@awsmbiz/inbis-access-control 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,170 @@
-# Temporary Holding Version
+# @awsmbiz/inbis-access-control
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Business permissions for Inbis applications: a typed permission catalogue and system roles
+declared in code, roles and assignments in D1, `authorize()` and a `requirePermission()` Hono
+middleware, and package-owned D1 migrations (ADR-4).
+
+It is separate from the platform administrator role (`user.role = "admin"` in `@awsmbiz/inbis-auth`,
+plan Q12): a platform admin gets **no** business permission implicitly (Q41).
+
+## Public API
+
+| Entry | Contents |
+|---|---|
+| `@awsmbiz/inbis-access-control` | `defineAccessControl`, `createAccessControl`, `ACCESS_CONTROL_AUDIT_ACTIONS`, `ACCESS_CONTROL_MIGRATIONS_TABLE`; types `AccessControl`, `AccessControlDefinition`, `AccessControlInput`, `AccessControlOptions`, `AuthorizeInput`, `RoleAssignmentInput`, `RoleDeclaration`, `PermissionDefinition`, `SystemRoleDefinition`, `SeedResult`, `Role`, `RoleFields`, `CreateRoleInput`, `UpdateRoleInput`, `DeleteRoleInput`, `UserRole` |
+| `@awsmbiz/inbis-access-control/hono` | `honoAccessControl` (→ `requirePermission`, `accessControlOf`), `mountRoleAdmin`; types `AccessControlResolver`, `AccessControlVariables`, `HonoAccessControl`, `HonoAccessControlOptions`, `MountRoleAdminOptions`, `RoleResponse`, `UserRoleResponse` |
+| `migrations/` | Numbered, frozen SQL plus `migrations.lock.json`, shipped in the tarball |
+
+Optional peer dependency: `hono` ^4.13.14 (for `/hono`).
+
+## Setting it up
+
+1. Declare an access-control binding to the app's database, after auth's (`user_role`
+   references auth's `user` table) and before audit's, with the same `database_id`:
+
+   ```jsonc
+   "d1_databases": [
+     { "binding": "AUTH_DB", "database_name": "myapp-dev", "database_id": "<id>",
+       "migrations_dir": "node_modules/@awsmbiz/inbis-auth/migrations", "migrations_table": "_inbis_auth_migrations" },
+     { "binding": "ACCESS_CONTROL_DB", "database_name": "myapp-dev", "database_id": "<id>",
+       "migrations_dir": "node_modules/@awsmbiz/inbis-access-control/migrations", "migrations_table": "_inbis_access_control_migrations" },
+     { "binding": "AUDIT_DB", ... },
+     { "binding": "DB", ... }
+   ]
+   ```
+
+2. Declare the catalogue once, in code:
+
+   ```ts
+   import { defineAccessControl } from "@awsmbiz/inbis-access-control";
+
+   export const access = defineAccessControl({
+     permissions: { "notes.read": "Read notes", "notes.write": "Create and edit notes" },
+     roles: {
+       reader: { name: "Reader", permissions: ["notes.read"] },
+       editor: { name: "Editor", permissions: ["notes.write"], inherits: ["reader"] },
+     },
+   });
+   ```
+
+   Permission names are dotted lowercase (`notes.read`) and typed: a role granting an
+   undeclared permission, inheriting an undeclared role, or a call to
+   `authorize({ permission: "notes.reed" })` is a compile error. At runtime
+   `defineAccessControl` also throws on malformed names, duplicate role names and inheritance
+   cycles.
+
+3. Protect routes (build the helpers once per isolate, the instance per request):
+
+   ```ts
+   import { createAccessControl } from "@awsmbiz/inbis-access-control";
+   import { honoAccessControl } from "@awsmbiz/inbis-access-control/hono";
+
+   const { requirePermission, accessControlOf } = honoAccessControl((c) =>
+     createAccessControl(requireBinding(c.env, "ACCESS_CONTROL_DB"), access, {
+       audit, // e.g. @awsmbiz/inbis-audit's sink
+       requestId: c.var.requestId,
+       logger: c.var.logger,
+     }),
+   );
+
+   app.get("/v1/notes", requireAuth(), requirePermission("notes.read"), handler);
+   // Or in code: await (await accessControlOf(c)).authorize({ userId, permission: "notes.write" })
+   ```
+
+   `requirePermission` reads the user from `c.var.user` (`@awsmbiz/inbis-auth/hono`'s
+   `sessionMiddleware`; pass `{ userId: (c) => ... }` otherwise). Signed out: `401
+   UNAUTHENTICATED`; not allowed: `403 FORBIDDEN` with `details.permission`. Both are
+   `AppError`s that `@awsmbiz/inbis-api` renders as the standard error envelope. Put it after
+   `requireAuth()`, which applies the session policy.
+
+4. Mount the role admin API behind the platform admin policy (changes also need a recent
+   sign-in):
+
+   ```ts
+   import { requireAdmin, requireRecentAdminSignIn } from "@awsmbiz/inbis-auth/hono";
+   import { mountRoleAdmin } from "@awsmbiz/inbis-access-control/hono";
+
+   mountRoleAdmin(app, { accessControl: accessControlOf, guard: requireAdmin(), changeGuard: requireRecentAdminSignIn() });
+   ```
+
+5. Register the audit actions with the app's trail:
+   `createAuditActions({ platform: [AUTH_AUDIT_ACTIONS, ACCESS_CONTROL_AUDIT_ACTIONS] })`.
+
+## Behaviour
+
+- **Seeding.** `seed()` makes D1 hold exactly the declared catalogue in one batch: upserts
+  permissions and system roles, replaces system roles' grants and inheritance, and deletes
+  permissions and system roles no longer declared (with their grants and assignments). Custom
+  roles stay (losing grants of removed permissions). A fingerprint row makes it a single read
+  when nothing changed. `honoAccessControl` runs it on the isolate's first use. A custom role
+  with the same name as a new system role makes seeding fail (role names are unique).
+- **`authorize({ userId, permission, resource? })`** reads D1 on every request: the user's
+  permissions through their roles and the roles those **explicitly** inherit (transitively),
+  memoised for the life of one `AccessControl` instance (one request), never cached in KV
+  (Q42). Removing a role takes effect on the next request. An undeclared permission denies,
+  even if a stale row grants it. `resource` is reserved for app-defined scoping and ignored
+  today.
+- **Assignments.** `assignRole` / `unassignRole({ userId, roleId, actorId })` are idempotent
+  and record `access.role.assigned` / `access.role.unassigned` (subject `user:<id>`, metadata
+  `roleId`) through the injected `AuditSink` when they change something; a failing sink is
+  logged (`access.audit.record_failed`), never the caller's failure. Unknown role or user:
+  `404 ROLE_NOT_FOUND` / `404 USER_NOT_FOUND`. `rolesOf(userId)` lists direct assignments.
+- **Custom roles.** Admins create roles from the declared permissions (`createRole`,
+  `updateRole`, `deleteRole`); system roles are read-only (`409 SYSTEM_ROLE_IMMUTABLE`). Names
+  are 1–64 characters, unique case-insensitively (`409 ROLE_NAME_TAKEN`); undeclared
+  permissions are `422 UNKNOWN_PERMISSION`, inheriting a missing role `422 UNKNOWN_ROLE`, and an
+  edge that would close a loop `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`). Deleting a role
+  deletes its assignments, but is refused while another role inherits it
+  (`409 ROLE_INHERITED`, `details.roleIds`). Audited (subject `role:<id>`) as
+  `access.role.created` (the fields), `access.role.updated` (`changes`: `{ from, to }` for
+  `name`/`description`, `{ added, removed }` for `permissions`/`inherits`; an update that
+  changes nothing writes and audits nothing) and `access.role.deleted` (the fields and
+  `unassignedUserIds`). Role data holds no secrets. Concurrent edits are last-write-wins.
+
+## Role admin API
+
+`mountRoleAdmin(app, { accessControl, guard, changeGuard, actorIdOf?, basePath? })` mounts, under
+`/api/admin` (all `Cache-Control: no-store`, errors in the `@awsmbiz/inbis-api` envelope):
+
+| Route | Body | Response |
+|---|---|---|
+| `GET /permissions` | | `{ items: [{ name, description }] }` |
+| `GET /roles` | | `{ items: Role[] }`, system roles first, then by name |
+| `GET /roles/:roleId` | | `Role` |
+| `POST /roles` | `{ name, description?, permissions, inherits? }` | `201 Role` |
+| `PATCH /roles/:roleId` | any of those fields | `Role` |
+| `DELETE /roles/:roleId` | | `204` |
+| `GET /users/:userId/roles` | | `{ items: UserRole[] }` |
+| `PUT /users/:userId/roles/:roleId` | | `{ items: UserRole[] }` (idempotent) |
+| `DELETE /users/:userId/roles/:roleId` | | `{ items: UserRole[] }` (idempotent) |
+
+`Role` = `{ id, name, description, system, permissions, inherits, userCount, createdAt, updatedAt }`
+and `UserRole` = `{ id, name, system, assignedAt, assignedBy }` (timestamps ISO 8601). Custom role
+IDs are random UUIDs. Reads pass `guard` (the platform admin policy, `requireAdmin()`);
+changes then pass `changeGuard` (`requireRecentAdminSignIn()`). Error codes: `422
+VALIDATION_FAILED` (`details.issues[{ path, message }]`), `422 UNKNOWN_PERMISSION`, `422
+UNKNOWN_ROLE`, `422 ROLE_INHERITANCE_CYCLE`, `409 ROLE_NAME_TAKEN`, `409 SYSTEM_ROLE_IMMUTABLE`,
+`409 ROLE_INHERITED`, `404 ROLE_NOT_FOUND`, `404 USER_NOT_FOUND`, plus the guards' (`401
+UNAUTHENTICATED`, `403 FORBIDDEN`, `403 TWO_FACTOR_REQUIRED`, `403 STEP_UP_REQUIRED`, `403
+SESSION_NOT_FRESH`).
+- **Account deletion.** `user_role.user_id` references `user(id)` `ON DELETE CASCADE`, so every
+  deletion path (`/delete-user`, the scheduled purge, `/admin/remove-user`) removes the user's
+  role assignments; no deletion hook is needed. The foreign key is deliberate, and it means
+  **access-control's migrations run after auth's** (ADR-4 platform order): an app installs
+  `@awsmbiz/inbis-auth` first, and a database without auth's `user` table cannot take them.
+- **Actor.** Each change records the signed-in admin as its actor (`actorIdOf`, default
+  `c.var.user?.id`); a change that reaches the routes without one is refused with `401
+  UNAUTHENTICATED`, never audited without an actor.
+
+## Tables
+
+`permission(name, description)`, `role(id, name unique, description, system, created_at,
+updated_at)`, `role_permission(role_id, permission)`, `role_inheritance(role_id,
+inherits_role_id)`, `user_role(user_id, role_id, assigned_at, assigned_by)` and
+`access_control_seed` (the catalogue fingerprint). System role IDs are the keys declared in
+code; timestamps are epoch milliseconds. Apps use the API, never the tables.
+
+## Changing the schema (maintainers)
+
+Migrations are append-only: add `migrations/000N_*.sql`, then
+`pnpm exec inbis-db lock migrations`. `pnpm check:migrations` fails if a released file changed.

package/dist/access-control-eE6LZrpn.d.ts

@@ -0,0 +1,197 @@
+import { AuditSink, Clock, Logger } from "@awsmbiz/inbis-core";
+/**
+ * The permission catalogue and system roles, declared in the app's code
+ * (plan Q40). Permission names are typed: a typo is a compile error.
+ */
+/** A system role as the app declares it. */
+interface RoleDeclaration<P extends string, R extends string> {
+  /** Display name, unique among all roles (custom ones included). */
+  name: string;
+  description?: string;
+  /** Permissions the role grants itself. */
+  permissions: readonly P[];
+  /**
+   * Roles whose permissions this role also grants (transitively). Explicit
+   * inheritance is the only inheritance: nothing is implied by names or order.
+   */
+  inherits?: readonly R[];
+}
+interface AccessControlInput<P extends string, R extends string> {
+  /** Every permission the app checks, with a description for the admin UI: `{ "notes.read": "Read notes" }`. */
+  permissions: Readonly<Record<P, string>>;
+  /** System roles by ID: seeded into D1 and immutable through the API. */
+  roles: Readonly<Record<R, RoleDeclaration<NoInfer<P>, NoInfer<R>>>>;
+}
+interface PermissionDefinition<P extends string = string> {
+  name: P;
+  description: string;
+}
+interface SystemRoleDefinition<P extends string = string, R extends string = string> {
+  id: R;
+  name: string;
+  description: string | null;
+  permissions: readonly P[];
+  inherits: readonly R[];
+}
+/** A validated catalogue, from {@link defineAccessControl}. */
+interface AccessControlDefinition<P extends string = string, R extends string = string> {
+  /** Sorted by name. */
+  readonly permissions: readonly PermissionDefinition<P>[];
+  /** Sorted by ID. */
+  readonly roles: readonly SystemRoleDefinition<P, R>[];
+  /** True for a declared permission name. */
+  hasPermission(name: string): name is P;
+}
+/**
+ * Declares the app's permissions and system roles. Throws on a malformed name,
+ * an undeclared permission or role, a duplicate role name or an inheritance
+ * cycle: all programming errors, found at startup.
+ *
+ * ```ts
+ * export const access = defineAccessControl({
+ *   permissions: { "notes.read": "Read notes", "notes.write": "Write notes" },
+ *   roles: {
+ *     reader: { name: "Reader", permissions: ["notes.read"] },
+ *     editor: { name: "Editor", permissions: ["notes.write"], inherits: ["reader"] },
+ *   },
+ * });
+ * ```
+ */
+declare function defineAccessControl<const P extends string, const R extends string>(input: AccessControlInput<P, R>): AccessControlDefinition<P, R>;
+/** A custom role's editable fields. */
+interface RoleFields {
+  /** Display name, 1–64 characters, unique among all roles (case-insensitive). */
+  name: string;
+  /** Up to 500 characters; `null` or `""` for none. */
+  description?: string | null;
+  /** Declared permission names the role grants itself. */
+  permissions: readonly string[];
+  /** IDs of roles (system or custom) whose permissions this role also grants. */
+  inherits?: readonly string[];
+}
+/** A role as the admin API shows it. */
+interface Role {
+  id: string;
+  name: string;
+  description: string | null;
+  /** Declared in code: read-only through the API. */
+  system: boolean;
+  /** Permissions the role grants itself (declared ones only), sorted. */
+  permissions: string[];
+  /** IDs of the roles it inherits directly, sorted. */
+  inherits: string[];
+  /** Users the role is assigned to directly. */
+  userCount: number;
+  createdAt: Date;
+  updatedAt: Date;
+}
+/** A role assigned to a user directly. */
+interface UserRole {
+  /** The role's ID. */
+  id: string;
+  name: string;
+  system: boolean;
+  assignedAt: Date;
+  /** The admin who assigned it; `null` for the system. */
+  assignedBy: string | null;
+}
+interface CreateRoleInput extends RoleFields {
+  actorId: string | null;
+}
+interface UpdateRoleInput {
+  roleId: string;
+  /** The fields to change; others keep their value. */
+  changes: Partial<RoleFields>;
+  actorId: string | null;
+}
+interface DeleteRoleInput {
+  roleId: string;
+  actorId: string | null;
+}
+/** What {@link seedCatalogue} did. */
+interface SeedResult {
+  /** `false` when the database already held this exact catalogue (nothing written). */
+  changed: boolean;
+}
+interface AuthorizeInput<P extends string = string> {
+  userId: string;
+  permission: P;
+  /**
+   * The record the action applies to, e.g. `note:<id>`. Reserved: ignored
+   * today, so apps can add resource scoping later without a breaking change.
+   */
+  resource?: string;
+}
+interface RoleAssignmentInput {
+  userId: string;
+  roleId: string;
+  /** Who made the change (audited); `null` for the system. */
+  actorId: string | null;
+}
+/**
+ * Access control for one request (create one per request: answers are
+ * memoised for its life only, and forgotten when it changes roles or assignments).
+ */
+interface AccessControl<P extends string = string> {
+  /**
+   * `true` when one of the user's roles, or a role they explicitly inherit,
+   * grants the permission. Reads D1 (once per user per instance, never a
+   * cache), so revocation applies on the next request. Unknown permissions
+   * deny. A platform admin (`role` `admin`) gets nothing implicitly.
+   */
+  authorize(input: AuthorizeInput<P>): Promise<boolean>;
+  /** IDs of the roles assigned to the user directly (not inherited), sorted. */
+  rolesOf(userId: string): Promise<string[]>;
+  /**
+   * Assigns a role (idempotent). Audited as `access.role.assigned` when it
+   * changes anything. `404 ROLE_NOT_FOUND` / `404 USER_NOT_FOUND`.
+   */
+  assignRole(input: RoleAssignmentInput): Promise<void>;
+  /** Removes a role assignment (idempotent). Audited as `access.role.unassigned` when it changes anything. */
+  unassignRole(input: RoleAssignmentInput): Promise<void>;
+  /** Seeds the catalogue and system roles into D1 (see `seedCatalogue`); run once per isolate before use. */
+  seed(): Promise<SeedResult>;
+  /** The declared permission catalogue, sorted by name. */
+  listPermissions(): PermissionDefinition<P>[];
+  /** Every role: system roles first, then by name. */
+  listRoles(): Promise<Role[]>;
+  /** `404 ROLE_NOT_FOUND` for an unknown ID. */
+  getRole(roleId: string): Promise<Role>;
+  /**
+   * Creates a custom role. Audited as `access.role.created`. `422 VALIDATION_FAILED`
+   * (name, description), `422 UNKNOWN_PERMISSION` (`details.permissions`),
+   * `422 UNKNOWN_ROLE` (`details.roleIds`), `409 ROLE_NAME_TAKEN`.
+   */
+  createRole(input: CreateRoleInput): Promise<Role>;
+  /**
+   * Changes a custom role's fields. Audited as `access.role.updated` with a diff
+   * (nothing is written or audited when nothing changes). As {@link createRole},
+   * plus `404 ROLE_NOT_FOUND`, `409 SYSTEM_ROLE_IMMUTABLE` and
+   * `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`, role IDs from this role back to it).
+   */
+  updateRole(input: UpdateRoleInput): Promise<Role>;
+  /**
+   * Deletes a custom role and its assignments. Audited as `access.role.deleted`.
+   * `404 ROLE_NOT_FOUND`, `409 SYSTEM_ROLE_IMMUTABLE`, `409 ROLE_INHERITED`
+   * (`details.roleIds`: roles that inherit it).
+   */
+  deleteRole(input: DeleteRoleInput): Promise<void>;
+  /** The user's directly assigned roles. `404 USER_NOT_FOUND`. */
+  userRoles(userId: string): Promise<UserRole[]>;
+}
+interface AccessControlOptions {
+  /** Receives role-assignment events (e.g. `@awsmbiz/inbis-audit`'s sink). Without it, nothing is audited. */
+  audit?: AuditSink;
+  /** Stamped on audit events. */
+  requestId?: string;
+  /** Receives `access.audit.record_failed`. Defaults to a console JSON logger. */
+  logger?: Logger;
+  clock?: Clock;
+}
+/**
+ * Access control over the database holding the access-control tables (the
+ * app's access-control binding), for one request.
+ */
+declare function createAccessControl<P extends string>(db: D1Database, definition: AccessControlDefinition<P>, options?: AccessControlOptions): AccessControl<P>;
+export { SystemRoleDefinition as _, createAccessControl as a, DeleteRoleInput as c, UserRole as d, RoleFields as f, RoleDeclaration as g, PermissionDefinition as h, RoleAssignmentInput as i, Role as l, AccessControlInput as m, AccessControlOptions as n, SeedResult as o, AccessControlDefinition as p, AuthorizeInput as r, CreateRoleInput as s, AccessControl as t, UpdateRoleInput as u, defineAccessControl as v };
+//# sourceMappingURL=access-control-eE6LZrpn.d.ts.map

package/dist/hono.d.ts

@@ -0,0 +1,90 @@
+import { d as UserRole, l as Role, t as AccessControl } from "./access-control-eE6LZrpn.js";
+import { Context, Env, Hono, MiddlewareHandler } from "hono";
+/** A role as the admin API returns it: {@link Role} with ISO 8601 timestamps. */
+interface RoleResponse extends Omit<Role, "createdAt" | "updatedAt"> {
+  createdAt: string;
+  updatedAt: string;
+}
+/** A user's role as the admin API returns it: {@link UserRole} with an ISO 8601 `assignedAt`. */
+interface UserRoleResponse extends Omit<UserRole, "assignedAt"> {
+  assignedAt: string;
+}
+interface MountRoleAdminOptions<E extends Env = Env> {
+  /** The request's access control, e.g. `accessControlOf` from {@link honoAccessControl} (seeds the catalogue). */
+  accessControl: (c: Context<E>) => Promise<AccessControl>;
+  /**
+   * Admits the caller to every route, or throws: pass the app's admin policy
+   * (`requireAdmin()` from `@awsmbiz/inbis-auth/hono`). Any env: guards are typed for their own variables.
+   */
+  guard: MiddlewareHandler;
+  /**
+   * Runs after `guard` on the routes that change something: pass the admin
+   * recent-sign-in check (`requireRecentAdminSignIn()` from `@awsmbiz/inbis-auth/hono`).
+   */
+  changeGuard: MiddlewareHandler;
+  /**
+   * The signed-in admin's user ID, recorded as the actor of each change. Default `c.var.user?.id`.
+   * A change without one is refused with `401 UNAUTHENTICATED`.
+   */
+  actorIdOf?: (c: Context<E>) => string | null | undefined;
+  /** Path prefix. Default `/api/admin`. */
+  basePath?: string;
+}
+/**
+ * Mounts the role admin API (under `/api/admin` by default). Every response is
+ * `Cache-Control: no-store`; errors are `AppError`s, rendered as the standard
+ * envelope by `@awsmbiz/inbis-api`.
+ *
+ * Reads (`guard`):
+ * - `GET /permissions` → `{ items: [{ name, description }] }`
+ * - `GET /roles` → `{ items: RoleResponse[] }` (system roles first, then by name)
+ * - `GET /roles/:roleId` → `RoleResponse` (`404 ROLE_NOT_FOUND`)
+ * - `GET /users/:userId/roles` → `{ items: UserRoleResponse[] }` (`404 USER_NOT_FOUND`)
+ *
+ * Changes (`guard`, then `changeGuard`), each audited:
+ * - `POST /roles` `{ name, description?, permissions, inherits? }` → `201 RoleResponse`
+ * - `PATCH /roles/:roleId` (any of those fields) → `RoleResponse`
+ * - `DELETE /roles/:roleId` → `204` (its assignments go with it)
+ * - `PUT /users/:userId/roles/:roleId` → the user's roles (idempotent)
+ * - `DELETE /users/:userId/roles/:roleId` → the user's roles (idempotent)
+ *
+ * Refusals: `422 VALIDATION_FAILED` (`details.issues[{ path, message }]`),
+ * `422 UNKNOWN_PERMISSION` (`details.permissions`), `422 UNKNOWN_ROLE`
+ * (`details.roleIds`), `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`),
+ * `409 ROLE_NAME_TAKEN` (`details.name`), `409 SYSTEM_ROLE_IMMUTABLE`,
+ * `409 ROLE_INHERITED` (`details.roleIds`), `404 ROLE_NOT_FOUND`,
+ * `404 USER_NOT_FOUND`, plus whatever the guards refuse with.
+ */
+export declare function mountRoleAdmin<E extends Env>(app: Hono<E>, options: MountRoleAdminOptions<E>): void;
+/** Builds the access control for a request, from the app's bindings. */
+export type AccessControlResolver<P extends string, E extends Env = Env> = (c: Context<E>) => AccessControl<P>;
+/** Values put on the Hono context (`c.var`). */
+export interface AccessControlVariables {
+  /** The request's access control (one per request: its answers are memoised for the request only). */
+  accessControl: AccessControl;
+}
+export interface HonoAccessControlOptions<E extends Env> {
+  /**
+   * The signed-in user's ID. Defaults to `c.var.user?.id`, as
+   * `@awsmbiz/inbis-auth/hono`'s `sessionMiddleware` sets it.
+   */
+  userId?: (c: Context<E>) => string | null | undefined;
+}
+export interface HonoAccessControl<P extends string, E extends Env> {
+  /**
+   * Middleware: `401 UNAUTHENTICATED` without a signed-in user, `403
+   * FORBIDDEN` (`details.permission`) unless `authorize()` allows the
+   * permission; both `AppError`s, rendered as the error envelope by
+   * `@awsmbiz/inbis-api`. Put it after `requireAuth()`, which applies the session policy.
+   */
+  requirePermission: (permission: P) => MiddlewareHandler<E>;
+  /** The request's access control (created, and the catalogue seeded, on first use). */
+  accessControlOf: (c: Context<E>) => Promise<AccessControl<P>>;
+}
+/**
+ * Hono helpers over one resolver. Build once per Worker isolate: the
+ * catalogue is seeded on the first use (and again after a failed attempt).
+ */
+export declare function honoAccessControl<P extends string, E extends Env = Env>(resolve: AccessControlResolver<P, E>, options?: HonoAccessControlOptions<E>): HonoAccessControl<P, E>;
+export type { MountRoleAdminOptions, RoleResponse, UserRoleResponse };
+//# sourceMappingURL=hono.d.ts.map

package/dist/hono.js

@@ -0,0 +1,172 @@
+import { i as parseRoleFields } from "./role-fields-ClqODoYn.js";
+import { AppError, validationFailed } from "@awsmbiz/inbis-core";
+// src/role-routes.ts
+const toRoleResponse = (role) => ({
+	...role,
+	createdAt: role.createdAt.toISOString(),
+	updatedAt: role.updatedAt.toISOString()
+});
+const toUserRoles = (roles) => ({ items: roles.map((role) => ({
+	...role,
+	assignedAt: role.assignedAt.toISOString()
+})) });
+async function bodyOf(c) {
+	try {
+		return await c.req.json();
+	} catch {
+		throw validationFailed([{
+			path: [],
+			message: "Must be a JSON object."
+		}]);
+	}
+}
+/**
+* Mounts the role admin API (under `/api/admin` by default). Every response is
+* `Cache-Control: no-store`; errors are `AppError`s, rendered as the standard
+* envelope by `@awsmbiz/inbis-api`.
+*
+* Reads (`guard`):
+* - `GET /permissions` → `{ items: [{ name, description }] }`
+* - `GET /roles` → `{ items: RoleResponse[] }` (system roles first, then by name)
+* - `GET /roles/:roleId` → `RoleResponse` (`404 ROLE_NOT_FOUND`)
+* - `GET /users/:userId/roles` → `{ items: UserRoleResponse[] }` (`404 USER_NOT_FOUND`)
+*
+* Changes (`guard`, then `changeGuard`), each audited:
+* - `POST /roles` `{ name, description?, permissions, inherits? }` → `201 RoleResponse`
+* - `PATCH /roles/:roleId` (any of those fields) → `RoleResponse`
+* - `DELETE /roles/:roleId` → `204` (its assignments go with it)
+* - `PUT /users/:userId/roles/:roleId` → the user's roles (idempotent)
+* - `DELETE /users/:userId/roles/:roleId` → the user's roles (idempotent)
+*
+* Refusals: `422 VALIDATION_FAILED` (`details.issues[{ path, message }]`),
+* `422 UNKNOWN_PERMISSION` (`details.permissions`), `422 UNKNOWN_ROLE`
+* (`details.roleIds`), `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`),
+* `409 ROLE_NAME_TAKEN` (`details.name`), `409 SYSTEM_ROLE_IMMUTABLE`,
+* `409 ROLE_INHERITED` (`details.roleIds`), `404 ROLE_NOT_FOUND`,
+* `404 USER_NOT_FOUND`, plus whatever the guards refuse with.
+*/
+function mountRoleAdmin(app, options) {
+	const base = options.basePath ?? "/api/admin";
+	const { guard, changeGuard } = options;
+	const own = (c) => c;
+	const access = (c) => options.accessControl(own(c));
+	const actorIdOf = options.actorIdOf ?? ((c) => c.get("user")?.id);
+	const actorOf = (c) => {
+		const id = actorIdOf(own(c));
+		if (id === null || id === void 0 || id === "") throw new AppError({
+			code: "UNAUTHENTICATED",
+			status: 401,
+			message: "Sign in to continue."
+		});
+		return id;
+	};
+	const hono = app;
+	const noStore = async (c, next) => {
+		c.header("cache-control", "no-store");
+		await next();
+	};
+	hono.get(`${base}/permissions`, guard, noStore, async (c) => c.json({ items: (await access(c)).listPermissions() }));
+	hono.get(`${base}/roles`, guard, noStore, async (c) => c.json({ items: (await (await access(c)).listRoles()).map(toRoleResponse) }));
+	hono.get(`${base}/roles/:roleId`, guard, noStore, async (c) => c.json(toRoleResponse(await (await access(c)).getRole(c.req.param("roleId")))));
+	hono.get(`${base}/users/:userId/roles`, guard, noStore, async (c) => c.json(toUserRoles(await (await access(c)).userRoles(c.req.param("userId")))));
+	hono.post(`${base}/roles`, guard, changeGuard, noStore, async (c) => {
+		const fields = parseRoleFields(await bodyOf(c));
+		const role = await (await access(c)).createRole({
+			...fields,
+			actorId: actorOf(c)
+		});
+		return c.json(toRoleResponse(role), 201);
+	});
+	hono.patch(`${base}/roles/:roleId`, guard, changeGuard, noStore, async (c) => {
+		const changes = parseRoleFields(await bodyOf(c), { partial: true });
+		const role = await (await access(c)).updateRole({
+			roleId: c.req.param("roleId"),
+			changes,
+			actorId: actorOf(c)
+		});
+		return c.json(toRoleResponse(role));
+	});
+	hono.delete(`${base}/roles/:roleId`, guard, changeGuard, noStore, async (c) => {
+		await (await access(c)).deleteRole({
+			roleId: c.req.param("roleId"),
+			actorId: actorOf(c)
+		});
+		return c.body(null, 204);
+	});
+	hono.put(`${base}/users/:userId/roles/:roleId`, guard, changeGuard, noStore, async (c) => {
+		const control = await access(c);
+		const userId = c.req.param("userId");
+		await control.assignRole({
+			userId,
+			roleId: c.req.param("roleId"),
+			actorId: actorOf(c)
+		});
+		return c.json(toUserRoles(await control.userRoles(userId)));
+	});
+	hono.delete(`${base}/users/:userId/roles/:roleId`, guard, changeGuard, noStore, async (c) => {
+		const control = await access(c);
+		const userId = c.req.param("userId");
+		await control.unassignRole({
+			userId,
+			roleId: c.req.param("roleId"),
+			actorId: actorOf(c)
+		});
+		return c.json(toUserRoles(await control.userRoles(userId)));
+	});
+}
+// src/hono.ts
+/**
+* Hono integration: `@awsmbiz/inbis-access-control/hono`.
+*
+* ```ts
+* const { requirePermission } = honoAccessControl((c) =>
+*   createAccessControl(c.env.ACCESS_CONTROL_DB, access, { audit, requestId: c.var.requestId }),
+* );
+* app.get("/v1/notes", requireAuth(), requirePermission("notes.read"), handler);
+* ```
+*/
+/**
+* Hono helpers over one resolver. Build once per Worker isolate: the
+* catalogue is seeded on the first use (and again after a failed attempt).
+*/
+function honoAccessControl(resolve, options = {}) {
+	let seeded;
+	const userIdOf = options.userId ?? ((c) => c.get("user")?.id);
+	async function accessControlOf(c) {
+		const ctx = c;
+		const existing = ctx.get("accessControl");
+		if (existing !== void 0) return existing;
+		const access = resolve(c);
+		seeded ??= access.seed().catch((error) => {
+			seeded = void 0;
+			throw error;
+		});
+		await seeded;
+		ctx.set("accessControl", access);
+		return access;
+	}
+	return {
+		accessControlOf,
+		requirePermission: (permission) => async (c, next) => {
+			const userId = userIdOf(c);
+			if (userId === null || userId === void 0) throw new AppError({
+				code: "UNAUTHENTICATED",
+				status: 401,
+				message: "Sign in to continue."
+			});
+			if (!await (await accessControlOf(c)).authorize({
+				userId,
+				permission
+			})) throw new AppError({
+				code: "FORBIDDEN",
+				status: 403,
+				message: "You do not have permission to do this.",
+				details: { permission }
+			});
+			await next();
+		}
+	};
+}
+export { honoAccessControl, mountRoleAdmin };
+
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.js","names":[],"sources":["../src/role-routes.ts","../src/hono.ts"],"sourcesContent":["import { AppError, validationFailed } from \"@awsmbiz/inbis-core\";\nimport type { Context, Env, Hono, MiddlewareHandler } from \"hono\";\nimport type { AccessControl } from \"./access-control.js\";\nimport { parseRoleFields } from \"./role-fields.js\";\nimport type { Role, UserRole } from \"./roles.js\";\n\n/** A role as the admin API returns it: {@link Role} with ISO 8601 timestamps. */\nexport interface RoleResponse extends Omit<Role, \"createdAt\" | \"updatedAt\"> {\n  createdAt: string;\n  updatedAt: string;\n}\n\n/** A user's role as the admin API returns it: {@link UserRole} with an ISO 8601 `assignedAt`. */\nexport interface UserRoleResponse extends Omit<UserRole, \"assignedAt\"> {\n  assignedAt: string;\n}\n\nexport interface MountRoleAdminOptions<E extends Env = Env> {\n  /** The request's access control, e.g. `accessControlOf` from {@link honoAccessControl} (seeds the catalogue). */\n  accessControl: (c: Context<E>) => Promise<AccessControl>;\n  /**\n   * Admits the caller to every route, or throws: pass the app's admin policy\n   * (`requireAdmin()` from `@awsmbiz/inbis-auth/hono`). Any env: guards are typed for their own variables.\n   */\n  guard: MiddlewareHandler;\n  /**\n   * Runs after `guard` on the routes that change something: pass the admin\n   * recent-sign-in check (`requireRecentAdminSignIn()` from `@awsmbiz/inbis-auth/hono`).\n   */\n  changeGuard: MiddlewareHandler;\n  /**\n   * The signed-in admin's user ID, recorded as the actor of each change. Default `c.var.user?.id`.\n   * A change without one is refused with `401 UNAUTHENTICATED`.\n   */\n  actorIdOf?: (c: Context<E>) => string | null | undefined;\n  /** Path prefix. Default `/api/admin`. */\n  basePath?: string;\n}\n\nconst toRoleResponse = (role: Role): RoleResponse => ({\n  ...role,\n  createdAt: role.createdAt.toISOString(),\n  updatedAt: role.updatedAt.toISOString(),\n});\n\nconst toUserRoles = (roles: UserRole[]) => ({\n  items: roles.map((role): UserRoleResponse => ({ ...role, assignedAt: role.assignedAt.toISOString() })),\n});\n\nasync function bodyOf(c: Context): Promise<unknown> {\n  try {\n    return await c.req.json();\n  } catch {\n    throw validationFailed([{ path: [], message: \"Must be a JSON object.\" }]);\n  }\n}\n\n/**\n * Mounts the role admin API (under `/api/admin` by default). Every response is\n * `Cache-Control: no-store`; errors are `AppError`s, rendered as the standard\n * envelope by `@awsmbiz/inbis-api`.\n *\n * Reads (`guard`):\n * - `GET /permissions` → `{ items: [{ name, description }] }`\n * - `GET /roles` → `{ items: RoleResponse[] }` (system roles first, then by name)\n * - `GET /roles/:roleId` → `RoleResponse` (`404 ROLE_NOT_FOUND`)\n * - `GET /users/:userId/roles` → `{ items: UserRoleResponse[] }` (`404 USER_NOT_FOUND`)\n *\n * Changes (`guard`, then `changeGuard`), each audited:\n * - `POST /roles` `{ name, description?, permissions, inherits? }` → `201 RoleResponse`\n * - `PATCH /roles/:roleId` (any of those fields) → `RoleResponse`\n * - `DELETE /roles/:roleId` → `204` (its assignments go with it)\n * - `PUT /users/:userId/roles/:roleId` → the user's roles (idempotent)\n * - `DELETE /users/:userId/roles/:roleId` → the user's roles (idempotent)\n *\n * Refusals: `422 VALIDATION_FAILED` (`details.issues[{ path, message }]`),\n * `422 UNKNOWN_PERMISSION` (`details.permissions`), `422 UNKNOWN_ROLE`\n * (`details.roleIds`), `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`),\n * `409 ROLE_NAME_TAKEN` (`details.name`), `409 SYSTEM_ROLE_IMMUTABLE`,\n * `409 ROLE_INHERITED` (`details.roleIds`), `404 ROLE_NOT_FOUND`,\n * `404 USER_NOT_FOUND`, plus whatever the guards refuse with.\n */\nexport function mountRoleAdmin<E extends Env>(app: Hono<E>, options: MountRoleAdminOptions<E>): void {\n  const base = options.basePath ?? \"/api/admin\";\n  const { guard, changeGuard } = options;\n  // Routes run with the app's env E; Hono types the plain app's handlers with `any`.\n  const own = (c: Context): Context<E> => c as Context<E>;\n  const access = (c: Context) => options.accessControl(own(c));\n  const actorIdOf =\n    options.actorIdOf ??\n    ((c: Context<E>) => (c as unknown as Context<{ Variables: { user?: { id: string } | null } }>).get(\"user\")?.id);\n  // Fails closed: a change without a signed-in admin is refused, never audited without an actor.\n  const actorOf = (c: Context): string => {\n    const id = actorIdOf(own(c));\n    if (id === null || id === undefined || id === \"\") {\n      throw new AppError({ code: \"UNAUTHENTICATED\", status: 401, message: \"Sign in to continue.\" });\n    }\n    return id;\n  };\n  // Hono's handler types do not compose over a generic env: register on the plain app.\n  const hono = app as unknown as Hono;\n  const noStore: MiddlewareHandler = async (c, next) => {\n    c.header(\"cache-control\", \"no-store\");\n    await next();\n  };\n\n  hono.get(`${base}/permissions`, guard, noStore, async (c) => c.json({ items: (await access(c)).listPermissions() }));\n  hono.get(`${base}/roles`, guard, noStore, async (c) => c.json({ items: (await (await access(c)).listRoles()).map(toRoleResponse) }));\n  hono.get(`${base}/roles/:roleId`, guard, noStore, async (c) => c.json(toRoleResponse(await (await access(c)).getRole(c.req.param(\"roleId\")))));\n  hono.get(`${base}/users/:userId/roles`, guard, noStore, async (c) =>\n    c.json(toUserRoles(await (await access(c)).userRoles(c.req.param(\"userId\")))),\n  );\n\n  hono.post(`${base}/roles`, guard, changeGuard, noStore, async (c) => {\n    const fields = parseRoleFields(await bodyOf(c));\n    const role = await (await access(c)).createRole({ ...fields, actorId: actorOf(c) });\n    return c.json(toRoleResponse(role), 201);\n  });\n  hono.patch(`${base}/roles/:roleId`, guard, changeGuard, noStore, async (c) => {\n    const changes = parseRoleFields(await bodyOf(c), { partial: true });\n    const role = await (await access(c)).updateRole({ roleId: c.req.param(\"roleId\"), changes, actorId: actorOf(c) });\n    return c.json(toRoleResponse(role));\n  });\n  hono.delete(`${base}/roles/:roleId`, guard, changeGuard, noStore, async (c) => {\n    await (await access(c)).deleteRole({ roleId: c.req.param(\"roleId\"), actorId: actorOf(c) });\n    return c.body(null, 204);\n  });\n  hono.put(`${base}/users/:userId/roles/:roleId`, guard, changeGuard, noStore, async (c) => {\n    const control = await access(c);\n    const userId = c.req.param(\"userId\");\n    await control.assignRole({ userId, roleId: c.req.param(\"roleId\"), actorId: actorOf(c) });\n    return c.json(toUserRoles(await control.userRoles(userId)));\n  });\n  hono.delete(`${base}/users/:userId/roles/:roleId`, guard, changeGuard, noStore, async (c) => {\n    const control = await access(c);\n    const userId = c.req.param(\"userId\");\n    await control.unassignRole({ userId, roleId: c.req.param(\"roleId\"), actorId: actorOf(c) });\n    return c.json(toUserRoles(await control.userRoles(userId)));\n  });\n}\n","/**\n * Hono integration: `@awsmbiz/inbis-access-control/hono`.\n *\n * ```ts\n * const { requirePermission } = honoAccessControl((c) =>\n *   createAccessControl(c.env.ACCESS_CONTROL_DB, access, { audit, requestId: c.var.requestId }),\n * );\n * app.get(\"/v1/notes\", requireAuth(), requirePermission(\"notes.read\"), handler);\n * ```\n */\nimport { AppError } from \"@awsmbiz/inbis-core\";\nimport type { Context, Env, MiddlewareHandler } from \"hono\";\nimport type { AccessControl } from \"./access-control.js\";\n\n/** Builds the access control for a request, from the app's bindings. */\nexport type AccessControlResolver<P extends string, E extends Env = Env> = (c: Context<E>) => AccessControl<P>;\n\n/** Values put on the Hono context (`c.var`). */\nexport interface AccessControlVariables {\n  /** The request's access control (one per request: its answers are memoised for the request only). */\n  accessControl: AccessControl;\n}\n\nexport interface HonoAccessControlOptions<E extends Env> {\n  /**\n   * The signed-in user's ID. Defaults to `c.var.user?.id`, as\n   * `@awsmbiz/inbis-auth/hono`'s `sessionMiddleware` sets it.\n   */\n  userId?: (c: Context<E>) => string | null | undefined;\n}\n\nexport interface HonoAccessControl<P extends string, E extends Env> {\n  /**\n   * Middleware: `401 UNAUTHENTICATED` without a signed-in user, `403\n   * FORBIDDEN` (`details.permission`) unless `authorize()` allows the\n   * permission; both `AppError`s, rendered as the error envelope by\n   * `@awsmbiz/inbis-api`. Put it after `requireAuth()`, which applies the session policy.\n   */\n  requirePermission: (permission: P) => MiddlewareHandler<E>;\n  /** The request's access control (created, and the catalogue seeded, on first use). */\n  accessControlOf: (c: Context<E>) => Promise<AccessControl<P>>;\n}\n\n/**\n * Hono helpers over one resolver. Build once per Worker isolate: the\n * catalogue is seeded on the first use (and again after a failed attempt).\n */\nexport function honoAccessControl<P extends string, E extends Env = Env>(\n  resolve: AccessControlResolver<P, E>,\n  options: HonoAccessControlOptions<E> = {},\n): HonoAccessControl<P, E> {\n  let seeded: Promise<unknown> | undefined;\n  const userIdOf =\n    options.userId ?? ((c: Context<E>) => (c as unknown as Context<{ Variables: { user?: { id: string } | null } }>).get(\"user\")?.id);\n\n  async function accessControlOf(c: Context<E>): Promise<AccessControl<P>> {\n    const ctx = c as unknown as Context<{ Variables: AccessControlVariables }>;\n    const existing = ctx.get(\"accessControl\") as AccessControl<P> | undefined;\n    if (existing !== undefined) return existing;\n    const access = resolve(c);\n    seeded ??= access.seed().catch((error: unknown) => {\n      seeded = undefined;\n      throw error;\n    });\n    await seeded;\n    ctx.set(\"accessControl\", access as AccessControl);\n    return access;\n  }\n\n  return {\n    accessControlOf,\n    requirePermission: (permission) => async (c, next) => {\n      const userId = userIdOf(c);\n      if (userId === null || userId === undefined) {\n        throw new AppError({ code: \"UNAUTHENTICATED\", status: 401, message: \"Sign in to continue.\" });\n      }\n      const access = await accessControlOf(c);\n      if (!(await access.authorize({ userId, permission }))) {\n        throw new AppError({\n          code: \"FORBIDDEN\",\n          status: 403,\n          message: \"You do not have permission to do this.\",\n          details: { permission },\n        });\n      }\n      await next();\n    },\n  };\n}\nexport { mountRoleAdmin, type MountRoleAdminOptions, type RoleResponse, type UserRoleResponse } from \"./role-routes.js\";\n"],"mappings":";;;AAuCA,MAAM,kBAAkB,UAA8B;CACpD,GAAG;CACH,WAAW,KAAK,UAAU,YAAY;CACtC,WAAW,KAAK,UAAU,YAAY;AACxC;AAEA,MAAM,eAAe,WAAuB,EAC1C,OAAO,MAAM,KAAK,UAA4B;CAAE,GAAG;CAAM,YAAY,KAAK,WAAW,YAAY;AAAE,EAAE,EACvG;AAEA,eAAe,OAAO,GAA8B;CAClD,IAAI;EACF,OAAO,MAAM,EAAE,IAAI,KAAK;CAC1B,QAAQ;EACN,MAAM,iBAAiB,CAAC;GAAE,MAAM,CAAC;GAAG,SAAS;EAAyB,CAAC,CAAC;CAC1E;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,eAA8B,KAAc,SAAyC;CACnG,MAAM,OAAO,QAAQ,YAAY;CACjC,MAAM,EAAE,OAAO,gBAAgB;CAE/B,MAAM,OAAO,MAA2B;CACxC,MAAM,UAAU,MAAe,QAAQ,cAAc,IAAI,CAAC,CAAC;CAC3D,MAAM,YACJ,QAAQ,eACN,MAAmB,EAA0E,IAAI,MAAM,CAAC,EAAE;CAE9G,MAAM,WAAW,MAAuB;EACtC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC;EAC3B,IAAI,OAAO,QAAQ,OAAO,KAAA,KAAa,OAAO,IAC5C,MAAM,IAAI,SAAS;GAAE,MAAM;GAAmB,QAAQ;GAAK,SAAS;EAAuB,CAAC;EAE9F,OAAO;CACT;CAEA,MAAM,OAAO;CACb,MAAM,UAA6B,OAAO,GAAG,SAAS;EACpD,EAAE,OAAO,iBAAiB,UAAU;EACpC,MAAM,KAAK;CACb;CAEA,KAAK,IAAI,GAAG,KAAK,eAAe,OAAO,SAAS,OAAO,MAAM,EAAE,KAAK,EAAE,QAAQ,MAAM,OAAO,CAAC,EAAA,CAAG,gBAAgB,EAAE,CAAC,CAAC;CACnH,KAAK,IAAI,GAAG,KAAK,SAAS,OAAO,SAAS,OAAO,MAAM,EAAE,KAAK,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC,EAAA,CAAG,UAAU,EAAA,CAAG,IAAI,cAAc,EAAE,CAAC,CAAC;CACnI,KAAK,IAAI,GAAG,KAAK,iBAAiB,OAAO,SAAS,OAAO,MAAM,EAAE,KAAK,eAAe,OAAO,MAAM,OAAO,CAAC,EAAA,CAAG,QAAQ,EAAE,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC7I,KAAK,IAAI,GAAG,KAAK,uBAAuB,OAAO,SAAS,OAAO,MAC7D,EAAE,KAAK,YAAY,OAAO,MAAM,OAAO,CAAC,EAAA,CAAG,UAAU,EAAE,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC,CAC9E;CAEA,KAAK,KAAK,GAAG,KAAK,SAAS,OAAO,aAAa,SAAS,OAAO,MAAM;EACnE,MAAM,SAAS,gBAAgB,MAAM,OAAO,CAAC,CAAC;EAC9C,MAAM,OAAO,OAAO,MAAM,OAAO,CAAC,EAAA,CAAG,WAAW;GAAE,GAAG;GAAQ,SAAS,QAAQ,CAAC;EAAE,CAAC;EAClF,OAAO,EAAE,KAAK,eAAe,IAAI,GAAG,GAAG;CACzC,CAAC;CACD,KAAK,MAAM,GAAG,KAAK,iBAAiB,OAAO,aAAa,SAAS,OAAO,MAAM;EAC5E,MAAM,UAAU,gBAAgB,MAAM,OAAO,CAAC,GAAG,EAAE,SAAS,KAAK,CAAC;EAClE,MAAM,OAAO,OAAO,MAAM,OAAO,CAAC,EAAA,CAAG,WAAW;GAAE,QAAQ,EAAE,IAAI,MAAM,QAAQ;GAAG;GAAS,SAAS,QAAQ,CAAC;EAAE,CAAC;EAC/G,OAAO,EAAE,KAAK,eAAe,IAAI,CAAC;CACpC,CAAC;CACD,KAAK,OAAO,GAAG,KAAK,iBAAiB,OAAO,aAAa,SAAS,OAAO,MAAM;EAC7E,OAAO,MAAM,OAAO,CAAC,EAAA,CAAG,WAAW;GAAE,QAAQ,EAAE,IAAI,MAAM,QAAQ;GAAG,SAAS,QAAQ,CAAC;EAAE,CAAC;EACzF,OAAO,EAAE,KAAK,MAAM,GAAG;CACzB,CAAC;CACD,KAAK,IAAI,GAAG,KAAK,+BAA+B,OAAO,aAAa,SAAS,OAAO,MAAM;EACxF,MAAM,UAAU,MAAM,OAAO,CAAC;EAC9B,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EACnC,MAAM,QAAQ,WAAW;GAAE;GAAQ,QAAQ,EAAE,IAAI,MAAM,QAAQ;GAAG,SAAS,QAAQ,CAAC;EAAE,CAAC;EACvF,OAAO,EAAE,KAAK,YAAY,MAAM,QAAQ,UAAU,MAAM,CAAC,CAAC;CAC5D,CAAC;CACD,KAAK,OAAO,GAAG,KAAK,+BAA+B,OAAO,aAAa,SAAS,OAAO,MAAM;EAC3F,MAAM,UAAU,MAAM,OAAO,CAAC;EAC9B,MAAM,SAAS,EAAE,IAAI,MAAM,QAAQ;EACnC,MAAM,QAAQ,aAAa;GAAE;GAAQ,QAAQ,EAAE,IAAI,MAAM,QAAQ;GAAG,SAAS,QAAQ,CAAC;EAAE,CAAC;EACzF,OAAO,EAAE,KAAK,YAAY,MAAM,QAAQ,UAAU,MAAM,CAAC,CAAC;CAC5D,CAAC;AACH;;;;;;;;;;;;;;;;AC5FA,SAAgB,kBACd,SACA,UAAuC,CAAC,GACf;CACzB,IAAI;CACJ,MAAM,WACJ,QAAQ,YAAY,MAAmB,EAA0E,IAAI,MAAM,CAAC,EAAE;CAEhI,eAAe,gBAAgB,GAA0C;EACvE,MAAM,MAAM;EACZ,MAAM,WAAW,IAAI,IAAI,eAAe;EACxC,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,MAAM,SAAS,QAAQ,CAAC;EACxB,WAAW,OAAO,KAAK,CAAC,CAAC,OAAO,UAAmB;GACjD,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,MAAM;EACN,IAAI,IAAI,iBAAiB,MAAuB;EAChD,OAAO;CACT;CAEA,OAAO;EACL;EACA,oBAAoB,eAAe,OAAO,GAAG,SAAS;GACpD,MAAM,SAAS,SAAS,CAAC;GACzB,IAAI,WAAW,QAAQ,WAAW,KAAA,GAChC,MAAM,IAAI,SAAS;IAAE,MAAM;IAAmB,QAAQ;IAAK,SAAS;GAAuB,CAAC;GAG9F,IAAI,CAAE,OAAM,MADS,gBAAgB,CAAC,EAAA,CACnB,UAAU;IAAE;IAAQ;GAAW,CAAC,GACjD,MAAM,IAAI,SAAS;IACjB,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS,EAAE,WAAW;GACxB,CAAC;GAEH,MAAM,KAAK;EACb;CACF;AACF"}