@nacre.work/core 0.0.0

package/README.md

@@ -0,0 +1,3 @@
+# @nacre.work/core
+
+Data model, permission resolver, shared types

package/dist/authz/cache.d.ts

@@ -0,0 +1,54 @@
+import type { Principal, PrincipalRef } from '../types.js';
+import { type GroupGraph } from './principals.js';
+/**
+ * The effective-principals cache.
+ *
+ * Resolving a user's transitive groups is the one query on the search path that
+ * does not depend on the search, so it is the one worth caching. It is also the
+ * one where a stale answer is a leak that lasts exactly as long as the cache
+ * entry.
+ *
+ * **The key carries `groups_version`, so staleness is impossible rather than
+ * time-bounded.** A membership change increments the version in Postgres, by
+ * trigger, and every subsequent read composes a different key — the old entry
+ * is not invalidated, it is simply never asked for again. The TTL is a memory
+ * bound, not the correctness mechanism.
+ *
+ * That distinction is invariant I4. A TTL-only cache honours a 60-second SLA
+ * on average and misses it whenever the clock is unkind; a version-keyed cache
+ * cannot serve a revoked grant at all, because the request that would have hit
+ * the stale entry is looking somewhere else.
+ */
+export interface CacheStore {
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+}
+/** For a single process, and for tests. Redis is the shared implementation. */
+export declare class MemoryCache implements CacheStore {
+    #private;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+    get size(): number;
+}
+export declare function principalsCacheKey(orgId: string, principal: Principal, groupsVersion: number): string;
+export interface CachedPrincipalsOptions {
+    readonly orgId: string;
+    readonly principal: Principal;
+    /** Read from organizations.groups_version in the same transaction as the grants. */
+    readonly groupsVersion: number;
+    readonly ttlSeconds: number;
+}
+/**
+ * Effective principals, from cache when the version matches.
+ *
+ * The graph loader is only called on a miss. Note what is *not* here: no
+ * invalidation, no deletion, no pub/sub. A version bump changes the key, and
+ * the old entry ages out on its own.
+ *
+ * A cache failure is not a permission failure — it falls through to the graph
+ * rather than denying. Reading it as a denial would turn a Redis restart into
+ * an outage, and reading it as an allow is not on the table because there is
+ * nothing to allow: the fallback computes the same answer, slower.
+ */
+export declare function cachedEffectivePrincipals(options: CachedPrincipalsOptions, cache: CacheStore, loadGraph: () => Promise<GroupGraph>): Promise<ReadonlySet<PrincipalRef>>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/authz/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../authz/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnE;AAED,+EAA+E;AAC/E,qBAAa,WAAY,YAAW,UAAU;;IAGtC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAU7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAErG;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CA2BpC"}

package/dist/authz/cache.js

@@ -0,0 +1,63 @@
+import { effectivePrincipals } from './principals.js';
+/** For a single process, and for tests. Redis is the shared implementation. */
+export class MemoryCache {
+    #entries = new Map();
+    async get(key) {
+        const entry = this.#entries.get(key);
+        if (entry === undefined)
+            return undefined;
+        if (entry.expires <= Date.now()) {
+            this.#entries.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    async set(key, value, ttlSeconds) {
+        this.#entries.set(key, { value, expires: Date.now() + ttlSeconds * 1000 });
+    }
+    get size() {
+        return this.#entries.size;
+    }
+}
+export function principalsCacheKey(orgId, principal, groupsVersion) {
+    return `acl:principals:${orgId}:${principal.type}:${principal.id}:v${groupsVersion}`;
+}
+/**
+ * Effective principals, from cache when the version matches.
+ *
+ * The graph loader is only called on a miss. Note what is *not* here: no
+ * invalidation, no deletion, no pub/sub. A version bump changes the key, and
+ * the old entry ages out on its own.
+ *
+ * A cache failure is not a permission failure — it falls through to the graph
+ * rather than denying. Reading it as a denial would turn a Redis restart into
+ * an outage, and reading it as an allow is not on the table because there is
+ * nothing to allow: the fallback computes the same answer, slower.
+ */
+export async function cachedEffectivePrincipals(options, cache, loadGraph) {
+    const key = principalsCacheKey(options.orgId, options.principal, options.groupsVersion);
+    try {
+        const hit = await cache.get(key);
+        if (hit !== undefined) {
+            const parsed = JSON.parse(hit);
+            if (Array.isArray(parsed) && parsed.every((p) => typeof p === 'string')) {
+                return new Set(parsed);
+            }
+            // Unparseable means somebody else wrote this key with a different shape.
+            // Recompute rather than guess; a malformed principal set is a wrong
+            // permission set.
+        }
+    }
+    catch {
+        // Cache unreachable. Fall through.
+    }
+    const principals = effectivePrincipals(options.principal, await loadGraph());
+    try {
+        await cache.set(key, JSON.stringify([...principals]), options.ttlSeconds);
+    }
+    catch {
+        // Writing is best effort. A cache that cannot be written is slow, not wrong.
+    }
+    return principals;
+}
+//# sourceMappingURL=cache.js.map

package/dist/authz/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../authz/cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAmB,MAAM,iBAAiB,CAAA;AA2BtE,+EAA+E;AAC/E,MAAM,OAAO,WAAW;IACb,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAA;IAEzE,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAoB,EAAE,aAAqB;IAC3F,OAAO,kBAAkB,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,aAAa,EAAE,CAAA;AACtF,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,EAChC,KAAiB,EACjB,SAAoC;IAEpC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAEvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACxE,OAAO,IAAI,GAAG,CAAC,MAAwB,CAAC,CAAA;YAC1C,CAAC;YACD,yEAAyE;YACzE,oEAAoE;YACpE,kBAAkB;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,SAAS,EAAE,CAAC,CAAA;IAE5E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/authz/filter.d.ts

@@ -0,0 +1,60 @@
+import type { AccessPlan } from './resolve.js';
+/**
+ * A Qdrant payload filter. Narrow on purpose — this module builds filters and
+ * nothing reads them back apart from the vector client.
+ */
+export interface VectorFilter {
+    readonly must: readonly FilterClause[];
+    /**
+     * At least one of these must match.
+     *
+     * That is Qdrant's meaning, not Elasticsearch's: a `should` list is a
+     * constraint, and a point that matches none of them does not pass the filter.
+     * There is no scalar `min_should` to go with it — Qdrant's `min_should` is an
+     * object, `{ conditions, min_count }`, for the "at least N" case. The filter
+     * sketch in docs/authz.md carried `min_should: 1` as an integer, which the
+     * API rejects outright; every query built from it came back 400.
+     *
+     * Never emit an empty `should`. An empty list is not "match nothing" — it is
+     * no constraint at all, so the filter degrades to `must` alone and the caller
+     * sees every point in the collection.
+     */
+    readonly should?: readonly FilterClause[];
+    readonly must_not?: readonly FilterClause[];
+}
+export type FilterClause = {
+    readonly key: string;
+    readonly match: {
+        readonly value: string | boolean;
+    };
+} | {
+    readonly key: string;
+    readonly match: {
+        readonly any: readonly string[];
+    };
+};
+/**
+ * Plans that can be turned into a query at all.
+ *
+ * `AccessPlan` includes `none`, and there is no correct filter for it — the
+ * caller must not run the query. Excluding it from this type means a caller who
+ * forgets gets a compile error rather than a filter that happens to match
+ * everything.
+ */
+export type QueryablePlan = Exclude<AccessPlan, {
+    kind: 'none';
+}>;
+/**
+ * Build the pre-filter for a search.
+ *
+ * This goes into the `filter` field of the Qdrant query, where it is applied
+ * *inside* the HNSW traversal. That is what makes `top_k` return k permitted
+ * results rather than k results with some removed afterwards — invariant I2 —
+ * and it is the reason no part of this codebase filters a result set.
+ *
+ * In a hybrid query the same filter is repeated in every prefetch branch.
+ * Omitting it from one branch is a leak, and the branches are far enough apart
+ * in the query document for that to look like a formatting difference.
+ */
+export declare function buildFilter(orgId: string, plan: QueryablePlan): VectorFilter;
+//# sourceMappingURL=filter.d.ts.map

package/dist/authz/filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../../authz/filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAA;IACtC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAC5C;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CAAE,GAC9E;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;CAAE,CAAA;AAEjF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAEjE;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,YAAY,CA2C5E"}

package/dist/authz/filter.js

@@ -0,0 +1,54 @@
+/**
+ * Build the pre-filter for a search.
+ *
+ * This goes into the `filter` field of the Qdrant query, where it is applied
+ * *inside* the HNSW traversal. That is what makes `top_k` return k permitted
+ * results rather than k results with some removed afterwards — invariant I2 —
+ * and it is the reason no part of this codebase filters a result set.
+ *
+ * In a hybrid query the same filter is repeated in every prefetch branch.
+ * Omitting it from one branch is a leak, and the branches are far enough apart
+ * in the query document for that to look like a formatting difference.
+ */
+export function buildFilter(orgId, plan) {
+    // org_id and deleted are unconditional.
+    //
+    // org_id is duplicated in the payload even when each tenant has its own
+    // collection: it is the second line of defense behind picking the right
+    // collection, and it costs one clause.
+    //
+    // deleted is invariant I5. There is a real window between a delete and the
+    // garbage collector's sweep, and a query without this clause returns
+    // documents from inside it. Depending on GC timing is how that invariant
+    // gets broken.
+    const must = [
+        { key: 'org_id', match: { value: orgId } },
+        { key: 'deleted', match: { value: false } },
+    ];
+    if (plan.kind === 'all')
+        return { must };
+    // Only non-empty lists become clauses. An empty `any` adds nothing and an
+    // empty `should` removes the constraint entirely.
+    const should = [];
+    if (plan.layers.length > 0)
+        should.push({ key: 'layer_id', match: { any: plan.layers } });
+    if (plan.extraDocs.length > 0)
+        should.push({ key: 'doc_id', match: { any: plan.extraDocs } });
+    if (should.length === 0) {
+        // A scoped plan that reaches nothing. `resolve` never produces one — it
+        // returns `kind: 'none'` instead — so arriving here means the plan was
+        // assembled by hand. Refusing is rule I3 applied to the query builder: a
+        // permission set that cannot be expressed denies, and the alternative is a
+        // filter with no `should` at all, which returns the whole collection.
+        throw new Error('refusing to build a filter from a scoped plan that reaches no layer and ' +
+            'no document — a plan like this must be kind: "none"');
+    }
+    return {
+        must,
+        should,
+        ...(plan.deniedDocs.length > 0
+            ? { must_not: [{ key: 'doc_id', match: { any: plan.deniedDocs } }] }
+            : {}),
+    };
+}
+//# sourceMappingURL=filter.js.map

package/dist/authz/filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../authz/filter.ts"],"names":[],"mappings":"AAwCA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,IAAmB;IAC5D,wCAAwC;IACxC,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,eAAe;IACf,MAAM,IAAI,GAAmB;QAC3B,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1C,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;KAC5C,CAAA;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAExC,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACzF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAE7F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,qDAAqD,CACxD,CAAA;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}

package/dist/authz/index.d.ts

@@ -0,0 +1,15 @@
+export { implied, satisfies } from './permissions.js';
+export { effectivePrincipals, MemoryGroupGraph } from './principals.js';
+export type { GroupGraph, GroupGraphData } from './principals.js';
+export { resolve } from './resolve.js';
+export type { AccessPlan, ResolveInput } from './resolve.js';
+export { referenceAllows } from './reference.js';
+export type { ReferenceInput } from './reference.js';
+export { buildFilter } from './filter.js';
+export type { FilterClause, QueryablePlan, VectorFilter } from './filter.js';
+export { ancestry, MemoryScopeTree } from './scope-tree.js';
+export type { ScopeTree, ScopeTreeData } from './scope-tree.js';
+export { aclTags, principalTag, DEFAULT_TAG_BYTES } from './tags.js';
+export { cachedEffectivePrincipals, MemoryCache, principalsCacheKey } from './cache.js';
+export type { CacheStore, CachedPrincipalsOptions } from './cache.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/authz/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACvF,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA"}

package/dist/authz/index.js

@@ -0,0 +1,9 @@
+export { implied, satisfies } from './permissions.js';
+export { effectivePrincipals, MemoryGroupGraph } from './principals.js';
+export { resolve } from './resolve.js';
+export { referenceAllows } from './reference.js';
+export { buildFilter } from './filter.js';
+export { ancestry, MemoryScopeTree } from './scope-tree.js';
+export { aclTags, principalTag, DEFAULT_TAG_BYTES } from './tags.js';
+export { cachedEffectivePrincipals, MemoryCache, principalsCacheKey } from './cache.js';
+//# sourceMappingURL=index.js.map

package/dist/authz/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE3D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/authz/permissions.d.ts

@@ -0,0 +1,20 @@
+import type { Permission } from '../types.js';
+/**
+ * The set of permissions `granted` satisfies.
+ *
+ * Returns a copy. Handing out the module's own set would let any caller widen
+ * everyone's permissions with one `add()` — a process-wide privilege
+ * escalation reachable from a typo. The sets hold at most three elements and
+ * this is not the hot path; `satisfies` is, and it never allocates.
+ */
+export declare function implied(granted: Permission): ReadonlySet<Permission>;
+/**
+ * Does holding `granted` satisfy a request for `requested`?
+ *
+ * This answers one grant against one request and nothing else. It knows
+ * nothing about scopes, inheritance, deny, or tenancy — resolve.ts composes
+ * those on top. Keeping it that narrow is what makes it cheap to state as a
+ * table and cheap to test exhaustively.
+ */
+export declare function satisfies(granted: Permission, requested: Permission): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/authz/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../authz/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAuB7C;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAEpE;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAE7E"}

package/dist/authz/permissions.js

@@ -0,0 +1,43 @@
+/**
+ * Which permissions a single granted permission satisfies.
+ *
+ * Two rules from docs/authz.md section 3.2 meet here, and they pull in
+ * opposite directions:
+ *
+ *   rule 6 — `write` does not imply `read`. A service account that only
+ *            uploads documents must not be able to search them.
+ *   rule 7 — `admin` implies `read` and `write` within its scope.
+ *
+ * The asymmetry is deliberate and is the single most common thing to get
+ * wrong here, because every other permission system in common use treats
+ * write as a superset of read. Invariant 6 exists precisely because this one
+ * does not.
+ */
+const IMPLIES = {
+    read: new Set(['read']),
+    write: new Set(['write']),
+    admin: new Set(['read', 'write', 'admin']),
+};
+/**
+ * The set of permissions `granted` satisfies.
+ *
+ * Returns a copy. Handing out the module's own set would let any caller widen
+ * everyone's permissions with one `add()` — a process-wide privilege
+ * escalation reachable from a typo. The sets hold at most three elements and
+ * this is not the hot path; `satisfies` is, and it never allocates.
+ */
+export function implied(granted) {
+    return new Set(IMPLIES[granted]);
+}
+/**
+ * Does holding `granted` satisfy a request for `requested`?
+ *
+ * This answers one grant against one request and nothing else. It knows
+ * nothing about scopes, inheritance, deny, or tenancy — resolve.ts composes
+ * those on top. Keeping it that narrow is what makes it cheap to state as a
+ * table and cheap to test exhaustively.
+ */
+export function satisfies(granted, requested) {
+    return IMPLIES[granted].has(requested);
+}
+//# sourceMappingURL=permissions.js.map

package/dist/authz/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../authz/permissions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,GAA0D;IACrE,IAAI,EAAE,IAAI,GAAG,CAAa,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,EAAE,IAAI,GAAG,CAAa,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,EAAE,IAAI,GAAG,CAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;CACvD,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,OAAmB;IACzC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAAmB,EAAE,SAAqB;IAClE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AACxC,CAAC"}

package/dist/authz/principals.d.ts

@@ -0,0 +1,34 @@
+import type { Principal, PrincipalRef } from '../types.js';
+/**
+ * Group membership for one organization. Groups nest, and the nesting is
+ * supplied by an external SCIM sync, which means it is not trusted to be
+ * acyclic — see T14.
+ */
+export interface GroupGraph {
+    /** Groups the principal is a direct member of. */
+    directGroups(principal: PrincipalRef): readonly string[];
+}
+export interface GroupGraphData {
+    /** principal ref (`user:…` or `group:…`) → group ids it belongs to */
+    readonly membership: Readonly<Record<string, readonly string[]>>;
+}
+export declare class MemoryGroupGraph implements GroupGraph {
+    #private;
+    constructor(data: GroupGraphData);
+    directGroups(principal: PrincipalRef): readonly string[];
+}
+/**
+ * The principal plus every group it belongs to, transitively.
+ *
+ * Cycles terminate. A membership graph arriving from someone else's IdP over
+ * SCIM can contain A ⊂ B ⊂ A, and the correct response is to resolve the
+ * reachable set and move on — not to throw, and certainly not to recurse until
+ * the stack gives out. An exception here would surface as a permission
+ * evaluation failure, which denies access (rule I3), so an unrelated
+ * directory-hygiene problem in a customer's IdP would read as an outage.
+ *
+ * Iterative rather than recursive for the same reason: 10 000 principals is a
+ * documented case (T15), and that is well past a comfortable stack depth.
+ */
+export declare function effectivePrincipals(principal: Principal, graph: GroupGraph): ReadonlySet<PrincipalRef>;
+//# sourceMappingURL=principals.d.ts.map

package/dist/authz/principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../../authz/principals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1D;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,kDAAkD;IAClD,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,SAAS,MAAM,EAAE,CAAA;CACzD;AAED,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;CACjE;AAED,qBAAa,gBAAiB,YAAW,UAAU;;gBAGrC,IAAI,EAAE,cAAc;IAIhC,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,SAAS,MAAM,EAAE;CAGzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,UAAU,GAChB,WAAW,CAAC,YAAY,CAAC,CAkB3B"}

package/dist/authz/principals.js

@@ -0,0 +1,42 @@
+import { principalRef } from '../types.js';
+export class MemoryGroupGraph {
+    #membership;
+    constructor(data) {
+        this.#membership = new Map(Object.entries(data.membership));
+    }
+    directGroups(principal) {
+        return this.#membership.get(principal) ?? [];
+    }
+}
+/**
+ * The principal plus every group it belongs to, transitively.
+ *
+ * Cycles terminate. A membership graph arriving from someone else's IdP over
+ * SCIM can contain A ⊂ B ⊂ A, and the correct response is to resolve the
+ * reachable set and move on — not to throw, and certainly not to recurse until
+ * the stack gives out. An exception here would surface as a permission
+ * evaluation failure, which denies access (rule I3), so an unrelated
+ * directory-hygiene problem in a customer's IdP would read as an outage.
+ *
+ * Iterative rather than recursive for the same reason: 10 000 principals is a
+ * documented case (T15), and that is well past a comfortable stack depth.
+ */
+export function effectivePrincipals(principal, graph) {
+    const self = principalRef(principal);
+    const seen = new Set([self]);
+    const queue = [self];
+    while (queue.length > 0) {
+        // Safe: the loop condition guarantees a value, but noUncheckedIndexedAccess
+        // does not know that.
+        const current = queue.pop();
+        for (const group of graph.directGroups(current)) {
+            const ref = `group:${group}`;
+            if (seen.has(ref))
+                continue;
+            seen.add(ref);
+            queue.push(ref);
+        }
+    }
+    return seen;
+}
+//# sourceMappingURL=principals.js.map

package/dist/authz/principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../../authz/principals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAiB1C,MAAM,OAAO,gBAAgB;IAClB,WAAW,CAAgC;IAEpD,YAAY,IAAoB;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;IAC7D,CAAC;IAED,YAAY,CAAC,SAAuB;QAClC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAC9C,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAoB,EACpB,KAAiB;IAEjB,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAe,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAmB,CAAC,IAAI,CAAC,CAAA;IAEpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,4EAA4E;QAC5E,sBAAsB;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAkB,CAAA;QAC3C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,MAAM,GAAG,GAAiB,SAAS,KAAK,EAAE,CAAA;YAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/authz/reference.d.ts

@@ -0,0 +1,25 @@
+import type { Grant, OrgRole, Permission, PrincipalRef, Scope } from '../types.js';
+import { type ScopeTree } from './scope-tree.js';
+/**
+ * The reference implementation: the rules of docs/authz.md 3.2, written out
+ * one at a time, for one scope at a time.
+ *
+ * **Do not optimize this file.** Its only value is being obviously correct by
+ * inspection, so that the property-based test can catch `resolve.ts` drifting
+ * away from it. An optimized reference agrees with the bug it was supposed to
+ * find, and the test goes quiet exactly when it matters.
+ *
+ * It answers one question — "may these principals do X to this one scope?" —
+ * and answers it in time proportional to the number of grants. `resolve.ts`
+ * answers a different question, "what is the whole permitted set?", which is
+ * what a pre-filter needs and what cannot be built by asking this per document.
+ */
+export interface ReferenceInput {
+    readonly orgId: string;
+    readonly role: OrgRole;
+    readonly principals: ReadonlySet<PrincipalRef>;
+    readonly grants: readonly Grant[];
+    readonly tree: ScopeTree;
+}
+export declare function referenceAllows(input: ReferenceInput, scope: Scope, permission: Permission): boolean;
+//# sourceMappingURL=reference.d.ts.map

package/dist/authz/reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference.d.ts","sourceRoot":"","sources":["../../authz/reference.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAGlF,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE1D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CACzB;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,KAAK,EACZ,UAAU,EAAE,UAAU,GACrB,OAAO,CAoCT"}

package/dist/authz/reference.js

@@ -0,0 +1,34 @@
+import { principalRef } from '../types.js';
+import { satisfies } from './permissions.js';
+import { ancestry } from './scope-tree.js';
+export function referenceAllows(input, scope, permission) {
+    const { orgId, role, principals, grants, tree } = input;
+    // Rule 2. platform_admin administers organizations and reads no documents.
+    // Checked before anything else so no later rule can grant it access.
+    if (role === 'platform_admin')
+        return false;
+    // Rule 3. org_admin holds admin on every scope in its organization,
+    // implicitly. Rule 7 then makes that cover read and write.
+    if (role === 'org_admin')
+        return true;
+    // Rule 1 is a precondition, not part of the ACL: a grant from another tenant
+    // is not weighed against anything, it is discarded.
+    const mine = grants.filter((g) => g.orgId === orgId && principals.has(principalRef(g.principal)));
+    const chain = ancestry(scope, tree);
+    const covers = (granted) => 
+    // Rule 4. A grant reaches everything nested under it, so it applies when
+    // its scope is the target or any of the target's ancestors.
+    chain.some((s) => s.type === granted.type && s.id === granted.id);
+    const applicable = mine.filter(
+    // Rules 6 and 7 live entirely in `satisfies`: write does not imply read,
+    // admin implies both.
+    (g) => covers(g.scope) && satisfies(g.permission, permission));
+    // Rule 5. Any applicable deny beats any applicable allow, at any depth. Note
+    // what this is not: it is not "the most specific scope wins". Depth is never
+    // compared, which is why the check is a plain `some` over the whole set.
+    if (applicable.some((g) => g.effect === 'deny'))
+        return false;
+    // Rule 8. Default deny — an empty set of allows is no access.
+    return applicable.some((g) => g.effect === 'allow');
+}
+//# sourceMappingURL=reference.js.map

package/dist/authz/reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference.js","sourceRoot":"","sources":["../../authz/reference.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAkB,MAAM,iBAAiB,CAAA;AAwB1D,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,KAAY,EACZ,UAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IAEvD,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAA;IAE3C,oEAAoE;IACpE,2DAA2D;IAC3D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAErC,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CACtE,CAAA;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,CAAC,OAAc,EAAW,EAAE;IACzC,yEAAyE;IACzE,4DAA4D;IAC5D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;IAEnE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;IAC5B,yEAAyE;IACzE,sBAAsB;IACtB,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAC9D,CAAA;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAE7D,8DAA8D;IAC9D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAA;AACrD,CAAC"}

package/dist/authz/resolve.d.ts

@@ -0,0 +1,45 @@
+import type { Grant, OrgRole, Permission, PrincipalRef } from '../types.js';
+import type { ScopeTree } from './scope-tree.js';
+/**
+ * What the caller may reach, in the shape a pre-filter needs.
+ *
+ * A discriminated union rather than a struct with an `all` flag, so that the
+ * "no access at all" case cannot be handed to the filter builder by accident.
+ * `buildFilter` does not accept `none`; forgetting to check is a type error
+ * rather than a query that quietly returns the whole index.
+ */
+export type AccessPlan = {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'all';
+} | {
+    readonly kind: 'scoped';
+    /** Layers the caller may reach in full. */
+    readonly layers: readonly string[];
+    /** Documents reachable outside those layers. */
+    readonly extraDocs: readonly string[];
+    /** Documents excluded even inside an allowed layer. */
+    readonly deniedDocs: readonly string[];
+};
+export interface ResolveInput {
+    readonly orgId: string;
+    readonly role: OrgRole;
+    readonly principals: ReadonlySet<PrincipalRef>;
+    /** Grants for these principals. Extra rows are tolerated and filtered here. */
+    readonly grants: readonly Grant[];
+    readonly tree: ScopeTree;
+}
+/**
+ * Turn grants into the set of things the caller may reach.
+ *
+ * Where this differs from `reference.ts`: the reference answers "may they touch
+ * this one scope?", which is the question the rules are written in. A search
+ * needs the inverse — the whole permitted set, up front, so it can go into the
+ * query as a pre-filter. Computing it by asking the reference per document
+ * would be a post-filter with extra steps.
+ *
+ * The property-based test exists because these two are different algorithms
+ * answering the same question, and only one of them is obviously correct.
+ */
+export declare function resolve(input: ResolveInput, permission: Permission): AccessPlan;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/authz/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../authz/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC,CAAA;AAEL,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,CAAA;IAC9C,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,GAAG,UAAU,CA6E/E"}