@nxgt/janus 0.1.0

package/dist/permissions/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/permissions/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,KAAK,aAAa,EAAgB,MAAM,WAAW,CAAC;AAI7D;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS,CACzB,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,MAAM;IAE/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0CAA0C;AAC1C,MAAM,WAAW,mBAAmB,CACnC,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,OAAO,SAAS,MAAM,GAAG,MAAM,CAC9B,SAAQ,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,SAAS,CACxB,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,OAAO,SAAS,MAAM,EAC3B,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC7D,wBAAgB,SAAS,CACxB,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,OAAO,SAAS,MAAM,EAE5B,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAavC;;;;;;;GAOG;AACH,MAAM,WAAW,IAAI,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,GAAG,KAAK;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;CACrC;AAED,wBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,EAClD,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,GACzB,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAEjB;AAID;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;AAExD;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;KAAE,CAAC;IAC9D,iDAAiD;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAAA;KAAE,CAAC;CACvE;AAED,MAAM,WAAW,WAAW;IAC3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAAA;KAAE,CAAC;CAC3D;AAID,KAAK,OAAO,CAAC,CAAC,SAAS,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AAEjD,yCAAyC;AACzC,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,WAAW,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAE5E,kDAAkD;AAClD,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,KAAK,WAAW,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,GACzC,EAAE,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5C,MAAM,CAAC,GAAG,MAAM,GAChB,KAAK,GACN,KAAK,CAAC;AAET,KAAK,aAAa,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,GAC3C,EAAE,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;CAAE,GAC9C,MAAM,CAAC,GAAG,MAAM,GAChB,KAAK,GACN,KAAK,CAAC;AAET,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhE,KAAK,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,GAC9C,EAAE,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7C,CAAC,SAAS,MAAM,EAAE,GACjB,EAAE,CAAC,CAAC,CAAC,GACL,KAAK,GACN,KAAK,GACN,KAAK,CAAC;AAET,sFAAsF;AACtF,KAAK,iBAAiB,CAAC,EAAE,EAAE,CAAC,IAAI;KAC9B,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,SAAS,GACjE,KAAK,GACL,CAAC;CACJ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAEtB;;;;GAIG;AACH,KAAK,YAAY,CAAC,EAAE,IAAI;KACtB,CAAC,IAAI,MAAM,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC,IAAI,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;CAC5D,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AAErB,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,IACnC,CAAC,GACD,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,GACnB,YAAY,CAAC,EAAE,CAAC,CAAC;AAEpB,+EAA+E;AAC/E,KAAK,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IACzB,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,GACzD,GAAG,GACH,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GACnD,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,EAAE,GAC9B,KAAK,GACL,CAAC,GACF,KAAK,CAAC;AAEX,iDAAiD;AACjD,KAAK,WAAW,CAAC,EAAE,EAAE,OAAO,IAC3B,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,MAAM,CAAC,GACjC,CAAC,SAAS,MAAM,GACf,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GACrC,CAAC,GACD,KAAK,GACN,KAAK,GACN,KAAK,CAAC;AAEV,KAAK,WAAW,CAAC,EAAE,EAAE,CAAC,IAAI;KACxB,CAAC,IAAI,MAAM,EAAE,GAAG,CAAC,SAAS,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CACrD,CAAC,MAAM,EAAE,CAAC,CAAC;AAEZ,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI;KACrB,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAChE,KAAK,GACL,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,GAC1C,GAAG,CAAC,KAAK,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAClD,KAAK;CACT,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAEtB,yCAAyC;AACzC,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEzD,kFAAkF;AAClF,MAAM,MAAM,WAAW,CACtB,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,IACtB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE3B,gFAAgF;AAChF,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,IAAI;KACvE,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,aAAa,CAC/C,OAAO,CAAC,CAAC,CAAC,EACV,CAAC,EACD,CAAC,CACD,SAAS,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GACjC,CAAC,GACD,KAAK;CACR,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,IAAI;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI;CAAE,CAAC;AAEtD,+DAA+D;AAC/D,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,WAAW;IAChD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACpB;AAID,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAC7B,CAAC,SAAS,OAAO,GACd,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAClB,KAAK,CACR,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,GACtC,CAAC,GACD,KAAK,CAAC;AAET,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAEhE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAClC,CAAC,GACD,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GAC7B,CAAC,GACD,KAAK,CAAC;AAEV,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,GAChE,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GACpD,eAAe,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AAEnC;;;;GAIG;AACH,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,MAAM,EAAE,GAAG,MAAM,GAC/D,CAAC,SAAS,MAAM,GACf,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,GACvB,KAAK,GACL,EAAE,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/C,CAAC,SAAS,MAAM,EAAE,GACjB,EAAE,CAAC,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GACjC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAClE,KAAK,GACN,KAAK,GACN,KAAK,GACP,KAAK,GACN,KAAK,CAAC;AAET;;;;GAIG;AACH,MAAM,MAAM,KAAK,CAChB,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,MAAM,IACb,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC3D,KAAK,GACL,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,CACpB,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,MAAM,IACb,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAC9B,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAChC,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GACtC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAEtC,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACtB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GACxC,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAE3B,mFAAmF;AACnF,KAAK,cAAc,CAClB,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,MAAM,IACb,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAChC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,GACvC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACf,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GACvC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEnB,KAAK,MAAM,CACV,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,MAAM,IACb,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACjC,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GACpC,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC;AAE/C,8DAA8D;AAC9D,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,WAAW,IAAI,CACxC,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAE3B,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAC7B,UAAU,EAAE,CAAC,EACb,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EACvB,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;AAItB,oFAAoF;AACpF,KAAK,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAC1B,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD,KAAK,GACL,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,SAAS,GACxC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,EAAE,GAC7B,KAAK,CAAC;AAEX,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,GAE9D,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GACvB,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GACtD,eAAe,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AAEnC;;;;GAIG;AACH,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,MAAM,EAAE,GAAG,MAAM,GAC/D,CAAC,SAAS,MAAM,GACf,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,GACvB,KAAK,GACL,CAAC,SAAS,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,GAC3B,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GACvB,EAAE,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/C,CAAC,SAAS,MAAM,EAAE,GACjB,EAAE,CAAC,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GACjC,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GACnD,KAAK,GACN,KAAK,GACN,KAAK,GACR,KAAK,GACN,KAAK,CAAC;AAET,gGAAgG;AAChG,MAAM,MAAM,SAAS,CACpB,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,MAAM,IACb,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAE7C,+DAA+D;AAC/D,KAAK,SAAS,CACb,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,MAAM,IACb,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACrC,OAAO,GACP,OAAO,CACP,uBAAuB,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,gCAAgC,EACzE,KAAK,CACL,CAAC;AAEJ,8DAA8D;AAC9D,MAAM,WAAW,QAAQ;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,KAAK,QAAQ,CACZ,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,MAAM,IAEhB,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GACjC,CAAC,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,GACvB,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,GAC7C,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,GACxB,KAAK,CAAC;AAEX;;;;;GAKG;AACH,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,WAAW,IAAI,CACzC,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAE3B,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAC7B,UAAU,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAClC,IAAI,EAAE,CAAC,EACP,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KACzB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAEjC,oFAAoF;AACpF,MAAM,MAAM,WAAW,CACtB,CAAC,SAAS,WAAW,EACrB,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,IACtB,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAErC;;;GAGG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,IACvE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GACzD,CAAC,SAAS,GAAG,MAAM,OAAO,IAAI,MAAM,WAAW,EAAE,GAChD;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;CAC/B,GACA;IAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1C,KAAK,CAAC;AAEV,2DAA2D;AAC3D,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,WAAW,IAAI,CAC1C,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EACzB,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAE3B,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACjD,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KACtB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,oCAAoC;AACpC,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,WAAW;IACjD,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;CAC1B;AAED,kDAAkD;AAClD,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAIzE,KAAK,OAAO,CAAC,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI;IAC7C,QAAQ,EAAE,CAAC,IAAI,IAAI,GAAG,QAAQ;CAC9B,CAAC;AAEF,KAAK,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,GAAG,IAC5C,GAAG,SAAS,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,GACrC,GAAG,SAAS,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAC1C,OAAO,GACP;IACA,QAAQ,CAAC,OAAO,EAAE,OAAO,CACxB,IAAI,GAAG,sCAAsC,EAC7C,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAC/B,CAAC;CACF,GACD;IACA,QAAQ,EAAE,CAAC,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,YAAY,CACrD,UAAU,CAAC,CAAC,CAAC,EACb,OAAO,CAAC,CAAC,CAAC,CACV,GACE,OAAO,GACP,OAAO,CACP,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,uDAAuD,EAC1E,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CACvC;CACH,CAAC;AAEL,KAAK,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,IAAI;IAC/B,QAAQ,EAAE,CAAC,IAAI,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,GACjD,KAAK,CAAC,CAAC,CAAC,SAAS,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,GAChC,OAAO,GACP,OAAO,CACP,IAAI,KAAK,CAAC,CAAC,CAAC,oDAAoD,CAAC,GAAG,MAAM,eAAe,EACzF,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAChB,GACD,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GACpC,CAAC,SAAS,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,GACzB,OAAO,GACP;QACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CACrB,IAAI,CAAC,oDAAoD,CAAC,GAAG,MAAM,eAAe,EAClF,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAChB,CAAC;KACF,GACD,OAAO;CACX,CAAC;AAEF,KAAK,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAC7D,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GACxD;IACA,QAAQ,CAAC,SAAS,EAAE;QACnB,QAAQ,EAAE,CAAC,IAAI,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;KACjD,CAAC;CACF,GACA,OAAO,CAAC,GACV,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,GACzE;IACA,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,EAAE,CAAC,IAAI,MAAM,EAAE,GAAG,CAAC,SAAS,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAC3D,OAAO,CACP,IAAI,CAAC,GAAG,MAAM,0CAA0C,CAAC,GAAG,MAAM,cAAc,EAChF,KAAK,CACL,GACA,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;KACnC,CAAC;CACF,GACA,OAAO,CAAC,CAAC;AAEb;;;;GAIG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,WAAW,IAAI;IACjD,QAAQ,CAAC,KAAK,EAAE;QACf,QAAQ,EAAE,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;KACvD,CAAC;CACF,CAAC;AAIF,qEAAqE;AACrE,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW;IACnE,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;CACvB;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,WAAW,EACtD,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GACzB,eAAe,CAAC,CAAC,CAAC,CASpB;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAQvD"}

package/dist/permissions/port/memory.d.ts

@@ -0,0 +1,17 @@
+import type { RelationStore } from './types';
+/**
+ * The reference implementation of the relation store, in memory.
+ *
+ * **Shipped and documented, not a test helper**, like `createMemoryStores()`:
+ * what a consumer uses in their own tests, and what an adapter author compares
+ * against. It favours being obviously right over being fast — every query
+ * scans — and keeps the rules for real:
+ *
+ * - a tuple is unique because its key is its notation, and one `Map` holds it;
+ * - `write` checks nothing it could fail on half-way, so it is all or nothing
+ *   on one event loop;
+ * - every tuple is copied in and out, so a caller cannot reach the store by
+ *   mutating what it passed or got back.
+ */
+export declare function createMemoryRelations(): RelationStore;
+//# sourceMappingURL=memory.d.ts.map

package/dist/permissions/port/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/permissions/port/memory.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,IAAI,aAAa,CAgFrD"}

package/dist/permissions/port/types.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The relation store port: where tuples live, and nothing else.
+ *
+ * **A port of its own, not a fourth slot of `JanusStores`** (decided
+ * 2026-09-24): an application that only authenticates implements nothing
+ * here, and tuples may live somewhere else than users.
+ *
+ * Small on purpose, like the user port: the traversal — subject sets, arrows,
+ * `fromField`, conditions, depth — is the core's, written once. A store answers
+ * one-hop questions about stored tuples and never evaluates a permission.
+ *
+ * ## The rules an implementation keeps
+ *
+ * The user port's six hold here unchanged, and the conformance suite checks
+ * them: **an absence is `false`, `[]`, an empty page or `0`, and a failure
+ * throws** — a store that answers `false` for an outage denies everybody
+ * everything, silently; `null` or `false`, never `undefined`; uniqueness of a
+ * tuple is a constraint, not a read; bytes round-trip — a type, an id and a
+ * relation come back exactly as written, and `staff:u1` is not `patient:u1`;
+ * every method is atomic on its own; schema management is the adapter's own.
+ *
+ * A subject is a set when its `relation` is a string — `isSubjectSet` — so
+ * one spread with `relation: undefined` is its entity, as the reference store
+ * reads it.
+ */
+import type { CursorPage } from '../../pagination/cursor-page';
+import type { Entity, RelationTuple, Subject, SubjectSet } from '../../subjects/subject';
+/** What one {@link RelationStore.write} changes. */
+export interface RelationChanges {
+    readonly add?: readonly RelationTuple[];
+    readonly remove?: readonly RelationTuple[];
+}
+/** Which objects a page lists: those of one type where a subject holds a relation. */
+export interface ObjectPageRequest {
+    readonly type: string;
+    readonly relation: string;
+    /** Compared exactly: a subject set is not its entity, and the reverse. */
+    readonly subject: Subject;
+    /**
+     * The last object id of the previous page, or `null` for the first. It need
+     * not name a stored object: the page is every id strictly greater than it.
+     */
+    readonly after: string | null;
+    /** Already bounded by the core, between 1 and `MAX_PAGE_SIZE`. */
+    readonly limit: number;
+}
+export interface RelationStore {
+    /**
+     * Adds and removes tuples, **all or nothing**: removals first, then
+     * additions. Idempotent: adding a tuple already stored and removing one
+     * that is not are no-ops, so a retry after a timeout is a success.
+     *
+     * The core never sends one tuple in both lists.
+     */
+    write(changes: RelationChanges): Promise<void>;
+    /** Whether exactly this tuple is stored. */
+    has(tuple: RelationTuple): Promise<boolean>;
+    /**
+     * The subject sets holding `relation` on `object` — `team:t1#member` — and
+     * no single entity. What the traversal follows to reach members of a group.
+     * `[]` when none; unordered; unpaged, because a relation is held by few sets.
+     */
+    findSubjectSets(object: Entity, relation: string): Promise<readonly SubjectSet[]>;
+    /**
+     * The single entities holding `relation` on `object`, and no subject set.
+     * What an arrow follows — a record's team, a folder's parent — which is why
+     * it is unpaged: an arrow relation holds a handful of objects. `[]` when
+     * none; unordered.
+     */
+    findEntities(object: Entity, relation: string): Promise<readonly Entity[]>;
+    /**
+     * The ids of the objects of one type on which `subject` holds `relation`
+     * directly, in ascending id order, by pages. The reverse index `list()`
+     * walks. An empty store answers an empty page, never `null`.
+     */
+    findObjects(page: ObjectPageRequest): Promise<CursorPage<string>>;
+    /**
+     * Deletes every tuple naming `entity` — as the object, as the subject, and
+     * as the entity of a subject set — and answers how many. `0` is an answer.
+     * What deleting a user or an object calls.
+     */
+    deleteEntity(entity: Entity): Promise<number>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/permissions/port/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permissions/port/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EACX,MAAM,EACN,aAAa,EACb,OAAO,EACP,UAAU,EACV,MAAM,wBAAwB,CAAC;AAEhC,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAED,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC7B;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C,4CAA4C;IAC5C,GAAG,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5C;;;;OAIG;IACH,eAAe,CACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAElC;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAE3E;;;;OAIG;IACH,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAElE;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C"}

package/dist/permissions/resolve.d.ts

@@ -0,0 +1,59 @@
+/**
+ * A model, resolved: every string parsed once, every reference checked, every
+ * refusal a `TypeError` naming where it is.
+ *
+ * The types refuse most of these first. This is what refuses them for a model
+ * built at run time or written in JavaScript, and what refuses what the types
+ * cannot see: names, and a permission that reaches itself without crossing a
+ * relation.
+ */
+import type { Subject } from '../subjects/subject';
+import type { ModelConfig } from './model';
+/** Who may hold a stored relation: a subject type, or a subject set. */
+export type Holder = {
+    readonly kind: 'type';
+    readonly type: string;
+} | {
+    readonly kind: 'set';
+    readonly type: string;
+    readonly relation: string;
+};
+/**
+ * Whether a stored relation admits `subject` as a holder: an entity of a
+ * declared type, or a set of a declared `type#relation`. One rule for what
+ * `grant()` writes and what `can()` and `list()` follow — a tuple the model
+ * does not admit grants nothing, however it was stored.
+ */
+export declare function admits(holders: readonly Holder[], subject: Subject): boolean;
+export type ResolvedRelation = {
+    readonly kind: 'stored';
+    readonly holders: readonly Holder[];
+} | {
+    readonly kind: 'fromField';
+    readonly field: string;
+    readonly subject: string;
+    /** What `list()` reverses it with. Absent: `list()` cannot reach through it. */
+    readonly lookup?: (subjectId: string) => Promise<readonly string[]>;
+};
+/** One rule of a permission. `test`, when present, must pass for it to grant. */
+export type ResolvedRule = ({
+    readonly kind: 'name';
+    readonly name: string;
+} | {
+    readonly kind: 'arrow';
+    readonly relation: string;
+    readonly target: string;
+}) & {
+    readonly test?: (ctx: never) => boolean;
+};
+export interface ResolvedObjectType {
+    readonly name: string;
+    readonly relations: ReadonlyMap<string, ResolvedRelation>;
+    readonly permissions: ReadonlyMap<string, readonly ResolvedRule[]>;
+}
+export interface ResolvedModel {
+    readonly subjects: ReadonlySet<string>;
+    readonly types: ReadonlyMap<string, ResolvedObjectType>;
+}
+export declare function resolveModel(config: ModelConfig, where: string): ResolvedModel;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/permissions/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/permissions/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,wEAAwE;AACxE,MAAM,MAAM,MAAM,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAQ5E;AAED,MAAM,MAAM,gBAAgB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAChE;IACA,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACnE,CAAC;AAEL,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,CACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACvB,CACH,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,CAAA;CAAE,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC1D,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CACxD;AAUD,wBAAgB,YAAY,CAC3B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,aAAa,CAgHf"}

package/dist/permissions/reverse.d.ts

@@ -0,0 +1,53 @@
+import type { Subject } from '../subjects/subject';
+import type { RelationStore } from './port/types';
+import { type ResolvedModel } from './resolve';
+/**
+ * One `list()`: the objects a subject holds a name on, found backwards —
+ * from the subject to the tuples naming it, through the sets and arrows the
+ * model declares, to the objects.
+ *
+ * **A least fixpoint.** `objects(type, name)` is a union of what its rules
+ * reach, and a rule can reach its own name again — a folder viewable through
+ * its parent, a team member through a team. Such a name, met again on the
+ * current path, answers what the previous round found; rounds repeat until
+ * none adds an id. That is exactly the set of objects with a derivation that
+ * does not loop — what `can()`'s cut finds, one object at a time. A round
+ * that met no loop is final.
+ *
+ * **Depth.** Each round past the first follows the loops one relation
+ * further; more than `maxDepth` rounds is `PERMISSION_DEPTH`, as crossing more
+ * than `maxDepth` relations is for `can()`.
+ *
+ * **Cost.** Every page of `findObjects` for every id each step reaches, every
+ * round. Linear in what the subject can reach — fine for the objects of one
+ * user, not for a subject set holding most of the database.
+ */
+export declare class Reverse {
+    private readonly model;
+    private readonly store;
+    private readonly maxDepth;
+    private readonly ctx;
+    private readonly subject;
+    private readonly question;
+    private previous;
+    private current;
+    private readonly path;
+    private looped;
+    constructor(model: ResolvedModel, store: RelationStore, maxDepth: number, ctx: unknown, subject: Subject, question: string);
+    objects(type: string, name: string): Promise<ReadonlySet<string>>;
+    /** Whether this round found what the previous one did: nothing more to find. */
+    private same;
+    /** The ids of the objects of `typeName` on which the subject holds `name`. */
+    private reach;
+    private relation;
+    private permission;
+    /** The objects of `type` whose `relation` reaches an object on which the subject holds `target`. */
+    private arrow;
+    /** Every id of every page of `findObjects`. */
+    private holding;
+    /** The objects whose field names `id`, from the `fromField`'s lookup. */
+    private lookup;
+    /** The condition, run on the caller's `ctx`, as for `can()`. */
+    private passes;
+}
+//# sourceMappingURL=reverse.d.ts.map

package/dist/permissions/reverse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse.d.ts","sourceRoot":"","sources":["../../src/permissions/reverse.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAEN,KAAK,aAAa,EAGlB,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,OAAO;IAOlB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAX1B,OAAO,CAAC,QAAQ,CAA0C;IAC1D,OAAO,CAAC,OAAO,CAA0C;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,MAAM,CAAS;gBAGL,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM;IAG5B,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAcvE,gFAAgF;IAChF,OAAO,CAAC,IAAI;IAOZ,8EAA8E;YAChE,KAAK;YA2BL,QAAQ;YAgCR,UAAU;IAmBxB,oGAAoG;YACtF,KAAK;IAgCnB,+CAA+C;YACjC,OAAO;IAqBrB,yEAAyE;YAC3D,MAAM;IAoBpB,gEAAgE;IAChE,OAAO,CAAC,MAAM;CAYd"}

package/dist/permissions/walk.d.ts

@@ -0,0 +1,29 @@
+/** The walk behind `can()`: from an object, through its rules, to a subject. */
+import type { Entity, Subject } from '../subjects/subject';
+import type { RelationStore } from './port/types';
+import { type ResolvedModel } from './resolve';
+/** An object on the walk: its entity, and its data when the caller passed it. */
+export interface Node {
+    readonly entity: Entity;
+    readonly data: Readonly<Record<string, unknown>> | null;
+}
+/** One check: its context, its path, and the depth it may reach. */
+export declare class Walk {
+    private readonly model;
+    private readonly store;
+    private readonly maxDepth;
+    private readonly ctx;
+    private readonly question;
+    /** The nodes on the current path. The walk is sequential, so one set is the stack. */
+    private readonly path;
+    constructor(model: ResolvedModel, store: RelationStore, maxDepth: number, ctx: unknown, question: string);
+    /** Whether `subject` holds `name` — a relation or a permission — on `node`. */
+    holds(subject: Subject, node: Node, name: string, depth: number): Promise<boolean>;
+    private relation;
+    private permission;
+    /** The condition, run on the caller's `ctx`. Its absence is a caller's bug, not a denial. */
+    private passes;
+    /** The objects an arrow through `relation` reaches from `node`. */
+    private targets;
+}
+//# sourceMappingURL=walk.d.ts.map

package/dist/permissions/walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../src/permissions/walk.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAIhF,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAEN,KAAK,aAAa,EAGlB,MAAM,WAAW,CAAC;AAEnB,iFAAiF;AACjF,MAAM,WAAW,IAAI;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CACxD;AAED,oEAAoE;AACpE,qBAAa,IAAI;IAKf,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAR1B,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAGxB,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM;IAGlC,+EAA+E;IACzE,KAAK,CACV,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;YA0BL,QAAQ;YAqCR,UAAU;IAuBxB,6FAA6F;IAC7F,OAAO,CAAC,MAAM;IAad,mEAAmE;YACrD,OAAO;CAsBrB"}

package/dist/subjects/notation.d.ts

@@ -0,0 +1,35 @@
+import { type Entity, type RelationTuple, type Subject } from './subject';
+/**
+ * Zanzibar's notation, with typed subjects:
+ *
+ * ```
+ * record:r1#viewer@staff:u1
+ * record:r1#viewer@team:t1#member
+ * ```
+ *
+ * It exists for **messages, logs and documentation**, not as a wire format:
+ * nothing in this package parses a tuple off the network, and a tuple that
+ * crosses a boundary crosses it as an object. Keeping the notation is worth it
+ * because every piece of Zanzibar writing uses it, so an error message in it is
+ * an error message a reader has already learned to read.
+ *
+ * A type holds no `:`, and no part holds `@`, `#` or a parenthesis, so a
+ * subject set needs no parentheses: after the `@`, a `#` can only begin its
+ * relation. {@link parseTuple} refuses a string where that would not hold,
+ * rather than reading it two ways.
+ */
+export declare function formatEntity(entity: Entity): string;
+/** One subject: `staff:u1`, or `team:t1#member`. */
+export declare function formatSubject(subject: Subject): string;
+/** One relation tuple, in the notation above. */
+export declare function formatTuple(tuple: RelationTuple): string;
+/**
+ * Reads a tuple back. Refuses, with a `TypeError`, a string that is not one —
+ * a permission question built from a malformed string is a question whose
+ * answer means nothing, and no request is behind it: the string came from a
+ * developer's own code.
+ */
+export declare function parseTuple(text: string): RelationTuple;
+/** Reads one subject back: `staff:u1`, or `team:t1#member`. */
+export declare function parseSubject(text: string): Subject;
+//# sourceMappingURL=notation.d.ts.map

package/dist/subjects/notation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notation.d.ts","sourceRoot":"","sources":["../../src/subjects/notation.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,MAAM,EAEX,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,MAAM,WAAW,CAAC;AAEnB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAItD;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAExD;AASD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAkBtD;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBlD"}

package/dist/subjects/subject.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The id every decision in this package hangs on: a user's `id`, as `janus()`
+ * mints it.
+ *
+ * In Ory, the equality between a Kratos identity id and Keto's `subject_id` is
+ * a comment and a convention, restated in three repositories and enforced
+ * nowhere. Here a user **is** a subject — see {@link subjectOf} — and that
+ * shared vocabulary is the whole reason users and permissions are one package
+ * rather than two: two packages would make this contract implicit, and an
+ * implicit contract between independently versioned packages breaks silently.
+ *
+ * Opaque: compared with `===`, carried in a URL, logged, never parsed.
+ */
+export type SubjectId = string;
+/**
+ * Something a permission is about or held by — a user, a record, a team — by
+ * its type and its id.
+ *
+ * **Typed, unlike Keto's subjects.** One application has patients and staff,
+ * and an object can hold a relation too (a record's team), so an id alone does
+ * not say who. `type` is a user type of `janus()` or an object type of the
+ * permission model, and the same word as a user's own `type`.
+ */
+export interface Entity {
+    readonly type: string;
+    readonly id: string;
+}
+/**
+ * Everyone who holds `relation` on an entity — `team:t1#member` — which is how
+ * a permission is inherited rather than granted.
+ *
+ * A tuple whose subject is a subject set lets a whole group be given access
+ * with one write: granting a record's `viewer` to `team:t1#member` means every
+ * member of that team can view it, and no member holds a tuple on the record.
+ */
+export interface SubjectSet extends Entity {
+    readonly relation: string;
+}
+/**
+ * Who a tuple is about: one entity, or everyone who holds a relation on one.
+ * {@link isSubjectSet} tells them apart.
+ */
+export type Subject = Entity | SubjectSet;
+/**
+ * A relation tuple: `subject` holds `relation` on `object`.
+ *
+ * `relation` is Zanzibar's word, and a tuple is Zanzibar's unit. What is not
+ * carried over is Keto's `namespace`/`object` pair: here the object is an
+ * {@link Entity}, with the `type` and `id` a user already has.
+ */
+export interface RelationTuple {
+    readonly object: Entity;
+    readonly relation: string;
+    readonly subject: Subject;
+}
+/**
+ * Whether this subject is a set rather than one entity. Narrows.
+ *
+ * It reads the shape, so pass a user through {@link subjectOf} first: a user
+ * whose fields include a string `relation` would otherwise read as a set.
+ */
+export declare function isSubjectSet(subject: Subject): subject is SubjectSet;
+/**
+ * The subject a user is: their `type` and `id`, and nothing else.
+ *
+ * One line, and the entire join between the two halves of the package. It
+ * takes the narrowest shape it reads, so the permissions half never has to
+ * know what a user is, and it copies those two fields so none of the user's
+ * own fields ever reaches a tuple.
+ */
+export declare function subjectOf(user: {
+    readonly type: string;
+    readonly id: SubjectId;
+}): Entity;
+//# sourceMappingURL=subject.d.ts.map

package/dist/subjects/subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject.d.ts","sourceRoot":"","sources":["../../src/subjects/subject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;;;;;GAQG;AACH,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAW,SAAQ,MAAM;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,UAAU,CAEpE;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACvB,GAAG,MAAM,CAET"}

package/dist/time/clock.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Where `now` comes from.
+ *
+ * Injected rather than read from `Date` directly, for one practical reason:
+ * every expiry in this package — sessions, one-time tokens, refresh windows —
+ * is a comparison against the current time, and a spec that has to move the
+ * real clock to test one is a spec that needs fake timers, leaks them, and
+ * fails differently under load. A `Clock` makes those specs synchronous and
+ * exact.
+ *
+ * It is also the seam an application needs if it ever has to reason about a
+ * store's clock rather than its own: MongoDB stamps a TTL against the server's
+ * time, not the process's.
+ */
+export interface Clock {
+    now(): Date;
+}
+/** The process's own clock. The default everywhere. */
+export declare const systemClock: Clock;
+/**
+ * A clock a spec drives by hand.
+ *
+ * Shipped rather than kept in `test/`: a consumer writing their own tests
+ * against this package needs exactly this, and writing it again is how two
+ * subtly different versions of "advance time" come to exist.
+ */
+export declare function fixedClock(start?: Date | number): Clock & {
+    advance(ms: number): void;
+    set(at: Date | number): void;
+};
+//# sourceMappingURL=clock.d.ts.map

package/dist/time/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../src/time/clock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,KAAK;IACrB,GAAG,IAAI,IAAI,CAAC;CACZ;AAED,uDAAuD;AACvD,eAAO,MAAM,WAAW,EAAE,KAEzB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,GAAE,IAAI,GAAG,MAAU,GAAG,KAAK,GAAG;IAC7D,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;CAC7B,CAYA"}

package/dist/time/duration.d.ts

@@ -0,0 +1,23 @@
+/**
+ * A span of time, written the way a configuration file writes one: `'15m'`,
+ * `'720h'`, `'30d'`. A plain number is milliseconds.
+ *
+ * Strings rather than milliseconds everywhere, because `2592000000` in a config
+ * object is a number nobody reads back correctly, and Ory's own configuration
+ * uses exactly this notation — so a team moving across recognises it.
+ */
+export type Duration = number | `${number}${'ms' | 's' | 'm' | 'h' | 'd'}`;
+/**
+ * The duration in milliseconds.
+ *
+ * `where` names the option the consumer wrote — `session.lifespan`, not
+ * `parseDuration` — because this package has half a dozen durations and a
+ * message that does not say which one leaves the reader to guess.
+ *
+ * A bare `TypeError`: durations are written when the application is wired, so
+ * this cannot come from a request, and no handler should answer it. The refusal
+ * reports the **shape** expected and not the value's own bytes beyond echoing
+ * it, which is the rule this repository inherits.
+ */
+export declare function parseDuration(value: Duration, where: string): number;
+//# sourceMappingURL=duration.d.ts.map

package/dist/time/duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../src/time/duration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AAY3E;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA2BpE"}

package/docs/README.md

@@ -0,0 +1,17 @@
+# @nxgt/janus — documentation
+
+The [README](../README.md) shows that it works; these pages show how, one area
+at a time, with an example for every option.
+
+| Page | Read it when |
+| --- | --- |
+| [Users — `janus()`](guide/users.md) | You are wiring `janus()`, declaring one or several kinds of user, or calling `create`, `update`, `list`, `delete` |
+| [Sessions](guide/sessions.md) | You need to know who a request belongs to, set or clear the cookie, renew, sign out, or test expiry |
+| [E-mail verification and password reset](guide/email-flows.md) | You are sending a verification or reset link, and handling what comes back |
+| [Password hashing](guide/passwords.md) | You are choosing a hasher, raising its cost, moving to argon2id, or importing hashes from another system |
+| [Permissions](guide/permissions.md) | You are modelling access with `defineModel`, `fromField` and `when`, and calling `can`, `list`, `grant`, `revoke` |
+| [Errors](guide/errors.md) | You are turning what the package throws into a status code, and want every code and what it carries |
+| [The shared vocabulary](guide/vocabulary.md) | You need subjects and the tuple notation, ids, cursors, durations or `fixedClock` |
+| [Writing an adapter](guide/adapters.md) | You are implementing the store port or the relation store for your database, and running the conformance suites |
+| [Troubleshooting](troubleshooting.md) | You have an error message and want its cause and its fix |
+| [Roadmap](roadmap.md) | You want to know what is coming, what shipped, and what is deliberately not planned |