@nxgt/janus 0.1.0 → 0.1.1

package/dist/permissions/index.js.map

@@ -2,14 +2,14 @@
   "version": 3,
   "sources": ["../src/permissions/resolve.ts", "../src/permissions/input.ts", "../src/permissions/model.ts", "../src/permissions/reverse.ts", "../src/permissions/walk.ts", "../src/permissions/engine.ts"],
   "sourcesContent": [
-    "/**\n * A model, resolved: every string parsed once, every reference checked, every\n * refusal a `TypeError` naming where it is.\n *\n * The types refuse most of these first. This is what refuses them for a model\n * built at run time or written in JavaScript, and what refuses what the types\n * cannot see: names, and a permission that reaches itself without crossing a\n * relation.\n */\n\nimport type { Subject } from '../subjects/subject';\nimport type { ModelConfig } from './model';\n\n/** Who may hold a stored relation: a subject type, or a subject set. */\nexport type Holder =\n\t| { readonly kind: 'type'; readonly type: string }\n\t| { readonly kind: 'set'; readonly type: string; readonly relation: string };\n\n/**\n * Whether a stored relation admits `subject` as a holder: an entity of a\n * declared type, or a set of a declared `type#relation`. One rule for what\n * `grant()` writes and what `can()` and `list()` follow — a tuple the model\n * does not admit grants nothing, however it was stored.\n */\nexport function admits(holders: readonly Holder[], subject: Subject): boolean {\n\treturn holders.some((holder) =>\n\t\tholder.kind === 'type'\n\t\t\t? !('relation' in subject) && holder.type === subject.type\n\t\t\t: 'relation' in subject &&\n\t\t\t\tholder.type === subject.type &&\n\t\t\t\tholder.relation === subject.relation,\n\t);\n}\n\nexport type ResolvedRelation =\n\t| { readonly kind: 'stored'; readonly holders: readonly Holder[] }\n\t| {\n\t\t\treadonly kind: 'fromField';\n\t\t\treadonly field: string;\n\t\t\treadonly subject: string;\n\t\t\t/** What `list()` reverses it with. Absent: `list()` cannot reach through it. */\n\t\t\treadonly lookup?: (subjectId: string) => Promise<readonly string[]>;\n\t  };\n\n/** One rule of a permission. `test`, when present, must pass for it to grant. */\nexport type ResolvedRule = (\n\t| { readonly kind: 'name'; readonly name: string }\n\t| {\n\t\t\treadonly kind: 'arrow';\n\t\t\treadonly relation: string;\n\t\t\treadonly target: string;\n\t  }\n) & { readonly test?: (ctx: never) => boolean };\n\nexport interface ResolvedObjectType {\n\treadonly name: string;\n\treadonly relations: ReadonlyMap<string, ResolvedRelation>;\n\treadonly permissions: ReadonlyMap<string, readonly ResolvedRule[]>;\n}\n\nexport interface ResolvedModel {\n\treadonly subjects: ReadonlySet<string>;\n\treadonly types: ReadonlyMap<string, ResolvedObjectType>;\n}\n\n/** camelCase, as every name in this package — and never `#`, `-`, `>` or `:`, which the notation uses. */\nconst NAME = /^[a-z][A-Za-z0-9]*$/;\n/** A field `fromField` reads: a top-level property. */\nconst FIELD = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n\ttypeof value === 'object' && value !== null && !Array.isArray(value);\n\nexport function resolveModel(\n\tconfig: ModelConfig,\n\twhere: string,\n): ResolvedModel {\n\tconst refuse = (message: string) => new TypeError(`${where}: ${message}`);\n\n\tif (!isRecord(config)) throw refuse('pass { subjects, types }');\n\tif (!Array.isArray(config.subjects)) {\n\t\tthrow refuse(\n\t\t\t'subjects must be an array of user types — pass auth.types from janus()',\n\t\t);\n\t}\n\tfor (const subject of config.subjects) {\n\t\tif (typeof subject !== 'string' || !NAME.test(subject)) {\n\t\t\tthrow refuse(\n\t\t\t\t`the subject type \"${String(subject)}\" must be a camelCase name`,\n\t\t\t);\n\t\t}\n\t}\n\tconst subjects = new Set<string>(config.subjects);\n\n\tif (!isRecord(config.types) || Object.keys(config.types).length === 0) {\n\t\tthrow refuse('types declares no object type');\n\t}\n\tconst typeNames = new Set(Object.keys(config.types));\n\tfor (const name of typeNames) {\n\t\tif (!NAME.test(name)) {\n\t\t\tthrow refuse(\n\t\t\t\t`the object type \"${name}\" must be a camelCase name — letters and digits, starting with a lowercase letter`,\n\t\t\t);\n\t\t}\n\t\tif (subjects.has(name)) {\n\t\t\tthrow refuse(\n\t\t\t\t`\"${name}\" names a user type and an object type; a subject of type \"${name}\" would be ambiguous`,\n\t\t\t);\n\t\t}\n\t}\n\n\t// The relation names first: a subject set or an arrow may name a relation\n\t// of a type declared further down.\n\tconst relationNames = new Map<string, Set<string>>();\n\tconst permissionNames = new Map<string, Set<string>>();\n\tfor (const [name, def] of Object.entries(config.types)) {\n\t\tconst at = `types.${name}`;\n\t\tif (!isRecord(def)) throw refuse(`${at} must be an object`);\n\t\tfor (const key of Object.keys(def)) {\n\t\t\tif (key !== 'relations' && key !== 'permissions') {\n\t\t\t\tthrow refuse(`${at}.${key} is not a key of an object type`);\n\t\t\t}\n\t\t}\n\t\trelationNames.set(name, namesIn(def.relations, `${at}.relations`, refuse));\n\t\tconst permissions = namesIn(def.permissions, `${at}.permissions`, refuse);\n\t\tfor (const permission of permissions) {\n\t\t\tif (relationNames.get(name)?.has(permission)) {\n\t\t\t\tthrow refuse(\n\t\t\t\t\t`${at}: \"${permission}\" names a relation and a permission; rename one`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\tpermissionNames.set(name, permissions);\n\t}\n\n\tconst isSubjectType = (type: string) =>\n\t\tsubjects.has(type) || typeNames.has(type);\n\tconst namesOf = (type: string) =>\n\t\tnew Set([\n\t\t\t...(relationNames.get(type) ?? []),\n\t\t\t...(permissionNames.get(type) ?? []),\n\t\t]);\n\n\tconst types = new Map<string, ResolvedObjectType>();\n\tfor (const [name, def] of Object.entries(config.types)) {\n\t\tconst at = `types.${name}`;\n\t\tconst relations = new Map<string, ResolvedRelation>();\n\n\t\tfor (const [relation, holders] of Object.entries(def.relations ?? {})) {\n\t\t\tconst here = `${at}.relations.${relation}`;\n\t\t\trelations.set(\n\t\t\t\trelation,\n\t\t\t\tresolveRelation(holders, here, {\n\t\t\t\t\trefuse,\n\t\t\t\t\tisSubjectType,\n\t\t\t\t\trelationNames,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\tconst permissions = new Map<string, readonly ResolvedRule[]>();\n\t\tfor (const [permission, rules] of Object.entries(def.permissions ?? {})) {\n\t\t\tconst here = `${at}.permissions.${permission}`;\n\t\t\tif (!Array.isArray(rules) || rules.length === 0) {\n\t\t\t\tthrow refuse(`${here} must be a non-empty array of rules`);\n\t\t\t}\n\t\t\tpermissions.set(\n\t\t\t\tpermission,\n\t\t\t\trules.map((rule: unknown, index: number) =>\n\t\t\t\t\tresolveRule(rule, `${here}[${index}]`, {\n\t\t\t\t\t\trefuse,\n\t\t\t\t\t\town: namesOf(name),\n\t\t\t\t\t\trelations,\n\t\t\t\t\t\ttypeNames,\n\t\t\t\t\t\tnamesOf,\n\t\t\t\t\t\tself: name,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\n\t\ttypes.set(name, { name, relations, permissions });\n\t}\n\n\trefuseLoops(types, refuse);\n\trefuseDataBeyondRoot(types, refuse);\n\n\treturn { subjects, types };\n}\n\nfunction namesIn(\n\tvalue: unknown,\n\tat: string,\n\trefuse: (message: string) => TypeError,\n): Set<string> {\n\tif (value === undefined) return new Set();\n\tif (!isRecord(value)) throw refuse(`${at} must be an object`);\n\tfor (const name of Object.keys(value)) {\n\t\tif (!NAME.test(name)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${at}: \"${name}\" must be a camelCase name — letters and digits, starting with a lowercase letter`,\n\t\t\t);\n\t\t}\n\t}\n\treturn new Set(Object.keys(value));\n}\n\nfunction resolveRelation(\n\tvalue: unknown,\n\there: string,\n\t{\n\t\trefuse,\n\t\tisSubjectType,\n\t\trelationNames,\n\t}: {\n\t\trefuse: (message: string) => TypeError;\n\t\tisSubjectType: (type: string) => boolean;\n\t\trelationNames: ReadonlyMap<string, ReadonlySet<string>>;\n\t},\n): ResolvedRelation {\n\tif (isRecord(value) && value.kind === 'fromField') {\n\t\tconst { field, subject, lookup } = value;\n\t\tif (typeof field !== 'string' || !FIELD.test(field)) {\n\t\t\tthrow refuse(`${here}: fromField must name a top-level field`);\n\t\t}\n\t\tif (typeof subject !== 'string' || !isSubjectType(subject)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: fromField names \"${String(subject)}\", which is not a subject type`,\n\t\t\t);\n\t\t}\n\t\tif (lookup !== undefined && typeof lookup !== 'function') {\n\t\t\tthrow refuse(`${here}: fromField's lookup must be a function`);\n\t\t}\n\t\treturn lookup === undefined\n\t\t\t? { kind: 'fromField', field, subject }\n\t\t\t: {\n\t\t\t\t\tkind: 'fromField',\n\t\t\t\t\tfield,\n\t\t\t\t\tsubject,\n\t\t\t\t\tlookup: lookup as (subjectId: string) => Promise<readonly string[]>,\n\t\t\t\t};\n\t}\n\n\tif (!Array.isArray(value) || value.length === 0) {\n\t\tthrow refuse(\n\t\t\t`${here} must be a non-empty array of subject types, or fromField()`,\n\t\t);\n\t}\n\tconst holders = value.map((holder: unknown): Holder => {\n\t\tif (typeof holder !== 'string') {\n\t\t\tthrow refuse(`${here}: a holder must be a string`);\n\t\t}\n\t\tconst hash = holder.indexOf('#');\n\t\tif (hash < 0) {\n\t\t\tif (!isSubjectType(holder)) {\n\t\t\t\tthrow refuse(`${here}: \"${holder}\" is not a subject type`);\n\t\t\t}\n\t\t\treturn { kind: 'type', type: holder };\n\t\t}\n\t\tconst type = holder.slice(0, hash);\n\t\tconst relation = holder.slice(hash + 1);\n\t\tif (!relationNames.get(type)?.has(relation)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${holder}\" is not a subject set — it must name an object type and one of its relations`,\n\t\t\t);\n\t\t}\n\t\treturn { kind: 'set', type, relation };\n\t});\n\treturn { kind: 'stored', holders };\n}\n\nfunction resolveRule(\n\tvalue: unknown,\n\there: string,\n\tcontext: {\n\t\trefuse: (message: string) => TypeError;\n\t\town: ReadonlySet<string>;\n\t\trelations: ReadonlyMap<string, ResolvedRelation>;\n\t\ttypeNames: ReadonlySet<string>;\n\t\tnamesOf: (type: string) => ReadonlySet<string>;\n\t\tself: string;\n\t},\n): ResolvedRule {\n\tconst { refuse } = context;\n\n\tif (isRecord(value) && value.kind === 'when') {\n\t\tif (typeof value.test !== 'function') {\n\t\t\tthrow refuse(`${here}: when() takes a function as its test`);\n\t\t}\n\t\tconst inner = resolveRule(value.rule, here, context);\n\t\treturn { ...inner, test: value.test as (ctx: never) => boolean };\n\t}\n\tif (typeof value !== 'string') {\n\t\tthrow refuse(`${here}: a rule is a name, an arrow, or when()`);\n\t}\n\n\tconst arrow = value.indexOf('->');\n\tif (arrow < 0) {\n\t\tif (!context.own.has(value)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${value}\" is not a relation or a permission of ${context.self}`,\n\t\t\t);\n\t\t}\n\t\treturn { kind: 'name', name: value };\n\t}\n\n\tconst relation = value.slice(0, arrow);\n\tconst target = value.slice(arrow + 2);\n\tconst through = context.relations.get(relation);\n\tif (through === undefined) {\n\t\tthrow refuse(\n\t\t\t`${here}: \"${value}\" goes through \"${relation}\", which is not a relation of ${context.self}`,\n\t\t);\n\t}\n\tconst targets =\n\t\tthrough.kind === 'fromField'\n\t\t\t? [through.subject]\n\t\t\t: through.holders.map((holder) =>\n\t\t\t\t\tholder.kind === 'type' ? holder.type : null,\n\t\t\t\t);\n\tfor (const type of targets) {\n\t\t// A subject set, or a user type, has no permissions to follow.\n\t\tif (type === null || !context.typeNames.has(type)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${value}\" goes through \"${relation}\", which can hold ${type === null ? 'a subject set' : `a ${type}`}; an arrow follows object types only`,\n\t\t\t);\n\t\t}\n\t\tif (!context.namesOf(type).has(target)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${value}\" names \"${target}\", which ${type} does not declare`,\n\t\t\t);\n\t\t}\n\t}\n\treturn { kind: 'arrow', relation, target };\n}\n\n/**\n * A permission that reaches itself through names alone — `view: ['edit']`,\n * `edit: ['view']` — never reaches a relation, so no data could end the walk.\n * Refused here rather than cut at run time: it is a model's bug, not a\n * user's data.\n */\nfunction refuseLoops(\n\ttypes: ReadonlyMap<string, ResolvedObjectType>,\n\trefuse: (message: string) => TypeError,\n): void {\n\tfor (const type of types.values()) {\n\t\tconst visiting: string[] = [];\n\t\tconst done = new Set<string>();\n\n\t\tconst visit = (permission: string): void => {\n\t\t\tif (done.has(permission)) return;\n\t\t\tconst loop = visiting.indexOf(permission);\n\t\t\tif (loop >= 0) {\n\t\t\t\tthrow refuse(\n\t\t\t\t\t`types.${type.name}.permissions: ${[...visiting.slice(loop), permission].join(' → ')} is a loop no relation ends`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tvisiting.push(permission);\n\t\t\tfor (const rule of type.permissions.get(permission) ?? []) {\n\t\t\t\tif (rule.kind === 'name' && type.permissions.has(rule.name)) {\n\t\t\t\t\tvisit(rule.name);\n\t\t\t\t}\n\t\t\t}\n\t\t\tvisiting.pop();\n\t\t\tdone.add(permission);\n\t\t};\n\n\t\tfor (const permission of type.permissions.keys()) visit(permission);\n\t}\n}\n\n/**\n * A `fromField` is read from the object `can()` was given — the route loaded\n * it (decided 2026-09-24). An object reached through a subject set or an arrow\n * was loaded by nobody, so a rule that needs its data could never be decided.\n * Refused here, where it is a sentence, rather than at the first check that\n * reaches it, where it would be a denial nobody can explain.\n */\nfunction refuseDataBeyondRoot(\n\ttypes: ReadonlyMap<string, ResolvedObjectType>,\n\trefuse: (message: string) => TypeError,\n): void {\n\t/** The field `name` of `type` reads, directly or through its own rules; `null` when none. */\n\tconst fieldRead = (type: ResolvedObjectType, name: string): string | null => {\n\t\tconst relation = type.relations.get(name);\n\t\tif (relation !== undefined) {\n\t\t\treturn relation.kind === 'fromField' ? relation.field : null;\n\t\t}\n\t\tfor (const rule of type.permissions.get(name) ?? []) {\n\t\t\tconst field =\n\t\t\t\trule.kind === 'name'\n\t\t\t\t\t? fieldRead(type, rule.name)\n\t\t\t\t\t: // An arrow reads its own relation on this object.\n\t\t\t\t\t\tfieldRead(type, rule.relation);\n\t\t\tif (field !== null) return field;\n\t\t}\n\t\treturn null;\n\t};\n\n\tfor (const type of types.values()) {\n\t\tfor (const [relation, def] of type.relations) {\n\t\t\tif (def.kind !== 'stored') continue;\n\t\t\tfor (const holder of def.holders) {\n\t\t\t\tif (holder.kind !== 'set') continue;\n\t\t\t\tconst target = types.get(holder.type);\n\t\t\t\tconst field =\n\t\t\t\t\ttarget === undefined ? null : fieldRead(target, holder.relation);\n\t\t\t\tif (field !== null) {\n\t\t\t\t\tthrow refuse(\n\t\t\t\t\t\t`types.${type.name}.relations.${relation}: \"${holder.type}#${holder.relation}\" reads ${holder.type}.${field}, and a subject set reaches ${holder.type}s nobody passed to can() — store that relation instead of reading it`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfor (const [permission, rules] of type.permissions) {\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (rule.kind !== 'arrow') continue;\n\t\t\t\tconst through = type.relations.get(rule.relation);\n\t\t\t\tconst targets =\n\t\t\t\t\tthrough?.kind === 'fromField'\n\t\t\t\t\t\t? [through.subject]\n\t\t\t\t\t\t: (through?.holders ?? []).map((holder) => holder.type);\n\t\t\t\tfor (const name of targets) {\n\t\t\t\t\tconst target = types.get(name);\n\t\t\t\t\tconst field =\n\t\t\t\t\t\ttarget === undefined ? null : fieldRead(target, rule.target);\n\t\t\t\t\tif (field !== null) {\n\t\t\t\t\t\tthrow refuse(\n\t\t\t\t\t\t\t`types.${type.name}.permissions.${permission}: \"${rule.relation}->${rule.target}\" reaches ${name}.${rule.target}, which reads ${name}.${field}, and only the object passed to can() carries its data — store that relation instead of reading it`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n",
+    "/**\n * A model, resolved: every string parsed once, every reference checked, every\n * refusal a `TypeError` naming where it is.\n *\n * The types refuse most of these first. This is what refuses them for a model\n * built at run time or written in JavaScript, and what refuses what the types\n * cannot see: names, and a permission that reaches itself without crossing a\n * relation.\n */\n\nimport type { Subject } from '../subjects/subject';\nimport type { ModelConfig } from './model';\n\n/** Who may hold a stored relation: a subject type, or a subject set. */\nexport type Holder =\n\t| { readonly kind: 'type'; readonly type: string }\n\t| { readonly kind: 'set'; readonly type: string; readonly relation: string };\n\n/**\n * Whether a stored relation admits `subject` as a holder: an entity of a\n * declared type, or a set of a declared `type#relation`. One rule for what\n * `grant()` writes and what `can()` and `list()` follow — a tuple the model\n * does not admit grants nothing, however it was stored.\n */\nexport function admits(holders: readonly Holder[], subject: Subject): boolean {\n\treturn holders.some((holder) =>\n\t\tholder.kind === 'type'\n\t\t\t? !('relation' in subject) && holder.type === subject.type\n\t\t\t: 'relation' in subject &&\n\t\t\t\tholder.type === subject.type &&\n\t\t\t\tholder.relation === subject.relation,\n\t);\n}\n\nexport type ResolvedRelation =\n\t| { readonly kind: 'stored'; readonly holders: readonly Holder[] }\n\t| {\n\t\t\treadonly kind: 'fromField';\n\t\t\treadonly field: string;\n\t\t\treadonly subject: string;\n\t\t\t/** What `list()` reverses it with. Absent: `list()` cannot reach through it. */\n\t\t\treadonly lookup?: (subjectId: string) => Promise<readonly string[]>;\n\t  };\n\n/** One rule of a permission. `test`, when present, must pass for it to grant. */\nexport type ResolvedRule = (\n\t| { readonly kind: 'name'; readonly name: string }\n\t| {\n\t\t\treadonly kind: 'arrow';\n\t\t\treadonly relation: string;\n\t\t\treadonly target: string;\n\t  }\n) & { readonly test?: (ctx: never) => boolean };\n\nexport interface ResolvedObjectType {\n\treadonly name: string;\n\treadonly relations: ReadonlyMap<string, ResolvedRelation>;\n\treadonly permissions: ReadonlyMap<string, readonly ResolvedRule[]>;\n}\n\nexport interface ResolvedModel {\n\treadonly subjects: ReadonlySet<string>;\n\treadonly types: ReadonlyMap<string, ResolvedObjectType>;\n}\n\n/** camelCase, as every name in this package — and never `#`, `-`, `>` or `:`, which the notation uses. */\nconst NAME = /^[a-z][A-Za-z0-9]*$/;\n/** A field `fromField` reads: a top-level property. */\nconst FIELD = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n\ttypeof value === 'object' && value !== null && !Array.isArray(value);\n\nexport function resolveModel(\n\tconfig: ModelConfig,\n\twhere: string,\n): ResolvedModel {\n\tconst refuse = (message: string) => new TypeError(`${where}: ${message}`);\n\n\tif (!isRecord(config)) throw refuse('pass { subjects, types }');\n\tif (!Array.isArray(config.subjects)) {\n\t\tthrow refuse(\n\t\t\t'subjects must be an array of subject type names — auth.types from janus(), or your own',\n\t\t);\n\t}\n\tfor (const subject of config.subjects) {\n\t\tif (typeof subject !== 'string' || !NAME.test(subject)) {\n\t\t\tthrow refuse(\n\t\t\t\t`the subject type \"${String(subject)}\" must be a camelCase name`,\n\t\t\t);\n\t\t}\n\t}\n\tconst subjects = new Set<string>(config.subjects);\n\n\tif (!isRecord(config.types) || Object.keys(config.types).length === 0) {\n\t\tthrow refuse('types declares no object type');\n\t}\n\tconst typeNames = new Set(Object.keys(config.types));\n\tfor (const name of typeNames) {\n\t\tif (!NAME.test(name)) {\n\t\t\tthrow refuse(\n\t\t\t\t`the object type \"${name}\" must be a camelCase name — letters and digits, starting with a lowercase letter`,\n\t\t\t);\n\t\t}\n\t\tif (subjects.has(name)) {\n\t\t\tthrow refuse(\n\t\t\t\t`\"${name}\" names a user type and an object type; a subject of type \"${name}\" would be ambiguous`,\n\t\t\t);\n\t\t}\n\t}\n\n\t// The relation names first: a subject set or an arrow may name a relation\n\t// of a type declared further down.\n\tconst relationNames = new Map<string, Set<string>>();\n\tconst permissionNames = new Map<string, Set<string>>();\n\tfor (const [name, def] of Object.entries(config.types)) {\n\t\tconst at = `types.${name}`;\n\t\tif (!isRecord(def)) throw refuse(`${at} must be an object`);\n\t\tfor (const key of Object.keys(def)) {\n\t\t\tif (key !== 'relations' && key !== 'permissions') {\n\t\t\t\tthrow refuse(`${at}.${key} is not a key of an object type`);\n\t\t\t}\n\t\t}\n\t\trelationNames.set(name, namesIn(def.relations, `${at}.relations`, refuse));\n\t\tconst permissions = namesIn(def.permissions, `${at}.permissions`, refuse);\n\t\tfor (const permission of permissions) {\n\t\t\tif (relationNames.get(name)?.has(permission)) {\n\t\t\t\tthrow refuse(\n\t\t\t\t\t`${at}: \"${permission}\" names a relation and a permission; rename one`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\tpermissionNames.set(name, permissions);\n\t}\n\n\tconst isSubjectType = (type: string) =>\n\t\tsubjects.has(type) || typeNames.has(type);\n\tconst namesOf = (type: string) =>\n\t\tnew Set([\n\t\t\t...(relationNames.get(type) ?? []),\n\t\t\t...(permissionNames.get(type) ?? []),\n\t\t]);\n\n\tconst types = new Map<string, ResolvedObjectType>();\n\tfor (const [name, def] of Object.entries(config.types)) {\n\t\tconst at = `types.${name}`;\n\t\tconst relations = new Map<string, ResolvedRelation>();\n\n\t\tfor (const [relation, holders] of Object.entries(def.relations ?? {})) {\n\t\t\tconst here = `${at}.relations.${relation}`;\n\t\t\trelations.set(\n\t\t\t\trelation,\n\t\t\t\tresolveRelation(holders, here, {\n\t\t\t\t\trefuse,\n\t\t\t\t\tisSubjectType,\n\t\t\t\t\trelationNames,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\n\t\tconst permissions = new Map<string, readonly ResolvedRule[]>();\n\t\tfor (const [permission, rules] of Object.entries(def.permissions ?? {})) {\n\t\t\tconst here = `${at}.permissions.${permission}`;\n\t\t\tif (!Array.isArray(rules) || rules.length === 0) {\n\t\t\t\tthrow refuse(`${here} must be a non-empty array of rules`);\n\t\t\t}\n\t\t\tpermissions.set(\n\t\t\t\tpermission,\n\t\t\t\trules.map((rule: unknown, index: number) =>\n\t\t\t\t\tresolveRule(rule, `${here}[${index}]`, {\n\t\t\t\t\t\trefuse,\n\t\t\t\t\t\town: namesOf(name),\n\t\t\t\t\t\trelations,\n\t\t\t\t\t\ttypeNames,\n\t\t\t\t\t\tnamesOf,\n\t\t\t\t\t\tself: name,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\n\t\ttypes.set(name, { name, relations, permissions });\n\t}\n\n\trefuseLoops(types, refuse);\n\trefuseDataBeyondRoot(types, refuse);\n\n\treturn { subjects, types };\n}\n\nfunction namesIn(\n\tvalue: unknown,\n\tat: string,\n\trefuse: (message: string) => TypeError,\n): Set<string> {\n\tif (value === undefined) return new Set();\n\tif (!isRecord(value)) throw refuse(`${at} must be an object`);\n\tfor (const name of Object.keys(value)) {\n\t\tif (!NAME.test(name)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${at}: \"${name}\" must be a camelCase name — letters and digits, starting with a lowercase letter`,\n\t\t\t);\n\t\t}\n\t}\n\treturn new Set(Object.keys(value));\n}\n\nfunction resolveRelation(\n\tvalue: unknown,\n\there: string,\n\t{\n\t\trefuse,\n\t\tisSubjectType,\n\t\trelationNames,\n\t}: {\n\t\trefuse: (message: string) => TypeError;\n\t\tisSubjectType: (type: string) => boolean;\n\t\trelationNames: ReadonlyMap<string, ReadonlySet<string>>;\n\t},\n): ResolvedRelation {\n\tif (isRecord(value) && value.kind === 'fromField') {\n\t\tconst { field, subject, lookup } = value;\n\t\tif (typeof field !== 'string' || !FIELD.test(field)) {\n\t\t\tthrow refuse(`${here}: fromField must name a top-level field`);\n\t\t}\n\t\tif (typeof subject !== 'string' || !isSubjectType(subject)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: fromField names \"${String(subject)}\", which is not a subject type`,\n\t\t\t);\n\t\t}\n\t\tif (lookup !== undefined && typeof lookup !== 'function') {\n\t\t\tthrow refuse(`${here}: fromField's lookup must be a function`);\n\t\t}\n\t\treturn lookup === undefined\n\t\t\t? { kind: 'fromField', field, subject }\n\t\t\t: {\n\t\t\t\t\tkind: 'fromField',\n\t\t\t\t\tfield,\n\t\t\t\t\tsubject,\n\t\t\t\t\tlookup: lookup as (subjectId: string) => Promise<readonly string[]>,\n\t\t\t\t};\n\t}\n\n\tif (!Array.isArray(value) || value.length === 0) {\n\t\tthrow refuse(\n\t\t\t`${here} must be a non-empty array of subject types, or fromField()`,\n\t\t);\n\t}\n\tconst holders = value.map((holder: unknown): Holder => {\n\t\tif (typeof holder !== 'string') {\n\t\t\tthrow refuse(`${here}: a holder must be a string`);\n\t\t}\n\t\tconst hash = holder.indexOf('#');\n\t\tif (hash < 0) {\n\t\t\tif (!isSubjectType(holder)) {\n\t\t\t\tthrow refuse(`${here}: \"${holder}\" is not a subject type`);\n\t\t\t}\n\t\t\treturn { kind: 'type', type: holder };\n\t\t}\n\t\tconst type = holder.slice(0, hash);\n\t\tconst relation = holder.slice(hash + 1);\n\t\tif (!relationNames.get(type)?.has(relation)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${holder}\" is not a subject set — it must name an object type and one of its relations`,\n\t\t\t);\n\t\t}\n\t\treturn { kind: 'set', type, relation };\n\t});\n\treturn { kind: 'stored', holders };\n}\n\nfunction resolveRule(\n\tvalue: unknown,\n\there: string,\n\tcontext: {\n\t\trefuse: (message: string) => TypeError;\n\t\town: ReadonlySet<string>;\n\t\trelations: ReadonlyMap<string, ResolvedRelation>;\n\t\ttypeNames: ReadonlySet<string>;\n\t\tnamesOf: (type: string) => ReadonlySet<string>;\n\t\tself: string;\n\t},\n): ResolvedRule {\n\tconst { refuse } = context;\n\n\tif (isRecord(value) && value.kind === 'when') {\n\t\tif (typeof value.test !== 'function') {\n\t\t\tthrow refuse(`${here}: when() takes a function as its test`);\n\t\t}\n\t\tconst inner = resolveRule(value.rule, here, context);\n\t\treturn { ...inner, test: value.test as (ctx: never) => boolean };\n\t}\n\tif (typeof value !== 'string') {\n\t\tthrow refuse(`${here}: a rule is a name, an arrow, or when()`);\n\t}\n\n\tconst arrow = value.indexOf('->');\n\tif (arrow < 0) {\n\t\tif (!context.own.has(value)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${value}\" is not a relation or a permission of ${context.self}`,\n\t\t\t);\n\t\t}\n\t\treturn { kind: 'name', name: value };\n\t}\n\n\tconst relation = value.slice(0, arrow);\n\tconst target = value.slice(arrow + 2);\n\tconst through = context.relations.get(relation);\n\tif (through === undefined) {\n\t\tthrow refuse(\n\t\t\t`${here}: \"${value}\" goes through \"${relation}\", which is not a relation of ${context.self}`,\n\t\t);\n\t}\n\tconst targets =\n\t\tthrough.kind === 'fromField'\n\t\t\t? [through.subject]\n\t\t\t: through.holders.map((holder) =>\n\t\t\t\t\tholder.kind === 'type' ? holder.type : null,\n\t\t\t\t);\n\tfor (const type of targets) {\n\t\t// A subject set, or a user type, has no permissions to follow.\n\t\tif (type === null || !context.typeNames.has(type)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${value}\" goes through \"${relation}\", which can hold ${type === null ? 'a subject set' : `a ${type}`}; an arrow follows object types only`,\n\t\t\t);\n\t\t}\n\t\tif (!context.namesOf(type).has(target)) {\n\t\t\tthrow refuse(\n\t\t\t\t`${here}: \"${value}\" names \"${target}\", which ${type} does not declare`,\n\t\t\t);\n\t\t}\n\t}\n\treturn { kind: 'arrow', relation, target };\n}\n\n/**\n * A permission that reaches itself through names alone — `view: ['edit']`,\n * `edit: ['view']` — never reaches a relation, so no data could end the walk.\n * Refused here rather than cut at run time: it is a model's bug, not a\n * user's data.\n */\nfunction refuseLoops(\n\ttypes: ReadonlyMap<string, ResolvedObjectType>,\n\trefuse: (message: string) => TypeError,\n): void {\n\tfor (const type of types.values()) {\n\t\tconst visiting: string[] = [];\n\t\tconst done = new Set<string>();\n\n\t\tconst visit = (permission: string): void => {\n\t\t\tif (done.has(permission)) return;\n\t\t\tconst loop = visiting.indexOf(permission);\n\t\t\tif (loop >= 0) {\n\t\t\t\tthrow refuse(\n\t\t\t\t\t`types.${type.name}.permissions: ${[...visiting.slice(loop), permission].join(' → ')} is a loop no relation ends`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tvisiting.push(permission);\n\t\t\tfor (const rule of type.permissions.get(permission) ?? []) {\n\t\t\t\tif (rule.kind === 'name' && type.permissions.has(rule.name)) {\n\t\t\t\t\tvisit(rule.name);\n\t\t\t\t}\n\t\t\t}\n\t\t\tvisiting.pop();\n\t\t\tdone.add(permission);\n\t\t};\n\n\t\tfor (const permission of type.permissions.keys()) visit(permission);\n\t}\n}\n\n/**\n * A `fromField` is read from the object `can()` was given — the route loaded\n * it (decided 2026-09-24). An object reached through a subject set or an arrow\n * was loaded by nobody, so a rule that needs its data could never be decided.\n * Refused here, where it is a sentence, rather than at the first check that\n * reaches it, where it would be a denial nobody can explain.\n */\nfunction refuseDataBeyondRoot(\n\ttypes: ReadonlyMap<string, ResolvedObjectType>,\n\trefuse: (message: string) => TypeError,\n): void {\n\t/** The field `name` of `type` reads, directly or through its own rules; `null` when none. */\n\tconst fieldRead = (type: ResolvedObjectType, name: string): string | null => {\n\t\tconst relation = type.relations.get(name);\n\t\tif (relation !== undefined) {\n\t\t\treturn relation.kind === 'fromField' ? relation.field : null;\n\t\t}\n\t\tfor (const rule of type.permissions.get(name) ?? []) {\n\t\t\tconst field =\n\t\t\t\trule.kind === 'name'\n\t\t\t\t\t? fieldRead(type, rule.name)\n\t\t\t\t\t: // An arrow reads its own relation on this object.\n\t\t\t\t\t\tfieldRead(type, rule.relation);\n\t\t\tif (field !== null) return field;\n\t\t}\n\t\treturn null;\n\t};\n\n\tfor (const type of types.values()) {\n\t\tfor (const [relation, def] of type.relations) {\n\t\t\tif (def.kind !== 'stored') continue;\n\t\t\tfor (const holder of def.holders) {\n\t\t\t\tif (holder.kind !== 'set') continue;\n\t\t\t\tconst target = types.get(holder.type);\n\t\t\t\tconst field =\n\t\t\t\t\ttarget === undefined ? null : fieldRead(target, holder.relation);\n\t\t\t\tif (field !== null) {\n\t\t\t\t\tthrow refuse(\n\t\t\t\t\t\t`types.${type.name}.relations.${relation}: \"${holder.type}#${holder.relation}\" reads ${holder.type}.${field}, and a subject set reaches ${holder.type}s nobody passed to can() — store that relation instead of reading it`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfor (const [permission, rules] of type.permissions) {\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (rule.kind !== 'arrow') continue;\n\t\t\t\tconst through = type.relations.get(rule.relation);\n\t\t\t\tconst targets =\n\t\t\t\t\tthrough?.kind === 'fromField'\n\t\t\t\t\t\t? [through.subject]\n\t\t\t\t\t\t: (through?.holders ?? []).map((holder) => holder.type);\n\t\t\t\tfor (const name of targets) {\n\t\t\t\t\tconst target = types.get(name);\n\t\t\t\t\tconst field =\n\t\t\t\t\t\ttarget === undefined ? null : fieldRead(target, rule.target);\n\t\t\t\t\tif (field !== null) {\n\t\t\t\t\t\tthrow refuse(\n\t\t\t\t\t\t\t`types.${type.name}.permissions.${permission}: \"${rule.relation}->${rule.target}\" reaches ${name}.${rule.target}, which reads ${name}.${field}, and only the object passed to can() carries its data — store that relation instead of reading it`,\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n",
     "/** Reading what a caller passed to `can()`, `list()`, `grant()` and `revoke()`. */\n\nimport type { Subject } from '../subjects/subject';\nimport { admits, type ResolvedModel, type ResolvedObjectType } from './resolve';\n\n/** What no part of an id may hold: the notation would read it two ways. */\nconst RESERVED = /[@#()]/;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n\ttypeof value === 'object' && value !== null;\n\nexport function idOf(value: unknown, what: string, where: string): string {\n\tif (typeof value !== 'string' || value === '' || RESERVED.test(value)) {\n\t\tthrow new TypeError(\n\t\t\t`${where}: ${what} must be a non-empty string without @, # or parentheses`,\n\t\t);\n\t}\n\treturn value;\n}\n\nexport function typeOf(\n\tmodel: ResolvedModel,\n\tname: string,\n\twhere: string,\n): ResolvedObjectType {\n\tconst type = model.types.get(name);\n\tif (type === undefined) {\n\t\tthrow new TypeError(\n\t\t\t`${where}: \"${name}\" is not an object type of the model`,\n\t\t);\n\t}\n\treturn type;\n}\n\nexport function objectOf(\n\tmodel: ResolvedModel,\n\tvalue: unknown,\n\twhere: string,\n): {\n\treadonly type: string;\n\treadonly id: string;\n\treadonly data: Readonly<Record<string, unknown>>;\n} {\n\tif (!isRecord(value) || typeof value.type !== 'string') {\n\t\tthrow new TypeError(\n\t\t\t`${where}: the object must be { type, id, …its fields }`,\n\t\t);\n\t}\n\ttypeOf(model, value.type, where);\n\treturn {\n\t\ttype: value.type,\n\t\tid: idOf(value.id, 'the object id', where),\n\t\tdata: value,\n\t};\n}\n\n/**\n * The subject as the store compares it: `{ type, id }` for a user or an\n * object, and `{ type, id, relation }` for a subject set.\n *\n * Decided by the type, not the shape: a user's fields are flat on it, and one\n * named `relation` must not make a user read as a set. A user type is never a\n * set; an object type is one when `relation` is given.\n */\nexport function subjectOf(\n\tmodel: ResolvedModel,\n\tvalue: unknown,\n\twhere: string,\n): Subject {\n\tif (!isRecord(value) || typeof value.type !== 'string') {\n\t\tthrow new TypeError(\n\t\t\t`${where}: the subject must be a user, or { type, id }`,\n\t\t);\n\t}\n\tconst id = idOf(value.id, 'the subject id', where);\n\tif (model.subjects.has(value.type)) return { type: value.type, id };\n\n\tconst type = typeOf(model, value.type, where);\n\tif (typeof value.relation !== 'string') return { type: type.name, id };\n\tif (!type.relations.has(value.relation)) {\n\t\tthrow new TypeError(\n\t\t\t`${where}: \"${value.relation}\" is not a relation of ${type.name}, so ${type.name}:${id}#${value.relation} is no subject set`,\n\t\t);\n\t}\n\treturn { type: type.name, id, relation: value.relation };\n}\n\n/** A tuple `grant` or `revoke` may write: a stored relation, and a holder it admits. */\nexport function tupleOf(\n\tmodel: ResolvedModel,\n\tobject: unknown,\n\trelation: string,\n\tsubject: unknown,\n\twhere: string,\n) {\n\tconst target = objectOf(model, object, where);\n\tconst type = typeOf(model, target.type, where);\n\tconst def = type.relations.get(relation);\n\tif (def === undefined) {\n\t\tthrow new TypeError(\n\t\t\t`${where}: \"${relation}\" is not a relation of ${type.name}`,\n\t\t);\n\t}\n\tif (def.kind === 'fromField') {\n\t\tthrow new TypeError(\n\t\t\t`${where}: ${type.name}.${relation} is read from ${def.field}; there is nothing to store — change the ${type.name} instead`,\n\t\t);\n\t}\n\n\tconst who = subjectOf(model, subject, where);\n\tif (!admits(def.holders, who)) {\n\t\tthrow new TypeError(\n\t\t\t`${where}: ${type.name}.${relation} is not held by ${'relation' in who ? `${who.type}#${who.relation}` : who.type}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tobject: { type: target.type, id: target.id },\n\t\trelation,\n\t\tsubject: who,\n\t};\n}\n",
     "/**\n * The permission model: which object types exist, which relations they hold,\n * and which permissions those relations grant — written in TypeScript, and\n * typed from itself.\n *\n * **ReBAC, embedded.** Zanzibar's data model — relations between objects and\n * subjects, permissions computed from them — without its infrastructure: the\n * database is the application's own, so reads follow writes and there is\n * nothing to cache or sequence. Two things go beyond Zanzibar's descendants:\n *\n * - **`fromField`**, a relation read from the object's own data — a record's\n *   `doctorId` — rather than a tuple to keep in sync with it. Two sources of\n *   truth for one fact is the first trap of a Zanzibar deployment;\n * - **`when`**, a condition written in TypeScript and typed: its `ctx` is what\n *   `can()` then requires, and only for the permissions whose rules reach it.\n *\n * The model is a flat `const` literal, and everything the compiler can check\n * about it is checked here: a relation naming a subject type that does not\n * exist, a permission naming a relation that does not exist, an arrow to a\n * permission its target does not have. What only running it can check —\n * names, cycles — is refused by {@link defineModel} with a `TypeError`.\n */\n\nimport type { CursorPage } from '../pagination/cursor-page';\nimport { type ResolvedModel, resolveModel } from './resolve';\n\n// ─── The two building blocks ──────────────────────────────────────────────\n\n/**\n * The ids of the objects whose field names this subject id — what `list()`\n * needs to reverse a `fromField`: `(doctorId) => db.records.ids({ doctorId })`.\n * Unpaged; a failure throws, as a store's does.\n */\nexport type Lookup = (subjectId: string) => Promise<readonly string[]>;\n\n/**\n * A relation read from the object's own data: `fromField('doctorId', 'staff')`\n * holds for the subject of type `staff` whose id is `object.doctorId`.\n *\n * Nothing is stored. `can()` receives the object — the route has already\n * loaded it — and the compiler requires the field on it. `list()` cannot read\n * a field of objects it has not found yet, so it asks `lookup` instead; a\n * `list()` that would need one it was not given is a compile error.\n */\nexport interface FromField<\n\tField extends string = string,\n\tSubject extends string = string,\n> {\n\treadonly kind: 'fromField';\n\treadonly field: Field;\n\treadonly subject: Subject;\n\treadonly lookup?: Lookup;\n}\n\n/** A `fromField` `list()` can reverse. */\nexport interface ReversibleFromField<\n\tField extends string = string,\n\tSubject extends string = string,\n> extends FromField<Field, Subject> {\n\treadonly lookup: Lookup;\n}\n\nexport function fromField<\n\tconst Field extends string,\n\tconst Subject extends string,\n>(field: Field, subject: Subject): FromField<Field, Subject>;\nexport function fromField<\n\tconst Field extends string,\n\tconst Subject extends string,\n>(\n\tfield: Field,\n\tsubject: Subject,\n\toptions: { readonly lookup: Lookup },\n): ReversibleFromField<Field, Subject>;\nexport function fromField(\n\tfield: string,\n\tsubject: string,\n\toptions?: { readonly lookup: Lookup },\n): FromField {\n\treturn Object.freeze(\n\t\toptions === undefined\n\t\t\t? { kind: 'fromField' as const, field, subject }\n\t\t\t: { kind: 'fromField' as const, field, subject, lookup: options.lookup },\n\t);\n}\n\n/**\n * A rule that grants only when `test(ctx)` is true: `when('doctor', (ctx:\n * { onShift: boolean }) => ctx.onShift)`.\n *\n * `rule` is any rule of the same object type — a relation, a permission, an\n * arrow. The test is synchronous and pure: it decides on what the caller\n * passes, and reads nothing, so it can never fail the way a store can.\n */\nexport interface When<Rule extends string = string, Ctx = never> {\n\treadonly kind: 'when';\n\treadonly rule: Rule;\n\treadonly test: (ctx: Ctx) => boolean;\n}\n\nexport function when<const Rule extends string, Ctx>(\n\trule: Rule,\n\ttest: (ctx: Ctx) => boolean,\n): When<Rule, Ctx> {\n\treturn Object.freeze({ kind: 'when', rule, test });\n}\n\n// ─── The shape of a model ─────────────────────────────────────────────────\n\n/**\n * Who may hold a relation: subject types — `'staff'`, a user type, or `'team'`,\n * an object type — and subject sets, `'team#member'`: every member of a team.\n * Or a relation read from the object's data.\n */\nexport type RelationDef = readonly string[] | FromField;\n\n/**\n * One way to hold a permission: a relation or a permission of the same object\n * type (`'doctor'`, `'manage'`), an arrow to a permission of a related object\n * (`'team->view'`: who can view the record's team), or one of those under a\n * condition.\n */\nexport type RuleDef = string | When<string, never>;\n\nexport interface ObjectTypeDef {\n\treadonly relations?: { readonly [name: string]: RelationDef };\n\t/** Each permission is the union of its rules. */\n\treadonly permissions?: { readonly [name: string]: readonly RuleDef[] };\n}\n\nexport interface ModelConfig {\n\t/**\n\t * The user types that can be subjects — pass `auth.types` from `janus()`,\n\t * so a user type and a subject type are one name.\n\t */\n\treadonly subjects: readonly string[];\n\treadonly types: { readonly [name: string]: ObjectTypeDef };\n}\n\n// ─── Reading a model's types ──────────────────────────────────────────────\n\ntype TypesOf<C extends ModelConfig> = C['types'];\n\n/** The object types a model declares. */\nexport type ObjectTypeOf<C extends ModelConfig> = keyof TypesOf<C> & string;\n\n/** The user types a model accepts as subjects. */\nexport type UserTypeOf<C extends ModelConfig> = C['subjects'][number];\n\ntype RelationsOf<Ts, T> = T extends keyof Ts\n\t? Ts[T] extends { readonly relations: infer R }\n\t\t? keyof R & string\n\t\t: never\n\t: never;\n\ntype PermissionsOf<Ts, T> = T extends keyof Ts\n\t? Ts[T] extends { readonly permissions: infer P }\n\t\t? keyof P & string\n\t\t: never\n\t: never;\n\ntype NamesOf<Ts, T> = RelationsOf<Ts, T> | PermissionsOf<Ts, T>;\n\ntype RelationDefOf<Ts, T, R> = T extends keyof Ts\n\t? Ts[T] extends { readonly relations: infer Rs }\n\t\t? R extends keyof Rs\n\t\t\t? Rs[R]\n\t\t\t: never\n\t\t: never\n\t: never;\n\n/** The relations of `T` that are stored as tuples: every one but its `fromField`s. */\ntype StoredRelationsOf<Ts, T> = {\n\t[R in RelationsOf<Ts, T>]: RelationDefOf<Ts, T, R> extends FromField\n\t\t? never\n\t\t: R;\n}[RelationsOf<Ts, T>];\n\n/**\n * `'team#member'` for every stored relation of every object type. Not a\n * `fromField`: a subject set reaches objects nobody passed to `can()`, so there\n * is no data to read the field from.\n */\ntype SubjectSetOf<Ts> = {\n\t[T in keyof Ts & string]: `${T}#${StoredRelationsOf<Ts, T>}`;\n}[keyof Ts & string];\n\ntype SubjectRefOf<S extends string, Ts> =\n\t| S\n\t| (keyof Ts & string)\n\t| SubjectSetOf<Ts>;\n\n/** The object types an arrow through `R` reaches: its direct subject types. */\ntype ArrowTargets<Ts, T, R> =\n\tRelationDefOf<Ts, T, R> extends FromField<string, infer Sub>\n\t\t? Sub\n\t\t: RelationDefOf<Ts, T, R> extends readonly (infer E)[]\n\t\t\t? E extends `${string}#${string}`\n\t\t\t\t? never\n\t\t\t\t: E\n\t\t\t: never;\n\n/** The names every one of `Targets` declares. */\ntype CommonNames<Ts, Targets> =\n\tNamesOf<Ts, Targets> extends infer N\n\t\t? N extends string\n\t\t\t? [Targets] extends [TypesNaming<Ts, N>]\n\t\t\t\t? N\n\t\t\t\t: never\n\t\t\t: never\n\t\t: never;\n\ntype TypesNaming<Ts, N> = {\n\t[X in keyof Ts]: N extends NamesOf<Ts, X> ? X : never;\n}[keyof Ts];\n\n/** `'team->view'`, for each relation whose targets are all object types. */\ntype ArrowsOf<Ts, T> = {\n\t[R in RelationsOf<Ts, T>]: [ArrowTargets<Ts, T, R>] extends [never]\n\t\t? never\n\t\t: [ArrowTargets<Ts, T, R>] extends [keyof Ts]\n\t\t\t? `${R}->${CommonNames<Ts, ArrowTargets<Ts, T, R>>}`\n\t\t\t: never;\n}[RelationsOf<Ts, T>];\n\n/** Every string a rule of `T` may be. */\ntype RuleRefOf<Ts, T> = NamesOf<Ts, T> | ArrowsOf<Ts, T>;\n\n/** What `can()` accepts for an object type: its relations and its permissions. */\nexport type CheckableOf<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n> = NamesOf<TypesOf<C>, T>;\n\n/** The fields an object of type `T` must carry: those its `fromField`s read. */\nexport type FieldsOf<C extends ModelConfig, T extends ObjectTypeOf<C>> = {\n\t[R in RelationsOf<TypesOf<C>, T>]: RelationDefOf<\n\t\tTypesOf<C>,\n\t\tT,\n\t\tR\n\t> extends FromField<infer F, string>\n\t\t? F\n\t\t: never;\n}[RelationsOf<TypesOf<C>, T>];\n\n/**\n * An object, as `can()` takes it: its type and id, and **every field a\n * `fromField` of its type reads** — required, so an object passed without\n * them is a compile error rather than a silent denial. `null` is a field\n * holding nobody.\n */\nexport type ObjectRef<C extends ModelConfig, T extends ObjectTypeOf<C>> = {\n\treadonly type: T;\n\treadonly id: string;\n} & { readonly [F in FieldsOf<C, T>]: string | null };\n\n/** A subject: a user from `janus()` as it is, or an object. */\nexport interface SubjectRef<C extends ModelConfig> {\n\treadonly type: UserTypeOf<C> | ObjectTypeOf<C>;\n\treadonly id: string;\n}\n\n// ─── The context a check requires ─────────────────────────────────────────\n\ntype UnionToIntersection<U> = (\n\tU extends unknown\n\t\t? (union: U) => void\n\t\t: never\n) extends (intersection: infer I) => void\n\t? I\n\t: never;\n\ntype CtxOfRule<E> = E extends When<string, infer X> ? X : never;\n\ntype NameOfRule<E> = E extends string\n\t? E\n\t: E extends When<infer R, never>\n\t\t? R\n\t\t: never;\n\ntype CtxOfName<Ts, T, N, Seen> = N extends `${infer R}->${infer P}`\n\t? CtxOfPermission<Ts, ArrowTargets<Ts, T, R>, P, Seen>\n\t: CtxOfPermission<Ts, T, N, Seen>;\n\n/**\n * The union of the `ctx` types a permission's rules reach — through its own\n * rules, the permissions they name, and arrows into other types. `Seen` stops\n * the walk on a cycle.\n */\ntype CtxOfPermission<Ts, T, P, Seen> = T extends keyof Ts & string\n\t? P extends string\n\t\t? `${T}.${P}` extends Seen\n\t\t\t? never\n\t\t\t: Ts[T] extends { readonly permissions: infer Ps }\n\t\t\t\t? P extends keyof Ps\n\t\t\t\t\t? Ps[P] extends readonly (infer E)[]\n\t\t\t\t\t\t? CtxOfRule<E> | CtxOfName<Ts, T, NameOfRule<E>, Seen | `${T}.${P}`>\n\t\t\t\t\t\t: never\n\t\t\t\t\t: never\n\t\t\t\t: never\n\t\t: never\n\t: never;\n\n/**\n * What `can(…, permission, object)` requires as `ctx`: every condition its\n * rules can reach, intersected. `never` when none — and then `can()` takes no\n * `ctx` at all.\n */\nexport type CtxOf<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n\tP extends string,\n> = [CtxOfPermission<TypesOf<C>, T, P, never>] extends [never]\n\t? never\n\t: UnionToIntersection<CtxOfPermission<TypesOf<C>, T, P, never>>;\n\n/**\n * The options of a check: `ctx` required exactly when a condition is\n * reachable.\n *\n * Loose when `T` or `P` is its whole constraint — what the compiler falls back\n * to when the argument was wrong. Requiring `ctx` there would report a missing\n * argument instead of the wrong type or permission that caused it; the\n * refusal on that argument is the one worth reading. A `when` reached with no\n * `ctx` still throws at run time.\n */\nexport type CheckArgs<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n\tP extends string,\n> = [ObjectTypeOf<C>] extends [T]\n\t? [ObjectTypeOf<C>] extends [never]\n\t\t? [options?: { readonly ctx?: unknown }]\n\t\t: IsSingle<ObjectTypeOf<C>> extends true\n\t\t\t? // One object type: `T` is its constraint and right; `P` may not be.\n\t\t\t\tPermissionArgs<C, T, P>\n\t\t\t: [options?: { readonly ctx?: unknown }]\n\t: PermissionArgs<C, T, P>;\n\n/** `CheckArgs` once `T` is known right: loose when `P` is its whole constraint. */\ntype PermissionArgs<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n\tP extends string,\n> = [CheckableOf<C, T>] extends [P]\n\t? IsSingle<CheckableOf<C, T>> extends true\n\t\t? Strict<C, T, P>\n\t\t: [options?: { readonly ctx?: unknown }]\n\t: Strict<C, T, P>;\n\ntype Strict<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n\tP extends string,\n> = [CtxOf<C, T, P>] extends [never]\n\t? [options?: { readonly ctx?: never }]\n\t: [options: { readonly ctx: CtxOf<C, T, P> }];\n\n/** Whether `U` is one type rather than a union of several. */\ntype IsSingle<U> = [U] extends [UnionToIntersection<U>] ? true : false;\n\n/**\n * The signature of `can()`, typed from the model: the permission must be one\n * the object's type declares, the object must carry every field its\n * `fromField`s read, and `ctx` is required exactly when a condition is\n * reachable. `null` is anonymous, and answers `false`.\n */\nexport type Can<C extends ModelConfig> = <\n\tT extends ObjectTypeOf<C>,\n\tP extends CheckableOf<C, T>,\n>(\n\tsubject: SubjectRef<C> | null,\n\tpermission: P,\n\tobject: ObjectRef<C, T>,\n\t...options: CheckArgs<C, T, P>\n) => Promise<boolean>;\n\n// ─── What list() can reverse ──────────────────────────────────────────────\n\n/** `'record.doctor'` when relation `R` of `T` is a `fromField` with no `lookup`. */\ntype GapOfRelation<Ts, T, R> =\n\tRelationDefOf<Ts, T, R> extends { readonly lookup: Lookup }\n\t\t? never\n\t\t: RelationDefOf<Ts, T, R> extends FromField\n\t\t\t? `${T & string}.${R & string}`\n\t\t\t: never;\n\ntype GapOfName<Ts, T, N, Seen> = N extends `${infer R}->${infer P}`\n\t?\n\t\t\t| GapOfRelation<Ts, T, R>\n\t\t\t| GapOfPermission<Ts, ArrowTargets<Ts, T, R>, P, Seen>\n\t: GapOfPermission<Ts, T, N, Seen>;\n\n/**\n * The `fromField`s without a `lookup` that `list(…, P, T)` would have to\n * reverse — through `P`'s rules, the names they reach, and arrows. A subject\n * set never reaches one: `defineModel` refuses that.\n */\ntype GapOfPermission<Ts, T, P, Seen> = T extends keyof Ts & string\n\t? P extends string\n\t\t? `${T}.${P}` extends Seen\n\t\t\t? never\n\t\t\t: P extends RelationsOf<Ts, T>\n\t\t\t\t? GapOfRelation<Ts, T, P>\n\t\t\t\t: Ts[T] extends { readonly permissions: infer Ps }\n\t\t\t\t\t? P extends keyof Ps\n\t\t\t\t\t\t? Ps[P] extends readonly (infer E)[]\n\t\t\t\t\t\t\t? GapOfName<Ts, T, NameOfRule<E>, Seen | `${T}.${P}`>\n\t\t\t\t\t\t\t: never\n\t\t\t\t\t\t: never\n\t\t\t\t\t: never\n\t\t: never\n\t: never;\n\n/** Every `fromField` without a `lookup` that `list(…, P, T)` would reach; `never` when none. */\nexport type LookupGap<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n\tP extends string,\n> = GapOfPermission<TypesOf<C>, T, P, never>;\n\n/** What a permission must also be for `list()`: reversible. */\ntype ListCheck<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n\tP extends string,\n> = [LookupGap<C, T, P>] extends [never]\n\t? unknown\n\t: Refusal<\n\t\t\t`list cannot reverse ${LookupGap<C, T, P>}: give that fromField a lookup`,\n\t\t\tnever\n\t\t>;\n\n/** Where a page of `list()` starts, and how much it holds. */\nexport interface ListPage {\n\t/** The `nextCursor` of the previous page; absent or `null` for the first. */\n\treadonly after?: string | null;\n\t/** Between 1 and 100; 20 when absent. */\n\treadonly limit?: number;\n}\n\n/** `CheckArgs`, with a page. */\ntype ListArgs<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n\tP extends string,\n> =\n\tCheckArgs<C, T, P> extends [infer O]\n\t\t? [options: O & ListPage]\n\t\t: CheckArgs<C, T, P> extends [options?: infer O]\n\t\t\t? [options?: O & ListPage]\n\t\t\t: never;\n\n/**\n * The signature of `list()`: the ids of the objects of `type` on which\n * `subject` holds `permission`, in ascending order, by pages. Typed like\n * `can()`, and refuses a permission that reaches a `fromField` with no\n * `lookup`: nothing could find the objects whose field names the subject.\n */\nexport type List<C extends ModelConfig> = <\n\tT extends ObjectTypeOf<C>,\n\tP extends CheckableOf<C, T>,\n>(\n\tsubject: SubjectRef<C> | null,\n\tpermission: P & ListCheck<C, T, P>,\n\ttype: T,\n\t...options: ListArgs<C, T, P>\n) => Promise<CursorPage<string>>;\n\n/** The relations of an object type that `grant` can write: not its `fromField`s. */\nexport type GrantableOf<\n\tC extends ModelConfig,\n\tT extends ObjectTypeOf<C>,\n> = StoredRelationsOf<TypesOf<C>, T>;\n\n/**\n * Who may be granted relation `R` on an object of type `T`: an entity of each\n * subject type it names, and a subject set for each set it names.\n */\nexport type HolderOf<C extends ModelConfig, T extends ObjectTypeOf<C>, R> =\n\tRelationDefOf<TypesOf<C>, T, R> extends readonly (infer E)[]\n\t\t? E extends `${infer SetType}#${infer SetRelation}`\n\t\t\t? {\n\t\t\t\t\treadonly type: SetType;\n\t\t\t\t\treadonly id: string;\n\t\t\t\t\treadonly relation: SetRelation;\n\t\t\t\t}\n\t\t\t: { readonly type: E; readonly id: string }\n\t\t: never;\n\n/** Writes one tuple, or removes it: typed like `can()`. */\nexport type Grant<C extends ModelConfig> = <\n\tT extends ObjectTypeOf<C>,\n\tR extends GrantableOf<C, T>,\n>(\n\tobject: { readonly type: T; readonly id: string },\n\trelation: R,\n\tsubject: HolderOf<C, T, R>,\n) => Promise<void>;\n\n/** What `permissions()` answers. */\nexport interface Permissions<C extends ModelConfig> {\n\treadonly model: PermissionModel<C>;\n\t/**\n\t * Whether `subject` holds `permission` on `object`: `true` or `false`, and\n\t * **a failure throws** — a store that cannot answer is `STORE_FAILED`, never\n\t * a denial. `null` is anonymous, and `false` before any store call.\n\t */\n\treadonly can: Can<C>;\n\t/**\n\t * The ids of the objects of `type` on which `subject` holds `permission`,\n\t * ascending, by pages — what `can()` answers `true` for, found without\n\t * naming them. `null` is anonymous, and an empty page before any store call.\n\t * A failure throws, as for `can()`.\n\t */\n\treadonly list: List<C>;\n\t/** Stores that `subject` holds `relation` on `object`. Idempotent. */\n\treadonly grant: Grant<C>;\n\t/** Removes it. Idempotent: revoking what is not held is not an error. */\n\treadonly revoke: Grant<C>;\n}\n\n/** The configuration a model was defined from. */\nexport type ConfigOf<M> = M extends PermissionModel<infer C> ? C : never;\n\n// ─── The checks, as types ─────────────────────────────────────────────────\n\ntype Refusal<Text extends string, Expected> = {\n\treadonly [K in Text]: Expected;\n};\n\ntype CheckRelation<C extends ModelConfig, Def> =\n\tDef extends FromField<string, infer Sub>\n\t\t? Sub extends UserTypeOf<C> | ObjectTypeOf<C>\n\t\t\t? unknown\n\t\t\t: {\n\t\t\t\t\treadonly subject: Refusal<\n\t\t\t\t\t\t`\"${Sub}\" is not a subject type; name one of`,\n\t\t\t\t\t\tUserTypeOf<C> | ObjectTypeOf<C>\n\t\t\t\t\t>;\n\t\t\t\t}\n\t\t: {\n\t\t\t\treadonly [I in keyof Def]: Def[I] extends SubjectRefOf<\n\t\t\t\t\tUserTypeOf<C>,\n\t\t\t\t\tTypesOf<C>\n\t\t\t\t>\n\t\t\t\t\t? unknown\n\t\t\t\t\t: Refusal<\n\t\t\t\t\t\t\t`\"${Def[I] & string}\" is not a subject type or a subject set; name one of`,\n\t\t\t\t\t\t\tSubjectRefOf<UserTypeOf<C>, TypesOf<C>>\n\t\t\t\t\t\t>;\n\t\t\t};\n\ntype CheckRules<Ts, T, Rules> = {\n\treadonly [I in keyof Rules]: Rules[I] extends string\n\t\t? Rules[I] extends RuleRefOf<Ts, T>\n\t\t\t? unknown\n\t\t\t: Refusal<\n\t\t\t\t\t`\"${Rules[I]}\" is not a relation, a permission or an arrow of ${T & string}; name one of`,\n\t\t\t\t\tRuleRefOf<Ts, T>\n\t\t\t\t>\n\t\t: Rules[I] extends When<infer R, never>\n\t\t\t? R extends RuleRefOf<Ts, T>\n\t\t\t\t? unknown\n\t\t\t\t: {\n\t\t\t\t\t\treadonly rule: Refusal<\n\t\t\t\t\t\t\t`\"${R}\" is not a relation, a permission or an arrow of ${T & string}; name one of`,\n\t\t\t\t\t\t\tRuleRefOf<Ts, T>\n\t\t\t\t\t\t>;\n\t\t\t\t\t}\n\t\t\t: unknown;\n};\n\ntype CheckObjectType<C extends ModelConfig, T> = (TypesOf<C>[T &\n\tkeyof TypesOf<C>] extends { readonly relations: infer Rs }\n\t? {\n\t\t\treadonly relations: {\n\t\t\t\treadonly [R in keyof Rs]: CheckRelation<C, Rs[R]>;\n\t\t\t};\n\t\t}\n\t: unknown) &\n\t(TypesOf<C>[T & keyof TypesOf<C>] extends { readonly permissions: infer Ps }\n\t\t? {\n\t\t\t\treadonly permissions: {\n\t\t\t\t\treadonly [P in keyof Ps]: P extends RelationsOf<TypesOf<C>, T>\n\t\t\t\t\t\t? Refusal<\n\t\t\t\t\t\t\t\t`\"${P & string}\" names a relation and a permission of ${T & string}; rename one`,\n\t\t\t\t\t\t\t\tnever\n\t\t\t\t\t\t\t>\n\t\t\t\t\t\t: CheckRules<TypesOf<C>, T, Ps[P]>;\n\t\t\t\t};\n\t\t\t}\n\t\t: unknown);\n\n/**\n * The compile-time checks `defineModel` intersects into its parameter — the\n * `C & Checked<C>` pattern of `janus()`: a wrong value is unassignable **on\n * the offending key**, and the reason is the type the compiler prints.\n */\nexport type CheckedModel<C extends ModelConfig> = {\n\treadonly types: {\n\t\treadonly [T in keyof TypesOf<C>]: CheckObjectType<C, T>;\n\t};\n};\n\n// ─── Defining one ─────────────────────────────────────────────────────────\n\n/** A model, checked and resolved. What `permissions()` will take. */\nexport interface PermissionModel<C extends ModelConfig = ModelConfig> {\n\t/** The user types it accepts as subjects. */\n\treadonly subjects: readonly UserTypeOf<C>[];\n\t/** The object types it declares. */\n\treadonly types: readonly ObjectTypeOf<C>[];\n\t/** The definition, as written. Frozen. */\n\treadonly definition: C;\n}\n\n// Keyed by the frozen model itself: nothing outside this module can reach it.\nconst RESOLVED = new WeakMap<object, ResolvedModel>();\n\n/**\n * Checks a model and resolves it. Connects to nothing.\n *\n * ```ts\n * export const model = defineModel({\n *   subjects: auth.types,\n *   types: {\n *     team: {\n *       relations: { member: ['staff', 'team#member'], lead: ['staff'] },\n *       permissions: { manage: ['lead'], view: ['member', 'manage'] },\n *     },\n *     record: {\n *       relations: {\n *         doctor: fromField('doctorId', 'staff'),\n *         team: ['team'],\n *       },\n *       permissions: {\n *         view: ['doctor', 'team->view'],\n *         edit: [when('doctor', (ctx: { onShift: boolean }) => ctx.onShift)],\n *       },\n *     },\n *   },\n * });\n * ```\n *\n * Refuses with a `TypeError` what only running it can see: a name that is not\n * camelCase, an object type named like a user type, a permission that reaches\n * itself without crossing a relation — which no data could ever end.\n */\nexport function defineModel<const C extends ModelConfig>(\n\tconfig: C & CheckedModel<C>,\n): PermissionModel<C> {\n\tconst resolved = resolveModel(config, 'defineModel');\n\tconst model: PermissionModel<C> = Object.freeze({\n\t\tsubjects: [...resolved.subjects] as UserTypeOf<C>[],\n\t\ttypes: [...resolved.types.keys()] as ObjectTypeOf<C>[],\n\t\tdefinition: config,\n\t});\n\tRESOLVED.set(model, resolved);\n\treturn model;\n}\n\n/** The resolved form of a model this module defined. Internal. */\nexport function resolvedOf(model: object): ResolvedModel {\n\tconst resolved = RESOLVED.get(model);\n\tif (resolved === undefined) {\n\t\tthrow new TypeError(\n\t\t\t'permissions: this model was not made by defineModel() — pass what defineModel() answered',\n\t\t);\n\t}\n\treturn resolved;\n}\n",
     "import { PermissionDepthError } from '../errors/janus-error';\nimport type { CursorPage } from '../pagination/cursor-page';\nimport { MAX_PAGE_SIZE } from '../pagination/cursor-page';\nimport type { Subject } from '../subjects/subject';\nimport type { RelationStore } from './port/types';\nimport {\n\tadmits,\n\ttype ResolvedModel,\n\ttype ResolvedObjectType,\n\ttype ResolvedRule,\n} from './resolve';\n\n/**\n * One `list()`: the objects a subject holds a name on, found backwards —\n * from the subject to the tuples naming it, through the sets and arrows the\n * model declares, to the objects.\n *\n * **A least fixpoint.** `objects(type, name)` is a union of what its rules\n * reach, and a rule can reach its own name again — a folder viewable through\n * its parent, a team member through a team. Such a name, met again on the\n * current path, answers what the previous round found; rounds repeat until\n * none adds an id. That is exactly the set of objects with a derivation that\n * does not loop — what `can()`'s cut finds, one object at a time. A round\n * that met no loop is final.\n *\n * **Depth.** Each round past the first follows the loops one relation\n * further; more than `maxDepth` rounds is `PERMISSION_DEPTH`, as crossing more\n * than `maxDepth` relations is for `can()`.\n *\n * **Cost.** Every page of `findObjects` for every id each step reaches, every\n * round. Linear in what the subject can reach — fine for the objects of one\n * user, not for a subject set holding most of the database.\n */\nexport class Reverse {\n\tprivate previous = new Map<string, ReadonlySet<string>>();\n\tprivate current = new Map<string, ReadonlySet<string>>();\n\tprivate readonly path = new Set<string>();\n\tprivate looped = false;\n\n\tconstructor(\n\t\tprivate readonly model: ResolvedModel,\n\t\tprivate readonly store: RelationStore,\n\t\tprivate readonly maxDepth: number,\n\t\tprivate readonly ctx: unknown,\n\t\tprivate readonly subject: Subject,\n\t\tprivate readonly question: string,\n\t) {}\n\n\tasync objects(type: string, name: string): Promise<ReadonlySet<string>> {\n\t\tfor (let round = 0; round <= this.maxDepth; round += 1) {\n\t\t\tthis.current = new Map();\n\t\t\tthis.looped = false;\n\t\t\tconst found = await this.reach(type, name);\n\t\t\tif (!this.looped || this.same()) return found;\n\t\t\tthis.previous = this.current;\n\t\t}\n\t\tthrow new PermissionDepthError(\n\t\t\t`list: listing ${this.question} crossed more than ${this.maxDepth} relations without an answer`,\n\t\t\t{ permission: this.question, maxDepth: this.maxDepth },\n\t\t);\n\t}\n\n\t/** Whether this round found what the previous one did: nothing more to find. */\n\tprivate same(): boolean {\n\t\tfor (const [key, ids] of this.current) {\n\t\t\tif ((this.previous.get(key)?.size ?? 0) !== ids.size) return false;\n\t\t}\n\t\treturn true;\n\t}\n\n\t/** The ids of the objects of `typeName` on which the subject holds `name`. */\n\tprivate async reach(\n\t\ttypeName: string,\n\t\tname: string,\n\t): Promise<ReadonlySet<string>> {\n\t\tconst key = `${typeName}#${name}`;\n\t\tconst done = this.current.get(key);\n\t\tif (done !== undefined) return done;\n\t\tif (this.path.has(key)) {\n\t\t\tthis.looped = true;\n\t\t\treturn this.previous.get(key) ?? new Set();\n\t\t}\n\n\t\tconst type = this.model.types.get(typeName);\n\t\tif (type === undefined) return new Set();\n\n\t\tthis.path.add(key);\n\t\ttry {\n\t\t\tconst found = type.permissions.has(name)\n\t\t\t\t? await this.permission(type, name)\n\t\t\t\t: await this.relation(type, name);\n\t\t\tthis.current.set(key, found);\n\t\t\treturn found;\n\t\t} finally {\n\t\t\tthis.path.delete(key);\n\t\t}\n\t}\n\n\tprivate async relation(\n\t\ttype: ResolvedObjectType,\n\t\tname: string,\n\t): Promise<Set<string>> {\n\t\tconst relation = type.relations.get(name);\n\t\tif (relation === undefined) return new Set();\n\n\t\tif (relation.kind === 'fromField') {\n\t\t\tconst subject = this.subject;\n\t\t\treturn 'relation' in subject || subject.type !== relation.subject\n\t\t\t\t? new Set()\n\t\t\t\t: new Set(await this.lookup(type, name, subject.id));\n\t\t}\n\n\t\t// A direct tuple counts only when the model admits the subject here.\n\t\tconst found = new Set(\n\t\t\tadmits(relation.holders, this.subject)\n\t\t\t\t? await this.holding(type.name, name, this.subject)\n\t\t\t\t: [],\n\t\t);\n\t\tfor (const holder of relation.holders) {\n\t\t\tif (holder.kind !== 'set') continue;\n\t\t\tfor (const id of await this.reach(holder.type, holder.relation)) {\n\t\t\t\tconst set = { type: holder.type, id, relation: holder.relation };\n\t\t\t\tfor (const object of await this.holding(type.name, name, set)) {\n\t\t\t\t\tfound.add(object);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn found;\n\t}\n\n\tprivate async permission(\n\t\ttype: ResolvedObjectType,\n\t\tname: string,\n\t): Promise<Set<string>> {\n\t\tconst found = new Set<string>();\n\t\tfor (const rule of type.permissions.get(name) ?? []) {\n\t\t\tif (rule.test !== undefined && !this.passes(rule, type, name)) continue;\n\n\t\t\tif (rule.kind === 'name') {\n\t\t\t\tfor (const id of await this.reach(type.name, rule.name)) found.add(id);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfor (const id of await this.arrow(type, rule.relation, rule.target)) {\n\t\t\t\tfound.add(id);\n\t\t\t}\n\t\t}\n\t\treturn found;\n\t}\n\n\t/** The objects of `type` whose `relation` reaches an object on which the subject holds `target`. */\n\tprivate async arrow(\n\t\ttype: ResolvedObjectType,\n\t\trelation: string,\n\t\ttarget: string,\n\t): Promise<Set<string>> {\n\t\tconst through = type.relations.get(relation);\n\t\tconst found = new Set<string>();\n\t\tif (through === undefined) return found;\n\n\t\tif (through.kind === 'fromField') {\n\t\t\tfor (const id of await this.reach(through.subject, target)) {\n\t\t\t\tfor (const object of await this.lookup(type, relation, id)) {\n\t\t\t\t\tfound.add(object);\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn found;\n\t\t}\n\t\tfor (const holder of through.holders) {\n\t\t\t// An arrow follows entities; a user type holds no permission.\n\t\t\tif (holder.kind !== 'type' || !this.model.types.has(holder.type)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfor (const id of await this.reach(holder.type, target)) {\n\t\t\t\tconst entity = { type: holder.type, id };\n\t\t\t\tfor (const object of await this.holding(type.name, relation, entity)) {\n\t\t\t\t\tfound.add(object);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn found;\n\t}\n\n\t/** Every id of every page of `findObjects`. */\n\tprivate async holding(\n\t\ttype: string,\n\t\trelation: string,\n\t\tsubject: Subject,\n\t): Promise<string[]> {\n\t\tconst ids: string[] = [];\n\t\tlet after: string | null = null;\n\t\tdo {\n\t\t\tconst page: CursorPage<string> = await this.store.findObjects({\n\t\t\t\ttype,\n\t\t\t\trelation,\n\t\t\t\tsubject,\n\t\t\t\tafter,\n\t\t\t\tlimit: MAX_PAGE_SIZE,\n\t\t\t});\n\t\t\tids.push(...page.items);\n\t\t\tafter = page.nextCursor;\n\t\t} while (after !== null);\n\t\treturn ids;\n\t}\n\n\t/** The objects whose field names `id`, from the `fromField`'s lookup. */\n\tprivate async lookup(\n\t\ttype: ResolvedObjectType,\n\t\trelation: string,\n\t\tid: string,\n\t): Promise<readonly string[]> {\n\t\tconst def = type.relations.get(relation);\n\t\tif (def?.kind !== 'fromField' || def.lookup === undefined) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`list: ${type.name}.${relation} is read from a field, and has no lookup to find the ${type.name}s naming ${id} — fromField('${def?.kind === 'fromField' ? def.field : relation}', '${def?.kind === 'fromField' ? def.subject : ''}', { lookup })`,\n\t\t\t);\n\t\t}\n\t\tconst ids = await def.lookup(id);\n\t\tif (!Array.isArray(ids) || ids.some((each) => typeof each !== 'string')) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`list: the lookup of ${type.name}.${relation} must answer an array of ids`,\n\t\t\t);\n\t\t}\n\t\treturn ids;\n\t}\n\n\t/** The condition, run on the caller's `ctx`, as for `can()`. */\n\tprivate passes(\n\t\trule: ResolvedRule,\n\t\ttype: ResolvedObjectType,\n\t\tname: string,\n\t): boolean {\n\t\tif (this.ctx === undefined) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`list: ${type.name}.${name} reaches a condition, and no ctx was passed — pass { ctx }`,\n\t\t\t);\n\t\t}\n\t\treturn (rule.test as (ctx: unknown) => boolean)(this.ctx) === true;\n\t}\n}\n",
     "/** The walk behind `can()`: from an object, through its rules, to a subject. */\n\nimport { PermissionDepthError } from '../errors/janus-error';\nimport { formatEntity } from '../subjects/notation';\nimport type { Entity, Subject } from '../subjects/subject';\nimport type { RelationStore } from './port/types';\nimport {\n\tadmits,\n\ttype ResolvedModel,\n\ttype ResolvedObjectType,\n\ttype ResolvedRule,\n} from './resolve';\n\n/** An object on the walk: its entity, and its data when the caller passed it. */\nexport interface Node {\n\treadonly entity: Entity;\n\treadonly data: Readonly<Record<string, unknown>> | null;\n}\n\n/** One check: its context, its path, and the depth it may reach. */\nexport class Walk {\n\t/** The nodes on the current path. The walk is sequential, so one set is the stack. */\n\tprivate readonly path = new Set<string>();\n\n\tconstructor(\n\t\tprivate readonly model: ResolvedModel,\n\t\tprivate readonly store: RelationStore,\n\t\tprivate readonly maxDepth: number,\n\t\tprivate readonly ctx: unknown,\n\t\tprivate readonly question: string,\n\t) {}\n\n\t/** Whether `subject` holds `name` — a relation or a permission — on `node`. */\n\tasync holds(\n\t\tsubject: Subject,\n\t\tnode: Node,\n\t\tname: string,\n\t\tdepth: number,\n\t): Promise<boolean> {\n\t\tif (depth > this.maxDepth) {\n\t\t\tthrow new PermissionDepthError(\n\t\t\t\t`can: checking ${this.question} crossed more than ${this.maxDepth} relations without an answer`,\n\t\t\t\t{ permission: this.question, maxDepth: this.maxDepth },\n\t\t\t);\n\t\t}\n\n\t\tconst key = `${formatEntity(node.entity)}#${name}`;\n\t\t// A cycle in the data: this branch grants nothing, and it is not an error.\n\t\tif (this.path.has(key)) return false;\n\n\t\tconst type = this.model.types.get(node.entity.type);\n\t\t// A stored tuple naming a type the model no longer declares grants nothing.\n\t\tif (type === undefined) return false;\n\n\t\tthis.path.add(key);\n\t\ttry {\n\t\t\treturn type.permissions.has(name)\n\t\t\t\t? await this.permission(subject, type, node, name, depth)\n\t\t\t\t: await this.relation(subject, type, node, name, depth);\n\t\t} finally {\n\t\t\tthis.path.delete(key);\n\t\t}\n\t}\n\n\tprivate async relation(\n\t\tsubject: Subject,\n\t\ttype: ResolvedObjectType,\n\t\tnode: Node,\n\t\tname: string,\n\t\tdepth: number,\n\t): Promise<boolean> {\n\t\tconst relation = type.relations.get(name);\n\t\tif (relation === undefined) return false;\n\n\t\tif (relation.kind === 'fromField') {\n\t\t\tconst id = fieldOf(node, relation.field, `${type.name}.${name}`);\n\t\t\treturn (\n\t\t\t\tid !== null &&\n\t\t\t\t!('relation' in subject) &&\n\t\t\t\tsubject.type === relation.subject &&\n\t\t\t\tsubject.id === id\n\t\t\t);\n\t\t}\n\n\t\t// What the model does not admit here grants nothing, however it was stored.\n\t\tif (\n\t\t\tadmits(relation.holders, subject) &&\n\t\t\t(await this.store.has({ object: node.entity, relation: name, subject }))\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tfor (const set of await this.store.findSubjectSets(node.entity, name)) {\n\t\t\tif (!admits(relation.holders, set)) continue;\n\t\t\tconst through = { entity: { type: set.type, id: set.id }, data: null };\n\t\t\tif (await this.holds(subject, through, set.relation, depth + 1)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t}\n\n\tprivate async permission(\n\t\tsubject: Subject,\n\t\ttype: ResolvedObjectType,\n\t\tnode: Node,\n\t\tname: string,\n\t\tdepth: number,\n\t): Promise<boolean> {\n\t\tfor (const rule of type.permissions.get(name) ?? []) {\n\t\t\tif (rule.test !== undefined && !this.passes(rule, type, name)) continue;\n\n\t\t\tif (rule.kind === 'name') {\n\t\t\t\tif (await this.holds(subject, node, rule.name, depth)) return true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfor (const target of await this.targets(type, node, rule.relation)) {\n\t\t\t\tif (await this.holds(subject, target, rule.target, depth + 1)) {\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t}\n\n\t/** The condition, run on the caller's `ctx`. Its absence is a caller's bug, not a denial. */\n\tprivate passes(\n\t\trule: ResolvedRule,\n\t\ttype: ResolvedObjectType,\n\t\tname: string,\n\t): boolean {\n\t\tif (this.ctx === undefined) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`can: ${type.name}.${name} reaches a condition, and no ctx was passed — pass { ctx }`,\n\t\t\t);\n\t\t}\n\t\treturn (rule.test as (ctx: unknown) => boolean)(this.ctx) === true;\n\t}\n\n\t/** The objects an arrow through `relation` reaches from `node`. */\n\tprivate async targets(\n\t\ttype: ResolvedObjectType,\n\t\tnode: Node,\n\t\trelation: string,\n\t): Promise<Node[]> {\n\t\tconst through = type.relations.get(relation);\n\t\tif (through === undefined) return [];\n\n\t\tif (through.kind === 'fromField') {\n\t\t\tconst id = fieldOf(node, through.field, `${type.name}.${relation}`);\n\t\t\treturn id === null\n\t\t\t\t? []\n\t\t\t\t: [{ entity: { type: through.subject, id }, data: null }];\n\t\t}\n\t\t// An entity of a type the model does not admit here is no target.\n\t\treturn (await this.store.findEntities(node.entity, relation))\n\t\t\t.filter((entity) => admits(through.holders, entity))\n\t\t\t.map((entity) => ({\n\t\t\t\tentity: { type: entity.type, id: entity.id },\n\t\t\t\tdata: null,\n\t\t\t}));\n\t}\n}\n\n/** The id a `fromField` reads, or `null` for nobody. A missing field is the caller's bug. */\nfunction fieldOf(node: Node, field: string, what: string): string | null {\n\tif (node.data === null) {\n\t\t// resolveModel refuses a model that could get here.\n\t\tthrow new TypeError(\n\t\t\t`can: ${what} reads ${field} from an object nobody passed`,\n\t\t);\n\t}\n\tconst value = node.data[field];\n\tif (value === null) return null;\n\tif (typeof value !== 'string') {\n\t\tthrow new TypeError(\n\t\t\t`can: ${what} reads ${field}, which the object ${value === undefined ? 'does not carry — pass the loaded object, spread' : 'holds as something other than a string id'}`,\n\t\t);\n\t}\n\treturn value;\n}\n",
-    "/**\n * The engine: `permissions({ model, store })`, the traversal behind `can()`,\n * and the same traversal run backwards behind `list()` — `walk.ts` and\n * `reverse.ts`; what a caller passes is read in `input.ts`.\n *\n * **The invariant, permission side.** A denial is `false` — never a thrown\n * error, which is how Keto's historical endpoint answers and why a denial and\n * an outage look alike there. A failure throws — never `false`, which would\n * deny everybody everything during an outage and say nothing. The store is\n * reached only through `guardRelations`, and `outage.spec.ts` refuses a `catch`\n * anywhere in this directory.\n *\n * **What is walked.** A relation holds when the tuple is stored, or through a\n * subject set holding it (`team:t1#member`), or — for a `fromField` — when the\n * object's field names the subject. A permission holds when any of its rules\n * does: a name of the same object, an arrow to a related object's permission,\n * either under a condition. The walk is sequential and stops at the first\n * grant, so a check reads no more than it needs.\n *\n * **Cycles and depth.** A node already on the current path — a team member of\n * a team member of itself — is cut: that branch grants nothing, and it is not\n * an error, because it is data. Crossing more than `maxDepth` relations *is*\n * an error, `PERMISSION_DEPTH`: an evaluation that stopped half-way decided\n * nothing, and `false` would hide it.\n */\n\nimport { guardRelations } from '../auth/outage';\nimport type { CursorPage } from '../pagination/cursor-page';\nimport { pageLimit } from '../pagination/cursor-page';\nimport { objectOf, subjectOf, tupleOf, typeOf } from './input';\nimport type { ModelConfig, PermissionModel, Permissions } from './model';\nimport { resolvedOf } from './model';\nimport type { RelationStore } from './port/types';\nimport { Reverse } from './reverse';\nimport { Walk } from './walk';\n\n/** Deep enough for any hierarchy a person draws; OpenFGA's default too. */\nconst DEFAULT_MAX_DEPTH = 25;\n\nconst REQUIRED = [\n\t'write',\n\t'has',\n\t'findSubjectSets',\n\t'findEntities',\n\t'findObjects',\n\t'deleteEntity',\n] as const;\n\nexport interface PermissionsOptions<C extends ModelConfig> {\n\t/** What `defineModel()` answered. */\n\treadonly model: PermissionModel<C>;\n\t/** Where tuples live. `createMemoryRelations()` in tests. */\n\treadonly store: RelationStore;\n\t/** How many relations a check may cross. `25` when absent. */\n\treadonly maxDepth?: number;\n}\n\n/**\n * Binds a model to a relation store. Connects to nothing.\n *\n * ```ts\n * const access = permissions({ model, store: createMemoryRelations() });\n * await access.grant({ type: 'team', id: 't1' }, 'member', staff);\n * await access.can(staff, 'view', { type: 'record', ...record }, { ctx: { onShift } });\n * ```\n */\nexport function permissions<C extends ModelConfig>(\n\toptions: PermissionsOptions<C>,\n): Permissions<C> {\n\tconst where = 'permissions';\n\tconst model = resolvedOf(options.model);\n\tconst maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;\n\tif (!Number.isInteger(maxDepth) || maxDepth < 1) {\n\t\tthrow new TypeError(`${where}: maxDepth must be a positive integer`);\n\t}\n\tconst raw = options.store as unknown as Record<string, unknown> | undefined;\n\tfor (const method of REQUIRED) {\n\t\tif (typeof raw?.[method] !== 'function') {\n\t\t\tthrow new TypeError(`${where}: store.${method} is missing`);\n\t\t}\n\t}\n\tconst store = guardRelations(options.store);\n\n\tconst check = async (\n\t\tsubject: unknown,\n\t\tpermission: string,\n\t\tobject: unknown,\n\t\toptions?: { readonly ctx?: unknown },\n\t): Promise<boolean> => {\n\t\t// Anonymous, before anything else — and before the store.\n\t\tif (subject === null || subject === undefined) return false;\n\n\t\tconst root = objectOf(model, object, 'can');\n\t\tconst type = typeOf(model, root.type, 'can');\n\t\tif (!type.relations.has(permission) && !type.permissions.has(permission)) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`can: \"${permission}\" is not a relation or a permission of ${type.name}`,\n\t\t\t);\n\t\t}\n\n\t\treturn new Walk(\n\t\t\tmodel,\n\t\t\tstore,\n\t\t\tmaxDepth,\n\t\t\toptions?.ctx,\n\t\t\t`${type.name}#${permission}`,\n\t\t).holds(\n\t\t\tsubjectOf(model, subject, 'can'),\n\t\t\t{ entity: { type: root.type, id: root.id }, data: root.data },\n\t\t\tpermission,\n\t\t\t0,\n\t\t);\n\t};\n\n\tconst list = async (\n\t\tsubject: unknown,\n\t\tpermission: string,\n\t\ttypeName: unknown,\n\t\toptions?: {\n\t\t\treadonly ctx?: unknown;\n\t\t\treadonly after?: string | null;\n\t\t\treadonly limit?: number;\n\t\t},\n\t): Promise<CursorPage<string>> => {\n\t\tconst limit = pageLimit(options?.limit, 'list');\n\t\tconst after = options?.after ?? null;\n\t\tif (after !== null && typeof after !== 'string') {\n\t\t\tthrow new TypeError(\n\t\t\t\t'list: after must be the nextCursor of a page, or null',\n\t\t\t);\n\t\t}\n\t\t// Anonymous holds nothing, and the store is not asked.\n\t\tif (subject === null || subject === undefined) {\n\t\t\treturn { items: [], nextCursor: null };\n\t\t}\n\n\t\tif (typeof typeName !== 'string') {\n\t\t\tthrow new TypeError('list: the type must be an object type of the model');\n\t\t}\n\t\tconst type = typeOf(model, typeName, 'list');\n\t\tif (!type.relations.has(permission) && !type.permissions.has(permission)) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`list: \"${permission}\" is not a relation or a permission of ${type.name}`,\n\t\t\t);\n\t\t}\n\n\t\tconst ids = await new Reverse(\n\t\t\tmodel,\n\t\t\tstore,\n\t\t\tmaxDepth,\n\t\t\toptions?.ctx,\n\t\t\tsubjectOf(model, subject, 'list'),\n\t\t\t`${type.name}#${permission}`,\n\t\t).objects(type.name, permission);\n\n\t\tconst rest = [...ids].sort().filter((id) => after === null || id > after);\n\t\tconst items = rest.slice(0, limit);\n\t\tconst last = items.at(-1);\n\t\treturn {\n\t\t\titems,\n\t\t\tnextCursor: rest.length > limit && last !== undefined ? last : null,\n\t\t};\n\t};\n\n\tconst change =\n\t\t(operation: 'grant' | 'revoke') =>\n\t\tasync (object: unknown, relation: string, subject: unknown) => {\n\t\t\tconst tuple = tupleOf(model, object, relation, subject, operation);\n\t\t\tawait store.write(\n\t\t\t\toperation === 'grant' ? { add: [tuple] } : { remove: [tuple] },\n\t\t\t);\n\t\t};\n\n\treturn Object.freeze({\n\t\tmodel: options.model,\n\t\tcan: check as Permissions<C>['can'],\n\t\tlist: list as Permissions<C>['list'],\n\t\tgrant: change('grant') as Permissions<C>['grant'],\n\t\trevoke: change('revoke') as Permissions<C>['revoke'],\n\t});\n}\n"
+    "/**\n * The engine: `permissions({ model, store })`, the traversal behind `can()`,\n * and the same traversal run backwards behind `list()` — `walk.ts` and\n * `reverse.ts`; what a caller passes is read in `input.ts`.\n *\n * **The invariant, permission side.** A denial is `false` — never a thrown\n * error, which is how Keto's historical endpoint answers and why a denial and\n * an outage look alike there. A failure throws — never `false`, which would\n * deny everybody everything during an outage and say nothing. The store is\n * reached only through `guardRelations`, and `outage.spec.ts` refuses a `catch`\n * anywhere in this directory.\n *\n * **What is walked.** A relation holds when the tuple is stored, or through a\n * subject set holding it (`team:t1#member`), or — for a `fromField` — when the\n * object's field names the subject. A permission holds when any of its rules\n * does: a name of the same object, an arrow to a related object's permission,\n * either under a condition. The walk is sequential and stops at the first\n * grant, so a check reads no more than it needs.\n *\n * **Cycles and depth.** A node already on the current path — a team member of\n * a team member of itself — is cut: that branch grants nothing, and it is not\n * an error, because it is data. Crossing more than `maxDepth` relations *is*\n * an error, `PERMISSION_DEPTH`: an evaluation that stopped half-way decided\n * nothing, and `false` would hide it.\n */\n\nimport type { CursorPage } from '../pagination/cursor-page';\nimport { pageLimit } from '../pagination/cursor-page';\nimport { guardRelations } from '../stores/guard';\nimport { objectOf, subjectOf, tupleOf, typeOf } from './input';\nimport type { ModelConfig, PermissionModel, Permissions } from './model';\nimport { resolvedOf } from './model';\nimport type { RelationStore } from './port/types';\nimport { Reverse } from './reverse';\nimport { Walk } from './walk';\n\n/** Deep enough for any hierarchy a person draws; OpenFGA's default too. */\nconst DEFAULT_MAX_DEPTH = 25;\n\nconst REQUIRED = [\n\t'write',\n\t'has',\n\t'findSubjectSets',\n\t'findEntities',\n\t'findObjects',\n\t'deleteEntity',\n] as const;\n\nexport interface PermissionsOptions<C extends ModelConfig> {\n\t/** What `defineModel()` answered. */\n\treadonly model: PermissionModel<C>;\n\t/** Where tuples live. `createMemoryRelations()` in tests. */\n\treadonly store: RelationStore;\n\t/** How many relations a check may cross. `25` when absent. */\n\treadonly maxDepth?: number;\n}\n\n/**\n * Binds a model to a relation store. Connects to nothing.\n *\n * ```ts\n * const access = permissions({ model, store: createMemoryRelations() });\n * await access.grant({ type: 'team', id: 't1' }, 'member', staff);\n * await access.can(staff, 'view', { type: 'record', ...record }, { ctx: { onShift } });\n * ```\n */\nexport function permissions<C extends ModelConfig>(\n\toptions: PermissionsOptions<C>,\n): Permissions<C> {\n\tconst where = 'permissions';\n\tconst model = resolvedOf(options.model);\n\tconst maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;\n\tif (!Number.isInteger(maxDepth) || maxDepth < 1) {\n\t\tthrow new TypeError(`${where}: maxDepth must be a positive integer`);\n\t}\n\tconst raw = options.store as unknown as Record<string, unknown> | undefined;\n\tfor (const method of REQUIRED) {\n\t\tif (typeof raw?.[method] !== 'function') {\n\t\t\tthrow new TypeError(`${where}: store.${method} is missing`);\n\t\t}\n\t}\n\tconst store = guardRelations(options.store);\n\n\tconst check = async (\n\t\tsubject: unknown,\n\t\tpermission: string,\n\t\tobject: unknown,\n\t\toptions?: { readonly ctx?: unknown },\n\t): Promise<boolean> => {\n\t\t// Anonymous, before anything else — and before the store.\n\t\tif (subject === null || subject === undefined) return false;\n\n\t\tconst root = objectOf(model, object, 'can');\n\t\tconst type = typeOf(model, root.type, 'can');\n\t\tif (!type.relations.has(permission) && !type.permissions.has(permission)) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`can: \"${permission}\" is not a relation or a permission of ${type.name}`,\n\t\t\t);\n\t\t}\n\n\t\treturn new Walk(\n\t\t\tmodel,\n\t\t\tstore,\n\t\t\tmaxDepth,\n\t\t\toptions?.ctx,\n\t\t\t`${type.name}#${permission}`,\n\t\t).holds(\n\t\t\tsubjectOf(model, subject, 'can'),\n\t\t\t{ entity: { type: root.type, id: root.id }, data: root.data },\n\t\t\tpermission,\n\t\t\t0,\n\t\t);\n\t};\n\n\tconst list = async (\n\t\tsubject: unknown,\n\t\tpermission: string,\n\t\ttypeName: unknown,\n\t\toptions?: {\n\t\t\treadonly ctx?: unknown;\n\t\t\treadonly after?: string | null;\n\t\t\treadonly limit?: number;\n\t\t},\n\t): Promise<CursorPage<string>> => {\n\t\tconst limit = pageLimit(options?.limit, 'list');\n\t\tconst after = options?.after ?? null;\n\t\tif (after !== null && typeof after !== 'string') {\n\t\t\tthrow new TypeError(\n\t\t\t\t'list: after must be the nextCursor of a page, or null',\n\t\t\t);\n\t\t}\n\t\t// Anonymous holds nothing, and the store is not asked.\n\t\tif (subject === null || subject === undefined) {\n\t\t\treturn { items: [], nextCursor: null };\n\t\t}\n\n\t\tif (typeof typeName !== 'string') {\n\t\t\tthrow new TypeError('list: the type must be an object type of the model');\n\t\t}\n\t\tconst type = typeOf(model, typeName, 'list');\n\t\tif (!type.relations.has(permission) && !type.permissions.has(permission)) {\n\t\t\tthrow new TypeError(\n\t\t\t\t`list: \"${permission}\" is not a relation or a permission of ${type.name}`,\n\t\t\t);\n\t\t}\n\n\t\tconst ids = await new Reverse(\n\t\t\tmodel,\n\t\t\tstore,\n\t\t\tmaxDepth,\n\t\t\toptions?.ctx,\n\t\t\tsubjectOf(model, subject, 'list'),\n\t\t\t`${type.name}#${permission}`,\n\t\t).objects(type.name, permission);\n\n\t\tconst rest = [...ids].sort().filter((id) => after === null || id > after);\n\t\tconst items = rest.slice(0, limit);\n\t\tconst last = items.at(-1);\n\t\treturn {\n\t\t\titems,\n\t\t\tnextCursor: rest.length > limit && last !== undefined ? last : null,\n\t\t};\n\t};\n\n\tconst change =\n\t\t(operation: 'grant' | 'revoke') =>\n\t\tasync (object: unknown, relation: string, subject: unknown) => {\n\t\t\tconst tuple = tupleOf(model, object, relation, subject, operation);\n\t\t\tawait store.write(\n\t\t\t\toperation === 'grant' ? { add: [tuple] } : { remove: [tuple] },\n\t\t\t);\n\t\t};\n\n\treturn Object.freeze({\n\t\tmodel: options.model,\n\t\tcan: check as Permissions<C>['can'],\n\t\tlist: list as Permissions<C>['list'],\n\t\tgrant: change('grant') as Permissions<C>['grant'],\n\t\trevoke: change('revoke') as Permissions<C>['revoke'],\n\t});\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;AAwBO,SAAS,MAAM,CAAC,SAA4B,SAA2B;AAAA,EAC7E,OAAO,QAAQ,KAAK,CAAC,WACpB,OAAO,SAAS,SACb,EAAE,cAAc,YAAY,OAAO,SAAS,QAAQ,QACpD,cAAc,YACf,OAAO,SAAS,QAAQ,QACxB,OAAO,aAAa,QAAQ,QAC/B;AAAA;AAmCD,IAAM,OAAO;AAEb,IAAM,QAAQ;AAEd,IAAM,WAAW,CAAC,UACjB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAE7D,SAAS,YAAY,CAC3B,QACA,OACgB;AAAA,EAChB,MAAM,SAAS,CAAC,YAAoB,IAAI,UAAU,GAAG,UAAU,SAAS;AAAA,EAExE,IAAI,CAAC,SAAS,MAAM;AAAA,IAAG,MAAM,OAAO,0BAA0B;AAAA,EAC9D,IAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAAA,IACpC,MAAM,OACL,wEACD;AAAA,EACD;AAAA,EACA,WAAW,WAAW,OAAO,UAAU;AAAA,IACtC,IAAI,OAAO,YAAY,YAAY,CAAC,KAAK,KAAK,OAAO,GAAG;AAAA,MACvD,MAAM,OACL,qBAAqB,OAAO,OAAO,6BACpC;AAAA,IACD;AAAA,EACD;AAAA,EACA,MAAM,WAAW,IAAI,IAAY,OAAO,QAAQ;AAAA,EAEhD,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,OAAO,KAAK,OAAO,KAAK,EAAE,WAAW,GAAG;AAAA,IACtE,MAAM,OAAO,+BAA+B;AAAA,EAC7C;AAAA,EACA,MAAM,YAAY,IAAI,IAAI,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,EACnD,WAAW,QAAQ,WAAW;AAAA,IAC7B,IAAI,CAAC,KAAK,KAAK,IAAI,GAAG;AAAA,MACrB,MAAM,OACL,oBAAoB,uFACrB;AAAA,IACD;AAAA,IACA,IAAI,SAAS,IAAI,IAAI,GAAG;AAAA,MACvB,MAAM,OACL,IAAI,kEAAkE,0BACvE;AAAA,IACD;AAAA,EACD;AAAA,EAIA,MAAM,gBAAgB,IAAI;AAAA,EAC1B,MAAM,kBAAkB,IAAI;AAAA,EAC5B,YAAY,MAAM,QAAQ,OAAO,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvD,MAAM,KAAK,SAAS;AAAA,IACpB,IAAI,CAAC,SAAS,GAAG;AAAA,MAAG,MAAM,OAAO,GAAG,sBAAsB;AAAA,IAC1D,WAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAAA,MACnC,IAAI,QAAQ,eAAe,QAAQ,eAAe;AAAA,QACjD,MAAM,OAAO,GAAG,MAAM,oCAAoC;AAAA,MAC3D;AAAA,IACD;AAAA,IACA,cAAc,IAAI,MAAM,QAAQ,IAAI,WAAW,GAAG,gBAAgB,MAAM,CAAC;AAAA,IACzE,MAAM,cAAc,QAAQ,IAAI,aAAa,GAAG,kBAAkB,MAAM;AAAA,IACxE,WAAW,cAAc,aAAa;AAAA,MACrC,IAAI,cAAc,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG;AAAA,QAC7C,MAAM,OACL,GAAG,QAAQ,2DACZ;AAAA,MACD;AAAA,IACD;AAAA,IACA,gBAAgB,IAAI,MAAM,WAAW;AAAA,EACtC;AAAA,EAEA,MAAM,gBAAgB,CAAC,SACtB,SAAS,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI;AAAA,EACzC,MAAM,UAAU,CAAC,SAChB,IAAI,IAAI;AAAA,IACP,GAAI,cAAc,IAAI,IAAI,KAAK,CAAC;AAAA,IAChC,GAAI,gBAAgB,IAAI,IAAI,KAAK,CAAC;AAAA,EACnC,CAAC;AAAA,EAEF,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,MAAM,QAAQ,OAAO,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvD,MAAM,KAAK,SAAS;AAAA,IACpB,MAAM,YAAY,IAAI;AAAA,IAEtB,YAAY,UAAU,YAAY,OAAO,QAAQ,IAAI,aAAa,CAAC,CAAC,GAAG;AAAA,MACtE,MAAM,OAAO,GAAG,gBAAgB;AAAA,MAChC,UAAU,IACT,UACA,gBAAgB,SAAS,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,MACD,CAAC,CACF;AAAA,IACD;AAAA,IAEA,MAAM,cAAc,IAAI;AAAA,IACxB,YAAY,YAAY,UAAU,OAAO,QAAQ,IAAI,eAAe,CAAC,CAAC,GAAG;AAAA,MACxE,MAAM,OAAO,GAAG,kBAAkB;AAAA,MAClC,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;AAAA,QAChD,MAAM,OAAO,GAAG,yCAAyC;AAAA,MAC1D;AAAA,MACA,YAAY,IACX,YACA,MAAM,IAAI,CAAC,MAAe,UACzB,YAAY,MAAM,GAAG,QAAQ,UAAU;AAAA,QACtC;AAAA,QACA,KAAK,QAAQ,IAAI;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,MACP,CAAC,CACF,CACD;AAAA,IACD;AAAA,IAEA,MAAM,IAAI,MAAM,EAAE,MAAM,WAAW,YAAY,CAAC;AAAA,EACjD;AAAA,EAEA,YAAY,OAAO,MAAM;AAAA,EACzB,qBAAqB,OAAO,MAAM;AAAA,EAElC,OAAO,EAAE,UAAU,MAAM;AAAA;AAG1B,SAAS,OAAO,CACf,OACA,IACA,QACc;AAAA,EACd,IAAI,UAAU;AAAA,IAAW,OAAO,IAAI;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,OAAO,GAAG,sBAAsB;AAAA,EAC5D,WAAW,QAAQ,OAAO,KAAK,KAAK,GAAG;AAAA,IACtC,IAAI,CAAC,KAAK,KAAK,IAAI,GAAG;AAAA,MACrB,MAAM,OACL,GAAG,QAAQ,uFACZ;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC;AAAA;AAGlC,SAAS,eAAe,CACvB,OACA;AAAA,EAEC;AAAA,EACA;AAAA,EACA;AAAA,GAMkB;AAAA,EACnB,IAAI,SAAS,KAAK,KAAK,MAAM,SAAS,aAAa;AAAA,IAClD,QAAQ,OAAO,SAAS,WAAW;AAAA,IACnC,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,KAAK,GAAG;AAAA,MACpD,MAAM,OAAO,GAAG,6CAA6C;AAAA,IAC9D;AAAA,IACA,IAAI,OAAO,YAAY,YAAY,CAAC,cAAc,OAAO,GAAG;AAAA,MAC3D,MAAM,OACL,GAAG,0BAA0B,OAAO,OAAO,iCAC5C;AAAA,IACD;AAAA,IACA,IAAI,WAAW,aAAa,OAAO,WAAW,YAAY;AAAA,MACzD,MAAM,OAAO,GAAG,6CAA6C;AAAA,IAC9D;AAAA,IACA,OAAO,WAAW,YACf,EAAE,MAAM,aAAa,OAAO,QAAQ,IACpC;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,IACD;AAAA,EACH;AAAA,EAEA,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;AAAA,IAChD,MAAM,OACL,GAAG,iEACJ;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,IAAI,CAAC,WAA4B;AAAA,IACtD,IAAI,OAAO,WAAW,UAAU;AAAA,MAC/B,MAAM,OAAO,GAAG,iCAAiC;AAAA,IAClD;AAAA,IACA,MAAM,OAAO,OAAO,QAAQ,GAAG;AAAA,IAC/B,IAAI,OAAO,GAAG;AAAA,MACb,IAAI,CAAC,cAAc,MAAM,GAAG;AAAA,QAC3B,MAAM,OAAO,GAAG,UAAU,+BAA+B;AAAA,MAC1D;AAAA,MACA,OAAO,EAAE,MAAM,QAAQ,MAAM,OAAO;AAAA,IACrC;AAAA,IACA,MAAM,OAAO,OAAO,MAAM,GAAG,IAAI;AAAA,IACjC,MAAM,WAAW,OAAO,MAAM,OAAO,CAAC;AAAA,IACtC,IAAI,CAAC,cAAc,IAAI,IAAI,GAAG,IAAI,QAAQ,GAAG;AAAA,MAC5C,MAAM,OACL,GAAG,UAAU,qFACd;AAAA,IACD;AAAA,IACA,OAAO,EAAE,MAAM,OAAO,MAAM,SAAS;AAAA,GACrC;AAAA,EACD,OAAO,EAAE,MAAM,UAAU,QAAQ;AAAA;AAGlC,SAAS,WAAW,CACnB,OACA,MACA,SAQe;AAAA,EACf,QAAQ,WAAW;AAAA,EAEnB,IAAI,SAAS,KAAK,KAAK,MAAM,SAAS,QAAQ;AAAA,IAC7C,IAAI,OAAO,MAAM,SAAS,YAAY;AAAA,MACrC,MAAM,OAAO,GAAG,2CAA2C;AAAA,IAC5D;AAAA,IACA,MAAM,QAAQ,YAAY,MAAM,MAAM,MAAM,OAAO;AAAA,IACnD,OAAO,KAAK,OAAO,MAAM,MAAM,KAAgC;AAAA,EAChE;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,MAAM,OAAO,GAAG,6CAA6C;AAAA,EAC9D;AAAA,EAEA,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAAA,EAChC,IAAI,QAAQ,GAAG;AAAA,IACd,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG;AAAA,MAC5B,MAAM,OACL,GAAG,UAAU,+CAA+C,QAAQ,MACrE;AAAA,IACD;AAAA,IACA,OAAO,EAAE,MAAM,QAAQ,MAAM,MAAM;AAAA,EACpC;AAAA,EAEA,MAAM,WAAW,MAAM,MAAM,GAAG,KAAK;AAAA,EACrC,MAAM,SAAS,MAAM,MAAM,QAAQ,CAAC;AAAA,EACpC,MAAM,UAAU,QAAQ,UAAU,IAAI,QAAQ;AAAA,EAC9C,IAAI,YAAY,WAAW;AAAA,IAC1B,MAAM,OACL,GAAG,UAAU,wBAAwB,yCAAyC,QAAQ,MACvF;AAAA,EACD;AAAA,EACA,MAAM,UACL,QAAQ,SAAS,cACd,CAAC,QAAQ,OAAO,IAChB,QAAQ,QAAQ,IAAI,CAAC,WACrB,OAAO,SAAS,SAAS,OAAO,OAAO,IACxC;AAAA,EACH,WAAW,QAAQ,SAAS;AAAA,IAE3B,IAAI,SAAS,QAAQ,CAAC,QAAQ,UAAU,IAAI,IAAI,GAAG;AAAA,MAClD,MAAM,OACL,GAAG,UAAU,wBAAwB,6BAA6B,SAAS,OAAO,kBAAkB,KAAK,4CAC1G;AAAA,IACD;AAAA,IACA,IAAI,CAAC,QAAQ,QAAQ,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,MACvC,MAAM,OACL,GAAG,UAAU,iBAAiB,kBAAkB,uBACjD;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,UAAU,OAAO;AAAA;AAS1C,SAAS,WAAW,CACnB,OACA,QACO;AAAA,EACP,WAAW,QAAQ,MAAM,OAAO,GAAG;AAAA,IAClC,MAAM,WAAqB,CAAC;AAAA,IAC5B,MAAM,OAAO,IAAI;AAAA,IAEjB,MAAM,QAAQ,CAAC,eAA6B;AAAA,MAC3C,IAAI,KAAK,IAAI,UAAU;AAAA,QAAG;AAAA,MAC1B,MAAM,OAAO,SAAS,QAAQ,UAAU;AAAA,MACxC,IAAI,QAAQ,GAAG;AAAA,QACd,MAAM,OACL,SAAS,KAAK,qBAAqB,CAAC,GAAG,SAAS,MAAM,IAAI,GAAG,UAAU,EAAE,KAAK,KAAK,8BACpF;AAAA,MACD;AAAA,MACA,SAAS,KAAK,UAAU;AAAA,MACxB,WAAW,QAAQ,KAAK,YAAY,IAAI,UAAU,KAAK,CAAC,GAAG;AAAA,QAC1D,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAAI,KAAK,IAAI,GAAG;AAAA,UAC5D,MAAM,KAAK,IAAI;AAAA,QAChB;AAAA,MACD;AAAA,MACA,SAAS,IAAI;AAAA,MACb,KAAK,IAAI,UAAU;AAAA;AAAA,IAGpB,WAAW,cAAc,KAAK,YAAY,KAAK;AAAA,MAAG,MAAM,UAAU;AAAA,EACnE;AAAA;AAUD,SAAS,oBAAoB,CAC5B,OACA,QACO;AAAA,EAEP,MAAM,YAAY,CAAC,MAA0B,SAAgC;AAAA,IAC5E,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;AAAA,IACxC,IAAI,aAAa,WAAW;AAAA,MAC3B,OAAO,SAAS,SAAS,cAAc,SAAS,QAAQ;AAAA,IACzD;AAAA,IACA,WAAW,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG;AAAA,MACpD,MAAM,QACL,KAAK,SAAS,SACX,UAAU,MAAM,KAAK,IAAI,IAE1B,UAAU,MAAM,KAAK,QAAQ;AAAA,MAChC,IAAI,UAAU;AAAA,QAAM,OAAO;AAAA,IAC5B;AAAA,IACA,OAAO;AAAA;AAAA,EAGR,WAAW,QAAQ,MAAM,OAAO,GAAG;AAAA,IAClC,YAAY,UAAU,QAAQ,KAAK,WAAW;AAAA,MAC7C,IAAI,IAAI,SAAS;AAAA,QAAU;AAAA,MAC3B,WAAW,UAAU,IAAI,SAAS;AAAA,QACjC,IAAI,OAAO,SAAS;AAAA,UAAO;AAAA,QAC3B,MAAM,SAAS,MAAM,IAAI,OAAO,IAAI;AAAA,QACpC,MAAM,QACL,WAAW,YAAY,OAAO,UAAU,QAAQ,OAAO,QAAQ;AAAA,QAChE,IAAI,UAAU,MAAM;AAAA,UACnB,MAAM,OACL,SAAS,KAAK,kBAAkB,cAAc,OAAO,QAAQ,OAAO,mBAAmB,OAAO,QAAQ,oCAAoC,OAAO,0EAClJ;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,IACA,YAAY,YAAY,UAAU,KAAK,aAAa;AAAA,MACnD,WAAW,QAAQ,OAAO;AAAA,QACzB,IAAI,KAAK,SAAS;AAAA,UAAS;AAAA,QAC3B,MAAM,UAAU,KAAK,UAAU,IAAI,KAAK,QAAQ;AAAA,QAChD,MAAM,UACL,SAAS,SAAS,cACf,CAAC,QAAQ,OAAO,KACf,SAAS,WAAW,CAAC,GAAG,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,QACxD,WAAW,QAAQ,SAAS;AAAA,UAC3B,MAAM,SAAS,MAAM,IAAI,IAAI;AAAA,UAC7B,MAAM,QACL,WAAW,YAAY,OAAO,UAAU,QAAQ,KAAK,MAAM;AAAA,UAC5D,IAAI,UAAU,MAAM;AAAA,YACnB,MAAM,OACL,SAAS,KAAK,oBAAoB,gBAAgB,KAAK,aAAa,KAAK,mBAAmB,QAAQ,KAAK,uBAAuB,QAAQ,yGACzI;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;;;AC7aD,IAAM,WAAW;AAEjB,IAAM,YAAW,CAAC,UACjB,OAAO,UAAU,YAAY,UAAU;AAEjC,SAAS,IAAI,CAAC,OAAgB,MAAc,OAAuB;AAAA,EACzE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,SAAS,KAAK,KAAK,GAAG;AAAA,IACtE,MAAM,IAAI,UACT,GAAG,UAAU,6DACd;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,MAAM,CACrB,OACA,MACA,OACqB;AAAA,EACrB,MAAM,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA,EACjC,IAAI,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,UACT,GAAG,WAAW,0CACf;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,QAAQ,CACvB,OACA,OACA,OAKC;AAAA,EACD,IAAI,CAAC,UAAS,KAAK,KAAK,OAAO,MAAM,SAAS,UAAU;AAAA,IACvD,MAAM,IAAI,UACT,GAAG,qDACJ;AAAA,EACD;AAAA,EACA,OAAO,OAAO,MAAM,MAAM,KAAK;AAAA,EAC/B,OAAO;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,IAAI,KAAK,MAAM,IAAI,iBAAiB,KAAK;AAAA,IACzC,MAAM;AAAA,EACP;AAAA;AAWM,SAAS,SAAS,CACxB,OACA,OACA,OACU;AAAA,EACV,IAAI,CAAC,UAAS,KAAK,KAAK,OAAO,MAAM,SAAS,UAAU;AAAA,IACvD,MAAM,IAAI,UACT,GAAG,oDACJ;AAAA,EACD;AAAA,EACA,MAAM,KAAK,KAAK,MAAM,IAAI,kBAAkB,KAAK;AAAA,EACjD,IAAI,MAAM,SAAS,IAAI,MAAM,IAAI;AAAA,IAAG,OAAO,EAAE,MAAM,MAAM,MAAM,GAAG;AAAA,EAElE,MAAM,OAAO,OAAO,OAAO,MAAM,MAAM,KAAK;AAAA,EAC5C,IAAI,OAAO,MAAM,aAAa;AAAA,IAAU,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG;AAAA,EACrE,IAAI,CAAC,KAAK,UAAU,IAAI,MAAM,QAAQ,GAAG;AAAA,IACxC,MAAM,IAAI,UACT,GAAG,WAAW,MAAM,kCAAkC,KAAK,YAAY,KAAK,QAAQ,MAAM,MAAM,4BACjG;AAAA,EACD;AAAA,EACA,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,UAAU,MAAM,SAAS;AAAA;AAIjD,SAAS,OAAO,CACtB,OACA,QACA,UACA,SACA,OACC;AAAA,EACD,MAAM,SAAS,SAAS,OAAO,QAAQ,KAAK;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,EAC7C,MAAM,MAAM,KAAK,UAAU,IAAI,QAAQ;AAAA,EACvC,IAAI,QAAQ,WAAW;AAAA,IACtB,MAAM,IAAI,UACT,GAAG,WAAW,kCAAkC,KAAK,MACtD;AAAA,EACD;AAAA,EACA,IAAI,IAAI,SAAS,aAAa;AAAA,IAC7B,MAAM,IAAI,UACT,GAAG,UAAU,KAAK,QAAQ,yBAAyB,IAAI,iDAAiD,KAAK,cAC9G;AAAA,EACD;AAAA,EAEA,MAAM,MAAM,UAAU,OAAO,SAAS,KAAK;AAAA,EAC3C,IAAI,CAAC,OAAO,IAAI,SAAS,GAAG,GAAG;AAAA,IAC9B,MAAM,IAAI,UACT,GAAG,UAAU,KAAK,QAAQ,2BAA2B,cAAc,MAAM,GAAG,IAAI,QAAQ,IAAI,aAAa,IAAI,MAC9G;AAAA,EACD;AAAA,EAEA,OAAO;AAAA,IACN,QAAQ,EAAE,MAAM,OAAO,MAAM,IAAI,OAAO,GAAG;AAAA,IAC3C;AAAA,IACA,SAAS;AAAA,EACV;AAAA;;;AC9CM,SAAS,SAAS,CACxB,OACA,SACA,SACY;AAAA,EACZ,OAAO,OAAO,OACb,YAAY,YACT,EAAE,MAAM,aAAsB,OAAO,QAAQ,IAC7C,EAAE,MAAM,aAAsB,OAAO,SAAS,QAAQ,QAAQ,OAAO,CACzE;AAAA;AAiBM,SAAS,IAAoC,CACnD,MACA,MACkB;AAAA,EAClB,OAAO,OAAO,OAAO,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC;AAAA;AAkgBlD,IAAM,WAAW,IAAI;AA+Bd,SAAS,WAAwC,CACvD,QACqB;AAAA,EACrB,MAAM,WAAW,aAAa,QAAQ,aAAa;AAAA,EACnD,MAAM,QAA4B,OAAO,OAAO;AAAA,IAC/C,UAAU,CAAC,GAAG,SAAS,QAAQ;AAAA,IAC/B,OAAO,CAAC,GAAG,SAAS,MAAM,KAAK,CAAC;AAAA,IAChC,YAAY;AAAA,EACb,CAAC;AAAA,EACD,SAAS,IAAI,OAAO,QAAQ;AAAA,EAC5B,OAAO;AAAA;AAID,SAAS,UAAU,CAAC,OAA8B;AAAA,EACxD,MAAM,WAAW,SAAS,IAAI,KAAK;AAAA,EACnC,IAAI,aAAa,WAAW;AAAA,IAC3B,MAAM,IAAI,UACT,0FACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA;;;AC7nBD,MAAM,QAAQ;AAAA,EAMpB,WAAW,CACO,OACA,OACA,UACA,KACA,SACA,UAChB;AAAA,IANgB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAXV,gBAAW,IAAI;AAAA,IACf,eAAU,IAAI;AAAA,IACL,YAAO,IAAI;AAAA,IACpB,cAAS;AAAA;AAAA,OAWX,QAAO,CAAC,MAAc,MAA4C;AAAA,IACvE,SAAS,QAAQ,EAAG,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,KAAK,UAAU,IAAI;AAAA,MACnB,KAAK,SAAS;AAAA,MACd,MAAM,QAAQ,MAAM,KAAK,MAAM,MAAM,IAAI;AAAA,MACzC,IAAI,CAAC,KAAK,UAAU,KAAK,KAAK;AAAA,QAAG,OAAO;AAAA,MACxC,KAAK,WAAW,KAAK;AAAA,IACtB;AAAA,IACA,MAAM,IAAI,sBACT,iBAAiB,KAAK,8BAA8B,KAAK,wCACzD,EAAE,YAAY,KAAK,UAAU,UAAU,KAAK,SAAS,CACtD;AAAA;AAAA,EAIO,IAAI,GAAY;AAAA,IACvB,YAAY,KAAK,QAAQ,KAAK,SAAS;AAAA,MACtC,KAAK,KAAK,SAAS,IAAI,GAAG,GAAG,QAAQ,OAAO,IAAI;AAAA,QAAM,OAAO;AAAA,IAC9D;AAAA,IACA,OAAO;AAAA;AAAA,OAIM,MAAK,CAClB,UACA,MAC+B;AAAA,IAC/B,MAAM,MAAM,GAAG,YAAY;AAAA,IAC3B,MAAM,OAAO,KAAK,QAAQ,IAAI,GAAG;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,IAAI,KAAK,KAAK,IAAI,GAAG,GAAG;AAAA,MACvB,KAAK,SAAS;AAAA,MACd,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;AAAA,IACtC;AAAA,IAEA,MAAM,OAAO,KAAK,MAAM,MAAM,IAAI,QAAQ;AAAA,IAC1C,IAAI,SAAS;AAAA,MAAW,OAAO,IAAI;AAAA,IAEnC,KAAK,KAAK,IAAI,GAAG;AAAA,IACjB,IAAI;AAAA,MACH,MAAM,QAAQ,KAAK,YAAY,IAAI,IAAI,IACpC,MAAM,KAAK,WAAW,MAAM,IAAI,IAChC,MAAM,KAAK,SAAS,MAAM,IAAI;AAAA,MACjC,KAAK,QAAQ,IAAI,KAAK,KAAK;AAAA,MAC3B,OAAO;AAAA,cACN;AAAA,MACD,KAAK,KAAK,OAAO,GAAG;AAAA;AAAA;AAAA,OAIR,SAAQ,CACrB,MACA,MACuB;AAAA,IACvB,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;AAAA,IACxC,IAAI,aAAa;AAAA,MAAW,OAAO,IAAI;AAAA,IAEvC,IAAI,SAAS,SAAS,aAAa;AAAA,MAClC,MAAM,UAAU,KAAK;AAAA,MACrB,OAAO,cAAc,WAAW,QAAQ,SAAS,SAAS,UACvD,IAAI,MACJ,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM,MAAM,QAAQ,EAAE,CAAC;AAAA,IACrD;AAAA,IAGA,MAAM,QAAQ,IAAI,IACjB,OAAO,SAAS,SAAS,KAAK,OAAO,IAClC,MAAM,KAAK,QAAQ,KAAK,MAAM,MAAM,KAAK,OAAO,IAChD,CAAC,CACL;AAAA,IACA,WAAW,UAAU,SAAS,SAAS;AAAA,MACtC,IAAI,OAAO,SAAS;AAAA,QAAO;AAAA,MAC3B,WAAW,MAAM,MAAM,KAAK,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG;AAAA,QAChE,MAAM,MAAM,EAAE,MAAM,OAAO,MAAM,IAAI,UAAU,OAAO,SAAS;AAAA,QAC/D,WAAW,UAAU,MAAM,KAAK,QAAQ,KAAK,MAAM,MAAM,GAAG,GAAG;AAAA,UAC9D,MAAM,IAAI,MAAM;AAAA,QACjB;AAAA,MACD;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAGM,WAAU,CACvB,MACA,MACuB;AAAA,IACvB,MAAM,QAAQ,IAAI;AAAA,IAClB,WAAW,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG;AAAA,MACpD,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,OAAO,MAAM,MAAM,IAAI;AAAA,QAAG;AAAA,MAE/D,IAAI,KAAK,SAAS,QAAQ;AAAA,QACzB,WAAW,MAAM,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,IAAI;AAAA,UAAG,MAAM,IAAI,EAAE;AAAA,QACrE;AAAA,MACD;AAAA,MACA,WAAW,MAAM,MAAM,KAAK,MAAM,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,QACpE,MAAM,IAAI,EAAE;AAAA,MACb;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAIM,MAAK,CAClB,MACA,UACA,QACuB;AAAA,IACvB,MAAM,UAAU,KAAK,UAAU,IAAI,QAAQ;AAAA,IAC3C,MAAM,QAAQ,IAAI;AAAA,IAClB,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAElC,IAAI,QAAQ,SAAS,aAAa;AAAA,MACjC,WAAW,MAAM,MAAM,KAAK,MAAM,QAAQ,SAAS,MAAM,GAAG;AAAA,QAC3D,WAAW,UAAU,MAAM,KAAK,OAAO,MAAM,UAAU,EAAE,GAAG;AAAA,UAC3D,MAAM,IAAI,MAAM;AAAA,QACjB;AAAA,MACD;AAAA,MACA,OAAO;AAAA,IACR;AAAA,IACA,WAAW,UAAU,QAAQ,SAAS;AAAA,MAErC,IAAI,OAAO,SAAS,UAAU,CAAC,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,GAAG;AAAA,QACjE;AAAA,MACD;AAAA,MACA,WAAW,MAAM,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,QACvD,MAAM,SAAS,EAAE,MAAM,OAAO,MAAM,GAAG;AAAA,QACvC,WAAW,UAAU,MAAM,KAAK,QAAQ,KAAK,MAAM,UAAU,MAAM,GAAG;AAAA,UACrE,MAAM,IAAI,MAAM;AAAA,QACjB;AAAA,MACD;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAIM,QAAO,CACpB,MACA,UACA,SACoB;AAAA,IACpB,MAAM,MAAgB,CAAC;AAAA,IACvB,IAAI,QAAuB;AAAA,IAC3B,GAAG;AAAA,MACF,MAAM,OAA2B,MAAM,KAAK,MAAM,YAAY;AAAA,QAC7D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO;AAAA,MACR,CAAC;AAAA,MACD,IAAI,KAAK,GAAG,KAAK,KAAK;AAAA,MACtB,QAAQ,KAAK;AAAA,IACd,SAAS,UAAU;AAAA,IACnB,OAAO;AAAA;AAAA,OAIM,OAAM,CACnB,MACA,UACA,IAC6B;AAAA,IAC7B,MAAM,MAAM,KAAK,UAAU,IAAI,QAAQ;AAAA,IACvC,IAAI,KAAK,SAAS,eAAe,IAAI,WAAW,WAAW;AAAA,MAC1D,MAAM,IAAI,UACT,SAAS,KAAK,QAAQ,gEAAgE,KAAK,gBAAgB,mBAAmB,KAAK,SAAS,cAAc,IAAI,QAAQ,eAAe,KAAK,SAAS,cAAc,IAAI,UAAU,kBAChO;AAAA,IACD;AAAA,IACA,MAAM,MAAM,MAAM,IAAI,OAAO,EAAE;AAAA,IAC/B,IAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,KAAK,CAAC,SAAS,OAAO,SAAS,QAAQ,GAAG;AAAA,MACxE,MAAM,IAAI,UACT,uBAAuB,KAAK,QAAQ,sCACrC;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,EAIA,MAAM,CACb,MACA,MACA,MACU;AAAA,IACV,IAAI,KAAK,QAAQ,WAAW;AAAA,MAC3B,MAAM,IAAI,UACT,SAAS,KAAK,QAAQ,gEACvB;AAAA,IACD;AAAA,IACA,OAAQ,KAAK,KAAmC,KAAK,GAAG,MAAM;AAAA;AAEhE;;;AC1NO,MAAM,KAAK;AAAA,EAIjB,WAAW,CACO,OACA,OACA,UACA,KACA,UAChB;AAAA,IALgB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAPD,YAAO,IAAI;AAAA;AAAA,OAWtB,MAAK,CACV,SACA,MACA,MACA,OACmB;AAAA,IACnB,IAAI,QAAQ,KAAK,UAAU;AAAA,MAC1B,MAAM,IAAI,sBACT,iBAAiB,KAAK,8BAA8B,KAAK,wCACzD,EAAE,YAAY,KAAK,UAAU,UAAU,KAAK,SAAS,CACtD;AAAA,IACD;AAAA,IAEA,MAAM,MAAM,GAAG,cAAa,KAAK,MAAM,KAAK;AAAA,IAE5C,IAAI,KAAK,KAAK,IAAI,GAAG;AAAA,MAAG,OAAO;AAAA,IAE/B,MAAM,OAAO,KAAK,MAAM,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,IAElD,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAE/B,KAAK,KAAK,IAAI,GAAG;AAAA,IACjB,IAAI;AAAA,MACH,OAAO,KAAK,YAAY,IAAI,IAAI,IAC7B,MAAM,KAAK,WAAW,SAAS,MAAM,MAAM,MAAM,KAAK,IACtD,MAAM,KAAK,SAAS,SAAS,MAAM,MAAM,MAAM,KAAK;AAAA,cACtD;AAAA,MACD,KAAK,KAAK,OAAO,GAAG;AAAA;AAAA;AAAA,OAIR,SAAQ,CACrB,SACA,MACA,MACA,MACA,OACmB;AAAA,IACnB,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;AAAA,IACxC,IAAI,aAAa;AAAA,MAAW,OAAO;AAAA,IAEnC,IAAI,SAAS,SAAS,aAAa;AAAA,MAClC,MAAM,KAAK,QAAQ,MAAM,SAAS,OAAO,GAAG,KAAK,QAAQ,MAAM;AAAA,MAC/D,OACC,OAAO,QACP,EAAE,cAAc,YAChB,QAAQ,SAAS,SAAS,WAC1B,QAAQ,OAAO;AAAA,IAEjB;AAAA,IAGA,IACC,OAAO,SAAS,SAAS,OAAO,KAC/B,MAAM,KAAK,MAAM,IAAI,EAAE,QAAQ,KAAK,QAAQ,UAAU,MAAM,QAAQ,CAAC,GACrE;AAAA,MACD,OAAO;AAAA,IACR;AAAA,IACA,WAAW,OAAO,MAAM,KAAK,MAAM,gBAAgB,KAAK,QAAQ,IAAI,GAAG;AAAA,MACtE,IAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAAA,QAAG;AAAA,MACpC,MAAM,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG,GAAG,MAAM,KAAK;AAAA,MACrE,IAAI,MAAM,KAAK,MAAM,SAAS,SAAS,IAAI,UAAU,QAAQ,CAAC,GAAG;AAAA,QAChE,OAAO;AAAA,MACR;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAGM,WAAU,CACvB,SACA,MACA,MACA,MACA,OACmB;AAAA,IACnB,WAAW,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG;AAAA,MACpD,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,OAAO,MAAM,MAAM,IAAI;AAAA,QAAG;AAAA,MAE/D,IAAI,KAAK,SAAS,QAAQ;AAAA,QACzB,IAAI,MAAM,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK;AAAA,UAAG,OAAO;AAAA,QAC9D;AAAA,MACD;AAAA,MACA,WAAW,UAAU,MAAM,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,GAAG;AAAA,QACnE,IAAI,MAAM,KAAK,MAAM,SAAS,QAAQ,KAAK,QAAQ,QAAQ,CAAC,GAAG;AAAA,UAC9D,OAAO;AAAA,QACR;AAAA,MACD;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,EAIA,MAAM,CACb,MACA,MACA,MACU;AAAA,IACV,IAAI,KAAK,QAAQ,WAAW;AAAA,MAC3B,MAAM,IAAI,UACT,QAAQ,KAAK,QAAQ,gEACtB;AAAA,IACD;AAAA,IACA,OAAQ,KAAK,KAAmC,KAAK,GAAG,MAAM;AAAA;AAAA,OAIjD,QAAO,CACpB,MACA,MACA,UACkB;AAAA,IAClB,MAAM,UAAU,KAAK,UAAU,IAAI,QAAQ;AAAA,IAC3C,IAAI,YAAY;AAAA,MAAW,OAAO,CAAC;AAAA,IAEnC,IAAI,QAAQ,SAAS,aAAa;AAAA,MACjC,MAAM,KAAK,QAAQ,MAAM,QAAQ,OAAO,GAAG,KAAK,QAAQ,UAAU;AAAA,MAClE,OAAO,OAAO,OACX,CAAC,IACD,CAAC,EAAE,QAAQ,EAAE,MAAM,QAAQ,SAAS,GAAG,GAAG,MAAM,KAAK,CAAC;AAAA,IAC1D;AAAA,IAEA,QAAQ,MAAM,KAAK,MAAM,aAAa,KAAK,QAAQ,QAAQ,GACzD,OAAO,CAAC,WAAW,OAAO,QAAQ,SAAS,MAAM,CAAC,EAClD,IAAI,CAAC,YAAY;AAAA,MACjB,QAAQ,EAAE,MAAM,OAAO,MAAM,IAAI,OAAO,GAAG;AAAA,MAC3C,MAAM;AAAA,IACP,EAAE;AAAA;AAEL;AAGA,SAAS,OAAO,CAAC,MAAY,OAAe,MAA6B;AAAA,EACxE,IAAI,KAAK,SAAS,MAAM;AAAA,IAEvB,MAAM,IAAI,UACT,QAAQ,cAAc,oCACvB;AAAA,EACD;AAAA,EACA,MAAM,QAAQ,KAAK,KAAK;AAAA,EACxB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,MAAM,IAAI,UACT,QAAQ,cAAc,2BAA2B,UAAU,YAAY,oDAAoD,6CAC5H;AAAA,EACD;AAAA,EACA,OAAO;AAAA;;;AC7IR,IAAM,oBAAoB;AAE1B,IAAM,WAAW;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAoBO,SAAS,WAAkC,CACjD,SACiB;AAAA,EACjB,MAAM,QAAQ;AAAA,EACd,MAAM,QAAQ,WAAW,QAAQ,KAAK;AAAA,EACtC,MAAM,WAAW,QAAQ,YAAY;AAAA,EACrC,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG;AAAA,IAChD,MAAM,IAAI,UAAU,GAAG,4CAA4C;AAAA,EACpE;AAAA,EACA,MAAM,MAAM,QAAQ;AAAA,EACpB,WAAW,UAAU,UAAU;AAAA,IAC9B,IAAI,OAAO,MAAM,YAAY,YAAY;AAAA,MACxC,MAAM,IAAI,UAAU,GAAG,gBAAgB,mBAAmB;AAAA,IAC3D;AAAA,EACD;AAAA,EACA,MAAM,QAAQ,eAAe,QAAQ,KAAK;AAAA,EAE1C,MAAM,QAAQ,OACb,SACA,YACA,QACA,YACsB;AAAA,IAEtB,IAAI,YAAY,QAAQ,YAAY;AAAA,MAAW,OAAO;AAAA,IAEtD,MAAM,OAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IAC1C,MAAM,OAAO,OAAO,OAAO,KAAK,MAAM,KAAK;AAAA,IAC3C,IAAI,CAAC,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC,KAAK,YAAY,IAAI,UAAU,GAAG;AAAA,MACzE,MAAM,IAAI,UACT,SAAS,oDAAoD,KAAK,MACnE;AAAA,IACD;AAAA,IAEA,OAAO,IAAI,KACV,OACA,OACA,UACA,SAAS,KACT,GAAG,KAAK,QAAQ,YACjB,EAAE,MACD,UAAU,OAAO,SAAS,KAAK,GAC/B,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG,GAAG,MAAM,KAAK,KAAK,GAC5D,YACA,CACD;AAAA;AAAA,EAGD,MAAM,OAAO,OACZ,SACA,YACA,UACA,YAKiC;AAAA,IACjC,MAAM,QAAQ,WAAU,SAAS,OAAO,MAAM;AAAA,IAC9C,MAAM,QAAQ,SAAS,SAAS;AAAA,IAChC,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,MAChD,MAAM,IAAI,UACT,uDACD;AAAA,IACD;AAAA,IAEA,IAAI,YAAY,QAAQ,YAAY,WAAW;AAAA,MAC9C,OAAO,EAAE,OAAO,CAAC,GAAG,YAAY,KAAK;AAAA,IACtC;AAAA,IAEA,IAAI,OAAO,aAAa,UAAU;AAAA,MACjC,MAAM,IAAI,UAAU,oDAAoD;AAAA,IACzE;AAAA,IACA,MAAM,OAAO,OAAO,OAAO,UAAU,MAAM;AAAA,IAC3C,IAAI,CAAC,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC,KAAK,YAAY,IAAI,UAAU,GAAG;AAAA,MACzE,MAAM,IAAI,UACT,UAAU,oDAAoD,KAAK,MACpE;AAAA,IACD;AAAA,IAEA,MAAM,MAAM,MAAM,IAAI,QACrB,OACA,OACA,UACA,SAAS,KACT,UAAU,OAAO,SAAS,MAAM,GAChC,GAAG,KAAK,QAAQ,YACjB,EAAE,QAAQ,KAAK,MAAM,UAAU;AAAA,IAE/B,MAAM,OAAO,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,UAAU,QAAQ,KAAK,KAAK;AAAA,IACxE,MAAM,QAAQ,KAAK,MAAM,GAAG,KAAK;AAAA,IACjC,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,IACxB,OAAO;AAAA,MACN;AAAA,MACA,YAAY,KAAK,SAAS,SAAS,SAAS,YAAY,OAAO;AAAA,IAChE;AAAA;AAAA,EAGD,MAAM,SACL,CAAC,cACD,OAAO,QAAiB,UAAkB,YAAqB;AAAA,IAC9D,MAAM,QAAQ,QAAQ,OAAO,QAAQ,UAAU,SAAS,SAAS;AAAA,IACjE,MAAM,MAAM,MACX,cAAc,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,CAC9D;AAAA;AAAA,EAGF,OAAO,OAAO,OAAO;AAAA,IACpB,OAAO,QAAQ;AAAA,IACf,KAAK;AAAA,IACL;AAAA,IACA,OAAO,OAAO,OAAO;AAAA,IACrB,QAAQ,OAAO,QAAQ;AAAA,EACxB,CAAC;AAAA;",
-  "debugId": "42583EA285837CAD64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;AAwBO,SAAS,MAAM,CAAC,SAA4B,SAA2B;AAAA,EAC7E,OAAO,QAAQ,KAAK,CAAC,WACpB,OAAO,SAAS,SACb,EAAE,cAAc,YAAY,OAAO,SAAS,QAAQ,QACpD,cAAc,YACf,OAAO,SAAS,QAAQ,QACxB,OAAO,aAAa,QAAQ,QAC/B;AAAA;AAmCD,IAAM,OAAO;AAEb,IAAM,QAAQ;AAEd,IAAM,WAAW,CAAC,UACjB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAE7D,SAAS,YAAY,CAC3B,QACA,OACgB;AAAA,EAChB,MAAM,SAAS,CAAC,YAAoB,IAAI,UAAU,GAAG,UAAU,SAAS;AAAA,EAExE,IAAI,CAAC,SAAS,MAAM;AAAA,IAAG,MAAM,OAAO,0BAA0B;AAAA,EAC9D,IAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAAA,IACpC,MAAM,OACL,wFACD;AAAA,EACD;AAAA,EACA,WAAW,WAAW,OAAO,UAAU;AAAA,IACtC,IAAI,OAAO,YAAY,YAAY,CAAC,KAAK,KAAK,OAAO,GAAG;AAAA,MACvD,MAAM,OACL,qBAAqB,OAAO,OAAO,6BACpC;AAAA,IACD;AAAA,EACD;AAAA,EACA,MAAM,WAAW,IAAI,IAAY,OAAO,QAAQ;AAAA,EAEhD,IAAI,CAAC,SAAS,OAAO,KAAK,KAAK,OAAO,KAAK,OAAO,KAAK,EAAE,WAAW,GAAG;AAAA,IACtE,MAAM,OAAO,+BAA+B;AAAA,EAC7C;AAAA,EACA,MAAM,YAAY,IAAI,IAAI,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,EACnD,WAAW,QAAQ,WAAW;AAAA,IAC7B,IAAI,CAAC,KAAK,KAAK,IAAI,GAAG;AAAA,MACrB,MAAM,OACL,oBAAoB,uFACrB;AAAA,IACD;AAAA,IACA,IAAI,SAAS,IAAI,IAAI,GAAG;AAAA,MACvB,MAAM,OACL,IAAI,kEAAkE,0BACvE;AAAA,IACD;AAAA,EACD;AAAA,EAIA,MAAM,gBAAgB,IAAI;AAAA,EAC1B,MAAM,kBAAkB,IAAI;AAAA,EAC5B,YAAY,MAAM,QAAQ,OAAO,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvD,MAAM,KAAK,SAAS;AAAA,IACpB,IAAI,CAAC,SAAS,GAAG;AAAA,MAAG,MAAM,OAAO,GAAG,sBAAsB;AAAA,IAC1D,WAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAAA,MACnC,IAAI,QAAQ,eAAe,QAAQ,eAAe;AAAA,QACjD,MAAM,OAAO,GAAG,MAAM,oCAAoC;AAAA,MAC3D;AAAA,IACD;AAAA,IACA,cAAc,IAAI,MAAM,QAAQ,IAAI,WAAW,GAAG,gBAAgB,MAAM,CAAC;AAAA,IACzE,MAAM,cAAc,QAAQ,IAAI,aAAa,GAAG,kBAAkB,MAAM;AAAA,IACxE,WAAW,cAAc,aAAa;AAAA,MACrC,IAAI,cAAc,IAAI,IAAI,GAAG,IAAI,UAAU,GAAG;AAAA,QAC7C,MAAM,OACL,GAAG,QAAQ,2DACZ;AAAA,MACD;AAAA,IACD;AAAA,IACA,gBAAgB,IAAI,MAAM,WAAW;AAAA,EACtC;AAAA,EAEA,MAAM,gBAAgB,CAAC,SACtB,SAAS,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI;AAAA,EACzC,MAAM,UAAU,CAAC,SAChB,IAAI,IAAI;AAAA,IACP,GAAI,cAAc,IAAI,IAAI,KAAK,CAAC;AAAA,IAChC,GAAI,gBAAgB,IAAI,IAAI,KAAK,CAAC;AAAA,EACnC,CAAC;AAAA,EAEF,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,MAAM,QAAQ,OAAO,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvD,MAAM,KAAK,SAAS;AAAA,IACpB,MAAM,YAAY,IAAI;AAAA,IAEtB,YAAY,UAAU,YAAY,OAAO,QAAQ,IAAI,aAAa,CAAC,CAAC,GAAG;AAAA,MACtE,MAAM,OAAO,GAAG,gBAAgB;AAAA,MAChC,UAAU,IACT,UACA,gBAAgB,SAAS,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA;AAAA,MACD,CAAC,CACF;AAAA,IACD;AAAA,IAEA,MAAM,cAAc,IAAI;AAAA,IACxB,YAAY,YAAY,UAAU,OAAO,QAAQ,IAAI,eAAe,CAAC,CAAC,GAAG;AAAA,MACxE,MAAM,OAAO,GAAG,kBAAkB;AAAA,MAClC,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;AAAA,QAChD,MAAM,OAAO,GAAG,yCAAyC;AAAA,MAC1D;AAAA,MACA,YAAY,IACX,YACA,MAAM,IAAI,CAAC,MAAe,UACzB,YAAY,MAAM,GAAG,QAAQ,UAAU;AAAA,QACtC;AAAA,QACA,KAAK,QAAQ,IAAI;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,MACP,CAAC,CACF,CACD;AAAA,IACD;AAAA,IAEA,MAAM,IAAI,MAAM,EAAE,MAAM,WAAW,YAAY,CAAC;AAAA,EACjD;AAAA,EAEA,YAAY,OAAO,MAAM;AAAA,EACzB,qBAAqB,OAAO,MAAM;AAAA,EAElC,OAAO,EAAE,UAAU,MAAM;AAAA;AAG1B,SAAS,OAAO,CACf,OACA,IACA,QACc;AAAA,EACd,IAAI,UAAU;AAAA,IAAW,OAAO,IAAI;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,OAAO,GAAG,sBAAsB;AAAA,EAC5D,WAAW,QAAQ,OAAO,KAAK,KAAK,GAAG;AAAA,IACtC,IAAI,CAAC,KAAK,KAAK,IAAI,GAAG;AAAA,MACrB,MAAM,OACL,GAAG,QAAQ,uFACZ;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC;AAAA;AAGlC,SAAS,eAAe,CACvB,OACA;AAAA,EAEC;AAAA,EACA;AAAA,EACA;AAAA,GAMkB;AAAA,EACnB,IAAI,SAAS,KAAK,KAAK,MAAM,SAAS,aAAa;AAAA,IAClD,QAAQ,OAAO,SAAS,WAAW;AAAA,IACnC,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,KAAK,GAAG;AAAA,MACpD,MAAM,OAAO,GAAG,6CAA6C;AAAA,IAC9D;AAAA,IACA,IAAI,OAAO,YAAY,YAAY,CAAC,cAAc,OAAO,GAAG;AAAA,MAC3D,MAAM,OACL,GAAG,0BAA0B,OAAO,OAAO,iCAC5C;AAAA,IACD;AAAA,IACA,IAAI,WAAW,aAAa,OAAO,WAAW,YAAY;AAAA,MACzD,MAAM,OAAO,GAAG,6CAA6C;AAAA,IAC9D;AAAA,IACA,OAAO,WAAW,YACf,EAAE,MAAM,aAAa,OAAO,QAAQ,IACpC;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,IACD;AAAA,EACH;AAAA,EAEA,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAAG;AAAA,IAChD,MAAM,OACL,GAAG,iEACJ;AAAA,EACD;AAAA,EACA,MAAM,UAAU,MAAM,IAAI,CAAC,WAA4B;AAAA,IACtD,IAAI,OAAO,WAAW,UAAU;AAAA,MAC/B,MAAM,OAAO,GAAG,iCAAiC;AAAA,IAClD;AAAA,IACA,MAAM,OAAO,OAAO,QAAQ,GAAG;AAAA,IAC/B,IAAI,OAAO,GAAG;AAAA,MACb,IAAI,CAAC,cAAc,MAAM,GAAG;AAAA,QAC3B,MAAM,OAAO,GAAG,UAAU,+BAA+B;AAAA,MAC1D;AAAA,MACA,OAAO,EAAE,MAAM,QAAQ,MAAM,OAAO;AAAA,IACrC;AAAA,IACA,MAAM,OAAO,OAAO,MAAM,GAAG,IAAI;AAAA,IACjC,MAAM,WAAW,OAAO,MAAM,OAAO,CAAC;AAAA,IACtC,IAAI,CAAC,cAAc,IAAI,IAAI,GAAG,IAAI,QAAQ,GAAG;AAAA,MAC5C,MAAM,OACL,GAAG,UAAU,qFACd;AAAA,IACD;AAAA,IACA,OAAO,EAAE,MAAM,OAAO,MAAM,SAAS;AAAA,GACrC;AAAA,EACD,OAAO,EAAE,MAAM,UAAU,QAAQ;AAAA;AAGlC,SAAS,WAAW,CACnB,OACA,MACA,SAQe;AAAA,EACf,QAAQ,WAAW;AAAA,EAEnB,IAAI,SAAS,KAAK,KAAK,MAAM,SAAS,QAAQ;AAAA,IAC7C,IAAI,OAAO,MAAM,SAAS,YAAY;AAAA,MACrC,MAAM,OAAO,GAAG,2CAA2C;AAAA,IAC5D;AAAA,IACA,MAAM,QAAQ,YAAY,MAAM,MAAM,MAAM,OAAO;AAAA,IACnD,OAAO,KAAK,OAAO,MAAM,MAAM,KAAgC;AAAA,EAChE;AAAA,EACA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,MAAM,OAAO,GAAG,6CAA6C;AAAA,EAC9D;AAAA,EAEA,MAAM,QAAQ,MAAM,QAAQ,IAAI;AAAA,EAChC,IAAI,QAAQ,GAAG;AAAA,IACd,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG;AAAA,MAC5B,MAAM,OACL,GAAG,UAAU,+CAA+C,QAAQ,MACrE;AAAA,IACD;AAAA,IACA,OAAO,EAAE,MAAM,QAAQ,MAAM,MAAM;AAAA,EACpC;AAAA,EAEA,MAAM,WAAW,MAAM,MAAM,GAAG,KAAK;AAAA,EACrC,MAAM,SAAS,MAAM,MAAM,QAAQ,CAAC;AAAA,EACpC,MAAM,UAAU,QAAQ,UAAU,IAAI,QAAQ;AAAA,EAC9C,IAAI,YAAY,WAAW;AAAA,IAC1B,MAAM,OACL,GAAG,UAAU,wBAAwB,yCAAyC,QAAQ,MACvF;AAAA,EACD;AAAA,EACA,MAAM,UACL,QAAQ,SAAS,cACd,CAAC,QAAQ,OAAO,IAChB,QAAQ,QAAQ,IAAI,CAAC,WACrB,OAAO,SAAS,SAAS,OAAO,OAAO,IACxC;AAAA,EACH,WAAW,QAAQ,SAAS;AAAA,IAE3B,IAAI,SAAS,QAAQ,CAAC,QAAQ,UAAU,IAAI,IAAI,GAAG;AAAA,MAClD,MAAM,OACL,GAAG,UAAU,wBAAwB,6BAA6B,SAAS,OAAO,kBAAkB,KAAK,4CAC1G;AAAA,IACD;AAAA,IACA,IAAI,CAAC,QAAQ,QAAQ,IAAI,EAAE,IAAI,MAAM,GAAG;AAAA,MACvC,MAAM,OACL,GAAG,UAAU,iBAAiB,kBAAkB,uBACjD;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO,EAAE,MAAM,SAAS,UAAU,OAAO;AAAA;AAS1C,SAAS,WAAW,CACnB,OACA,QACO;AAAA,EACP,WAAW,QAAQ,MAAM,OAAO,GAAG;AAAA,IAClC,MAAM,WAAqB,CAAC;AAAA,IAC5B,MAAM,OAAO,IAAI;AAAA,IAEjB,MAAM,QAAQ,CAAC,eAA6B;AAAA,MAC3C,IAAI,KAAK,IAAI,UAAU;AAAA,QAAG;AAAA,MAC1B,MAAM,OAAO,SAAS,QAAQ,UAAU;AAAA,MACxC,IAAI,QAAQ,GAAG;AAAA,QACd,MAAM,OACL,SAAS,KAAK,qBAAqB,CAAC,GAAG,SAAS,MAAM,IAAI,GAAG,UAAU,EAAE,KAAK,KAAK,8BACpF;AAAA,MACD;AAAA,MACA,SAAS,KAAK,UAAU;AAAA,MACxB,WAAW,QAAQ,KAAK,YAAY,IAAI,UAAU,KAAK,CAAC,GAAG;AAAA,QAC1D,IAAI,KAAK,SAAS,UAAU,KAAK,YAAY,IAAI,KAAK,IAAI,GAAG;AAAA,UAC5D,MAAM,KAAK,IAAI;AAAA,QAChB;AAAA,MACD;AAAA,MACA,SAAS,IAAI;AAAA,MACb,KAAK,IAAI,UAAU;AAAA;AAAA,IAGpB,WAAW,cAAc,KAAK,YAAY,KAAK;AAAA,MAAG,MAAM,UAAU;AAAA,EACnE;AAAA;AAUD,SAAS,oBAAoB,CAC5B,OACA,QACO;AAAA,EAEP,MAAM,YAAY,CAAC,MAA0B,SAAgC;AAAA,IAC5E,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;AAAA,IACxC,IAAI,aAAa,WAAW;AAAA,MAC3B,OAAO,SAAS,SAAS,cAAc,SAAS,QAAQ;AAAA,IACzD;AAAA,IACA,WAAW,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG;AAAA,MACpD,MAAM,QACL,KAAK,SAAS,SACX,UAAU,MAAM,KAAK,IAAI,IAE1B,UAAU,MAAM,KAAK,QAAQ;AAAA,MAChC,IAAI,UAAU;AAAA,QAAM,OAAO;AAAA,IAC5B;AAAA,IACA,OAAO;AAAA;AAAA,EAGR,WAAW,QAAQ,MAAM,OAAO,GAAG;AAAA,IAClC,YAAY,UAAU,QAAQ,KAAK,WAAW;AAAA,MAC7C,IAAI,IAAI,SAAS;AAAA,QAAU;AAAA,MAC3B,WAAW,UAAU,IAAI,SAAS;AAAA,QACjC,IAAI,OAAO,SAAS;AAAA,UAAO;AAAA,QAC3B,MAAM,SAAS,MAAM,IAAI,OAAO,IAAI;AAAA,QACpC,MAAM,QACL,WAAW,YAAY,OAAO,UAAU,QAAQ,OAAO,QAAQ;AAAA,QAChE,IAAI,UAAU,MAAM;AAAA,UACnB,MAAM,OACL,SAAS,KAAK,kBAAkB,cAAc,OAAO,QAAQ,OAAO,mBAAmB,OAAO,QAAQ,oCAAoC,OAAO,0EAClJ;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,IACA,YAAY,YAAY,UAAU,KAAK,aAAa;AAAA,MACnD,WAAW,QAAQ,OAAO;AAAA,QACzB,IAAI,KAAK,SAAS;AAAA,UAAS;AAAA,QAC3B,MAAM,UAAU,KAAK,UAAU,IAAI,KAAK,QAAQ;AAAA,QAChD,MAAM,UACL,SAAS,SAAS,cACf,CAAC,QAAQ,OAAO,KACf,SAAS,WAAW,CAAC,GAAG,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,QACxD,WAAW,QAAQ,SAAS;AAAA,UAC3B,MAAM,SAAS,MAAM,IAAI,IAAI;AAAA,UAC7B,MAAM,QACL,WAAW,YAAY,OAAO,UAAU,QAAQ,KAAK,MAAM;AAAA,UAC5D,IAAI,UAAU,MAAM;AAAA,YACnB,MAAM,OACL,SAAS,KAAK,oBAAoB,gBAAgB,KAAK,aAAa,KAAK,mBAAmB,QAAQ,KAAK,uBAAuB,QAAQ,yGACzI;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;;;AC7aD,IAAM,WAAW;AAEjB,IAAM,YAAW,CAAC,UACjB,OAAO,UAAU,YAAY,UAAU;AAEjC,SAAS,IAAI,CAAC,OAAgB,MAAc,OAAuB;AAAA,EACzE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,SAAS,KAAK,KAAK,GAAG;AAAA,IACtE,MAAM,IAAI,UACT,GAAG,UAAU,6DACd;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,MAAM,CACrB,OACA,MACA,OACqB;AAAA,EACrB,MAAM,OAAO,MAAM,MAAM,IAAI,IAAI;AAAA,EACjC,IAAI,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,UACT,GAAG,WAAW,0CACf;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,QAAQ,CACvB,OACA,OACA,OAKC;AAAA,EACD,IAAI,CAAC,UAAS,KAAK,KAAK,OAAO,MAAM,SAAS,UAAU;AAAA,IACvD,MAAM,IAAI,UACT,GAAG,qDACJ;AAAA,EACD;AAAA,EACA,OAAO,OAAO,MAAM,MAAM,KAAK;AAAA,EAC/B,OAAO;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,IAAI,KAAK,MAAM,IAAI,iBAAiB,KAAK;AAAA,IACzC,MAAM;AAAA,EACP;AAAA;AAWM,SAAS,SAAS,CACxB,OACA,OACA,OACU;AAAA,EACV,IAAI,CAAC,UAAS,KAAK,KAAK,OAAO,MAAM,SAAS,UAAU;AAAA,IACvD,MAAM,IAAI,UACT,GAAG,oDACJ;AAAA,EACD;AAAA,EACA,MAAM,KAAK,KAAK,MAAM,IAAI,kBAAkB,KAAK;AAAA,EACjD,IAAI,MAAM,SAAS,IAAI,MAAM,IAAI;AAAA,IAAG,OAAO,EAAE,MAAM,MAAM,MAAM,GAAG;AAAA,EAElE,MAAM,OAAO,OAAO,OAAO,MAAM,MAAM,KAAK;AAAA,EAC5C,IAAI,OAAO,MAAM,aAAa;AAAA,IAAU,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG;AAAA,EACrE,IAAI,CAAC,KAAK,UAAU,IAAI,MAAM,QAAQ,GAAG;AAAA,IACxC,MAAM,IAAI,UACT,GAAG,WAAW,MAAM,kCAAkC,KAAK,YAAY,KAAK,QAAQ,MAAM,MAAM,4BACjG;AAAA,EACD;AAAA,EACA,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,UAAU,MAAM,SAAS;AAAA;AAIjD,SAAS,OAAO,CACtB,OACA,QACA,UACA,SACA,OACC;AAAA,EACD,MAAM,SAAS,SAAS,OAAO,QAAQ,KAAK;AAAA,EAC5C,MAAM,OAAO,OAAO,OAAO,OAAO,MAAM,KAAK;AAAA,EAC7C,MAAM,MAAM,KAAK,UAAU,IAAI,QAAQ;AAAA,EACvC,IAAI,QAAQ,WAAW;AAAA,IACtB,MAAM,IAAI,UACT,GAAG,WAAW,kCAAkC,KAAK,MACtD;AAAA,EACD;AAAA,EACA,IAAI,IAAI,SAAS,aAAa;AAAA,IAC7B,MAAM,IAAI,UACT,GAAG,UAAU,KAAK,QAAQ,yBAAyB,IAAI,iDAAiD,KAAK,cAC9G;AAAA,EACD;AAAA,EAEA,MAAM,MAAM,UAAU,OAAO,SAAS,KAAK;AAAA,EAC3C,IAAI,CAAC,OAAO,IAAI,SAAS,GAAG,GAAG;AAAA,IAC9B,MAAM,IAAI,UACT,GAAG,UAAU,KAAK,QAAQ,2BAA2B,cAAc,MAAM,GAAG,IAAI,QAAQ,IAAI,aAAa,IAAI,MAC9G;AAAA,EACD;AAAA,EAEA,OAAO;AAAA,IACN,QAAQ,EAAE,MAAM,OAAO,MAAM,IAAI,OAAO,GAAG;AAAA,IAC3C;AAAA,IACA,SAAS;AAAA,EACV;AAAA;;;AC9CM,SAAS,SAAS,CACxB,OACA,SACA,SACY;AAAA,EACZ,OAAO,OAAO,OACb,YAAY,YACT,EAAE,MAAM,aAAsB,OAAO,QAAQ,IAC7C,EAAE,MAAM,aAAsB,OAAO,SAAS,QAAQ,QAAQ,OAAO,CACzE;AAAA;AAiBM,SAAS,IAAoC,CACnD,MACA,MACkB;AAAA,EAClB,OAAO,OAAO,OAAO,EAAE,MAAM,QAAQ,MAAM,KAAK,CAAC;AAAA;AAkgBlD,IAAM,WAAW,IAAI;AA+Bd,SAAS,WAAwC,CACvD,QACqB;AAAA,EACrB,MAAM,WAAW,aAAa,QAAQ,aAAa;AAAA,EACnD,MAAM,QAA4B,OAAO,OAAO;AAAA,IAC/C,UAAU,CAAC,GAAG,SAAS,QAAQ;AAAA,IAC/B,OAAO,CAAC,GAAG,SAAS,MAAM,KAAK,CAAC;AAAA,IAChC,YAAY;AAAA,EACb,CAAC;AAAA,EACD,SAAS,IAAI,OAAO,QAAQ;AAAA,EAC5B,OAAO;AAAA;AAID,SAAS,UAAU,CAAC,OAA8B;AAAA,EACxD,MAAM,WAAW,SAAS,IAAI,KAAK;AAAA,EACnC,IAAI,aAAa,WAAW;AAAA,IAC3B,MAAM,IAAI,UACT,0FACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA;;;AC7nBD,MAAM,QAAQ;AAAA,EAMpB,WAAW,CACO,OACA,OACA,UACA,KACA,SACA,UAChB;AAAA,IANgB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAXV,gBAAW,IAAI;AAAA,IACf,eAAU,IAAI;AAAA,IACL,YAAO,IAAI;AAAA,IACpB,cAAS;AAAA;AAAA,OAWX,QAAO,CAAC,MAAc,MAA4C;AAAA,IACvE,SAAS,QAAQ,EAAG,SAAS,KAAK,UAAU,SAAS,GAAG;AAAA,MACvD,KAAK,UAAU,IAAI;AAAA,MACnB,KAAK,SAAS;AAAA,MACd,MAAM,QAAQ,MAAM,KAAK,MAAM,MAAM,IAAI;AAAA,MACzC,IAAI,CAAC,KAAK,UAAU,KAAK,KAAK;AAAA,QAAG,OAAO;AAAA,MACxC,KAAK,WAAW,KAAK;AAAA,IACtB;AAAA,IACA,MAAM,IAAI,sBACT,iBAAiB,KAAK,8BAA8B,KAAK,wCACzD,EAAE,YAAY,KAAK,UAAU,UAAU,KAAK,SAAS,CACtD;AAAA;AAAA,EAIO,IAAI,GAAY;AAAA,IACvB,YAAY,KAAK,QAAQ,KAAK,SAAS;AAAA,MACtC,KAAK,KAAK,SAAS,IAAI,GAAG,GAAG,QAAQ,OAAO,IAAI;AAAA,QAAM,OAAO;AAAA,IAC9D;AAAA,IACA,OAAO;AAAA;AAAA,OAIM,MAAK,CAClB,UACA,MAC+B;AAAA,IAC/B,MAAM,MAAM,GAAG,YAAY;AAAA,IAC3B,MAAM,OAAO,KAAK,QAAQ,IAAI,GAAG;AAAA,IACjC,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAC/B,IAAI,KAAK,KAAK,IAAI,GAAG,GAAG;AAAA,MACvB,KAAK,SAAS;AAAA,MACd,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;AAAA,IACtC;AAAA,IAEA,MAAM,OAAO,KAAK,MAAM,MAAM,IAAI,QAAQ;AAAA,IAC1C,IAAI,SAAS;AAAA,MAAW,OAAO,IAAI;AAAA,IAEnC,KAAK,KAAK,IAAI,GAAG;AAAA,IACjB,IAAI;AAAA,MACH,MAAM,QAAQ,KAAK,YAAY,IAAI,IAAI,IACpC,MAAM,KAAK,WAAW,MAAM,IAAI,IAChC,MAAM,KAAK,SAAS,MAAM,IAAI;AAAA,MACjC,KAAK,QAAQ,IAAI,KAAK,KAAK;AAAA,MAC3B,OAAO;AAAA,cACN;AAAA,MACD,KAAK,KAAK,OAAO,GAAG;AAAA;AAAA;AAAA,OAIR,SAAQ,CACrB,MACA,MACuB;AAAA,IACvB,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;AAAA,IACxC,IAAI,aAAa;AAAA,MAAW,OAAO,IAAI;AAAA,IAEvC,IAAI,SAAS,SAAS,aAAa;AAAA,MAClC,MAAM,UAAU,KAAK;AAAA,MACrB,OAAO,cAAc,WAAW,QAAQ,SAAS,SAAS,UACvD,IAAI,MACJ,IAAI,IAAI,MAAM,KAAK,OAAO,MAAM,MAAM,QAAQ,EAAE,CAAC;AAAA,IACrD;AAAA,IAGA,MAAM,QAAQ,IAAI,IACjB,OAAO,SAAS,SAAS,KAAK,OAAO,IAClC,MAAM,KAAK,QAAQ,KAAK,MAAM,MAAM,KAAK,OAAO,IAChD,CAAC,CACL;AAAA,IACA,WAAW,UAAU,SAAS,SAAS;AAAA,MACtC,IAAI,OAAO,SAAS;AAAA,QAAO;AAAA,MAC3B,WAAW,MAAM,MAAM,KAAK,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG;AAAA,QAChE,MAAM,MAAM,EAAE,MAAM,OAAO,MAAM,IAAI,UAAU,OAAO,SAAS;AAAA,QAC/D,WAAW,UAAU,MAAM,KAAK,QAAQ,KAAK,MAAM,MAAM,GAAG,GAAG;AAAA,UAC9D,MAAM,IAAI,MAAM;AAAA,QACjB;AAAA,MACD;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAGM,WAAU,CACvB,MACA,MACuB;AAAA,IACvB,MAAM,QAAQ,IAAI;AAAA,IAClB,WAAW,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG;AAAA,MACpD,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,OAAO,MAAM,MAAM,IAAI;AAAA,QAAG;AAAA,MAE/D,IAAI,KAAK,SAAS,QAAQ;AAAA,QACzB,WAAW,MAAM,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,IAAI;AAAA,UAAG,MAAM,IAAI,EAAE;AAAA,QACrE;AAAA,MACD;AAAA,MACA,WAAW,MAAM,MAAM,KAAK,MAAM,MAAM,KAAK,UAAU,KAAK,MAAM,GAAG;AAAA,QACpE,MAAM,IAAI,EAAE;AAAA,MACb;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAIM,MAAK,CAClB,MACA,UACA,QACuB;AAAA,IACvB,MAAM,UAAU,KAAK,UAAU,IAAI,QAAQ;AAAA,IAC3C,MAAM,QAAQ,IAAI;AAAA,IAClB,IAAI,YAAY;AAAA,MAAW,OAAO;AAAA,IAElC,IAAI,QAAQ,SAAS,aAAa;AAAA,MACjC,WAAW,MAAM,MAAM,KAAK,MAAM,QAAQ,SAAS,MAAM,GAAG;AAAA,QAC3D,WAAW,UAAU,MAAM,KAAK,OAAO,MAAM,UAAU,EAAE,GAAG;AAAA,UAC3D,MAAM,IAAI,MAAM;AAAA,QACjB;AAAA,MACD;AAAA,MACA,OAAO;AAAA,IACR;AAAA,IACA,WAAW,UAAU,QAAQ,SAAS;AAAA,MAErC,IAAI,OAAO,SAAS,UAAU,CAAC,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,GAAG;AAAA,QACjE;AAAA,MACD;AAAA,MACA,WAAW,MAAM,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,QACvD,MAAM,SAAS,EAAE,MAAM,OAAO,MAAM,GAAG;AAAA,QACvC,WAAW,UAAU,MAAM,KAAK,QAAQ,KAAK,MAAM,UAAU,MAAM,GAAG;AAAA,UACrE,MAAM,IAAI,MAAM;AAAA,QACjB;AAAA,MACD;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAIM,QAAO,CACpB,MACA,UACA,SACoB;AAAA,IACpB,MAAM,MAAgB,CAAC;AAAA,IACvB,IAAI,QAAuB;AAAA,IAC3B,GAAG;AAAA,MACF,MAAM,OAA2B,MAAM,KAAK,MAAM,YAAY;AAAA,QAC7D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO;AAAA,MACR,CAAC;AAAA,MACD,IAAI,KAAK,GAAG,KAAK,KAAK;AAAA,MACtB,QAAQ,KAAK;AAAA,IACd,SAAS,UAAU;AAAA,IACnB,OAAO;AAAA;AAAA,OAIM,OAAM,CACnB,MACA,UACA,IAC6B;AAAA,IAC7B,MAAM,MAAM,KAAK,UAAU,IAAI,QAAQ;AAAA,IACvC,IAAI,KAAK,SAAS,eAAe,IAAI,WAAW,WAAW;AAAA,MAC1D,MAAM,IAAI,UACT,SAAS,KAAK,QAAQ,gEAAgE,KAAK,gBAAgB,mBAAmB,KAAK,SAAS,cAAc,IAAI,QAAQ,eAAe,KAAK,SAAS,cAAc,IAAI,UAAU,kBAChO;AAAA,IACD;AAAA,IACA,MAAM,MAAM,MAAM,IAAI,OAAO,EAAE;AAAA,IAC/B,IAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,KAAK,CAAC,SAAS,OAAO,SAAS,QAAQ,GAAG;AAAA,MACxE,MAAM,IAAI,UACT,uBAAuB,KAAK,QAAQ,sCACrC;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,EAIA,MAAM,CACb,MACA,MACA,MACU;AAAA,IACV,IAAI,KAAK,QAAQ,WAAW;AAAA,MAC3B,MAAM,IAAI,UACT,SAAS,KAAK,QAAQ,gEACvB;AAAA,IACD;AAAA,IACA,OAAQ,KAAK,KAAmC,KAAK,GAAG,MAAM;AAAA;AAEhE;;;AC1NO,MAAM,KAAK;AAAA,EAIjB,WAAW,CACO,OACA,OACA,UACA,KACA,UAChB;AAAA,IALgB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAPD,YAAO,IAAI;AAAA;AAAA,OAWtB,MAAK,CACV,SACA,MACA,MACA,OACmB;AAAA,IACnB,IAAI,QAAQ,KAAK,UAAU;AAAA,MAC1B,MAAM,IAAI,sBACT,iBAAiB,KAAK,8BAA8B,KAAK,wCACzD,EAAE,YAAY,KAAK,UAAU,UAAU,KAAK,SAAS,CACtD;AAAA,IACD;AAAA,IAEA,MAAM,MAAM,GAAG,cAAa,KAAK,MAAM,KAAK;AAAA,IAE5C,IAAI,KAAK,KAAK,IAAI,GAAG;AAAA,MAAG,OAAO;AAAA,IAE/B,MAAM,OAAO,KAAK,MAAM,MAAM,IAAI,KAAK,OAAO,IAAI;AAAA,IAElD,IAAI,SAAS;AAAA,MAAW,OAAO;AAAA,IAE/B,KAAK,KAAK,IAAI,GAAG;AAAA,IACjB,IAAI;AAAA,MACH,OAAO,KAAK,YAAY,IAAI,IAAI,IAC7B,MAAM,KAAK,WAAW,SAAS,MAAM,MAAM,MAAM,KAAK,IACtD,MAAM,KAAK,SAAS,SAAS,MAAM,MAAM,MAAM,KAAK;AAAA,cACtD;AAAA,MACD,KAAK,KAAK,OAAO,GAAG;AAAA;AAAA;AAAA,OAIR,SAAQ,CACrB,SACA,MACA,MACA,MACA,OACmB;AAAA,IACnB,MAAM,WAAW,KAAK,UAAU,IAAI,IAAI;AAAA,IACxC,IAAI,aAAa;AAAA,MAAW,OAAO;AAAA,IAEnC,IAAI,SAAS,SAAS,aAAa;AAAA,MAClC,MAAM,KAAK,QAAQ,MAAM,SAAS,OAAO,GAAG,KAAK,QAAQ,MAAM;AAAA,MAC/D,OACC,OAAO,QACP,EAAE,cAAc,YAChB,QAAQ,SAAS,SAAS,WAC1B,QAAQ,OAAO;AAAA,IAEjB;AAAA,IAGA,IACC,OAAO,SAAS,SAAS,OAAO,KAC/B,MAAM,KAAK,MAAM,IAAI,EAAE,QAAQ,KAAK,QAAQ,UAAU,MAAM,QAAQ,CAAC,GACrE;AAAA,MACD,OAAO;AAAA,IACR;AAAA,IACA,WAAW,OAAO,MAAM,KAAK,MAAM,gBAAgB,KAAK,QAAQ,IAAI,GAAG;AAAA,MACtE,IAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAAA,QAAG;AAAA,MACpC,MAAM,UAAU,EAAE,QAAQ,EAAE,MAAM,IAAI,MAAM,IAAI,IAAI,GAAG,GAAG,MAAM,KAAK;AAAA,MACrE,IAAI,MAAM,KAAK,MAAM,SAAS,SAAS,IAAI,UAAU,QAAQ,CAAC,GAAG;AAAA,QAChE,OAAO;AAAA,MACR;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,OAGM,WAAU,CACvB,SACA,MACA,MACA,MACA,OACmB;AAAA,IACnB,WAAW,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG;AAAA,MACpD,IAAI,KAAK,SAAS,aAAa,CAAC,KAAK,OAAO,MAAM,MAAM,IAAI;AAAA,QAAG;AAAA,MAE/D,IAAI,KAAK,SAAS,QAAQ;AAAA,QACzB,IAAI,MAAM,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK;AAAA,UAAG,OAAO;AAAA,QAC9D;AAAA,MACD;AAAA,MACA,WAAW,UAAU,MAAM,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,GAAG;AAAA,QACnE,IAAI,MAAM,KAAK,MAAM,SAAS,QAAQ,KAAK,QAAQ,QAAQ,CAAC,GAAG;AAAA,UAC9D,OAAO;AAAA,QACR;AAAA,MACD;AAAA,IACD;AAAA,IACA,OAAO;AAAA;AAAA,EAIA,MAAM,CACb,MACA,MACA,MACU;AAAA,IACV,IAAI,KAAK,QAAQ,WAAW;AAAA,MAC3B,MAAM,IAAI,UACT,QAAQ,KAAK,QAAQ,gEACtB;AAAA,IACD;AAAA,IACA,OAAQ,KAAK,KAAmC,KAAK,GAAG,MAAM;AAAA;AAAA,OAIjD,QAAO,CACpB,MACA,MACA,UACkB;AAAA,IAClB,MAAM,UAAU,KAAK,UAAU,IAAI,QAAQ;AAAA,IAC3C,IAAI,YAAY;AAAA,MAAW,OAAO,CAAC;AAAA,IAEnC,IAAI,QAAQ,SAAS,aAAa;AAAA,MACjC,MAAM,KAAK,QAAQ,MAAM,QAAQ,OAAO,GAAG,KAAK,QAAQ,UAAU;AAAA,MAClE,OAAO,OAAO,OACX,CAAC,IACD,CAAC,EAAE,QAAQ,EAAE,MAAM,QAAQ,SAAS,GAAG,GAAG,MAAM,KAAK,CAAC;AAAA,IAC1D;AAAA,IAEA,QAAQ,MAAM,KAAK,MAAM,aAAa,KAAK,QAAQ,QAAQ,GACzD,OAAO,CAAC,WAAW,OAAO,QAAQ,SAAS,MAAM,CAAC,EAClD,IAAI,CAAC,YAAY;AAAA,MACjB,QAAQ,EAAE,MAAM,OAAO,MAAM,IAAI,OAAO,GAAG;AAAA,MAC3C,MAAM;AAAA,IACP,EAAE;AAAA;AAEL;AAGA,SAAS,OAAO,CAAC,MAAY,OAAe,MAA6B;AAAA,EACxE,IAAI,KAAK,SAAS,MAAM;AAAA,IAEvB,MAAM,IAAI,UACT,QAAQ,cAAc,oCACvB;AAAA,EACD;AAAA,EACA,MAAM,QAAQ,KAAK,KAAK;AAAA,EACxB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,MAAM,IAAI,UACT,QAAQ,cAAc,2BAA2B,UAAU,YAAY,oDAAoD,6CAC5H;AAAA,EACD;AAAA,EACA,OAAO;AAAA;;;AC7IR,IAAM,oBAAoB;AAE1B,IAAM,WAAW;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAoBO,SAAS,WAAkC,CACjD,SACiB;AAAA,EACjB,MAAM,QAAQ;AAAA,EACd,MAAM,QAAQ,WAAW,QAAQ,KAAK;AAAA,EACtC,MAAM,WAAW,QAAQ,YAAY;AAAA,EACrC,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,GAAG;AAAA,IAChD,MAAM,IAAI,UAAU,GAAG,4CAA4C;AAAA,EACpE;AAAA,EACA,MAAM,MAAM,QAAQ;AAAA,EACpB,WAAW,UAAU,UAAU;AAAA,IAC9B,IAAI,OAAO,MAAM,YAAY,YAAY;AAAA,MACxC,MAAM,IAAI,UAAU,GAAG,gBAAgB,mBAAmB;AAAA,IAC3D;AAAA,EACD;AAAA,EACA,MAAM,QAAQ,eAAe,QAAQ,KAAK;AAAA,EAE1C,MAAM,QAAQ,OACb,SACA,YACA,QACA,YACsB;AAAA,IAEtB,IAAI,YAAY,QAAQ,YAAY;AAAA,MAAW,OAAO;AAAA,IAEtD,MAAM,OAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IAC1C,MAAM,OAAO,OAAO,OAAO,KAAK,MAAM,KAAK;AAAA,IAC3C,IAAI,CAAC,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC,KAAK,YAAY,IAAI,UAAU,GAAG;AAAA,MACzE,MAAM,IAAI,UACT,SAAS,oDAAoD,KAAK,MACnE;AAAA,IACD;AAAA,IAEA,OAAO,IAAI,KACV,OACA,OACA,UACA,SAAS,KACT,GAAG,KAAK,QAAQ,YACjB,EAAE,MACD,UAAU,OAAO,SAAS,KAAK,GAC/B,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG,GAAG,MAAM,KAAK,KAAK,GAC5D,YACA,CACD;AAAA;AAAA,EAGD,MAAM,OAAO,OACZ,SACA,YACA,UACA,YAKiC;AAAA,IACjC,MAAM,QAAQ,WAAU,SAAS,OAAO,MAAM;AAAA,IAC9C,MAAM,QAAQ,SAAS,SAAS;AAAA,IAChC,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAAA,MAChD,MAAM,IAAI,UACT,uDACD;AAAA,IACD;AAAA,IAEA,IAAI,YAAY,QAAQ,YAAY,WAAW;AAAA,MAC9C,OAAO,EAAE,OAAO,CAAC,GAAG,YAAY,KAAK;AAAA,IACtC;AAAA,IAEA,IAAI,OAAO,aAAa,UAAU;AAAA,MACjC,MAAM,IAAI,UAAU,oDAAoD;AAAA,IACzE;AAAA,IACA,MAAM,OAAO,OAAO,OAAO,UAAU,MAAM;AAAA,IAC3C,IAAI,CAAC,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC,KAAK,YAAY,IAAI,UAAU,GAAG;AAAA,MACzE,MAAM,IAAI,UACT,UAAU,oDAAoD,KAAK,MACpE;AAAA,IACD;AAAA,IAEA,MAAM,MAAM,MAAM,IAAI,QACrB,OACA,OACA,UACA,SAAS,KACT,UAAU,OAAO,SAAS,MAAM,GAChC,GAAG,KAAK,QAAQ,YACjB,EAAE,QAAQ,KAAK,MAAM,UAAU;AAAA,IAE/B,MAAM,OAAO,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,UAAU,QAAQ,KAAK,KAAK;AAAA,IACxE,MAAM,QAAQ,KAAK,MAAM,GAAG,KAAK;AAAA,IACjC,MAAM,OAAO,MAAM,GAAG,EAAE;AAAA,IACxB,OAAO;AAAA,MACN;AAAA,MACA,YAAY,KAAK,SAAS,SAAS,SAAS,YAAY,OAAO;AAAA,IAChE;AAAA;AAAA,EAGD,MAAM,SACL,CAAC,cACD,OAAO,QAAiB,UAAkB,YAAqB;AAAA,IAC9D,MAAM,QAAQ,QAAQ,OAAO,QAAQ,UAAU,SAAS,SAAS;AAAA,IACjE,MAAM,MAAM,MACX,cAAc,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,CAC9D;AAAA;AAAA,EAGF,OAAO,OAAO,OAAO;AAAA,IACpB,OAAO,QAAQ;AAAA,IACf,KAAK;AAAA,IACL;AAAA,IACA,OAAO,OAAO,OAAO;AAAA,IACrB,QAAQ,OAAO,QAAQ;AAAA,EACxB,CAAC;AAAA;",
+  "debugId": "B13C4A414094D54564756E2164756E21",
   "names": []
 }

package/dist/stores/guard.d.ts

@@ -0,0 +1,24 @@
+/**
+ * **The one place a store's answer is caught**, shared by both sides of the
+ * package: the identity stores and the relation store reach a caller only
+ * through {@link guardStore}.
+ *
+ * - A `JanusError` the store threw passes through, so `instanceof` holds.
+ * - **Anything else it threw is a failure** — `StoreFailure`, naming the slot
+ *   and the method, with the original as `cause`. Never an absence.
+ * - `undefined` where the port says `null` is a store that forgot to answer,
+ *   and becomes `StoreFailure` rather than "not found".
+ *
+ * The `catch` below always rethrows; `src/auth/outage.spec.ts` holds it to that.
+ */
+import { StoreFailure } from '../errors/janus-error';
+import type { RelationStore } from '../permissions/port/types';
+/** A store the guard names in a `StoreFailure`: `users`, `sessions`, `tokens` or `relations`. */
+export type StoreSlot = NonNullable<StoreFailure['slot']>;
+export declare function guardStore<S extends object>(slot: StoreSlot, store: S): S;
+/**
+ * The relation store, guarded the same way: the permission engine's only way
+ * to a store, so a failure there is `STORE_FAILED` and never a denial.
+ */
+export declare function guardRelations(store: RelationStore): RelationStore;
+//# sourceMappingURL=guard.d.ts.map

package/dist/stores/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/stores/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAGN,YAAY,EACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,iGAAiG;AACjG,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAS1D,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA6BzE;AAoCD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAElE"}

package/dist/subjects/subject.d.ts

@@ -63,8 +63,8 @@ export declare function isSubjectSet(subject: Subject): subject is SubjectSet;
 /**
  * The subject a user is: their `type` and `id`, and nothing else.
  *
- * One line, and the entire join between the two halves of the package. It
- * takes the narrowest shape it reads, so the permissions half never has to
+ * One line, and the entire join between the two sides of the package. It
+ * takes the narrowest shape it reads, so the permissions side never has to
  * know what a user is, and it copies those two fields so none of the user's
  * own fields ever reaches a tuple.
  */

package/docs/README.md

@@ -3,15 +3,31 @@
 The [README](../README.md) shows that it works; these pages show how, one area
 at a time, with an example for every option.
 
+Janus has two sides, each usable alone — see
+[Three ways to use it](../README.md#three-ways-to-use-it) — and the words
+below are defined once, in [Words](guide/vocabulary.md#words).
+
+### Identities — `janus()`
+
 | Page | Read it when |
 | --- | --- |
-| [Users — `janus()`](guide/users.md) | You are wiring `janus()`, declaring one or several kinds of user, or calling `create`, `update`, `list`, `delete` |
+| [Users](guide/users.md) | You are wiring `janus()`, declaring one or several user types, or calling `create`, `update`, `list`, `delete` |
 | [Sessions](guide/sessions.md) | You need to know who a request belongs to, set or clear the cookie, renew, sign out, or test expiry |
 | [E-mail verification and password reset](guide/email-flows.md) | You are sending a verification or reset link, and handling what comes back |
 | [Password hashing](guide/passwords.md) | You are choosing a hasher, raising its cost, moving to argon2id, or importing hashes from another system |
+
+### Permissions — `@nxgt/janus/permissions`
+
+| Page | Read it when |
+| --- | --- |
 | [Permissions](guide/permissions.md) | You are modelling access with `defineModel`, `fromField` and `when`, and calling `can`, `list`, `grant`, `revoke` |
+
+### Shared by both sides
+
+| Page | Read it when |
+| --- | --- |
+| [The shared vocabulary](guide/vocabulary.md) | You want the words the documentation uses, or subjects and the tuple notation, ids, cursors, durations or `fixedClock` |
 | [Errors](guide/errors.md) | You are turning what the package throws into a status code, and want every code and what it carries |
-| [The shared vocabulary](guide/vocabulary.md) | You need subjects and the tuple notation, ids, cursors, durations or `fixedClock` |
-| [Writing an adapter](guide/adapters.md) | You are implementing the store port or the relation store for your database, and running the conformance suites |
+| [Writing an adapter](guide/adapters.md) | You are implementing the identity stores or the relation store for your database, and running the conformance suites |
 | [Troubleshooting](troubleshooting.md) | You have an error message and want its cause and its fix |
 | [Roadmap](roadmap.md) | You want to know what is coming, what shipped, and what is deliberately not planned |

package/docs/guide/adapters.md

@@ -1,4 +1,4 @@
-# Writing an adapter — the store port and `@nxgt/janus/conformance`
+# Writing an adapter — the ports and `@nxgt/janus/conformance`
 
 This page is for putting `janus()` or `permissions()` on a database of your
 choice: the two ports you implement, the rules they carry, and the conformance
@@ -100,7 +100,7 @@ interface TokenStore {
 and answers it **as it was before the call**, in **one conditional write**.
 Twenty concurrent calls must produce exactly one answer with `spentAt: null`;
 in MongoDB that is one `findOneAndUpdate` returning the document before the
-update. A read followed by a write lets two requests redeem one reset code.
+update. A read followed by a write lets two requests redeem one reset token.
 
 Expiry is the core's decision: a read answers a stored session verbatim,
 lapsed or revoked, and never a record it has changed.
@@ -278,10 +278,10 @@ for (const conformanceCase of allCases) {
 
 | Export | What it is |
 | --- | --- |
-| `allCases`, `userStoreCases`, `sessionStoreCases`, `tokenStoreCases`, `outageCases` | The user-port cases, as `ConformanceCase` objects with a stable `id` |
+| `allCases`, `userStoreCases`, `sessionStoreCases`, `tokenStoreCases`, `outageCases` | The identity stores' cases, as `ConformanceCase` objects with a stable `id` |
 | `runCase(case, harness)` | Runs one; throws on failure, answers `{ passed: true }` or `{ skipped }` |
 | `SKIP_REASONS` | The reasons the suite gives itself |
-| `allRelationCases`, `relationStoreCases`, `relationOutageCases`, `runRelationCase` | The same for the relation port |
+| `allRelationCases`, `relationStoreCases`, `relationOutageCases`, `runRelationCase` | The same for the relation store |
 | `referenceHarness()`, `referenceRelationHarness()` | The suites against the reference stores: the examples to copy |
 
 Types: `ConformanceHarness`, `OpenedStores`, `StoreFaults`, `ConformanceCase`,

package/docs/guide/errors.md

@@ -53,8 +53,8 @@ instead of answering `undefined`.
 answers `null`, `false` or an empty page. A store that cannot answer — a
 refused connection, a timeout, a primary stepping down, a bug in the adapter —
 rejects with `STORE_FAILED`. Answer 503. Mapping it to a 404, to `null` or to
-`false` turns an outage into a silent lockout: everybody who has an account is
-told they do not.
+`false` turns an outage into a silent lockout: every user is
+told they do not exist.
 
 ## Two kinds of refusal
 
@@ -109,7 +109,7 @@ async function signIn(email: string, password: string): Promise<Response> {
 ```
 
 - **Never put `reason` in a response body.** `unknownLogin` tells an attacker
-  which accounts exist.
+  which users exist.
 - **`STORE_FAILED` is never a 401 or a 404.** Test for it before anything that
   would read as "no".
 - **`VERSION_CONFLICT` is a retry**: read the user again, reapply, write with

package/docs/guide/passwords.md

@@ -127,7 +127,7 @@ per prefix the old system wrote (`$2a$`, `$2b$`, `$2y$` for bcrypt).
 - The plain password is never stored, and never appears in an error message.
 - The hash never reaches a `User` — `hasPassword` says whether there is one.
 - `signIn` compares against a dummy hash when nobody holds the login, so the
-  time taken does not reveal which accounts exist. The store's own latency
+  time taken does not reveal which users exist. The store's own latency
   still can, and that limit is stated rather than denied.
 
 ## See also

package/docs/guide/permissions.md

@@ -6,6 +6,11 @@ Zanzibar's model — relations between objects and subjects, permissions
 computed from them — **without its infrastructure**: the tuples live in your
 database, so a read follows a write and there is nothing to cache.
 
+It is the **permissions** side, and it is usable alone: the example below wires
+it to `janus()` so the user types become the subjects, but `subjects` takes
+any list of names — `defineModel({ subjects: ['user'], … })` — when your users
+live elsewhere. Importing `@nxgt/janus/permissions` loads no identity code.
+
 ```ts
 import { z } from 'zod';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
@@ -257,8 +262,8 @@ own for that.
 ### `grant` and `revoke`
 
 ```ts
-grant(object, relation, holder): Promise<void>;
-revoke(object, relation, holder): Promise<void>;
+grant(object, relation, subject): Promise<void>;
+revoke(object, relation, subject): Promise<void>;
 ```
 
 Both are typed from the model: only a stored relation (never a `fromField`),

package/docs/guide/sessions.md

@@ -53,11 +53,11 @@ await auth.authenticate({ headers: { cookie: `janus-session=${token}` } });
 ```
 
 It reads `Authorization: Bearer`, then `X-Session-Token`, then the cookie.
-**The first credential present wins, not the first valid one**: a client that
+**The first session credential present wins, not the first valid one**: a client that
 sends a lapsed bearer beside a live cookie is anonymous. An `Authorization`
 header of another scheme (`Basic`) is not a session credential.
 
-It answers `null` — anonymous — for no credential, an unknown token, a lapsed
+It answers `null` — anonymous — for no session credential, an unknown token, a lapsed
 or revoked session, a user deleted or inactive, or a user of another type than
 `options.type`:
 

package/docs/guide/users.md

@@ -1,8 +1,9 @@
 # Users — `janus()`
 
 This page is for wiring `janus()` and managing users with it: the
-configuration, one or several kinds of user, and every method a user type
-answers. Sessions have [their own page](sessions.md), and so do the
+configuration, one or several user types, and every method a user type
+answers. It is the **identities** side, usable alone: nothing here needs
+[permissions](permissions.md), and `@nxgt/janus` loads none of their code. Sessions have [their own page](sessions.md), and so do the
 [e-mail flows](email-flows.md) and [password hashing](passwords.md).
 
 ```ts
@@ -71,8 +72,8 @@ before the store sees it.
 
 | Option | Type | Default | Effect |
 | --- | --- | --- | --- |
-| `user` | Standard Schema | — | One kind of user, named `'user'`. Exactly one of `user` and `users` |
-| `users` | `{ [type]: UserTypeConfig }` | — | Several kinds of user. See [Several kinds of user](#several-kinds-of-user) |
+| `user` | Standard Schema | — | One user type, named `'user'`. Exactly one of `user` and `users` |
+| `users` | `{ [type]: UserTypeConfig }` | — | Several user types. See [Several user types](#several-user-types) |
 | `password.login` | a field name | — | The field users sign in with: a **top-level, required string** field. A typo is a compile error |
 | `password.normalize` | `'none' \| 'lowercase' \| 'lowercaseTrim' \| 'nfkcLowercaseTrim' \| (value) => string` | `'lowercaseTrim'` | Applied to the login before any store sees it, at sign-up and at sign-in alike |
 | `password.minLength` | integer ≥ 1 | `8` | Below it: `PASSWORD_TOO_SHORT` |
@@ -122,7 +123,7 @@ A function is accepted, and must be deterministic: the same rule normalises
 at sign-up and at sign-in. An e-mail used by the e-mail flows is always
 compared lower-cased and trimmed, whatever the login's rule.
 
-## Several kinds of user
+## Several user types
 
 ```ts
 const Patient = z.object({ email: z.email(), birthDate: z.string() });
@@ -151,7 +152,7 @@ if (current?.user.type === 'staff') current.user.service; // narrowed by type
 
 Each type carries `schema` and, optionally, `password`, `email`, `session`
 and `schemaVersion`, with the defaults above. A login is unique **per type**:
-the same e-mail may hold a patient account and a staff account. A type name is
+the same e-mail may hold a patient user and a staff user. A type name is
 camelCase, and may not be one of `janus()`'s own methods (`authenticate`,
 `signOut`, `signOutEverywhere`, `findUser`, `getUser`, `cookie`,
 `collectExpired`, `types`) — a compile error, and a `TypeError` for a
@@ -274,4 +275,4 @@ fields against your schema, not that `password` is a string.
 
 - [Sessions](sessions.md) — `authenticate`, the cookie, signing out
 - [Errors](errors.md) — every code, and the status it deserves
-- [Writing an adapter](adapters.md) — the store port behind `store`
+- [Writing an adapter](adapters.md) — the identity stores behind `store`