@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/sharing/access/grantee-kinds.js

@@ -0,0 +1,345 @@
+"use strict";
+// =============================================================================
+// The grantee-kind registry (PP-14.16): rung 2 of the extension contract
+// =============================================================================
+//
+// A GRANTEE KIND is a way to name who a grant shares a record with. The
+// platform ships three: `user`, `group` and `link`. They register through
+// `registerGranteeKind` exactly as an app's kind does (no private fast path),
+// and everything that used to hard-code them composes the registered kinds:
+//
+//   - `AccessPolicy` loads the caller's candidate grants with each persisted
+//     kind's `principalWhere`, then asks `matchesPrincipal` per grant;
+//   - `accessibleWhere` / `accessibleSql` ("resources I can see") join each
+//     persisted kind's `resolvePrincipalMatch` fragment with OR;
+//   - `GET /api/sharing/grantee-kinds` serves the descriptors a share dialog
+//     lists;
+//   - `POST /api/grants` runs `validateGrantee` for a grantee of an app kind.
+//
+// THE TWO REPRESENTATIONS OF "WHO THIS GRANT NAMES" MUST AGREE: `matchesPrincipal`
+// (the in-memory decision) and `resolvePrincipalMatch` (the SQL fragment of the
+// list) are two spellings of one predicate over a grant's grantee columns.
+// `describeGranteeKindConformance` (./testing) compares them over a fixture
+// matrix, so a drift between "may I open it" and "does it list" fails a test.
+//
+// PERSISTENCE (migration 0037_open_sharing_vocabularies). `grants.grantee_kind`
+// is text and `grants.grantee_ref` holds the reference of an app kind, so a kind
+// registered with `persisted: true` stores its grants: `POST /api/grants`
+// validates the grantee with the kind's `validateGrantee`, writes the kind and
+// the NORMALISED reference it returned (`grantee_ref`, the built-in grantee
+// columns stay NULL, `grants_grantee_consistency_check` is the database's
+// second line of defence), and the decision query and the list compose the
+// kind's `principalWhere` / `resolvePrincipalMatch`. A kind registered without
+// `persisted` is still listed, validated and described, and its fragments are
+// checked by the kit, but no grant row carries it (422
+// `GRANTEE_KIND_NOT_PERSISTABLE`).
+//
+// A grant whose kind is no longer registered contributes to nothing (no
+// decision, no list) and shows without a description: a row outlives the
+// registry that wrote it, and an unregistered kind names nobody.
+//
+// SECURITY. A fragment is a predicate, never a statement: every value goes
+// through the app's SQL kit as a bind parameter (`sql` template) and the grants
+// row's columns arrive as ready-made expressions (`GranteeColumns`). The
+// composing code wraps the fragments in the ONE `EXISTS` on `grants` whose
+// `g.org_id = <the caller's organization>` predicate confines the GRANTS ROW to
+// the caller's organization. That is all the slice can guarantee: a fragment
+// that reads ANOTHER table (a sub-select over a team table) is not confined by
+// it. Such a table must be reached through row-level security or by binding
+// `principal.activeOrgId` in the sub-select; `describeGranteeKindConformance`
+// checks that a sub-select binds the (distinct) organization value, not that
+// it is bound correctly.
+//
+// Identity. `matchesPrincipal` of a kind that reads `principal.email` trusts
+// that the address was verified by the identity provider.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.granteeKindRegistry = exports.GranteeInputError = exports.BUILTIN_GRANTEE_KIND_IDS = exports.GRANTEE_KIND_PERSISTENCE_AVAILABLE = void 0;
+exports.registerGranteeKind = registerGranteeKind;
+exports.findGranteeKind = findGranteeKind;
+exports.persistedGranteeKinds = persistedGranteeKinds;
+exports.granteeWhereFor = granteeWhereFor;
+exports.granteeSqlFor = granteeSqlFor;
+exports.granteeKindVia = granteeKindVia;
+exports.describeGranteeKind = describeGranteeKind;
+exports.withGroups = withGroups;
+const sharing_1 = require("@marinoscar/platform-contract/sharing");
+const index_1 = require("../../core/index");
+const ownership_1 = require("../ownership");
+/**
+ * Whether the storage layer can hold a grant of a non-built-in kind: always
+ * `true` since migration `0037_open_sharing_vocabularies` (`grants.grantee_kind`
+ * is text, `grants.grantee_ref` holds the reference). Kept so code written
+ * against the earlier "not yet" state keeps compiling.
+ *
+ * @deprecated Persistence is available; register a kind with `persisted: true`.
+ *
+ * @stability experimental
+ */
+exports.GRANTEE_KIND_PERSISTENCE_AVAILABLE = true;
+/**
+ * The ids the platform's own kinds use. They are registered at import time.
+ *
+ * @stability experimental
+ */
+exports.BUILTIN_GRANTEE_KIND_IDS = ['user', 'group', 'link'];
+/** Ids no kind may take: the wire discriminator of an app kind. */
+const RESERVED_KIND_IDS = ['custom'];
+/**
+ * The `via` values the platform's own sources use. A kind may not declare one
+ * for itself (the built-in kinds declare their own, and only their own).
+ */
+const PLATFORM_VIAS = ['owner', 'group_owner', 'user_grant', 'group_grant', 'org_default', 'bypass', 'none', 'app'];
+/** A kind `via`: snake_case WITH an underscore, so it can never equal an access rule id (rule ids are hyphenated). */
+const KIND_VIA = /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/;
+/**
+ * Thrown by {@link GranteeKindDef.validateGrantee} for an input it rejects.
+ * Its message is shown to the caller (422 `GRANTEE_INVALID`), so write it for
+ * a person; any OTHER error a kind throws is answered with a generic message,
+ * so an internal error (a database message, a stack) never reaches the caller.
+ *
+ * @stability experimental
+ */
+class GranteeInputError extends Error {
+    /** @param message - what is wrong with the grantee, safe to show. */
+    constructor(message) {
+        super(message);
+        this.name = 'GranteeInputError';
+    }
+}
+exports.GranteeInputError = GranteeInputError;
+function check(condition, kind, why) {
+    if (!condition)
+        throw new Error(`grantee kind "${kind}": ${why}`);
+}
+function validateKind(def, registry) {
+    const kind = typeof def?.kind === 'string' ? def.kind : '?';
+    check(!RESERVED_KIND_IDS.includes(kind), kind, `"${kind}" is reserved (it is the wire discriminator of an app kind)`);
+    check(typeof def.label === 'string' && def.label.trim().length > 0, kind, '`label` must be a non-empty string');
+    check(def.description === undefined || typeof def.description === 'string', kind, '`description` must be a string');
+    check(sharing_1.GRANTEE_KIND_INPUTS.includes(def.input), kind, `\`input\` must be one of ${sharing_1.GRANTEE_KIND_INPUTS.join(', ')}`);
+    check(def.via === undefined || (typeof def.via === 'string' && KIND_VIA.test(def.via)), kind, '`via` must be lower-case snake_case with an underscore (for example `team_grant`)');
+    const via = def.via ?? `${kind.replace(/-/g, '_')}_grant`;
+    const builtin = exports.BUILTIN_GRANTEE_KIND_IDS.includes(kind);
+    check(!PLATFORM_VIAS.includes(via) || (builtin && via === `${kind}_grant`), kind, `\`via\` "${via}" is one of the platform's own (${PLATFORM_VIAS.join(', ')})`);
+    check(!registry.list().some((other) => other.kind !== kind && granteeKindVia(other) === via), kind, `\`via\` "${via}" is already used by another grantee kind`);
+    for (const member of ['validateGrantee', 'describe', 'matchesPrincipal', 'resolvePrincipalMatch']) {
+        check(typeof def[member] === 'function', kind, `\`${member}\` must be a function`);
+    }
+    check(def.principalWhere === undefined || typeof def.principalWhere === 'function', kind, '`principalWhere` must be a function');
+    if (def.persisted === true) {
+        check(typeof def.principalWhere === 'function', kind, '`persisted` needs `principalWhere` (the Prisma spelling of the predicate)');
+    }
+}
+/**
+ * The grantee kinds. String ids, a duplicate-id error, registration order,
+ * frozen after bootstrap (the core registry primitive). `user`, `group` and
+ * `link` are registered when the sharing slice is imported.
+ *
+ * @stability experimental
+ */
+exports.granteeKindRegistry = (0, index_1.defineRegistry)({
+    name: 'sharing-grantee-kinds',
+    idOf: (def) => def.kind,
+    idPattern: sharing_1.GRANTEE_KIND_ID_PATTERN,
+    validate: (def, registry) => validateKind(def, registry),
+});
+/**
+ * Registers one grantee kind. Call it at import time, before the application
+ * bootstraps (an app's `app-registrations` module); register kinds before the
+ * resource types that list roles for them.
+ *
+ * @param def - the grantee kind (the object is shallow-frozen).
+ * @throws RegistryError `INVALID_ID`, `INVALID_ENTRY` (the message names the
+ *   kind and the rule), `DUPLICATE_ID` or `FROZEN` (after bootstrap).
+ *
+ * @example
+ * ```ts
+ * registerGranteeKind(emailDomainGranteeKind); // apps/api/src/platform-extensions/sharing/email-domain.grantee-kind.ts
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function registerGranteeKind(def) {
+    // Shallow-frozen: a registered definition is the app's decision at start-up, not a live object
+    // that code holding a reference can change later (this freezes the object you pass).
+    exports.granteeKindRegistry.register(Object.freeze(def));
+}
+/**
+ * The registered kind `kind`, or `undefined`.
+ *
+ * @param kind - a grantee kind id.
+ *
+ * @stability experimental
+ */
+function findGranteeKind(kind) {
+    return exports.granteeKindRegistry.get(kind);
+}
+/**
+ * The kinds whose grants are rows of the `grants` table, in registration
+ * order: what the decision query and the list SQL compose.
+ *
+ * @stability experimental
+ */
+function persistedGranteeKinds() {
+    return exports.granteeKindRegistry.list().filter((def) => def.persisted === true);
+}
+/**
+ * The Prisma `where` over `Grant` rows that names `principal` through `def`,
+ * pinned to the kind (an app kind; the built-ins pin their own): `{ AND: [{ granteeKind }, def.principalWhere(...)] }`. The
+ * pin is the platform's, not the kind's, so a kind whose `where` is too broad
+ * (empty, a bare `OR`) still cannot match another kind's rows. `null` when the
+ * kind names nobody; a kind that throws names nobody (fail closed).
+ *
+ * @param def - a persisted kind.
+ * @param principal - the caller, enriched with its groups.
+ *
+ * @stability experimental
+ */
+function granteeWhereFor(def, principal) {
+    try {
+        const where = def.principalWhere?.(principal) ?? null;
+        // The built-ins are the platform's own and already pin their kind; an app kind is pinned here.
+        return where === null || exports.BUILTIN_GRANTEE_KIND_IDS.includes(def.kind) ? where : { AND: [{ granteeKind: def.kind }, where] };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The SQL condition over a grants row that names `principal` through `def`,
+ * pinned to the kind for an app kind (`kind = '<id>' AND (<the kind's fragment>)`, the id a bind
+ * parameter), for the same reason as {@link granteeWhereFor}. `null` when the
+ * kind names nobody; a kind that throws names nobody.
+ *
+ * @param def - a persisted kind.
+ * @param principal - the caller, enriched with its groups.
+ * @param columns - the grantee columns of the row.
+ * @param kit - the app's SQL builders.
+ *
+ * @stability experimental
+ */
+function granteeSqlFor(def, principal, columns, kit) {
+    try {
+        const fragment = def.resolvePrincipalMatch(principal, columns, kit);
+        return fragment === null || exports.BUILTIN_GRANTEE_KIND_IDS.includes(def.kind) ? fragment : kit.sql `(${columns.kind} = ${def.kind} AND (${fragment}))`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What `AccessDecision.via` reports for a grant of `def`.
+ *
+ * @param def - the kind.
+ *
+ * @stability experimental
+ */
+function granteeKindVia(def) {
+    return def.via ?? `${def.kind.replace(/-/g, '_')}_grant`;
+}
+/**
+ * The descriptor `GET /api/sharing/grantee-kinds` serves for `def`.
+ *
+ * @param def - the kind.
+ *
+ * @stability experimental
+ */
+function describeGranteeKind(def) {
+    return {
+        kind: def.kind,
+        label: def.label,
+        description: def.description ?? null,
+        input: def.input,
+        builtin: exports.BUILTIN_GRANTEE_KIND_IDS.includes(def.kind),
+        persisted: def.persisted === true,
+    };
+}
+/** The principal an evaluation matches against: carries the groups the caller enriched. */
+function withGroups(principal, groups) {
+    return principal.groups === groups ? principal : { ...principal, groups };
+}
+// ---- the built-in kinds: registered through the same call --------------------------------
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function fieldOf(input, name) {
+    return input !== null && typeof input === 'object' ? input[name] : undefined;
+}
+const userKind = {
+    kind: 'user',
+    label: 'Person',
+    description: 'One member of the organization.',
+    input: 'user-search',
+    persisted: true,
+    via: 'user_grant',
+    validateGrantee(input) {
+        const userId = fieldOf(input, 'userId');
+        if (typeof userId === 'string' && UUID.test(userId))
+            return { kind: 'user', id: userId.toLowerCase() };
+        const email = fieldOf(input, 'email');
+        if (typeof email === 'string' && email.includes('@'))
+            return { kind: 'user', id: email.trim().toLowerCase() };
+        throw new GranteeInputError('A person is named by a user id or an e-mail address.');
+    },
+    async describe(ref) {
+        return { display: ref.id };
+    },
+    matchesPrincipal: (facts, principal) => facts.kind === 'user' && facts.userId !== null && facts.userId === principal.userId,
+    resolvePrincipalMatch: (principal, g, kit) => kit.sql `(${g.kind} = 'user' AND ${g.userId} = ${principal.userId}::uuid)`,
+    principalWhere: (principal) => ({ granteeKind: 'user', granteeUserId: principal.userId }),
+};
+function groupIdsOf(principal) {
+    return [...new Set((0, ownership_1.activeGroupsOf)(principal).map((group) => group.groupId))];
+}
+const groupKind = {
+    kind: 'group',
+    label: 'Group',
+    description: 'Every member of one group of the organization.',
+    input: 'group-select',
+    persisted: true,
+    via: 'group_grant',
+    validateGrantee(input) {
+        const groupId = fieldOf(input, 'groupId');
+        if (typeof groupId === 'string' && UUID.test(groupId))
+            return { kind: 'group', id: groupId.toLowerCase() };
+        throw new GranteeInputError('A group is named by its id.');
+    },
+    async describe(ref) {
+        return { display: ref.id };
+    },
+    matchesPrincipal: (facts, principal) => facts.kind === 'group' && facts.groupId !== null && groupIdsOf(principal).includes(facts.groupId),
+    resolvePrincipalMatch(principal, g, kit) {
+        const ids = groupIdsOf(principal);
+        if (ids.length === 0)
+            return null;
+        return kit.sql `(${g.kind} = 'group' AND ${g.groupId} IN (${kit.join(ids.map((id) => kit.sql `${id}::uuid`))}))`;
+    },
+    principalWhere(principal) {
+        const ids = groupIdsOf(principal);
+        return ids.length === 0 ? null : { granteeKind: 'group', granteeGroupId: { in: ids } };
+    },
+};
+// A link names whoever holds the token, never a principal: it is resolved by
+// `LinkGrantsService` from the token, so it contributes to no decision or list.
+const linkKind = {
+    kind: 'link',
+    label: 'Link',
+    description: 'Anyone holding the link, without signing in.',
+    input: 'none',
+    persisted: true,
+    via: 'link_grant',
+    validateGrantee() {
+        throw new GranteeInputError('A link is created through POST /api/grants/links, not as a grantee.');
+    },
+    async describe() {
+        return { display: 'Anyone with the link' };
+    },
+    matchesPrincipal: () => false,
+    resolvePrincipalMatch: () => null,
+    principalWhere: () => null,
+};
+for (const def of [userKind, groupKind, linkKind]) {
+    if (!exports.granteeKindRegistry.has(def.kind))
+        registerGranteeKind(def);
+}
+//# sourceMappingURL=grantee-kinds.js.map

package/dist/sharing/access/grantee-kinds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantee-kinds.js","sourceRoot":"","sources":["../../../src/sharing/access/grantee-kinds.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,iEAAiE;AACjE,6EAA6E;AAC7E,aAAa;AACb,8EAA8E;AAC9E,EAAE;AACF,mFAAmF;AACnF,gFAAgF;AAChF,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,+EAA+E;AAC/E,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,uDAAuD;AACvD,mCAAmC;AACnC,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,yEAAyE;AACzE,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,6EAA6E;AAC7E,0DAA0D;AAC1D,gFAAgF;;;AAiQhF,kDAIC;AASD,0CAEC;AAQD,sDAEC;AAcD,0CAQC;AAeD,sCAOC;AASD,wCAEC;AASD,kDASC;AAGD,gCAEC;AAtWD,mEAAwJ;AAExJ,4CAAwF;AACxF,4CAA8C;AAG9C;;;;;;;;;GASG;AACU,QAAA,kCAAkC,GAAY,IAAI,CAAC;AAEhE;;;;GAIG;AACU,QAAA,wBAAwB,GAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAErF,mEAAmE;AACnE,MAAM,iBAAiB,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAExD;;;GAGG;AACH,MAAM,aAAa,GAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEvI,sHAAsH;AACtH,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,qEAAqE;IACrE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAND,8CAMC;AAqJD,SAAS,KAAK,CAAC,SAAkB,EAAE,IAAY,EAAE,GAAW;IAC1D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB,EAAE,QAAsC;IAC/E,MAAM,IAAI,GAAG,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,6DAA6D,CAAC,CAAC;IACtH,KAAK,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,oCAAoC,CAAC,CAAC;IAChH,KAAK,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACpH,KAAK,CAAE,6BAAyC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,4BAA4B,6BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1I,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,mFAAmF,CAAC,CAAC;IACnL,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;IAC1D,MAAM,OAAO,GAAG,gCAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,GAAG,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjK,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,GAAG,2CAA2C,CAAC,CAAC;IAChK,KAAK,MAAM,MAAM,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,kBAAkB,EAAE,uBAAuB,CAAU,EAAE,CAAC;QAC3G,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,IAAI,EAAE,KAAK,MAAM,uBAAuB,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,UAAU,EAAE,IAAI,EAAE,qCAAqC,CAAC,CAAC;IACjI,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,UAAU,EAAE,IAAI,EAAE,2EAA2E,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,IAAA,sBAAc,EAAiB;IAChE,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI;IACvB,SAAS,EAAE,iCAAuB;IAClC,QAAQ,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC;CACzD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,mBAAmB,CAAC,GAAmB;IACrD,+FAA+F;IAC/F,qFAAqF;IACrF,2BAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,OAAO,2BAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB;IACnC,OAAO,2BAAmB,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,eAAe,CAAC,GAAmB,EAAE,SAAoB;IACvE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACtD,+FAA+F;QAC/F,OAAO,KAAK,KAAK,IAAI,IAAI,gCAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;IAC7H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,aAAa,CAAI,GAAmB,EAAE,SAAoB,EAAE,OAA0B,EAAE,GAAc;IACpH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAI,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,QAAQ,KAAK,IAAI,IAAI,gCAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAA,IAAI,OAAO,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,SAAS,QAAQ,IAAI,CAAC;IAClJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,GAAmB;IAChD,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,GAAmB;IACrD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,gCAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QACpD,SAAS,EAAE,GAAG,CAAC,SAAS,KAAK,IAAI;KAClC,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAgB,UAAU,CAAC,SAAoB,EAAE,MAAkC;IACjF,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,6FAA6F;AAE7F,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5G,CAAC;AAED,MAAM,QAAQ,GAAmB;IAC/B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,iCAAiC;IAC9C,KAAK,EAAE,aAAa;IACpB,SAAS,EAAE,IAAI;IACf,GAAG,EAAE,YAAY;IACjB,eAAe,CAAC,KAAK;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9G,MAAM,IAAI,iBAAiB,CAAC,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7B,CAAC;IACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;IAC3H,qBAAqB,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAA,IAAI,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,MAAM,MAAM,SAAS,CAAC,MAAM,SAAS;IACvH,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;CAC1F,CAAC;AAEF,SAAS,UAAU,CAAC,SAAoB;IACtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAA,0BAAc,EAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,SAAS,GAAmB;IAChC,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,gDAAgD;IAC7D,KAAK,EAAE,cAAc;IACrB,SAAS,EAAE,IAAI;IACf,GAAG,EAAE,aAAa;IAClB,eAAe,CAAC,KAAK;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3G,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7B,CAAC;IACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;IACzI,qBAAqB,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG;QACrC,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,GAAG,CAAC,GAAG,CAAA,IAAI,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,OAAO,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAA,GAAG,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;IACjH,CAAC;IACD,cAAc,CAAC,SAAS;QACtB,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;IACzF,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,gFAAgF;AAChF,MAAM,QAAQ,GAAmB;IAC/B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,8CAA8C;IAC3D,KAAK,EAAE,MAAM;IACb,SAAS,EAAE,IAAI;IACf,GAAG,EAAE,YAAY;IACjB,eAAe;QACb,MAAM,IAAI,iBAAiB,CAAC,qEAAqE,CAAC,CAAC;IACrG,CAAC;IACD,KAAK,CAAC,QAAQ;QACZ,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC7C,CAAC;IACD,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC7B,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI;IACjC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;CAC3B,CAAC;AAEF,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;IAClD,IAAI,CAAC,2BAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC"}

package/dist/sharing/access/resource-types.d.ts

@@ -0,0 +1,211 @@
+import { type GrantGranteeKind } from '@marinoscar/platform-contract/sharing';
+import { type ResourceOwner } from '../ownership';
+/**
+ * The app's Prisma transaction client, opaque to the slice: a resource type's
+ * callbacks receive the client of the transaction the slice opened (scoped to
+ * one organization, or the system bypass for the prune job) and cast it to
+ * their own generated type.
+ *
+ * @stability experimental
+ */
+export type PrismaTx = unknown;
+/**
+ * Who owns one record, and its organization, as `loadOwners` returns it.
+ *
+ * @stability experimental
+ */
+export interface ResourceOwnerInfo {
+    /** The owning user or group. */
+    readonly owner: ResourceOwner;
+    /** The record's organization. */
+    readonly orgId: string;
+}
+/**
+ * A record's label for notifications and "shared with me" lists.
+ *
+ * @stability experimental
+ */
+export interface ResourceDescription {
+    /** A short title (user-typed: the slice escapes it wherever it renders it). */
+    readonly title: string;
+    /** The root-relative app path of the record (`/transcripts/<id>`). */
+    readonly path?: string;
+}
+/**
+ * The grantee kinds a type's `grantable` lists roles for: the built-ins and any
+ * kind registered with `registerGranteeKind`.
+ *
+ * @stability experimental
+ */
+export type GrantableKind = GrantGranteeKind;
+/**
+ * One shareable resource type of the app.
+ *
+ * @typeParam TRole - the type's grantable roles.
+ *
+ * @stability stable
+ */
+export interface ResourceTypeDef<TRole extends string = string> {
+    /** Stable id, permanent once grants exist, e.g. `'transcript'`, `'media_item'`, `'album'`: lower-case snake_case. */
+    readonly type: string;
+    /** Grantable roles, weakest first, e.g. `['viewer', 'editor']`. `'owner'` is implicit and never grantable. */
+    readonly roles: readonly TRole[];
+    /**
+     * Minimum role per action, e.g. `{ read: 'viewer', write: 'editor', share: 'owner', delete: 'owner' }`.
+     * `share` (what the grants API checks) defaults to `'owner'` when absent.
+     */
+    readonly actions: Readonly<Record<string, TRole | 'owner'>>;
+    /** RBAC permission the principal must ALSO hold per action (kvox: `write` needs `'transcripts:write'`). */
+    readonly actionPermissions?: Readonly<Record<string, string>>;
+    /** Permission that grants an action regardless of ownership (MemoriaHub: `read` to `'media:read_any'`). */
+    readonly bypassPermissions?: Readonly<Record<string, string>>;
+    /** Who can own a record: a user, a group, or either. */
+    readonly ownership: 'user' | 'group' | 'user_or_group';
+    /**
+     * Effective role of a member of the owning group, per group role (a built-in
+     * one or any registered with `registerGroupRole`; register roles first).
+     * Default for the built-ins: `admin` gets `'owner'`, `editor` the strongest
+     * role, `viewer` the weakest. A group role this map does not name (an app
+     * role, until it is mapped here) gets NO access to the group's records.
+     */
+    readonly groupRoleMap?: Readonly<Record<string, TRole | 'owner'>>;
+    /**
+     * The organization-wide default (Salesforce's OWD). `'private'` (default):
+     * owner and grants only. `'org'`: every member of the record's organization
+     * holds `orgRole`.
+     */
+    readonly defaultVisibility?: 'private' | 'org';
+    /** The role `defaultVisibility: 'org'` gives every member of the organization. Required with `'org'`. */
+    readonly orgRole?: TRole;
+    /**
+     * Roles allowed per grantee kind. Default: `user` and `group` get every
+     * role; `link` gets none (link shares are off unless listed, #730); a
+     * persisted app kind (`registerGranteeKind`) gets none until it is listed
+     * here under its id (register kinds first).
+     */
+    readonly grantable?: {
+        /** Roles a user may be granted. */
+        readonly user?: readonly TRole[];
+        /** Roles a group may be granted. */
+        readonly group?: readonly TRole[];
+        /** Roles a link may carry (#730); none by default. */
+        readonly link?: readonly TRole[];
+        /** Roles a grantee of a registered app kind may be granted, under the kind's id. */
+        readonly [kind: string]: readonly TRole[] | undefined;
+    };
+    /** Cap on the active grants of one record. Default 500. */
+    readonly maxGrantsPerResource?: number;
+    /** How a denial surfaces. Default `'not_found'` (kvox and MemoriaHub both hide existence). */
+    readonly denyAs?: 'not_found' | 'forbidden';
+    /**
+     * Batch owner lookup: ONE query for the whole batch. Must return the owner
+     * and organization of every id that exists; a missing id is treated as not
+     * found.
+     *
+     * @param ids - the record ids (deduplicated, at most a few hundred).
+     * @param tx - the transaction the slice opened.
+     */
+    loadOwners(ids: readonly string[], tx: PrismaTx): Promise<Map<string, ResourceOwnerInfo>>;
+    /**
+     * How many records a group owns. Required when `ownership` includes
+     * `group`: it feeds the group-deletion guard of #728.
+     *
+     * @param groupId - the group about to be deleted.
+     * @param tx - the deleting transaction.
+     */
+    countOwnedByGroup?(groupId: string, tx: PrismaTx): Promise<number>;
+    /**
+     * Optional labels for notifications and "shared with me" lists.
+     *
+     * @param ids - the record ids.
+     * @param tx - the transaction the slice opened.
+     */
+    describe?(ids: readonly string[], tx: PrismaTx): Promise<Map<string, ResourceDescription>>;
+}
+/**
+ * The default cap on the active grants of one record (`maxGrantsPerResource`).
+ *
+ * @stability experimental
+ */
+export declare const DEFAULT_MAX_GRANTS_PER_RESOURCE = 500;
+/**
+ * The shareable resource types. String ids, a duplicate-id error,
+ * registration order, frozen after bootstrap (the core registry primitive).
+ *
+ * @stability experimental
+ */
+export declare const resourceTypeRegistry: import("../../core/index").Registry<ResourceTypeDef<string>>;
+/**
+ * Registers one shareable resource type. Call it at import time, before the
+ * application bootstraps (an app's `app-registrations` module).
+ *
+ * A type whose ownership includes `group` is also registered as a
+ * group-owned resource (`registerGroupOwnedResource`, #728) unless the app
+ * already did.
+ *
+ * @param def - the resource type.
+ * @throws RegistryError `INVALID_ID`, `INVALID_ENTRY` (the message names the
+ *   type and the rule), `DUPLICATE_ID` or `FROZEN` (after bootstrap).
+ *
+ * @example
+ * ```ts
+ * registerResourceType({
+ *   type: 'transcript',
+ *   roles: ['viewer', 'editor'],
+ *   actions: { read: 'viewer', write: 'editor', share: 'owner', delete: 'owner' },
+ *   actionPermissions: { write: 'transcripts:write' },
+ *   ownership: 'user',
+ *   async loadOwners(ids, tx) {
+ *     const rows = await (tx as Prisma.TransactionClient).transcript.findMany({
+ *       where: { id: { in: [...ids] } },
+ *       select: { id: true, orgId: true, ownerUserId: true },
+ *     });
+ *     return new Map(rows.map((r) => [r.id, { orgId: r.orgId, owner: { kind: 'user', userId: r.ownerUserId } }]));
+ *   },
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability stable
+ */
+export declare function registerResourceType<TRole extends string>(def: ResourceTypeDef<TRole>): void;
+/**
+ * A registered type with its defaults applied and its rules precomputed.
+ * Internal to the slice.
+ */
+export interface ResolvedResourceType {
+    readonly def: ResourceTypeDef;
+    readonly type: string;
+    readonly roles: readonly string[];
+    readonly denyAs: 'not_found' | 'forbidden';
+    readonly maxGrantsPerResource: number;
+    readonly defaultVisibility: 'private' | 'org';
+    readonly orgRole: string | null;
+    /** Rank of a role: 0 unknown, 1 the weakest, roles.length + 1 for 'owner'. */
+    rank(role: string | null | undefined): number;
+    /** The role an action needs, or `undefined` for an action the type does not declare. */
+    required(action: string): string | undefined;
+    /** The role a member of the owning group holds. */
+    groupRole(groupRole: string): string | null;
+    /** The roles grantable to a grantee kind. */
+    grantable(kind: GrantableKind): readonly string[];
+    /** The roles at or above `minRole` (owner excluded), weakest first. */
+    rolesAtLeast(minRole: string | undefined): readonly string[];
+}
+/** Applies the defaults to a registered definition (memoised per definition object). */
+export declare function resolveResourceType(def: ResourceTypeDef): ResolvedResourceType;
+/**
+ * The registered type `type`, resolved, or `undefined`.
+ *
+ * @param type - a resource type id.
+ */
+export declare function findResourceType(type: string): ResolvedResourceType | undefined;
+/**
+ * The registered type `type`, resolved. An unknown type is a PROGRAMMING
+ * error (a 500), never a 404: the code asked about a type nobody registered.
+ *
+ * @param type - a resource type id.
+ * @throws Error naming the type.
+ */
+export declare function requireResourceType(type: string): ResolvedResourceType;
+//# sourceMappingURL=resource-types.d.ts.map

package/dist/sharing/access/resource-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-types.d.ts","sourceRoot":"","sources":["../../../src/sharing/access/resource-types.ts"],"names":[],"mappings":"AA+BA,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAI1G,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9E;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,WAAW,eAAe,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IAC5D,qHAAqH;IACrH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8GAA8G;IAC9G,QAAQ,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAC5D,2GAA2G;IAC3G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,2GAA2G;IAC3G,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,eAAe,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAClE;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IAC/C,yGAAyG;IACzG,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,mCAAmC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;QACjC,oCAAoC;QACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;QAClC,sDAAsD;QACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;QACjC,oFAAoF;QACpF,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,KAAK,EAAE,GAAG,SAAS,CAAC;KACvD,CAAC;IACF,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;IAC5C;;;;;;;OAOG;IACH,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC1F;;;;;;OAMG;IACH,iBAAiB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE;;;;;OAKG;IACH,QAAQ,CAAC,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CAC5F;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAmEnD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8DAK/B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,SAAS,MAAM,EAAE,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,IAAI,CAO5F;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAAC;IAC3C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8EAA8E;IAC9E,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC;IAC9C,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C,mDAAmD;IACnD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,6CAA6C;IAC7C,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,MAAM,EAAE,CAAC;IAClD,uEAAuE;IACvE,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAAC;CAC9D;AAID,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,oBAAoB,CA2C9E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAG/E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAMtE"}