@cullet/erp-core 1.3.0 → 1.4.0

package/dist/policy-bridge.cjs

@@ -0,0 +1,437 @@
+const require_authorization_error = require("./authorization-error.cjs");
+const require_validation_code = require("./validation-code.cjs");
+const require_validation_field = require("./validation-field.cjs");
+const require_validation_exception = require("./validation-exception.cjs");
+const require_requested_by = require("./requested-by.cjs");
+const require_value_object = require("./value-object.cjs");
+const require_result = require("./result.cjs");
+//#region src/core/rbac/authorizer.ts
+const REQUIRED_FIELD = require_validation_field.ValidationField.of("required");
+/**
+* The pure RBAC decisor. Given an {@link AccessRequest} and the {@link Grant}s
+* already loaded for the actor, it answers "may this actor do this?" with no
+* I/O — no storage, no network, no clock — returning a {@link Result}. An
+* authorization *decision* is never thrown, always a value, mirroring the
+* "errors as values" contract of `UseCase`/`PolicyService`. Loading the grants
+* is the consumer's job (behind an `AuthorizerPort` adapter); this class only
+* decides.
+*
+* The one thing it *does* throw is {@link InvalidValueException} when the caller
+* misuses the API by passing a wildcard `required` permission — that is a
+* programming error surfaced loudly, not an authorization outcome.
+*/
+var RbacAuthorizer = class {
+	/**
+	* Decides the request against the supplied grants. The checks run
+	* role → capability → scope so the denial reason is the most informative
+	* one available:
+	*
+	* 1. no grant for the actor → `missing_role`;
+	* 2. has grants but none grants the permission → `missing_capability`;
+	* 3. grants the permission but not in scope → `out_of_scope`;
+	* 4. otherwise → ALLOW (`Result.ok`).
+	*
+	* @throws {@link InvalidValueException} when `request.required` is a wildcard
+	*   permission (only *granted* permissions may wildcard, never the *required*
+	*   one).
+	*/
+	authorize(request, grants) {
+		if (request.required.hasWildcard()) throw new require_validation_exception.InvalidValueException(REQUIRED_FIELD, require_validation_code.ValidationCode.INVALID_FORMAT, `AccessRequest.required must be a concrete permission, not a wildcard, got "${request.required.toPrimitive()}"`);
+		const required = {
+			capability: request.required.toPrimitive(),
+			scope: request.scope.toPrimitive()
+		};
+		const metadata = {
+			action: request.action,
+			resource: request.resource,
+			actor: { userId: request.actor.raw },
+			required
+		};
+		const actorGrants = grants.filter((grant) => grant.appliesTo(request.actor));
+		if (actorGrants.length === 0) return require_result.Result.err(require_authorization_error.AuthorizationError.missingRole(metadata));
+		const withPermission = actorGrants.filter((grant) => grant.role.grants(request.required));
+		if (withPermission.length === 0) return require_result.Result.err(require_authorization_error.AuthorizationError.missingCapability(metadata));
+		if (withPermission.filter((grant) => grant.scope.includes(request.scope)).length === 0) return require_result.Result.err(require_authorization_error.AuthorizationError.outOfScope(metadata));
+		return require_result.Result.ok(void 0);
+	}
+};
+//#endregion
+//#region src/core/rbac/domain/permission.ts
+const PERMISSION_FIELD = require_validation_field.ValidationField.of("permission");
+const SEGMENT_PATTERN = /^(?:\*|[a-z0-9_-]+)$/u;
+/**
+* A `"<resource>:<action>"` capability such as `"orders:cancel"`, with a
+* single-level wildcard. Either segment may be the whole-segment wildcard `*`
+* (`"orders:*"`, `"*:cancel"`, `"*:*"`), which is what lets a broad grant cover
+* a narrower requirement — see {@link implies}.
+*
+* A zod-free value object: it validates its own format on construction
+* (throwing {@link InvalidValueException}) and is frozen thereafter. Build one
+* through {@link of} (from a raw `"resource:action"` string) or {@link for}
+* (from already-separated parts); the constructor is private.
+*/
+var Permission = class Permission extends require_value_object.ValueObject {
+	constructor(props) {
+		super(props);
+		this.finalize();
+	}
+	/**
+	* Parses a `"resource:action"` string. Throws {@link InvalidValueException}
+	* when the string is blank, lacks exactly one `:`, or carries an invalid
+	* segment.
+	*/
+	static of(raw) {
+		if (typeof raw !== "string" || raw.trim().length === 0) throw new require_validation_exception.InvalidValueException(PERMISSION_FIELD, require_validation_code.ValidationCode.BLANK, `permission must be a non-empty "resource:action" string, got "${raw}"`);
+		const parts = raw.split(":");
+		if (parts.length !== 2) throw new require_validation_exception.InvalidValueException(PERMISSION_FIELD, require_validation_code.ValidationCode.INVALID_FORMAT, `permission must have exactly one ":" separating resource and action, got "${raw}"`);
+		return Permission.for(parts[0], parts[1]);
+	}
+	/**
+	* Builds from already-separated `resource` and `action` parts. Each must be
+	* a valid segment (`[a-z0-9_-]+` or the whole-segment wildcard `*`).
+	*/
+	static for(resource, action) {
+		Permission.assertSegment(resource, "resource");
+		Permission.assertSegment(action, "action");
+		return new Permission({
+			resource,
+			action
+		});
+	}
+	static assertSegment(value, label) {
+		if (typeof value !== "string" || !SEGMENT_PATTERN.test(value)) throw new require_validation_exception.InvalidValueException(PERMISSION_FIELD.nested(label), require_validation_code.ValidationCode.INVALID_FORMAT, `permission ${label} must match [a-z0-9_-]+ or be the whole-segment wildcard "*" (no partial wildcards), got "${value}"`);
+	}
+	get resource() {
+		return this.value.resource;
+	}
+	get action() {
+		return this.value.action;
+	}
+	/**
+	* Whether holding this permission grants `other`. A `*` segment matches any
+	* value in the same position, so `"orders:*"` implies `"orders:cancel"` and
+	* `"*:*"` implies everything. Concrete segments must match exactly.
+	*/
+	implies(other) {
+		return (this.resource === "*" || this.resource === other.resource) && (this.action === "*" || this.action === other.action);
+	}
+	/**
+	* Whether either segment is the whole-segment wildcard `*`. A *granted*
+	* permission may wildcard (see {@link implies}); a *required* one may not —
+	* `RbacAuthorizer` rejects a wildcard requirement as caller misuse.
+	*/
+	hasWildcard() {
+		return this.value.resource === "*" || this.value.action === "*";
+	}
+	toPrimitive() {
+		return `${this.value.resource}:${this.value.action}`;
+	}
+};
+//#endregion
+//#region src/core/rbac/domain/role.ts
+const ROLE_FIELD = require_validation_field.ValidationField.of("role");
+/**
+* A named bundle of {@link Permission}s — `"cashier"`, `"manager"`, `"admin"`.
+* There is **no role hierarchy** in v1: a role grants exactly the permissions
+* it lists (wildcards included). Duplicate permissions are collapsed on
+* construction, preserving first-seen order.
+*
+* A zod-free value object. Build through {@link of}; reconstruct a serialized
+* one through {@link fromProps}.
+*/
+var Role = class Role extends require_value_object.ValueObject {
+	constructor(props) {
+		super(props);
+		this._permissions = this.value.permissions.map(Permission.of);
+		this.finalize();
+	}
+	/**
+	* Builds a role from a name and its permissions. Throws
+	* {@link InvalidValueException} when the name is blank. Duplicate
+	* permissions are deduplicated.
+	*/
+	static of(name, permissions) {
+		if (typeof name !== "string" || name.trim().length === 0) throw new require_validation_exception.InvalidValueException(ROLE_FIELD, require_validation_code.ValidationCode.BLANK, `role name must be a non-empty string, got "${name}"`);
+		const seen = /* @__PURE__ */ new Set();
+		const deduped = [];
+		for (const permission of permissions) {
+			const primitive = permission.toPrimitive();
+			if (seen.has(primitive)) continue;
+			seen.add(primitive);
+			deduped.push(primitive);
+		}
+		return new Role({
+			name,
+			permissions: deduped
+		});
+	}
+	/**
+	* Rebuilds a role from its serialized {@link RoleProps} — the inverse of
+	* {@link toPrimitive}. Each stored string is re-parsed through
+	* {@link Permission.of}, so a malformed payload still fails loudly.
+	*/
+	static fromProps(props) {
+		return Role.of(props.name, props.permissions.map(Permission.of));
+	}
+	get name() {
+		return this.value.name;
+	}
+	/** The role's permissions, rehydrated from their stored primitive form. */
+	get permissions() {
+		return this._permissions;
+	}
+	/** Whether any permission in this role {@link Permission.implies | implies} `required`. */
+	grants(required) {
+		return this._permissions.some((permission) => permission.implies(required));
+	}
+	toPrimitive() {
+		return {
+			name: this.value.name,
+			permissions: [...this.value.permissions]
+		};
+	}
+};
+//#endregion
+//#region src/core/rbac/domain/scope.ts
+const SCOPE_FIELD = require_validation_field.ValidationField.of("scope");
+const SCOPE_PATTERN = /^[a-z][a-z0-9_-]*:[A-Za-z0-9._-]+$/u;
+/**
+* Where a grant (or a target resource) lives, aligned with
+* `AuthorizationRequirement.scope` and the policy `PolicyScope`
+* (`tenantId`/`schoolId`): `"tenant:{id}"`, `"school:{id}"`, or the global
+* `"*"`.
+*
+* v1 keeps containment ({@link includes}) flat — the global scope contains
+* everything, and any other scope contains only itself. A real hierarchy
+* (`tenant` ⊇ `school`) is a deliberately deferred extension point.
+*/
+var Scope = class Scope extends require_value_object.ValueObject {
+	constructor(props) {
+		super(props);
+		this.finalize();
+	}
+	/** Validates `"type:id"` or the global `"*"`, throwing on anything else. */
+	static of(raw) {
+		if (typeof raw !== "string" || raw.trim().length === 0) throw new require_validation_exception.InvalidValueException(SCOPE_FIELD, require_validation_code.ValidationCode.BLANK, `scope must be a non-empty "type:id" string or "*", got "${raw}"`);
+		if (raw !== "*" && !SCOPE_PATTERN.test(raw)) throw new require_validation_exception.InvalidValueException(SCOPE_FIELD, require_validation_code.ValidationCode.INVALID_FORMAT, `scope must be "type:id" (e.g. "school:42") or the global "*", got "${raw}"`);
+		return new Scope({ raw });
+	}
+	/** The global scope `"*"`, which {@link includes} every other scope. */
+	static global() {
+		return new Scope({ raw: "*" });
+	}
+	/** The type segment, or `"*"` for the global scope. */
+	get type() {
+		if (this.value.raw === "*") return "*";
+		return this.value.raw.slice(0, this.value.raw.indexOf(":"));
+	}
+	/** The id segment, or `undefined` for the global scope. */
+	get id() {
+		if (this.value.raw === "*") return void 0;
+		return this.value.raw.slice(this.value.raw.indexOf(":") + 1);
+	}
+	/**
+	* Whether this scope contains `target`. The global scope contains
+	* everything; any other scope contains only an exact match of itself.
+	*/
+	includes(target) {
+		if (this.value.raw === "*") return true;
+		return this.value.raw === target.value.raw;
+	}
+	toPrimitive() {
+		return this.value.raw;
+	}
+};
+//#endregion
+//#region src/core/rbac/domain/grant.ts
+/**
+* A role binding — it ties one actor to one {@link Role} within one
+* {@link Scope}. This is the unit the consumer stores (a `(subject, role,
+* scope)` row) and rehydrates into the pure decisor; the kit itself persists
+* nothing.
+*
+* A zod-free value object built through {@link of} from live
+* `RequestedBy`/`Role`/`Scope` objects; the getters reconstruct those objects
+* back from the frozen primitive form.
+*/
+var Grant = class Grant extends require_value_object.ValueObject {
+	constructor(props) {
+		super(props);
+		this._subject = require_requested_by.RequestedBy.parse(this.value.subject);
+		this._role = Role.fromProps(this.value.role);
+		this._scope = Scope.of(this.value.scope);
+		this.finalize();
+	}
+	static of(params) {
+		return new Grant({
+			subject: params.subject.raw,
+			role: params.role.toPrimitive(),
+			scope: params.scope.toPrimitive()
+		});
+	}
+	/**
+	* Rebuilds a grant from its serialized {@link GrantProps} — the inverse of
+	* {@link toPrimitive}, symmetric to {@link Role.fromProps}. Each part is
+	* re-validated (subject through {@link RequestedBy.parse}, role through
+	* {@link Role.fromProps}, scope through {@link Scope.of}), so a malformed
+	* payload still fails loudly.
+	*/
+	static fromProps(props) {
+		return new Grant(props);
+	}
+	get subject() {
+		return this._subject;
+	}
+	get role() {
+		return this._role;
+	}
+	get scope() {
+		return this._scope;
+	}
+	/** Whether this grant belongs to `actor`. */
+	appliesTo(actor) {
+		return this.value.subject === actor.raw;
+	}
+	toPrimitive() {
+		return {
+			subject: this.value.subject,
+			role: {
+				name: this.value.role.name,
+				permissions: [...this.value.role.permissions]
+			},
+			scope: this.value.scope
+		};
+	}
+};
+//#endregion
+//#region src/core/rbac/domain/permission-set.ts
+/**
+* The flattened, deduplicated permissions an actor effectively holds across a
+* set of {@link Grant}s, together with the role names that contributed them.
+*
+* Pure resolution, isolated from the decisor so the "roles → permissions"
+* collapse can be tested on its own. Build through {@link fromGrants}; pre-filter
+* the grants to a single actor first when that matters (the set does not know
+* which actor it describes).
+*/
+var PermissionSet = class PermissionSet {
+	constructor(permissions, _roleNames) {
+		this.permissions = permissions;
+		this._roleNames = _roleNames;
+	}
+	/**
+	* Collapses the roles across `grants` into one permission set. Permissions
+	* are deduplicated by their primitive form and role names by value, both
+	* preserving first-seen order.
+	*/
+	static fromGrants(grants) {
+		const permissions = [];
+		const seenPermissions = /* @__PURE__ */ new Set();
+		const roleNames = [];
+		const seenRoles = /* @__PURE__ */ new Set();
+		for (const grant of grants) {
+			const role = grant.role;
+			if (!seenRoles.has(role.name)) {
+				seenRoles.add(role.name);
+				roleNames.push(role.name);
+			}
+			for (const permission of role.permissions) {
+				const primitive = permission.toPrimitive();
+				if (seenPermissions.has(primitive)) continue;
+				seenPermissions.add(primitive);
+				permissions.push(permission);
+			}
+		}
+		return new PermissionSet(permissions, roleNames);
+	}
+	/** Whether any held permission {@link Permission.implies | implies} `required`. */
+	has(required) {
+		return this.permissions.some((permission) => permission.implies(required));
+	}
+	/** The effective permissions, deduplicated. */
+	toArray() {
+		return this.permissions;
+	}
+	/** The names of the roles that contributed to this set, deduplicated. */
+	get roleNames() {
+		return this._roleNames;
+	}
+};
+//#endregion
+//#region src/core/rbac/policy-bridge.ts
+/**
+* Projects an actor's RBAC facts into flat {@link PolicyContext}-style fields so
+* a declarative gate policy can reason over them (ABAC) — without importing the
+* policy engine or `zod`. It only builds a plain object; the consumer merges it
+* into `seed.fields` of `PolicyService.evaluate(...)`.
+*
+* The grants are filtered to `actor` first, so passing an actor's full grant
+* list (or a mixed one) is safe.
+*
+* **Wildcards are projected literally — they are NOT expanded.** `actor.roles`
+* and `actor.permissions` are the exact stored strings, so a permission such as
+* `"orders:*"` or `"*:*"` appears verbatim. A gate condition like
+* `{ field: "actor.permissions", op: "in", value: "orders:cancel" }` does a
+* *literal* membership test and will therefore NOT match a holder of
+* `"orders:*"`. Open-ended wildcards cannot be enumerated into a finite list, so
+* for wildcard-aware checks either match on the finite `actor.roles` instead, or
+* make the wildcard-aware decision with `RbacAuthorizer` (which knows
+* {@link Permission.implies}) and use the gate only for the extra ABAC
+* conditions.
+*
+* @returns `{ "actor.id", "actor.roles", "actor.permissions" }`, where roles and
+*   permissions are plain string arrays (wildcards left literal).
+*/
+function rbacContextFields(actor, grants) {
+	const set = PermissionSet.fromGrants(grants.filter((grant) => grant.appliesTo(actor)));
+	return {
+		"actor.id": actor.raw,
+		"actor.roles": [...set.roleNames],
+		"actor.permissions": set.toArray().map((permission) => permission.toPrimitive())
+	};
+}
+//#endregion
+Object.defineProperty(exports, "Grant", {
+	enumerable: true,
+	get: function() {
+		return Grant;
+	}
+});
+Object.defineProperty(exports, "Permission", {
+	enumerable: true,
+	get: function() {
+		return Permission;
+	}
+});
+Object.defineProperty(exports, "PermissionSet", {
+	enumerable: true,
+	get: function() {
+		return PermissionSet;
+	}
+});
+Object.defineProperty(exports, "RbacAuthorizer", {
+	enumerable: true,
+	get: function() {
+		return RbacAuthorizer;
+	}
+});
+Object.defineProperty(exports, "Role", {
+	enumerable: true,
+	get: function() {
+		return Role;
+	}
+});
+Object.defineProperty(exports, "Scope", {
+	enumerable: true,
+	get: function() {
+		return Scope;
+	}
+});
+Object.defineProperty(exports, "rbacContextFields", {
+	enumerable: true,
+	get: function() {
+		return rbacContextFields;
+	}
+});
+
+//# sourceMappingURL=policy-bridge.cjs.map

package/dist/policy-bridge.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-bridge.cjs","names":["ValidationField","InvalidValueException","ValidationCode","Result","AuthorizationError","ValidationField","ValueObject","InvalidValueException","ValidationCode","ValidationField","ValueObject","InvalidValueException","ValidationCode","ValidationField","ValueObject","InvalidValueException","ValidationCode","ValueObject","RequestedBy"],"sources":["../src/core/rbac/authorizer.ts","../src/core/rbac/domain/permission.ts","../src/core/rbac/domain/role.ts","../src/core/rbac/domain/scope.ts","../src/core/rbac/domain/grant.ts","../src/core/rbac/domain/permission-set.ts","../src/core/rbac/policy-bridge.ts"],"sourcesContent":["import {\n    AuthorizationError,\n    type AuthorizationRequirement,\n} from \"../errors/authorization-error.js\";\nimport { ValidationCode } from \"../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../exceptions/validation-field.js\";\nimport { Result } from \"../result/result.js\";\n\nimport type { AccessRequest } from \"./access-request.js\";\nimport type { Grant } from \"./domain/grant.js\";\n\nconst REQUIRED_FIELD = ValidationField.of(\"required\");\n\n/**\n * The pure RBAC decisor. Given an {@link AccessRequest} and the {@link Grant}s\n * already loaded for the actor, it answers \"may this actor do this?\" with no\n * I/O — no storage, no network, no clock — returning a {@link Result}. An\n * authorization *decision* is never thrown, always a value, mirroring the\n * \"errors as values\" contract of `UseCase`/`PolicyService`. Loading the grants\n * is the consumer's job (behind an `AuthorizerPort` adapter); this class only\n * decides.\n *\n * The one thing it *does* throw is {@link InvalidValueException} when the caller\n * misuses the API by passing a wildcard `required` permission — that is a\n * programming error surfaced loudly, not an authorization outcome.\n */\nclass RbacAuthorizer {\n    /**\n     * Decides the request against the supplied grants. The checks run\n     * role → capability → scope so the denial reason is the most informative\n     * one available:\n     *\n     * 1. no grant for the actor → `missing_role`;\n     * 2. has grants but none grants the permission → `missing_capability`;\n     * 3. grants the permission but not in scope → `out_of_scope`;\n     * 4. otherwise → ALLOW (`Result.ok`).\n     *\n     * @throws {@link InvalidValueException} when `request.required` is a wildcard\n     *   permission (only *granted* permissions may wildcard, never the *required*\n     *   one).\n     */\n    authorize(\n        request: AccessRequest,\n        grants: readonly Grant[],\n    ): Result<void, AuthorizationError> {\n        if (request.required.hasWildcard()) {\n            throw new InvalidValueException(\n                REQUIRED_FIELD,\n                ValidationCode.INVALID_FORMAT,\n                `AccessRequest.required must be a concrete permission, not a wildcard, got \"${request.required.toPrimitive()}\"`,\n            );\n        }\n\n        const required: AuthorizationRequirement = {\n            capability: request.required.toPrimitive(),\n            scope: request.scope.toPrimitive(),\n        };\n        const metadata = {\n            action: request.action,\n            resource: request.resource,\n            actor: { userId: request.actor.raw },\n            required,\n        };\n\n        const actorGrants = grants.filter((grant) =>\n            grant.appliesTo(request.actor),\n        );\n        if (actorGrants.length === 0) {\n            return Result.err(AuthorizationError.missingRole(metadata));\n        }\n\n        const withPermission = actorGrants.filter((grant) =>\n            grant.role.grants(request.required),\n        );\n        if (withPermission.length === 0) {\n            return Result.err(AuthorizationError.missingCapability(metadata));\n        }\n\n        const inScope = withPermission.filter((grant) =>\n            grant.scope.includes(request.scope),\n        );\n        if (inScope.length === 0) {\n            return Result.err(AuthorizationError.outOfScope(metadata));\n        }\n\n        return Result.ok(undefined);\n    }\n}\n\nexport { RbacAuthorizer };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\n\n/** The two halves of a permission: what is acted on, and what is done to it. */\ntype PermissionProps = {\n    readonly resource: string;\n    readonly action: string;\n};\n\nconst PERMISSION_FIELD = ValidationField.of(\"permission\");\n\n// A segment is either a whole-segment wildcard (`*`) or a run of lowercase\n// alphanumerics, hyphens and underscores. Partial wildcards (`ord*`) are\n// rejected on purpose: a `*` only ever stands for an entire segment.\nconst SEGMENT_PATTERN = /^(?:\\*|[a-z0-9_-]+)$/u;\n\n/**\n * A `\"<resource>:<action>\"` capability such as `\"orders:cancel\"`, with a\n * single-level wildcard. Either segment may be the whole-segment wildcard `*`\n * (`\"orders:*\"`, `\"*:cancel\"`, `\"*:*\"`), which is what lets a broad grant cover\n * a narrower requirement — see {@link implies}.\n *\n * A zod-free value object: it validates its own format on construction\n * (throwing {@link InvalidValueException}) and is frozen thereafter. Build one\n * through {@link of} (from a raw `\"resource:action\"` string) or {@link for}\n * (from already-separated parts); the constructor is private.\n */\nclass Permission extends ValueObject<PermissionProps, string> {\n    private constructor(props: PermissionProps) {\n        super(props);\n        this.finalize();\n    }\n\n    /**\n     * Parses a `\"resource:action\"` string. Throws {@link InvalidValueException}\n     * when the string is blank, lacks exactly one `:`, or carries an invalid\n     * segment.\n     */\n    static of(raw: string): Permission {\n        if (typeof raw !== \"string\" || raw.trim().length === 0) {\n            throw new InvalidValueException(\n                PERMISSION_FIELD,\n                ValidationCode.BLANK,\n                `permission must be a non-empty \"resource:action\" string, got \"${raw}\"`,\n            );\n        }\n\n        const parts = raw.split(\":\");\n        if (parts.length !== 2) {\n            throw new InvalidValueException(\n                PERMISSION_FIELD,\n                ValidationCode.INVALID_FORMAT,\n                `permission must have exactly one \":\" separating resource and action, got \"${raw}\"`,\n            );\n        }\n\n        return Permission.for(parts[0], parts[1]);\n    }\n\n    /**\n     * Builds from already-separated `resource` and `action` parts. Each must be\n     * a valid segment (`[a-z0-9_-]+` or the whole-segment wildcard `*`).\n     */\n    static for(resource: string, action: string): Permission {\n        Permission.assertSegment(resource, \"resource\");\n        Permission.assertSegment(action, \"action\");\n        return new Permission({ resource, action });\n    }\n\n    private static assertSegment(\n        value: string,\n        label: \"resource\" | \"action\",\n    ): void {\n        if (typeof value !== \"string\" || !SEGMENT_PATTERN.test(value)) {\n            throw new InvalidValueException(\n                PERMISSION_FIELD.nested(label),\n                ValidationCode.INVALID_FORMAT,\n                `permission ${label} must match [a-z0-9_-]+ or be the whole-segment wildcard \"*\" (no partial wildcards), got \"${value}\"`,\n            );\n        }\n    }\n\n    get resource(): string {\n        return this.value.resource;\n    }\n\n    get action(): string {\n        return this.value.action;\n    }\n\n    /**\n     * Whether holding this permission grants `other`. A `*` segment matches any\n     * value in the same position, so `\"orders:*\"` implies `\"orders:cancel\"` and\n     * `\"*:*\"` implies everything. Concrete segments must match exactly.\n     */\n    implies(other: Permission): boolean {\n        return (\n            (this.resource === \"*\" || this.resource === other.resource) &&\n            (this.action === \"*\" || this.action === other.action)\n        );\n    }\n\n    /**\n     * Whether either segment is the whole-segment wildcard `*`. A *granted*\n     * permission may wildcard (see {@link implies}); a *required* one may not —\n     * `RbacAuthorizer` rejects a wildcard requirement as caller misuse.\n     */\n    hasWildcard(): boolean {\n        return this.value.resource === \"*\" || this.value.action === \"*\";\n    }\n\n    toPrimitive(): string {\n        return `${this.value.resource}:${this.value.action}`;\n    }\n}\n\nexport { Permission, type PermissionProps };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\n\nimport { Permission } from \"./permission.js\";\n\n/**\n * The serializable shape of a role: a name plus its permissions kept as their\n * primitive `\"resource:action\"` strings (so the role round-trips through JSON\n * and stays deep-frozen). The {@link Role.permissions} getter rehydrates them\n * back into {@link Permission} objects.\n */\ntype RoleProps = {\n    readonly name: string;\n    readonly permissions: readonly string[];\n};\n\nconst ROLE_FIELD = ValidationField.of(\"role\");\n\n/**\n * A named bundle of {@link Permission}s — `\"cashier\"`, `\"manager\"`, `\"admin\"`.\n * There is **no role hierarchy** in v1: a role grants exactly the permissions\n * it lists (wildcards included). Duplicate permissions are collapsed on\n * construction, preserving first-seen order.\n *\n * A zod-free value object. Build through {@link of}; reconstruct a serialized\n * one through {@link fromProps}.\n */\nclass Role extends ValueObject<RoleProps, RoleProps> {\n    // Parsed once, at construction, and cached: the decisor calls `grants` (and\n    // `PermissionSet` reads `permissions`) repeatedly, so re-parsing the stored\n    // strings on every access would be wasted work.\n    private readonly _permissions: readonly Permission[];\n\n    private constructor(props: RoleProps) {\n        super(props);\n        this._permissions = this.value.permissions.map(Permission.of);\n        this.finalize();\n    }\n\n    /**\n     * Builds a role from a name and its permissions. Throws\n     * {@link InvalidValueException} when the name is blank. Duplicate\n     * permissions are deduplicated.\n     */\n    static of(name: string, permissions: readonly Permission[]): Role {\n        if (typeof name !== \"string\" || name.trim().length === 0) {\n            throw new InvalidValueException(\n                ROLE_FIELD,\n                ValidationCode.BLANK,\n                `role name must be a non-empty string, got \"${name}\"`,\n            );\n        }\n\n        const seen = new Set<string>();\n        const deduped: string[] = [];\n        for (const permission of permissions) {\n            const primitive = permission.toPrimitive();\n            if (seen.has(primitive)) continue;\n            seen.add(primitive);\n            deduped.push(primitive);\n        }\n\n        return new Role({ name, permissions: deduped });\n    }\n\n    /**\n     * Rebuilds a role from its serialized {@link RoleProps} — the inverse of\n     * {@link toPrimitive}. Each stored string is re-parsed through\n     * {@link Permission.of}, so a malformed payload still fails loudly.\n     */\n    static fromProps(props: RoleProps): Role {\n        return Role.of(props.name, props.permissions.map(Permission.of));\n    }\n\n    get name(): string {\n        return this.value.name;\n    }\n\n    /** The role's permissions, rehydrated from their stored primitive form. */\n    get permissions(): readonly Permission[] {\n        return this._permissions;\n    }\n\n    /** Whether any permission in this role {@link Permission.implies | implies} `required`. */\n    grants(required: Permission): boolean {\n        return this._permissions.some((permission) =>\n            permission.implies(required),\n        );\n    }\n\n    toPrimitive(): RoleProps {\n        return {\n            name: this.value.name,\n            permissions: [...this.value.permissions],\n        };\n    }\n}\n\nexport { Role, type RoleProps };\n","import { ValidationCode } from \"../../exceptions/validation-code.js\";\nimport { InvalidValueException } from \"../../exceptions/validation-exception.js\";\nimport { ValidationField } from \"../../exceptions/validation-field.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\n\n/** The wrapped, already-validated scope string (`\"type:id\"` or `\"*\"`). */\ntype ScopeProps = { readonly raw: string };\n\nconst SCOPE_FIELD = ValidationField.of(\"scope\");\n\n// \"type:id\": a lowercase type segment, a colon, then a non-empty id. The id\n// charset is permissive enough for UUIDs and numeric keys (`school:42`,\n// `tenant:550e8400-e29b-41d4-a716-446655440000`).\nconst SCOPE_PATTERN = /^[a-z][a-z0-9_-]*:[A-Za-z0-9._-]+$/u;\n\n/**\n * Where a grant (or a target resource) lives, aligned with\n * `AuthorizationRequirement.scope` and the policy `PolicyScope`\n * (`tenantId`/`schoolId`): `\"tenant:{id}\"`, `\"school:{id}\"`, or the global\n * `\"*\"`.\n *\n * v1 keeps containment ({@link includes}) flat — the global scope contains\n * everything, and any other scope contains only itself. A real hierarchy\n * (`tenant` ⊇ `school`) is a deliberately deferred extension point.\n */\nclass Scope extends ValueObject<ScopeProps, string> {\n    private constructor(props: ScopeProps) {\n        super(props);\n        this.finalize();\n    }\n\n    /** Validates `\"type:id\"` or the global `\"*\"`, throwing on anything else. */\n    static of(raw: string): Scope {\n        if (typeof raw !== \"string\" || raw.trim().length === 0) {\n            throw new InvalidValueException(\n                SCOPE_FIELD,\n                ValidationCode.BLANK,\n                `scope must be a non-empty \"type:id\" string or \"*\", got \"${raw}\"`,\n            );\n        }\n\n        if (raw !== \"*\" && !SCOPE_PATTERN.test(raw)) {\n            throw new InvalidValueException(\n                SCOPE_FIELD,\n                ValidationCode.INVALID_FORMAT,\n                `scope must be \"type:id\" (e.g. \"school:42\") or the global \"*\", got \"${raw}\"`,\n            );\n        }\n\n        return new Scope({ raw });\n    }\n\n    /** The global scope `\"*\"`, which {@link includes} every other scope. */\n    static global(): Scope {\n        return new Scope({ raw: \"*\" });\n    }\n\n    /** The type segment, or `\"*\"` for the global scope. */\n    get type(): string {\n        if (this.value.raw === \"*\") return \"*\";\n        return this.value.raw.slice(0, this.value.raw.indexOf(\":\"));\n    }\n\n    /** The id segment, or `undefined` for the global scope. */\n    get id(): string | undefined {\n        if (this.value.raw === \"*\") return undefined;\n        return this.value.raw.slice(this.value.raw.indexOf(\":\") + 1);\n    }\n\n    /**\n     * Whether this scope contains `target`. The global scope contains\n     * everything; any other scope contains only an exact match of itself.\n     */\n    includes(target: Scope): boolean {\n        if (this.value.raw === \"*\") return true;\n        return this.value.raw === target.value.raw;\n    }\n\n    toPrimitive(): string {\n        return this.value.raw;\n    }\n}\n\nexport { Scope, type ScopeProps };\n","import { RequestedBy } from \"../../application/commands/requested-by.js\";\nimport { ValueObject } from \"../../domain/value-object.js\";\n\nimport { Role, type RoleProps } from \"./role.js\";\nimport { Scope } from \"./scope.js\";\n\n/**\n * The serializable shape a consumer persists and loads: the actor's identity\n * (`RequestedBy.raw`), the role they hold (as {@link RoleProps}), and the scope\n * the role applies in (the {@link Scope} string).\n */\ntype GrantProps = {\n    readonly subject: string;\n    readonly role: RoleProps;\n    readonly scope: string;\n};\n\n/**\n * A role binding — it ties one actor to one {@link Role} within one\n * {@link Scope}. This is the unit the consumer stores (a `(subject, role,\n * scope)` row) and rehydrates into the pure decisor; the kit itself persists\n * nothing.\n *\n * A zod-free value object built through {@link of} from live\n * `RequestedBy`/`Role`/`Scope` objects; the getters reconstruct those objects\n * back from the frozen primitive form.\n */\nclass Grant extends ValueObject<GrantProps, GrantProps> {\n    // The live objects are rehydrated once, at construction, and cached — the\n    // decisor reads `role`/`scope` at least once per grant, so parsing lazily on\n    // each getter access would re-parse the same frozen primitives repeatedly.\n    private readonly _subject: RequestedBy;\n    private readonly _role: Role;\n    private readonly _scope: Scope;\n\n    private constructor(props: GrantProps) {\n        super(props);\n        this._subject = RequestedBy.parse(this.value.subject);\n        this._role = Role.fromProps(this.value.role);\n        this._scope = Scope.of(this.value.scope);\n        this.finalize();\n    }\n\n    static of(params: {\n        subject: RequestedBy;\n        role: Role;\n        scope: Scope;\n    }): Grant {\n        return new Grant({\n            subject: params.subject.raw,\n            role: params.role.toPrimitive(),\n            scope: params.scope.toPrimitive(),\n        });\n    }\n\n    /**\n     * Rebuilds a grant from its serialized {@link GrantProps} — the inverse of\n     * {@link toPrimitive}, symmetric to {@link Role.fromProps}. Each part is\n     * re-validated (subject through {@link RequestedBy.parse}, role through\n     * {@link Role.fromProps}, scope through {@link Scope.of}), so a malformed\n     * payload still fails loudly.\n     */\n    static fromProps(props: GrantProps): Grant {\n        return new Grant(props);\n    }\n\n    get subject(): RequestedBy {\n        return this._subject;\n    }\n\n    get role(): Role {\n        return this._role;\n    }\n\n    get scope(): Scope {\n        return this._scope;\n    }\n\n    /** Whether this grant belongs to `actor`. */\n    appliesTo(actor: RequestedBy): boolean {\n        return this.value.subject === actor.raw;\n    }\n\n    toPrimitive(): GrantProps {\n        return {\n            subject: this.value.subject,\n            role: {\n                name: this.value.role.name,\n                permissions: [...this.value.role.permissions],\n            },\n            scope: this.value.scope,\n        };\n    }\n}\n\nexport { Grant, type GrantProps };\n","import type { Grant } from \"./grant.js\";\nimport type { Permission } from \"./permission.js\";\n\n/**\n * The flattened, deduplicated permissions an actor effectively holds across a\n * set of {@link Grant}s, together with the role names that contributed them.\n *\n * Pure resolution, isolated from the decisor so the \"roles → permissions\"\n * collapse can be tested on its own. Build through {@link fromGrants}; pre-filter\n * the grants to a single actor first when that matters (the set does not know\n * which actor it describes).\n */\nclass PermissionSet {\n    private constructor(\n        private readonly permissions: readonly Permission[],\n        private readonly _roleNames: readonly string[],\n    ) {}\n\n    /**\n     * Collapses the roles across `grants` into one permission set. Permissions\n     * are deduplicated by their primitive form and role names by value, both\n     * preserving first-seen order.\n     */\n    static fromGrants(grants: readonly Grant[]): PermissionSet {\n        const permissions: Permission[] = [];\n        const seenPermissions = new Set<string>();\n        const roleNames: string[] = [];\n        const seenRoles = new Set<string>();\n\n        for (const grant of grants) {\n            const role = grant.role;\n\n            if (!seenRoles.has(role.name)) {\n                seenRoles.add(role.name);\n                roleNames.push(role.name);\n            }\n\n            for (const permission of role.permissions) {\n                const primitive = permission.toPrimitive();\n                if (seenPermissions.has(primitive)) continue;\n                seenPermissions.add(primitive);\n                permissions.push(permission);\n            }\n        }\n\n        return new PermissionSet(permissions, roleNames);\n    }\n\n    /** Whether any held permission {@link Permission.implies | implies} `required`. */\n    has(required: Permission): boolean {\n        return this.permissions.some((permission) =>\n            permission.implies(required),\n        );\n    }\n\n    /** The effective permissions, deduplicated. */\n    toArray(): readonly Permission[] {\n        return this.permissions;\n    }\n\n    /** The names of the roles that contributed to this set, deduplicated. */\n    get roleNames(): readonly string[] {\n        return this._roleNames;\n    }\n}\n\nexport { PermissionSet };\n","import type { RequestedBy } from \"../application/commands/requested-by.js\";\n\nimport type { Grant } from \"./domain/grant.js\";\nimport { PermissionSet } from \"./domain/permission-set.js\";\n\n/**\n * Projects an actor's RBAC facts into flat {@link PolicyContext}-style fields so\n * a declarative gate policy can reason over them (ABAC) — without importing the\n * policy engine or `zod`. It only builds a plain object; the consumer merges it\n * into `seed.fields` of `PolicyService.evaluate(...)`.\n *\n * The grants are filtered to `actor` first, so passing an actor's full grant\n * list (or a mixed one) is safe.\n *\n * **Wildcards are projected literally — they are NOT expanded.** `actor.roles`\n * and `actor.permissions` are the exact stored strings, so a permission such as\n * `\"orders:*\"` or `\"*:*\"` appears verbatim. A gate condition like\n * `{ field: \"actor.permissions\", op: \"in\", value: \"orders:cancel\" }` does a\n * *literal* membership test and will therefore NOT match a holder of\n * `\"orders:*\"`. Open-ended wildcards cannot be enumerated into a finite list, so\n * for wildcard-aware checks either match on the finite `actor.roles` instead, or\n * make the wildcard-aware decision with `RbacAuthorizer` (which knows\n * {@link Permission.implies}) and use the gate only for the extra ABAC\n * conditions.\n *\n * @returns `{ \"actor.id\", \"actor.roles\", \"actor.permissions\" }`, where roles and\n *   permissions are plain string arrays (wildcards left literal).\n */\nexport function rbacContextFields(\n    actor: RequestedBy,\n    grants: readonly Grant[],\n): Record<string, unknown> {\n    const set = PermissionSet.fromGrants(\n        grants.filter((grant) => grant.appliesTo(actor)),\n    );\n\n    return {\n        \"actor.id\": actor.raw,\n        \"actor.roles\": [...set.roleNames],\n        \"actor.permissions\": set\n            .toArray()\n            .map((permission) => permission.toPrimitive()),\n    };\n}\n"],"mappings":";;;;;;;;AAYA,MAAM,iBAAiBA,yBAAAA,gBAAgB,GAAG,UAAU;;;;;;;;;;;;;;AAepD,IAAM,iBAAN,MAAqB;;;;;;;;;;;;;;;CAejB,UACI,SACA,QACgC;EAChC,IAAI,QAAQ,SAAS,YAAY,GAC7B,MAAM,IAAIC,6BAAAA,sBACN,gBACAC,wBAAAA,eAAe,gBACf,8EAA8E,QAAQ,SAAS,YAAY,EAAE,EACjH;EAGJ,MAAM,WAAqC;GACvC,YAAY,QAAQ,SAAS,YAAY;GACzC,OAAO,QAAQ,MAAM,YAAY;EACrC;EACA,MAAM,WAAW;GACb,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GAClB,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI;GACnC;EACJ;EAEA,MAAM,cAAc,OAAO,QAAQ,UAC/B,MAAM,UAAU,QAAQ,KAAK,CACjC;EACA,IAAI,YAAY,WAAW,GACvB,OAAOC,eAAAA,OAAO,IAAIC,4BAAAA,mBAAmB,YAAY,QAAQ,CAAC;EAG9D,MAAM,iBAAiB,YAAY,QAAQ,UACvC,MAAM,KAAK,OAAO,QAAQ,QAAQ,CACtC;EACA,IAAI,eAAe,WAAW,GAC1B,OAAOD,eAAAA,OAAO,IAAIC,4BAAAA,mBAAmB,kBAAkB,QAAQ,CAAC;EAMpE,IAHgB,eAAe,QAAQ,UACnC,MAAM,MAAM,SAAS,QAAQ,KAAK,CAE5B,EAAE,WAAW,GACnB,OAAOD,eAAAA,OAAO,IAAIC,4BAAAA,mBAAmB,WAAW,QAAQ,CAAC;EAG7D,OAAOD,eAAAA,OAAO,GAAG,KAAA,CAAS;CAC9B;AACJ;;;AC7EA,MAAM,mBAAmBE,yBAAAA,gBAAgB,GAAG,YAAY;AAKxD,MAAM,kBAAkB;;;;;;;;;;;;AAaxB,IAAM,aAAN,MAAM,mBAAmBC,qBAAAA,YAAqC;CAC1D,YAAoB,OAAwB;EACxC,MAAM,KAAK;EACX,KAAK,SAAS;CAClB;;;;;;CAOA,OAAO,GAAG,KAAyB;EAC/B,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,GACjD,MAAM,IAAIC,6BAAAA,sBACN,kBACAC,wBAAAA,eAAe,OACf,iEAAiE,IAAI,EACzE;EAGJ,MAAM,QAAQ,IAAI,MAAM,GAAG;EAC3B,IAAI,MAAM,WAAW,GACjB,MAAM,IAAID,6BAAAA,sBACN,kBACAC,wBAAAA,eAAe,gBACf,6EAA6E,IAAI,EACrF;EAGJ,OAAO,WAAW,IAAI,MAAM,IAAI,MAAM,EAAE;CAC5C;;;;;CAMA,OAAO,IAAI,UAAkB,QAA4B;EACrD,WAAW,cAAc,UAAU,UAAU;EAC7C,WAAW,cAAc,QAAQ,QAAQ;EACzC,OAAO,IAAI,WAAW;GAAE;GAAU;EAAO,CAAC;CAC9C;CAEA,OAAe,cACX,OACA,OACI;EACJ,IAAI,OAAO,UAAU,YAAY,CAAC,gBAAgB,KAAK,KAAK,GACxD,MAAM,IAAID,6BAAAA,sBACN,iBAAiB,OAAO,KAAK,GAC7BC,wBAAAA,eAAe,gBACf,cAAc,MAAM,4FAA4F,MAAM,EAC1H;CAER;CAEA,IAAI,WAAmB;EACnB,OAAO,KAAK,MAAM;CACtB;CAEA,IAAI,SAAiB;EACjB,OAAO,KAAK,MAAM;CACtB;;;;;;CAOA,QAAQ,OAA4B;EAChC,QACK,KAAK,aAAa,OAAO,KAAK,aAAa,MAAM,cACjD,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CAEtD;;;;;;CAOA,cAAuB;EACnB,OAAO,KAAK,MAAM,aAAa,OAAO,KAAK,MAAM,WAAW;CAChE;CAEA,cAAsB;EAClB,OAAO,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM;CAChD;AACJ;;;AClGA,MAAM,aAAaC,yBAAAA,gBAAgB,GAAG,MAAM;;;;;;;;;;AAW5C,IAAM,OAAN,MAAM,aAAaC,qBAAAA,YAAkC;CAMjD,YAAoB,OAAkB;EAClC,MAAM,KAAK;EACX,KAAK,eAAe,KAAK,MAAM,YAAY,IAAI,WAAW,EAAE;EAC5D,KAAK,SAAS;CAClB;;;;;;CAOA,OAAO,GAAG,MAAc,aAA0C;EAC9D,IAAI,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,WAAW,GACnD,MAAM,IAAIC,6BAAAA,sBACN,YACAC,wBAAAA,eAAe,OACf,8CAA8C,KAAK,EACvD;EAGJ,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,UAAoB,CAAC;EAC3B,KAAK,MAAM,cAAc,aAAa;GAClC,MAAM,YAAY,WAAW,YAAY;GACzC,IAAI,KAAK,IAAI,SAAS,GAAG;GACzB,KAAK,IAAI,SAAS;GAClB,QAAQ,KAAK,SAAS;EAC1B;EAEA,OAAO,IAAI,KAAK;GAAE;GAAM,aAAa;EAAQ,CAAC;CAClD;;;;;;CAOA,OAAO,UAAU,OAAwB;EACrC,OAAO,KAAK,GAAG,MAAM,MAAM,MAAM,YAAY,IAAI,WAAW,EAAE,CAAC;CACnE;CAEA,IAAI,OAAe;EACf,OAAO,KAAK,MAAM;CACtB;;CAGA,IAAI,cAAqC;EACrC,OAAO,KAAK;CAChB;;CAGA,OAAO,UAA+B;EAClC,OAAO,KAAK,aAAa,MAAM,eAC3B,WAAW,QAAQ,QAAQ,CAC/B;CACJ;CAEA,cAAyB;EACrB,OAAO;GACH,MAAM,KAAK,MAAM;GACjB,aAAa,CAAC,GAAG,KAAK,MAAM,WAAW;EAC3C;CACJ;AACJ;;;AC1FA,MAAM,cAAcC,yBAAAA,gBAAgB,GAAG,OAAO;AAK9C,MAAM,gBAAgB;;;;;;;;;;;AAYtB,IAAM,QAAN,MAAM,cAAcC,qBAAAA,YAAgC;CAChD,YAAoB,OAAmB;EACnC,MAAM,KAAK;EACX,KAAK,SAAS;CAClB;;CAGA,OAAO,GAAG,KAAoB;EAC1B,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,GACjD,MAAM,IAAIC,6BAAAA,sBACN,aACAC,wBAAAA,eAAe,OACf,2DAA2D,IAAI,EACnE;EAGJ,IAAI,QAAQ,OAAO,CAAC,cAAc,KAAK,GAAG,GACtC,MAAM,IAAID,6BAAAA,sBACN,aACAC,wBAAAA,eAAe,gBACf,sEAAsE,IAAI,EAC9E;EAGJ,OAAO,IAAI,MAAM,EAAE,IAAI,CAAC;CAC5B;;CAGA,OAAO,SAAgB;EACnB,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,CAAC;CACjC;;CAGA,IAAI,OAAe;EACf,IAAI,KAAK,MAAM,QAAQ,KAAK,OAAO;EACnC,OAAO,KAAK,MAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,QAAQ,GAAG,CAAC;CAC9D;;CAGA,IAAI,KAAyB;EACzB,IAAI,KAAK,MAAM,QAAQ,KAAK,OAAO,KAAA;EACnC,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,QAAQ,GAAG,IAAI,CAAC;CAC/D;;;;;CAMA,SAAS,QAAwB;EAC7B,IAAI,KAAK,MAAM,QAAQ,KAAK,OAAO;EACnC,OAAO,KAAK,MAAM,QAAQ,OAAO,MAAM;CAC3C;CAEA,cAAsB;EAClB,OAAO,KAAK,MAAM;CACtB;AACJ;;;;;;;;;;;;;ACtDA,IAAM,QAAN,MAAM,cAAcC,qBAAAA,YAAoC;CAQpD,YAAoB,OAAmB;EACnC,MAAM,KAAK;EACX,KAAK,WAAWC,qBAAAA,YAAY,MAAM,KAAK,MAAM,OAAO;EACpD,KAAK,QAAQ,KAAK,UAAU,KAAK,MAAM,IAAI;EAC3C,KAAK,SAAS,MAAM,GAAG,KAAK,MAAM,KAAK;EACvC,KAAK,SAAS;CAClB;CAEA,OAAO,GAAG,QAIA;EACN,OAAO,IAAI,MAAM;GACb,SAAS,OAAO,QAAQ;GACxB,MAAM,OAAO,KAAK,YAAY;GAC9B,OAAO,OAAO,MAAM,YAAY;EACpC,CAAC;CACL;;;;;;;;CASA,OAAO,UAAU,OAA0B;EACvC,OAAO,IAAI,MAAM,KAAK;CAC1B;CAEA,IAAI,UAAuB;EACvB,OAAO,KAAK;CAChB;CAEA,IAAI,OAAa;EACb,OAAO,KAAK;CAChB;CAEA,IAAI,QAAe;EACf,OAAO,KAAK;CAChB;;CAGA,UAAU,OAA6B;EACnC,OAAO,KAAK,MAAM,YAAY,MAAM;CACxC;CAEA,cAA0B;EACtB,OAAO;GACH,SAAS,KAAK,MAAM;GACpB,MAAM;IACF,MAAM,KAAK,MAAM,KAAK;IACtB,aAAa,CAAC,GAAG,KAAK,MAAM,KAAK,WAAW;GAChD;GACA,OAAO,KAAK,MAAM;EACtB;CACJ;AACJ;;;;;;;;;;;;ACjFA,IAAM,gBAAN,MAAM,cAAc;CAChB,YACI,aACA,YACF;EAFmB,KAAA,cAAA;EACA,KAAA,aAAA;CAClB;;;;;;CAOH,OAAO,WAAW,QAAyC;EACvD,MAAM,cAA4B,CAAC;EACnC,MAAM,kCAAkB,IAAI,IAAY;EACxC,MAAM,YAAsB,CAAC;EAC7B,MAAM,4BAAY,IAAI,IAAY;EAElC,KAAK,MAAM,SAAS,QAAQ;GACxB,MAAM,OAAO,MAAM;GAEnB,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI,GAAG;IAC3B,UAAU,IAAI,KAAK,IAAI;IACvB,UAAU,KAAK,KAAK,IAAI;GAC5B;GAEA,KAAK,MAAM,cAAc,KAAK,aAAa;IACvC,MAAM,YAAY,WAAW,YAAY;IACzC,IAAI,gBAAgB,IAAI,SAAS,GAAG;IACpC,gBAAgB,IAAI,SAAS;IAC7B,YAAY,KAAK,UAAU;GAC/B;EACJ;EAEA,OAAO,IAAI,cAAc,aAAa,SAAS;CACnD;;CAGA,IAAI,UAA+B;EAC/B,OAAO,KAAK,YAAY,MAAM,eAC1B,WAAW,QAAQ,QAAQ,CAC/B;CACJ;;CAGA,UAAiC;EAC7B,OAAO,KAAK;CAChB;;CAGA,IAAI,YAA+B;EAC/B,OAAO,KAAK;CAChB;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;ACpCA,SAAgB,kBACZ,OACA,QACuB;CACvB,MAAM,MAAM,cAAc,WACtB,OAAO,QAAQ,UAAU,MAAM,UAAU,KAAK,CAAC,CACnD;CAEA,OAAO;EACH,YAAY,MAAM;EAClB,eAAe,CAAC,GAAG,IAAI,SAAS;EAChC,qBAAqB,IAChB,QAAQ,EACR,KAAK,eAAe,WAAW,YAAY,CAAC;CACrD;AACJ"}