@cqrs-ddd/pipeline-casl 0.5.0

package/README.md

@@ -0,0 +1,38 @@
+# @cqrs-ddd/pipeline-casl
+
+CASL authorization for `@cqrs-ddd/pipeline`. `CaslBehavior` checks type-level
+requirements before the handler runs (`requires({ action, subject })`), loading the
+caller's rules through your `ICaslPermissionSource`; `CaslAuthorizer` checks the loaded
+entity and projects readable fields inside the handler. `toHttpResponse()` from
+`@cqrs-ddd/pipeline-casl/http` turns a denial into a 403 answer.
+
+**Documentation:** [guide](https://aristoteliss.github.io/ddd-cqrs/packages/pipeline-casl/) · [API reference](https://aristoteliss.github.io/ddd-cqrs/api/cqrs-ddd/pipeline-casl/) · [all packages](https://aristoteliss.github.io/ddd-cqrs/)
+
+## Installation
+
+```bash
+pnpm add @cqrs-ddd/pipeline-casl @cqrs-ddd/pipeline @casl/ability
+```
+
+Requires Node.js 22.12 or later. Published as an ES module; a CommonJS application loads
+it with `require()`.
+
+## Example
+
+```ts
+const pipeline = createPipeline({ behaviors: [new CaslBehavior(permissionSource)] });
+
+export const deletePost = pipeline.wrap(
+  { name: 'deletePost', kind: 'command' },
+  requires({ action: 'delete', subject: 'Post' }),
+)(async (id: string) => posts.remove(id));
+```
+
+A type-level check does not replace the entity check after loading: a cache or
+idempotency hit skips the handler, so their keys must include the principal and its
+permission scope.
+
+## License
+
+Dual-licensed under **AGPLv3** and a **Commercial License**. See `LICENSE` and
+`COMMERCIAL_LICENSE.txt`.

package/dist/casl.behavior.d.ts

@@ -0,0 +1,27 @@
+import { IPipelineBehavior, IPipelineContext, NextDelegate, PIPELINE_BEHAVIOR_ID } from '@cqrs-ddd/pipeline';
+import type { ICaslPermissionSource } from './interfaces/permission-source.interface.js';
+import type { AbilityRequirement } from './types/casl.types.js';
+/** Stable behavior identity; cache and idempotency order themselves after it. */
+export declare const CASL_BEHAVIOR_ID = "@cqrs-ddd/pipeline-casl:CaslBehavior";
+/** Per-handler options, usually declared with `requires(...)`. */
+export interface CaslBehaviorOptions {
+    /** Type-level requirements, all of which must pass. */
+    rules: readonly [AbilityRequirement, ...AbilityRequirement[]];
+}
+/**
+ * Type-level authorization before the handler runs.
+ *
+ * Loads the caller through `ICaslPermissionSource`, builds the ability, stores
+ * it and the principal in `context.items` for `CaslAuthorizer` and
+ * security-scoped keys, and throws `UnauthorizedActionException` unless every
+ * requirement passes. An unauthenticated caller (`null` input) is denied.
+ * Errors from the source or from malformed rules propagate unchanged.
+ * A handler without `rules` runs without loading permissions.
+ */
+export declare class CaslBehavior implements IPipelineBehavior {
+    private readonly source;
+    static readonly [PIPELINE_BEHAVIOR_ID] = "@cqrs-ddd/pipeline-casl:CaslBehavior";
+    constructor(source: ICaslPermissionSource);
+    handle(context: IPipelineContext, next: NextDelegate): Promise<unknown>;
+}
+//# sourceMappingURL=casl.behavior.d.ts.map

package/dist/casl.behavior.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"casl.behavior.d.ts","sourceRoot":"","sources":["../src/casl.behavior.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AAEvE,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,KAAK,EAAE,SAAS,CAAC,kBAAkB,EAAE,GAAG,kBAAkB,EAAE,CAAC,CAAC;CAC/D;AAED;;;;;;;;;GASG;AACH,qBAAa,YAAa,YAAW,iBAAiB;IAGxC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,0CAAoB;IAE1D,YAA6B,MAAM,EAAE,qBAAqB,EAMzD;IAEK,MAAM,CACV,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,OAAO,CAAC,CA+BlB;CACF"}

package/dist/casl.behavior.js

@@ -0,0 +1,57 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+import { PIPELINE_BEHAVIOR_ID, } from '@cqrs-ddd/pipeline';
+import { CASL_ABILITY_KEY, CASL_PRINCIPAL_KEY } from './constants/tokens.js';
+import { UnauthorizedActionException } from './errors/unauthorized-action.exception.js';
+import { buildAbility } from './helpers/ability.js';
+/** Stable behavior identity; cache and idempotency order themselves after it. */
+export const CASL_BEHAVIOR_ID = '@cqrs-ddd/pipeline-casl:CaslBehavior';
+/**
+ * Type-level authorization before the handler runs.
+ *
+ * Loads the caller through `ICaslPermissionSource`, builds the ability, stores
+ * it and the principal in `context.items` for `CaslAuthorizer` and
+ * security-scoped keys, and throws `UnauthorizedActionException` unless every
+ * requirement passes. An unauthenticated caller (`null` input) is denied.
+ * Errors from the source or from malformed rules propagate unchanged.
+ * A handler without `rules` runs without loading permissions.
+ */
+export class CaslBehavior {
+    source;
+    static [PIPELINE_BEHAVIOR_ID] = CASL_BEHAVIOR_ID;
+    constructor(source) {
+        this.source = source;
+        if (typeof source?.load !== 'function') {
+            throw new TypeError('CaslBehavior requires a permission source (ICaslPermissionSource) with a load() method.');
+        }
+    }
+    async handle(context, next) {
+        const rules = context.getBehaviorOptions(CaslBehavior)?.rules;
+        if (!rules?.length)
+            return next();
+        const input = await this.source.load(context);
+        if (!input) {
+            throw new UnauthorizedActionException({
+                action: rules[0].action,
+                subject: rules[0].subject,
+                reason: 'Access denied — authentication required.',
+            });
+        }
+        const ability = buildAbility(input.rules, input.principal);
+        context.items.set(CASL_PRINCIPAL_KEY, input.principal);
+        context.items.set(CASL_ABILITY_KEY, ability);
+        for (const { action, subject, field } of rules) {
+            const allowed = field
+                ? ability.can(action, subject, field)
+                : ability.can(action, subject);
+            if (!allowed) {
+                throw new UnauthorizedActionException({
+                    action,
+                    subject,
+                    ...(field ? { fields: [field] } : {}),
+                });
+            }
+        }
+        return next();
+    }
+}
+//# sourceMappingURL=casl.behavior.js.map

package/dist/casl.behavior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"casl.behavior.js","sourceRoot":"","sources":["../src/casl.behavior.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAIL,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIpD,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAQvE;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IAGM,MAAM;IAFnC,MAAM,CAAU,CAAC,oBAAoB,CAAC,GAAG,gBAAgB,CAAC;IAE1D,YAA6B,MAA6B;sBAA7B,MAAM;QACjC,IAAI,OAAO,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CACjB,yFAAyF,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAyB,EACzB,IAAkB;QAElB,MAAM,KAAK,GACT,OAAO,CAAC,kBAAkB,CAAsB,YAAY,CAAC,EAAE,KAAK,CAAC;QACvE,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAA2B,CAAC;gBACpC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;gBACvB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO;gBACzB,MAAM,EAAE,0CAA0C;aACnD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAE7C,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,KAAK;gBACnB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;gBACrC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,2BAA2B,CAAC;oBACpC,MAAM;oBACN,OAAO;oBACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;CACF"}

package/dist/constants/tokens.d.ts

@@ -0,0 +1,29 @@
+/** `context.items` key holding the ability `CaslBehavior` built for the execution. */
+export declare const CASL_ABILITY_KEY: unique symbol;
+/** `context.items` key holding the principal that ability was built for. */
+export declare const CASL_PRINCIPAL_KEY: unique symbol;
+/**
+ * Built-in CASL keyword subjects.
+ */
+export declare const CASL_SUBJECTS: {
+    /** Wildcard subject matching any entity type. */
+    readonly ALL: 'all';
+};
+export type CaslSubject = (typeof CASL_SUBJECTS)[keyof typeof CASL_SUBJECTS];
+/**
+ * Standard CASL actions, including built-in wildcard and standard CRUD verbs.
+ */
+export declare const CASL_ACTIONS: {
+    /** Built-in CASL wildcard action matching any operation. */
+    readonly MANAGE: 'manage';
+    /** Standard CRUD create action. */
+    readonly CREATE: 'create';
+    /** Standard CRUD read/retrieve action. */
+    readonly READ: 'read';
+    /** Standard CRUD update action. */
+    readonly UPDATE: 'update';
+    /** Standard CRUD delete action. */
+    readonly DELETE: 'delete';
+};
+export type CaslAction = (typeof CASL_ACTIONS)[keyof typeof CASL_ACTIONS];
+//# sourceMappingURL=tokens.d.ts.map

package/dist/constants/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/constants/tokens.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,eAAgD,CAAC;AAE9E,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa;IACxB,iDAAiD;aACjD,GAAG,EAAE,KAAK;CACF,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE7E;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB,4DAA4D;aAC5D,MAAM,EAAE,QAAQ;IAChB,mCAAmC;aACnC,MAAM,EAAE,QAAQ;IAChB,0CAA0C;aAC1C,IAAI,EAAE,MAAM;IACZ,mCAAmC;aACnC,MAAM,EAAE,QAAQ;IAChB,mCAAmC;aACnC,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC"}

package/dist/constants/tokens.js

@@ -0,0 +1,28 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+/** `context.items` key holding the ability `CaslBehavior` built for the execution. */
+export const CASL_ABILITY_KEY = Symbol.for('@cqrs-ddd/pipeline-casl:ability');
+/** `context.items` key holding the principal that ability was built for. */
+export const CASL_PRINCIPAL_KEY = Symbol.for('@cqrs-ddd/pipeline-casl:principal');
+/**
+ * Built-in CASL keyword subjects.
+ */
+export const CASL_SUBJECTS = {
+    /** Wildcard subject matching any entity type. */
+    ALL: 'all',
+};
+/**
+ * Standard CASL actions, including built-in wildcard and standard CRUD verbs.
+ */
+export const CASL_ACTIONS = {
+    /** Built-in CASL wildcard action matching any operation. */
+    MANAGE: 'manage',
+    /** Standard CRUD create action. */
+    CREATE: 'create',
+    /** Standard CRUD read/retrieve action. */
+    READ: 'read',
+    /** Standard CRUD update action. */
+    UPDATE: 'update',
+    /** Standard CRUD delete action. */
+    DELETE: 'delete',
+};
+//# sourceMappingURL=tokens.js.map

package/dist/constants/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/constants/tokens.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAC1C,mCAAmC,CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,iDAAiD;IACjD,GAAG,EAAE,KAAK;CACF,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,4DAA4D;IAC5D,MAAM,EAAE,QAAQ;IAChB,mCAAmC;IACnC,MAAM,EAAE,QAAQ;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM;IACZ,mCAAmC;IACnC,MAAM,EAAE,QAAQ;IAChB,mCAAmC;IACnC,MAAM,EAAE,QAAQ;CACR,CAAC"}

package/dist/errors/missing-ability.error.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Raised when code that needs the caller's authorization runs without an
+ * ability: `CaslBehavior` did not run for the request, or the code runs outside
+ * a pipeline. A configuration failure, not a denial — map it to a server error,
+ * never to 403.
+ */
+export declare class MissingAbilityError extends Error {
+    readonly purpose: string;
+    /**
+     * @param purpose - What needed the ability, named in the message.
+     */
+    constructor(purpose: string);
+}
+//# sourceMappingURL=missing-ability.error.d.ts.map

package/dist/errors/missing-ability.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-ability.error.d.ts","sourceRoot":"","sources":["../../src/errors/missing-ability.error.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAIhC,QAAQ,CAAC,OAAO,EAAE,MAAM;IAHpC;;OAEG;IACH,YAAqB,OAAO,EAAE,MAAM,EAGnC;CACF"}

package/dist/errors/missing-ability.error.js

@@ -0,0 +1,19 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+/**
+ * Raised when code that needs the caller's authorization runs without an
+ * ability: `CaslBehavior` did not run for the request, or the code runs outside
+ * a pipeline. A configuration failure, not a denial — map it to a server error,
+ * never to 403.
+ */
+export class MissingAbilityError extends Error {
+    purpose;
+    /**
+     * @param purpose - What needed the ability, named in the message.
+     */
+    constructor(purpose) {
+        super(`No authorization ability is present for ${purpose}.`);
+        this.purpose = purpose;
+        this.name = MissingAbilityError.name;
+    }
+}
+//# sourceMappingURL=missing-ability.error.js.map

package/dist/errors/missing-ability.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-ability.error.js","sourceRoot":"","sources":["../../src/errors/missing-ability.error.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAIvB,OAAO;IAH5B;;OAEG;IACH,YAAqB,OAAe;QAClC,KAAK,CAAC,2CAA2C,OAAO,GAAG,CAAC,CAAC;uBAD1C,OAAO;QAE1B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC;IACvC,CAAC;CACF"}

package/dist/errors/unauthorized-action.exception.d.ts

@@ -0,0 +1,19 @@
+export interface UnauthorizedActionDetails {
+    action: string;
+    subject: string;
+    entityId?: string | number;
+    fields?: string[];
+    reason?: string;
+}
+/**
+ * Exception thrown when an actor attempts an action or field modification
+ * on a subject or entity without the required authorization permissions.
+ */
+export declare class UnauthorizedActionException extends Error {
+    readonly action: string;
+    readonly subject: string;
+    readonly entityId?: string | number;
+    readonly fields?: string[];
+    constructor(details: UnauthorizedActionDetails);
+}
+//# sourceMappingURL=unauthorized-action.exception.d.ts.map

package/dist/errors/unauthorized-action.exception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unauthorized-action.exception.d.ts","sourceRoot":"","sources":["../../src/errors/unauthorized-action.exception.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,YAAY,OAAO,EAAE,yBAAyB,EAgB7C;CACF"}

package/dist/errors/unauthorized-action.exception.js

@@ -0,0 +1,26 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+/**
+ * Exception thrown when an actor attempts an action or field modification
+ * on a subject or entity without the required authorization permissions.
+ */
+export class UnauthorizedActionException extends Error {
+    action;
+    subject;
+    entityId;
+    fields;
+    constructor(details) {
+        const fieldMsg = details.fields?.length
+            ? ` on fields: [${details.fields.join(', ')}]`
+            : '';
+        const idMsg = details.entityId !== undefined ? ` (id=${details.entityId})` : '';
+        const msg = details.reason ??
+            `Access denied: cannot execute "${details.action}" on "${details.subject}"${idMsg}${fieldMsg}.`;
+        super(msg);
+        this.name = 'UnauthorizedActionException';
+        this.action = details.action;
+        this.subject = details.subject;
+        this.entityId = details.entityId;
+        this.fields = details.fields;
+    }
+}
+//# sourceMappingURL=unauthorized-action.exception.js.map

package/dist/errors/unauthorized-action.exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unauthorized-action.exception.js","sourceRoot":"","sources":["../../src/errors/unauthorized-action.exception.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAUtE;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,QAAQ,CAAmB;IAC3B,MAAM,CAAY;IAE3B,YAAY,OAAkC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM;YACrC,CAAC,CAAC,gBAAgB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,GACP,OAAO,CAAC,MAAM;YACd,kCAAkC,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,OAAO,IAAI,KAAK,GAAG,QAAQ,GAAG,CAAC;QAElG,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF"}

package/dist/helpers/ability-digest.d.ts

@@ -0,0 +1,47 @@
+import type { IPipelineContext } from '@cqrs-ddd/pipeline';
+/**
+ * A digest of the permissions the current ability grants: the SHA-256 (hex) of
+ * its rules in order, with every condition already resolved against the
+ * principal. Any change that can change a decision — a rule, its order,
+ * inversion, fields, or a principal value a condition interpolates — changes
+ * the digest.
+ *
+ * Use it as the permission-scope segment of a response cache key, or as an
+ * idempotency replay scope. It identifies a set of permissions, not a caller:
+ * two principals with identical effective rules share a digest, so combine it
+ * with the principal wherever the key must separate callers.
+ *
+ * @param context - The pipeline execution; omitted, the running one.
+ * @returns The 64-character hex digest, or `undefined` when no ability is
+ *   present (`CaslBehavior` has not run, or runs outside a pipeline).
+ * @throws {TypeError} When a rule holds a value that is not plain JSON, such as
+ *   a `RegExp` condition.
+ *
+ * @example
+ * ```ts
+ * const cacheKey = createPartitionedCacheKeyFactory({
+ *   principal: (ctx) => getCaslPrincipal(ctx)?.id,
+ *   scope: abilityDigest,
+ * });
+ * const replay = idempotent({ keyFactory, replayScopeFactory: abilityDigest });
+ * ```
+ */
+export declare function abilityDigest(context?: IPipelineContext): string | undefined;
+/**
+ * {@link abilityDigest}, failing closed: it throws instead of returning
+ * `undefined` when no ability is present. Use it where a missing ability must
+ * stop the operation, such as an idempotency replay scope, whose factory must
+ * throw rather than let an operation run without a scope.
+ *
+ * @param context - The pipeline execution; omitted, the running one.
+ * @returns The 64-character hex digest.
+ * @throws {MissingAbilityError} When no ability is present.
+ * @throws {TypeError} When a rule holds a value that is not plain JSON.
+ *
+ * @example
+ * ```ts
+ * idempotent({ keyFactory, replayScopeFactory: requireAbilityDigest });
+ * ```
+ */
+export declare function requireAbilityDigest(context?: IPipelineContext): string;
+//# sourceMappingURL=ability-digest.d.ts.map

package/dist/helpers/ability-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability-digest.d.ts","sourceRoot":"","sources":["../../src/helpers/ability-digest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK3D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAM5E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMvE"}

package/dist/helpers/ability-digest.js

@@ -0,0 +1,64 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+import { createHash } from 'node:crypto';
+import { stableStringify } from '@cqrs-ddd/safe-stringify';
+import { MissingAbilityError } from '../errors/missing-ability.error.js';
+import { getCaslAbility } from './authorizer.js';
+/**
+ * A digest of the permissions the current ability grants: the SHA-256 (hex) of
+ * its rules in order, with every condition already resolved against the
+ * principal. Any change that can change a decision — a rule, its order,
+ * inversion, fields, or a principal value a condition interpolates — changes
+ * the digest.
+ *
+ * Use it as the permission-scope segment of a response cache key, or as an
+ * idempotency replay scope. It identifies a set of permissions, not a caller:
+ * two principals with identical effective rules share a digest, so combine it
+ * with the principal wherever the key must separate callers.
+ *
+ * @param context - The pipeline execution; omitted, the running one.
+ * @returns The 64-character hex digest, or `undefined` when no ability is
+ *   present (`CaslBehavior` has not run, or runs outside a pipeline).
+ * @throws {TypeError} When a rule holds a value that is not plain JSON, such as
+ *   a `RegExp` condition.
+ *
+ * @example
+ * ```ts
+ * const cacheKey = createPartitionedCacheKeyFactory({
+ *   principal: (ctx) => getCaslPrincipal(ctx)?.id,
+ *   scope: abilityDigest,
+ * });
+ * const replay = idempotent({ keyFactory, replayScopeFactory: abilityDigest });
+ * ```
+ */
+export function abilityDigest(context) {
+    const ability = getCaslAbility(context);
+    if (!ability)
+        return undefined;
+    return createHash('sha256')
+        .update(stableStringify(ability.rules))
+        .digest('hex');
+}
+/**
+ * {@link abilityDigest}, failing closed: it throws instead of returning
+ * `undefined` when no ability is present. Use it where a missing ability must
+ * stop the operation, such as an idempotency replay scope, whose factory must
+ * throw rather than let an operation run without a scope.
+ *
+ * @param context - The pipeline execution; omitted, the running one.
+ * @returns The 64-character hex digest.
+ * @throws {MissingAbilityError} When no ability is present.
+ * @throws {TypeError} When a rule holds a value that is not plain JSON.
+ *
+ * @example
+ * ```ts
+ * idempotent({ keyFactory, replayScopeFactory: requireAbilityDigest });
+ * ```
+ */
+export function requireAbilityDigest(context) {
+    const digest = abilityDigest(context);
+    if (digest === undefined) {
+        throw new MissingAbilityError('an authorization digest');
+    }
+    return digest;
+}
+//# sourceMappingURL=ability-digest.js.map

package/dist/helpers/ability-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability-digest.js","sourceRoot":"","sources":["../../src/helpers/ability-digest.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,aAAa,CAAC,OAA0B;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SACtC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA0B;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/helpers/ability.d.ts

@@ -0,0 +1,52 @@
+import type { CaslPrincipal } from '../interfaces/permission-source.interface.js';
+import type { AppAbility, Capability, CapabilityString } from '../types/casl.types.js';
+/**
+ * Builds the ability for one caller. Every direct rule precedes every inverted
+ * rule (stable within each group), so a deny from any source wins over an allow.
+ * Placeholders resolve against `principal`; a missing attribute throws.
+ *
+ * @throws {TypeError} For a malformed capability or an allow rule with an
+ *   empty `fields` list.
+ *
+ * @example
+ * ```ts
+ * const ability = buildAbility(
+ *   ['User|read|{"department":"${user.department}"}', '!User|read|*|email'],
+ *   { id: 'u-1', department: 'engineering' },
+ * );
+ * ```
+ */
+export declare function buildAbility(rules: readonly (Capability | CapabilityString)[], principal?: CaslPrincipal): AppAbility;
+/**
+ * Resolve template placeholders in a {@link Capability}'s `conditions` against
+ * the current {@link CaslPrincipal}.
+ *
+ * A capability's conditions, whether supplied as an object or parsed from a
+ * compact string, may contain placeholders like `${user.id}` or
+ * `${user.tenantId}` (or `{{ property }}` syntax). At runtime, before CASL can
+ * evaluate the rule, this function replaces each placeholder with the real
+ * value from the authenticated principal.
+ *
+ * Supports nested property access via dot notation (e.g. `${address.city}`).
+ *
+ * A placeholder that cannot be resolved against the principal, or that
+ * resolves to anything other than a string, number, boolean, `null` or an
+ * array of those, throws rather than collapsing to an empty string or
+ * injecting query operators. This fails closed: a condition
+ * such as `{ department: '${department}' }` can never silently become
+ * `{ department: '' }` and match unintended records.
+ *
+ * @throws {Error} When a placeholder references a property absent from the
+ *   principal or resolves to an object.
+ *
+ * @example
+ * ```ts
+ * interpolateConditions({ authorId: '${user.id}' }, { id: 'u-1' })
+ * // → { authorId: 'u-1' }
+ *
+ * interpolateConditions({ level: '${level}' }, { id: 'u-1', level: 3 })
+ * // → { level: 3 }
+ * ```
+ */
+export declare function interpolateConditions(conditions: Record<string, unknown>, principal: CaslPrincipal): Record<string, unknown>;
+//# sourceMappingURL=ability.d.ts.map

package/dist/helpers/ability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability.d.ts","sourceRoot":"","sources":["../../src/helpers/ability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,KAAK,EACV,UAAU,EAEV,UAAU,EACV,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,CAAC,UAAU,GAAG,gBAAgB,CAAC,EAAE,EACjD,SAAS,CAAC,EAAE,aAAa,GACxB,UAAU,CASZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,EAAE,aAAa,GACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB"}

package/dist/helpers/ability.js

@@ -0,0 +1,148 @@
+/* Copyright (C) 2026-present Aristotelis — see repository license. */
+import { createMongoAbility } from '@casl/ability';
+import { isPlainObject, normalizeCapability } from './capability.js';
+/**
+ * Builds the ability for one caller. Every direct rule precedes every inverted
+ * rule (stable within each group), so a deny from any source wins over an allow.
+ * Placeholders resolve against `principal`; a missing attribute throws.
+ *
+ * @throws {TypeError} For a malformed capability or an allow rule with an
+ *   empty `fields` list.
+ *
+ * @example
+ * ```ts
+ * const ability = buildAbility(
+ *   ['User|read|{"department":"${user.department}"}', '!User|read|*|email'],
+ *   { id: 'u-1', department: 'engineering' },
+ * );
+ * ```
+ */
+export function buildAbility(rules, principal) {
+    const normalized = rules.map(normalizeCapability);
+    const ordered = [
+        ...normalized.filter((rule) => !rule.inverted),
+        ...normalized.filter((rule) => rule.inverted),
+    ];
+    return createMongoAbility(ordered.map((rule) => toRawRule(rule, principal)));
+}
+/**
+ * Resolve template placeholders in a {@link Capability}'s `conditions` against
+ * the current {@link CaslPrincipal}.
+ *
+ * A capability's conditions, whether supplied as an object or parsed from a
+ * compact string, may contain placeholders like `${user.id}` or
+ * `${user.tenantId}` (or `{{ property }}` syntax). At runtime, before CASL can
+ * evaluate the rule, this function replaces each placeholder with the real
+ * value from the authenticated principal.
+ *
+ * Supports nested property access via dot notation (e.g. `${address.city}`).
+ *
+ * A placeholder that cannot be resolved against the principal, or that
+ * resolves to anything other than a string, number, boolean, `null` or an
+ * array of those, throws rather than collapsing to an empty string or
+ * injecting query operators. This fails closed: a condition
+ * such as `{ department: '${department}' }` can never silently become
+ * `{ department: '' }` and match unintended records.
+ *
+ * @throws {Error} When a placeholder references a property absent from the
+ *   principal or resolves to an object.
+ *
+ * @example
+ * ```ts
+ * interpolateConditions({ authorId: '${user.id}' }, { id: 'u-1' })
+ * // → { authorId: 'u-1' }
+ *
+ * interpolateConditions({ level: '${level}' }, { id: 'u-1', level: 3 })
+ * // → { level: 3 }
+ * ```
+ */
+export function interpolateConditions(conditions, principal) {
+    return Object.fromEntries(Object.entries(conditions).map(([key, value]) => [
+        key,
+        interpolateValue(value, principal, key),
+    ]));
+}
+function interpolateValue(value, principal, conditionPath) {
+    if (typeof value === 'string') {
+        // If the entire string is a single placeholder, preserve the resolved
+        // value's original type (e.g. a numeric id stays a number).
+        if (/^(\$\{[^}]+\}|\{\{\s*[^}]+?\s*\}\})$/.test(value)) {
+            const prop = value.replace(/^\$\{|\}$|^\{\{\s*|\s*\}\}$/g, '').trim();
+            return resolvePlaceholder(principal, prop, conditionPath);
+        }
+        return value.replace(/\$\{([^}]+)\}|\{\{\s*([^}]+?)\s*\}\}/g, (_, p1, p2) => {
+            const prop = (p1 ?? p2).trim();
+            return String(resolvePlaceholder(principal, prop, conditionPath));
+        });
+    }
+    if (Array.isArray(value)) {
+        return value.map((item, index) => interpolateValue(item, principal, `${conditionPath}[${index}]`));
+    }
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.entries(value).map(([key, nested]) => [
+            key,
+            interpolateValue(nested, principal, `${conditionPath}.${key}`),
+        ]));
+    }
+    return value;
+}
+function resolvePlaceholder(principal, path, conditionPath) {
+    const resolved = getNestedValue(principal, path);
+    if (typeof resolved === 'undefined') {
+        throw new Error(`Cannot interpolate capability condition "${conditionPath}": property "${path}" is missing from the principal.`);
+    }
+    // An object value would be read by CASL as query operators ({ $ne: ... }).
+    if (!isConditionScalar(resolved) &&
+        !(Array.isArray(resolved) && resolved.every(isConditionScalar))) {
+        throw new Error(`Cannot interpolate capability condition "${conditionPath}": property "${path}" must be a scalar or an array of scalars.`);
+    }
+    return resolved;
+}
+function isConditionScalar(value) {
+    return (value === null ||
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean');
+}
+function getNestedValue(obj, path) {
+    const normalizedPath = path.startsWith('user.') ? path.slice(5) : path;
+    const segments = normalizedPath.split('.').filter(Boolean);
+    let current = obj;
+    for (const seg of segments) {
+        if (current !== null &&
+            typeof current === 'object' &&
+            Object.getOwnPropertyDescriptor(current, seg) !== undefined) {
+            current = current[seg];
+        }
+        else {
+            return undefined;
+        }
+    }
+    return current;
+}
+function toRawRule(capability, principal) {
+    const rule = {
+        action: capability.action,
+        subject: capability.subject,
+    };
+    if (capability.inverted) {
+        rule.inverted = true;
+    }
+    if (capability.reason) {
+        rule.reason = capability.reason;
+    }
+    if (capability.fields?.length === 0 && !capability.inverted) {
+        throw new TypeError('Allow capability has an empty fields list, which would grant no fields. ' +
+            'Omit fields for unrestricted access.');
+    }
+    if (capability.fields && capability.fields.length > 0) {
+        rule.fields = capability.fields;
+    }
+    if (capability.conditions) {
+        rule.conditions = principal
+            ? interpolateConditions(capability.conditions, principal)
+            : capability.conditions;
+    }
+    return rule;
+}
+//# sourceMappingURL=ability.js.map

package/dist/helpers/ability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability.js","sourceRoot":"","sources":["../../src/helpers/ability.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAQnD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAErE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAiD,EACjD,SAAyB;IAEzB,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9C,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC9C,CAAC;IACF,OAAO,kBAAkB,CACvB,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAmC,EACnC,SAAwB;IAExB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC/C,GAAG;QACH,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC;KACxC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,SAAwB,EACxB,aAAqB;IAErB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,OAAO,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,KAAK,CAAC,OAAO,CAClB,uCAAuC,EACvC,CAAC,CAAC,EAAE,EAAsB,EAAE,EAAU,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACpE,CAAC,CACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/B,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,GAAG,CAAC,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,GAAG,EAAE,CAAC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAwB,EACxB,IAAY,EACZ,aAAqB;IAErB,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4CAA4C,aAAa,gBAAgB,IAAI,kCAAkC,CAChH,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,IACE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4CAA4C,aAAa,gBAAgB,IAAI,4CAA4C,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB,EAAE,IAAY;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,GAAY,GAAG,CAAC;IAE3B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IACE,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC3B,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,SAAS,EAC3D,CAAC;YACD,OAAO,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAChB,UAAsB,EACtB,SAAoC;IAEpC,MAAM,IAAI,GAAe;QACvB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;IAEF,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CACjB,0EAA0E;YACxE,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,SAAS;YACzB,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC;YACzD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}