@empire-builder-kit/runtime 1.0.0-beta.9 → 1.0.0-rc.2

package/src/authorization/delegation.js

@@ -0,0 +1,401 @@
+import { __awaiter } from "tslib";
+import { createHash, randomBytes, randomUUID, timingSafeEqual, } from 'node:crypto';
+import { isBoundedSafeReference } from '../safe-reference.js';
+import { denyAuthorization, composeDelegatedAuthorizationPrincipalModel, } from './model.js';
+export const DELEGATION_GRANT_SCHEMA_VERSION = 1;
+export const DEFAULT_MAX_DELEGATION_TTL_SECONDS = 60 * 60;
+export const MAX_DELEGATION_WRITE_ATTEMPTS = 4;
+const SAFE_NAME = /^[a-z][a-z0-9-]{0,62}$/;
+const CAPABILITY_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+function requiredReference(value, label) {
+    const normalized = value.trim();
+    if (!isBoundedSafeReference(normalized)) {
+        throw new Error(`[runtime/authorization] Delegation ${label} must be a bounded safe reference.`);
+    }
+    return normalized;
+}
+function parseInstant(value, label) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        throw new Error(`[runtime/authorization] Delegation ${label} must be a valid instant.`);
+    }
+    return parsed;
+}
+function positiveInteger(value, label) {
+    if (value !== undefined && (!Number.isSafeInteger(value) || value < 1)) {
+        throw new Error(`[runtime/authorization] Delegation ${label} must be a positive safe integer.`);
+    }
+    return value;
+}
+function normalizedUnique(values, label, allowEmpty = false) {
+    const normalized = values.map((value) => requiredReference(value, label));
+    if ((!allowEmpty && normalized.length === 0) ||
+        new Set(normalized).size !== normalized.length) {
+        throw new Error(`[runtime/authorization] Delegation ${label} must contain unique values.`);
+    }
+    return Object.freeze(normalized);
+}
+function normalizeBoundary(boundary) {
+    const resourceType = requiredReference(boundary.resourceType, 'resource type');
+    if (boundary.kind === 'exact') {
+        return Object.freeze({
+            kind: 'exact',
+            resourceIds: normalizedUnique(boundary.resourceIds, 'resource ids'),
+            resourceType,
+        });
+    }
+    if (boundary.kind === 'constraint') {
+        return Object.freeze({
+            constraintId: requiredReference(boundary.constraintId, 'constraint id'),
+            kind: 'constraint',
+            resourceType,
+        });
+    }
+    throw new Error('[runtime/authorization] Delegation resource boundary is invalid.');
+}
+function capabilityDigest(audience, capability) {
+    return createHash('sha256')
+        .update(audience, 'utf8')
+        .update('\0', 'utf8')
+        .update(capability, 'utf8')
+        .digest('hex');
+}
+function capabilityMatches(grant, audience, capability) {
+    if (audience !== grant.audience ||
+        !CAPABILITY_PATTERN.test(capability) ||
+        !/^[a-f0-9]{64}$/.test(grant.capabilityDigest)) {
+        return false;
+    }
+    const expected = Buffer.from(grant.capabilityDigest, 'hex');
+    const actual = Buffer.from(capabilityDigest(audience, capability), 'hex');
+    return expected.length === actual.length && timingSafeEqual(expected, actual);
+}
+function policyVersion(grant) {
+    var _a;
+    return (_a = grant === null || grant === void 0 ? void 0 : grant.issuedUnderPolicyVersion) !== null && _a !== void 0 ? _a : 'delegation-v1';
+}
+function cloneGrant(grant) {
+    return structuredClone(grant);
+}
+function createGrant(input, capability) {
+    var _a, _b, _c, _d;
+    if (input.delegator.actor.type !== 'user' ||
+        input.delegator.authority.mode !== 'direct') {
+        throw new Error('[runtime/authorization] Delegation must be issued by a direct authenticated human.');
+    }
+    if (input.agent.kind !== 'agent' ||
+        input.agent.actor.id === input.delegator.actor.id) {
+        throw new Error('[runtime/authorization] Delegation target must be a distinct PrincipalKind agent.');
+    }
+    if (!SAFE_NAME.test(input.slice)) {
+        throw new Error('[runtime/authorization] Delegation Slice must be a safe name.');
+    }
+    const now = parseInstant(input.now, 'issuedAt');
+    const expiresAt = parseInstant(input.expiresAt, 'expiresAt');
+    if (expiresAt <= now ||
+        expiresAt - now > DEFAULT_MAX_DELEGATION_TTL_SECONDS * 1000) {
+        throw new Error(`[runtime/authorization] Delegation lifetime must be positive and no longer than ${DEFAULT_MAX_DELEGATION_TTL_SECONDS} seconds.`);
+    }
+    const actions = normalizedUnique(input.actions, 'actions');
+    const nonDelegableApprovalActions = normalizedUnique((_a = input.nonDelegableApprovalActions) !== null && _a !== void 0 ? _a : [], 'non-delegable approval actions', true);
+    if (nonDelegableApprovalActions.some((action) => !actions.includes(action))) {
+        throw new Error('[runtime/authorization] Non-delegable approval actions must be included in the grant actions.');
+    }
+    const capabilityScopes = normalizedUnique((_b = input.capabilityScopes) !== null && _b !== void 0 ? _b : [], 'capability scopes', true);
+    const maxUses = positiveInteger(input.maxUses, 'maxUses');
+    const rateLimit = input.rateLimit
+        ? {
+            maximumUses: (_c = positiveInteger(input.rateLimit.maximumUses, 'rateLimit.maximumUses')) !== null && _c !== void 0 ? _c : 0,
+            windowSeconds: (_d = positiveInteger(input.rateLimit.windowSeconds, 'rateLimit.windowSeconds')) !== null && _d !== void 0 ? _d : 0,
+        }
+        : undefined;
+    return Object.freeze(Object.assign(Object.assign(Object.assign(Object.assign({ actions, agent: Object.freeze({
+            id: requiredReference(input.agent.actor.id, 'agent id'),
+            type: input.agent.actor.type,
+        }), audience: requiredReference(input.audience, 'audience'), capabilityDigest: capabilityDigest(input.audience, capability), capabilityScopes, delegator: Object.freeze({
+            id: requiredReference(input.delegator.actor.id, 'delegator id'),
+            type: 'user',
+        }), expiresAt: new Date(expiresAt).toISOString(), id: randomUUID(), issuedAt: new Date(now).toISOString(), issuedUnderPolicyVersion: requiredReference(input.issuedUnderPolicyVersion, 'policy version') }, (maxUses ? { maxUses } : {})), { nonDelegableApprovalActions, purposeReference: requiredReference(input.purposeReference, 'purpose reference') }), (rateLimit ? { rateLimit: Object.freeze(rateLimit) } : {})), { resourceBoundary: normalizeBoundary(input.resourceBoundary), revision: 0, schemaVersion: DELEGATION_GRANT_SCHEMA_VERSION, slice: input.slice, status: 'active', usage: Object.freeze({ rateWindowUses: 0, totalUses: 0 }) }));
+}
+/**
+ * Issues and persists an attended grant. The operation caller must already
+ * have authorized the grant-creation action; this function enforces the
+ * structural delegation invariants and never persists the opaque capability.
+ */
+export function issueDelegation(store, input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const capability = randomBytes(32).toString('base64url');
+        const grant = createGrant(input, capability);
+        if (!(yield store.create(cloneGrant(grant)))) {
+            throw new Error('[runtime/authorization] Delegation grant could not be created.');
+        }
+        return { capability, grant };
+    });
+}
+function boundaryMatches(grant, resource, context, matchesConstraint) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (resource.type !== grant.resourceBoundary.resourceType)
+            return false;
+        if (grant.resourceBoundary.kind === 'exact') {
+            return (typeof resource.id === 'string' &&
+                grant.resourceBoundary.resourceIds.includes(resource.id));
+        }
+        if (!matchesConstraint)
+            return false;
+        try {
+            return ((yield matchesConstraint(grant.resourceBoundary.constraintId, resource, context)) === true);
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+}
+function currentRateUsage(grant, now) {
+    const startedAt = grant.usage.rateWindowStartedAt
+        ? Date.parse(grant.usage.rateWindowStartedAt)
+        : Number.NaN;
+    if (!grant.rateLimit ||
+        !Number.isFinite(startedAt) ||
+        now >= startedAt + grant.rateLimit.windowSeconds * 1000) {
+        return { startedAt: new Date(now).toISOString(), uses: 0 };
+    }
+    return {
+        startedAt: new Date(startedAt).toISOString(),
+        uses: grant.usage.rateWindowUses,
+    };
+}
+function usageDenial(grant, now) {
+    if (grant.maxUses !== undefined && grant.usage.totalUses >= grant.maxUses) {
+        return denyAuthorization('delegation-rate-limited', policyVersion(grant));
+    }
+    const rate = currentRateUsage(grant, now);
+    if (grant.rateLimit !== undefined &&
+        rate.uses >= grant.rateLimit.maximumUses) {
+        return denyAuthorization('delegation-rate-limited', policyVersion(grant));
+    }
+    return undefined;
+}
+function consumeGrant(grant, now) {
+    const rate = currentRateUsage(grant, now);
+    return Object.freeze(Object.assign(Object.assign({}, cloneGrant(grant)), { revision: grant.revision + 1, usage: Object.freeze({
+            lastUsedAt: new Date(now).toISOString(),
+            rateWindowStartedAt: rate.startedAt,
+            rateWindowUses: rate.uses + 1,
+            totalUses: grant.usage.totalUses + 1,
+        }) }));
+}
+function preflightDelegation(grant, input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const version = policyVersion(grant);
+        const now = Date.parse(input.context.now);
+        if (!Number.isFinite(now)) {
+            return { decision: denyAuthorization('policy-input-invalid', version) };
+        }
+        if (grant.agent.id !== input.agent.actor.id ||
+            grant.agent.type !== input.agent.actor.type ||
+            input.agent.kind !== 'agent' ||
+            !capabilityMatches(grant, input.audience, input.capability) ||
+            !grant.actions.includes(input.action)) {
+            return {
+                decision: denyAuthorization('delegation-out-of-bounds', version),
+            };
+        }
+        if (grant.status === 'revoked') {
+            return { decision: denyAuthorization('delegation-revoked', version) };
+        }
+        if (grant.status === 'expired' || now >= Date.parse(grant.expiresAt)) {
+            return { decision: denyAuthorization('delegation-expired', version) };
+        }
+        if (grant.status !== 'active') {
+            return {
+                decision: denyAuthorization('delegation-out-of-bounds', version),
+            };
+        }
+        const requiredScopes = (_a = input.requiredCapabilityScopes) !== null && _a !== void 0 ? _a : [];
+        if (new Set(requiredScopes).size !== requiredScopes.length ||
+            grant.capabilityScopes.some((scope) => !input.agent.scopes.includes(scope)) ||
+            requiredScopes.some((scope) => !grant.capabilityScopes.includes(scope) ||
+                !input.agent.scopes.includes(scope))) {
+            return {
+                decision: denyAuthorization('delegation-out-of-bounds', version),
+            };
+        }
+        if (grant.issuedUnderPolicyVersion !== input.evaluator.policyVersion) {
+            return {
+                decision: denyAuthorization('policy-stale', input.evaluator.policyVersion),
+            };
+        }
+        if (!(yield boundaryMatches(grant, input.resource, input.context, input.matchesConstraint))) {
+            return {
+                decision: denyAuthorization('delegation-out-of-bounds', version),
+            };
+        }
+        const limited = usageDenial(grant, now);
+        if (limited)
+            return { decision: limited };
+        let delegator;
+        try {
+            delegator = yield input.resolveDelegator({
+                context: input.context,
+                delegator: grant.delegator,
+                resource: input.resource,
+            });
+        }
+        catch (_b) {
+            return {
+                decision: denyAuthorization('authorization-unavailable', version),
+            };
+        }
+        if (!delegator ||
+            delegator.authority.mode !== 'direct' ||
+            delegator.actor.type !== 'user' ||
+            delegator.subject.type !== 'user' ||
+            delegator.actor.id !== grant.delegator.id ||
+            delegator.subject.id !== grant.delegator.id) {
+            return {
+                decision: denyAuthorization('delegation-out-of-bounds', version),
+            };
+        }
+        let delegatorDecision;
+        try {
+            delegatorDecision = yield input.evaluator.evaluate({
+                action: input.action,
+                context: input.context,
+                principal: delegator,
+                resource: input.resource,
+            });
+        }
+        catch (_c) {
+            return {
+                decision: denyAuthorization('authorization-unavailable', version),
+            };
+        }
+        if (delegatorDecision.decision !== 'allow') {
+            return {
+                decision: denyAuthorization('delegation-out-of-bounds', version),
+            };
+        }
+        const delegatedPrincipal = composeDelegatedAuthorizationPrincipalModel(input.agent, {
+            delegatedBy: grant.delegator,
+            delegationId: grant.id,
+        });
+        let policyDecision;
+        try {
+            policyDecision = yield input.evaluator.evaluate({
+                action: input.action,
+                context: input.context,
+                principal: delegatedPrincipal,
+                resource: input.resource,
+            });
+        }
+        catch (_d) {
+            return {
+                decision: denyAuthorization('authorization-unavailable', version),
+            };
+        }
+        if (policyDecision.decision === 'deny') {
+            return { decision: policyDecision };
+        }
+        if (grant.nonDelegableApprovalActions.includes(input.action)) {
+            return { decision: denyAuthorization('approval-required', version) };
+        }
+        return { decision: policyDecision, now, principal: delegatedPrincipal };
+    });
+}
+/**
+ * Re-reads the grant online and persists a rate/use transition before
+ * returning allow. The store's compare-and-set is the concurrency boundary;
+ * the protected business effect must run only after this function allows.
+ */
+export function useDelegation(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        for (let attempt = 0; attempt < MAX_DELEGATION_WRITE_ATTEMPTS; attempt += 1) {
+            let grant;
+            try {
+                grant = yield input.store.read(input.delegationId);
+            }
+            catch (_a) {
+                return {
+                    decision: denyAuthorization('authorization-unavailable', 'delegation-v1'),
+                };
+            }
+            if (!grant || grant.id !== input.delegationId) {
+                return {
+                    decision: denyAuthorization('delegation-out-of-bounds', 'delegation-v1'),
+                };
+            }
+            const preflight = yield preflightDelegation(grant, input);
+            if (!('now' in preflight)) {
+                return { decision: preflight.decision };
+            }
+            const next = consumeGrant(grant, preflight.now);
+            try {
+                if (yield input.store.write(grant.id, grant.revision, cloneGrant(next))) {
+                    return {
+                        decision: preflight.decision,
+                        grant: next,
+                        principal: preflight.principal,
+                    };
+                }
+            }
+            catch (_b) {
+                return {
+                    decision: denyAuthorization('authorization-unavailable', policyVersion(grant)),
+                };
+            }
+        }
+        return {
+            decision: denyAuthorization('authorization-unavailable', 'delegation-v1'),
+        };
+    });
+}
+export function revokeDelegationGrant(grant, input) {
+    if (grant.status === 'revoked')
+        return grant;
+    const now = parseInstant(input.now, 'revokedAt');
+    return Object.freeze(Object.assign(Object.assign({}, cloneGrant(grant)), { revision: grant.revision + 1, revokedAt: new Date(now).toISOString(), revokedBy: Object.freeze({
+            id: requiredReference(input.revokedBy.actor.id, 'revoker id'),
+            type: input.revokedBy.actor.type,
+        }), status: 'revoked' }));
+}
+export function revokeDelegation(store, input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        for (let attempt = 0; attempt < MAX_DELEGATION_WRITE_ATTEMPTS; attempt += 1) {
+            const grant = yield store.read(input.delegationId);
+            if (!grant)
+                return undefined;
+            if (grant.status === 'revoked')
+                return grant;
+            const next = revokeDelegationGrant(grant, input);
+            if (yield store.write(grant.id, grant.revision, cloneGrant(next))) {
+                return next;
+            }
+        }
+        throw new Error('[runtime/authorization] Delegation revocation conflicted repeatedly.');
+    });
+}
+export function expireDelegationGrant(grant, now) {
+    const instant = parseInstant(now, 'expiry check');
+    if (grant.status !== 'active' || instant < Date.parse(grant.expiresAt)) {
+        return grant;
+    }
+    return Object.freeze(Object.assign(Object.assign({}, cloneGrant(grant)), { revision: grant.revision + 1, status: 'expired' }));
+}
+export function expireDelegation(store, delegationId, now) {
+    return __awaiter(this, void 0, void 0, function* () {
+        for (let attempt = 0; attempt < MAX_DELEGATION_WRITE_ATTEMPTS; attempt += 1) {
+            const grant = yield store.read(delegationId);
+            if (!grant)
+                return undefined;
+            const next = expireDelegationGrant(grant, now);
+            if (next === grant)
+                return grant;
+            if (yield store.write(grant.id, grant.revision, cloneGrant(next))) {
+                return next;
+            }
+        }
+        throw new Error('[runtime/authorization] Delegation expiry conflicted repeatedly.');
+    });
+}
+//# sourceMappingURL=delegation.js.map

package/src/authorization/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/delegation.ts"],"names":[],"mappings":";AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,iBAAiB,EASjB,2CAA2C,GAC5C,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAU,CAAC;AAC1D,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAmK/C,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAC3C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,oCAAoC,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,2BAA2B,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,KAAyB,EACzB,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,mCAAmC,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAyB,EACzB,KAAa,EACb,UAAU,GAAG,KAAK;IAElB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,IACE,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,8BAA8B,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAsB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAoC;IAEpC,MAAM,YAAY,GAAG,iBAAiB,CACpC,QAAQ,CAAC,YAAY,EACrB,eAAe,CAChB,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;YACnE,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,YAAY,EAAE,iBAAiB,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;YACvE,IAAI,EAAE,YAAY;YAClB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;IAC5D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;SACxB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;SACpB,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;SAC1B,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAsB,EACtB,QAAgB,EAChB,UAAkB;IAElB,IACE,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC3B,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;QACpC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,KAAkC;;IACvD,OAAO,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,wBAAwB,mCAAI,eAAe,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CACjB,KAA8B;IAE9B,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAClB,KAAmC,EACnC,UAAkB;;IAElB,IACE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;QACrC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QAC5B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC7D,IACE,SAAS,IAAI,GAAG;QAChB,SAAS,GAAG,GAAG,GAAG,kCAAkC,GAAG,IAAK,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mFAAmF,kCAAkC,WAAW,CACjI,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,2BAA2B,GAAG,gBAAgB,CAClD,MAAA,KAAK,CAAC,2BAA2B,mCAAI,EAAE,EACvC,gCAAgC,EAChC,IAAI,CACL,CAAC;IACF,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,EAAE,EAC5B,mBAAmB,EACnB,IAAI,CACL,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS;QAC/B,CAAC,CAAC;YACE,WAAW,EACT,MAAA,eAAe,CACb,KAAK,CAAC,SAAS,CAAC,WAAW,EAC3B,uBAAuB,CACxB,mCAAI,CAAC;YACR,aAAa,EACX,MAAA,eAAe,CACb,KAAK,CAAC,SAAS,CAAC,aAAa,EAC7B,yBAAyB,CAC1B,mCAAI,CAAC;SACT;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,MAAM,CAAC,MAAM,2DAClB,OAAO,EACP,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,EAAE,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC;YACvD,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;SAC7B,CAAC,EACF,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,EACvD,gBAAgB,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC9D,gBAAgB,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,EAAE,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC;YAC/D,IAAI,EAAE,MAAe;SACtB,CAAC,EACF,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAC5C,EAAE,EAAE,UAAU,EAAE,EAChB,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EACrC,wBAAwB,EAAE,iBAAiB,CACzC,KAAK,CAAC,wBAAwB,EAC9B,gBAAgB,CACjB,IACE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC/B,2BAA2B,EAC3B,gBAAgB,EAAE,iBAAiB,CACjC,KAAK,CAAC,gBAAgB,EACtB,mBAAmB,CACpB,KACE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC7D,gBAAgB,EAAE,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC3D,QAAQ,EAAE,CAAC,EACX,aAAa,EAAE,+BAA+B,EAC9C,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,MAAM,EAAE,QAAiB,EACzB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,IACzD,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAgB,eAAe,CACnC,KAA8B,EAC9B,KAAmC;;QAEnC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;CAAA;AAED,SAAe,eAAe,CAI5B,KAAsB,EACtB,QAAkB,EAClB,OAAgB,EAChB,iBAMa;;QAEb,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,gBAAgB,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5C,OAAO,CACL,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ;gBAC/B,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,CACL,CAAC,MAAM,iBAAiB,CACtB,KAAK,CAAC,gBAAgB,CAAC,YAAY,EACnC,QAAQ,EACR,OAAO,CACR,CAAC,KAAK,IAAI,CACZ,CAAC;QACJ,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CAAA;AAED,SAAS,gBAAgB,CACvB,KAAsB,EACtB,GAAW;IAEX,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB;QAC/C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACf,IACE,CAAC,KAAK,CAAC,SAAS;QAChB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,GAAG,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,aAAa,GAAG,IAAK,EACxD,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,KAAsB,EACtB,GAAW;IAEX,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1E,OAAO,iBAAiB,CAAC,yBAAyB,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,EACxC,CAAC;QACD,OAAO,iBAAiB,CAAC,yBAAyB,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,KAA8B,EAC9B,GAAW;IAEX,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,iCACf,UAAU,CAAC,KAAK,CAAC,KACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACvC,mBAAmB,EAAE,IAAI,CAAC,SAAS;YACnC,cAAc,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC;SACrC,CAAC,IACF,CAAC;AACL,CAAC;AAED,SAAe,mBAAmB,CAMhC,KAA8B,EAC9B,KAAgE;;;QAShE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,IACE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACvC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3C,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAC5B,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;YAC3D,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EACrC,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,0BAA0B,EAAE,OAAO,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,OAAO,CAAC,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,oBAAoB,EAAE,OAAO,CAAC,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,0BAA0B,EAAE,OAAO,CAAC;aACjE,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAA,KAAK,CAAC,wBAAwB,mCAAI,EAAE,CAAC;QAC5D,IACE,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;YACtD,KAAK,CAAC,gBAAgB,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/C;YACD,cAAc,CAAC,IAAI,CACjB,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACvC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtC,EACD,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,0BAA0B,EAAE,OAAO,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,wBAAwB,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACrE,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CACzB,cAAc,EACd,KAAK,CAAC,SAAS,CAAC,aAAa,CAC9B;aACF,CAAC;QACJ,CAAC;QACD,IACE,CAAC,CAAC,MAAM,eAAe,CACrB,KAAK,EACL,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,iBAAiB,CACxB,CAAC,EACF,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,0BAA0B,EAAE,OAAO,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAE1C,IAAI,SAA6C,CAAC;QAClD,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBACvC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,2BAA2B,EAAE,OAAO,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,SAAS;YACV,SAAS,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;YACrC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YAC/B,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM;YACjC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE;YACzC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,EAC3C,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,0BAA0B,EAAE,OAAO,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,IAAI,iBAAoD,CAAC;QACzD,IAAI,CAAC;YACH,iBAAiB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACjD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,2BAA2B,EAAE,OAAO,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,IAAI,iBAAiB,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC3C,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,0BAA0B,EAAE,OAAO,CAAC;aACjE,CAAC;QACJ,CAAC;QAED,MAAM,kBAAkB,GAAG,2CAA2C,CACpE,KAAK,CAAC,KAAK,EACX;YACE,WAAW,EAAE,KAAK,CAAC,SAAS;YAC5B,YAAY,EAAE,KAAK,CAAC,EAAE;SACvB,CACF,CAAC;QACF,IAAI,cAAiD,CAAC;QACtD,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC9C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,kBAAkB;gBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP,OAAO;gBACL,QAAQ,EAAE,iBAAiB,CAAC,2BAA2B,EAAE,OAAO,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,CAAC,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAC1E,CAAC;CAAA;AAED;;;;GAIG;AACH,MAAM,UAAgB,aAAa,CAMjC,KAAgE;;QAEhE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,6BAA6B,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC5E,IAAI,KAA0C,CAAC;YAC/C,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrD,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO;oBACL,QAAQ,EAAE,iBAAiB,CACzB,2BAA2B,EAC3B,eAAe,CAChB;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;gBAC9C,OAAO;oBACL,QAAQ,EAAE,iBAAiB,CACzB,0BAA0B,EAC1B,eAAe,CAChB;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC1C,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACxE,OAAO;wBACL,QAAQ,EAAE,SAAS,CAAC,QAAQ;wBAC5B,KAAK,EAAE,IAAI;wBACX,SAAS,EAAE,SAAS,CAAC,SAAS;qBAC/B,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO;oBACL,QAAQ,EAAE,iBAAiB,CACzB,2BAA2B,EAC3B,aAAa,CAAC,KAAK,CAAC,CACrB;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,2BAA2B,EAAE,eAAe,CAAC;SAC1E,CAAC;IACJ,CAAC;CAAA;AAQD,MAAM,UAAU,qBAAqB,CACnC,KAA8B,EAC9B,KAAuD;IAEvD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,iCACf,UAAU,CAAC,KAAK,CAAC,KACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EACtC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,EAAE,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC;YAC7D,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI;SACjC,CAAC,EACF,MAAM,EAAE,SAAkB,IAC1B,CAAC;AACL,CAAC;AAED,MAAM,UAAgB,gBAAgB,CACpC,KAA8B,EAC9B,KAA4B;;QAE5B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,6BAA6B,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACjD,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;CAAA;AAED,MAAM,UAAU,qBAAqB,CACnC,KAA8B,EAC9B,GAAW;IAEX,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,iCACf,UAAU,CAAC,KAAK,CAAC,KACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAC5B,MAAM,EAAE,SAAkB,IAC1B,CAAC;AACL,CAAC;AAED,MAAM,UAAgB,gBAAgB,CACpC,KAA8B,EAC9B,YAAoB,EACpB,GAAW;;QAEX,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,6BAA6B,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YACjC,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;CAAA"}

package/src/authorization/errors.d.ts

@@ -0,0 +1,32 @@
+import { RuntimeError } from '../response.js';
+import type { AuthorizationAllowDecision, AuthorizationDecision, AuthorizationDenialCategory, AuthorizationDenyDecision, AuthorizationObligation } from './model.js';
+export declare const AUTHORIZATION_ERROR_CODES: {
+    readonly admissionRequired: "authorization_admission_required";
+    readonly approvalExpired: "authorization_approval_expired";
+    readonly approvalInvalid: "authorization_approval_invalid";
+    readonly approvalPending: "authorization_approval_pending";
+    readonly approvalRequired: "authorization_approval_required";
+    readonly denied: "authorization_denied";
+    readonly delegationExpired: "authorization_delegation_expired";
+    readonly delegationOutOfBounds: "authorization_delegation_out_of_bounds";
+    readonly delegationRateLimited: "authorization_delegation_rate_limited";
+    readonly delegationRevoked: "authorization_delegation_revoked";
+    readonly invalidAuthentication: "authorization_authentication_invalid";
+    readonly invalidInput: "authorization_input_invalid";
+    readonly policyStale: "authorization_policy_stale";
+    readonly requiredAuthentication: "authorization_authentication_required";
+    readonly unavailable: "authorization_unavailable";
+};
+export type AuthorizationErrorCode = (typeof AUTHORIZATION_ERROR_CODES)[keyof typeof AUTHORIZATION_ERROR_CODES];
+/**
+ * A response-safe RuntimeError. The denial category and policy version remain
+ * server-side properties; they are intentionally not copied into details.
+ */
+export declare class AuthorizationError extends RuntimeError {
+    readonly category: AuthorizationDenialCategory;
+    readonly policyVersion: string;
+    constructor(decision: AuthorizationDenyDecision);
+}
+export declare function isAuthorizationError(error: unknown): error is AuthorizationError;
+export declare function authorizationErrorFromDecision(decision: AuthorizationDenyDecision): AuthorizationError;
+export declare function assertAuthorizationAllowed<Obligation extends AuthorizationObligation>(decision: AuthorizationDecision<Obligation>): asserts decision is AuthorizationAllowDecision<Obligation>;

package/src/authorization/errors.js

@@ -0,0 +1,153 @@
+import { RuntimeError } from '../response.js';
+export const AUTHORIZATION_ERROR_CODES = {
+    admissionRequired: 'authorization_admission_required',
+    approvalExpired: 'authorization_approval_expired',
+    approvalInvalid: 'authorization_approval_invalid',
+    approvalPending: 'authorization_approval_pending',
+    approvalRequired: 'authorization_approval_required',
+    denied: 'authorization_denied',
+    delegationExpired: 'authorization_delegation_expired',
+    delegationOutOfBounds: 'authorization_delegation_out_of_bounds',
+    delegationRateLimited: 'authorization_delegation_rate_limited',
+    delegationRevoked: 'authorization_delegation_revoked',
+    invalidAuthentication: 'authorization_authentication_invalid',
+    invalidInput: 'authorization_input_invalid',
+    policyStale: 'authorization_policy_stale',
+    requiredAuthentication: 'authorization_authentication_required',
+    unavailable: 'authorization_unavailable',
+};
+const ERROR_PROJECTIONS = {
+    'admission-kind-denied': {
+        code: AUTHORIZATION_ERROR_CODES.admissionRequired,
+        message: 'Required operation admission is missing',
+        retryable: false,
+        status: 403,
+    },
+    'admission-role-denied': {
+        code: AUTHORIZATION_ERROR_CODES.admissionRequired,
+        message: 'Required operation admission is missing',
+        retryable: false,
+        status: 403,
+    },
+    'admission-scope-denied': {
+        code: AUTHORIZATION_ERROR_CODES.admissionRequired,
+        message: 'Required operation admission is missing',
+        retryable: false,
+        status: 403,
+    },
+    'approval-expired': {
+        code: AUTHORIZATION_ERROR_CODES.approvalExpired,
+        message: 'Approval has expired',
+        retryable: false,
+        status: 409,
+    },
+    'approval-invalid': {
+        code: AUTHORIZATION_ERROR_CODES.approvalInvalid,
+        message: 'Approval is not valid for this request',
+        retryable: false,
+        status: 409,
+    },
+    'approval-pending': {
+        code: AUTHORIZATION_ERROR_CODES.approvalPending,
+        message: 'Approval is pending',
+        retryable: false,
+        status: 409,
+    },
+    'approval-required': {
+        code: AUTHORIZATION_ERROR_CODES.approvalRequired,
+        message: 'Approval is required',
+        retryable: false,
+        status: 409,
+    },
+    'authentication-invalid': {
+        code: AUTHORIZATION_ERROR_CODES.invalidAuthentication,
+        message: 'Authentication is invalid',
+        retryable: false,
+        status: 401,
+    },
+    'authentication-missing': {
+        code: AUTHORIZATION_ERROR_CODES.requiredAuthentication,
+        message: 'Authentication is required',
+        retryable: false,
+        status: 401,
+    },
+    'authorization-unavailable': {
+        code: AUTHORIZATION_ERROR_CODES.unavailable,
+        message: 'Authorization is temporarily unavailable',
+        retryable: true,
+        status: 503,
+    },
+    'delegation-expired': {
+        code: AUTHORIZATION_ERROR_CODES.delegationExpired,
+        message: 'Delegated authority has expired',
+        retryable: false,
+        status: 403,
+    },
+    'delegation-out-of-bounds': {
+        code: AUTHORIZATION_ERROR_CODES.delegationOutOfBounds,
+        message: 'Delegated authority does not cover this request',
+        retryable: false,
+        status: 403,
+    },
+    'delegation-rate-limited': {
+        code: AUTHORIZATION_ERROR_CODES.delegationRateLimited,
+        message: 'Delegated authority use limit has been reached',
+        retryable: false,
+        status: 429,
+    },
+    'delegation-revoked': {
+        code: AUTHORIZATION_ERROR_CODES.delegationRevoked,
+        message: 'Delegated authority has been revoked',
+        retryable: false,
+        status: 403,
+    },
+    'domain-authorization-denied': {
+        code: AUTHORIZATION_ERROR_CODES.denied,
+        message: 'Authorization denied',
+        retryable: false,
+        status: 403,
+    },
+    'policy-input-invalid': {
+        code: AUTHORIZATION_ERROR_CODES.invalidInput,
+        message: 'Authorization input is invalid',
+        retryable: false,
+        status: 403,
+    },
+    'policy-stale': {
+        code: AUTHORIZATION_ERROR_CODES.policyStale,
+        message: 'Authorization policy is not current',
+        retryable: true,
+        status: 503,
+    },
+};
+/**
+ * A response-safe RuntimeError. The denial category and policy version remain
+ * server-side properties; they are intentionally not copied into details.
+ */
+export class AuthorizationError extends RuntimeError {
+    constructor(decision) {
+        const projection = ERROR_PROJECTIONS[decision.category];
+        super({
+            code: projection.code,
+            expose: true,
+            message: projection.message,
+            retryable: projection.retryable,
+            status: projection.status,
+        });
+        this.name = 'AuthorizationError';
+        this.category = decision.category;
+        this.policyVersion = decision.policyVersion;
+    }
+}
+export function isAuthorizationError(error) {
+    return error instanceof AuthorizationError;
+}
+export function authorizationErrorFromDecision(decision) {
+    return new AuthorizationError(decision);
+}
+export function assertAuthorizationAllowed(decision) {
+    if (decision.decision === 'deny') {
+        throw authorizationErrorFromDecision(decision);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/src/authorization/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../packages/runtime/src/authorization/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAS9C,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iBAAiB,EAAE,kCAAkC;IACrD,eAAe,EAAE,gCAAgC;IACjD,eAAe,EAAE,gCAAgC;IACjD,eAAe,EAAE,gCAAgC;IACjD,gBAAgB,EAAE,iCAAiC;IACnD,MAAM,EAAE,sBAAsB;IAC9B,iBAAiB,EAAE,kCAAkC;IACrD,qBAAqB,EAAE,wCAAwC;IAC/D,qBAAqB,EAAE,uCAAuC;IAC9D,iBAAiB,EAAE,kCAAkC;IACrD,qBAAqB,EAAE,sCAAsC;IAC7D,YAAY,EAAE,6BAA6B;IAC3C,WAAW,EAAE,4BAA4B;IACzC,sBAAsB,EAAE,uCAAuC;IAC/D,WAAW,EAAE,2BAA2B;CAChC,CAAC;AAYX,MAAM,iBAAiB,GAGnB;IACF,uBAAuB,EAAE;QACvB,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;QACjD,OAAO,EAAE,yCAAyC;QAClD,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;QACjD,OAAO,EAAE,yCAAyC;QAClD,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;QACjD,OAAO,EAAE,yCAAyC;QAClD,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,kBAAkB,EAAE;QAClB,IAAI,EAAE,yBAAyB,CAAC,eAAe;QAC/C,OAAO,EAAE,sBAAsB;QAC/B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,kBAAkB,EAAE;QAClB,IAAI,EAAE,yBAAyB,CAAC,eAAe;QAC/C,OAAO,EAAE,wCAAwC;QACjD,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,kBAAkB,EAAE;QAClB,IAAI,EAAE,yBAAyB,CAAC,eAAe;QAC/C,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;QAChD,OAAO,EAAE,sBAAsB;QAC/B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;QACrD,OAAO,EAAE,2BAA2B;QACpC,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,yBAAyB,CAAC,sBAAsB;QACtD,OAAO,EAAE,4BAA4B;QACrC,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,yBAAyB,CAAC,WAAW;QAC3C,OAAO,EAAE,0CAA0C;QACnD,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,GAAG;KACZ;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;QACjD,OAAO,EAAE,iCAAiC;QAC1C,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,0BAA0B,EAAE;QAC1B,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;QACrD,OAAO,EAAE,iDAAiD;QAC1D,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;QACrD,OAAO,EAAE,gDAAgD;QACzD,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,yBAAyB,CAAC,iBAAiB;QACjD,OAAO,EAAE,sCAAsC;QAC/C,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,6BAA6B,EAAE;QAC7B,IAAI,EAAE,yBAAyB,CAAC,MAAM;QACtC,OAAO,EAAE,sBAAsB;QAC/B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,sBAAsB,EAAE;QACtB,IAAI,EAAE,yBAAyB,CAAC,YAAY;QAC5C,OAAO,EAAE,gCAAgC;QACzC,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;KACZ;IACD,cAAc,EAAE;QACd,IAAI,EAAE,yBAAyB,CAAC,WAAW;QAC3C,OAAO,EAAE,qCAAqC;QAC9C,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,GAAG;KACZ;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAIlD,YAAY,QAAmC;QAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,KAAK,CAAC;YACJ,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc;IAEd,OAAO,KAAK,YAAY,kBAAkB,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAAmC;IAEnC,OAAO,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,0BAA0B,CAGxC,QAA2C;IAE3C,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/src/authorization/evaluator.d.ts

@@ -0,0 +1,39 @@
+import { type CoarseAdmission } from './admission.js';
+import { type AuthorizationAllowDecision, type AuthorizationDecision, type AuthorizationInput, type AuthorizationObligation, type AuthorizationPolicy } from './model.js';
+export interface AuthorizationDecisionSinkInput<Input extends AuthorizationInput, Obligation extends AuthorizationObligation> {
+    decision: AuthorizationDecision<Obligation>;
+    input: Input;
+}
+export interface CreateAuthorizationEvaluatorOptions<Input extends AuthorizationInput, Obligation extends AuthorizationObligation> {
+    admission: CoarseAdmission;
+    /**
+     * An unavailable policy is a supported fail-closed state. This lets an
+     * optional external adapter preserve the same contract during outages.
+     */
+    policy?: AuthorizationPolicy<Input, Obligation>;
+    /**
+     * When supplied, the exact policy version must match before evaluation.
+     */
+    requiredPolicyVersion?: string;
+    /**
+     * An optional pre-effect decision sink. It receives the complete
+     * authorization input, which may contain protected identifiers, and is not
+     * itself a safe-persistence or redaction boundary. When supplied, sink
+     * failure converts an allow into an unavailable denial. Callers must
+     * sanitize any durable evidence and complete required persistence before
+     * beginning the protected effect.
+     */
+    decisionSink?: (input: AuthorizationDecisionSinkInput<Input, Obligation>) => Promise<void> | void;
+}
+export interface AuthorizationEvaluator<Input extends AuthorizationInput = AuthorizationInput, Obligation extends AuthorizationObligation = AuthorizationObligation> {
+    authorize(input: Input): Promise<AuthorizationAllowDecision<Obligation>>;
+    evaluate(input: Input): Promise<AuthorizationDecision<Obligation>>;
+    readonly policyVersion: string;
+}
+export declare function defineAuthorizationPolicy<Input extends AuthorizationInput, Obligation extends AuthorizationObligation = AuthorizationObligation>(policy: AuthorizationPolicy<Input, Obligation>): AuthorizationPolicy<Input, Obligation>;
+/**
+ * Wraps Slice-owned policy with explicit admission and fail-closed behavior.
+ * Only the literal typed allow result authorizes; falsey, ambiguous, thrown,
+ * stale, or unavailable evaluation returns a stable denial.
+ */
+export declare function createAuthorizationEvaluator<Input extends AuthorizationInput, Obligation extends AuthorizationObligation = AuthorizationObligation>(options: CreateAuthorizationEvaluatorOptions<Input, Obligation>): AuthorizationEvaluator<Input, Obligation>;