@ddd-ts-kit/auth 0.0.0-stage → 0.1.0

package/dist/rbac/role-based-authorizer.js

@@ -0,0 +1,68 @@
+import { isAnonymous, isSystem } from '@ddd-ts-kit/kernel';
+import { ALLOWED, deny } from '../authorization/decision.js';
+import { DenialReason } from '../authorization/denial-reason.js';
+import { AuthorizationSetupError } from '../errors/authorization-setup-error.js';
+import { grantCovers } from '../permissions/grant-covers.js';
+import { grantPattern } from '../permissions/grant-pattern.js';
+/** RBAC: an actor may do what one of its roles grants. It decides on actions, not on elements. */
+export class RoleBasedAuthorizer {
+    options;
+    grants;
+    constructor(options) {
+        this.options = options;
+        this.grants = effectiveGrants(options);
+    }
+    async check(request) {
+        if (isAnonymous(request.actor)) {
+            return deny(DenialReason.anonymous);
+        }
+        if (!this.holds(request.actor, request.permission)) {
+            return deny(DenialReason.noMatchingRole);
+        }
+        return (await this.targetsAnotherTenant(request)) ? deny(DenialReason.tenantMismatch) : ALLOWED;
+    }
+    /** Constant time: everything, nothing, or the rows of the actor's tenant. */
+    async listAccessible({ actor, permission }) {
+        if (isAnonymous(actor) || !this.holds(actor, permission)) {
+            return { kind: 'none' };
+        }
+        if (this.options.tenantOf === undefined || this.crossesTenants(actor)) {
+            return { kind: 'all' };
+        }
+        return actor.tenantId === undefined ? { kind: 'none' } : { kind: 'filter', filter: { tenantId: actor.tenantId } };
+    }
+    holds(actor, permission) {
+        return this.rolesOf(actor).some((role) => (this.grants.get(role) ?? []).some((pattern) => grantCovers(pattern, permission)));
+    }
+    rolesOf(actor) {
+        const { systemRole } = this.options;
+        return isSystem(actor) && systemRole !== undefined ? [...actor.roles, systemRole] : actor.roles;
+    }
+    async targetsAnotherTenant(request) {
+        if (this.options.tenantOf === undefined || this.crossesTenants(request.actor)) {
+            return false;
+        }
+        const targeted = await this.options.tenantOf(request);
+        return targeted !== undefined && targeted !== request.actor.tenantId;
+    }
+    crossesTenants(actor) {
+        const crossing = this.options.crossTenantRoles ?? [];
+        return this.rolesOf(actor).some((role) => crossing.includes(role));
+    }
+}
+function effectiveGrants(options) {
+    const inherits = options.inherits ?? {};
+    const roles = new Set([...Object.keys(options.roles), ...Object.keys(inherits)]);
+    const own = new Map([...roles].map((role) => [role, (options.roles[role] ?? []).map(grantPattern)]));
+    const lineage = (role, path) => {
+        if (!roles.has(role)) {
+            throw new AuthorizationSetupError(`Role "${path.at(-1) ?? role}" inherits the unknown role "${role}".`);
+        }
+        if (path.includes(role)) {
+            throw new AuthorizationSetupError(`Role hierarchy cycle: ${[...path, role].join(' -> ')}.`);
+        }
+        return [role, ...(inherits[role] ?? []).flatMap((parent) => lineage(parent, [...path, role]))];
+    };
+    return new Map([...roles].map((role) => [role, [...new Set(lineage(role, []).flatMap((ancestor) => own.get(ancestor) ?? []))]]));
+}
+//# sourceMappingURL=role-based-authorizer.js.map

package/dist/rbac/role-based-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-based-authorizer.js","sourceRoot":"","sources":["../../src/rbac/role-based-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAc,MAAM,oBAAoB,CAAC;AAIvE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAiB,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAmB/D,kGAAkG;AAClG,MAAM,OAAO,mBAAmB;IAGD,OAAO;IAFnB,MAAM,CAAyC;IAEhE,YAA6B,OAAmC;uBAAnC,OAAO;QAClC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClG,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAe;QACrD,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpH,CAAC;IAEO,KAAK,CAAC,KAAY,EAAE,UAAsB;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACvC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAClF,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,KAAY;QAC1B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEpC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAClG,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,OAAqB;QACtD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEtD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;IACvE,CAAC;IAEO,cAAc,CAAC,KAAY;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAErD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;CACF;AAED,SAAS,eAAe,CAAC,OAAmC;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAuB,EAAqB,EAAE;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,uBAAuB,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,gCAAgC,IAAI,IAAI,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC;IAEF,OAAO,IAAI,GAAG,CACZ,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACjH,CAAC;AACJ,CAAC"}

package/dist/rbac/tenant-of-context.d.ts

@@ -0,0 +1,4 @@
+import type { CheckRequest } from '../authorization/check-request.js';
+/** For `tenantOf`: reads `context.tenantId`, which `requires(..., { context })` provides. */
+export declare function tenantOfContext(request: CheckRequest): string | undefined;
+//# sourceMappingURL=tenant-of-context.d.ts.map

package/dist/rbac/tenant-of-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-of-context.d.ts","sourceRoot":"","sources":["../../src/rbac/tenant-of-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEtE,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAIzE"}

package/dist/rbac/tenant-of-context.js

@@ -0,0 +1,6 @@
+/** For `tenantOf`: reads `context.tenantId`, which `requires(..., { context })` provides. */
+export function tenantOfContext(request) {
+    const tenantId = request.context?.['tenantId'];
+    return typeof tenantId === 'string' ? tenantId : undefined;
+}
+//# sourceMappingURL=tenant-of-context.js.map

package/dist/rbac/tenant-of-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-of-context.js","sourceRoot":"","sources":["../../src/rbac/tenant-of-context.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IAE/C,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC"}

package/dist/rebac/define-schema.d.ts

@@ -0,0 +1,8 @@
+import { Schema } from './schema.js';
+import type { SchemaDefinition } from './schema-definition.js';
+/**
+ * The object types, their relations and how permissions derive from them. Validated here, so
+ * an unknown type or relation, or a rewrite that could never terminate, never reaches a check.
+ */
+export declare function defineSchema(definition: SchemaDefinition): Schema;
+//# sourceMappingURL=define-schema.d.ts.map

package/dist/rebac/define-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-schema.d.ts","sourceRoot":"","sources":["../../src/rebac/define-schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D;;;GAGG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAcjE"}

package/dist/rebac/define-schema.js

@@ -0,0 +1,99 @@
+import { Schema } from './schema.js';
+import { SchemaError } from './schema-error.js';
+/**
+ * The object types, their relations and how permissions derive from them. Validated here, so
+ * an unknown type or relation, or a rewrite that could never terminate, never reaches a check.
+ */
+export function defineSchema(definition) {
+    const schema = new Schema(definition);
+    for (const type of schema.types()) {
+        assertNoNameClash(schema, type);
+        assertSubjectsExist(schema, type);
+        for (const [name, rewrite] of Object.entries(schema.permissions(type))) {
+            assertResolves(schema, { type, name }, rewrite);
+            assertTerminates(schema, type, [name]);
+        }
+    }
+    return schema;
+}
+function assertNoNameClash(schema, type) {
+    const relations = Object.keys(schema.relations(type));
+    const clash = Object.keys(schema.permissions(type)).find((name) => relations.includes(name));
+    if (clash !== undefined) {
+        throw new SchemaError(`"${type}" declares "${clash}" both as a relation and as a permission.`);
+    }
+}
+function assertSubjectsExist(schema, type) {
+    for (const [name, subjects] of Object.entries(schema.relations(type))) {
+        for (const subject of subjects) {
+            const [subjectType = '', relation] = subject.split('#');
+            if (!schema.types().includes(subjectType)) {
+                throw new SchemaError(`"${type}#${name}" accepts the unknown type "${subjectType}".`);
+            }
+            if (relation !== undefined && schema.resolve(subjectType, relation) === undefined) {
+                throw new SchemaError(`"${type}#${name}" accepts "${subject}", but "${subjectType}" has no "${relation}".`);
+            }
+        }
+    }
+}
+function assertResolves(schema, at, rewrite) {
+    if (typeof rewrite === 'string') {
+        if (schema.resolve(at.type, rewrite) !== undefined) {
+            return;
+        }
+        throw new SchemaError(`"${at.type}#${at.name}" refers to "${rewrite}", which "${at.type}" does not declare.`);
+    }
+    if (rewrite.kind === 'from') {
+        assertFollows(schema, at, rewrite);
+        return;
+    }
+    const children = rewrite.kind === 'exclusion' ? [rewrite.base, rewrite.subtract] : rewrite.children;
+    if (children.length === 0) {
+        throw new SchemaError(`"${at.type}#${at.name}" has an empty ${rewrite.kind}.`);
+    }
+    for (const child of children) {
+        assertResolves(schema, at, child);
+    }
+}
+function assertFollows(schema, at, { relation, permission }) {
+    const followed = schema.resolve(at.type, relation);
+    if (followed?.kind !== 'relation') {
+        throw new SchemaError(`"${at.type}#${at.name}" follows "${relation}", which is not a relation of "${at.type}".`);
+    }
+    for (const target of followed.subjects) {
+        if (target.includes('#')) {
+            throw new SchemaError(`"${at.type}#${at.name}" follows "${relation}", which accepts the userset "${target}": only objects can be followed.`);
+        }
+        if (schema.resolve(target, permission) === undefined) {
+            throw new SchemaError(`"${at.type}#${at.name}" asks "${permission}" of "${target}", which does not declare it.`);
+        }
+    }
+}
+/**
+ * A permission defined by itself through names alone (`edit: 'view'`, `view: 'edit'`) reads
+ * no tuple and would loop for ever. A loop through `from` or a userset reads a tuple at each
+ * turn: it depends on the data and is cut at run time by the cycle protection.
+ */
+function assertTerminates(schema, type, path) {
+    const rewrite = schema.permissions(type)[path.at(-1) ?? ''];
+    if (rewrite === undefined) {
+        return;
+    }
+    for (const name of namesIn(rewrite)) {
+        if (path.includes(name)) {
+            throw new SchemaError(`"${type}" has a rewrite that cannot terminate: ${[...path, name].join(' -> ')}.`);
+        }
+        assertTerminates(schema, type, [...path, name]);
+    }
+}
+function namesIn(rewrite) {
+    if (typeof rewrite === 'string') {
+        return [rewrite];
+    }
+    if (rewrite.kind === 'from') {
+        return [];
+    }
+    const children = rewrite.kind === 'exclusion' ? [rewrite.base, rewrite.subtract] : rewrite.children;
+    return children.flatMap(namesIn);
+}
+//# sourceMappingURL=define-schema.js.map

package/dist/rebac/define-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-schema.js","sourceRoot":"","sources":["../../src/rebac/define-schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,UAA4B;IACvD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvE,cAAc,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAChD,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,IAAY;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,eAAe,KAAK,2CAA2C,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,IAAY;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,WAAW,GAAG,EAAE,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAExD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,IAAI,IAAI,+BAA+B,WAAW,IAAI,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClF,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,IAAI,IAAI,cAAc,OAAO,WAAW,WAAW,aAAa,QAAQ,IAAI,CAAC,CAAC;YAC9G,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAOD,SAAS,cAAc,CAAC,MAAc,EAAE,EAAS,EAAE,OAAgB;IACjE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,gBAAgB,OAAO,aAAa,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAEnC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEpG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,kBAAkB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,EAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAe;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEnD,IAAI,QAAQ,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,cAAc,QAAQ,kCAAkC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IACnH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACnB,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,cAAc,QAAQ,iCAAiC,MAAM,kCAAkC,CACtH,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,WAAW,UAAU,SAAS,MAAM,+BAA+B,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAY,EAAE,IAAuB;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAE5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CAAC,IAAI,IAAI,0CAA0C,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3G,CAAC;QAED,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEpG,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}

package/dist/rebac/evaluation.d.ts

@@ -0,0 +1,31 @@
+import type { ExpandNode } from './expand-node.js';
+import type { RelationTupleStore } from './relation-tuple-store.js';
+import type { Schema } from './schema.js';
+export interface EvaluationOptions {
+    readonly schema: Schema;
+    readonly store: RelationTupleStore;
+    /** `<type>:<id>` of who is asking. */
+    readonly subject: string;
+    readonly maxDepth: number;
+    /** Visits every branch instead of stopping at the first that settles the answer. */
+    readonly exhaustive: boolean;
+}
+/** One question, answered by walking the rewrites of the schema over the stored tuples. */
+export declare class Evaluation {
+    private readonly options;
+    private cutByDepthLimit;
+    constructor(options: EvaluationOptions);
+    /** True when a branch was cut by the depth limit: the answer is then not to be trusted. */
+    get depthExceeded(): boolean;
+    evaluate(object: string, relation: string, path?: readonly string[]): Promise<ExpandNode>;
+    private relation;
+    /** Runs the steps in order and stops at the first whose answer is `settling`, unless exhaustive. */
+    private until;
+    private tuple;
+    private rewrite;
+    private computed;
+    private from;
+    private exclusion;
+    private set;
+}
+//# sourceMappingURL=evaluation.d.ts.map

package/dist/rebac/evaluation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluation.d.ts","sourceRoot":"","sources":["../../src/rebac/evaluation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAWD,2FAA2F;AAC3F,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,eAAe,CAAS;IAEhC,YAA6B,OAAO,EAAE,iBAAiB,EAAI;IAE3D,2FAA2F;IAC3F,IAAI,aAAa,IAAI,OAAO,CAE3B;IAEK,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBlG;YAEa,QAAQ;IAWtB,oGAAoG;YACtF,KAAK;YAgBL,KAAK;IAYnB,OAAO,CAAC,OAAO;YAYD,QAAQ;YAMR,IAAI;YAYJ,SAAS;YAYT,GAAG;CAYlB"}

package/dist/rebac/evaluation.js

@@ -0,0 +1,94 @@
+import { parseObject } from './parse-object.js';
+/** One question, answered by walking the rewrites of the schema over the stored tuples. */
+export class Evaluation {
+    options;
+    cutByDepthLimit = false;
+    constructor(options) {
+        this.options = options;
+    }
+    /** True when a branch was cut by the depth limit: the answer is then not to be trusted. */
+    get depthExceeded() {
+        return this.cutByDepthLimit;
+    }
+    async evaluate(object, relation, path = []) {
+        const key = `${object}#${relation}`;
+        const here = { object, relation, path: [...path, key] };
+        if (path.includes(key)) {
+            return node(here, { via: 'cycle', allowed: false });
+        }
+        if (path.length >= this.options.maxDepth) {
+            this.cutByDepthLimit = true;
+            return node(here, { via: 'depth-limit', allowed: false });
+        }
+        const resolution = this.options.schema.resolve(parseObject(object).type, relation);
+        if (resolution === undefined) {
+            return node(here, { via: 'unknown', allowed: false });
+        }
+        return resolution.kind === 'relation' ? this.relation(here) : this.rewrite(here, resolution.rewrite);
+    }
+    async relation(here) {
+        const tuples = await this.options.store.readByObject(here.object, here.relation);
+        const children = await this.until(true, tuples.map((tuple) => () => this.tuple(here, tuple)));
+        return node(here, { via: 'relation', allowed: children.some(isAllowed), children });
+    }
+    /** Runs the steps in order and stops at the first whose answer is `settling`, unless exhaustive. */
+    async until(settling, steps) {
+        const visited = [];
+        for (const step of steps) {
+            const outcome = await step();
+            visited.push(outcome);
+            if (!this.options.exhaustive && outcome.allowed === settling) {
+                break;
+            }
+        }
+        return visited;
+    }
+    async tuple(here, tuple) {
+        const [object = '', relation] = tuple.subject.split('#');
+        if (relation === undefined) {
+            return node(here, { via: 'direct', allowed: tuple.subject === this.options.subject, tuple });
+        }
+        const members = await this.evaluate(object, relation, here.path);
+        return node(here, { via: 'userset', allowed: members.allowed, children: [members], tuple });
+    }
+    rewrite(here, rewrite) {
+        if (typeof rewrite === 'string') {
+            return this.computed(here, rewrite);
+        }
+        if (rewrite.kind === 'from') {
+            return this.from(here, rewrite);
+        }
+        return rewrite.kind === 'exclusion' ? this.exclusion(here, rewrite) : this.set(here, rewrite);
+    }
+    async computed(here, name) {
+        const child = await this.evaluate(here.object, name, here.path);
+        return node(here, { via: 'computed', allowed: child.allowed, children: [child] });
+    }
+    async from(here, { relation, permission }) {
+        const tuples = await this.options.store.readByObject(here.object, relation);
+        const followed = tuples.filter((tuple) => !tuple.subject.includes('#'));
+        const children = await this.until(true, followed.map((tuple) => async () => ({ ...(await this.evaluate(tuple.subject, permission, here.path)), tuple })));
+        return node(here, { via: 'from', allowed: children.some(isAllowed), children });
+    }
+    async exclusion(here, { base, subtract }) {
+        const kept = await this.rewrite(here, base);
+        if (!kept.allowed && !this.options.exhaustive) {
+            return node(here, { via: 'exclusion', allowed: false, children: [kept] });
+        }
+        const removed = await this.rewrite(here, subtract);
+        return node(here, { via: 'exclusion', allowed: kept.allowed && !removed.allowed, children: [kept, removed] });
+    }
+    async set(here, { kind, children }) {
+        const settles = kind === 'union';
+        const visited = await this.until(settles, children.map((child) => () => this.rewrite(here, child)));
+        const allowed = settles ? visited.some(isAllowed) : visited.every(isAllowed);
+        return node(here, { via: kind, allowed, children: visited });
+    }
+}
+function node({ object, relation }, outcome) {
+    return { object, relation, children: [], ...outcome };
+}
+function isAllowed(outcome) {
+    return outcome.allowed;
+}
+//# sourceMappingURL=evaluation.js.map

package/dist/rebac/evaluation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluation.js","sourceRoot":"","sources":["../../src/rebac/evaluation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAyBhD,2FAA2F;AAC3F,MAAM,OAAO,UAAU;IAGQ,OAAO;IAF5B,eAAe,GAAG,KAAK,CAAC;IAEhC,YAA6B,OAA0B;uBAA1B,OAAO;IAAsB,CAAC;IAE3D,2FAA2F;IAC3F,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAI,GAAsB,EAAE;QAC3E,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,GAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAElE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAE5B,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEnF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACvG,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAc;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACrD,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,oGAAoG;IAC5F,KAAK,CAAC,KAAK,CAAC,QAAiB,EAAE,KAAsB;QAC3D,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;YAE7B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC7D,MAAM;YACR,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAc,EAAE,KAAoB;QACtD,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,CAAC;IAEO,OAAO,CAAC,IAAc,EAAE,OAAgB;QAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChG,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAc,EAAE,IAAY;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAc,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAe;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,IAAI,EACJ,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CACjH,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAoB;QAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEnD,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAc;QAC9D,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAC9B,OAAO,EACP,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACzD,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE7E,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;CACF;AAID,SAAS,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAY,EAAE,OAAgB;IAC5D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC"}

package/dist/rebac/expand-node.d.ts

@@ -0,0 +1,13 @@
+import type { RelationTuple } from './relation-tuple.js';
+/** One step of an evaluation: what was asked of which object, how, and with what answer. */
+export interface ExpandNode {
+    readonly object: string;
+    /** The relation or permission evaluated on the object. */
+    readonly relation: string;
+    readonly via: 'relation' | 'direct' | 'userset' | 'computed' | 'union' | 'intersection' | 'exclusion' | 'from' | 'cycle' | 'depth-limit' | 'unknown';
+    readonly allowed: boolean;
+    /** The stored fact that led to this step. */
+    readonly tuple?: RelationTuple;
+    readonly children: readonly ExpandNode[];
+}
+//# sourceMappingURL=expand-node.d.ts.map

package/dist/rebac/expand-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expand-node.d.ts","sourceRoot":"","sources":["../../src/rebac/expand-node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EACR,UAAU,GACV,QAAQ,GACR,SAAS,GACT,UAAU,GACV,OAAO,GACP,cAAc,GACd,WAAW,GACX,MAAM,GACN,OAAO,GACP,aAAa,GACb,SAAS,CAAC;IACd,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C"}

package/dist/rebac/expand-node.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=expand-node.js.map

package/dist/rebac/expand-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expand-node.js","sourceRoot":"","sources":["../../src/rebac/expand-node.ts"],"names":[],"mappings":""}

package/dist/rebac/in-memory-relation-tuple-store.d.ts

@@ -0,0 +1,12 @@
+import type { RelationTuple } from './relation-tuple.js';
+import type { RelationTupleStore } from './relation-tuple-store.js';
+export declare class InMemoryRelationTupleStore implements RelationTupleStore {
+    private readonly tuples;
+    write(tuples: readonly RelationTuple[]): Promise<void>;
+    delete(tuples: readonly RelationTuple[]): Promise<void>;
+    readByObject(object: string, relation: string): Promise<readonly RelationTuple[]>;
+    readBySubject(subject: string): Promise<readonly RelationTuple[]>;
+    /** Every stored tuple, for the assertions of a test. */
+    all(): readonly RelationTuple[];
+}
+//# sourceMappingURL=in-memory-relation-tuple-store.d.ts.map

package/dist/rebac/in-memory-relation-tuple-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-relation-tuple-store.d.ts","sourceRoot":"","sources":["../../src/rebac/in-memory-relation-tuple-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAErD,KAAK,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3D;IAEK,MAAM,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI5D;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAEtF;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAEtE;IAED,wDAAwD;IACxD,GAAG,IAAI,SAAS,aAAa,EAAE,CAE9B;CACF"}

package/dist/rebac/in-memory-relation-tuple-store.js

@@ -0,0 +1,25 @@
+import { tupleKey } from './tuple-key.js';
+export class InMemoryRelationTupleStore {
+    tuples = new Map();
+    async write(tuples) {
+        for (const tuple of tuples) {
+            this.tuples.set(tupleKey(tuple), { ...tuple });
+        }
+    }
+    async delete(tuples) {
+        for (const tuple of tuples) {
+            this.tuples.delete(tupleKey(tuple));
+        }
+    }
+    async readByObject(object, relation) {
+        return this.all().filter((tuple) => tuple.object === object && tuple.relation === relation);
+    }
+    async readBySubject(subject) {
+        return this.all().filter((tuple) => tuple.subject === subject);
+    }
+    /** Every stored tuple, for the assertions of a test. */
+    all() {
+        return [...this.tuples.values()];
+    }
+}
+//# sourceMappingURL=in-memory-relation-tuple-store.js.map

package/dist/rebac/in-memory-relation-tuple-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-relation-tuple-store.js","sourceRoot":"","sources":["../../src/rebac/in-memory-relation-tuple-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,OAAO,0BAA0B;IACpB,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE3D,KAAK,CAAC,KAAK,CAAC,MAAgC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAgC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe;QACjC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,wDAAwD;IACxD,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/rebac/invalid-tuple-error.d.ts

@@ -0,0 +1,5 @@
+/** A tuple that cannot be read or that the schema does not allow. */
+export declare class InvalidTupleError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=invalid-tuple-error.d.ts.map

package/dist/rebac/invalid-tuple-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-tuple-error.d.ts","sourceRoot":"","sources":["../../src/rebac/invalid-tuple-error.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/rebac/invalid-tuple-error.js

@@ -0,0 +1,8 @@
+/** A tuple that cannot be read or that the schema does not allow. */
+export class InvalidTupleError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidTupleError';
+    }
+}
+//# sourceMappingURL=invalid-tuple-error.js.map

package/dist/rebac/invalid-tuple-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-tuple-error.js","sourceRoot":"","sources":["../../src/rebac/invalid-tuple-error.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF"}

package/dist/rebac/object-of.d.ts

@@ -0,0 +1,3 @@
+import type { ResourceRef } from '../authorization/resource-ref.js';
+export declare function objectOf(resource: ResourceRef): string;
+//# sourceMappingURL=object-of.d.ts.map

package/dist/rebac/object-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-of.d.ts","sourceRoot":"","sources":["../../src/rebac/object-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAEtD"}

package/dist/rebac/object-of.js

@@ -0,0 +1,4 @@
+export function objectOf(resource) {
+    return `${resource.type}:${resource.id}`;
+}
+//# sourceMappingURL=object-of.js.map

package/dist/rebac/object-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-of.js","sourceRoot":"","sources":["../../src/rebac/object-of.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,QAAQ,CAAC,QAAqB;IAC5C,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;AAC3C,CAAC"}

package/dist/rebac/parse-object.d.ts

@@ -0,0 +1,3 @@
+import type { ResourceRef } from '../authorization/resource-ref.js';
+export declare function parseObject(object: string): ResourceRef;
+//# sourceMappingURL=parse-object.d.ts.map

package/dist/rebac/parse-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-object.d.ts","sourceRoot":"","sources":["../../src/rebac/parse-object.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAKpE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAQvD"}

package/dist/rebac/parse-object.js

@@ -0,0 +1,10 @@
+import { InvalidTupleError } from './invalid-tuple-error.js';
+const OBJECT_PATTERN = /^([a-z][a-z0-9_-]*):([^#@\s]+)$/;
+export function parseObject(object) {
+    const [, type, id] = OBJECT_PATTERN.exec(object) ?? [];
+    if (type === undefined || id === undefined) {
+        throw new InvalidTupleError(`"${object}" is not an object: expected <type>:<id>.`);
+    }
+    return { type, id };
+}
+//# sourceMappingURL=parse-object.js.map

package/dist/rebac/parse-object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-object.js","sourceRoot":"","sources":["../../src/rebac/parse-object.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CAAC,IAAI,MAAM,2CAA2C,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC"}

package/dist/rebac/parse-subject.d.ts

@@ -0,0 +1,3 @@
+import type { SubjectRef } from './subject-ref.js';
+export declare function parseSubject(subject: string): SubjectRef;
+//# sourceMappingURL=parse-subject.d.ts.map

package/dist/rebac/parse-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-subject.d.ts","sourceRoot":"","sources":["../../src/rebac/parse-subject.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAQxD"}

package/dist/rebac/parse-subject.js

@@ -0,0 +1,11 @@
+import { InvalidTupleError } from './invalid-tuple-error.js';
+import { parseObject } from './parse-object.js';
+const NAME_PATTERN = /^[a-z][a-z0-9_-]*$/;
+export function parseSubject(subject) {
+    const [object = '', relation, ...rest] = subject.split('#');
+    if (rest.length > 0 || (relation !== undefined && !NAME_PATTERN.test(relation))) {
+        throw new InvalidTupleError(`"${subject}" is not a subject: expected <type>:<id> or <type>:<id>#<relation>.`);
+    }
+    return relation === undefined ? parseObject(object) : { ...parseObject(object), relation };
+}
+//# sourceMappingURL=parse-subject.js.map

package/dist/rebac/parse-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-subject.js","sourceRoot":"","sources":["../../src/rebac/parse-subject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,iBAAiB,CAAC,IAAI,OAAO,qEAAqE,CAAC,CAAC;IAChH,CAAC;IAED,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC7F,CAAC"}

package/dist/rebac/permission-mapping.d.ts

@@ -0,0 +1,3 @@
+/** Per resource type, the schema permission each kit permission stands for: `{ document: { 'docs:document.edit': 'edit' } }`. */
+export type PermissionMapping = Readonly<Record<string, Readonly<Record<string, string>>>>;
+//# sourceMappingURL=permission-mapping.d.ts.map

package/dist/rebac/permission-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-mapping.d.ts","sourceRoot":"","sources":["../../src/rebac/permission-mapping.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/rebac/permission-mapping.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permission-mapping.js.map

package/dist/rebac/permission-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-mapping.js","sourceRoot":"","sources":["../../src/rebac/permission-mapping.ts"],"names":[],"mappings":""}

package/dist/rebac/relation-based-authorizer.d.ts

@@ -0,0 +1,45 @@
+import { type Actor } from '@ddd-ts-kit/kernel';
+import type { AccessScope } from '../authorization/access-scope.js';
+import type { Authorizer } from '../authorization/authorizer.js';
+import type { CheckRequest } from '../authorization/check-request.js';
+import { type Decision } from '../authorization/decision.js';
+import type { ListRequest } from '../authorization/list-request.js';
+import type { ExpandNode } from './expand-node.js';
+import type { PermissionMapping } from './permission-mapping.js';
+import type { RelationTupleStore } from './relation-tuple-store.js';
+import type { Schema } from './schema.js';
+export interface RelationBasedAuthorizerOptions {
+    readonly schema: Schema;
+    readonly store: RelationTupleStore;
+    readonly mapping: PermissionMapping;
+    /** How many `object#relation` hops one check may chain. Default 16. Beyond it the answer is no. */
+    readonly maxDepth?: number;
+    /** How many subjects a listing may walk through before giving up loudly. Default 10000. */
+    readonly listLimit?: number;
+    /** The subject an actor is in the tuples. Default `<actor type>:<actor id>`, such as `user:ada`. */
+    readonly subjectOf?: (actor: Actor) => string;
+}
+/**
+ * ReBAC in the manner of Zanzibar, evaluated in process: a permission holds when the rewrites
+ * of the schema find a path of stored tuples from the object to the actor.
+ */
+export declare class RelationBasedAuthorizer implements Authorizer {
+    private readonly options;
+    constructor(options: RelationBasedAuthorizerOptions);
+    check(request: CheckRequest): Promise<Decision>;
+    /**
+     * By reverse expansion: walks every tuple reachable from the actor, then checks each object
+     * of the type it met. Cost: one read per reachable subject and userset, plus one check per
+     * candidate. Fine for thousands of tuples per actor, not for a search index.
+     */
+    listAccessible({ actor, permission, resourceType }: ListRequest): Promise<AccessScope>;
+    /** Why is this allowed, or not: the whole evaluation tree, every branch visited. For debugging. */
+    expand(request: Required<Pick<CheckRequest, 'actor' | 'permission' | 'resource'>>): Promise<ExpandNode>;
+    private mapped;
+    private evaluation;
+    private subjectOf;
+    private reachable;
+    /** How an object may itself be the subject of a tuple: as such, or as one of its usersets. */
+    private subjectFormsOf;
+}
+//# sourceMappingURL=relation-based-authorizer.d.ts.map

package/dist/rebac/relation-based-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-based-authorizer.d.ts","sourceRoot":"","sources":["../../src/rebac/relation-based-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAGpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;CAC/C;AAKD;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,UAAU;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,8BAA8B,EAEnE;IAEK,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuBpD;IAED;;;;OAIG;IACG,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmB3F;IAED,mGAAmG;IAC7F,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAU5G;IAED,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,SAAS;YAIH,SAAS;IAyBvB,8FAA8F;IAC9F,OAAO,CAAC,cAAc;CAKvB"}