@liquisio/wix-access 0.3.1 → 0.4.0

package/README.md

@@ -72,15 +72,19 @@ the **release** rather than a request.
 
 ## Using it
 
-**Web methods** — you write the export line, the package decides the call.
+**Web methods** — you write the export line, the policy decides the gate.
 
-Wix only ever hands page code a web method written in exactly this form, so the
-`webMethod` call and the permission literal have to be yours:
+Wix treats a web method in two separate ways, and both matter.
+
+*Whether an export becomes a web method at all* is decided at build time, by reading the
+source. Only this exact form is recognised, so the `webMethod` call and the permission
+literal have to be yours:
 
 ```js
 // backend/api.web.js
 import { webMethod, Permissions } from 'wix-web-module'
-import { guard } from 'backend/access'
+import { guard, applyGates } from 'backend/access'
+import policy from 'public/access-policy'
 import { cancelBooking as _cancelBooking, getBooking } from 'backend/booking-service'
 
 const _cancel = guard(
@@ -96,21 +100,37 @@ const _cancel = guard(
 )
 
 export const cancelBooking = webMethod(Permissions.SiteMember, async (...args) => await _cancel(...args))
+
+// The policy is the authority. One line, at the end of the file.
+applyGates({ cancelBooking }, policy)
 ```
 
-Three rules, and breaking any of them makes the export arrive in the browser as
-`undefined` rather than failing loudly:
+Break any of these three and the export arrives in the browser as `undefined` rather than
+failing loudly:
 
 - the `webMethod(...)` call and the `export const` are one statement;
-- the permission is written out as `Permissions.LEVEL`, never computed, aliased
-  or bracketed;
-- the second argument is a function written in place. Passing `_cancel` straight
-  in does not work; calling it from inside the arrow does.
+- the permission is written out as `Permissions.LEVEL`, never computed, aliased or bracketed;
+- the second argument is a function written in place. Passing `_cancel` straight in does not
+  work; calling it from inside the arrow does.
+
+*Which level is enforced* is read from the method's `permission` property when the request
+arrives. That is what `applyGates` sets, from `policy.api`, so the manifest wins over the
+literal you typed and cannot drift from it. A method missing from the policy throws there,
+rather than quietly keeping whatever the literal said.
 
-Because you type the gate, it can drift from the policy. Two things stop that.
-`guard` re-checks the declared level at request time, so a method the policy
-calls `Admin` refuses a caller without the Admin role even if the export says
-`Anyone`. And `assertGates` reads the file and compares:
+Three independent things now have to agree before a caller gets through, and each is checked
+somewhere different:
+
+| Layer | Set by | Checked by |
+| --- | --- | --- |
+| the platform gate | `applyGates`, from the policy | Wix, at request time |
+| the literal you typed | you | `assertGates` in a test |
+| the caller's level and ability | the policy | `guard`, in code, per request |
+
+`guard` re-checks the declared level itself, so a method the policy calls `Admin` refuses a
+caller without the Admin role even if `applyGates` was never called. And `assertGates` reads
+the file and reports any literal that disagrees with the policy, plus the unreachable export
+shapes above:
 
 ```js
 // tests/gates.test.js
@@ -121,13 +141,9 @@ import policy from '../src/public/access-policy.js'
 assertGates(readFileSync('src/backend/api.web.js', 'utf8'), policy, { complete: true })
 ```
 
-It also flags the unreachable export shapes above, which is the failure worth
-catching early: a mis-typed gate is a bug, but a dropped export is a call site
-that throws "is not a function" with nothing to point at.
-
-A method missing from `policy.api` throws at construction, so an undocumented
-gate fails the build. `gateFor(name)` returns the level to type, for a test —
-never at the call site, where it would be a computed permission.
+A method missing from `policy.api` throws when `guard` is constructed, so an undocumented gate
+fails the build. `gateFor(name)` returns the level, for a test — never at the call site, where
+it would be a computed permission and the export would vanish.
 
 **Data** — elevation and authorization together, so neither is used without the other.
 

package/backend.d.ts

@@ -81,6 +81,13 @@ export declare function parseGates(source: string): Record<string, string>
 export declare function verifyGates(source: string, policy: Policy, options?: { complete?: boolean }): GateReport
 /** verifyGates, throwing with every problem in the message. For a test. */
 export declare function assertGates(source: string, policy: Policy, options?: { complete?: boolean }): true
+/**
+ * Makes the policy the authority on the gate at runtime, by stamping each
+ * exported web method's `permission` property from `policy.api`. Call it once at
+ * the end of your `.web.js`, passing the exported bindings. Throws on any method
+ * missing from the policy.
+ */
+export declare function applyGates(exported: Record<string, unknown>, policy: Policy): Record<string, string>
 
 export declare function backendPing(): { ok: boolean; side: string; version: string }
 export declare function backendMemberId(): Promise<string | null>

package/backend.js

@@ -1,3 +1,3 @@
-var Yt=Object.create;var Y=Object.defineProperty;var Jt=Object.getOwnPropertyDescriptor;var Kt=Object.getOwnPropertyNames;var Zt=Object.getPrototypeOf,Ht=Object.prototype.hasOwnProperty;var Qt=(t,e)=>{for(var r in e)Y(t,r,{get:e[r],enumerable:!0})},st=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of Kt(e))!Ht.call(t,s)&&s!==r&&Y(t,s,{get:()=>e[s],enumerable:!(n=Jt(e,s))||n.enumerable});return t};var Wt=(t,e,r)=>(r=t!=null?Yt(Zt(t)):{},st(e||!t||!t.__esModule?Y(r,"default",{value:t,enumerable:!0}):r,t)),Xt=t=>st(Y({},"__esModule",{value:!0}),t);var Qr={};Qt(Qr,{CASES:()=>rt,CODES:()=>O,KIND:()=>$,PACKAGE_VERSION:()=>tt,PolicyError:()=>M,SCOPE:()=>w,WHEN:()=>I,abilityFor:()=>ce,abilityFromRules:()=>Qe,anonymous:()=>at,applyClauses:()=>le,assertDeclared:()=>Tt,assertGates:()=>Rt,backendMemberId:()=>Hr,backendPing:()=>Zr,can:()=>v,caseTable:()=>kt,createAccess:()=>Kr,createPrincipal:()=>q,deny:()=>C,denyOpaque:()=>j,filterFor:()=>ue,hasRole:()=>J,isDenial:()=>it,normaliseRoles:()=>fe,ok:()=>ot,parseGates:()=>Xe,permissionFor:()=>ut,resolvePlaceholders:()=>St,resolveSubjects:()=>Z,resolveWhere:()=>ae,rulesFor:()=>k,validatePolicy:()=>K,verifyGates:()=>et});module.exports=Xt(Qr);var nt=require("wix-members-backend"),Bt=Wt(require("wix-users-backend"),1),zt=require("@wix/data"),Gt=require("@wix/essentials");var O={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},M=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=O.INVALID_POLICY}};function ot(t){return{ok:!0,data:t===void 0?null:t}}function C(t,e,r){let n={ok:!1,code:t||O.FORBIDDEN};return e&&(n.action=e),r&&(n.detail=r),n}var it=t=>!!t&&t.ok===!1;function j(t){return C(O.NOT_FOUND,t)}var $={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function fe(t){if(!Array.isArray(t))return[];let e=[];for(let r of t){if(typeof r=="string"){e.push(r);continue}if(!r||typeof r!="object")continue;let n=r.title||r.name||r.roleKey;n&&e.push(n)}return e}function q(t){let e=t||{},r=e.memberId||null,n=fe(e.roles);return{kind:e.kind||(r?$.MEMBER:$.VISITOR),memberId:r,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var at=()=>q({kind:$.VISITOR}),J=(t,e)=>t.roles.indexOf(e)!==-1;var I={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},E=t=>!!t&&typeof t=="object"&&!Array.isArray(t),er=t=>Array.isArray(t)?t:[t];function h(t,e){throw new M("policy"+t+": "+e)}function tr(t,e){let r=".subjects."+t;E(e)||h(r,"must be an object");let s=["when","role","domain"].filter(o=>e[o]!==void 0);if(s.length===0&&h(r,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),s.length>1&&h(r,"has "+s.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[I.ANYONE,I.ANONYMOUS,I.MEMBER];o.indexOf(e.when)===-1&&h(r+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&h(r+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&h(r+".domain","must be a string")}function rr(t,e,r){let n=".rules["+e+"]";E(t)||h(n,"must be an object"),typeof t.subject!="string"&&h(n+".subject","must be a string"),r.indexOf(t.subject)===-1&&h(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&h(n+".actions","is required");for(let s of er(t.actions))typeof s!="string"&&h(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&h(n+".resource","must be a string"),t.where!==void 0&&!E(t.where)&&h(n+".where","must be an object")}var ct=["Anyone","SiteMember","Admin"];function nr(t,e,r){let n=".api."+t;E(e)||h(n,"must be an object"),ct.indexOf(e.permission)===-1&&h(n+".permission","must be one of "+ct.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&h(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&h(n+".ability","both entries must be strings")),e.subject!==void 0&&r.indexOf(e.subject)===-1&&h(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function K(t){if(!E(t))throw new M("policy must be an object");E(t.subjects)||h(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&h(".subjects","declares no subjects");for(let r of e)tr(r,t.subjects[r]);if(Array.isArray(t.rules)||h(".rules","is required and must be an array"),t.rules.forEach((r,n)=>rr(r,n,e)),t.api!==void 0){E(t.api)||h(".api","must be an object");for(let r of Object.keys(t.api))nr(r,t.api[r],e)}return t.collections!==void 0&&!E(t.collections)&&h(".collections","must be an object"),t}function Z(t,e){let r=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let s=e.subjects[n];(s.when===I.ANYONE||s.when===I.ANONYMOUS&&!t.memberId||s.when===I.MEMBER&&t.memberId||s.role!==void 0&&t.roles.indexOf(s.role)!==-1||s.domain!==void 0&&t.domain[s.domain])&&r.add(n)}return Array.from(r)}function ut(t,e){let r=t.api&&t.api[e];return r?r.permission:null}var H=class{constructor(e,r){this.operator=e,this.value=r,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},L=class extends H{},S=class extends L{constructor(e,r){if(!Array.isArray(r))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,r)}},N="__itself__",_=class extends H{constructor(e,r,n){super(e,n),this.field=r}},me=new L("__null__",null),he=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function sr(t,e){return e instanceof S&&e.operator===t}function ye(t,e){return e.length===1?e[0]:new S(t,(function r(n,s,o){let i=o||[];for(let a=0,c=s.length;a<c;a++){let l=s[a];sr(n,l)?r(n,l.value,i):i.push(l)}return i})(t,e))}var or=t=>t,lt=()=>Object.create(null),ft=Object.defineProperty(lt(),"__@type@__",{value:"ignore value"});function ir(t,e,r=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(he(t,n)&&he(e,n)&&(!r||t[n]!==ft))return!0;return!1}function ar(t){let e=[];for(let r in t)he(t,r)&&t[r]!==ft&&e.push(r);return e}function de(t,e){e!==me&&t.push(e)}var be=t=>ye("and",t);var Q={compound(t,e,r){let n=(Array.isArray(e)?e:[e]).map(s=>r.parse(s));return new S(t.name,n)},field:(t,e,r)=>new _(t.name,r.field,e),document:(t,e)=>new L(t.name,e)},B=class{constructor(e,r=lt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:r.operatorToConditionName||or,defaultOperatorName:r.defaultOperatorName||"eq",mergeFinalConditions:r.mergeFinalConditions||be},this.o=Object.keys(e).reduce((n,s)=>(n[s]=Object.assign({name:this.u.operatorToConditionName(s)},e[s]),n),{}),this.s=Object.assign({},r.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>ir(n,this.o,r.useIgnoreValue)}),this.i=Object.assign({},r.documentContext,{parse:this.parse,query:{}}),this.h=r.useIgnoreValue?ar:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,r,n,s){let o=this.o[r];if(!o)throw new Error(`Unsupported operator "${r}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${r}" at field level`);return this.s.field=e,this.s.query=s,this.parseInstruction(o,n,this.s)}parseInstruction(e,r,n){return typeof e.validate=="function"&&e.validate(e,r),(e.parse||Q[e.type])(e,r,n)}parseFieldOperators(e,r){let n=[],s=this.h(r);for(let o=0,i=s.length;o<i;o++){let a=s[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);de(n,this.parseField(e,a,r[a],r))}return n}parse(e){let r=[],n=this.h(e);this.i.query=e;for(let s=0,o=n.length;s<o;s++){let i=n[s],a=e[i],c=this.o[i];if(c){if(c.type!=="document"&&c.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in  "${c.type}" context`);de(r,this.parseInstruction(c,a,this.i))}else this.s.hasOperators(a)?r.push(...this.parseFieldOperators(i,a)):de(r,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(r)}};function pe(t,e){let r=t[e];if(typeof r!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return r}function cr(t){return t.operator}function dt(t,e){let r=e,n=r&&r.getInterpreterName||cr,s;switch(r?r.numberOfArguments:0){case 1:s=i=>{let a=n(i,r);return pe(t,a)(i,o)};break;case 3:s=(i,a,c)=>{let l=n(i,r);return pe(t,l)(i,a,c,o)};break;default:s=(i,a)=>{let c=n(i,r);return pe(t,c)(i,a,o)}}let o=Object.assign({},r,{interpret:s});return o.interpret}function pt(t,e){return(r,...n)=>{let s=t(r,...n),o=e.bind(null,s);return o.ast=s,o}}var on=B.prototype.parseInstruction;function ht(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function mt(t,e){if(ht(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ge=t=>(e,r)=>{if(typeof r!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},yt={type:"compound",validate:mt,parse(t,e,{parse:r}){let n=e.map(s=>r(s));return ye(t.name,n)}},ur=yt,lr={type:"compound",validate:mt},fr={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,r){let n=e instanceof RegExp?new _("regex",r.field,e):r.parse(e,r);return new S(t.name,[n])}},xe={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:r,field:n,hasOperators:s}){let o=s(e)?r(e,{field:N}):r(e);return new _(t.name,n,o)}},Oe={type:"field",validate:ge("number")},z={type:"field",validate:ht},ve=z,we=z,dr={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},je={type:"field",validate:ge("boolean")},X={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},G=X,Ae=G,$e=G,ee={type:"field"},Ee=ee,Ie={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,r){let n=typeof e=="string"?new RegExp(e,r.query.$options||""):e;return new _(t.name,r.field,n)}},Ne={type:"field",parse:()=>me},pr={type:"document",validate:ge("function")},hr=Object.freeze({__proto__:null,$and:yt,$or:ur,$nor:lr,$not:fr,$elemMatch:xe,$size:Oe,$in:z,$nin:ve,$all:we,$mod:dr,$exists:je,$gte:X,$gt:G,$lt:Ae,$lte:$e,$eq:ee,$ne:Ee,$regex:Ie,$options:Ne,$where:pr}),W=class extends B{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:r=>r.slice(1)})}parse(e,r){return r&&r.field?be(this.parseFieldOperators(r.field,e)):super.parse(e)}},te=hr;function Fe(t,e,r){for(let n=0,s=t.length;n<s;n++)if(r(t[n],e)===0)return!0;return!1}function Me(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function bt(t,e,r){if(!Me(t,e))return r(t,e);let n=[];for(let s=0;s<t.length;s++){let o=r(t[s],e);o!==void 0&&(n=n.concat(o))}return n}function R(t){return(e,r,n)=>{let s=n.get(r,e.field);return Array.isArray(s)?s.some(o=>t(e,o,n)):t(e,s,n)}}var mr=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),yr=(t,e)=>t[e];function gt(t,e,r){let n=e.lastIndexOf(".");return n===-1?[t,e]:[r(t,e.slice(0,n)),e.slice(n+1)]}function br(t,e,r=yr){if(e===N)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,s,o){if(s.indexOf(".")===-1)return bt(n,s,o);let i=s.split("."),a=n;for(let c=0,l=i.length;c<l;c++)if(a=bt(a,i[c],o),!a||typeof a!="object")return c<l-1?void 0:a;return a})(t,e,r)}function Ce(t,e){return t===e?0:t>e?1:-1}function Se(t,e={}){return dt(t,Object.assign({get:br,compare:Ce},e))}var xt=(t,e,{interpret:r})=>t.value.some(n=>r(n,e)),gr=(t,e,r)=>!xt(t,e,r),_e=(t,e,{interpret:r})=>t.value.every(n=>r(n,e)),xr=(t,e,{interpret:r})=>!r(t.value[0],e),re=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&!Array.isArray(t.value)?Fe(s,t.value,r):r(s,t.value)===0},Re=(t,e,r)=>!re(t,e,r),ke=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===-1}),De=R((t,e,r)=>r.compare(e,t.value)===-1),Pe=R((t,e,r)=>r.compare(e,t.value)===1),Te=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===1}),Ue=(t,e,{get:r})=>{if(t.field===N)return e!==void 0;let[n,s]=gt(e,t.field,r),o=i=>i==null?!!i===t.value:mr(i,s)===t.value;return Me(n,s)?n.some(o):o(n)},Or=R((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),qe=(t,e,{get:r})=>{let[n,s]=gt(e,t.field,r),o=i=>{let a=r(i,s);return Array.isArray(a)&&a.length===t.value};return t.field!==N&&Me(n,s)?n.some(o):o(n)},Le=R((t,e)=>typeof e=="string"&&t.value.test(e)),V=R((t,e,{compare:r})=>Fe(t.value,e,r)),Be=(t,e,r)=>!V(t,e,r),ze=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&t.value.every(o=>Fe(s,o,r))},Ge=(t,e,{interpret:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&s.some(o=>r(t.value,o))},vr=(t,e)=>t.value.call(e),wr=Object.freeze({__proto__:null,or:xt,nor:gr,and:_e,not:xr,eq:re,ne:Re,lte:ke,lt:De,gt:Pe,gte:Te,exists:Ue,mod:Or,size:qe,regex:Le,within:V,nin:Be,all:ze,elemMatch:Ge,where:vr}),ne=Object.assign({},wr,{in:V}),dn=Se(ne);function Ot(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var jr=(t,e)=>Ce(Ot(t),Ot(e));function se(t,e,r){let n=new W(t),s=Se(e,Object.assign({compare:jr},r));if(r&&r.forPrimitives){let o={field:N},i=n.parse;n.setParse(a=>i(a,o))}return pt(n.parse,s)}var bn=se(te,ne),gn=se(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},te,{$nor:Object.assign({},te.$nor,{type:"field",parse:Q.compound})})),ne,{forPrimitives:!0});var Et=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Ve(t){return Array.isArray(t)?t:[t]}var P="__caslSubjectType__";function It(t,e){if(e){if(!Et(e,P))Object.defineProperty(e,P,{value:t});else if(t!==e[P])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[P]}`)}return e}var ie=t=>{let e=typeof t;return e==="string"||e==="function"},Nt=t=>t.modelName||t.name;function Ar(t){return typeof t=="string"?t:Nt(t)}function Ft(t){return Et(t,P)?t[P]:Nt(t.constructor)}var vt={function:t=>t.constructor,string:Ft};function wt(t,e,r){for(let n=r;n<e.length;n++)t.push(e[n])}function jt(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let r=0,n=0,s=[];for(;r<t.length&&n<e.length;)t[r].priority<e[n].priority?(s.push(t[r]),r++):t[r].priority>e[n].priority?(s.push(e[n]),n++):(s.push(t[r]),r++,n++);return wt(s,t,r),wt(s,e,n),s}function oe(t,e,r){let n=t.get(e);return n||(n=r(),t.set(e,n)),n}var $r=t=>t;function Er(t,e){let r;for(let n=0;n<t.length;n++){let s=e(t[n]);r&&s&&r.push(t[n]),s||(r??=t.slice(0,n))}return r||t}function Ir(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var Ye=class{constructor(e,r,n=0){Ir(e,r),this.action=r.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Ve(e.fields):void 0,this.priority=n,this.t=r}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||ie(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function Nr(t,e){let r={value:t,prev:e,next:null};return e&&(e.next=r),r}function Fr(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var At=()=>({rules:[],merged:!1}),$t=()=>new Map,Je=class{constructor(e=[],r={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:r.conditionsMatcher,fieldMatcher:r.fieldMatcher,resolveAction:r.resolveAction||$r},this.$=r.anyAction||"manage",this.A=r.anySubjectType||"all",this.m=e,this.M=!!r.detectSubjectType,this.j=r.detectSubjectType||Ft,this.v(e)}get rules(){return this.m}detectSubjectType(e){return ie(e)?e:e?this.j(e):this.A}update(e){let r={rules:e,ability:this,target:this};return this._("update",r),this.m=e,this.v(e),this._("updated",r),this}v(e){let r=new Map,n;for(let s=e.length-1;s>=0;s--){let o=e.length-s-1,i=new Ye(e[s],this.p,o),a=Ve(i.action),c=Ve(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let l=0;l<c.length;l++){let u=oe(r,c[l],$t);n===void 0&&(n=typeof c[l]),typeof c[l]!==n&&n!=="mixed"&&(n="mixed");for(let d=0;d<a.length;d++)oe(u,a[d],At).rules.push(i)}}if(this.l=r,n!=="mixed"&&!this.M){let s=vt[n]||vt.string;this.j=s}}possibleRulesFor(e,r=this.A){if(!ie(r))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=oe(this.l,r,$t),s=oe(n,e,At);if(s.merged)return s.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=jt(s.rules,o);return r!==this.A&&(i=jt(i,this.possibleRulesFor(e,this.A))),s.rules=i,s.merged=!0,i}rulesFor(e,r,n){let s=this.possibleRulesFor(e,r);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?Er(s,o=>o.matchesField(n)):s}actionsFor(e){if(!ie(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let r=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>r.add(o));let s=e!==this.A?this.l.get(this.A):void 0;return s&&Array.from(s.keys()).forEach(o=>r.add(o)),Array.from(r)}on(e,r){this.F=this.F||new Map;let n=this.F,s=n.get(e)||null,o=Nr(r,s);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),Fr(o)}}_(e,r){if(!this.F)return;let n=this.F.get(e)||null,s=[];for(;n!==null;)s.push(n.value),n=n.prev;for(let o=0;o<s.length;o++)s[o](r)}},Ke=class extends Je{can(e,r,n){let s=this.relevantRuleFor(e,r,n);return!!s&&!s.inverted}relevantRuleFor(e,r,n){let s=this.detectSubjectType(r),o=this.rulesFor(e,s,n);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(r))return o[i];return null}cannot(e,r,n){return!this.can(e,r,n)}},Mr={$eq:ee,$ne:Ee,$lt:Ae,$lte:$e,$gt:G,$gte:X,$in:z,$nin:ve,$all:we,$size:Oe,$regex:Ie,$options:Ne,$elemMatch:xe,$exists:je},Cr={eq:re,ne:Re,lt:De,lte:ke,gt:Pe,gte:Te,in:V,nin:Be,all:ze,size:qe,regex:Le,elemMatch:Ge,exists:Ue,and:_e};var Sr=se(Mr,Cr),_r=/[-/\\^$+?.()|[\]{}]/g,Rr=/\.?\*+\.?/g,kr=/\*+/,Dr=/\./g;function Pr(t,e,r){let n=r[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",s=t.indexOf("**")===-1?"[^.]":".",o=t.replace(Dr,"\\$&").replace(kr,s+n);return e+t.length===r.length?`(?:${o})?`:o}function Tr(t,e,r){return t==="."&&(r[e-1]==="*"||r[e+1]==="*")?t:`\\${t}`}function Ur(t){let e=t.map(n=>n.replace(_r,Tr).replace(Rr,Pr)),r=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${r}$`)}var qr=t=>{let e;return r=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:Ur(t)),e===null?t.indexOf(r)!==-1:e.test(r))};function Mt(t=[],e={}){return new Ke(t,Object.assign({conditionsMatcher:Sr,fieldMatcher:qr},e))}var Lr=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,Ct=function(e){this.message=e};Ct.prototype=Object.create(Error.prototype);var Ze=class extends Ct{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,r,n){let s=this.unlessCan(e,r,n);if(s)throw s}unlessCan(e,r,n){let s=this.ability.relevantRuleFor(e,r,n);if(s&&!s.inverted)return;this.action=e,this.subject=r,this.subjectType=Ar(this.ability.detectSubjectType(r)),this.field=n;let o=s?s.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};Ze.P=Lr;var An=Object.freeze({__proto__:null});function He(t,e,r){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let s=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return s==null&&(r.unresolved=!0),s}if(Array.isArray(t))return t.map(n=>He(n,e,r));if(typeof t=="object"){let n={};for(let s of Object.keys(t))n[s]=He(t[s],e,r);return n}return t}function ae(t,e){let r={unresolved:!1};return{conditions:He(t,e,r),unresolved:r.unresolved}}function St(t,e){return ae(t,e).conditions}function k(t,e){let r=Z(t,e),n=[];for(let s of e.rules){if(r.indexOf(s.subject)===-1)continue;let o={action:s.actions,subject:s.resource};if(s.where){let{conditions:i,unresolved:a}=ae(s.where,t);if(a)continue;o.conditions=i}n.push(o)}return n}function Qe(t){return Mt(Array.isArray(t)?t:[])}function ce(t,e){return Qe(k(t,e))}function v(t,e,r,n){return n==null?t.can(e,r):t.can(e,It(r,Object.assign({},n)))}var w={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},_t={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Br(t){let e=[];for(let r of Object.keys(t)){let n=t[r];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:r,op:"eq",value:n});continue}let s=Object.keys(n);if(s.length!==1||!_t[s[0]])return null;e.push({field:r,op:_t[s[0]],value:n[s[0]]})}return e}var zr=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Gr=(t,e)=>t==="all"||t===e;function ue(t,e,r,n){let s=k(t,e).filter(i=>zr(i.action,r)&&Gr(i.subject,n));if(s.length===0)return{scope:w.NONE,clauses:[]};if(s.some(i=>!i.conditions))return{scope:w.ALL,clauses:[]};if(s.length>1)return{scope:w.AMBIGUOUS,clauses:[]};let o=Br(s[0].conditions);return o?{scope:w.FIELDS,clauses:o}:{scope:w.AMBIGUOUS,clauses:[]}}function le(t,e){let r=t;for(let n of e)n.op==="in"?r=r.hasSome(n.field,n.value):n.op==="nin"?r=r.not(r.hasSome(n.field,n.value)):r=r[n.op](n.field,n.value);return r}var We=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Vr=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function Xe(t){let e={},r=String(t||"");We.lastIndex=0;let n=We.exec(r);for(;n;)e[n[1]]=n[2],n=We.exec(r);return e}function et(t,e,r){let n=r||{},s=e&&e.api||{},o=Xe(t),i=String(t||""),a=[],c=[];for(let f of Object.keys(o)){let p=s[f];p?p.permission!==o[f]&&a.push({name:f,declared:p.permission,written:o[f]}):c.push({name:f,gate:o[f]})}let l=n.complete?Object.keys(s).filter(f=>!(f in o)):[],u=[];for(let[f,p]of Vr)f.test(i)&&u.push(p);return{ok:a.length+c.length+l.length+u.length===0,found:o,mismatched:a,undeclared:c,missing:l,suspect:u}}function Rt(t,e,r){let n=et(t,e,r);if(n.ok)return!0;let s=[];for(let o of n.mismatched)s.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)s.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)s.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)s.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
+var Jt=Object.create;var J=Object.defineProperty;var Kt=Object.getOwnPropertyDescriptor;var Zt=Object.getOwnPropertyNames;var Ht=Object.getPrototypeOf,Qt=Object.prototype.hasOwnProperty;var Wt=(t,e)=>{for(var r in e)J(t,r,{get:e[r],enumerable:!0})},st=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of Zt(e))!Qt.call(t,s)&&s!==r&&J(t,s,{get:()=>e[s],enumerable:!(n=Kt(e,s))||n.enumerable});return t};var Xt=(t,e,r)=>(r=t!=null?Jt(Ht(t)):{},st(e||!t||!t.__esModule?J(r,"default",{value:t,enumerable:!0}):r,t)),er=t=>st(J({},"__esModule",{value:!0}),t);var Wr={};Wt(Wr,{CASES:()=>rt,CODES:()=>O,KIND:()=>$,PACKAGE_VERSION:()=>tt,PolicyError:()=>M,SCOPE:()=>v,WHEN:()=>I,abilityFor:()=>ce,abilityFromRules:()=>Qe,anonymous:()=>at,applyClauses:()=>le,applyGates:()=>kt,assertDeclared:()=>Ut,assertGates:()=>Rt,backendMemberId:()=>Qr,backendPing:()=>Hr,can:()=>w,caseTable:()=>Dt,createAccess:()=>Zr,createPrincipal:()=>L,deny:()=>C,denyOpaque:()=>j,filterFor:()=>ue,hasRole:()=>K,isDenial:()=>it,normaliseRoles:()=>fe,ok:()=>ot,parseGates:()=>Xe,permissionFor:()=>ut,resolvePlaceholders:()=>St,resolveSubjects:()=>P,resolveWhere:()=>ae,rulesFor:()=>k,validatePolicy:()=>Z,verifyGates:()=>et});module.exports=er(Wr);var nt=require("wix-members-backend"),Gt=Xt(require("wix-users-backend"),1),zt=require("@wix/data"),Vt=require("@wix/essentials");var O={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},M=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=O.INVALID_POLICY}};function ot(t){return{ok:!0,data:t===void 0?null:t}}function C(t,e,r){let n={ok:!1,code:t||O.FORBIDDEN};return e&&(n.action=e),r&&(n.detail=r),n}var it=t=>!!t&&t.ok===!1;function j(t){return C(O.NOT_FOUND,t)}var $={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function fe(t){if(!Array.isArray(t))return[];let e=[];for(let r of t){if(typeof r=="string"){e.push(r);continue}if(!r||typeof r!="object")continue;let n=r.title||r.name||r.roleKey;n&&e.push(n)}return e}function L(t){let e=t||{},r=e.memberId||null,n=fe(e.roles);return{kind:e.kind||(r?$.MEMBER:$.VISITOR),memberId:r,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var at=()=>L({kind:$.VISITOR}),K=(t,e)=>t.roles.indexOf(e)!==-1;var I={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},E=t=>!!t&&typeof t=="object"&&!Array.isArray(t),tr=t=>Array.isArray(t)?t:[t];function h(t,e){throw new M("policy"+t+": "+e)}function rr(t,e){let r=".subjects."+t;E(e)||h(r,"must be an object");let s=["when","role","domain"].filter(o=>e[o]!==void 0);if(s.length===0&&h(r,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),s.length>1&&h(r,"has "+s.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[I.ANYONE,I.ANONYMOUS,I.MEMBER];o.indexOf(e.when)===-1&&h(r+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&h(r+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&h(r+".domain","must be a string")}function nr(t,e,r){let n=".rules["+e+"]";E(t)||h(n,"must be an object"),typeof t.subject!="string"&&h(n+".subject","must be a string"),r.indexOf(t.subject)===-1&&h(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&h(n+".actions","is required");for(let s of tr(t.actions))typeof s!="string"&&h(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&h(n+".resource","must be a string"),t.where!==void 0&&!E(t.where)&&h(n+".where","must be an object")}var ct=["Anyone","SiteMember","Admin"];function sr(t,e,r){let n=".api."+t;E(e)||h(n,"must be an object"),ct.indexOf(e.permission)===-1&&h(n+".permission","must be one of "+ct.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&h(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&h(n+".ability","both entries must be strings")),e.subject!==void 0&&r.indexOf(e.subject)===-1&&h(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function Z(t){if(!E(t))throw new M("policy must be an object");E(t.subjects)||h(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&h(".subjects","declares no subjects");for(let r of e)rr(r,t.subjects[r]);if(Array.isArray(t.rules)||h(".rules","is required and must be an array"),t.rules.forEach((r,n)=>nr(r,n,e)),t.api!==void 0){E(t.api)||h(".api","must be an object");for(let r of Object.keys(t.api))sr(r,t.api[r],e)}return t.collections!==void 0&&!E(t.collections)&&h(".collections","must be an object"),t}function P(t,e){let r=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let s=e.subjects[n];(s.when===I.ANYONE||s.when===I.ANONYMOUS&&!t.memberId||s.when===I.MEMBER&&t.memberId||s.role!==void 0&&t.roles.indexOf(s.role)!==-1||s.domain!==void 0&&t.domain[s.domain])&&r.add(n)}return Array.from(r)}function ut(t,e){let r=t.api&&t.api[e];return r?r.permission:null}var H=class{constructor(e,r){this.operator=e,this.value=r,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},B=class extends H{},S=class extends B{constructor(e,r){if(!Array.isArray(r))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,r)}},N="__itself__",_=class extends H{constructor(e,r,n){super(e,n),this.field=r}},me=new B("__null__",null),he=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function or(t,e){return e instanceof S&&e.operator===t}function ye(t,e){return e.length===1?e[0]:new S(t,(function r(n,s,o){let i=o||[];for(let a=0,l=s.length;a<l;a++){let u=s[a];or(n,u)?r(n,u.value,i):i.push(u)}return i})(t,e))}var ir=t=>t,lt=()=>Object.create(null),ft=Object.defineProperty(lt(),"__@type@__",{value:"ignore value"});function ar(t,e,r=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(he(t,n)&&he(e,n)&&(!r||t[n]!==ft))return!0;return!1}function cr(t){let e=[];for(let r in t)he(t,r)&&t[r]!==ft&&e.push(r);return e}function pe(t,e){e!==me&&t.push(e)}var be=t=>ye("and",t);var Q={compound(t,e,r){let n=(Array.isArray(e)?e:[e]).map(s=>r.parse(s));return new S(t.name,n)},field:(t,e,r)=>new _(t.name,r.field,e),document:(t,e)=>new B(t.name,e)},G=class{constructor(e,r=lt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:r.operatorToConditionName||ir,defaultOperatorName:r.defaultOperatorName||"eq",mergeFinalConditions:r.mergeFinalConditions||be},this.o=Object.keys(e).reduce((n,s)=>(n[s]=Object.assign({name:this.u.operatorToConditionName(s)},e[s]),n),{}),this.s=Object.assign({},r.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>ar(n,this.o,r.useIgnoreValue)}),this.i=Object.assign({},r.documentContext,{parse:this.parse,query:{}}),this.h=r.useIgnoreValue?cr:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,r,n,s){let o=this.o[r];if(!o)throw new Error(`Unsupported operator "${r}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${r}" at field level`);return this.s.field=e,this.s.query=s,this.parseInstruction(o,n,this.s)}parseInstruction(e,r,n){return typeof e.validate=="function"&&e.validate(e,r),(e.parse||Q[e.type])(e,r,n)}parseFieldOperators(e,r){let n=[],s=this.h(r);for(let o=0,i=s.length;o<i;o++){let a=s[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);pe(n,this.parseField(e,a,r[a],r))}return n}parse(e){let r=[],n=this.h(e);this.i.query=e;for(let s=0,o=n.length;s<o;s++){let i=n[s],a=e[i],l=this.o[i];if(l){if(l.type!=="document"&&l.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in  "${l.type}" context`);pe(r,this.parseInstruction(l,a,this.i))}else this.s.hasOperators(a)?r.push(...this.parseFieldOperators(i,a)):pe(r,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(r)}};function de(t,e){let r=t[e];if(typeof r!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return r}function ur(t){return t.operator}function pt(t,e){let r=e,n=r&&r.getInterpreterName||ur,s;switch(r?r.numberOfArguments:0){case 1:s=i=>{let a=n(i,r);return de(t,a)(i,o)};break;case 3:s=(i,a,l)=>{let u=n(i,r);return de(t,u)(i,a,l,o)};break;default:s=(i,a)=>{let l=n(i,r);return de(t,l)(i,a,o)}}let o=Object.assign({},r,{interpret:s});return o.interpret}function dt(t,e){return(r,...n)=>{let s=t(r,...n),o=e.bind(null,s);return o.ast=s,o}}var an=G.prototype.parseInstruction;function ht(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function mt(t,e){if(ht(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ge=t=>(e,r)=>{if(typeof r!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},yt={type:"compound",validate:mt,parse(t,e,{parse:r}){let n=e.map(s=>r(s));return ye(t.name,n)}},lr=yt,fr={type:"compound",validate:mt},pr={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,r){let n=e instanceof RegExp?new _("regex",r.field,e):r.parse(e,r);return new S(t.name,[n])}},xe={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:r,field:n,hasOperators:s}){let o=s(e)?r(e,{field:N}):r(e);return new _(t.name,n,o)}},Oe={type:"field",validate:ge("number")},z={type:"field",validate:ht},we=z,ve=z,dr={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},je={type:"field",validate:ge("boolean")},X={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},V=X,Ae=V,$e=V,ee={type:"field"},Ee=ee,Ie={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,r){let n=typeof e=="string"?new RegExp(e,r.query.$options||""):e;return new _(t.name,r.field,n)}},Ne={type:"field",parse:()=>me},hr={type:"document",validate:ge("function")},mr=Object.freeze({__proto__:null,$and:yt,$or:lr,$nor:fr,$not:pr,$elemMatch:xe,$size:Oe,$in:z,$nin:we,$all:ve,$mod:dr,$exists:je,$gte:X,$gt:V,$lt:Ae,$lte:$e,$eq:ee,$ne:Ee,$regex:Ie,$options:Ne,$where:hr}),W=class extends G{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:r=>r.slice(1)})}parse(e,r){return r&&r.field?be(this.parseFieldOperators(r.field,e)):super.parse(e)}},te=mr;function Fe(t,e,r){for(let n=0,s=t.length;n<s;n++)if(r(t[n],e)===0)return!0;return!1}function Me(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function bt(t,e,r){if(!Me(t,e))return r(t,e);let n=[];for(let s=0;s<t.length;s++){let o=r(t[s],e);o!==void 0&&(n=n.concat(o))}return n}function R(t){return(e,r,n)=>{let s=n.get(r,e.field);return Array.isArray(s)?s.some(o=>t(e,o,n)):t(e,s,n)}}var yr=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),br=(t,e)=>t[e];function gt(t,e,r){let n=e.lastIndexOf(".");return n===-1?[t,e]:[r(t,e.slice(0,n)),e.slice(n+1)]}function gr(t,e,r=br){if(e===N)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,s,o){if(s.indexOf(".")===-1)return bt(n,s,o);let i=s.split("."),a=n;for(let l=0,u=i.length;l<u;l++)if(a=bt(a,i[l],o),!a||typeof a!="object")return l<u-1?void 0:a;return a})(t,e,r)}function Ce(t,e){return t===e?0:t>e?1:-1}function Se(t,e={}){return pt(t,Object.assign({get:gr,compare:Ce},e))}var xt=(t,e,{interpret:r})=>t.value.some(n=>r(n,e)),xr=(t,e,r)=>!xt(t,e,r),_e=(t,e,{interpret:r})=>t.value.every(n=>r(n,e)),Or=(t,e,{interpret:r})=>!r(t.value[0],e),re=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&!Array.isArray(t.value)?Fe(s,t.value,r):r(s,t.value)===0},Re=(t,e,r)=>!re(t,e,r),ke=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===-1}),De=R((t,e,r)=>r.compare(e,t.value)===-1),Pe=R((t,e,r)=>r.compare(e,t.value)===1),Te=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===1}),Ue=(t,e,{get:r})=>{if(t.field===N)return e!==void 0;let[n,s]=gt(e,t.field,r),o=i=>i==null?!!i===t.value:yr(i,s)===t.value;return Me(n,s)?n.some(o):o(n)},wr=R((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),qe=(t,e,{get:r})=>{let[n,s]=gt(e,t.field,r),o=i=>{let a=r(i,s);return Array.isArray(a)&&a.length===t.value};return t.field!==N&&Me(n,s)?n.some(o):o(n)},Le=R((t,e)=>typeof e=="string"&&t.value.test(e)),Y=R((t,e,{compare:r})=>Fe(t.value,e,r)),Be=(t,e,r)=>!Y(t,e,r),Ge=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&t.value.every(o=>Fe(s,o,r))},ze=(t,e,{interpret:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&s.some(o=>r(t.value,o))},vr=(t,e)=>t.value.call(e),jr=Object.freeze({__proto__:null,or:xt,nor:xr,and:_e,not:Or,eq:re,ne:Re,lte:ke,lt:De,gt:Pe,gte:Te,exists:Ue,mod:wr,size:qe,regex:Le,within:Y,nin:Be,all:Ge,elemMatch:ze,where:vr}),ne=Object.assign({},jr,{in:Y}),dn=Se(ne);function Ot(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var Ar=(t,e)=>Ce(Ot(t),Ot(e));function se(t,e,r){let n=new W(t),s=Se(e,Object.assign({compare:Ar},r));if(r&&r.forPrimitives){let o={field:N},i=n.parse;n.setParse(a=>i(a,o))}return dt(n.parse,s)}var gn=se(te,ne),xn=se(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},te,{$nor:Object.assign({},te.$nor,{type:"field",parse:Q.compound})})),ne,{forPrimitives:!0});var Et=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Ve(t){return Array.isArray(t)?t:[t]}var T="__caslSubjectType__";function It(t,e){if(e){if(!Et(e,T))Object.defineProperty(e,T,{value:t});else if(t!==e[T])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[T]}`)}return e}var ie=t=>{let e=typeof t;return e==="string"||e==="function"},Nt=t=>t.modelName||t.name;function $r(t){return typeof t=="string"?t:Nt(t)}function Ft(t){return Et(t,T)?t[T]:Nt(t.constructor)}var wt={function:t=>t.constructor,string:Ft};function vt(t,e,r){for(let n=r;n<e.length;n++)t.push(e[n])}function jt(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let r=0,n=0,s=[];for(;r<t.length&&n<e.length;)t[r].priority<e[n].priority?(s.push(t[r]),r++):t[r].priority>e[n].priority?(s.push(e[n]),n++):(s.push(t[r]),r++,n++);return vt(s,t,r),vt(s,e,n),s}function oe(t,e,r){let n=t.get(e);return n||(n=r(),t.set(e,n)),n}var Er=t=>t;function Ir(t,e){let r;for(let n=0;n<t.length;n++){let s=e(t[n]);r&&s&&r.push(t[n]),s||(r??=t.slice(0,n))}return r||t}function Nr(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var Ye=class{constructor(e,r,n=0){Nr(e,r),this.action=r.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Ve(e.fields):void 0,this.priority=n,this.t=r}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||ie(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function Fr(t,e){let r={value:t,prev:e,next:null};return e&&(e.next=r),r}function Mr(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var At=()=>({rules:[],merged:!1}),$t=()=>new Map,Je=class{constructor(e=[],r={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:r.conditionsMatcher,fieldMatcher:r.fieldMatcher,resolveAction:r.resolveAction||Er},this.$=r.anyAction||"manage",this.A=r.anySubjectType||"all",this.m=e,this.M=!!r.detectSubjectType,this.j=r.detectSubjectType||Ft,this.v(e)}get rules(){return this.m}detectSubjectType(e){return ie(e)?e:e?this.j(e):this.A}update(e){let r={rules:e,ability:this,target:this};return this._("update",r),this.m=e,this.v(e),this._("updated",r),this}v(e){let r=new Map,n;for(let s=e.length-1;s>=0;s--){let o=e.length-s-1,i=new Ye(e[s],this.p,o),a=Ve(i.action),l=Ve(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let u=0;u<l.length;u++){let c=oe(r,l[u],$t);n===void 0&&(n=typeof l[u]),typeof l[u]!==n&&n!=="mixed"&&(n="mixed");for(let p=0;p<a.length;p++)oe(c,a[p],At).rules.push(i)}}if(this.l=r,n!=="mixed"&&!this.M){let s=wt[n]||wt.string;this.j=s}}possibleRulesFor(e,r=this.A){if(!ie(r))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=oe(this.l,r,$t),s=oe(n,e,At);if(s.merged)return s.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=jt(s.rules,o);return r!==this.A&&(i=jt(i,this.possibleRulesFor(e,this.A))),s.rules=i,s.merged=!0,i}rulesFor(e,r,n){let s=this.possibleRulesFor(e,r);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?Ir(s,o=>o.matchesField(n)):s}actionsFor(e){if(!ie(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let r=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>r.add(o));let s=e!==this.A?this.l.get(this.A):void 0;return s&&Array.from(s.keys()).forEach(o=>r.add(o)),Array.from(r)}on(e,r){this.F=this.F||new Map;let n=this.F,s=n.get(e)||null,o=Fr(r,s);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),Mr(o)}}_(e,r){if(!this.F)return;let n=this.F.get(e)||null,s=[];for(;n!==null;)s.push(n.value),n=n.prev;for(let o=0;o<s.length;o++)s[o](r)}},Ke=class extends Je{can(e,r,n){let s=this.relevantRuleFor(e,r,n);return!!s&&!s.inverted}relevantRuleFor(e,r,n){let s=this.detectSubjectType(r),o=this.rulesFor(e,s,n);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(r))return o[i];return null}cannot(e,r,n){return!this.can(e,r,n)}},Cr={$eq:ee,$ne:Ee,$lt:Ae,$lte:$e,$gt:V,$gte:X,$in:z,$nin:we,$all:ve,$size:Oe,$regex:Ie,$options:Ne,$elemMatch:xe,$exists:je},Sr={eq:re,ne:Re,lt:De,lte:ke,gt:Pe,gte:Te,in:Y,nin:Be,all:Ge,size:qe,regex:Le,elemMatch:ze,exists:Ue,and:_e};var _r=se(Cr,Sr),Rr=/[-/\\^$+?.()|[\]{}]/g,kr=/\.?\*+\.?/g,Dr=/\*+/,Pr=/\./g;function Tr(t,e,r){let n=r[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",s=t.indexOf("**")===-1?"[^.]":".",o=t.replace(Pr,"\\$&").replace(Dr,s+n);return e+t.length===r.length?`(?:${o})?`:o}function Ur(t,e,r){return t==="."&&(r[e-1]==="*"||r[e+1]==="*")?t:`\\${t}`}function qr(t){let e=t.map(n=>n.replace(Rr,Ur).replace(kr,Tr)),r=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${r}$`)}var Lr=t=>{let e;return r=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:qr(t)),e===null?t.indexOf(r)!==-1:e.test(r))};function Mt(t=[],e={}){return new Ke(t,Object.assign({conditionsMatcher:_r,fieldMatcher:Lr},e))}var Br=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,Ct=function(e){this.message=e};Ct.prototype=Object.create(Error.prototype);var Ze=class extends Ct{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,r,n){let s=this.unlessCan(e,r,n);if(s)throw s}unlessCan(e,r,n){let s=this.ability.relevantRuleFor(e,r,n);if(s&&!s.inverted)return;this.action=e,this.subject=r,this.subjectType=$r(this.ability.detectSubjectType(r)),this.field=n;let o=s?s.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};Ze.P=Br;var $n=Object.freeze({__proto__:null});function He(t,e,r){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let s=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return s==null&&(r.unresolved=!0),s}if(Array.isArray(t))return t.map(n=>He(n,e,r));if(typeof t=="object"){let n={};for(let s of Object.keys(t))n[s]=He(t[s],e,r);return n}return t}function ae(t,e){let r={unresolved:!1};return{conditions:He(t,e,r),unresolved:r.unresolved}}function St(t,e){return ae(t,e).conditions}function k(t,e){let r=P(t,e),n=[];for(let s of e.rules){if(r.indexOf(s.subject)===-1)continue;let o={action:s.actions,subject:s.resource};if(s.where){let{conditions:i,unresolved:a}=ae(s.where,t);if(a)continue;o.conditions=i}n.push(o)}return n}function Qe(t){return Mt(Array.isArray(t)?t:[])}function ce(t,e){return Qe(k(t,e))}function w(t,e,r,n){return n==null?t.can(e,r):t.can(e,It(r,Object.assign({},n)))}var v={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},_t={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Gr(t){let e=[];for(let r of Object.keys(t)){let n=t[r];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:r,op:"eq",value:n});continue}let s=Object.keys(n);if(s.length!==1||!_t[s[0]])return null;e.push({field:r,op:_t[s[0]],value:n[s[0]]})}return e}var zr=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Vr=(t,e)=>t==="all"||t===e;function ue(t,e,r,n){let s=k(t,e).filter(i=>zr(i.action,r)&&Vr(i.subject,n));if(s.length===0)return{scope:v.NONE,clauses:[]};if(s.some(i=>!i.conditions))return{scope:v.ALL,clauses:[]};if(s.length>1)return{scope:v.AMBIGUOUS,clauses:[]};let o=Gr(s[0].conditions);return o?{scope:v.FIELDS,clauses:o}:{scope:v.AMBIGUOUS,clauses:[]}}function le(t,e){let r=t;for(let n of e)n.op==="in"?r=r.hasSome(n.field,n.value):n.op==="nin"?r=r.not(r.hasSome(n.field,n.value)):r=r[n.op](n.field,n.value);return r}var We=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Yr=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function Xe(t){let e={},r=String(t||"");We.lastIndex=0;let n=We.exec(r);for(;n;)e[n[1]]=n[2],n=We.exec(r);return e}function et(t,e,r){let n=r||{},s=e&&e.api||{},o=Xe(t),i=String(t||""),a=[],l=[];for(let f of Object.keys(o)){let d=s[f];d?d.permission!==o[f]&&a.push({name:f,declared:d.permission,written:o[f]}):l.push({name:f,gate:o[f]})}let u=n.complete?Object.keys(s).filter(f=>!(f in o)):[],c=[];for(let[f,d]of Yr)f.test(i)&&c.push(d);return{ok:a.length+l.length+u.length+c.length===0,found:o,mismatched:a,undeclared:l,missing:u,suspect:c}}function Rt(t,e,r){let n=et(t,e,r);if(n.ok)return!0;let s=[];for(let o of n.mismatched)s.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)s.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)s.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)s.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
   `+s.join(`
-  `))}var tt="0.3.1";var rt=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function kt(t){return rt.map(e=>({action:e.action,type:e.type,object:e.object,can:v(t,e.action,e.type,e.object)}))}function Dt(t,e){let{wixUsers:r,currentMember:n}=t,s=e&&e.enrich||null,o=e&&e.onError||null;return async function(){let a=null,c=!1,l=!1;try{a=r.currentUser&&r.currentUser.id||null,c=!!(r.currentUser&&r.currentUser.loggedIn)}catch(f){l=!0,o&&o("resolveCaller.id",f)}let u=[];if(a)try{u=await n.getRoles()}catch(f){l=!0,o&&o("resolveCaller.roles",f)}let d=q({kind:a?$.MEMBER:$.VISITOR,memberId:a,roles:u,unverified:l});if(d.loggedIn=c,s)try{let f=await s(d);f&&typeof f=="object"&&(d.domain=f)}catch(f){d.unverified=!0,o&&o("resolveCaller.enrich",f)}return d}}var Yr="Admin";function Pt(t,e,r){let n=r.resolveCaller,s=r.abilityFor,o=r.audit||null;function i(c,l,u,d){return o&&o({event:"access.denied",action:c,code:l,caller:u?u.memberId:null,detail:d||null}),C(l,c)}function a(c,l,u){return l==="Anyone"?null:u.memberId?l==="Admin"&&!J(u,Yr)?i(c,O.FORBIDDEN,u,{gate:l}):null:i(c,O.UNAUTHENTICATED,u)}return function(l,u,d){let f=t.api&&t.api[l]||null;if(!f)throw new Error('wix-access: web method "'+l+'" is not declared in policy.api. Add it, or the gate it runs behind is undocumented.');let p=d||{},y=f.permission,b=f.ability||null,m=p.strip||[];return async function(...x){let g=await n();if(g.unverified)return i(l,O.UNVERIFIED,g);let F=a(l,y,g);if(F)return F;let T=x.map(A=>{if(!A||typeof A!="object"||Array.isArray(A))return A;let U=Object.assign({},A);for(let Vt of m)delete U[Vt];return U}),D=null;if(b){let[A,U]=b;if(p.load){if(D=await p.load(...T),!D)return i(l,O.NOT_FOUND,g);if(!v(s(g),A,U,D))return j(l)}else if(!v(s(g),A,U))return i(l,O.FORBIDDEN,g)}return u({principal:g,subject:D},...T)}}}function Tt(t,e){let r=Object.keys(t&&t.api||{}),n=e.filter(s=>r.indexOf(s)===-1);if(n.length)throw new Error("wix-access: web methods missing from policy.api: "+n.join(", "));return!0}var Ut=100,Jr=100;function qt(t,e,r){let{items:n,auth:s}=e,o=r.abilityFor,i={query:s.elevate(n.query),get:s.elevate(n.get),insert:s.elevate(n.insert),update:s.elevate(n.update),remove:s.elevate(n.remove)},a=u=>{let d=t.collections&&t.collections[u]||null;return d&&d.owner?d.owner:null},c=u=>{let d=t.collections&&t.collections[u]||null;return d&&d.resource||u};async function l(u,d){let f=[],p=await u.limit(Math.min(d||Ut,Ut)).find(),y=0;for(;p;){for(let b of p.items)f.push(b);if(d&&f.length>=d)return f.slice(0,d);if(!p.hasNext||!p.hasNext()||++y>=Jr)break;p=await p.next()}return f}return{async query(u,d){let{principal:f,action:p="read",limit:y}=d,b=c(u),m=ue(f,t,p,b);if(m.scope===w.NONE)return{ok:!0,data:[],scope:m.scope};let x=i.query(u);m.scope===w.FIELDS&&(x=le(x,m.clauses));let g=await l(x,m.scope===w.AMBIGUOUS?null:y);if(m.scope!==w.AMBIGUOUS)return{ok:!0,data:g,scope:m.scope};let F=o(f),T=g.filter(D=>v(F,p,b,D));return{ok:!0,data:y?T.slice(0,y):T,scope:m.scope}},async get(u,d,f){let{principal:p,action:y="read"}=f,b=c(u),m=await i.get(u,d);return m?v(o(p),y,b,m)?{ok:!0,data:m}:j(y):j(y)},async insert(u,d,f){let{principal:p,action:y="create"}=f,b=c(u),m=a(u),x=Object.assign({},d);return m&&p.memberId&&(x[m]=p.memberId),v(o(p),y,b,x)?{ok:!0,data:await i.insert(u,x)}:C(O.FORBIDDEN,y)},async update(u,d,f,p){let{principal:y,action:b="update"}=p,m=c(u),x=await i.get(u,d);if(!x)return j(b);if(!v(o(y),b,m,x))return j(b);let g=a(u),F=Object.assign({},x,f,{_id:d});return g&&(F[g]=x[g]),{ok:!0,data:await i.update(u,F)}},async remove(u,d,f){let{principal:p,action:y="delete"}=f,b=c(u),m=await i.get(u,d);return m?v(o(p),y,b,m)?{ok:!0,data:await i.remove(u,d)}:j(y):j(y)}}}function Lt(t,e,r){K(t);let n=r||{},s=Dt(e,{enrich:n.enrich,onError:n.onError}),o=c=>ce(c,t),i=Pt(t,e,{resolveCaller:s,abilityFor:o,audit:n.audit}),a=qt(t,e,{abilityFor:o});return{policy:t,resolveCaller:s,abilityFor:o,guard:i,db:a,gateFor:c=>{let l=t.api&&t.api[c]||null;return l?l.permission:null},rulesForCaller:async()=>k(await s(),t)}}function Kr(t,e){let r=e||{},n=Object.assign({wixUsers:Bt.default,currentMember:nt.currentMember,items:zt.items,auth:Gt.auth},r.deps||{});return Lt(t,n,r)}function Zr(){return{ok:!0,side:"backend",version:tt}}async function Hr(){try{let t=await nt.currentMember.getMember();return t&&t._id||null}catch{return null}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,assertDeclared,assertGates,backendMemberId,backendPing,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});
+  `))}function kt(t,e){let r=e&&e.api||{},n=t||{},s={},o=[];for(let i of Object.keys(n)){let a=n[i],l=r[i];if(!l){o.push(i);continue}if(typeof a!="function"){o.push(i+" (not a function: "+typeof a+")");continue}try{a.permission=l.permission,s[i]=l.permission}catch(u){o.push(i+" (could not stamp: "+String(u&&u.message)+")")}}if(o.length)throw new Error("wix-access: applyGates could not gate: "+o.join(", ")+". Every exported web method must be declared in policy.api.");return s}var tt="0.4.0";var rt=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function Dt(t){return rt.map(e=>({action:e.action,type:e.type,object:e.object,can:w(t,e.action,e.type,e.object)}))}function Pt(t,e){let{wixUsers:r,currentMember:n}=t,s=e&&e.enrich||null,o=e&&e.onError||null;return async function(){let a=null,l=!1,u=!1;try{a=r.currentUser&&r.currentUser.id||null,l=!!(r.currentUser&&r.currentUser.loggedIn)}catch(f){u=!0,o&&o("resolveCaller.id",f)}let c=[];if(a)try{c=await n.getRoles()}catch(f){u=!0,o&&o("resolveCaller.roles",f)}let p=L({kind:a?$.MEMBER:$.VISITOR,memberId:a,roles:c,unverified:u});if(p.loggedIn=l,s)try{let f=await s(p);f&&typeof f=="object"&&(p.domain=f)}catch(f){p.unverified=!0,o&&o("resolveCaller.enrich",f)}return p}}var Jr="Admin";function Tt(t,e,r){let n=r.resolveCaller,s=r.abilityFor,o=r.audit||null;function i(l,u,c,p){return o&&o({event:"access.denied",action:l,code:u,caller:c?c.memberId:null,detail:p||null}),C(u,l)}function a(l,u,c){return u==="Anyone"?null:c.memberId?u==="Admin"&&!K(c,Jr)?i(l,O.FORBIDDEN,c,{gate:u}):null:i(l,O.UNAUTHENTICATED,c)}return function(u,c,p){let f=t.api&&t.api[u]||null;if(!f)throw new Error('wix-access: web method "'+u+'" is not declared in policy.api. Add it, or the gate it runs behind is undocumented.');let d=p||{},y=f.permission,b=f.ability||null,m=d.strip||[];return async function(...x){let g=await n();if(g.unverified)return i(u,O.UNVERIFIED,g);let F=a(u,y,g);if(F)return F;let U=x.map(A=>{if(!A||typeof A!="object"||Array.isArray(A))return A;let q=Object.assign({},A);for(let Yt of m)delete q[Yt];return q}),D=null;if(b){let[A,q]=b;if(d.load){if(D=await d.load(...U),!D)return i(u,O.NOT_FOUND,g);if(!w(s(g),A,q,D))return j(u)}else if(!w(s(g),A,q))return i(u,O.FORBIDDEN,g)}return c({principal:g,subject:D},...U)}}}function Ut(t,e){let r=Object.keys(t&&t.api||{}),n=e.filter(s=>r.indexOf(s)===-1);if(n.length)throw new Error("wix-access: web methods missing from policy.api: "+n.join(", "));return!0}var qt=100,Kr=100;function Lt(t,e,r){let{items:n,auth:s}=e,o=r.abilityFor,i={query:(...c)=>s.elevate(n.query)(...c),get:(...c)=>s.elevate(n.get)(...c),insert:(...c)=>s.elevate(n.insert)(...c),update:(...c)=>s.elevate(n.update)(...c),remove:(...c)=>s.elevate(n.remove)(...c)},a=c=>{let p=t.collections&&t.collections[c]||null;return p&&p.owner?p.owner:null},l=c=>{let p=t.collections&&t.collections[c]||null;return p&&p.resource||c};async function u(c,p){let f=[],d=await c.limit(Math.min(p||qt,qt)).find(),y=0;for(;d;){for(let b of d.items)f.push(b);if(p&&f.length>=p)return f.slice(0,p);if(!d.hasNext||!d.hasNext()||++y>=Kr)break;d=await d.next()}return f}return{async query(c,p){let{principal:f,action:d="read",limit:y}=p,b=l(c),m=ue(f,t,d,b);if(m.scope===v.NONE)return{ok:!0,data:[],scope:m.scope};let x=i.query(c);m.scope===v.FIELDS&&(x=le(x,m.clauses));let g=await u(x,m.scope===v.AMBIGUOUS?null:y);if(m.scope!==v.AMBIGUOUS)return{ok:!0,data:g,scope:m.scope};let F=o(f),U=g.filter(D=>w(F,d,b,D));return{ok:!0,data:y?U.slice(0,y):U,scope:m.scope}},async get(c,p,f){let{principal:d,action:y="read"}=f,b=l(c),m=await i.get(c,p);return m?w(o(d),y,b,m)?{ok:!0,data:m}:j(y):j(y)},async insert(c,p,f){let{principal:d,action:y="create"}=f,b=l(c),m=a(c),x=Object.assign({},p);return m&&d.memberId&&(x[m]=d.memberId),w(o(d),y,b,x)?{ok:!0,data:await i.insert(c,x)}:C(O.FORBIDDEN,y)},async update(c,p,f,d){let{principal:y,action:b="update"}=d,m=l(c),x=await i.get(c,p);if(!x)return j(b);if(!w(o(y),b,m,x))return j(b);let g=a(c),F=Object.assign({},x,f,{_id:p});return g&&(F[g]=x[g]),{ok:!0,data:await i.update(c,F)}},async remove(c,p,f){let{principal:d,action:y="delete"}=f,b=l(c),m=await i.get(c,p);return m?w(o(d),y,b,m)?{ok:!0,data:await i.remove(c,p)}:j(y):j(y)}}}function Bt(t,e,r){Z(t);let n=r||{},s=Pt(e,{enrich:n.enrich,onError:n.onError}),o=async()=>{let u=await s();return u.subjects=P(u,t),u},i=u=>ce(u,t),a=Tt(t,e,{resolveCaller:o,abilityFor:i,audit:n.audit}),l=Lt(t,e,{abilityFor:i});return{policy:t,resolveCaller:o,abilityFor:i,guard:a,db:l,gateFor:u=>{let c=t.api&&t.api[u]||null;return c?c.permission:null},rulesForCaller:async()=>k(await o(),t)}}function Zr(t,e){let r=e||{},n=Object.assign({wixUsers:Gt.default,currentMember:nt.currentMember,items:zt.items,auth:Vt.auth},r.deps||{});return Bt(t,n,r)}function Hr(){return{ok:!0,side:"backend",version:tt}}async function Qr(){try{let t=await nt.currentMember.getMember();return t&&t._id||null}catch{return null}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,applyGates,assertDeclared,assertGates,backendMemberId,backendPing,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liquisio/wix-access",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "One authorization policy for Wix, serving the web-method gate, backend, database and page code. Built against measured platform behaviour.",
   "main": "./index.js",
   "types": "./types.d.ts",

package/public.js

@@ -1,3 +1,3 @@
-var Q=Object.defineProperty;var _t=Object.getOwnPropertyDescriptor;var Rt=Object.getOwnPropertyNames;var Pt=Object.prototype.hasOwnProperty;var Tt=(t,e)=>{for(var s in e)Q(t,s,{get:e[s],enumerable:!0})},kt=(t,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of Rt(e))!Pt.call(t,r)&&r!==s&&Q(t,r,{get:()=>e[r],enumerable:!(n=_t(e,r))||n.enumerable});return t};var Dt=t=>kt(Q({},"__esModule",{value:!0}),t);var _s={};Tt(_s,{CASES:()=>Ve,CODES:()=>E,KIND:()=>F,PACKAGE_VERSION:()=>Be,PolicyError:()=>x,SCOPE:()=>w,WHEN:()=>y,abilityFor:()=>wt,abilityFromRules:()=>N,anonymous:()=>Ke,applyClauses:()=>It,assertGates:()=>Nt,can:()=>$,caseTable:()=>Ft,createAccess:()=>St,createPrincipal:()=>ee,deny:()=>W,denyOpaque:()=>He,filterFor:()=>Et,frontendRoleTitles:()=>Cs,hasRole:()=>Qe,isDenial:()=>Ze,normaliseRoles:()=>X,ok:()=>Je,parseGates:()=>qe,permissionFor:()=>et,publicPing:()=>Ss,resolvePlaceholders:()=>$t,resolveSubjects:()=>k,resolveWhere:()=>H,rulesFor:()=>P,validatePolicy:()=>Xe,verifyGates:()=>ze});module.exports=Dt(_s);var Ct=require("wix-members-frontend");var E={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},x=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=E.INVALID_POLICY}};function Je(t){return{ok:!0,data:t===void 0?null:t}}function W(t,e,s){let n={ok:!1,code:t||E.FORBIDDEN};return e&&(n.action=e),s&&(n.detail=s),n}var Ze=t=>!!t&&t.ok===!1;function He(t){return W(E.NOT_FOUND,t)}var F={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function X(t){if(!Array.isArray(t))return[];let e=[];for(let s of t){if(typeof s=="string"){e.push(s);continue}if(!s||typeof s!="object")continue;let n=s.title||s.name||s.roleKey;n&&e.push(n)}return e}function ee(t){let e=t||{},s=e.memberId||null,n=X(e.roles);return{kind:e.kind||(s?F.MEMBER:F.VISITOR),memberId:s,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var Ke=()=>ee({kind:F.VISITOR}),Qe=(t,e)=>t.roles.indexOf(e)!==-1;var y={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},m=t=>!!t&&typeof t=="object"&&!Array.isArray(t),Ut=t=>Array.isArray(t)?t:[t];function l(t,e){throw new x("policy"+t+": "+e)}function Lt(t,e){let s=".subjects."+t;m(e)||l(s,"must be an object");let r=["when","role","domain"].filter(o=>e[o]!==void 0);if(r.length===0&&l(s,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),r.length>1&&l(s,"has "+r.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[y.ANYONE,y.ANONYMOUS,y.MEMBER];o.indexOf(e.when)===-1&&l(s+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&l(s+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&l(s+".domain","must be a string")}function qt(t,e,s){let n=".rules["+e+"]";m(t)||l(n,"must be an object"),typeof t.subject!="string"&&l(n+".subject","must be a string"),s.indexOf(t.subject)===-1&&l(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&l(n+".actions","is required");for(let r of Ut(t.actions))typeof r!="string"&&l(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&l(n+".resource","must be a string"),t.where!==void 0&&!m(t.where)&&l(n+".where","must be an object")}var We=["Anyone","SiteMember","Admin"];function zt(t,e,s){let n=".api."+t;m(e)||l(n,"must be an object"),We.indexOf(e.permission)===-1&&l(n+".permission","must be one of "+We.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&l(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&l(n+".ability","both entries must be strings")),e.subject!==void 0&&s.indexOf(e.subject)===-1&&l(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function Xe(t){if(!m(t))throw new x("policy must be an object");m(t.subjects)||l(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&l(".subjects","declares no subjects");for(let s of e)Lt(s,t.subjects[s]);if(Array.isArray(t.rules)||l(".rules","is required and must be an array"),t.rules.forEach((s,n)=>qt(s,n,e)),t.api!==void 0){m(t.api)||l(".api","must be an object");for(let s of Object.keys(t.api))zt(s,t.api[s],e)}return t.collections!==void 0&&!m(t.collections)&&l(".collections","must be an object"),t}function k(t,e){let s=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let r=e.subjects[n];(r.when===y.ANYONE||r.when===y.ANONYMOUS&&!t.memberId||r.when===y.MEMBER&&t.memberId||r.role!==void 0&&t.roles.indexOf(r.role)!==-1||r.domain!==void 0&&t.domain[r.domain])&&s.add(n)}return Array.from(s)}function et(t,e){let s=t.api&&t.api[e];return s?s.permission:null}var D=class{constructor(e,s){this.operator=e,this.value=s,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},M=class extends D{},O=class extends M{constructor(e,s){if(!Array.isArray(s))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,s)}},b="__itself__",j=class extends D{constructor(e,s,n){super(e,n),this.field=s}},re=new M("__null__",null),ne=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function Bt(t,e){return e instanceof O&&e.operator===t}function oe(t,e){return e.length===1?e[0]:new O(t,(function s(n,r,o){let i=o||[];for(let a=0,u=r.length;a<u;a++){let f=r[a];Bt(n,f)?s(n,f.value,i):i.push(f)}return i})(t,e))}var Vt=t=>t,tt=()=>Object.create(null),st=Object.defineProperty(tt(),"__@type@__",{value:"ignore value"});function Gt(t,e,s=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(ne(t,n)&&ne(e,n)&&(!s||t[n]!==st))return!0;return!1}function Yt(t){let e=[];for(let s in t)ne(t,s)&&t[s]!==st&&e.push(s);return e}function te(t,e){e!==re&&t.push(e)}var ie=t=>oe("and",t);var U={compound(t,e,s){let n=(Array.isArray(e)?e:[e]).map(r=>s.parse(r));return new O(t.name,n)},field:(t,e,s)=>new j(t.name,s.field,e),document:(t,e)=>new M(t.name,e)},S=class{constructor(e,s=tt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:s.operatorToConditionName||Vt,defaultOperatorName:s.defaultOperatorName||"eq",mergeFinalConditions:s.mergeFinalConditions||ie},this.o=Object.keys(e).reduce((n,r)=>(n[r]=Object.assign({name:this.u.operatorToConditionName(r)},e[r]),n),{}),this.s=Object.assign({},s.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>Gt(n,this.o,s.useIgnoreValue)}),this.i=Object.assign({},s.documentContext,{parse:this.parse,query:{}}),this.h=s.useIgnoreValue?Yt:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,s,n,r){let o=this.o[s];if(!o)throw new Error(`Unsupported operator "${s}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${s}" at field level`);return this.s.field=e,this.s.query=r,this.parseInstruction(o,n,this.s)}parseInstruction(e,s,n){return typeof e.validate=="function"&&e.validate(e,s),(e.parse||U[e.type])(e,s,n)}parseFieldOperators(e,s){let n=[],r=this.h(s);for(let o=0,i=r.length;o<i;o++){let a=r[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);te(n,this.parseField(e,a,s[a],s))}return n}parse(e){let s=[],n=this.h(e);this.i.query=e;for(let r=0,o=n.length;r<o;r++){let i=n[r],a=e[i],u=this.o[i];if(u){if(u.type!=="document"&&u.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in  "${u.type}" context`);te(s,this.parseInstruction(u,a,this.i))}else this.s.hasOperators(a)?s.push(...this.parseFieldOperators(i,a)):te(s,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(s)}};function se(t,e){let s=t[e];if(typeof s!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return s}function Jt(t){return t.operator}function nt(t,e){let s=e,n=s&&s.getInterpreterName||Jt,r;switch(s?s.numberOfArguments:0){case 1:r=i=>{let a=n(i,s);return se(t,a)(i,o)};break;case 3:r=(i,a,u)=>{let f=n(i,s);return se(t,f)(i,a,u,o)};break;default:r=(i,a)=>{let u=n(i,s);return se(t,u)(i,a,o)}}let o=Object.assign({},s,{interpret:r});return o.interpret}function rt(t,e){return(s,...n)=>{let r=t(s,...n),o=e.bind(null,r);return o.ast=r,o}}var qs=S.prototype.parseInstruction;function ot(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function it(t,e){if(ot(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ae=t=>(e,s)=>{if(typeof s!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},at={type:"compound",validate:it,parse(t,e,{parse:s}){let n=e.map(r=>s(r));return oe(t.name,n)}},Zt=at,Ht={type:"compound",validate:it},Kt={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,s){let n=e instanceof RegExp?new j("regex",s.field,e):s.parse(e,s);return new O(t.name,[n])}},ce={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:s,field:n,hasOperators:r}){let o=r(e)?s(e,{field:b}):s(e);return new j(t.name,n,o)}},ue={type:"field",validate:ae("number")},C={type:"field",validate:ot},le=C,fe=C,Qt={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},pe={type:"field",validate:ae("boolean")},q={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},_=q,de=_,he=_,z={type:"field"},me=z,ye={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,s){let n=typeof e=="string"?new RegExp(e,s.query.$options||""):e;return new j(t.name,s.field,n)}},be={type:"field",parse:()=>re},Wt={type:"document",validate:ae("function")},Xt=Object.freeze({__proto__:null,$and:at,$or:Zt,$nor:Ht,$not:Kt,$elemMatch:ce,$size:ue,$in:C,$nin:le,$all:fe,$mod:Qt,$exists:pe,$gte:q,$gt:_,$lt:de,$lte:he,$eq:z,$ne:me,$regex:ye,$options:be,$where:Wt}),L=class extends S{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:s=>s.slice(1)})}parse(e,s){return s&&s.field?ie(this.parseFieldOperators(s.field,e)):super.parse(e)}},B=Xt;function ge(t,e,s){for(let n=0,r=t.length;n<r;n++)if(s(t[n],e)===0)return!0;return!1}function xe(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function ct(t,e,s){if(!xe(t,e))return s(t,e);let n=[];for(let r=0;r<t.length;r++){let o=s(t[r],e);o!==void 0&&(n=n.concat(o))}return n}function v(t){return(e,s,n)=>{let r=n.get(s,e.field);return Array.isArray(r)?r.some(o=>t(e,o,n)):t(e,r,n)}}var es=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),ts=(t,e)=>t[e];function ut(t,e,s){let n=e.lastIndexOf(".");return n===-1?[t,e]:[s(t,e.slice(0,n)),e.slice(n+1)]}function ss(t,e,s=ts){if(e===b)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,r,o){if(r.indexOf(".")===-1)return ct(n,r,o);let i=r.split("."),a=n;for(let u=0,f=i.length;u<f;u++)if(a=ct(a,i[u],o),!a||typeof a!="object")return u<f-1?void 0:a;return a})(t,e,s)}function Oe(t,e){return t===e?0:t>e?1:-1}function je(t,e={}){return nt(t,Object.assign({get:ss,compare:Oe},e))}var lt=(t,e,{interpret:s})=>t.value.some(n=>s(n,e)),ns=(t,e,s)=>!lt(t,e,s),ve=(t,e,{interpret:s})=>t.value.every(n=>s(n,e)),rs=(t,e,{interpret:s})=>!s(t.value[0],e),V=(t,e,{compare:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&!Array.isArray(t.value)?ge(r,t.value,s):s(r,t.value)===0},$e=(t,e,s)=>!V(t,e,s),we=v((t,e,s)=>{let n=s.compare(e,t.value);return n===0||n===-1}),Ae=v((t,e,s)=>s.compare(e,t.value)===-1),Ee=v((t,e,s)=>s.compare(e,t.value)===1),Ie=v((t,e,s)=>{let n=s.compare(e,t.value);return n===0||n===1}),Ne=(t,e,{get:s})=>{if(t.field===b)return e!==void 0;let[n,r]=ut(e,t.field,s),o=i=>i==null?!!i===t.value:es(i,r)===t.value;return xe(n,r)?n.some(o):o(n)},os=v((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),Fe=(t,e,{get:s})=>{let[n,r]=ut(e,t.field,s),o=i=>{let a=s(i,r);return Array.isArray(a)&&a.length===t.value};return t.field!==b&&xe(n,r)?n.some(o):o(n)},Me=v((t,e)=>typeof e=="string"&&t.value.test(e)),R=v((t,e,{compare:s})=>ge(t.value,e,s)),Se=(t,e,s)=>!R(t,e,s),Ce=(t,e,{compare:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&t.value.every(o=>ge(r,o,s))},_e=(t,e,{interpret:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&r.some(o=>s(t.value,o))},is=(t,e)=>t.value.call(e),as=Object.freeze({__proto__:null,or:lt,nor:ns,and:ve,not:rs,eq:V,ne:$e,lte:we,lt:Ae,gt:Ee,gte:Ie,exists:Ne,mod:os,size:Fe,regex:Me,within:R,nin:Se,all:Ce,elemMatch:_e,where:is}),G=Object.assign({},as,{in:R}),Js=je(G);function ft(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var cs=(t,e)=>Oe(ft(t),ft(e));function Y(t,e,s){let n=new L(t),r=je(e,Object.assign({compare:cs},s));if(s&&s.forPrimitives){let o={field:b},i=n.parse;n.setParse(a=>i(a,o))}return rt(n.parse,r)}var Ws=Y(B,G),Xs=Y(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},B,{$nor:Object.assign({},B.$nor,{type:"field",parse:U.compound})})),G,{forPrimitives:!0});var bt=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Re(t){return Array.isArray(t)?t:[t]}var I="__caslSubjectType__";function gt(t,e){if(e){if(!bt(e,I))Object.defineProperty(e,I,{value:t});else if(t!==e[I])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[I]}`)}return e}var Z=t=>{let e=typeof t;return e==="string"||e==="function"},xt=t=>t.modelName||t.name;function us(t){return typeof t=="string"?t:xt(t)}function Ot(t){return bt(t,I)?t[I]:xt(t.constructor)}var pt={function:t=>t.constructor,string:Ot};function dt(t,e,s){for(let n=s;n<e.length;n++)t.push(e[n])}function ht(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let s=0,n=0,r=[];for(;s<t.length&&n<e.length;)t[s].priority<e[n].priority?(r.push(t[s]),s++):t[s].priority>e[n].priority?(r.push(e[n]),n++):(r.push(t[s]),s++,n++);return dt(r,t,s),dt(r,e,n),r}function J(t,e,s){let n=t.get(e);return n||(n=s(),t.set(e,n)),n}var ls=t=>t;function fs(t,e){let s;for(let n=0;n<t.length;n++){let r=e(t[n]);s&&r&&s.push(t[n]),r||(s??(s=t.slice(0,n)))}return s||t}function ps(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var Pe=class{constructor(e,s,n=0){ps(e,s),this.action=s.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Re(e.fields):void 0,this.priority=n,this.t=s}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||Z(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function ds(t,e){let s={value:t,prev:e,next:null};return e&&(e.next=s),s}function hs(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var mt=()=>({rules:[],merged:!1}),yt=()=>new Map,Te=class{constructor(e=[],s={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:s.conditionsMatcher,fieldMatcher:s.fieldMatcher,resolveAction:s.resolveAction||ls},this.$=s.anyAction||"manage",this.A=s.anySubjectType||"all",this.m=e,this.M=!!s.detectSubjectType,this.j=s.detectSubjectType||Ot,this.v(e)}get rules(){return this.m}detectSubjectType(e){return Z(e)?e:e?this.j(e):this.A}update(e){let s={rules:e,ability:this,target:this};return this._("update",s),this.m=e,this.v(e),this._("updated",s),this}v(e){let s=new Map,n;for(let r=e.length-1;r>=0;r--){let o=e.length-r-1,i=new Pe(e[r],this.p,o),a=Re(i.action),u=Re(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let f=0;f<u.length;f++){let h=J(s,u[f],yt);n===void 0&&(n=typeof u[f]),typeof u[f]!==n&&n!=="mixed"&&(n="mixed");for(let A=0;A<a.length;A++)J(h,a[A],mt).rules.push(i)}}if(this.l=s,n!=="mixed"&&!this.M){let r=pt[n]||pt.string;this.j=r}}possibleRulesFor(e,s=this.A){if(!Z(s))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=J(this.l,s,yt),r=J(n,e,mt);if(r.merged)return r.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=ht(r.rules,o);return s!==this.A&&(i=ht(i,this.possibleRulesFor(e,this.A))),r.rules=i,r.merged=!0,i}rulesFor(e,s,n){let r=this.possibleRulesFor(e,s);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?fs(r,o=>o.matchesField(n)):r}actionsFor(e){if(!Z(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let s=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>s.add(o));let r=e!==this.A?this.l.get(this.A):void 0;return r&&Array.from(r.keys()).forEach(o=>s.add(o)),Array.from(s)}on(e,s){this.F=this.F||new Map;let n=this.F,r=n.get(e)||null,o=ds(s,r);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),hs(o)}}_(e,s){if(!this.F)return;let n=this.F.get(e)||null,r=[];for(;n!==null;)r.push(n.value),n=n.prev;for(let o=0;o<r.length;o++)r[o](s)}},ke=class extends Te{can(e,s,n){let r=this.relevantRuleFor(e,s,n);return!!r&&!r.inverted}relevantRuleFor(e,s,n){let r=this.detectSubjectType(s),o=this.rulesFor(e,r,n);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(s))return o[i];return null}cannot(e,s,n){return!this.can(e,s,n)}},ms={$eq:z,$ne:me,$lt:de,$lte:he,$gt:_,$gte:q,$in:C,$nin:le,$all:fe,$size:ue,$regex:ye,$options:be,$elemMatch:ce,$exists:pe},ys={eq:V,ne:$e,lt:Ae,lte:we,gt:Ee,gte:Ie,in:R,nin:Se,all:Ce,size:Fe,regex:Me,elemMatch:_e,exists:Ne,and:ve};var bs=Y(ms,ys),gs=/[-/\\^$+?.()|[\]{}]/g,xs=/\.?\*+\.?/g,Os=/\*+/,js=/\./g;function vs(t,e,s){let n=s[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",r=t.indexOf("**")===-1?"[^.]":".",o=t.replace(js,"\\$&").replace(Os,r+n);return e+t.length===s.length?`(?:${o})?`:o}function $s(t,e,s){return t==="."&&(s[e-1]==="*"||s[e+1]==="*")?t:`\\${t}`}function ws(t){let e=t.map(n=>n.replace(gs,$s).replace(xs,vs)),s=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${s}$`)}var As=t=>{let e;return s=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:ws(t)),e===null?t.indexOf(s)!==-1:e.test(s))};function jt(t=[],e={}){return new ke(t,Object.assign({conditionsMatcher:bs,fieldMatcher:As},e))}var Es=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,vt=function(e){this.message=e};vt.prototype=Object.create(Error.prototype);var De=class extends vt{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,s,n){let r=this.unlessCan(e,s,n);if(r)throw r}unlessCan(e,s,n){let r=this.ability.relevantRuleFor(e,s,n);if(r&&!r.inverted)return;this.action=e,this.subject=s,this.subjectType=us(this.ability.detectSubjectType(s)),this.field=n;let o=r?r.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};De.P=Es;var on=Object.freeze({__proto__:null});function Ue(t,e,s){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let r=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return r==null&&(s.unresolved=!0),r}if(Array.isArray(t))return t.map(n=>Ue(n,e,s));if(typeof t=="object"){let n={};for(let r of Object.keys(t))n[r]=Ue(t[r],e,s);return n}return t}function H(t,e){let s={unresolved:!1};return{conditions:Ue(t,e,s),unresolved:s.unresolved}}function $t(t,e){return H(t,e).conditions}function P(t,e){let s=k(t,e),n=[];for(let r of e.rules){if(s.indexOf(r.subject)===-1)continue;let o={action:r.actions,subject:r.resource};if(r.where){let{conditions:i,unresolved:a}=H(r.where,t);if(a)continue;o.conditions=i}n.push(o)}return n}function N(t){return jt(Array.isArray(t)?t:[])}function wt(t,e){return N(P(t,e))}function $(t,e,s,n){return n==null?t.can(e,s):t.can(e,gt(s,Object.assign({},n)))}var w={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},At={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Is(t){let e=[];for(let s of Object.keys(t)){let n=t[s];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:s,op:"eq",value:n});continue}let r=Object.keys(n);if(r.length!==1||!At[r[0]])return null;e.push({field:s,op:At[r[0]],value:n[r[0]]})}return e}var Ns=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Fs=(t,e)=>t==="all"||t===e;function Et(t,e,s,n){let r=P(t,e).filter(i=>Ns(i.action,s)&&Fs(i.subject,n));if(r.length===0)return{scope:w.NONE,clauses:[]};if(r.some(i=>!i.conditions))return{scope:w.ALL,clauses:[]};if(r.length>1)return{scope:w.AMBIGUOUS,clauses:[]};let o=Is(r[0].conditions);return o?{scope:w.FIELDS,clauses:o}:{scope:w.AMBIGUOUS,clauses:[]}}function It(t,e){let s=t;for(let n of e)n.op==="in"?s=s.hasSome(n.field,n.value):n.op==="nin"?s=s.not(s.hasSome(n.field,n.value)):s=s[n.op](n.field,n.value);return s}var Le=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Ms=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function qe(t){let e={},s=String(t||"");Le.lastIndex=0;let n=Le.exec(s);for(;n;)e[n[1]]=n[2],n=Le.exec(s);return e}function ze(t,e,s){let n=s||{},r=e&&e.api||{},o=qe(t),i=String(t||""),a=[],u=[];for(let p of Object.keys(o)){let c=r[p];c?c.permission!==o[p]&&a.push({name:p,declared:c.permission,written:o[p]}):u.push({name:p,gate:o[p]})}let f=n.complete?Object.keys(r).filter(p=>!(p in o)):[],h=[];for(let[p,c]of Ms)p.test(i)&&h.push(c);return{ok:a.length+u.length+f.length+h.length===0,found:o,mismatched:a,undeclared:u,missing:f,suspect:h}}function Nt(t,e,s){let n=ze(t,e,s);if(n.ok)return!0;let r=[];for(let o of n.mismatched)r.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)r.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)r.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)r.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
+var X=Object.defineProperty;var _t=Object.getOwnPropertyDescriptor;var Pt=Object.getOwnPropertyNames;var Tt=Object.prototype.hasOwnProperty;var kt=(t,e)=>{for(var s in e)X(t,s,{get:e[s],enumerable:!0})},Dt=(t,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of Pt(e))!Tt.call(t,r)&&r!==s&&X(t,r,{get:()=>e[r],enumerable:!(n=_t(e,r))||n.enumerable});return t};var Ut=t=>Dt(X({},"__esModule",{value:!0}),t);var _s={};kt(_s,{CASES:()=>Ye,CODES:()=>E,KIND:()=>F,PACKAGE_VERSION:()=>Ge,PolicyError:()=>x,SCOPE:()=>$,WHEN:()=>y,abilityFor:()=>$t,abilityFromRules:()=>N,anonymous:()=>Ke,applyClauses:()=>It,applyGates:()=>Ft,assertGates:()=>Nt,can:()=>w,caseTable:()=>Mt,createAccess:()=>Ct,createPrincipal:()=>se,deny:()=>ee,denyOpaque:()=>He,filterFor:()=>Et,frontendRoleTitles:()=>Rs,hasRole:()=>Qe,isDenial:()=>k,normaliseRoles:()=>te,ok:()=>Ze,parseGates:()=>Be,permissionFor:()=>et,publicPing:()=>Cs,resolvePlaceholders:()=>wt,resolveSubjects:()=>D,resolveWhere:()=>K,rulesFor:()=>P,validatePolicy:()=>Xe,verifyGates:()=>Ve});module.exports=Ut(_s);var Rt=require("wix-members-frontend");var E={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},x=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=E.INVALID_POLICY}};function Ze(t){return{ok:!0,data:t===void 0?null:t}}function ee(t,e,s){let n={ok:!1,code:t||E.FORBIDDEN};return e&&(n.action=e),s&&(n.detail=s),n}var k=t=>!!t&&t.ok===!1;function He(t){return ee(E.NOT_FOUND,t)}var F={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function te(t){if(!Array.isArray(t))return[];let e=[];for(let s of t){if(typeof s=="string"){e.push(s);continue}if(!s||typeof s!="object")continue;let n=s.title||s.name||s.roleKey;n&&e.push(n)}return e}function se(t){let e=t||{},s=e.memberId||null,n=te(e.roles);return{kind:e.kind||(s?F.MEMBER:F.VISITOR),memberId:s,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var Ke=()=>se({kind:F.VISITOR}),Qe=(t,e)=>t.roles.indexOf(e)!==-1;var y={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},m=t=>!!t&&typeof t=="object"&&!Array.isArray(t),Lt=t=>Array.isArray(t)?t:[t];function f(t,e){throw new x("policy"+t+": "+e)}function qt(t,e){let s=".subjects."+t;m(e)||f(s,"must be an object");let r=["when","role","domain"].filter(o=>e[o]!==void 0);if(r.length===0&&f(s,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),r.length>1&&f(s,"has "+r.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[y.ANYONE,y.ANONYMOUS,y.MEMBER];o.indexOf(e.when)===-1&&f(s+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&f(s+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&f(s+".domain","must be a string")}function zt(t,e,s){let n=".rules["+e+"]";m(t)||f(n,"must be an object"),typeof t.subject!="string"&&f(n+".subject","must be a string"),s.indexOf(t.subject)===-1&&f(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&f(n+".actions","is required");for(let r of Lt(t.actions))typeof r!="string"&&f(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&f(n+".resource","must be a string"),t.where!==void 0&&!m(t.where)&&f(n+".where","must be an object")}var We=["Anyone","SiteMember","Admin"];function Bt(t,e,s){let n=".api."+t;m(e)||f(n,"must be an object"),We.indexOf(e.permission)===-1&&f(n+".permission","must be one of "+We.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&f(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&f(n+".ability","both entries must be strings")),e.subject!==void 0&&s.indexOf(e.subject)===-1&&f(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function Xe(t){if(!m(t))throw new x("policy must be an object");m(t.subjects)||f(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&f(".subjects","declares no subjects");for(let s of e)qt(s,t.subjects[s]);if(Array.isArray(t.rules)||f(".rules","is required and must be an array"),t.rules.forEach((s,n)=>zt(s,n,e)),t.api!==void 0){m(t.api)||f(".api","must be an object");for(let s of Object.keys(t.api))Bt(s,t.api[s],e)}return t.collections!==void 0&&!m(t.collections)&&f(".collections","must be an object"),t}function D(t,e){let s=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let r=e.subjects[n];(r.when===y.ANYONE||r.when===y.ANONYMOUS&&!t.memberId||r.when===y.MEMBER&&t.memberId||r.role!==void 0&&t.roles.indexOf(r.role)!==-1||r.domain!==void 0&&t.domain[r.domain])&&s.add(n)}return Array.from(s)}function et(t,e){let s=t.api&&t.api[e];return s?s.permission:null}var U=class{constructor(e,s){this.operator=e,this.value=s,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},M=class extends U{},O=class extends M{constructor(e,s){if(!Array.isArray(s))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,s)}},b="__itself__",j=class extends U{constructor(e,s,n){super(e,n),this.field=s}},ie=new M("__null__",null),oe=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function Vt(t,e){return e instanceof O&&e.operator===t}function ae(t,e){return e.length===1?e[0]:new O(t,(function s(n,r,o){let i=o||[];for(let a=0,u=r.length;a<u;a++){let l=r[a];Vt(n,l)?s(n,l.value,i):i.push(l)}return i})(t,e))}var Gt=t=>t,tt=()=>Object.create(null),st=Object.defineProperty(tt(),"__@type@__",{value:"ignore value"});function Yt(t,e,s=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(oe(t,n)&&oe(e,n)&&(!s||t[n]!==st))return!0;return!1}function Jt(t){let e=[];for(let s in t)oe(t,s)&&t[s]!==st&&e.push(s);return e}function ne(t,e){e!==ie&&t.push(e)}var ce=t=>ae("and",t);var L={compound(t,e,s){let n=(Array.isArray(e)?e:[e]).map(r=>s.parse(r));return new O(t.name,n)},field:(t,e,s)=>new j(t.name,s.field,e),document:(t,e)=>new M(t.name,e)},S=class{constructor(e,s=tt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:s.operatorToConditionName||Gt,defaultOperatorName:s.defaultOperatorName||"eq",mergeFinalConditions:s.mergeFinalConditions||ce},this.o=Object.keys(e).reduce((n,r)=>(n[r]=Object.assign({name:this.u.operatorToConditionName(r)},e[r]),n),{}),this.s=Object.assign({},s.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>Yt(n,this.o,s.useIgnoreValue)}),this.i=Object.assign({},s.documentContext,{parse:this.parse,query:{}}),this.h=s.useIgnoreValue?Jt:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,s,n,r){let o=this.o[s];if(!o)throw new Error(`Unsupported operator "${s}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${s}" at field level`);return this.s.field=e,this.s.query=r,this.parseInstruction(o,n,this.s)}parseInstruction(e,s,n){return typeof e.validate=="function"&&e.validate(e,s),(e.parse||L[e.type])(e,s,n)}parseFieldOperators(e,s){let n=[],r=this.h(s);for(let o=0,i=r.length;o<i;o++){let a=r[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);ne(n,this.parseField(e,a,s[a],s))}return n}parse(e){let s=[],n=this.h(e);this.i.query=e;for(let r=0,o=n.length;r<o;r++){let i=n[r],a=e[i],u=this.o[i];if(u){if(u.type!=="document"&&u.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in  "${u.type}" context`);ne(s,this.parseInstruction(u,a,this.i))}else this.s.hasOperators(a)?s.push(...this.parseFieldOperators(i,a)):ne(s,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(s)}};function re(t,e){let s=t[e];if(typeof s!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return s}function Zt(t){return t.operator}function nt(t,e){let s=e,n=s&&s.getInterpreterName||Zt,r;switch(s?s.numberOfArguments:0){case 1:r=i=>{let a=n(i,s);return re(t,a)(i,o)};break;case 3:r=(i,a,u)=>{let l=n(i,s);return re(t,l)(i,a,u,o)};break;default:r=(i,a)=>{let u=n(i,s);return re(t,u)(i,a,o)}}let o=Object.assign({},s,{interpret:r});return o.interpret}function rt(t,e){return(s,...n)=>{let r=t(s,...n),o=e.bind(null,r);return o.ast=r,o}}var zs=S.prototype.parseInstruction;function ot(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function it(t,e){if(ot(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ue=t=>(e,s)=>{if(typeof s!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},at={type:"compound",validate:it,parse(t,e,{parse:s}){let n=e.map(r=>s(r));return ae(t.name,n)}},Ht=at,Kt={type:"compound",validate:it},Qt={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,s){let n=e instanceof RegExp?new j("regex",s.field,e):s.parse(e,s);return new O(t.name,[n])}},le={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:s,field:n,hasOperators:r}){let o=r(e)?s(e,{field:b}):s(e);return new j(t.name,n,o)}},fe={type:"field",validate:ue("number")},C={type:"field",validate:ot},pe=C,de=C,Wt={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},he={type:"field",validate:ue("boolean")},z={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},R=z,me=R,ye=R,B={type:"field"},be=B,ge={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,s){let n=typeof e=="string"?new RegExp(e,s.query.$options||""):e;return new j(t.name,s.field,n)}},xe={type:"field",parse:()=>ie},Xt={type:"document",validate:ue("function")},es=Object.freeze({__proto__:null,$and:at,$or:Ht,$nor:Kt,$not:Qt,$elemMatch:le,$size:fe,$in:C,$nin:pe,$all:de,$mod:Wt,$exists:he,$gte:z,$gt:R,$lt:me,$lte:ye,$eq:B,$ne:be,$regex:ge,$options:xe,$where:Xt}),q=class extends S{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:s=>s.slice(1)})}parse(e,s){return s&&s.field?ce(this.parseFieldOperators(s.field,e)):super.parse(e)}},V=es;function Oe(t,e,s){for(let n=0,r=t.length;n<r;n++)if(s(t[n],e)===0)return!0;return!1}function je(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function ct(t,e,s){if(!je(t,e))return s(t,e);let n=[];for(let r=0;r<t.length;r++){let o=s(t[r],e);o!==void 0&&(n=n.concat(o))}return n}function v(t){return(e,s,n)=>{let r=n.get(s,e.field);return Array.isArray(r)?r.some(o=>t(e,o,n)):t(e,r,n)}}var ts=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),ss=(t,e)=>t[e];function ut(t,e,s){let n=e.lastIndexOf(".");return n===-1?[t,e]:[s(t,e.slice(0,n)),e.slice(n+1)]}function ns(t,e,s=ss){if(e===b)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,r,o){if(r.indexOf(".")===-1)return ct(n,r,o);let i=r.split("."),a=n;for(let u=0,l=i.length;u<l;u++)if(a=ct(a,i[u],o),!a||typeof a!="object")return u<l-1?void 0:a;return a})(t,e,s)}function ve(t,e){return t===e?0:t>e?1:-1}function we(t,e={}){return nt(t,Object.assign({get:ns,compare:ve},e))}var lt=(t,e,{interpret:s})=>t.value.some(n=>s(n,e)),rs=(t,e,s)=>!lt(t,e,s),$e=(t,e,{interpret:s})=>t.value.every(n=>s(n,e)),os=(t,e,{interpret:s})=>!s(t.value[0],e),G=(t,e,{compare:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&!Array.isArray(t.value)?Oe(r,t.value,s):s(r,t.value)===0},Ae=(t,e,s)=>!G(t,e,s),Ee=v((t,e,s)=>{let n=s.compare(e,t.value);return n===0||n===-1}),Ie=v((t,e,s)=>s.compare(e,t.value)===-1),Ne=v((t,e,s)=>s.compare(e,t.value)===1),Fe=v((t,e,s)=>{let n=s.compare(e,t.value);return n===0||n===1}),Me=(t,e,{get:s})=>{if(t.field===b)return e!==void 0;let[n,r]=ut(e,t.field,s),o=i=>i==null?!!i===t.value:ts(i,r)===t.value;return je(n,r)?n.some(o):o(n)},is=v((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),Se=(t,e,{get:s})=>{let[n,r]=ut(e,t.field,s),o=i=>{let a=s(i,r);return Array.isArray(a)&&a.length===t.value};return t.field!==b&&je(n,r)?n.some(o):o(n)},Ce=v((t,e)=>typeof e=="string"&&t.value.test(e)),_=v((t,e,{compare:s})=>Oe(t.value,e,s)),Re=(t,e,s)=>!_(t,e,s),_e=(t,e,{compare:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&t.value.every(o=>Oe(r,o,s))},Pe=(t,e,{interpret:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&r.some(o=>s(t.value,o))},as=(t,e)=>t.value.call(e),cs=Object.freeze({__proto__:null,or:lt,nor:rs,and:$e,not:os,eq:G,ne:Ae,lte:Ee,lt:Ie,gt:Ne,gte:Fe,exists:Me,mod:is,size:Se,regex:Ce,within:_,nin:Re,all:_e,elemMatch:Pe,where:as}),Y=Object.assign({},cs,{in:_}),Zs=we(Y);function ft(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var us=(t,e)=>ve(ft(t),ft(e));function J(t,e,s){let n=new q(t),r=we(e,Object.assign({compare:us},s));if(s&&s.forPrimitives){let o={field:b},i=n.parse;n.setParse(a=>i(a,o))}return rt(n.parse,r)}var Xs=J(V,Y),en=J(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},V,{$nor:Object.assign({},V.$nor,{type:"field",parse:L.compound})})),Y,{forPrimitives:!0});var bt=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Te(t){return Array.isArray(t)?t:[t]}var I="__caslSubjectType__";function gt(t,e){if(e){if(!bt(e,I))Object.defineProperty(e,I,{value:t});else if(t!==e[I])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[I]}`)}return e}var H=t=>{let e=typeof t;return e==="string"||e==="function"},xt=t=>t.modelName||t.name;function ls(t){return typeof t=="string"?t:xt(t)}function Ot(t){return bt(t,I)?t[I]:xt(t.constructor)}var pt={function:t=>t.constructor,string:Ot};function dt(t,e,s){for(let n=s;n<e.length;n++)t.push(e[n])}function ht(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let s=0,n=0,r=[];for(;s<t.length&&n<e.length;)t[s].priority<e[n].priority?(r.push(t[s]),s++):t[s].priority>e[n].priority?(r.push(e[n]),n++):(r.push(t[s]),s++,n++);return dt(r,t,s),dt(r,e,n),r}function Z(t,e,s){let n=t.get(e);return n||(n=s(),t.set(e,n)),n}var fs=t=>t;function ps(t,e){let s;for(let n=0;n<t.length;n++){let r=e(t[n]);s&&r&&s.push(t[n]),r||(s??(s=t.slice(0,n)))}return s||t}function ds(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var ke=class{constructor(e,s,n=0){ds(e,s),this.action=s.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Te(e.fields):void 0,this.priority=n,this.t=s}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||H(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function hs(t,e){let s={value:t,prev:e,next:null};return e&&(e.next=s),s}function ms(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var mt=()=>({rules:[],merged:!1}),yt=()=>new Map,De=class{constructor(e=[],s={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:s.conditionsMatcher,fieldMatcher:s.fieldMatcher,resolveAction:s.resolveAction||fs},this.$=s.anyAction||"manage",this.A=s.anySubjectType||"all",this.m=e,this.M=!!s.detectSubjectType,this.j=s.detectSubjectType||Ot,this.v(e)}get rules(){return this.m}detectSubjectType(e){return H(e)?e:e?this.j(e):this.A}update(e){let s={rules:e,ability:this,target:this};return this._("update",s),this.m=e,this.v(e),this._("updated",s),this}v(e){let s=new Map,n;for(let r=e.length-1;r>=0;r--){let o=e.length-r-1,i=new ke(e[r],this.p,o),a=Te(i.action),u=Te(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let l=0;l<u.length;l++){let h=Z(s,u[l],yt);n===void 0&&(n=typeof u[l]),typeof u[l]!==n&&n!=="mixed"&&(n="mixed");for(let A=0;A<a.length;A++)Z(h,a[A],mt).rules.push(i)}}if(this.l=s,n!=="mixed"&&!this.M){let r=pt[n]||pt.string;this.j=r}}possibleRulesFor(e,s=this.A){if(!H(s))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=Z(this.l,s,yt),r=Z(n,e,mt);if(r.merged)return r.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=ht(r.rules,o);return s!==this.A&&(i=ht(i,this.possibleRulesFor(e,this.A))),r.rules=i,r.merged=!0,i}rulesFor(e,s,n){let r=this.possibleRulesFor(e,s);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?ps(r,o=>o.matchesField(n)):r}actionsFor(e){if(!H(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let s=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>s.add(o));let r=e!==this.A?this.l.get(this.A):void 0;return r&&Array.from(r.keys()).forEach(o=>s.add(o)),Array.from(s)}on(e,s){this.F=this.F||new Map;let n=this.F,r=n.get(e)||null,o=hs(s,r);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),ms(o)}}_(e,s){if(!this.F)return;let n=this.F.get(e)||null,r=[];for(;n!==null;)r.push(n.value),n=n.prev;for(let o=0;o<r.length;o++)r[o](s)}},Ue=class extends De{can(e,s,n){let r=this.relevantRuleFor(e,s,n);return!!r&&!r.inverted}relevantRuleFor(e,s,n){let r=this.detectSubjectType(s),o=this.rulesFor(e,r,n);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(s))return o[i];return null}cannot(e,s,n){return!this.can(e,s,n)}},ys={$eq:B,$ne:be,$lt:me,$lte:ye,$gt:R,$gte:z,$in:C,$nin:pe,$all:de,$size:fe,$regex:ge,$options:xe,$elemMatch:le,$exists:he},bs={eq:G,ne:Ae,lt:Ie,lte:Ee,gt:Ne,gte:Fe,in:_,nin:Re,all:_e,size:Se,regex:Ce,elemMatch:Pe,exists:Me,and:$e};var gs=J(ys,bs),xs=/[-/\\^$+?.()|[\]{}]/g,Os=/\.?\*+\.?/g,js=/\*+/,vs=/\./g;function ws(t,e,s){let n=s[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",r=t.indexOf("**")===-1?"[^.]":".",o=t.replace(vs,"\\$&").replace(js,r+n);return e+t.length===s.length?`(?:${o})?`:o}function $s(t,e,s){return t==="."&&(s[e-1]==="*"||s[e+1]==="*")?t:`\\${t}`}function As(t){let e=t.map(n=>n.replace(xs,$s).replace(Os,ws)),s=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${s}$`)}var Es=t=>{let e;return s=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:As(t)),e===null?t.indexOf(s)!==-1:e.test(s))};function jt(t=[],e={}){return new Ue(t,Object.assign({conditionsMatcher:gs,fieldMatcher:Es},e))}var Is=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,vt=function(e){this.message=e};vt.prototype=Object.create(Error.prototype);var Le=class extends vt{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,s,n){let r=this.unlessCan(e,s,n);if(r)throw r}unlessCan(e,s,n){let r=this.ability.relevantRuleFor(e,s,n);if(r&&!r.inverted)return;this.action=e,this.subject=s,this.subjectType=ls(this.ability.detectSubjectType(s)),this.field=n;let o=r?r.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};Le.P=Is;var an=Object.freeze({__proto__:null});function qe(t,e,s){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let r=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return r==null&&(s.unresolved=!0),r}if(Array.isArray(t))return t.map(n=>qe(n,e,s));if(typeof t=="object"){let n={};for(let r of Object.keys(t))n[r]=qe(t[r],e,s);return n}return t}function K(t,e){let s={unresolved:!1};return{conditions:qe(t,e,s),unresolved:s.unresolved}}function wt(t,e){return K(t,e).conditions}function P(t,e){let s=D(t,e),n=[];for(let r of e.rules){if(s.indexOf(r.subject)===-1)continue;let o={action:r.actions,subject:r.resource};if(r.where){let{conditions:i,unresolved:a}=K(r.where,t);if(a)continue;o.conditions=i}n.push(o)}return n}function N(t){return jt(Array.isArray(t)?t:[])}function $t(t,e){return N(P(t,e))}function w(t,e,s,n){return n==null?t.can(e,s):t.can(e,gt(s,Object.assign({},n)))}var $={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},At={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Ns(t){let e=[];for(let s of Object.keys(t)){let n=t[s];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:s,op:"eq",value:n});continue}let r=Object.keys(n);if(r.length!==1||!At[r[0]])return null;e.push({field:s,op:At[r[0]],value:n[r[0]]})}return e}var Fs=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Ms=(t,e)=>t==="all"||t===e;function Et(t,e,s,n){let r=P(t,e).filter(i=>Fs(i.action,s)&&Ms(i.subject,n));if(r.length===0)return{scope:$.NONE,clauses:[]};if(r.some(i=>!i.conditions))return{scope:$.ALL,clauses:[]};if(r.length>1)return{scope:$.AMBIGUOUS,clauses:[]};let o=Ns(r[0].conditions);return o?{scope:$.FIELDS,clauses:o}:{scope:$.AMBIGUOUS,clauses:[]}}function It(t,e){let s=t;for(let n of e)n.op==="in"?s=s.hasSome(n.field,n.value):n.op==="nin"?s=s.not(s.hasSome(n.field,n.value)):s=s[n.op](n.field,n.value);return s}var ze=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Ss=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function Be(t){let e={},s=String(t||"");ze.lastIndex=0;let n=ze.exec(s);for(;n;)e[n[1]]=n[2],n=ze.exec(s);return e}function Ve(t,e,s){let n=s||{},r=e&&e.api||{},o=Be(t),i=String(t||""),a=[],u=[];for(let p of Object.keys(o)){let c=r[p];c?c.permission!==o[p]&&a.push({name:p,declared:c.permission,written:o[p]}):u.push({name:p,gate:o[p]})}let l=n.complete?Object.keys(r).filter(p=>!(p in o)):[],h=[];for(let[p,c]of Ss)p.test(i)&&h.push(c);return{ok:a.length+u.length+l.length+h.length===0,found:o,mismatched:a,undeclared:u,missing:l,suspect:h}}function Nt(t,e,s){let n=Ve(t,e,s);if(n.ok)return!0;let r=[];for(let o of n.mismatched)r.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)r.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)r.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)r.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
   `+r.join(`
-  `))}var Be="0.3.1";var Ve=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function Ft(t){return Ve.map(e=>({action:e.action,type:e.type,object:e.object,can:$(t,e.action,e.type,e.object)}))}var Ge=N([]),Mt="wix-access: createAccess({ fetchRules }) needs your web method, e.g. import { getMyAbilities } from 'backend/access.web'. The package cannot import it for you \u2014 that specifier only resolves inside your project. If it is imported and still not a function, build the kit inside onReady and pass an arrow: fetchRules: (...a) => getMyAbilities(...a).";function St(t){let e=t||{},s=e.fetchRules,n=e.onError||null,r=typeof s!="function",o=Ge,i=[],a=!1,u=!1,f=null,h=null;async function A(){if(r)return i=[],o=Ge,u=!0,f=Mt,a=!0,n&&n(new Error(Mt)),p;try{let c=await s();i=Array.isArray(c)?c:[],o=N(i),u=!1}catch(c){i=[],o=Ge,u=!0,f=String(c&&c.message||c),n&&n(c)}return a=!0,p}let p={ready(){return a?Promise.resolve(p):(h||(h=A().then(c=>(h=null,c))),h)},refresh(){return a=!1,u=!1,f=null,h=null,p.ready()},can:(c,d,g)=>$(o,c,d,g),cannot:(c,d,g)=>!$(o,c,d,g),rules:()=>i.slice(),get loaded(){return a},get failed(){return u},get reason(){return f},guard(c,d,g,T,K){let Ye=p.can(d,g,T);return p.apply(c,Ye,K),Ye},apply(c,d,g){if(!c)return d;let T=g||"hide";try{T==="disable"?d&&c.enable?c.enable():!d&&c.disable&&c.disable():T==="collapse"?d&&c.expand?c.expand():!d&&c.collapse&&c.collapse():d&&c.show?c.show():!d&&c.hide&&c.hide()}catch(K){n&&n(K)}return d}};return p}function Ss(){return{ok:!0,side:"public",version:Be}}async function Cs(){try{return(await Ct.currentMember.getRoles()).map(e=>e.title)}catch{return[]}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,assertGates,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,frontendRoleTitles,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,publicPing,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});
+  `))}function Ft(t,e){let s=e&&e.api||{},n=t||{},r={},o=[];for(let i of Object.keys(n)){let a=n[i],u=s[i];if(!u){o.push(i);continue}if(typeof a!="function"){o.push(i+" (not a function: "+typeof a+")");continue}try{a.permission=u.permission,r[i]=u.permission}catch(l){o.push(i+" (could not stamp: "+String(l&&l.message)+")")}}if(o.length)throw new Error("wix-access: applyGates could not gate: "+o.join(", ")+". Every exported web method must be declared in policy.api.");return r}var Ge="0.4.0";var Ye=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function Mt(t){return Ye.map(e=>({action:e.action,type:e.type,object:e.object,can:w(t,e.action,e.type,e.object)}))}var Q=N([]),St="wix-access: createAccess({ fetchRules }) needs your web method, e.g. import { getMyAbilities } from 'backend/access.web'. The package cannot import it for you \u2014 that specifier only resolves inside your project. If it is imported and still not a function, build the kit inside onReady and pass an arrow: fetchRules: (...a) => getMyAbilities(...a).";function Ct(t){let e=t||{},s=e.fetchRules,n=e.onError||null,r=typeof s!="function",o=Q,i=[],a=!1,u=!1,l=null,h=null;async function A(){if(r)return i=[],o=Q,u=!0,l=St,a=!0,n&&n(new Error(St)),p;try{let c=await s();if(k(c))return i=[],o=Q,u=!0,l="rules refused: "+(c.code||"FORBIDDEN"),a=!0,n&&n(new Error(l)),p;i=Array.isArray(c)?c:[],o=N(i),u=!1}catch(c){i=[],o=Q,u=!0,l=String(c&&c.message||c),n&&n(c)}return a=!0,p}let p={ready(){return a?Promise.resolve(p):(h||(h=A().then(c=>(h=null,c))),h)},refresh(){return a=!1,u=!1,l=null,h=null,p.ready()},can:(c,d,g)=>w(o,c,d,g),cannot:(c,d,g)=>!w(o,c,d,g),rules:()=>i.slice(),get loaded(){return a},get failed(){return u},get reason(){return l},guard(c,d,g,T,W){let Je=p.can(d,g,T);return p.apply(c,Je,W),Je},apply(c,d,g){if(!c)return d;let T=g||"hide";try{T==="disable"?d&&c.enable?c.enable():!d&&c.disable&&c.disable():T==="collapse"?d&&c.expand?c.expand():!d&&c.collapse&&c.collapse():d&&c.show?c.show():!d&&c.hide&&c.hide()}catch(W){n&&n(W)}return d}};return p}function Cs(){return{ok:!0,side:"public",version:Ge}}async function Rs(){try{return(await Rt.currentMember.getRoles()).map(e=>e.title)}catch{return[]}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,applyGates,assertGates,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,frontendRoleTitles,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,publicPing,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});