@cullet/erp-core 1.3.0 → 1.4.0

package/dist/application/index.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_use_case = require("../use-case.cjs");
+const require_requested_by = require("../requested-by.cjs");
 const require_temporal_use_case = require("../temporal-use-case.cjs");
 Object.defineProperty(exports, "Command", {
 	enumerable: true,
@@ -13,7 +14,7 @@ Object.defineProperty(exports, "Query", {
 		return require_temporal_use_case.Query;
 	}
 });
-exports.RequestedBy = require_temporal_use_case.RequestedBy;
+exports.RequestedBy = require_requested_by.RequestedBy;
 exports.TemporalUseCase = require_temporal_use_case.TemporalUseCase;
 Object.defineProperty(exports, "UseCase", {
 	enumerable: true,

package/dist/application/index.d.cts

@@ -1,2 +1,3 @@
-import { A as MetricLabels, C as RequestedByKind, D as TraceAttributeValue, E as UseCaseObservability, M as LogPayload, N as LoggerPort, O as TraceSpan, S as RequestedBy, T as UseCase, _ as PolicyEvaluationOutput, a as TemporalContext, b as Command, c as CacheStrategy, d as mapPolicyEvaluationError, f as TemporalHistory, g as PolicyEvaluationInput, h as ResultRepository, i as CreateTemporalContextInput, j as MetricsPort, k as TracerPort, l as Page, m as Repository, n as TemporalUseCaseInput, o as assertTemporalContext, p as TemporalRepository, r as TemporalizedContextSeed, s as createTemporalContext, t as TemporalUseCase, u as Query, v as PolicyPort, w as MaybePromise, x as CommandInput, y as PolicyPortError } from "../temporal-use-case.cjs";
+import { n as RequestedByKind, t as RequestedBy } from "../requested-by.cjs";
+import { A as LogPayload, C as UseCase, D as TracerPort, E as TraceSpan, O as MetricLabels, S as MaybePromise, T as TraceAttributeValue, _ as PolicyEvaluationOutput, a as TemporalContext, b as Command, c as CacheStrategy, d as mapPolicyEvaluationError, f as TemporalHistory, g as PolicyEvaluationInput, h as ResultRepository, i as CreateTemporalContextInput, j as LoggerPort, k as MetricsPort, l as Page, m as Repository, n as TemporalUseCaseInput, o as assertTemporalContext, p as TemporalRepository, r as TemporalizedContextSeed, s as createTemporalContext, t as TemporalUseCase, u as Query, v as PolicyPort, w as UseCaseObservability, x as CommandInput, y as PolicyPortError } from "../temporal-use-case.cjs";
 export { CacheStrategy, Command, CommandInput, CreateTemporalContextInput, LogPayload, LoggerPort, MaybePromise, MetricLabels, MetricsPort, Page, PolicyEvaluationInput, PolicyEvaluationOutput, PolicyPort, PolicyPortError, Query, Repository, RequestedBy, RequestedByKind, ResultRepository, TemporalContext, TemporalHistory, TemporalRepository, TemporalUseCase, TemporalUseCaseInput, TemporalizedContextSeed, TraceAttributeValue, TraceSpan, TracerPort, UseCase, UseCaseObservability, assertTemporalContext, createTemporalContext, mapPolicyEvaluationError };

package/dist/application/index.d.ts

@@ -1,2 +1,3 @@
-import { A as MetricLabels, C as RequestedByKind, D as TraceAttributeValue, E as UseCaseObservability, M as LogPayload, N as LoggerPort, O as TraceSpan, S as RequestedBy, T as UseCase, _ as PolicyEvaluationOutput, a as TemporalContext, b as Command, c as CacheStrategy, d as mapPolicyEvaluationError, f as TemporalHistory, g as PolicyEvaluationInput, h as ResultRepository, i as CreateTemporalContextInput, j as MetricsPort, k as TracerPort, l as Page, m as Repository, n as TemporalUseCaseInput, o as assertTemporalContext, p as TemporalRepository, r as TemporalizedContextSeed, s as createTemporalContext, t as TemporalUseCase, u as Query, v as PolicyPort, w as MaybePromise, x as CommandInput, y as PolicyPortError } from "../temporal-use-case.js";
+import { n as RequestedByKind, t as RequestedBy } from "../requested-by.js";
+import { A as LogPayload, C as UseCase, D as TracerPort, E as TraceSpan, O as MetricLabels, S as MaybePromise, T as TraceAttributeValue, _ as PolicyEvaluationOutput, a as TemporalContext, b as Command, c as CacheStrategy, d as mapPolicyEvaluationError, f as TemporalHistory, g as PolicyEvaluationInput, h as ResultRepository, i as CreateTemporalContextInput, j as LoggerPort, k as MetricsPort, l as Page, m as Repository, n as TemporalUseCaseInput, o as assertTemporalContext, p as TemporalRepository, r as TemporalizedContextSeed, s as createTemporalContext, t as TemporalUseCase, u as Query, v as PolicyPort, w as UseCaseObservability, x as CommandInput, y as PolicyPortError } from "../temporal-use-case.js";
 export { CacheStrategy, Command, CommandInput, CreateTemporalContextInput, LogPayload, LoggerPort, MaybePromise, MetricLabels, MetricsPort, Page, PolicyEvaluationInput, PolicyEvaluationOutput, PolicyPort, PolicyPortError, Query, Repository, RequestedBy, RequestedByKind, ResultRepository, TemporalContext, TemporalHistory, TemporalRepository, TemporalUseCase, TemporalUseCaseInput, TemporalizedContextSeed, TraceAttributeValue, TraceSpan, TracerPort, UseCase, UseCaseObservability, assertTemporalContext, createTemporalContext, mapPolicyEvaluationError };

package/dist/application/index.js

@@ -1,3 +1,4 @@
 import { t as UseCase } from "../use-case.js";
-import { a as mapPolicyEvaluationError, i as Query, n as assertTemporalContext, o as Command, r as createTemporalContext, s as RequestedBy, t as TemporalUseCase } from "../temporal-use-case.js";
+import { t as RequestedBy } from "../requested-by.js";
+import { a as mapPolicyEvaluationError, i as Query, n as assertTemporalContext, o as Command, r as createTemporalContext, t as TemporalUseCase } from "../temporal-use-case.js";
 export { Command, Query, RequestedBy, TemporalUseCase, UseCase, assertTemporalContext, createTemporalContext, mapPolicyEvaluationError };

package/dist/authorization-error.cjs

@@ -0,0 +1,157 @@
+const require_app_error = require("./app-error.cjs");
+//#region src/core/errors/authorization-error.ts
+/**
+* Raised when an authenticated actor is not allowed to perform a business
+* action — the "you may not" error, distinct from authentication ("who are
+* you"). Maps to an HTTP 403 at the edge.
+*
+* The discriminating {@link reason} records *why* access was denied (a flat
+* forbid, a missing role/capability, an out-of-scope target, or a policy
+* decision) so the boundary can shape the response without re-deriving it. The
+* metadata is deliberately built around a stable business `action` and a
+* type/id resource reference rather than an HTTP route or full payload, keeping
+* sensitive data out of logs. Instances are frozen. Construct through the
+* static factories, never directly.
+*/
+var AuthorizationError = class AuthorizationError extends require_app_error.AppError {
+	constructor(params) {
+		super(params.message, params.code, {
+			cause: params.cause,
+			metadata: params.metadata,
+			type: params.type,
+			severity: params.severity,
+			correlationId: params.correlationId,
+			requestId: params.requestId,
+			commandId: params.commandId,
+			createdAtIso: params.createdAtIso,
+			publicMessage: params.publicMessage
+		});
+		this.reason = params.reason;
+		Object.freeze(this);
+	}
+	/**
+	* A flat denial with no more specific reason — the actor simply may not
+	* perform this action. Reach for a more precise factory
+	* ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},
+	* {@link AuthorizationError.policyDenied}) when the cause is known.
+	*/
+	static forbidden(input) {
+		return new AuthorizationError({
+			message: "Action not allowed",
+			code: require_app_error.ErrorCodes.authorization.forbidden,
+			reason: "forbidden",
+			metadata: {
+				reason: "forbidden",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The action was denied by an evaluated policy. Captures the deciding
+	* policy's id, version, and evaluation instant into the metadata (with
+	* `decision: "deny"`) so the denial is auditable back to the exact policy
+	* that produced it.
+	*
+	* @param input - Factory options plus the required `policyId`,
+	*   `policyVersion`, and `evaluatedAtIso` of the deciding policy.
+	*/
+	static policyDenied(input) {
+		return new AuthorizationError({
+			message: "Action denied by policy",
+			code: require_app_error.ErrorCodes.authorization.policyDenied,
+			reason: "policy_denied",
+			metadata: {
+				reason: "policy_denied",
+				...extractMetadataOnly(input),
+				decision: "deny"
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The actor holds no role at all that bears on the action — the most basic
+	* denial, distinct from {@link AuthorizationError.missingCapability} (which
+	* means the actor *has* roles, just none granting the required capability).
+	* The expected {@link AuthorizationRequirement} is recorded so the boundary
+	* can tell the caller what grant is missing.
+	*
+	* @param input - Factory options plus the `required` role/capability/scope.
+	*/
+	static missingRole(input) {
+		return new AuthorizationError({
+			message: "Missing required role to perform the action",
+			code: require_app_error.ErrorCodes.authorization.missingRole,
+			reason: "missing_role",
+			metadata: {
+				reason: "missing_role",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The actor lacks a required role or capability. The expected
+	* {@link AuthorizationRequirement} is recorded so the boundary can tell the
+	* caller precisely what grant is missing.
+	*
+	* @param input - Factory options plus the `required` role/capability/scope.
+	*/
+	static missingCapability(input) {
+		return new AuthorizationError({
+			message: "Insufficient capability to perform the action",
+			code: require_app_error.ErrorCodes.authorization.missingCapability,
+			reason: "missing_capability",
+			metadata: {
+				reason: "missing_capability",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The actor may perform the action in general, but not on *this* target —
+	* the resource falls outside the actor's permitted scope (e.g. a different
+	* school or tenant than the one they are bound to).
+	*
+	* @param input - Factory options plus the optional `required` scope that the
+	*   target failed to satisfy.
+	*/
+	static outOfScope(input) {
+		return new AuthorizationError({
+			message: "Action outside the allowed scope",
+			code: require_app_error.ErrorCodes.authorization.outOfScope,
+			reason: "out_of_scope",
+			metadata: {
+				reason: "out_of_scope",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+};
+function extractAppErrorOptions(options) {
+	return {
+		cause: options?.cause,
+		type: options?.type,
+		severity: options?.severity,
+		correlationId: options?.correlationId,
+		requestId: options?.requestId,
+		commandId: options?.commandId,
+		createdAtIso: options?.createdAtIso,
+		publicMessage: options?.publicMessage
+	};
+}
+function extractMetadataOnly(input) {
+	const { cause, type, severity, correlationId, requestId, commandId, createdAtIso, publicMessage, ...metadata } = input;
+	return metadata;
+}
+//#endregion
+Object.defineProperty(exports, "AuthorizationError", {
+	enumerable: true,
+	get: function() {
+		return AuthorizationError;
+	}
+});
+
+//# sourceMappingURL=authorization-error.cjs.map

package/dist/authorization-error.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-error.cjs","names":["AppError","ErrorCodes"],"sources":["../src/core/errors/authorization-error.ts"],"sourcesContent":["import { AppError } from \"./app-error.js\";\nimport { ErrorCodes } from \"./error-codes.js\";\nimport type { AppErrorOptions, ErrorSeverity } from \"./types.js\";\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────────────────\n\ntype AuthorizationErrorReason =\n    | \"forbidden\"\n    | \"missing_role\"\n    | \"missing_capability\"\n    | \"out_of_scope\"\n    | \"outside_time_window\"\n    | \"policy_denied\"\n    | \"unknown\";\n\ntype AuthorizationRequirement = {\n    role?: string;\n    capability?: string;\n    scope?: string; // e.g.: \"school:{id}\" or \"class:{id}\"\n};\n\ntype AuthorizationErrorMetadata = {\n    reason: AuthorizationErrorReason;\n\n    /** Stable action you evaluated (not an HTTP route — a \"business action\") */\n    action: string;\n\n    /** Resource identification (without leaking the full payload) */\n    resource?: { type: string; id?: string };\n\n    /** Optional: actor (do not include sensitive data) */\n    actor?: { userId: string; role?: string };\n\n    /** Optional: expected requirement */\n    required?: AuthorizationRequirement;\n\n    /** Optional: policy (when you already have PolicyEvaluation or similar) */\n    policyId?: string;\n    policyVersion?: number;\n    evaluatedAtIso?: string;\n    decision?: \"allow\" | \"deny\";\n    reasonCode?: string;\n\n    /** Optional: additional non-sensitive info */\n    details?: string;\n};\n\n/**\n * Options for AuthorizationError factory methods.\n * Combines metadata fields (except 'reason') with common AppError options.\n */\ntype AuthorizationErrorFactoryOptions = Omit<\n    AuthorizationErrorMetadata,\n    \"reason\"\n> &\n    Omit<AppErrorOptions, \"metadata\">;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// AuthorizationError\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Raised when an authenticated actor is not allowed to perform a business\n * action — the \"you may not\" error, distinct from authentication (\"who are\n * you\"). Maps to an HTTP 403 at the edge.\n *\n * The discriminating {@link reason} records *why* access was denied (a flat\n * forbid, a missing role/capability, an out-of-scope target, or a policy\n * decision) so the boundary can shape the response without re-deriving it. The\n * metadata is deliberately built around a stable business `action` and a\n * type/id resource reference rather than an HTTP route or full payload, keeping\n * sensitive data out of logs. Instances are frozen. Construct through the\n * static factories, never directly.\n */\nclass AuthorizationError extends AppError {\n    public readonly reason: AuthorizationErrorReason;\n\n    private constructor(params: {\n        message: string;\n        code: string;\n        reason: AuthorizationErrorReason;\n        metadata: AuthorizationErrorMetadata;\n        cause?: unknown;\n        type?: string;\n        severity?: ErrorSeverity;\n        correlationId?: string;\n        requestId?: string;\n        commandId?: string;\n        createdAtIso?: string;\n        publicMessage?: string;\n    }) {\n        super(params.message, params.code, {\n            cause: params.cause,\n            metadata: params.metadata,\n            type: params.type,\n            severity: params.severity,\n            correlationId: params.correlationId,\n            requestId: params.requestId,\n            commandId: params.commandId,\n            createdAtIso: params.createdAtIso,\n            publicMessage: params.publicMessage,\n        });\n\n        this.reason = params.reason;\n        Object.freeze(this);\n    }\n\n    // ─────────────────────────────────────────────────────────────────────────\n    // Factories\n    // ─────────────────────────────────────────────────────────────────────────\n\n    /**\n     * A flat denial with no more specific reason — the actor simply may not\n     * perform this action. Reach for a more precise factory\n     * ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},\n     * {@link AuthorizationError.policyDenied}) when the cause is known.\n     */\n    static forbidden(\n        input: AuthorizationErrorFactoryOptions,\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Action not allowed\",\n            code: ErrorCodes.authorization.forbidden,\n            reason: \"forbidden\",\n            metadata: { reason: \"forbidden\", ...extractMetadataOnly(input) },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The action was denied by an evaluated policy. Captures the deciding\n     * policy's id, version, and evaluation instant into the metadata (with\n     * `decision: \"deny\"`) so the denial is auditable back to the exact policy\n     * that produced it.\n     *\n     * @param input - Factory options plus the required `policyId`,\n     *   `policyVersion`, and `evaluatedAtIso` of the deciding policy.\n     */\n    static policyDenied(\n        input: AuthorizationErrorFactoryOptions & {\n            policyId: string;\n            policyVersion: number;\n            evaluatedAtIso: string;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Action denied by policy\",\n            code: ErrorCodes.authorization.policyDenied,\n            reason: \"policy_denied\",\n            metadata: {\n                reason: \"policy_denied\",\n                ...extractMetadataOnly(input),\n                decision: \"deny\",\n            },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The actor holds no role at all that bears on the action — the most basic\n     * denial, distinct from {@link AuthorizationError.missingCapability} (which\n     * means the actor *has* roles, just none granting the required capability).\n     * The expected {@link AuthorizationRequirement} is recorded so the boundary\n     * can tell the caller what grant is missing.\n     *\n     * @param input - Factory options plus the `required` role/capability/scope.\n     */\n    static missingRole(\n        input: AuthorizationErrorFactoryOptions & {\n            required: AuthorizationRequirement;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Missing required role to perform the action\",\n            code: ErrorCodes.authorization.missingRole,\n            reason: \"missing_role\",\n            metadata: {\n                reason: \"missing_role\",\n                ...extractMetadataOnly(input),\n            },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The actor lacks a required role or capability. The expected\n     * {@link AuthorizationRequirement} is recorded so the boundary can tell the\n     * caller precisely what grant is missing.\n     *\n     * @param input - Factory options plus the `required` role/capability/scope.\n     */\n    static missingCapability(\n        input: AuthorizationErrorFactoryOptions & {\n            required: AuthorizationRequirement;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Insufficient capability to perform the action\",\n            code: ErrorCodes.authorization.missingCapability,\n            reason: \"missing_capability\",\n            metadata: {\n                reason: \"missing_capability\",\n                ...extractMetadataOnly(input),\n            },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The actor may perform the action in general, but not on *this* target —\n     * the resource falls outside the actor's permitted scope (e.g. a different\n     * school or tenant than the one they are bound to).\n     *\n     * @param input - Factory options plus the optional `required` scope that the\n     *   target failed to satisfy.\n     */\n    static outOfScope(\n        input: AuthorizationErrorFactoryOptions & {\n            required?: AuthorizationRequirement;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Action outside the allowed scope\",\n            code: ErrorCodes.authorization.outOfScope,\n            reason: \"out_of_scope\",\n            metadata: { reason: \"out_of_scope\", ...extractMetadataOnly(input) },\n            ...extractAppErrorOptions(input),\n        });\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction extractAppErrorOptions(options?: Partial<AppErrorOptions>) {\n    return {\n        cause: options?.cause,\n        type: options?.type,\n        severity: options?.severity,\n        correlationId: options?.correlationId,\n        requestId: options?.requestId,\n        commandId: options?.commandId,\n        createdAtIso: options?.createdAtIso,\n        publicMessage: options?.publicMessage,\n    };\n}\n\nfunction extractMetadataOnly(\n    input: AuthorizationErrorFactoryOptions,\n): Omit<AuthorizationErrorMetadata, \"reason\"> {\n    const {\n        cause,\n        type,\n        severity,\n        correlationId,\n        requestId,\n        commandId,\n        createdAtIso,\n        publicMessage,\n        ...metadata\n    } = input;\n    return metadata;\n}\n\nexport { AuthorizationError };\nexport type {\n    AuthorizationErrorMetadata,\n    AuthorizationErrorReason,\n    AuthorizationRequirement,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA4EA,IAAM,qBAAN,MAAM,2BAA2BA,kBAAAA,SAAS;CAGtC,YAAoB,QAajB;EACC,MAAM,OAAO,SAAS,OAAO,MAAM;GAC/B,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,eAAe,OAAO;GACtB,WAAW,OAAO;GAClB,WAAW,OAAO;GAClB,cAAc,OAAO;GACrB,eAAe,OAAO;EAC1B,CAAC;EAED,KAAK,SAAS,OAAO;EACrB,OAAO,OAAO,IAAI;CACtB;;;;;;;CAYA,OAAO,UACH,OACkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAMC,kBAAAA,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IAAE,QAAQ;IAAa,GAAG,oBAAoB,KAAK;GAAE;GAC/D,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;;;CAWA,OAAO,aACH,OAKkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAMA,kBAAAA,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IACN,QAAQ;IACR,GAAG,oBAAoB,KAAK;IAC5B,UAAU;GACd;GACA,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;;;CAWA,OAAO,YACH,OAGkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAMA,kBAAAA,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IACN,QAAQ;IACR,GAAG,oBAAoB,KAAK;GAChC;GACA,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;CASA,OAAO,kBACH,OAGkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAMA,kBAAAA,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IACN,QAAQ;IACR,GAAG,oBAAoB,KAAK;GAChC;GACA,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;;CAUA,OAAO,WACH,OAGkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAMA,kBAAAA,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IAAE,QAAQ;IAAgB,GAAG,oBAAoB,KAAK;GAAE;GAClE,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;AACJ;AAMA,SAAS,uBAAuB,SAAoC;CAChE,OAAO;EACH,OAAO,SAAS;EAChB,MAAM,SAAS;EACf,UAAU,SAAS;EACnB,eAAe,SAAS;EACxB,WAAW,SAAS;EACpB,WAAW,SAAS;EACpB,cAAc,SAAS;EACvB,eAAe,SAAS;CAC5B;AACJ;AAEA,SAAS,oBACL,OAC0C;CAC1C,MAAM,EACF,OACA,MACA,UACA,eACA,WACA,WACA,cACA,eACA,GAAG,aACH;CACJ,OAAO;AACX"}

package/dist/authorization-error.d.cts

@@ -0,0 +1,113 @@
+import { n as AppErrorOptions, t as AppError } from "./app-error.cjs";
+
+//#region src/core/errors/authorization-error.d.ts
+type AuthorizationErrorReason = "forbidden" | "missing_role" | "missing_capability" | "out_of_scope" | "outside_time_window" | "policy_denied" | "unknown";
+type AuthorizationRequirement = {
+  role?: string;
+  capability?: string;
+  scope?: string;
+};
+type AuthorizationErrorMetadata = {
+  reason: AuthorizationErrorReason;
+  /** Stable action you evaluated (not an HTTP route — a "business action") */
+  action: string;
+  /** Resource identification (without leaking the full payload) */
+  resource?: {
+    type: string;
+    id?: string;
+  };
+  /** Optional: actor (do not include sensitive data) */
+  actor?: {
+    userId: string;
+    role?: string;
+  };
+  /** Optional: expected requirement */
+  required?: AuthorizationRequirement;
+  /** Optional: policy (when you already have PolicyEvaluation or similar) */
+  policyId?: string;
+  policyVersion?: number;
+  evaluatedAtIso?: string;
+  decision?: "allow" | "deny";
+  reasonCode?: string;
+  /** Optional: additional non-sensitive info */
+  details?: string;
+};
+/**
+ * Options for AuthorizationError factory methods.
+ * Combines metadata fields (except 'reason') with common AppError options.
+ */
+type AuthorizationErrorFactoryOptions = Omit<AuthorizationErrorMetadata, "reason"> & Omit<AppErrorOptions, "metadata">;
+/**
+ * Raised when an authenticated actor is not allowed to perform a business
+ * action — the "you may not" error, distinct from authentication ("who are
+ * you"). Maps to an HTTP 403 at the edge.
+ *
+ * The discriminating {@link reason} records *why* access was denied (a flat
+ * forbid, a missing role/capability, an out-of-scope target, or a policy
+ * decision) so the boundary can shape the response without re-deriving it. The
+ * metadata is deliberately built around a stable business `action` and a
+ * type/id resource reference rather than an HTTP route or full payload, keeping
+ * sensitive data out of logs. Instances are frozen. Construct through the
+ * static factories, never directly.
+ */
+declare class AuthorizationError extends AppError {
+  readonly reason: AuthorizationErrorReason;
+  private constructor();
+  /**
+   * A flat denial with no more specific reason — the actor simply may not
+   * perform this action. Reach for a more precise factory
+   * ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},
+   * {@link AuthorizationError.policyDenied}) when the cause is known.
+   */
+  static forbidden(input: AuthorizationErrorFactoryOptions): AuthorizationError;
+  /**
+   * The action was denied by an evaluated policy. Captures the deciding
+   * policy's id, version, and evaluation instant into the metadata (with
+   * `decision: "deny"`) so the denial is auditable back to the exact policy
+   * that produced it.
+   *
+   * @param input - Factory options plus the required `policyId`,
+   *   `policyVersion`, and `evaluatedAtIso` of the deciding policy.
+   */
+  static policyDenied(input: AuthorizationErrorFactoryOptions & {
+    policyId: string;
+    policyVersion: number;
+    evaluatedAtIso: string;
+  }): AuthorizationError;
+  /**
+   * The actor holds no role at all that bears on the action — the most basic
+   * denial, distinct from {@link AuthorizationError.missingCapability} (which
+   * means the actor *has* roles, just none granting the required capability).
+   * The expected {@link AuthorizationRequirement} is recorded so the boundary
+   * can tell the caller what grant is missing.
+   *
+   * @param input - Factory options plus the `required` role/capability/scope.
+   */
+  static missingRole(input: AuthorizationErrorFactoryOptions & {
+    required: AuthorizationRequirement;
+  }): AuthorizationError;
+  /**
+   * The actor lacks a required role or capability. The expected
+   * {@link AuthorizationRequirement} is recorded so the boundary can tell the
+   * caller precisely what grant is missing.
+   *
+   * @param input - Factory options plus the `required` role/capability/scope.
+   */
+  static missingCapability(input: AuthorizationErrorFactoryOptions & {
+    required: AuthorizationRequirement;
+  }): AuthorizationError;
+  /**
+   * The actor may perform the action in general, but not on *this* target —
+   * the resource falls outside the actor's permitted scope (e.g. a different
+   * school or tenant than the one they are bound to).
+   *
+   * @param input - Factory options plus the optional `required` scope that the
+   *   target failed to satisfy.
+   */
+  static outOfScope(input: AuthorizationErrorFactoryOptions & {
+    required?: AuthorizationRequirement;
+  }): AuthorizationError;
+}
+//#endregion
+export { AuthorizationRequirement as i, AuthorizationErrorMetadata as n, AuthorizationErrorReason as r, AuthorizationError as t };
+//# sourceMappingURL=authorization-error.d.cts.map

package/dist/authorization-error.d.ts

@@ -0,0 +1,113 @@
+import { n as AppErrorOptions, t as AppError } from "./app-error.js";
+
+//#region src/core/errors/authorization-error.d.ts
+type AuthorizationErrorReason = "forbidden" | "missing_role" | "missing_capability" | "out_of_scope" | "outside_time_window" | "policy_denied" | "unknown";
+type AuthorizationRequirement = {
+  role?: string;
+  capability?: string;
+  scope?: string;
+};
+type AuthorizationErrorMetadata = {
+  reason: AuthorizationErrorReason;
+  /** Stable action you evaluated (not an HTTP route — a "business action") */
+  action: string;
+  /** Resource identification (without leaking the full payload) */
+  resource?: {
+    type: string;
+    id?: string;
+  };
+  /** Optional: actor (do not include sensitive data) */
+  actor?: {
+    userId: string;
+    role?: string;
+  };
+  /** Optional: expected requirement */
+  required?: AuthorizationRequirement;
+  /** Optional: policy (when you already have PolicyEvaluation or similar) */
+  policyId?: string;
+  policyVersion?: number;
+  evaluatedAtIso?: string;
+  decision?: "allow" | "deny";
+  reasonCode?: string;
+  /** Optional: additional non-sensitive info */
+  details?: string;
+};
+/**
+ * Options for AuthorizationError factory methods.
+ * Combines metadata fields (except 'reason') with common AppError options.
+ */
+type AuthorizationErrorFactoryOptions = Omit<AuthorizationErrorMetadata, "reason"> & Omit<AppErrorOptions, "metadata">;
+/**
+ * Raised when an authenticated actor is not allowed to perform a business
+ * action — the "you may not" error, distinct from authentication ("who are
+ * you"). Maps to an HTTP 403 at the edge.
+ *
+ * The discriminating {@link reason} records *why* access was denied (a flat
+ * forbid, a missing role/capability, an out-of-scope target, or a policy
+ * decision) so the boundary can shape the response without re-deriving it. The
+ * metadata is deliberately built around a stable business `action` and a
+ * type/id resource reference rather than an HTTP route or full payload, keeping
+ * sensitive data out of logs. Instances are frozen. Construct through the
+ * static factories, never directly.
+ */
+declare class AuthorizationError extends AppError {
+  readonly reason: AuthorizationErrorReason;
+  private constructor();
+  /**
+   * A flat denial with no more specific reason — the actor simply may not
+   * perform this action. Reach for a more precise factory
+   * ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},
+   * {@link AuthorizationError.policyDenied}) when the cause is known.
+   */
+  static forbidden(input: AuthorizationErrorFactoryOptions): AuthorizationError;
+  /**
+   * The action was denied by an evaluated policy. Captures the deciding
+   * policy's id, version, and evaluation instant into the metadata (with
+   * `decision: "deny"`) so the denial is auditable back to the exact policy
+   * that produced it.
+   *
+   * @param input - Factory options plus the required `policyId`,
+   *   `policyVersion`, and `evaluatedAtIso` of the deciding policy.
+   */
+  static policyDenied(input: AuthorizationErrorFactoryOptions & {
+    policyId: string;
+    policyVersion: number;
+    evaluatedAtIso: string;
+  }): AuthorizationError;
+  /**
+   * The actor holds no role at all that bears on the action — the most basic
+   * denial, distinct from {@link AuthorizationError.missingCapability} (which
+   * means the actor *has* roles, just none granting the required capability).
+   * The expected {@link AuthorizationRequirement} is recorded so the boundary
+   * can tell the caller what grant is missing.
+   *
+   * @param input - Factory options plus the `required` role/capability/scope.
+   */
+  static missingRole(input: AuthorizationErrorFactoryOptions & {
+    required: AuthorizationRequirement;
+  }): AuthorizationError;
+  /**
+   * The actor lacks a required role or capability. The expected
+   * {@link AuthorizationRequirement} is recorded so the boundary can tell the
+   * caller precisely what grant is missing.
+   *
+   * @param input - Factory options plus the `required` role/capability/scope.
+   */
+  static missingCapability(input: AuthorizationErrorFactoryOptions & {
+    required: AuthorizationRequirement;
+  }): AuthorizationError;
+  /**
+   * The actor may perform the action in general, but not on *this* target —
+   * the resource falls outside the actor's permitted scope (e.g. a different
+   * school or tenant than the one they are bound to).
+   *
+   * @param input - Factory options plus the optional `required` scope that the
+   *   target failed to satisfy.
+   */
+  static outOfScope(input: AuthorizationErrorFactoryOptions & {
+    required?: AuthorizationRequirement;
+  }): AuthorizationError;
+}
+//#endregion
+export { AuthorizationRequirement as i, AuthorizationErrorMetadata as n, AuthorizationErrorReason as r, AuthorizationError as t };
+//# sourceMappingURL=authorization-error.d.ts.map

package/dist/authorization-error.js

@@ -0,0 +1,152 @@
+import { r as ErrorCodes, t as AppError } from "./app-error.js";
+//#region src/core/errors/authorization-error.ts
+/**
+* Raised when an authenticated actor is not allowed to perform a business
+* action — the "you may not" error, distinct from authentication ("who are
+* you"). Maps to an HTTP 403 at the edge.
+*
+* The discriminating {@link reason} records *why* access was denied (a flat
+* forbid, a missing role/capability, an out-of-scope target, or a policy
+* decision) so the boundary can shape the response without re-deriving it. The
+* metadata is deliberately built around a stable business `action` and a
+* type/id resource reference rather than an HTTP route or full payload, keeping
+* sensitive data out of logs. Instances are frozen. Construct through the
+* static factories, never directly.
+*/
+var AuthorizationError = class AuthorizationError extends AppError {
+	constructor(params) {
+		super(params.message, params.code, {
+			cause: params.cause,
+			metadata: params.metadata,
+			type: params.type,
+			severity: params.severity,
+			correlationId: params.correlationId,
+			requestId: params.requestId,
+			commandId: params.commandId,
+			createdAtIso: params.createdAtIso,
+			publicMessage: params.publicMessage
+		});
+		this.reason = params.reason;
+		Object.freeze(this);
+	}
+	/**
+	* A flat denial with no more specific reason — the actor simply may not
+	* perform this action. Reach for a more precise factory
+	* ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},
+	* {@link AuthorizationError.policyDenied}) when the cause is known.
+	*/
+	static forbidden(input) {
+		return new AuthorizationError({
+			message: "Action not allowed",
+			code: ErrorCodes.authorization.forbidden,
+			reason: "forbidden",
+			metadata: {
+				reason: "forbidden",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The action was denied by an evaluated policy. Captures the deciding
+	* policy's id, version, and evaluation instant into the metadata (with
+	* `decision: "deny"`) so the denial is auditable back to the exact policy
+	* that produced it.
+	*
+	* @param input - Factory options plus the required `policyId`,
+	*   `policyVersion`, and `evaluatedAtIso` of the deciding policy.
+	*/
+	static policyDenied(input) {
+		return new AuthorizationError({
+			message: "Action denied by policy",
+			code: ErrorCodes.authorization.policyDenied,
+			reason: "policy_denied",
+			metadata: {
+				reason: "policy_denied",
+				...extractMetadataOnly(input),
+				decision: "deny"
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The actor holds no role at all that bears on the action — the most basic
+	* denial, distinct from {@link AuthorizationError.missingCapability} (which
+	* means the actor *has* roles, just none granting the required capability).
+	* The expected {@link AuthorizationRequirement} is recorded so the boundary
+	* can tell the caller what grant is missing.
+	*
+	* @param input - Factory options plus the `required` role/capability/scope.
+	*/
+	static missingRole(input) {
+		return new AuthorizationError({
+			message: "Missing required role to perform the action",
+			code: ErrorCodes.authorization.missingRole,
+			reason: "missing_role",
+			metadata: {
+				reason: "missing_role",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The actor lacks a required role or capability. The expected
+	* {@link AuthorizationRequirement} is recorded so the boundary can tell the
+	* caller precisely what grant is missing.
+	*
+	* @param input - Factory options plus the `required` role/capability/scope.
+	*/
+	static missingCapability(input) {
+		return new AuthorizationError({
+			message: "Insufficient capability to perform the action",
+			code: ErrorCodes.authorization.missingCapability,
+			reason: "missing_capability",
+			metadata: {
+				reason: "missing_capability",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+	/**
+	* The actor may perform the action in general, but not on *this* target —
+	* the resource falls outside the actor's permitted scope (e.g. a different
+	* school or tenant than the one they are bound to).
+	*
+	* @param input - Factory options plus the optional `required` scope that the
+	*   target failed to satisfy.
+	*/
+	static outOfScope(input) {
+		return new AuthorizationError({
+			message: "Action outside the allowed scope",
+			code: ErrorCodes.authorization.outOfScope,
+			reason: "out_of_scope",
+			metadata: {
+				reason: "out_of_scope",
+				...extractMetadataOnly(input)
+			},
+			...extractAppErrorOptions(input)
+		});
+	}
+};
+function extractAppErrorOptions(options) {
+	return {
+		cause: options?.cause,
+		type: options?.type,
+		severity: options?.severity,
+		correlationId: options?.correlationId,
+		requestId: options?.requestId,
+		commandId: options?.commandId,
+		createdAtIso: options?.createdAtIso,
+		publicMessage: options?.publicMessage
+	};
+}
+function extractMetadataOnly(input) {
+	const { cause, type, severity, correlationId, requestId, commandId, createdAtIso, publicMessage, ...metadata } = input;
+	return metadata;
+}
+//#endregion
+export { AuthorizationError as t };
+
+//# sourceMappingURL=authorization-error.js.map

package/dist/authorization-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-error.js","names":[],"sources":["../src/core/errors/authorization-error.ts"],"sourcesContent":["import { AppError } from \"./app-error.js\";\nimport { ErrorCodes } from \"./error-codes.js\";\nimport type { AppErrorOptions, ErrorSeverity } from \"./types.js\";\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────────────────\n\ntype AuthorizationErrorReason =\n    | \"forbidden\"\n    | \"missing_role\"\n    | \"missing_capability\"\n    | \"out_of_scope\"\n    | \"outside_time_window\"\n    | \"policy_denied\"\n    | \"unknown\";\n\ntype AuthorizationRequirement = {\n    role?: string;\n    capability?: string;\n    scope?: string; // e.g.: \"school:{id}\" or \"class:{id}\"\n};\n\ntype AuthorizationErrorMetadata = {\n    reason: AuthorizationErrorReason;\n\n    /** Stable action you evaluated (not an HTTP route — a \"business action\") */\n    action: string;\n\n    /** Resource identification (without leaking the full payload) */\n    resource?: { type: string; id?: string };\n\n    /** Optional: actor (do not include sensitive data) */\n    actor?: { userId: string; role?: string };\n\n    /** Optional: expected requirement */\n    required?: AuthorizationRequirement;\n\n    /** Optional: policy (when you already have PolicyEvaluation or similar) */\n    policyId?: string;\n    policyVersion?: number;\n    evaluatedAtIso?: string;\n    decision?: \"allow\" | \"deny\";\n    reasonCode?: string;\n\n    /** Optional: additional non-sensitive info */\n    details?: string;\n};\n\n/**\n * Options for AuthorizationError factory methods.\n * Combines metadata fields (except 'reason') with common AppError options.\n */\ntype AuthorizationErrorFactoryOptions = Omit<\n    AuthorizationErrorMetadata,\n    \"reason\"\n> &\n    Omit<AppErrorOptions, \"metadata\">;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// AuthorizationError\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Raised when an authenticated actor is not allowed to perform a business\n * action — the \"you may not\" error, distinct from authentication (\"who are\n * you\"). Maps to an HTTP 403 at the edge.\n *\n * The discriminating {@link reason} records *why* access was denied (a flat\n * forbid, a missing role/capability, an out-of-scope target, or a policy\n * decision) so the boundary can shape the response without re-deriving it. The\n * metadata is deliberately built around a stable business `action` and a\n * type/id resource reference rather than an HTTP route or full payload, keeping\n * sensitive data out of logs. Instances are frozen. Construct through the\n * static factories, never directly.\n */\nclass AuthorizationError extends AppError {\n    public readonly reason: AuthorizationErrorReason;\n\n    private constructor(params: {\n        message: string;\n        code: string;\n        reason: AuthorizationErrorReason;\n        metadata: AuthorizationErrorMetadata;\n        cause?: unknown;\n        type?: string;\n        severity?: ErrorSeverity;\n        correlationId?: string;\n        requestId?: string;\n        commandId?: string;\n        createdAtIso?: string;\n        publicMessage?: string;\n    }) {\n        super(params.message, params.code, {\n            cause: params.cause,\n            metadata: params.metadata,\n            type: params.type,\n            severity: params.severity,\n            correlationId: params.correlationId,\n            requestId: params.requestId,\n            commandId: params.commandId,\n            createdAtIso: params.createdAtIso,\n            publicMessage: params.publicMessage,\n        });\n\n        this.reason = params.reason;\n        Object.freeze(this);\n    }\n\n    // ─────────────────────────────────────────────────────────────────────────\n    // Factories\n    // ─────────────────────────────────────────────────────────────────────────\n\n    /**\n     * A flat denial with no more specific reason — the actor simply may not\n     * perform this action. Reach for a more precise factory\n     * ({@link AuthorizationError.missingCapability}, {@link AuthorizationError.outOfScope},\n     * {@link AuthorizationError.policyDenied}) when the cause is known.\n     */\n    static forbidden(\n        input: AuthorizationErrorFactoryOptions,\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Action not allowed\",\n            code: ErrorCodes.authorization.forbidden,\n            reason: \"forbidden\",\n            metadata: { reason: \"forbidden\", ...extractMetadataOnly(input) },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The action was denied by an evaluated policy. Captures the deciding\n     * policy's id, version, and evaluation instant into the metadata (with\n     * `decision: \"deny\"`) so the denial is auditable back to the exact policy\n     * that produced it.\n     *\n     * @param input - Factory options plus the required `policyId`,\n     *   `policyVersion`, and `evaluatedAtIso` of the deciding policy.\n     */\n    static policyDenied(\n        input: AuthorizationErrorFactoryOptions & {\n            policyId: string;\n            policyVersion: number;\n            evaluatedAtIso: string;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Action denied by policy\",\n            code: ErrorCodes.authorization.policyDenied,\n            reason: \"policy_denied\",\n            metadata: {\n                reason: \"policy_denied\",\n                ...extractMetadataOnly(input),\n                decision: \"deny\",\n            },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The actor holds no role at all that bears on the action — the most basic\n     * denial, distinct from {@link AuthorizationError.missingCapability} (which\n     * means the actor *has* roles, just none granting the required capability).\n     * The expected {@link AuthorizationRequirement} is recorded so the boundary\n     * can tell the caller what grant is missing.\n     *\n     * @param input - Factory options plus the `required` role/capability/scope.\n     */\n    static missingRole(\n        input: AuthorizationErrorFactoryOptions & {\n            required: AuthorizationRequirement;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Missing required role to perform the action\",\n            code: ErrorCodes.authorization.missingRole,\n            reason: \"missing_role\",\n            metadata: {\n                reason: \"missing_role\",\n                ...extractMetadataOnly(input),\n            },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The actor lacks a required role or capability. The expected\n     * {@link AuthorizationRequirement} is recorded so the boundary can tell the\n     * caller precisely what grant is missing.\n     *\n     * @param input - Factory options plus the `required` role/capability/scope.\n     */\n    static missingCapability(\n        input: AuthorizationErrorFactoryOptions & {\n            required: AuthorizationRequirement;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Insufficient capability to perform the action\",\n            code: ErrorCodes.authorization.missingCapability,\n            reason: \"missing_capability\",\n            metadata: {\n                reason: \"missing_capability\",\n                ...extractMetadataOnly(input),\n            },\n            ...extractAppErrorOptions(input),\n        });\n    }\n\n    /**\n     * The actor may perform the action in general, but not on *this* target —\n     * the resource falls outside the actor's permitted scope (e.g. a different\n     * school or tenant than the one they are bound to).\n     *\n     * @param input - Factory options plus the optional `required` scope that the\n     *   target failed to satisfy.\n     */\n    static outOfScope(\n        input: AuthorizationErrorFactoryOptions & {\n            required?: AuthorizationRequirement;\n        },\n    ): AuthorizationError {\n        return new AuthorizationError({\n            message: \"Action outside the allowed scope\",\n            code: ErrorCodes.authorization.outOfScope,\n            reason: \"out_of_scope\",\n            metadata: { reason: \"out_of_scope\", ...extractMetadataOnly(input) },\n            ...extractAppErrorOptions(input),\n        });\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Helpers\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction extractAppErrorOptions(options?: Partial<AppErrorOptions>) {\n    return {\n        cause: options?.cause,\n        type: options?.type,\n        severity: options?.severity,\n        correlationId: options?.correlationId,\n        requestId: options?.requestId,\n        commandId: options?.commandId,\n        createdAtIso: options?.createdAtIso,\n        publicMessage: options?.publicMessage,\n    };\n}\n\nfunction extractMetadataOnly(\n    input: AuthorizationErrorFactoryOptions,\n): Omit<AuthorizationErrorMetadata, \"reason\"> {\n    const {\n        cause,\n        type,\n        severity,\n        correlationId,\n        requestId,\n        commandId,\n        createdAtIso,\n        publicMessage,\n        ...metadata\n    } = input;\n    return metadata;\n}\n\nexport { AuthorizationError };\nexport type {\n    AuthorizationErrorMetadata,\n    AuthorizationErrorReason,\n    AuthorizationRequirement,\n};\n"],"mappings":";;;;;;;;;;;;;;;AA4EA,IAAM,qBAAN,MAAM,2BAA2B,SAAS;CAGtC,YAAoB,QAajB;EACC,MAAM,OAAO,SAAS,OAAO,MAAM;GAC/B,OAAO,OAAO;GACd,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,UAAU,OAAO;GACjB,eAAe,OAAO;GACtB,WAAW,OAAO;GAClB,WAAW,OAAO;GAClB,cAAc,OAAO;GACrB,eAAe,OAAO;EAC1B,CAAC;EAED,KAAK,SAAS,OAAO;EACrB,OAAO,OAAO,IAAI;CACtB;;;;;;;CAYA,OAAO,UACH,OACkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAM,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IAAE,QAAQ;IAAa,GAAG,oBAAoB,KAAK;GAAE;GAC/D,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;;;CAWA,OAAO,aACH,OAKkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAM,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IACN,QAAQ;IACR,GAAG,oBAAoB,KAAK;IAC5B,UAAU;GACd;GACA,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;;;CAWA,OAAO,YACH,OAGkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAM,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IACN,QAAQ;IACR,GAAG,oBAAoB,KAAK;GAChC;GACA,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;CASA,OAAO,kBACH,OAGkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAM,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IACN,QAAQ;IACR,GAAG,oBAAoB,KAAK;GAChC;GACA,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;;;;;;;;;CAUA,OAAO,WACH,OAGkB;EAClB,OAAO,IAAI,mBAAmB;GAC1B,SAAS;GACT,MAAM,WAAW,cAAc;GAC/B,QAAQ;GACR,UAAU;IAAE,QAAQ;IAAgB,GAAG,oBAAoB,KAAK;GAAE;GAClE,GAAG,uBAAuB,KAAK;EACnC,CAAC;CACL;AACJ;AAMA,SAAS,uBAAuB,SAAoC;CAChE,OAAO;EACH,OAAO,SAAS;EAChB,MAAM,SAAS;EACf,UAAU,SAAS;EACnB,eAAe,SAAS;EACxB,WAAW,SAAS;EACpB,WAAW,SAAS;EACpB,cAAc,SAAS;EACvB,eAAe,SAAS;CAC5B;AACJ;AAEA,SAAS,oBACL,OAC0C;CAC1C,MAAM,EACF,OACA,MACA,UACA,eACA,WACA,WACA,cACA,eACA,GAAG,aACH;CACJ,OAAO;AACX"}