@docstack/client 0.0.1

package/lib/core/job-engine/index.js

@@ -0,0 +1,116 @@
+import crypto from "crypto";
+const calculateHash = (content) => {
+    return crypto.createHash("sha256").update(content).digest("hex");
+};
+const now = () => Date.now();
+export class Job {
+    constructor(model, stack) {
+        this.model = model;
+        this.stack = stack;
+        const computed = calculateHash(model.content);
+        if (computed !== model.hash) {
+            throw new Error(`Job content hash mismatch for ${model._id}`);
+        }
+    }
+    hydrate() {
+        return new Function("stack", "params", "job", `"use strict"; ${this.model.content}; return execute(stack, params, job);`);
+    }
+    async hasRunningInstance() {
+        var _a;
+        if (!this.model.isSingleton)
+            return false;
+        const existingRuns = await this.stack.db.find({
+            selector: {
+                "~class": "~JobRun",
+                jobId: this.model._id,
+                status: "RUNNING",
+            },
+            limit: 1,
+        });
+        return Boolean((_a = existingRuns === null || existingRuns === void 0 ? void 0 : existingRuns.docs) === null || _a === void 0 ? void 0 : _a.length);
+    }
+    buildRun(triggerType, runtimeArgs) {
+        const id = `JobRun-${crypto.randomUUID ? crypto.randomUUID() : crypto.randomBytes(16).toString("hex")}`;
+        const base = {
+            _id: id,
+            "~class": "~JobRun",
+            jobId: this.model._id,
+            status: "PENDING",
+            triggerType,
+            startTime: now(),
+            runtimeArgs,
+            initialMetadata: this.model.metadata ? Object.assign({}, this.model.metadata) : undefined,
+        };
+        return base;
+    }
+    async persistRun(run) {
+        const existing = await this.stack.db.get(run._id).catch(() => null);
+        const doc = existing ? Object.assign(Object.assign({}, run), { _rev: existing._rev }) : run;
+        await this.stack.db.bulkDocs([doc]);
+        return doc;
+    }
+    async persistJobMetadata(metadata) {
+        if (!metadata)
+            return;
+        const current = await this.stack.db.get(this.model._id).catch(() => null);
+        const nextDoc = Object.assign(Object.assign({}, this.model), { _rev: current === null || current === void 0 ? void 0 : current._rev, metadata });
+        await this.stack.db.bulkDocs([nextDoc]);
+    }
+    async execute(runtimeArgs, triggerType = "manual") {
+        let run = this.buildRun(triggerType, runtimeArgs);
+        run = await this.persistRun(run);
+        if (!this.model.isEnabled) {
+            run.status = "SKIPPED";
+            run.errorMessage = `Job ${this.model._id} is disabled`;
+            run.endTime = now();
+            run.durationMs = run.endTime - run.startTime;
+            await this.persistRun(run);
+            throw new Error(run.errorMessage);
+        }
+        if (await this.hasRunningInstance()) {
+            run.status = "SKIPPED";
+            run.errorMessage = `Job ${this.model._id} already has a running instance`;
+            run.endTime = now();
+            run.durationMs = run.endTime - run.startTime;
+            await this.persistRun(run);
+            throw new Error(run.errorMessage);
+        }
+        try {
+            run.status = "RUNNING";
+            run.startTime = now();
+            run = await this.persistRun(run);
+            const executor = this.hydrate();
+            const params = Object.assign(Object.assign({}, (this.model.defaultParams || {})), (runtimeArgs || {}));
+            const result = await executor(this.stack, params, this.model);
+            const finalMetadata = (result && result.metadata) || this.model.metadata;
+            if (finalMetadata) {
+                run.finalMetadata = finalMetadata;
+                this.model.metadata = finalMetadata;
+                await this.persistJobMetadata(finalMetadata);
+            }
+            run.status = "SUCCESS";
+            run.endTime = now();
+            run.durationMs = run.endTime - run.startTime;
+            return await this.persistRun(run);
+        }
+        catch (error) {
+            run.status = "FAILURE";
+            run.errorMessage = (error === null || error === void 0 ? void 0 : error.message) || String(error);
+            run.errorStack = error === null || error === void 0 ? void 0 : error.stack;
+            run.endTime = now();
+            run.durationMs = run.endTime - run.startTime;
+            return await this.persistRun(run);
+        }
+    }
+}
+export class JobEngine {
+    constructor(stack) {
+        this.stack = stack;
+    }
+    async executeJob(jobId, runtimeArgs, triggerType = "manual") {
+        const jobDoc = await this.stack.db.get(jobId);
+        const job = new Job(jobDoc, this.stack);
+        return job.execute(runtimeArgs, triggerType);
+    }
+}
+//# sourceMappingURL=index.js.map

package/lib/core/job-engine/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/job-engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAI5B,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE;IAC9C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7B,MAAM,OAAO,GAAG;IAIZ,YAAY,KAAe,EAAE,KAAkB;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAEnB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;IACL,CAAC;IAEO,OAAO;QACX,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;IAC9H,CAAC;IAEO,KAAK,CAAC,kBAAkB;;QAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAO,IAAI,CAAC,KAAK,CAAC,EAAU,CAAC,IAAI,CAAC;YACnD,QAAQ,EAAE;gBACN,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG;gBACrB,MAAM,EAAE,SAAS;aACpB;YACD,KAAK,EAAE,CAAC;SACX,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,IAAI,0CAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAEO,QAAQ,CAAC,WAA2B,EAAE,WAAiC;QAC3E,MAAM,EAAE,GAAG,UAAU,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,GAAgB;YACtB,GAAG,EAAE,EAAE;YACP,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG;YACrB,MAAM,EAAE,SAAsB;YAC9B,WAAW;YACX,SAAS,EAAE,GAAG,EAAE;YAChB,WAAW;YACX,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,mBAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAG,CAAC,CAAC,SAAS;SAChF,CAAC;QACF,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAgB;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAc,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,iCAAM,GAAG,KAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAG,CAAC,CAAC,GAAG,CAAC;QAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAU,CAAC,CAAC,CAAC;QAC3C,OAAQ,GAAmB,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,QAA8B;QAC3D,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAW,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GAAa,gCACnB,IAAI,CAAC,KAAK,KACb,IAAI,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EACnB,QAAQ,GACC,CAAC;QACd,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,OAAc,CAAC,CAAC,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,WAAiC,EAAE,cAA8B,QAAQ;QAC1F,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,YAAY,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC;YACvD,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC;YAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,YAAY,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,iCAAiC,CAAC;YAC1E,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC;YAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACtB,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,mCAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,GAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAE,CAAC;YAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,MAAM,aAAa,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YAEzE,IAAI,aAAa,EAAE,CAAC;gBAChB,GAAG,CAAC,aAAa,GAAG,aAAa,CAAC;gBAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,aAAa,CAAC;gBACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACjD,CAAC;YAED,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC;YAC7C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;YACvB,GAAG,CAAC,YAAY,GAAG,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,GAAG,CAAC,UAAU,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAC;YAC9B,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC;YAC7C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;CACJ;AAED,MAAM,OAAO,SAAS;IAGlB,YAAY,KAAkB;QAC1B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,WAAiC,EAAE,cAA8B,QAAQ;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAW,KAAK,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;CACJ"}

package/lib/core/policy-engine/index.d.ts

@@ -0,0 +1,97 @@
+import type ClientStack from "../stack.js";
+import type { Document } from "@docstack/shared";
+/** The type of operation being authorized: read or write. */
+export type PolicyOperation = "read" | "write";
+/**
+ * Engine for evaluating access control policies on documents.
+ *
+ * PolicyEngine implements role-based access control (RBAC) by evaluating
+ * policy rules against documents and user sessions. Policies can be:
+ * - Class-level (apply to all documents of a class)
+ * - User-specific (apply only to a specific user)
+ * - Group-specific (apply only to users in a specific group)
+ *
+ * Policy rules are JavaScript expressions that receive the document,
+ * session, and groupId as context and return a boolean.
+ *
+ * @example
+ * ```typescript
+ * // Policy engine is used automatically during document operations
+ * // Policies are defined as documents:
+ * await stack.createDoc(null, '~Policy', null, {
+ *     name: 'user-read-own',
+ *     targetClass: ['User'],
+ *     rule: 'return document.userId === session.userId;'
+ * });
+ * ```
+ */
+export declare class PolicyEngine {
+    /** Reference to the parent stack for database and session access. */
+    private readonly stack;
+    /**
+     * Creates a new PolicyEngine instance.
+     * @param stack - The parent ClientStack instance
+     */
+    constructor(stack: ClientStack);
+    /**
+     * Gets the current authentication session proof.
+     * @returns The session proof, or undefined if not authenticated
+     */
+    private getSessionProof;
+    /**
+     * Checks if a class should bypass policy evaluation.
+     * System classes (prefixed with ~) are always allowed.
+     *
+     * @param targetClass - The class name to check
+     * @returns `true` if the class should bypass policies
+     */
+    private shouldBypass;
+    private loadPolicies;
+    private getTargetIdentifiers;
+    private resolveClassTarget;
+    /**
+     * Evaluates a policy rule against a document and session.
+     * The rule is a JavaScript expression that returns a boolean.
+     *
+     * @param policy - The policy containing the rule
+     * @param document - The document being accessed
+     * @param session - The current auth session
+     * @returns Whether the rule permits access
+     */
+    private evaluateRule;
+    private filterPoliciesForSession;
+    private authorize;
+    /**
+     * Ensures write access is allowed for a document of the given class.
+     * Throws an error if no policy permits the write operation.
+     *
+     * @param targetClass - The class of the document being written
+     * @param document - The document to write
+     * @throws Error if write is not permitted
+     *
+     * @example
+     * ```typescript
+     * // Called automatically during createDoc/updateCard operations
+     * await policyEngine.ensureWriteAllowed('Task', taskDocument);
+     * ```
+     */
+    ensureWriteAllowed(targetClass: string, document: Document | null): Promise<void>;
+    /**
+     * Checks if a document is readable by the current user.
+     * Used to filter query results based on read policies.
+     *
+     * @param document - The document to check
+     * @returns `true` if the document can be read
+     * @throws Error if the stack is not authenticated
+     *
+     * @example
+     * ```typescript
+     * // Used internally during findDocuments
+     * const readable = await policyEngine.isReadableDocument(doc);
+     * if (readable) {
+     *     results.push(doc);
+     * }
+     * ```
+     */
+    isReadableDocument(document: Document): Promise<boolean>;
+}

package/lib/core/policy-engine/index.js

@@ -0,0 +1,150 @@
+const SYSTEM_CLASSES = new Set([
+    "~Policy",
+    "~Job",
+    "~JobRun",
+    "~AuthModule",
+    "~UserSession",
+    "class",
+    "domain"
+]);
+export class PolicyEngine {
+    constructor(stack) {
+        this.stack = stack;
+    }
+    getSessionProof() {
+        return this.stack.authSession;
+    }
+    shouldBypass(targetClass) {
+        if (SYSTEM_CLASSES.has(targetClass))
+            return true;
+        const normalized = targetClass.startsWith("~") ? targetClass.slice(1) : `~${targetClass}`;
+        return SYSTEM_CLASSES.has(normalized);
+    }
+    async loadPolicies(targetClass, aliases = []) {
+        const identifiers = new Set([targetClass, ...aliases]);
+        const result = await this.stack.findDocuments({ "~class": "~Policy" });
+        return result.docs.filter((doc) => {
+            if (!Array.isArray(doc.targetClass))
+                return false;
+            return doc.targetClass.some((entry) => identifiers.has(entry));
+        });
+    }
+    getTargetIdentifiers(targetId, targetName) {
+        const identifiers = new Set();
+        const variants = [targetId, targetName];
+        for (const value of variants) {
+            identifiers.add(value);
+            if (value.startsWith("~")) {
+                identifiers.add(value.slice(1));
+            }
+            else {
+                identifiers.add(`~${value}`);
+            }
+        }
+        return Array.from(identifiers);
+    }
+    async resolveClassTarget(targetClass) {
+        var _a, _b;
+        const classModel = await this.stack.getClassModel(targetClass).catch(() => null);
+        return {
+            id: (_a = classModel === null || classModel === void 0 ? void 0 : classModel._id) !== null && _a !== void 0 ? _a : targetClass,
+            name: (_b = classModel === null || classModel === void 0 ? void 0 : classModel.name) !== null && _b !== void 0 ? _b : targetClass,
+        };
+    }
+    async evaluateRule(policy, document, session) {
+        const executor = new Function("document", "session", "groupId", `"use strict"; ${policy.rule}`);
+        const result = executor(document || {}, session.session, session.session.groupId);
+        if (result instanceof Promise) {
+            return Boolean(await result);
+        }
+        return Boolean(result);
+    }
+    filterPoliciesForSession(policies, session) {
+        const sessionUserId = session.session.userId || session.session.username;
+        const sessionGroups = Array.isArray(session.session.groupId)
+            ? session.session.groupId
+            : session.session.groupId
+                ? [session.session.groupId]
+                : [];
+        return policies.filter((policy) => {
+            const matchesUser = !policy.userId || policy.userId === sessionUserId || policy.userId === session.session.username;
+            const matchesGroup = !policy.groupId || sessionGroups.includes(policy.groupId);
+            return matchesUser && matchesGroup;
+        });
+    }
+    async authorize(targetClass, operation, document) {
+        const { id: targetId, name: targetName } = await this.resolveClassTarget(targetClass);
+        const identifiers = this.getTargetIdentifiers(targetId, targetName);
+        if (this.shouldBypass(targetName)) {
+            return true;
+        }
+        const policies = await this.loadPolicies(targetId, identifiers);
+        if (policies.length === 0) {
+            return true;
+        }
+        const session = this.getSessionProof();
+        if (!session) {
+            throw new Error("Stack is not authenticated for policy evaluation");
+        }
+        const targetedPolicies = policies.filter((policy) => policy.userId || policy.groupId);
+        const basePolicies = policies.filter((policy) => !policy.userId && !policy.groupId);
+        const matchingPolicies = targetedPolicies.length > 0
+            ? this.filterPoliciesForSession(targetedPolicies, session)
+            : this.filterPoliciesForSession(basePolicies, session);
+        if (targetedPolicies.length > 0 && matchingPolicies.length === 0) {
+            throw new Error(`No matching policy allowed ${operation} on class '${targetClass}'`);
+        }
+        let allowed = false;
+        for (const policy of matchingPolicies) {
+            const result = await this.evaluateRule(policy, document, session);
+            if (result === false) {
+                throw new Error(`Policy '${policy._id}' denied ${operation} on class '${targetClass}'`);
+            }
+            if (result === true) {
+                allowed = true;
+            }
+        }
+        return allowed;
+    }
+    async ensureWriteAllowed(targetClass, document) {
+        const allowed = await this.authorize(targetClass, "write", document);
+        if (!allowed) {
+            throw new Error(`No matching policy allowed write on class '${targetClass}'`);
+        }
+    }
+    async isReadableDocument(document) {
+        const targetClass = document === null || document === void 0 ? void 0 : document["~class"];
+        const { id: targetId, name: targetName } = await this.resolveClassTarget(targetClass);
+        if (!targetClass || this.shouldBypass(targetName)) {
+            return true;
+        }
+        const policies = await this.loadPolicies(targetId, this.getTargetIdentifiers(targetId, targetName));
+        if (policies.length === 0) {
+            return true;
+        }
+        const session = this.getSessionProof();
+        if (!session) {
+            throw new Error("Stack is not authenticated for policy evaluation");
+        }
+        const targetedPolicies = policies.filter((policy) => policy.userId || policy.groupId);
+        const basePolicies = policies.filter((policy) => !policy.userId && !policy.groupId);
+        const matchingPolicies = targetedPolicies.length > 0
+            ? this.filterPoliciesForSession(targetedPolicies, session)
+            : this.filterPoliciesForSession(basePolicies, session);
+        if (targetedPolicies.length > 0 && matchingPolicies.length === 0) {
+            return false;
+        }
+        let permitted = false;
+        for (const policy of matchingPolicies) {
+            const result = await this.evaluateRule(policy, document, session);
+            if (result === false) {
+                return false;
+            }
+            if (result === true) {
+                permitted = true;
+            }
+        }
+        return permitted;
+    }
+}
+//# sourceMappingURL=index.js.map

package/lib/core/policy-engine/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/policy-engine/index.ts"],"names":[],"mappings":"AAGA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC3B,SAAS;IACT,MAAM;IACN,SAAS;IACT,aAAa;IACb,cAAc;IACd,OAAO;IACP,QAAQ;CACX,CAAC,CAAC;AAIH,MAAM,OAAO,YAAY;IAGrB,YAAY,KAAkB;QAC1B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IAEO,eAAe;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IAClC,CAAC;IAEO,YAAY,CAAC,WAAmB;QACpC,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;QAC1F,OAAO,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,UAAoB,EAAE;QAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CACzC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAC1B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClD,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,oBAAoB,CAAC,QAAgB,EAAE,UAAkB;QAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC3B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACJ,WAAW,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;YACjC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,WAAmB;;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO;YACH,EAAE,EAAE,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,GAAG,mCAAI,WAAW;YAClC,IAAI,EAAE,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,IAAI,mCAAI,WAAW;SACxC,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAmB,EAAE,QAAyB,EAAE,OAAyB;QAChG,MAAM,QAAQ,GAAG,IAAI,QAAQ,CACzB,UAAU,EACV,SAAS,EACT,SAAS,EACT,iBAAiB,MAAM,CAAC,IAAI,EAAE,CACiE,CAAC;QAEpG,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClF,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,wBAAwB,CAAC,QAAuB,EAAE,OAAyB;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzE,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAE,OAAO,CAAC,OAAe,CAAC,OAAO,CAAC;YACjE,CAAC,CAAE,OAAO,CAAC,OAAe,CAAC,OAAO;YAClC,CAAC,CAAE,OAAO,CAAC,OAAe,CAAC,OAAO;gBAC9B,CAAC,CAAC,CAAE,OAAO,CAAC,OAAe,CAAC,OAAO,CAAC;gBACpC,CAAC,CAAC,EAAE,CAAC;QAEb,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YAC9B,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpH,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/E,OAAO,WAAW,IAAI,YAAY,CAAC;QACvC,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,SAA0B,EAAE,QAAyB;QAC9F,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEpE,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,EAAE,OAAO,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,cAAc,WAAW,GAAG,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,GAAG,YAAY,SAAS,cAAc,WAAW,GAAG,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,GAAG,IAAI,CAAC;YACnB,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,QAAyB;QAC1E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,WAAW,GAAG,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,QAAkB;QAC9C,MAAM,WAAW,GAAI,QAAgB,aAAhB,QAAQ,uBAAR,QAAQ,CAAW,QAAQ,CAAW,CAAC;QAC5D,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACtF,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACpG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,gBAAgB,EAAE,OAAO,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClB,SAAS,GAAG,IAAI,CAAC;YACrB,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;CACJ"}

package/lib/core/query-engine/accumulators.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Creates an array of accumulator instances based on the aggregate functions in the query plan.
+ * @param {Array<object>} aggregates A list of aggregate function definitions from the plan.
+ * @param {string} fromAlias The alias for the FROM table.
+ * @param {object} joinAliases A map of join aliases.
+ * @returns {Array<object>} An array of initialized accumulator instances.
+ * @throws {Error} If an unsupported aggregate function is specified.
+ */
+export declare function createAccumulators(aggregates: any, fromAlias: any, joinAliases: any): any;

package/lib/core/query-engine/accumulators.js

@@ -0,0 +1,258 @@
+// @ts-nocheck
+import { evalExpression } from './evaluator.js';
+/**
+ * Accumulator for the SUM() aggregate function.
+ */
+class Sum {
+    /**
+     * @param {string} alias The result alias for this aggregate.
+     * @param {object} expr The expression to be summed.
+     * @param {string} fromAlias The alias of the FROM table.
+     * @param {object} joinAliases A map of join table aliases.
+     */
+    constructor(alias, expr, fromAlias, joinAliases) {
+        this.alias = alias;
+        this.expr = expr;
+        this.fromAlias = fromAlias;
+        this.joinAliases = joinAliases;
+        this.sum = 0;
+        this.seen = false;
+    }
+    /**
+     * Adds a row's value to the sum.
+     * @param {object} row The row to process.
+     */
+    async add(row) {
+        const val = await evalExpression(row, this.expr, this.fromAlias, this.joinAliases);
+        if (val != null && typeof val === 'number') {
+            this.sum += val;
+            this.seen = true;
+        }
+    }
+    /**
+     * Returns the final sum.
+     * @returns {number|null} The total sum, or null if no values were added.
+     */
+    result() { return this.seen ? this.sum : null; }
+}
+/**
+ * Accumulator for the COUNT() aggregate function.
+ */
+class Count {
+    /**
+    * @param {string} alias The result alias for this aggregate.
+    * @param {object} expr The expression to be counted.
+    * @param {string} fromAlias The alias of the FROM table.
+    * @param {object} joinAliases A map of join table aliases.
+    */
+    constructor(alias, expr, fromAlias, joinAliases) {
+        this.alias = alias;
+        this.expr = expr;
+        this.fromAlias = fromAlias;
+        this.joinAliases = joinAliases;
+        this.count = 0;
+    }
+    /**
+     * Increments the count for a row. For COUNT(column), it only counts non-null values.
+     * For COUNT(*), it counts all rows.
+     * @param {object} row The row to process.
+     */
+    async add(row) {
+        if (this.expr.type === 'star') {
+            this.count++;
+        }
+        else {
+            const val = await evalExpression(row, this.expr, this.fromAlias, this.joinAliases);
+            if (val != null) {
+                this.count++;
+            }
+        }
+    }
+    /**
+     * Returns the final count.
+     * @returns {number} The total count.
+     */
+    result() { return this.count; }
+}
+/**
+ * Accumulator for the AVG() aggregate function.
+ */
+class Avg {
+    /**
+     * @param {string} alias The result alias for this aggregate.
+     * @param {object} expr The expression to be averaged.
+     * @param {string} fromAlias The alias of the FROM table.
+     * @param {object} joinAliases A map of join table aliases.
+     */
+    constructor(alias, expr, fromAlias, joinAliases) {
+        this.alias = alias;
+        this.expr = expr;
+        this.fromAlias = fromAlias;
+        this.joinAliases = joinAliases;
+        this.sum = 0;
+        this.count = 0;
+    }
+    /**
+     * Adds a row's value to the running sum and increments the count.
+     * @param {object} row The row to process.
+     */
+    async add(row) {
+        const val = await evalExpression(row, this.expr, this.fromAlias, this.joinAliases);
+        if (val != null && typeof val === 'number') {
+            this.sum += val;
+            this.count++;
+        }
+    }
+    /**
+     * Returns the final average.
+     * @returns {number|null} The average, or null if no values were added.
+     */
+    result() { return this.count > 0 ? this.sum / this.count : null; }
+}
+/**
+ * Accumulator for the MIN() aggregate function.
+ */
+class Min {
+    /**
+     * @param {string} alias The result alias for this aggregate.
+     * @param {object} expr The expression to find the minimum of.
+     * @param {string} fromAlias The alias of the FROM table.
+     * @param {object} joinAliases A map of join table aliases.
+     */
+    constructor(alias, expr, fromAlias, joinAliases) {
+        this.alias = alias;
+        this.expr = expr;
+        this.fromAlias = fromAlias;
+        this.joinAliases = joinAliases;
+        this.min = null;
+    }
+    /**
+     * Updates the minimum value based on the current row.
+     * @param {object} row The row to process.
+     */
+    async add(row) {
+        const val = await evalExpression(row, this.expr, this.fromAlias, this.joinAliases);
+        if (val != null) {
+            if (this.min === null || val < this.min) {
+                this.min = val;
+            }
+        }
+    }
+    /**
+     * Returns the final minimum value.
+     * @returns {*} The minimum value, or null if no values were processed.
+     */
+    result() { return this.min; }
+}
+/**
+ * Accumulator for the MAX() aggregate function.
+ */
+class Max {
+    /**
+     * @param {string} alias The result alias for this aggregate.
+     * @param {object} expr The expression to find the maximum of.
+     * @param {string} fromAlias The alias of the FROM table.
+     * @param {object} joinAliases A map of join table aliases.
+     */
+    constructor(alias, expr, fromAlias, joinAliases) {
+        this.alias = alias;
+        this.expr = expr;
+        this.fromAlias = fromAlias;
+        this.joinAliases = joinAliases;
+        this.max = null;
+    }
+    /**
+     * Updates the maximum value based on the current row.
+     * @param {object} row The row to process.
+     */
+    async add(row) {
+        const val = await evalExpression(row, this.expr, this.fromAlias, this.joinAliases);
+        if (val != null) {
+            if (this.max === null || val > this.max) {
+                this.max = val;
+            }
+        }
+    }
+    /**
+     * Returns the final maximum value.
+     * @returns {*} The maximum value, or null if no values were processed.
+     */
+    result() { return this.max; }
+}
+/**
+ * A wrapper class that adds DISTINCT functionality to another accumulator.
+ * It ensures that the inner accumulator only processes unique values.
+ */
+class DistinctWrapper {
+    /**
+     * @param {object} innerAccumulator The accumulator to wrap (e.g., Count, Sum).
+     */
+    constructor(innerAccumulator) {
+        this.inner = innerAccumulator;
+        this.seen = new Set();
+        this.alias = this.inner.alias;
+    }
+    /**
+     * Adds a row's value to the inner accumulator only if it hasn't been seen before.
+     * @param {object} row The row to process.
+     */
+    async add(row) {
+        const val = await evalExpression(row, this.inner.expr, this.inner.fromAlias, this.inner.joinAliases);
+        const key = JSON.stringify(val); // Use JSON to handle objects/arrays as keys
+        if (!this.seen.has(key)) {
+            this.seen.add(key);
+            // Delegate to the inner accumulator, which will re-evaluate, but only for unique values
+            await this.inner.add(row);
+        }
+    }
+    /**
+     * Returns the result from the inner accumulator.
+     * @returns {*} The final aggregated result.
+     */
+    result() {
+        return this.inner.result();
+    }
+}
+/**
+ * Creates an array of accumulator instances based on the aggregate functions in the query plan.
+ * @param {Array<object>} aggregates A list of aggregate function definitions from the plan.
+ * @param {string} fromAlias The alias for the FROM table.
+ * @param {object} joinAliases A map of join aliases.
+ * @returns {Array<object>} An array of initialized accumulator instances.
+ * @throws {Error} If an unsupported aggregate function is specified.
+ */
+export function createAccumulators(aggregates, fromAlias, joinAliases) {
+    return aggregates.map(agg => {
+        const alias = agg.as || agg.expr.name;
+        const expr = agg.expr.args.expr;
+        const isDistinct = agg.expr.args.distinct;
+        let accumulator;
+        switch (agg.expr.name) {
+            case 'COUNT':
+                accumulator = new Count(alias, expr, fromAlias, joinAliases);
+                break;
+            case 'SUM':
+                accumulator = new Sum(alias, expr, fromAlias, joinAliases);
+                break;
+            case 'AVG':
+                accumulator = new Avg(alias, expr, fromAlias, joinAliases);
+                break;
+            case 'MIN':
+                accumulator = new Min(alias, expr, fromAlias, joinAliases);
+                break;
+            case 'MAX':
+                accumulator = new Max(alias, expr, fromAlias, joinAliases);
+                break;
+            default:
+                throw new Error(`Unsupported aggregate function: ${agg.expr.name}`);
+        }
+        if (isDistinct) {
+            // COUNT(*) should not be distinct
+            if (expr.type === 'star')
+                return accumulator;
+            return new DistinctWrapper(accumulator);
+        }
+        return accumulator;
+    });
+}
+//# sourceMappingURL=accumulators.js.map

package/lib/core/query-engine/accumulators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accumulators.js","sourceRoot":"","sources":["../../../src/core/query-engine/accumulators.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;GAEG;AACH,MAAM,GAAG;IACL;;;;;OAKG;IACH,YAAY,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;IACtB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAG;QACT,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,KAAK;IACN;;;;;MAKE;IACH,YAAY,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,GAAG;QACT,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnF,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBACd,IAAI,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;QACL,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,GAAG;IACL;;;;;OAKG;IACH,YAAY,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACb,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAG;QACT,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC;YAChB,IAAI,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;CACrE;AAED;;GAEG;AACH,MAAM,GAAG;IACL;;;;;OAKG;IACH,YAAY,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;IACpB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAG;QACT,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;YACnB,CAAC;QACL,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,GAAG;IACL;;;;;OAKG;IACH,YAAY,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;IACpB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAG;QACT,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;YACnB,CAAC;QACL,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,eAAe;IACjB;;OAEG;IACH,YAAY,gBAAgB;QACxB,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,GAAG;QACT,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,4CAA4C;QAE7E,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,wFAAwF;YACxF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/B,CAAC;CACJ;AAGD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW;IACjE,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAE1C,IAAI,WAAW,CAAC;QAEhB,QAAO,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,OAAO;gBACR,WAAW,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM;YACV,KAAK,KAAK;gBACN,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC3D,MAAM;YACV,KAAK,KAAK;gBACN,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC3D,MAAM;YACV,KAAK,KAAK;gBACN,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC3D,MAAM;YACV,KAAK,KAAK;gBACN,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC3D,MAAM;YACV;gBACI,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACb,kCAAkC;YAClC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,WAAW,CAAC;YAC7C,OAAO,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,WAAW,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}