissionPolicyBinding` (no top-level realmScope/policies; the access decision is the
- * OR over `grants`).
- */
-export type PermissionPolicyBindingAggregated = {
-  permission: BasePermission;
-  grants: PermissionGrant[];
-};
-//#endregion
 //#region src/permission/helpers/aggregate.d.ts
 /**
  * Group raw permission-policy bindings by permission key into the actor's disjunction of
@@ -748,6 +775,14 @@ export type PermissionCompileContext = {
    * compiled condition ranges over.
    */
   data?: PolicyData;
+  /**
+   * Row column the realm reach is lowered onto, when the rows this compilation
+   * ranges over carry their realm under another name — a junction's owner-realm
+   * key (`roleRealmId`, `clientRealmId`, …). Default `realmId`. Affects the
+   * `conditional` condition only; the per-row `post` fallback still reads the
+   * realm from the `realmMatch` data key its caller supplies.
+   */
+  realmAttributeName?: string;
 };
 /**
  * Outcome of compiling a permission's policy trees against the knowns bag
@@ -799,4 +834,381 @@ export declare class PermissionEvaluator implements IPermissionEvaluator {
   compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
 //#endregion
+//#region src/permission/authorization/error.d.ts
+export declare const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE: unique symbol;
+/**
+ * A grant references a definition or a policy the supplied catalog does not
+ * carry: the caller's cached catalog predates the definition or the junction
+ * row and must be refetched. A definition the catalog carries with
+ * `policies: null`, and one whose tree this copy cannot project, are not
+ * stale but unevaluable, and a grant of either is dropped.
+ *
+ * Recognize it with `isAuthorizationCatalogStaleError`, never `instanceof`:
+ * this package is a plain caret dependency of several workspaces, so a
+ * consumer tree may resolve two copies of it and turn the one recoverable
+ * state into an unrecoverable one.
+ */
+export declare class AuthorizationCatalogStaleError extends AuthupError {
+  constructor(message: string);
+}
+//#endregion
+//#region src/permission/authorization/check.d.ts
+/**
+ * Marker-only: the error carries no code of its own, and it never crosses a
+ * wire boundary, so there is no shape to fall back to.
+ */
+export declare function isAuthorizationCatalogStaleError(input: unknown): input is AuthorizationCatalogStaleError;
+//#endregion
+//#region src/permission/authorization/types.d.ts
+/**
+ * One policy tree node as it travels: the type's configuration keys (the output
+ * of that type's validator), `invert`, and for a composite its children inline.
+ */
+export type AuthorizationPolicy = {
+  type: string;
+  invert?: boolean | null;
+  children?: AuthorizationPolicy[];
+  [key: string]: unknown;
+};
+export type AuthorizationDefinition = {
+  name: string;
+  realm_id: string | null;
+  client_id: string | null;
+  decision_strategy: `${DecisionStrategy}` | null;
+  /**
+   * The definition layer: the ids of the policy trees bound to the permission
+   * definition (`auth_permission_policies`). Empty means unrestricted at this
+   * layer. `null` means the server could not project one of those trees onto
+   * the wire (a policy type the catalog does not carry, or a configuration
+   * its validator refuses): the definition exists, a consumer cannot evaluate
+   * it and denies it, dropping every grant of it, until the policy is fixed.
+   */
+  policies: string[] | null;
+};
+/**
+ * Identity-free and cacheable: every permission definition with its policy trees.
+ */
+export type AuthorizationCatalog = {
+  /**
+   * Every policy tree a definition or a grant can name, keyed by the tree's
+   * own id and present exactly once however many of them reference it.
+   */
+  policies: Record<string, AuthorizationPolicy>;
+  permissions: AuthorizationDefinition[];
+};
+/**
+ * One raw grant of an identity as the introspection endpoints report it: the
+ * permission namespace it names, its realm reach and the junction policy ids.
+ * Structurally the extended `OAuth2TokenPermission` of `@authup/specs` (this
+ * package does not depend on specs).
+ */
+export type AuthorizationGrant = {
+  name: string;
+  realm_id?: string | null;
+  client_id?: string | null;
+  /**
+   * Absent or null coerces to `own`, fail-closed.
+   */
+  realm_scope?: `${RealmScope}` | null;
+  /**
+   * Absent or null means no junction policy.
+   */
+  policies?: string[] | null;
+};
+export type AuthorizationEvaluatorInput = {
+  /**
+   * An `AuthorizationCatalog`, validated by the schema.
+   */
+  catalog: unknown;
+  /**
+   * `AuthorizationGrant[]`, validated by the schema. Defaults to none, and
+   * may only be supplied together with the identity holding them.
+   */
+  grants?: unknown;
+  /**
+   * The identity the grants belong to. Omitted for an anonymous caller:
+   * no identity data is injected and no grant is bound, so only a
+   * definition whose policies need no identity can pass.
+   */
+  identity?: IdentityPolicyData;
+};
+/**
+ * Which resource realms a batch check evaluates against.
+ *
+ * A string is SYMBOLIC and resolved server-side against the caller's own
+ * identity: `own` is the realm the identity belongs to, `ownOrNull` is that
+ * realm plus `null`, the global rows every realm shares. An array is taken
+ * VERBATIM: the server resolves no realm key, so it discloses no realm's
+ * existence and the caller matches the answer against its own input with no
+ * resolution step of its own.
+ *
+ * String versus array is what discriminates the two forms, so `own` stays
+ * unambiguous even though it is a legal realm name.
+ */
+export type AuthorizationCheckRealms = `${RealmScope.OWN}` | `${RealmScope.OWN_OR_NULL}` | Array<string | null>;
+/**
+ * One permission the identity may attempt, and the requested realms it may
+ * attempt it in. Never empty: a permission reaching no requested realm is
+ * absent from the answer entirely, so absent means denied.
+ */
+export type AuthorizationCheckPermission = {
+  name: string;
+  realms: Array<string | null>;
+};
+/**
+ * The answer `POST /authorization/check` serves: the caller's own verdicts,
+ * paired with the realms they hold in.
+ *
+ * It is an upper bound on what may be ATTEMPTED rather than an entitlement,
+ * the same posture the catalog and `GET /schemas` take: it is a pre-gate, so a
+ * grant whose junction policy needs a resource row passes here and is still
+ * decided per row on the server, which stays the enforcement point.
+ */
+export type AuthorizationCheckPermissions = AuthorizationCheckPermission[];
+export type AuthorizationCheckEvaluatorInput = {
+  /**
+   * An `AuthorizationCheckPermissions`, validated by the schema.
+   */
+  permissions: unknown;
+  /**
+   * The identity the verdicts belong to, used to resolve a `realmMatch` of
+   * `own` shape: a resource realm equal to this identity's realm id or name
+   * is the identity's own realm. Omitted for an anonymous caller, which
+   * holds no verdict at all.
+   */
+  identity?: IdentityPolicyData;
+};
+//#endregion
+//#region src/permission/authorization/check-schema.d.ts
+/**
+ * The whole input `createAuthorizationCheckEvaluator` takes: the answer
+ * `POST /authorization/check` served and the identity it belongs to. Same
+ * validup-over-zod shape as the catalog's input, so a consumer can override
+ * one member's rules instead of restating the answer.
+ */
+export declare class AuthorizationCheckEvaluatorInputValidator extends Container<AuthorizationCheckEvaluatorInput> {
+  initialize(): void;
+}
+export type AuthorizationCheckEvaluatorInputParsed = {
+  permissions: AuthorizationCheckPermissions;
+  identity: AuthorizationCheckEvaluatorInput['identity'];
+};
+/**
+ * Validate the check evaluator's input, plus the one rule a per-key validator
+ * cannot express: a permission namespace appears at most once. Two entries for
+ * one name would make the answer depend on which the consumer looked up first,
+ * and the server emits one entry per name by construction.
+ */
+export declare function parseAuthorizationCheckEvaluatorInput(input: AuthorizationCheckEvaluatorInput): Promise<AuthorizationCheckEvaluatorInputParsed>;
+//#endregion
+//#region src/permission/authorization/constants.d.ts
+/**
+ * The node a policy tree travels as when the server withholds it, because the
+ * caller's realm reach does not cover the row it was read from.
+ *
+ * It is deliberately a type no consumer can project: `projectAuthorizationPolicy`
+ * refuses it, which is already the state a definition referencing it denies
+ * through and a grant naming it is dropped through, so withholding a body needs
+ * no rule of its own on the consumer side. That is a contract between the two
+ * halves rather than a server detail, which is why it is declared HERE, next to
+ * the projection that has to keep refusing it, and pinned by this package's own
+ * test.
+ */
+export declare const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
+//#endregion
+//#region src/permission/authorization/module.d.ts
+/**
+ * Build a resource-server (or console) evaluator from the catalog
+ * `GET /authorization` serves, the identity's grants as the introspection
+ * endpoints report them, and the identity itself. Rejects legacy, incomplete
+ * and unsupported input. A grant referencing a definition or a policy the
+ * catalog lacks throws `AuthorizationCatalogStaleError`, the signal to
+ * refetch the catalog: the grants come from a fresh introspection while the
+ * catalog may predate the definition or the junction row. A definition the
+ * server could not project travels with `policies: null` instead of being
+ * left out, so a grant of it is dropped rather than reported stale: the
+ * definition layer cannot be evaluated here, a refetch changes nothing, and
+ * the permission denies until the policy is fixed.
+ *
+ * A tree THIS copy cannot project is the same condition read from the other
+ * side, and it is per tree: a policy type newer than this package (the
+ * built-in type enum is closed while the column is a free string) or a
+ * configuration its validator refuses denies the definitions that reference
+ * it, exactly as `policies: null` does, and drops a grant that names it,
+ * exactly as a binding check does. One such tree never takes the evaluator
+ * down for the permissions that do not use it. A malformed catalog still
+ * throws: a duplicate permission namespace is not a data condition.
+ *
+ * Both the identity and the grants are optional. Without an identity no grant
+ * is bound and any IDENTITY key the caller supplied is REMOVED, so the
+ * binding evaluator answers with missing data exactly as the server does for
+ * an anonymous request, only a definition whose policies need no identity can
+ * pass, and a caller can never inject an identity the document did not prove.
+ * Grants without the identity they belong to are refused.
+ *
+ * The REALM_MATCH data key follows the server's own three-way rule: a
+ * resource that carries a realm passes it (null for a global row, which
+ * `own` denies), a resource with no realm dimension passes nothing and reach
+ * neutral-passes. `preEvaluate` / `preEvaluateOneOf` are the pre-gate and
+ * enforce reach only when that key is present. `compile` returns the
+ * allow/deny/conditional/post contract; a `post` collection query must be
+ * rejected or evaluated over every candidate before paging. The supplied
+ * identity is authoritative; `options.decisionStrategy` is forwarded and the
+ * policy include, exclude and pending options are refused.
+ */
+export declare function createAuthorizationEvaluator(input: AuthorizationEvaluatorInput): Promise<IPermissionEvaluator>;
+/**
+ * An `IPermissionEvaluator` over the answer `POST /authorization/check`
+ * served: the caller's own verdicts, paired with the realms they hold in.
+ *
+ * It is what a PUBLIC client gets where the catalog is out of reach. A public
+ * client holds no secret, so it can obtain no `client_credentials` token and
+ * has no credential of its own for the catalog's gate to be satisfied by;
+ * publishing every policy predicate to it instead would be the wrong trade.
+ * The verdicts are computed by the server from the same grants and the same
+ * evaluators a request runs, so this is authoritative where the name-only
+ * fallback it replaces is merely coarse.
+ *
+ * Two properties follow from the answer being a pre-gate:
+ *
+ * It is an UPPER BOUND, so `evaluate` and `evaluateOneOf` answer exactly what
+ * the pre-gate pair answers. A check that depends on a resource row belongs to
+ * whoever holds the row, and the server decides it there; answering such a
+ * check here would mean inventing a verdict. That is the same bound the
+ * name-only fallback already had, so nothing that gates on it loosens.
+ *
+ * And a resource realm is matched against what the REQUEST asked about: a
+ * `realmMatch` naming a realm the request never carried is in no entry's list
+ * and therefore denies. That is fail-closed by construction rather than by a
+ * rule, and it is why a caller must ask about the realms its UI will ask
+ * about.
+ */
+export declare function createAuthorizationCheckEvaluator(input: AuthorizationCheckEvaluatorInput): Promise<IPermissionEvaluator>;
+//#endregion
+//#region src/permission/authorization/policy.d.ts
+/**
+ * The one definition of what a policy looks like on the wire, used by the server
+ * to build a document and by the consumer to validate one. A node is the OUTPUT
+ * of its type's validator (validup strips every unmounted key, so entity columns
+ * such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
+ * and, for a composite, its projected children.
+ *
+ * Every refusal is a `ValidupError`, the node's head and the type's own
+ * validator alike, and a child's issues are rebased onto the position it sits
+ * at, so one message names the node in the tree that is wrong.
+ */
+export declare function projectAuthorizationPolicy(input: unknown): Promise<AuthorizationPolicy>;
+/**
+ * Whether a projected tree evaluates the permission binding at any depth. A
+ * grant policy carrying one would re-enter its own permission's grants, so
+ * `createAuthorizationEvaluator` drops the grant that names it and evaluates
+ * the permission from the rest. Its one caller is that consumer: the tree is
+ * legal in a definition, where the binding check is what reach is enforced
+ * by, so the producer carries it and only the grant side is refused.
+ */
+export declare function containsBindingCheck(policy: AuthorizationPolicy): boolean;
+//#endregion
+//#region src/permission/authorization/schema.d.ts
+/**
+ * A policy node as it travels. Deliberately LOOSE: every key beyond `type` is
+ * that type's own configuration, and `projectAuthorizationPolicy` is what
+ * validates it, by running the type's own validator. Mounting a node in a
+ * validup container would strip every key the container does not mount, and
+ * the whole configuration would go with it.
+ */
+export declare const authorizationPolicySchema: z.ZodObject<{
+  type: z.ZodString;
+}, z.core.$loose>;
+/**
+ * One permission definition. `policies` carries the ids of its
+ * definition-layer trees, or `null` when the server could not project one.
+ */
+export declare const authorizationDefinitionSchema: z.ZodObject<{
+  name: z.ZodString;
+  realm_id: z.ZodNullable<z.ZodString>;
+  client_id: z.ZodNullable<z.ZodString>;
+  decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
+  policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authorizationCatalogSchema: z.ZodObject<{
+  policies: z.ZodRecord<z.ZodString, z.ZodObject<{
+    type: z.ZodString;
+  }, z.core.$loose>>;
+  permissions: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    realm_id: z.ZodNullable<z.ZodString>;
+    client_id: z.ZodNullable<z.ZodString>;
+    decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
+    policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * One grant of the identity, as the introspection endpoints report it.
+ * Whether a grant's policy ids are declared is checked against the catalog
+ * the consumer holds, since the two travel separately.
+ */
+export declare const authorizationGrantSchema: z.ZodObject<{
+  name: z.ZodString;
+  realm_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  client_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  realm_scope: z.ZodOptional<z.ZodNullable<z.ZodEnum<typeof RealmScope>>>;
+  policies: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$strip>;
+export declare const authorizationIdentitySchema: z.ZodObject<{
+  id: z.ZodString;
+  type: z.ZodEnum<{
+    user: "user";
+    client: "client";
+  }>;
+  realmId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  realmName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  clientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * The whole input `createAuthorizationEvaluator` takes: the catalog
+ * `GET /authorization` serves, the grants an introspection reports and the
+ * identity it names. A validup container over zod mounts, the shape every
+ * validator in this package uses, so a consumer can reuse or override one
+ * member's rules instead of restating the document.
+ */
+export declare class AuthorizationEvaluatorInputValidator extends Container<AuthorizationEvaluatorInput> {
+  initialize(): void;
+}
+export type AuthorizationEvaluatorInputParsed = {
+  catalog: AuthorizationCatalog;
+  grants: AuthorizationGrant[];
+  identity: AuthorizationEvaluatorInput['identity'];
+};
+/**
+ * Validate the evaluator's input, plus the two rules per-key validators
+ * cannot express.
+ *
+ * Every id a definition names must be a key of `policies`: a dangling id
+ * resolves to `undefined`, which reads as "this layer carries no policy", so
+ * a catalog that merely omitted a tree would grant unrestricted access rather
+ * than fail. The lookup is own-property only, so an id such as `constructor`
+ * cannot be answered by a member of `Object.prototype`.
+ *
+ * And the identity and its grants travel together: grants without an identity
+ * belong to nobody, while an identity without a grant list is the shape an
+ * INACTIVE introspection produces (`permissions` is absent unless the
+ * credential is active), which read as "holds nothing" would authorize every
+ * definition that carries no binding check. An identity holding no grant says
+ * so with an empty array.
+ */
+export declare function parseAuthorizationEvaluatorInput(input: AuthorizationEvaluatorInput): Promise<AuthorizationEvaluatorInputParsed>;
+/**
+ * One verdict: the permission namespace and the requested realms it holds in.
+ * A realm value is a realm key the caller itself supplied, or `null` for the
+ * global rows, so nothing here is resolved or looked up.
+ */
+export declare const authorizationCheckPermissionSchema: z.ZodObject<{
+  name: z.ZodString;
+  realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authorizationCheckPermissionsSchema: z.ZodArray<z.ZodObject<{
+  name: z.ZodString;
+  realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>>;
+//#endregion
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/module.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/types.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts"],"mappings":";;;;;;;iBAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAEhC,YAAY;EACZ,aAAa;EAEb,SAAU;;qBAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;EAGlB,YAAA,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;YC/CG;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;YAGD,+BAA+B,QAAQ;;;wBCdnC,8BACZ,QAAO,+BACP;;;YCDQ,mBAAmB,eAAe;YAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;iBAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;YC1DxE,WAAW;;;;EAInB,OAAO;;;;EAKP;;YAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;iBCZF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;qBC2B9D,wBAAwB;YACvB,YAAa,eAAe;EAE1B,YAAA,aAAY;EAWjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;oBCrLjE;EACR;EACA;;oBAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;YC5BQ,kBAAkB;YAClB,mBAAmB;YAEnB,cAAc,kBAAkB;;;wBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;wBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;qBCJnE;qBAEA,oBAAoB;EACjB,YAAA,kBAAkB,sBAAsB,SAAS;SAStD,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;wBC1BlB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;wBAED,yBACZ,kBACA,mBAAmB;;;iBCFN,6BAA6B;EAC1C;;;;qBCES,sCAAsC,UAAU;EAChD;;;;YCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;iBAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;wBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;qBCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;qBCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;qBCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCfrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;qBCLD,iCAAiC,UAAU;EAC3C;;;;qBCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;iBCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;qBCAN,4BAA4B,UAAU;EACtC;;;;qBCeA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1BrE,uBAAuB;;;;EAIpC;;YAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;cCvBS,oCAAoC,UAAU;EAC9C;;;;qBCFA,gCAAgC,UAAU;EAC1C;;;;qBCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCrCrE,gCAAgC;;;qBCCpC,yCAAyC,UAAU;EACnD;;;;qBCCA,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;;;;;;;;oBCX5C;;EAER;;EAEA;;EAEA;;EAEA;;;qBAIS,mBAAmB,UAAU;;;;;;;wBCb1B,oBAAoB,WAAW,yBAAyB;;;;;wBAYxD,kBACZ,OAAO,qBACP,OAAO;;wBAMK,cAAc,QAAQ,SAAS,sCAAsC;;wBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;wBAyCrE,kBACZ,UAAU,iCACV,uDACA,4CACA;;;iBClFa,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;qBC1BF,kCAAkC,UAAU;EAC5C;;;;qBCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;oBC5I1E;EACR;EACA;EACA;EACA;;;;iBCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;qBC1BS,4BAA4B,UAAU;EACtC;;;;qBC0CA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCtDtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;wBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;wBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;oBClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;qBAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;YAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;YAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;wBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;qBCGT;;;;;;;;;;;;;;;;;;;;iBCAI;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;wBAUW,iBAAiB,QAAO,cAAmB;;;qBCtB9C;qBAEA,wBAAwB;EACrB,YAAA,UAAS;SASd,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,yBAAyB,SAAS,gBAAa;;;;wBClC3D,kBAAkB,iBAAiB,SAAS;;;YCChD;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;YAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;YAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;YASD;EACR,YAAY;EACZ,QAAQ;;;;;;;;;;;wBCJI,kCACZ,OAAO,4BACR;;;wBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;wBC+GL,eAAe,QAAQ,iBAAiB,OAAO;;;wBC5G/C,mBACZ,OAAO;;;YCNC;EACR;EACA;EACA;;iBAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;qBCLzC,oCAAoC;YACnC,OAAQ,eAAe;EAErB,YAAA,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;iBCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;YAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;YAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;YAGQ;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;YAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;;;;;;YAcC;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;qBCnDO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;EAIE,YAAA,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAqH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/permission/types.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/identity-evaluator.ts","../src/policy/built-in/permission-binding/module.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts","../src/permission/authorization/error.ts","../src/permission/authorization/check.ts","../src/permission/authorization/types.ts","../src/permission/authorization/check-schema.ts","../src/permission/authorization/constants.ts","../src/permission/authorization/module.ts","../src/permission/authorization/policy.ts","../src/permission/authorization/schema.ts"],"mappings":";;;;;;;;iBAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAChC,OAAO;EAEP,YAAY;EACZ,aAAa;EAEb,SAAU;;qBAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;EAGlB,YAAA,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,OAAO;EAKP,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;YCrDG;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;;;;;;;;WASA;;YAGD,+BAA+B,QAAQ;;;wBCvBnC,8BACZ,QAAO,+BACP;;;YCDQ,mBAAmB,eAAe;YAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;iBAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;YC1DxE,WAAW;;;;EAInB,OAAO;;;;EAKP;;YAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;iBCZF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;qBC2B9D,wBAAwB;YACvB,YAAa,eAAe;EAE1B,YAAA,aAAY;EAWjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;oBCrLjE;EACR;EACA;;oBAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;YC5BQ,kBAAkB;YAClB,mBAAmB;YAEnB,cAAc,kBAAkB;;;wBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;wBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;qBCJnE;qBAEA,oBAAoB;EACjB,YAAA,kBAAkB,sBAAsB,SAAS;SAStD,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;wBC1BlB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;wBAED,yBACZ,kBACA,mBAAmB;;;iBCFN,6BAA6B;EAC1C;;;;qBCES,sCAAsC,UAAU;EAChD;;;;YCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;iBAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;wBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;qBCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;qBCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;qBCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCfrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;qBCLD,iCAAiC,UAAU;EAC3C;;;;qBCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;iBCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;qBCAN,4BAA4B,UAAU;EACtC;;;;qBCeA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1BrE,uBAAuB;;;;EAIpC;;YAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;cCvBS,oCAAoC,UAAU;EAC9C;;;;qBCFA,gCAAgC,UAAU;EAC1C;;;;qBCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;;;;;;;;oBChC1E;;EAER;;EAEA;;EAEA;;EAEA;;;qBAIS,mBAAmB,UAAU;;;;;;;wBCb1B,oBAAoB,WAAW,yBAAyB;;;;;wBAYxD,kBACZ,OAAO,qBACP,OAAO;;wBAMK,cAAc,QAAQ,SAAS,sCAAsC;;wBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;wBAyCrE,kBACZ,UAAU,iCACV,uDACA,4CACA;;;YClFQ;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;YAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;YAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;YASD;EACR,YAAY;EACZ,QAAQ;;;;iBC/CK,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;qBC1BF,kCAAkC,UAAU;EAC5C;;;;qBCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1IrE,gCAAgC;;;qBCGpC,yCAAyC,UAAU;EACnD;;;;KCUR;EACD,OAAO,UAAU,qBAAqB,QAAQ;;qBAGrC,oDAAoD;YACnD,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;YAEtB,4BAA4B;EAE1B,YAAA,4BAA4B;EAOxC;EAQM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;qBCxDzE,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;oBClB5C;EACR;EACA;EACA;EACA;;;;iBCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;qBC1BS,4BAA4B,UAAU;EACtC;;;;qBC0CA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCtDtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;wBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;wBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;oBClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;qBAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;YAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;YAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;wBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;qBCGT;;;;;;;;;;;;;;;;;;;;iBCAI;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;wBAUW,iBAAiB,QAAO,cAAmB;;;qBCtB9C;qBAEA,wBAAwB;EACrB,YAAA,UAAS;SASd,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,yBAAyB,SAAS,gBAAa;;;;wBClC3D,kBAAkB,iBAAiB,SAAS;;;;;;;;;;wBC4C5C,kCACZ,OAAO,4BACR;;;wBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;wBC+GL,eAAe,QAAQ,iBAAiB,OAAO;;;wBC5G/C,mBACZ,OAAO;;;YCNC;EACR;EACA;EACA;;iBAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;qBCLzC,oCAAoC;YACnC,OAAQ,eAAe;EAErB,YAAA,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;iBCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;YAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;YAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;YAGQ;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;YAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;EAQP;;;;;;;;;;;;;YAcQ;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;qBC3DO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;EAIE,YAAA,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAqH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ;;;;qBCzO9C;;;;;;;;;;;;;qBAcA,uCAAuC;EACpC,YAAA;;;;;;;;wBCTA,iCAAiC,iBAAkB,SAAS;;;;;;;YCAhE;EACR;EACA;EACA,WAAW;GACV;;YAGO;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;;;EAStB;;;;;YAMQ;;;;;EAKR,UAAU,eAAe;EACzB,aAAa;;;;;;;;YASL;EACR;EACA;EACA;;;;EAIA,iBAAiB;;;;EAIjB;;YAGQ;;;;EAIR;;;;;EAKA;;;;;;EAMA,WAAW;;;;;;;;;;;;;;;YAgBH,8BAA8B,WAAW,WAClD,WAAW,gBACd;;;;;;YAOY;EACR;EACA,QAAQ;;;;;;;;;;;YAYA,gCAAgC;YAEhC;;;;EAIR;;;;;;;EAOA,WAAW;;;;;;;;;;qBCtHF,kDAAkD,UAAU;EAC5D;;YAUD;EACR,aAAa;EACb,UAAU;;;;;;;;wBASQ,sCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;qBCxBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC4FS,6BAA6B,OAAO,8BAA+B,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4N3E,kCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;wBC1QU,2BAA2B,iBAAkB,QAAQ;;;;;;;;;wBAiD3D,qBAAqB,QAAQ;;;;;;;;;;qBCvFhC,2BAAyB,EAAA;;GAA6C,EAAA,KAAA;;;;;qBAMtE,+BAA6B,EAAA;;;;;;GAMxC,EAAA,KAAA;qBAEW,4BAA0B,EAAA;;;;;;;;;;;GAGrC,EAAA,KAAA;;;;;;qBAOW,0BAAwB,EAAA;;;;;;GAMnC,EAAA,KAAA;qBAEW,6BAA2B,EAAA;;;;;;;;;GAMtC,EAAA,KAAA;;;;;;;;qBASW,6CAA6C,UAAU;EACvD;;YAWD;EACR,SAAS;EACT,QAAQ;EACR,UAAU;;;;;;;;;;;;;;;;;;;wBAoBQ,iCAClB,OAAO,8BACP,QAAQ;;;;;;qBA4DC,oCAAkC,EAAA;;;GAG7C,EAAA,KAAA;qBAEW,qCAAmC,EAAA,SAAA,EAAA;;;GAA8C,EAAA,KAAA"}