@diister/quick-permission 0.9.0-beta.5

package/dist/resource.js

@@ -0,0 +1,298 @@
+/**
+ * `Resource` : source de donnée fetchable, dédupliquée par contexte.
+ *
+ * Une Resource est conçue pour être déclarée une fois dans son domaine
+ * (`userOf`, `expositionInfoOf`, etc.) et réutilisée entre permissions.
+ * Le moteur dédup les fetches au sein d'un context via `(id, dedupKey)`.
+ *
+ * Les méthodes `match`/`filter`/`includes`/`require*` sont du sucre :
+ * elles produisent des Rule via `defineRule`, avec la resource comme need.
+ *
+ * ─── Capability-mode contract ────────────────────────────────────────────
+ * A request target containing a wildcard (`"*"` or `"xxx:*"`) is a capability
+ * query — "can the subject act on ANY resource of this shape?". The engine
+ * skips resource fetches in this mode (no concrete resource to fetch). Each
+ * rule must declare what it does when its data is unavailable:
+ *
+ *   match           : silent-pass (cannot verify spec against absent data),
+ *                     but exposes the spec as a constraint for DB pushdown.
+ *   filter          : silent-pass — no projection happens; `output.data`
+ *                     stays undefined.
+ *   includes        : deny — membership cannot be checked without the resource.
+ *   requireTruthy   : deny — no value to test for truthiness.
+ *   requireOwner    : deny — no owner field to compare.
+ *   requireMembership: deny — no membership list to scan.
+ *   requireCustom   : deny — predicate cannot run without `data`.
+ *
+ * Pure rules (no `needs`) like `matchPath` and `requireSelf` are unaffected:
+ * they read `ctx.target` / `ctx.subject` only.
+ */
+import { deepEqual, defineRule } from "./rules.js";
+import { evaluateSpec, validateSpec } from "./mongo-query.js";
+class ResourceImpl {
+    // Spelled out rather than declared as constructor parameter properties:
+    // those are the one TypeScript-only construct Node's type stripping cannot
+    // erase, so they made this file unloadable as raw `.ts` there.
+    id;
+    fetcher;
+    activator;
+    dedupKey;
+    constructor(id, fetcher, activator, dedupKey) {
+        this.id = id;
+        this.fetcher = fetcher;
+        this.activator = activator;
+        this.dedupKey = dedupKey;
+    }
+    isActiveFor(grant) {
+        return this.activator ? this.activator(grant) : true;
+    }
+    computeDedupKey(ctx) {
+        if (this.dedupKey)
+            return `${this.id}::${this.dedupKey(ctx)}`;
+        // Default safe : hash de tous les inputs (subject + target + grant.with).
+        // Jamais de fausse dedup, mais peut être sous-optimal — d'où l'incitation
+        // à fournir un dedupKey explicite quand on connaît les params pertinents.
+        return `${this.id}::${ctx.subject.id}::${JSON.stringify(ctx.target)}::${JSON.stringify(ctx.grant.with ?? {})}`;
+    }
+    cacheKeyForTarget(target) {
+        // Build a synthetic FetchCtx (target-only). For `preseed()`, the
+        // caller knows the target shape but neither subject nor grant. We
+        // assume `dedupKey` only reads `target` (the recommended pattern)
+        // — if a resource's dedupKey reaches into subject/grant, `preseed`
+        // will produce a key that won't match runtime `computeDedupKey`,
+        // and the cache will silently miss. Document this limit.
+        const syntheticCtx = {
+            subject: { id: "__preseed__" },
+            target,
+            grant: { key: "__preseed__" },
+            capability: false,
+        };
+        if (this.dedupKey)
+            return `${this.id}::${this.dedupKey(syntheticCtx)}`;
+        return `${this.id}::${syntheticCtx.subject.id}::${JSON.stringify(target)}::${JSON.stringify({})}`;
+    }
+    // ─── Méthodes de sucre — toutes produites via defineRule ─────────────
+    match(extractor) {
+        const id = this.id;
+        const project = extractor ?? ((d) => d);
+        return defineRule({
+            kind: "match",
+            needs: [this],
+            check: ([data], _payload, ctx) => {
+                const spec = ctx.grant.with?.[id];
+                if (spec === undefined)
+                    return { ok: true };
+                if (typeof spec === "object" && spec !== null) {
+                    validateSpec(spec);
+                }
+                // Cap-mode without fetched data: silent-pass + expose spec as
+                // constraint (legacy behaviour — pushdown to DB for resources
+                // that ARE the listed collection).
+                //
+                // When `data` is present in cap-mode it means the resource was
+                // fetched anyway (because `Resource.targetSegment` was concrete
+                // — see system.ts collection logic). In that case we evaluate
+                // the spec like in concrete mode and DON'T emit a constraint :
+                // the check is fully resolved and the (potentially inappropriate)
+                // constraint would pollute the listed collection's `find()`.
+                if (ctx.capability && data === undefined) {
+                    if (typeof spec === "object" &&
+                        spec !== null &&
+                        !Array.isArray(spec)) {
+                        return { ok: true, constraint: spec };
+                    }
+                    return { ok: true };
+                }
+                const actual = project(data);
+                if (spec === null || typeof spec !== "object" || Array.isArray(spec)) {
+                    return deepEqual(spec, actual)
+                        ? { ok: true }
+                        : { ok: false, reason: `match[${id}] mismatch` };
+                }
+                const passes = evaluateSpec(spec, actual);
+                if (!passes) {
+                    return { ok: false, reason: `match[${id}] mismatch` };
+                }
+                // Concrete mode (or cap-mode w/ fetched data): the rule resolved
+                // fully via `evaluateSpec`. Emitting `constraint: spec` here is
+                // safe ONLY when the resource id matches the listed collection
+                // — for foreign resources it would push a wrong filter. Conservative
+                // choice : emit only in legacy concrete mode (preserves existing
+                // listWithPermission semantics for self-referencing resources like
+                // `users.read` + `userOf.match`).
+                if (!ctx.capability) {
+                    return { ok: true, constraint: spec };
+                }
+                return { ok: true };
+            },
+        });
+    }
+    filter(extractor) {
+        const project = extractor ?? ((d) => d);
+        return defineRule({
+            kind: "filter",
+            needs: [this],
+            check: ([data], _payload, ctx) => {
+                if (ctx.capability)
+                    return { ok: true };
+                const sub = project(data);
+                const filter = ctx.grant.filter;
+                // No filter on this grant → expose `null` spec so the system can
+                // collapse the cross-grant union to "all fields".
+                if (!filter ||
+                    sub === null ||
+                    typeof sub !== "object" ||
+                    Array.isArray(sub)) {
+                    return { ok: true, data: sub, filter: { source: sub, spec: null } };
+                }
+                const out = {};
+                for (const [k, v] of Object.entries(filter)) {
+                    if (v === true && k in sub) {
+                        out[k] = sub[k];
+                    }
+                }
+                return {
+                    ok: true,
+                    data: out,
+                    filter: { source: sub, spec: filter },
+                };
+            },
+        });
+    }
+    includes(grantField, extractor) {
+        return defineRule({
+            kind: "includes",
+            needs: [this],
+            // Lazy : skip si pas de spec dans le grant.
+            activeWhen: (grant) => grant.with?.[grantField] !== undefined,
+            describe: () => ({ grantField }),
+            check: ([data], _payload, ctx) => {
+                // Capability : ressource non fetchée, on ne peut pas vérifier
+                // l'inclusion concrète → deny.
+                if (ctx.capability) {
+                    return {
+                        ok: false,
+                        reason: `includes[${grantField}] cannot be verified in capability query`,
+                    };
+                }
+                const required = ctx.grant.with[grantField];
+                const list = extractor(data);
+                if (Array.isArray(required)) {
+                    return required.some((r) => list.includes(r))
+                        ? { ok: true }
+                        : {
+                            ok: false,
+                            reason: `includes[${grantField}] none of ${JSON.stringify(required)} present`,
+                        };
+                }
+                return list.includes(required)
+                    ? { ok: true }
+                    : {
+                        ok: false,
+                        reason: `includes[${grantField}] ${String(required)} absent`,
+                    };
+            },
+        });
+    }
+    requireTruthy() {
+        const id = this.id;
+        return defineRule({
+            kind: "require-truthy",
+            needs: [this],
+            check: ([data], _payload, ctx) => {
+                if (ctx.capability) {
+                    return {
+                        ok: false,
+                        reason: `require-truthy[${id}] cannot be verified in capability query`,
+                    };
+                }
+                return data
+                    ? { ok: true }
+                    : { ok: false, reason: `require-truthy[${id}] is falsy` };
+            },
+        });
+    }
+    requireOwner(getter, opts) {
+        const id = this.id;
+        return defineRule({
+            kind: "require-owner",
+            needs: [this],
+            flag: opts.flag,
+            check: ([data], _payload, ctx) => {
+                if (ctx.capability) {
+                    return {
+                        ok: false,
+                        reason: `require-owner[${id}] cannot be verified in capability query`,
+                    };
+                }
+                return getter(data) === ctx.subject.id
+                    ? { ok: true }
+                    : {
+                        ok: false,
+                        reason: `not owner of ${id} (flag: ${opts.flag})`,
+                    };
+            },
+        });
+    }
+    requireMembership(getter, opts) {
+        const id = this.id;
+        return defineRule({
+            kind: "require-membership",
+            needs: [this],
+            flag: opts.flag,
+            check: ([data], _payload, ctx) => {
+                if (ctx.capability) {
+                    return {
+                        ok: false,
+                        reason: `require-membership[${id}] cannot be verified in capability query`,
+                    };
+                }
+                const list = getter(data);
+                return list.includes(ctx.subject.id)
+                    ? { ok: true }
+                    : {
+                        ok: false,
+                        reason: `subject not member of ${id} (flag: ${opts.flag})`,
+                    };
+            },
+        });
+    }
+    requireCustom(predicate, opts) {
+        const id = this.id;
+        return defineRule({
+            kind: "require-custom",
+            needs: [this],
+            flag: opts.flag,
+            describe: opts.descriptor ? () => opts.descriptor : undefined,
+            check: ([data], _payload, ctx) => {
+                if (ctx.capability) {
+                    return {
+                        ok: false,
+                        reason: `require-custom[${id}] cannot be verified in capability query`,
+                    };
+                }
+                return predicate(data, ctx)
+                    ? { ok: true }
+                    : {
+                        ok: false,
+                        reason: `require-custom[${id}] denied (flag: ${opts.flag})`,
+                    };
+            },
+        });
+    }
+}
+/**
+ * Crée une Resource. À utiliser une fois par entité de domaine, partagée
+ * entre toutes les permissions qui la consomment.
+ *
+ * @example
+ *   const userOf = resource({
+ *     id: "user",
+ *     fetch: ({ target }) => usersRepo.findById(target[0] as string),
+ *     dedupKey: ({ target }) => target[0] as string,
+ *   });
+ */
+export function resource(opts) {
+    return new ResourceImpl(opts.id, opts.fetch, opts.activeWhen, opts.dedupKey);
+}
+//# sourceMappingURL=resource.js.map

package/dist/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE9D,MAAM,YAAY;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,+DAA+D;IAC/C,EAAE,CAAS;IACX,OAAO,CAAoC;IAC3C,SAAS,CAA6B;IACtC,QAAQ,CAA6B;IAErD,YACE,EAAU,EACV,OAA0C,EAC1C,SAAqC,EACrC,QAAoC;QAEpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,WAAW,CAAC,KAAY;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,eAAe,CAAC,GAAa;QAC3B,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,OAAO,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,CACrD,GAAG,CAAC,MAAM,CACX,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/C,CAAC;IAED,iBAAiB,CAAC,MAA0B;QAC1C,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,YAAY,GAAa;YAC7B,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE;YAC9B,MAAM;YACN,KAAK,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE;YAC7B,UAAU,EAAE,KAAK;SAClB,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvE,OAAO,GAAG,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,CAC9D,MAAM,CACP,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7B,CAAC;IAED,wEAAwE;IAExE,KAAK,CAAC,SAAgC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,CAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,CAAC,IAAI,CAAU;YACtB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;gBAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBAE5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC9C,YAAY,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;gBAED,8DAA8D;gBAC9D,8DAA8D;gBAC9D,mCAAmC;gBACnC,EAAE;gBACF,+DAA+D;gBAC/D,gEAAgE;gBAChE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,kEAAkE;gBAClE,6DAA6D;gBAC7D,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACzC,IACE,OAAO,IAAI,KAAK,QAAQ;wBACxB,IAAI,KAAK,IAAI;wBACb,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EACpB,CAAC;wBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAA+B,EAAE,CAAC;oBACnE,CAAC;oBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACtB,CAAC;gBAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAS,CAAC,CAAC;gBAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,OAAO,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;wBAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;wBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;gBACrD,CAAC;gBACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAA+B,EAAE,MAAM,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;gBACxD,CAAC;gBACD,iEAAiE;gBACjE,gEAAgE;gBAChE,+DAA+D;gBAC/D,qEAAqE;gBACrE,iEAAiE;gBACjE,mEAAmE;gBACnE,kCAAkC;gBAClC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;oBACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAA+B,EAAE,CAAC;gBACnE,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,SAAgC;QACrC,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,CAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,CAAC,IAAI,CAAU;YACtB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,CAAC,UAAU;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAS,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChC,iEAAiE;gBACjE,kDAAkD;gBAClD,IACE,CAAC,MAAM;oBACP,GAAG,KAAK,IAAI;oBACZ,OAAO,GAAG,KAAK,QAAQ;oBACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAClB,CAAC;oBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;gBACtE,CAAC;gBACD,MAAM,GAAG,GAA4B,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAK,GAA+B,EAAE,CAAC;wBACxD,GAAG,CAAC,CAAC,CAAC,GAAI,GAA+B,CAAC,CAAC,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;gBACD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;iBACtC,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CACN,UAAkB,EAClB,SAA0C;QAE1C,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,IAAI,CAAU;YACtB,4CAA4C;YAC5C,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS;YAC7D,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YAChC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;gBAC/B,8DAA8D;gBAC9D,+BAA+B;gBAC/B,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBACnB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,YAAY,UAAU,0CAA0C;qBACzE,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAK,CAAC,UAAU,CAAC,CAAC;gBAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAS,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;wBAC3C,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;wBACd,CAAC,CAAC;4BACE,EAAE,EAAE,KAAK;4BACT,MAAM,EAAE,YAAY,UAAU,aAAa,IAAI,CAAC,SAAS,CACvD,QAAQ,CACT,UAAU;yBACZ,CAAC;gBACR,CAAC;gBACD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC5B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,YAAY,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS;qBAC7D,CAAC;YACR,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,CAAC,IAAI,CAAU;YACtB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBACnB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,kBAAkB,EAAE,0CAA0C;qBACvE,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI;oBACT,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;YAC9D,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CACV,MAAuC,EACvC,IAA+B;QAE/B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,CAAC,IAAI,CAAU;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBACnB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,iBAAiB,EAAE,0CAA0C;qBACtE,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC,IAAS,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE;oBACzC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,gBAAgB,EAAE,WAAW,IAAI,CAAC,IAAI,GAAG;qBAClD,CAAC;YACR,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CACf,MAAsC,EACtC,IAA+B;QAE/B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,CAAC,IAAI,CAAU;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBACnB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,sBAAsB,EAAE,0CAA0C;qBAC3E,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAS,CAAC,CAAC;gBAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,yBAAyB,EAAE,WAAW,IAAI,CAAC,IAAI,GAAG;qBAC3D,CAAC;YACR,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CACX,SAA8C,EAC9C,IAGC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC;YAChB,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,CAAC,IAAI,CAAU;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAW,CAAC,CAAC,CAAC,SAAS;YAC9D,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;oBACnB,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,kBAAkB,EAAE,0CAA0C;qBACvE,CAAC;gBACJ,CAAC;gBACD,OAAO,SAAS,CAAC,IAAS,EAAE,GAAG,CAAC;oBAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,IAAI,CAAC,IAAI,GAAG;qBAC5D,CAAC;YACR,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAI,IAK3B;IACC,OAAO,IAAI,YAAY,CACrB,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,QAAQ,CACd,CAAC;AACJ,CAAC"}

package/dist/rules.d.ts

@@ -0,0 +1,106 @@
+/**
+ * `defineRule` — primitive unique de fabrication de rule.
+ *
+ * Toutes les rules de la lib (match, filter, includes, requireXxx) sont du
+ * sucre par-dessus cette fonction. Les devs en aval l'utilisent aussi pour
+ * écrire leurs rules métier réutilisables (cf. RFC §"Le rôle des devs").
+ */
+import type { FetchCtx, Grant, Resource, ResourcesData, Rule, RuleResult } from "./types.ts";
+export type DefineRuleOpts<RS extends readonly Resource<unknown>[], P> = {
+    /** Identifiant de famille de rule (matrix UI). */
+    readonly kind: string;
+    /**
+     * Resources à fetcher avant le check. L'ordre détermine l'ordre du tuple
+     * passé à `check`. Tableau vide = rule pure (ex: requireSelf).
+     */
+    readonly needs?: RS;
+    /**
+     * Sucre opt-in : la rule est active ssi `grant.flags?.[flag] === true`.
+     * Mutuellement exclusif avec `activeWhen`.
+     */
+    readonly flag?: string;
+    /**
+     * Escape hatch d'activation. Si retourne false, la rule est skip et ses
+     * needs ne sont pas fetchées.
+     */
+    readonly activeWhen?: (grant: Grant) => boolean;
+    /**
+     * Métadonnées additionnelles fusionnées dans le `descriptor` (matrix UI).
+     * Ne doit pas inclure les champs gérés automatiquement (kind/source/sources/flag).
+     */
+    readonly describe?: () => Readonly<Record<string, unknown>>;
+    /**
+     * Logique d'évaluation. `data` est un tuple aligné sur `needs`. `payload`
+     * est un alias de `ctx.grant.payload` casté au type générique P.
+     * Retourne soit un boolean (true = ok, false = deny avec raison auto),
+     * soit un RuleResult complet pour propager `data` ou un message custom.
+     */
+    readonly check: (data: ResourcesData<RS>, payload: P, ctx: FetchCtx) => boolean | RuleResult;
+};
+/**
+ * Fabrique une rule à partir d'une définition déclarative.
+ */
+export declare function defineRule<const RS extends readonly Resource<unknown>[], P = unknown>(opts: DefineRuleOpts<RS, P>): Rule;
+/**
+ * Rule pure (pas de needs) : compare un segment du target à `subject.id`.
+ * Opt-in via flag.
+ *
+ * @example
+ *   "users.update": permission({...}).rules([
+ *     userOf.match(),
+ *     requireSelf({ flag: "selfOnly" }),
+ *   ]),
+ *
+ *   // Grant d'admin (no flag) → silent pass
+ *   { key: "users.update", target: ["user:*"] }
+ *   // Grant self-only (flag activé) → check target[0] === subject.id
+ *   { key: "users.update", target: ["user:*"], flags: { selfOnly: true } }
+ */
+/**
+ * Translates a grant's `target[segment]` to a Mongo `{[field]: value}`
+ * constraint, exposed via the rule's `constraint` for cross-grant OR
+ * aggregation and DB pushdown. Wildcard segments (`*` or `xxx:*`) emit
+ * no constraint (= no restriction).
+ *
+ * Common case for resources stored in MongoDB by `_id`:
+ *
+ *   matchPath()                          // {_id: target[0]}
+ *   matchPath({ field: "userId" })       // {userId: target[0]}
+ *   matchPath({ segment: 1 })            // {_id: target[1]}  (e.g., target.path)
+ */
+export declare function matchPath(opts?: {
+    readonly field?: string;
+    readonly segment?: number;
+}): Rule;
+/**
+ * Validates `ctx.input` against `grant.inputWith` (Mongo spec). Distinct
+ * slot from `grant.with` so payload-shaped specs don't collide with
+ * resource-shaped specs in the same grant.
+ *
+ * Per-grant:
+ *  - no `inputWith`     → ok (unconditional grant)
+ *  - `inputWith` + input → `evaluateSpec(inputWith, input)`
+ *  - `inputWith` + no input → deny (cannot verify)
+ *
+ * Cross-grant OR aggregation: a single unconditional grant lets every check
+ * through (broadest wins); a UI capability check with no input only passes
+ * if at least one unconditional grant exists.
+ *
+ * @example
+ *   "invitations.create": permission({
+ *     target: target.path("exposition", "expo_organization"),
+ *   }).rules([inputMatch()])
+ *
+ *   { key: "invitations.create",
+ *     target: [expoId, orgId],
+ *     inputWith: { flowId: "flow:abc" } }
+ *
+ *   await ctx.can("invitations.create", [expoId, orgId], { input: body })
+ */
+export declare function inputMatch(): Rule;
+export declare function requireSelf(opts: {
+    readonly flag: string;
+    readonly segment?: number;
+}): Rule;
+export declare function deepEqual(a: unknown, b: unknown): boolean;
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,aAAa,EACb,IAAI,EACJ,UAAU,EACX,MAAM,YAAY,CAAC;AAGpB,MAAM,MAAM,cAAc,CAAC,EAAE,SAAS,SAAS,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,IAAI;IACvE,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,EACvB,OAAO,EAAE,CAAC,EACV,GAAG,EAAE,QAAQ,KACV,OAAO,GAAG,UAAU,CAAC;CAC3B,CAAC;AAEF;;GAEG;AACH,wBAAgB,UAAU,CACxB,KAAK,CAAC,EAAE,SAAS,SAAS,QAAQ,CAAC,OAAO,CAAC,EAAE,EAC7C,CAAC,GAAG,OAAO,EACX,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CA4CnC;AAED;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,IAAI,GAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,IAAI,CAgBN;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAkBjC;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,IAAI,CAeP;AAMD,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAkBzD"}

package/dist/rules.js

@@ -0,0 +1,183 @@
+/**
+ * `defineRule` — primitive unique de fabrication de rule.
+ *
+ * Toutes les rules de la lib (match, filter, includes, requireXxx) sont du
+ * sucre par-dessus cette fonction. Les devs en aval l'utilisent aussi pour
+ * écrire leurs rules métier réutilisables (cf. RFC §"Le rôle des devs").
+ */
+import { evaluateSpec, validateSpec } from "./mongo-query.js";
+/**
+ * Fabrique une rule à partir d'une définition déclarative.
+ */
+export function defineRule(opts) {
+    if (opts.flag !== undefined && opts.activeWhen !== undefined) {
+        throw new Error(`defineRule(${opts.kind}): cannot specify both 'flag' and 'activeWhen'`);
+    }
+    const needs = (opts.needs ?? []);
+    const flag = opts.flag;
+    const activeWhen = flag !== undefined
+        ? (grant) => grant.flags?.[flag] === true
+        : opts.activeWhen;
+    const descriptor = { kind: opts.kind };
+    if (needs.length === 1)
+        descriptor.source = needs[0].id;
+    if (needs.length > 1)
+        descriptor.sources = needs.map((n) => n.id);
+    if (flag !== undefined)
+        descriptor.flag = flag;
+    if (opts.describe) {
+        const extra = opts.describe();
+        for (const [k, v] of Object.entries(extra)) {
+            // Les champs auto ne peuvent pas être écrasés.
+            if (k === "kind" || k === "source" || k === "sources" || k === "flag") {
+                continue;
+            }
+            descriptor[k] = v;
+        }
+    }
+    return {
+        descriptor: descriptor,
+        needs,
+        activeWhen,
+        check: (data, ctx) => {
+            const payload = ctx.grant.payload;
+            const result = opts.check(data, payload, ctx);
+            if (typeof result === "boolean") {
+                return result
+                    ? { ok: true }
+                    : { ok: false, reason: `${opts.kind} denied` };
+            }
+            return result;
+        },
+    };
+}
+/**
+ * Rule pure (pas de needs) : compare un segment du target à `subject.id`.
+ * Opt-in via flag.
+ *
+ * @example
+ *   "users.update": permission({...}).rules([
+ *     userOf.match(),
+ *     requireSelf({ flag: "selfOnly" }),
+ *   ]),
+ *
+ *   // Grant d'admin (no flag) → silent pass
+ *   { key: "users.update", target: ["user:*"] }
+ *   // Grant self-only (flag activé) → check target[0] === subject.id
+ *   { key: "users.update", target: ["user:*"], flags: { selfOnly: true } }
+ */
+/**
+ * Translates a grant's `target[segment]` to a Mongo `{[field]: value}`
+ * constraint, exposed via the rule's `constraint` for cross-grant OR
+ * aggregation and DB pushdown. Wildcard segments (`*` or `xxx:*`) emit
+ * no constraint (= no restriction).
+ *
+ * Common case for resources stored in MongoDB by `_id`:
+ *
+ *   matchPath()                          // {_id: target[0]}
+ *   matchPath({ field: "userId" })       // {userId: target[0]}
+ *   matchPath({ segment: 1 })            // {_id: target[1]}  (e.g., target.path)
+ */
+export function matchPath(opts = {}) {
+    const field = opts.field ?? "_id";
+    const segment = opts.segment ?? 0;
+    return defineRule({
+        kind: "match-path",
+        needs: [],
+        describe: () => ({ field, segment }),
+        check: (_data, _payload, ctx) => {
+            const target = ctx.grant.target;
+            if (!target || !Array.isArray(target))
+                return { ok: true };
+            const value = target[segment];
+            if (typeof value !== "string")
+                return { ok: true };
+            if (value === "*" || value.endsWith("*"))
+                return { ok: true };
+            return { ok: true, constraint: { [field]: value } };
+        },
+    });
+}
+/**
+ * Validates `ctx.input` against `grant.inputWith` (Mongo spec). Distinct
+ * slot from `grant.with` so payload-shaped specs don't collide with
+ * resource-shaped specs in the same grant.
+ *
+ * Per-grant:
+ *  - no `inputWith`     → ok (unconditional grant)
+ *  - `inputWith` + input → `evaluateSpec(inputWith, input)`
+ *  - `inputWith` + no input → deny (cannot verify)
+ *
+ * Cross-grant OR aggregation: a single unconditional grant lets every check
+ * through (broadest wins); a UI capability check with no input only passes
+ * if at least one unconditional grant exists.
+ *
+ * @example
+ *   "invitations.create": permission({
+ *     target: target.path("exposition", "expo_organization"),
+ *   }).rules([inputMatch()])
+ *
+ *   { key: "invitations.create",
+ *     target: [expoId, orgId],
+ *     inputWith: { flowId: "flow:abc" } }
+ *
+ *   await ctx.can("invitations.create", [expoId, orgId], { input: body })
+ */
+export function inputMatch() {
+    return defineRule({
+        kind: "input-match",
+        needs: [],
+        check: (_data, _payload, ctx) => {
+            const spec = ctx.grant.inputWith;
+            if (spec === undefined || Object.keys(spec).length === 0) {
+                return { ok: true };
+            }
+            if (ctx.input === undefined) {
+                return { ok: false, reason: "input-match: input required" };
+            }
+            validateSpec(spec);
+            return evaluateSpec(spec, ctx.input)
+                ? { ok: true }
+                : { ok: false, reason: "input-match: mismatch" };
+        },
+    });
+}
+export function requireSelf(opts) {
+    const segment = opts.segment ?? 0;
+    return defineRule({
+        kind: "require-self",
+        needs: [],
+        flag: opts.flag,
+        describe: () => ({ segment }),
+        check: (_data, _payload, ctx) => ctx.target[segment] === ctx.subject.id
+            ? { ok: true }
+            : {
+                ok: false,
+                reason: `target[${segment}] is not self (flag: ${opts.flag})`,
+            },
+    });
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Helpers internes (utilisés par les méthodes resource dans resource.ts)
+// ─────────────────────────────────────────────────────────────────────────
+export function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (a === null || b === null)
+        return false;
+    if (typeof a !== "object")
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    if (Array.isArray(a) && Array.isArray(b)) {
+        return a.length === b.length && a.every((x, i) => deepEqual(x, b[i]));
+    }
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    return aKeys.every((k) => deepEqual(a[k], b[k]));
+}
+//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsC9D;;GAEG;AACH,MAAM,UAAU,UAAU,CAGxB,IAA2B;IAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gDAAgD,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAiC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,UAAU,GACd,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI;QAChD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAEtB,MAAM,UAAU,GAA4B,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,+CAA+C;YAC/C,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU,EAAE,UAAgC;QAC5C,KAAK;QACL,UAAU;QACV,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAY,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACnE,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,MAAM;oBACX,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;YACnD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CACvB,OAA+D,EAAE;IAEjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,EAAW;QAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACpC,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAChC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,EAAW;QAClB,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAC9D,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,YAAY,CAAC,IAA+B,EAAE,GAAG,CAAC,KAAK,CAAC;gBAC7D,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACrD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAG3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,EAAW;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE;YACpC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;YACd,CAAC,CAAC;gBACE,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,UAAU,OAAO,wBAAwB,IAAI,CAAC,IAAI,GAAG;aAC9D;KACR,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAE5E,MAAM,UAAU,SAAS,CAAC,CAAU,EAAE,CAAU;IAC9C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACvB,SAAS,CACN,CAA6B,CAAC,CAAC,CAAC,EAChC,CAA6B,CAAC,CAAC,CAAC,CAClC,CACF,CAAC;AACJ,CAAC"}