@kutur-kit/access 0.0.0-stage → 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kutur Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,225 @@
-# Temporary Holding Version
+# @kutur-kit/access
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Permissions for Effect, defined as services. Each permission declares what it decides about, and its policy is a Layer. Checks are typed and traced, can be restricted per caller (for example to an agent token's scopes) and can be audited. A permission can also describe the targets it allows as a condition for list queries.
+
+Tested with Effect 4.0.5.
+
+```sh
+pnpm add @kutur-kit/access@alpha effect
+```
+
+## Permissions
+
+Define a permission with a key, an optional public `id` and the schema of its `target`. Declare the services its policy may read with `requires`:
+
+```ts
+import { Permission } from "@kutur-kit/access";
+import { Schema } from "effect";
+
+import { CurrentUser, Invoice, MembershipUnavailable } from "./domain.js";
+
+export class ViewInvoice extends Permission.Service<ViewInvoice, { requires: CurrentUser }>()(
+  "billing/ViewInvoice",
+  { id: "invoices.view", target: Invoice, error: MembershipUnavailable },
+) {}
+```
+
+The definition holds only schemas, so it can be shared with clients. Implement the policy with `toLayer`, usually in server-only code. A policy returns a `Decision`, directly or as an Effect, and may read the services declared in `requires`:
+
+```ts
+import { Decision } from "@kutur-kit/access";
+import { Effect, Option } from "effect";
+
+export const ViewInvoiceLayer = ViewInvoice.toLayer(
+  Effect.gen(function* () {
+    const memberships = yield* Memberships;
+
+    return Effect.fn(function* (invoice) {
+      const user = yield* CurrentUser;
+      const role = yield* memberships.roleIn(user.id, invoice.orgId);
+
+      return Option.isSome(role) ? Decision.allow() : Decision.deny();
+    });
+  }),
+);
+```
+
+Services the Layer reads while it is built, such as `Memberships`, are requirements of the Layer. Services read inside the policy, such as `CurrentUser`, are requirements of every check.
+
+| Method                        | Result                                                         |
+| ----------------------------- | -------------------------------------------------------------- |
+| `ViewInvoice.check(target)`   | The `Decision`. Fails only with the policy's own errors.       |
+| `ViewInvoice.require(target)` | Succeeds when allowed; otherwise fails with `Decision.Denied`. |
+
+Both are also available on the service itself (`const view = yield* ViewInvoice`), which is how other services and policies capture a permission when their Layer is built. A permission without a `target` takes no arguments.
+
+`Decision.Denied` carries the refusing permission's `id` and encodes with HTTP status 403. Each permission's `Denied` schema matches only its own refusals, so a caller can treat one refusal differently:
+
+```ts
+const approve = (invoice: Invoice) =>
+  approvePayout
+    .require(invoice)
+    .pipe(Effect.catchIf(Schema.is(ViewInvoice.Denied), () => Effect.fail(new InvoiceNotFound())));
+```
+
+### Decisions
+
+| Constructor                  | Meaning                                                     |
+| ---------------------------- | ----------------------------------------------------------- |
+| `Decision.allow()`           | Allowed.                                                    |
+| `Decision.deny(reason?)`     | Refused by the policy.                                      |
+| `Decision.restricted()`      | Refused by the caller's restriction, before the policy ran. |
+| `Decision.unmet(permission)` | Refused because a permission the policy required refused.   |
+
+`Deny.by` tells these apart: `"policy"`, `"restriction"` or `"requirement"`.
+
+### Permissions that require others
+
+A policy can require another permission. Declare that permission's refusals in `error`:
+
+```ts
+export class ApprovePayout extends Permission.Service<ApprovePayout, { requires: CurrentUser }>()(
+  "billing/ApprovePayout",
+  {
+    id: "payouts.approve",
+    target: Invoice,
+    error: Schema.Union([ViewInvoice.Denied, MembershipUnavailable]),
+  },
+) {}
+
+export const ApprovePayoutLayer = ApprovePayout.toLayer(
+  Effect.gen(function* () {
+    const view = yield* ViewInvoice;
+
+    return Effect.fn(function* (invoice) {
+      yield* view.require(invoice);
+      // ...
+    });
+  }),
+).pipe(Layer.provide(ViewInvoiceLayer));
+```
+
+When the required permission refuses, `check` answers `Decision.unmet("invoices.view")` and `require` fails with the required permission's refusal, so callers can still tell which one refused. Refusals never appear in a check's error type.
+
+## Restrictions
+
+Restrict the permissions a caller may use, for example to the scopes of an agent token. Every other permission refuses with `Decision.restricted()`, and restrictions only narrow when nested:
+
+```ts
+program.pipe(Permission.restrictTo([ViewInvoice, ApprovePayout]));
+```
+
+To store scopes, define the set of permissions a token may hold. Its schema decodes stored ids and drops ids of permissions that no longer exist:
+
+```ts
+export const AgentScopes = Permission.set([ViewInvoice, ApprovePayout]);
+
+const asAgent = Effect.gen(function* () {
+  const scopes = yield* Schema.decodeEffect(AgentScopes.schema)(token.scopes);
+
+  return yield* program.pipe(AgentScopes.restrictTo(scopes));
+});
+```
+
+Ids name permissions outside the code, so `Permission.set` rejects duplicates. Restrictions hold service keys, so two permissions that share an id still restrict separately.
+
+## Lists
+
+Checking every row of a list one by one runs the policy, and its lookups, once per row. A `PermissionFilter` instead states the permission's rule as a `Condition` that a query applies, so a list is one query and pages stay complete:
+
+```ts
+import { PermissionFilter } from "@kutur-kit/access";
+
+export class ViewInvoiceFilter extends PermissionFilter.Service<ViewInvoiceFilter>()(ViewInvoice) {}
+
+export const ViewInvoiceFilterLayer = ViewInvoiceFilter.toLayer(
+  Effect.gen(function* () {
+    const memberships = yield* Memberships;
+
+    return Effect.fn(function* (where) {
+      const user = yield* CurrentUser;
+
+      return where.oneOf("orgId", yield* memberships.orgsOf(user.id));
+    });
+  }),
+);
+```
+
+The filter takes its target, errors and requirements from the permission, which must have a target. Name it after the permission: its key is the permission's key with `/Filter`. Outside the caller's restriction its condition matches nothing.
+
+`where` builds conditions over the target's fields: `eq`, `oneOf`, `and`, `or`, `not`, `all` and `none`. Fields and values are checked against the target's type. `Condition.matches(condition, target)` evaluates a condition in memory.
+
+### PostgreSQL with Drizzle
+
+`@kutur-kit/access/drizzle/postgres` translates a condition into a `where` clause:
+
+```ts
+import * as Drizzle from "@kutur-kit/access/drizzle/postgres";
+
+const page = Effect.gen(function* () {
+  const viewInvoiceFilter = yield* ViewInvoiceFilter;
+  const condition = yield* viewInvoiceFilter.condition;
+
+  return yield* database
+    .select()
+    .from(invoices)
+    .where(and(Drizzle.where(invoices, condition), gt(invoices.id, cursor)))
+    .orderBy(invoices.id)
+    .limit(100);
+});
+```
+
+The query selects exactly the rows `Condition.matches` accepts, including rows with `NULL` values. To keep that true, only columns whose SQL equality matches JavaScript's are accepted: `text`, `varchar`, enums, `uuid`, `smallint`, `integer`, `bigint`, `boolean`, `real` and `double precision`. `numeric`, `char`, `citext` and other custom types are rejected, and `uuid` values must be lowercase and canonical. `oneOf` sends its values as one array parameter, however many there are.
+
+Pagination is the query's own: the condition combines with a cursor as above, or with `LIMIT` and `OFFSET`.
+
+### Keeping filters and policies in agreement
+
+A filter and its policy state the same rule twice. `PermissionTesting.assertFilterAgrees` from `@kutur-kit/access/testing` dies on the first target where they disagree:
+
+```ts
+it.effect("the invoice filter agrees with its policy", () =>
+  PermissionTesting.assertFilterAgrees(ViewInvoice, ViewInvoiceFilter, invoices),
+);
+```
+
+Run it in tests for each kind of user over representative targets.
+
+## Audit
+
+`@kutur-kit/access/audit` records a permission's decisions with [`@kutur-kit/audit`](https://github.com/kutur-labs/kit/tree/main/packages/audit):
+
+```ts
+import * as PermissionAudit from "@kutur-kit/access/audit";
+
+export const ApprovePayoutLayer = ApprovePayout.toLayer(policy).pipe(
+  PermissionAudit.record(ApprovePayout, {
+    view: Schema.Struct({ id: InvoiceId, orgId: OrgId, amount: Schema.Int }),
+  }),
+);
+```
+
+Every `require` records an audit event named by the permission's id, with outcome `Allow` or `Deny`, the policy's reason and details of what refused. Checks only answer questions and are not recorded, nor are the requires their policies make. Writes are isolated from the caller's transaction, so refusals stay recorded when the request rolls back. The recorded Layer requires an `AuditLog`.
+
+`view` chooses what is recorded of the target, as for any audit event. Without it, the fields marked with `AuditKey.key` are recorded.
+
+## Tracing
+
+Checks run in spans named `<key>.check` and `<key>.require`, and conditions in `<key>/Filter.condition`. Spans carry `access.permission`, `access.decision`, `access.denied_by`, `access.reason` and `access.requirement`.
+
+`Permission.tap(f)` returns a permission service that also runs `f` after each decision, for other kinds of recording.
+
+## Requirements
+
+- `effect` 4.0.5 or later 4.x.
+- `@kutur-kit/access/audit` needs `@kutur-kit/audit`.
+- `@kutur-kit/access/drizzle/postgres` needs `drizzle-orm` 1.0.0-rc.4 with the Effect 4 patch described in the [`@kutur-kit/audit` README](https://github.com/kutur-labs/kit/tree/main/packages/audit#requirements).
+
+## Limitations
+
+- Conditions compare fields with values. They have no ranges, patterns, date fields, optional or nested fields and no conditions over other tables, so lists such as shared ids are passed as values.
+- `Drizzle.where` needs a comparable column for every field of the target a condition could compare, even unused ones. Map columns with an object when the table's names differ.
+- The SQL translation supports PostgreSQL only.
+- Each `eq` and `oneOf` is one statement parameter, and the PostgreSQL driver sends at most 32,767. Prefer `oneOf` over many `eq`s.
+- Translation and evaluation recurse once per level of nesting. SQL translation overflows the stack below 2,000 levels.
+- Nothing enforces that a filter agrees with its policy except `assertFilterAgrees` in tests.

package/dist/Condition.d.ts

@@ -0,0 +1,76 @@
+/** The values conditions compare. */
+export type Value = string | number | boolean | bigint | null;
+/** The fields of `T` a condition can compare: those holding primitive values. */
+export type Field<T> = {
+    readonly [K in keyof T & string]: T[K] extends Value ? K : never;
+}[keyof T & string];
+declare const All_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "All";
+} & import("effect/Pipeable").Pipeable;
+export declare class All extends All_base<{}> {
+}
+declare const None_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "None";
+} & import("effect/Pipeable").Pipeable;
+export declare class None extends None_base<{}> {
+}
+declare const Eq_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "Eq";
+} & import("effect/Pipeable").Pipeable;
+export declare class Eq extends Eq_base<{
+    readonly field: string;
+    readonly value: Value;
+}> {
+}
+declare const OneOf_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "OneOf";
+} & import("effect/Pipeable").Pipeable;
+export declare class OneOf extends OneOf_base<{
+    readonly field: string;
+    readonly values: ReadonlyArray<Value>;
+}> {
+}
+declare const And_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "And";
+} & import("effect/Pipeable").Pipeable;
+export declare class And extends And_base<{
+    readonly conditions: ReadonlyArray<Node>;
+}> {
+}
+declare const Or_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "Or";
+} & import("effect/Pipeable").Pipeable;
+export declare class Or extends Or_base<{
+    readonly conditions: ReadonlyArray<Node>;
+}> {
+}
+declare const Not_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => Readonly<A> & {
+    readonly _tag: "Not";
+} & import("effect/Pipeable").Pipeable;
+export declare class Not extends Not_base<{
+    readonly condition: Node;
+}> {
+}
+export type Node = All | None | Eq | OneOf | And | Or | Not;
+/**
+ * A condition over targets of type `T`. The phantom member keeps conditions
+ * over one target type from being used for another.
+ */
+export type Condition<T> = Node & {
+    readonly "~target"?: (target: T) => T;
+};
+/** Builds conditions over one target type; PermissionFilter policies receive it. */
+export interface Builder<T> {
+    readonly all: () => Condition<T>;
+    readonly none: () => Condition<T>;
+    readonly eq: <K extends Field<T>>(field: K, value: T[K] & Value) => Condition<T>;
+    readonly oneOf: <K extends Field<T>>(field: K, values: ReadonlyArray<T[K] & Value>) => Condition<T>;
+    readonly and: (...conditions: ReadonlyArray<Condition<T>>) => Condition<T>;
+    readonly or: (...conditions: ReadonlyArray<Condition<T>>) => Condition<T>;
+    readonly not: (condition: Condition<T>) => Condition<T>;
+}
+export declare const make: <T>() => Builder<T>;
+/** Whether a target satisfies a condition, as a query applying it would decide. */
+export declare const matches: <T extends object>(condition: Condition<T>, target: T) => boolean;
+export {};
+//# sourceMappingURL=Condition.d.ts.map

package/dist/Condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Condition.d.ts","sourceRoot":"","sources":["../src/Condition.ts"],"names":[],"mappings":"AAEA,qCAAqC;AACrC,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;AAE9D,iFAAiF;AACjF,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IACrB,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,GAAG,KAAK;CACjE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;;;;AAEpB,qBAAa,GAAI,SAAQ,SAAwB,EAAE,CAAC;CAAG;;;;AAEvD,qBAAa,IAAK,SAAQ,UAAyB,EAAE,CAAC;CAAG;;;;AAEzD,qBAAa,EAAG,SAAQ,QAAuB;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB,CAAC;CAAG;;;;AAEL,qBAAa,KAAM,SAAQ,WAA0B;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;CACvC,CAAC;CAAG;;;;AAEL,qBAAa,GAAI,SAAQ,SAAwB;IAAE,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;CAAG;;;;AAEjG,qBAAa,EAAG,SAAQ,QAAuB;IAAE,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;CAAG;;;;AAE/F,qBAAa,GAAI,SAAQ,SAAwB;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC;CAAG;AAEjF,MAAM,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,IAAI,GAAG;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAA;CAAE,CAAC;AAE5E,oFAAoF;AACpF,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;IACjF,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,EACjC,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAChC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3E,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;CACzD;AAED,eAAO,MAAM,IAAI,GAAI,CAAC,OAAK,OAAO,CAAC,CAAC,CAQlC,CAAC;AA0BH,mFAAmF;AACnF,eAAO,MAAM,OAAO,GAAI,CAAC,SAAS,MAAM,aAAa,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAG,OAKjE,CAAC"}

package/dist/Condition.js

@@ -0,0 +1,43 @@
+import { Data, Match, Predicate } from "effect";
+export class All extends Data.TaggedClass("All") {
+}
+export class None extends Data.TaggedClass("None") {
+}
+export class Eq extends Data.TaggedClass("Eq") {
+}
+export class OneOf extends Data.TaggedClass("OneOf") {
+}
+export class And extends Data.TaggedClass("And") {
+}
+export class Or extends Data.TaggedClass("Or") {
+}
+export class Not extends Data.TaggedClass("Not") {
+}
+export const make = () => ({
+    all: () => new All(),
+    none: () => new None(),
+    eq: (field, value) => new Eq({ field, value }),
+    oneOf: (field, values) => new OneOf({ field, values }),
+    and: (...conditions) => new And({ conditions }),
+    or: (...conditions) => new Or({ conditions }),
+    not: (condition) => new Not({ condition }),
+});
+// NaN equals NaN and 0 equals -0, as in SQL.
+const same = (actual, value) => actual === value || Object.is(actual, value);
+const isValue = (value) => value === null ||
+    Predicate.isString(value) ||
+    Predicate.isNumber(value) ||
+    Predicate.isBoolean(value) ||
+    Predicate.isBigInt(value);
+const evaluate = (fields) => Match.type().pipe(Match.tagsExhaustive({
+    All: () => true,
+    None: () => false,
+    Eq: ({ field, value }) => same(fields.get(field), value),
+    OneOf: ({ field, values }) => values.some((value) => same(fields.get(field), value)),
+    And: ({ conditions }) => conditions.every(evaluate(fields)),
+    Or: ({ conditions }) => conditions.some(evaluate(fields)),
+    Not: ({ condition }) => !evaluate(fields)(condition),
+}));
+/** Whether a target satisfies a condition, as a query applying it would decide. */
+export const matches = (condition, target) => evaluate(new Map(Object.entries(target).flatMap(([field, value]) => (isValue(value) ? [[field, value]] : []))))(condition);
+//# sourceMappingURL=Condition.js.map

package/dist/Condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Condition.js","sourceRoot":"","sources":["../src/Condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAUhD,MAAM,OAAO,GAAI,SAAQ,IAAI,CAAC,WAAW,CAAC,KAAK,CAAK;CAAG;AAEvD,MAAM,OAAO,IAAK,SAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAK;CAAG;AAEzD,MAAM,OAAO,EAAG,SAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAG3C;CAAG;AAEL,MAAM,OAAO,KAAM,SAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,CAGjD;CAAG;AAEL,MAAM,OAAO,GAAI,SAAQ,IAAI,CAAC,WAAW,CAAC,KAAK,CAA+C;CAAG;AAEjG,MAAM,OAAO,EAAG,SAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAA+C;CAAG;AAE/F,MAAM,OAAO,GAAI,SAAQ,IAAI,CAAC,WAAW,CAAC,KAAK,CAA+B;CAAG;AAwBjF,MAAM,CAAC,MAAM,IAAI,GAAG,GAAkB,EAAE,CAAC,CAAC;IACxC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE;IACpB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IACtB,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9C,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtD,GAAG,EAAE,CAAC,GAAG,UAAU,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC;IAC/C,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,IAAI,GAAG,CAAC,MAAyB,EAAE,KAAY,EAAE,EAAE,CACvD,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE/C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAkB,EAAE,CACjD,KAAK,KAAK,IAAI;IACd,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;IACzB,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;IACzB,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC;IAC1B,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE5B,MAAM,QAAQ,GAAG,CAAC,MAAkC,EAA6B,EAAE,CACjF,KAAK,CAAC,IAAI,EAAQ,CAAC,IAAI,CACrB,KAAK,CAAC,cAAc,CAAC;IACnB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;IACf,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK;IACjB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACxD,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACpF,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC;CACrD,CAAC,CACH,CAAC;AAEJ,mFAAmF;AACnF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAmB,SAAuB,EAAE,MAAS,EAAW,EAAE,CACvF,QAAQ,CACN,IAAI,GAAG,CACL,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7F,CACF,CAAC,SAAS,CAAC,CAAC"}

package/dist/Decision.d.ts

@@ -0,0 +1,39 @@
+import { Data, Schema } from "effect";
+export type Decision = Data.TaggedEnum<{
+    Allow: {};
+    /**
+     * `restriction` when the caller's restriction refused the permission before
+     * its policy ran; `requirement` when the policy required a permission, named
+     * by `requirement`, that refused.
+     */
+    Deny: {
+        readonly by: "restriction" | "policy" | "requirement";
+        readonly reason?: string;
+        readonly requirement?: string;
+    };
+}>;
+export type Allow = Extract<Decision, {
+    readonly _tag: "Allow";
+}>;
+export type Deny = Extract<Decision, {
+    readonly _tag: "Deny";
+}>;
+export declare const allow: () => Allow;
+export declare const deny: (reason?: string) => Deny;
+export declare const restricted: () => Deny;
+export declare const unmet: (requirement: string) => Deny;
+declare const Denied_base: Schema.Class<Denied, Schema.TaggedStruct<"AccessDenied", {
+    readonly permission: Schema.String;
+}>, import("effect/Cause").YieldableError & {
+    readonly brand: unique symbol;
+}>;
+export declare class Denied extends Denied_base {
+}
+export type DeniedBy<P extends string> = Denied & {
+    readonly permission: P;
+};
+export type DeniedBySchema<P extends string> = Schema.refine<DeniedBy<P>, typeof Denied>;
+/** The refusals of one permission, from its id alone. */
+export declare const deniedBy: <P extends string>(permission: P) => DeniedBySchema<P>;
+export {};
+//# sourceMappingURL=Decision.d.ts.map

package/dist/Decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decision.d.ts","sourceRoot":"","sources":["../src/Decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;IACrC,KAAK,EAAE,EAAE,CAAC;IACV;;;;OAIG;IACH,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,EAAE,aAAa,GAAG,QAAQ,GAAG,aAAa,CAAC;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAElE,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAIhE,eAAO,MAAM,KAAK,QAAO,KAA6B,CAAC;AAEvD,eAAO,MAAM,IAAI,YAAa,MAAM,KAAG,IACgD,CAAC;AAExF,eAAO,MAAM,UAAU,QAAO,IAAgD,CAAC;AAE/E,eAAO,MAAM,KAAK,gBAAiB,MAAM,KAAG,IACW,CAAC;;;;oBAEiB,OAAO,MAAM;;AAAtF,qBAAa,MAAO,SAAQ,WAI3B;CAAG;AAEJ,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;CAAE,CAAC;AAE7E,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,MAAM,cAAc,CAAC,KAAG,cAAc,CAAC,CAAC,CACsB,CAAC"}

package/dist/Decision.js

@@ -0,0 +1,11 @@
+import { Data, Schema } from "effect";
+const constructors = Data.taggedEnum();
+export const allow = () => constructors.Allow();
+export const deny = (reason) => constructors.Deny(reason === undefined ? { by: "policy" } : { by: "policy", reason });
+export const restricted = () => constructors.Deny({ by: "restriction" });
+export const unmet = (requirement) => constructors.Deny({ by: "requirement", requirement });
+export class Denied extends Schema.TaggedError()("AccessDenied", { permission: Schema.String }, { httpApiStatus: 403 }) {
+}
+/** The refusals of one permission, from its id alone. */
+export const deniedBy = (permission) => Denied.pipe(Schema.refine((denied) => denied.permission === permission));
+//# sourceMappingURL=Decision.js.map

package/dist/Decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Decision.js","sourceRoot":"","sources":["../src/Decision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAoBtC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAY,CAAC;AAEjD,MAAM,CAAC,MAAM,KAAK,GAAG,GAAU,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;AAEvD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAe,EAAQ,EAAE,CAC5C,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAS,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,WAAmB,EAAQ,EAAE,CACjD,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;AAExD,MAAM,OAAO,MAAO,SAAQ,MAAM,CAAC,WAAW,EAA6C,CACzF,cAAc,EACd,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,EAC7B,EAAE,aAAa,EAAE,GAAG,EAAE,CACvB;CAAG;AAMJ,yDAAyD;AACzD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAmB,UAAa,EAAqB,EAAE,CAC7E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC"}

package/dist/Permission.d.ts

@@ -0,0 +1,82 @@
+import type { Scope } from "effect";
+import { Context, Effect, Layer, Schema } from "effect";
+import * as Decision from "./Decision.ts";
+export type Codec = Schema.Codec<unknown, unknown>;
+export interface Config {
+    readonly requires?: unknown;
+}
+export interface Definition {
+    readonly id?: string;
+    readonly target?: Codec;
+    readonly error?: Codec;
+}
+export type IdOf<Key extends string, D extends Definition> = D extends {
+    readonly id: infer I extends string;
+} ? I : Key;
+export type Requires<C extends Config> = C extends {
+    readonly requires: infer R;
+} ? R : never;
+export type TargetOf<D extends Definition> = D extends {
+    readonly target: infer S extends Codec;
+} ? S["Type"] : never;
+export type TargetArgs<D extends Definition> = D extends {
+    readonly target: Codec;
+} ? [target: TargetOf<D>] : [];
+export type PolicyError<D extends Definition> = D extends {
+    readonly error: infer S extends Codec;
+} ? S["Type"] : never;
+/** The errors a check can fail with: refusals of required permissions become decisions. */
+export type CheckError<D extends Definition> = Exclude<PolicyError<D>, Refusal<D>>;
+type Refusal<D extends Definition> = Extract<PolicyError<D>, Decision.Denied>;
+export type Policy<D extends Definition, R> = (...target: TargetArgs<D>) => Decision.Decision | Effect.Effect<Decision.Decision, PolicyError<D>, R>;
+export interface Api<I extends string, D extends Definition, R> {
+    readonly check: (...target: TargetArgs<D>) => Effect.Effect<Decision.Decision, CheckError<D>, R>;
+    readonly require: (...target: TargetArgs<D>) => Effect.Effect<void, Decision.DeniedBy<I> | PolicyError<D>, R>;
+}
+export interface Statics<Self, I extends string, D extends Definition, R> {
+    readonly id: I;
+    readonly definition: D;
+    readonly Denied: Decision.DeniedBySchema<I>;
+    readonly check: (...target: TargetArgs<D>) => Effect.Effect<Decision.Decision, CheckError<D>, Self | R>;
+    readonly require: (...target: TargetArgs<D>) => Effect.Effect<void, Decision.DeniedBy<I> | PolicyError<D>, Self | R>;
+    readonly toLayer: <E = never, RL = never>(policy: Policy<D, R> | Effect.Effect<Policy<D, R>, E, RL>) => Layer.Layer<Self, E, Exclude<RL, Scope.Scope>>;
+}
+export type Permission<Self, Key extends string, D extends Definition, R> = Context.ServiceClass<Self, Key, Api<IdOf<Key, D>, D, R>> & Statics<Self, IdOf<Key, D>, D, R>;
+export interface Any {
+    readonly id: string;
+    /** The service key: unique per permission, as Effect requires of service keys. */
+    readonly key: string;
+}
+export interface Tag<Self, I extends string, D extends Definition, R> extends Context.Service<Self, Api<I, D, R>> {
+    readonly id: I;
+    readonly definition: D;
+}
+declare const Restriction_base: Context.Reference<ReadonlySet<string> | undefined>;
+/**
+ * The keys of the permissions the caller may use, or undefined for all.
+ * Keys rather than ids, so permissions sharing an id stay apart.
+ */
+export declare class Restriction extends Restriction_base {
+}
+export interface Decided<D extends Definition> {
+    readonly permission: string;
+    readonly via: "check" | "require";
+    readonly target: TargetArgs<D>;
+    readonly decision: Decision.Decision;
+}
+/**
+ * Runs `f` after every decision of a permission service built by `toLayer`,
+ * inside the check's span and before `require` fails.
+ */
+export declare const tap: <D extends Definition>(f: (decided: Decided<D>) => Effect.Effect<void>) => <I extends string, R>(service: Api<I, D, R>) => Api<I, D, R>;
+/** Whether the caller's restriction excludes a permission, so it must refuse. */
+export declare const isRestricted: (permission: Any) => Effect.Effect<boolean, never, never>;
+export declare const restrictTo: (permissions: Iterable<Any>) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+export interface PermissionSet<P extends Any> {
+    readonly schema: Schema.Codec<ReadonlyArray<P["id"]>, ReadonlyArray<string>>;
+    readonly restrictTo: (ids: Iterable<P["id"]>) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+}
+export declare const set: <const Ps extends readonly [Any, ...ReadonlyArray<Any>]>(permissions: Ps) => PermissionSet<Ps[number]>;
+export declare const Service: <Self, C extends Config = {}>() => <const Key extends string, const D extends Definition>(key: Key, definition: D) => Permission<Self, Key, D, Requires<C>>;
+export {};
+//# sourceMappingURL=Permission.d.ts.map

package/dist/Permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Permission.d.ts","sourceRoot":"","sources":["../src/Permission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAa,MAAM,EAAwB,MAAM,QAAQ,CAAC;AAEzF,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAEnD,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,MAAM,IAAI,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC,SAAS,UAAU,IAAI,CAAC,SAAS;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,MAAM,CAAC;CACrC,GACG,CAAC,GACD,GAAG,CAAC;AAER,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAC;AAE9F,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,UAAU,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,KAAK,CAAA;CAAE,GAC7F,CAAC,CAAC,MAAM,CAAC,GACT,KAAK,CAAC;AAEV,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,UAAU,IAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC/E,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GACrB,EAAE,CAAC;AAEP,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,UAAU,IAAI,CAAC,SAAS;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,KAAK,CAAC;CACvC,GACG,CAAC,CAAC,MAAM,CAAC,GACT,KAAK,CAAC;AAEV,2FAA2F;AAC3F,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnF,KAAK,OAAO,CAAC,CAAC,SAAS,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,IAAI,CAC5C,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KACrB,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7E,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjG,QAAQ,CAAC,OAAO,EAAE,CAChB,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC;IACtE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,CACd,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KACrB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,CAChB,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,GAAG,KAAK,EACtC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KACtD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,SAAS,MAAM,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC,IAAI,OAAO,CAAC,YAAY,CAC9F,IAAI,EACJ,GAAG,EACH,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACxB,GACC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpC,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC,CAAE,SAAQ,OAAO,CAAC,OAAO,CAC3F,IAAI,EACJ,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACb;IACC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;CACxB;;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,gBAGhC;CAAG;AAEJ,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,UAAU;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;CACtC;AAmED;;;GAGG;AACH,eAAO,MAAM,GAAG,GACb,CAAC,SAAS,UAAU,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MACrE,CAAC,SAAS,MAAM,EAAE,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAWxD,CAAC;AAEJ,iFAAiF;AACjF,eAAO,MAAM,YAAY,eAAgB,GAAG,yCACiD,CAAC;AAE9F,eAAO,MAAM,UAAU,gBACP,QAAQ,CAAC,GAAG,CAAC,MAC1B,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAS5D,CAAC;AAEP,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,GAAG;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KACnB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;CAC1E;AAED,eAAO,MAAM,GAAG,GAAI,KAAK,CAAC,EAAE,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,eAC3D,EAAE,KACd,aAAa,CAAC,EAAE,CAAC,MAAM,CAAC,CA2B1B,CAAC;AAEF,eAAO,MAAM,OAAO,GACjB,IAAI,EAAE,CAAC,SAAS,MAAM,GAAG,EAAE,QAC3B,KAAK,CAAC,GAAG,SAAS,MAAM,EAAE,KAAK,CAAC,CAAC,SAAS,UAAU,OAC9C,GAAG,cACI,CAAC,KACZ,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CA0DtC,CAAC"}