@plumbus/core 0.1.0

package/dist/execution/__tests__/capability-executor.test.js

@@ -0,0 +1,184 @@
+import { describe, expect, it, vi } from 'vitest';
+import { z } from 'zod';
+import { executeCapability } from '../capability-executor.js';
+import { createExecutionContext } from '../context-factory.js';
+function makeAuth(overrides = {}) {
+    return {
+        userId: 'user-1',
+        roles: ['admin'],
+        scopes: ['read', 'write'],
+        provider: 'test',
+        tenantId: 'tenant-1',
+        ...overrides,
+    };
+}
+function makeCapability(overrides = {}) {
+    return {
+        name: 'getUser',
+        kind: 'query',
+        domain: 'users',
+        input: z.object({ id: z.string() }),
+        output: z.object({ id: z.string(), name: z.string() }),
+        effects: { data: ['User'], events: [], external: [], ai: false },
+        access: { roles: ['admin'] },
+        handler: async (_ctx, input) => ({
+            id: input.id,
+            name: 'Test User',
+        }),
+        ...overrides,
+    };
+}
+function makeCtx(authOverrides = {}) {
+    const audit = { record: vi.fn().mockResolvedValue(undefined) };
+    const ctx = createExecutionContext({
+        auth: makeAuth(authOverrides),
+        data: {},
+        audit,
+    });
+    return { ctx, audit };
+}
+describe('executeCapability', () => {
+    it('executes successfully with valid input and authorization', async () => {
+        const cap = makeCapability();
+        const { ctx } = makeCtx();
+        const result = await executeCapability(cap, ctx, { id: 'u1' });
+        expect(result.success).toBe(true);
+        if (result.success) {
+            expect(result.data).toEqual({ id: 'u1', name: 'Test User' });
+        }
+    });
+    it('rejects invalid input', async () => {
+        const cap = makeCapability();
+        const { ctx } = makeCtx();
+        const result = await executeCapability(cap, ctx, { id: 123 });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.code).toBe('validation');
+        }
+    });
+    it('rejects missing input fields', async () => {
+        const cap = makeCapability();
+        const { ctx } = makeCtx();
+        const result = await executeCapability(cap, ctx, {});
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.code).toBe('validation');
+        }
+    });
+    it('denies access when caller lacks required roles', async () => {
+        const cap = makeCapability({
+            access: { roles: ['superadmin'] },
+        });
+        const { ctx } = makeCtx({ roles: ['viewer'] });
+        const result = await executeCapability(cap, ctx, { id: 'u1' });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.code).toBe('forbidden');
+        }
+    });
+    it('denies access when no policy defined (deny-by-default)', async () => {
+        const cap = makeCapability({ access: undefined });
+        const { ctx } = makeCtx();
+        const result = await executeCapability(cap, ctx, { id: 'u1' });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.code).toBe('forbidden');
+        }
+    });
+    it('catches handler exceptions and returns internal error', async () => {
+        const cap = makeCapability({
+            handler: async () => {
+                throw new Error('Database connection lost');
+            },
+        });
+        const { ctx } = makeCtx();
+        const result = await executeCapability(cap, ctx, { id: 'u1' });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.code).toBe('internal');
+            expect(result.error.metadata?.message).toBe('Database connection lost');
+        }
+    });
+    it('surfaces thrown PlumbusError directly', async () => {
+        const cap = makeCapability({
+            handler: async (ctx) => {
+                throw ctx.errors.notFound('User not found');
+            },
+        });
+        const { ctx } = makeCtx();
+        const result = await executeCapability(cap, ctx, { id: 'u1' });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.code).toBe('notFound');
+            expect(result.error.message).toBe('User not found');
+        }
+    });
+    it('catches invalid handler output', async () => {
+        const cap = makeCapability({
+            handler: async () => ({ wrong: 'shape' }),
+        });
+        const { ctx } = makeCtx();
+        const result = await executeCapability(cap, ctx, { id: 'u1' });
+        expect(result.success).toBe(false);
+        if (!result.success) {
+            expect(result.error.code).toBe('internal');
+            expect(result.error.message).toContain('Invalid output');
+        }
+    });
+    it('records audit on success', async () => {
+        const cap = makeCapability();
+        const { ctx, audit } = makeCtx();
+        await executeCapability(cap, ctx, { id: 'u1' });
+        expect(audit.record).toHaveBeenCalledWith('capability.getUser', expect.objectContaining({
+            capability: 'getUser',
+            outcome: 'success',
+        }));
+    });
+    it('records audit on denial', async () => {
+        const cap = makeCapability({
+            access: { roles: ['superadmin'] },
+        });
+        const { ctx, audit } = makeCtx({ roles: ['viewer'] });
+        await executeCapability(cap, ctx, { id: 'u1' });
+        expect(audit.record).toHaveBeenCalledWith('capability.getUser', expect.objectContaining({
+            outcome: 'denied',
+        }));
+    });
+    it('records audit on failure', async () => {
+        const cap = makeCapability({
+            handler: async () => {
+                throw new Error('boom');
+            },
+        });
+        const { ctx, audit } = makeCtx();
+        await executeCapability(cap, ctx, { id: 'u1' });
+        expect(audit.record).toHaveBeenCalledWith('capability.getUser', expect.objectContaining({
+            outcome: 'failure',
+        }));
+    });
+    it('skips audit when audit.enabled is false', async () => {
+        const cap = makeCapability({
+            audit: { enabled: false, event: 'test' },
+        });
+        const { ctx, audit } = makeCtx();
+        await executeCapability(cap, ctx, { id: 'u1' });
+        expect(audit.record).not.toHaveBeenCalled();
+    });
+    it('uses custom audit event name', async () => {
+        const cap = makeCapability({
+            audit: { enabled: true, event: 'custom.user.query' },
+        });
+        const { ctx, audit } = makeCtx();
+        await executeCapability(cap, ctx, { id: 'u1' });
+        expect(audit.record).toHaveBeenCalledWith('custom.user.query', expect.anything());
+    });
+    it('allows public capabilities without auth', async () => {
+        const cap = makeCapability({
+            access: { public: true },
+        });
+        const { ctx } = makeCtx({ userId: undefined, roles: [] });
+        const result = await executeCapability(cap, ctx, { id: 'u1' });
+        expect(result.success).toBe(true);
+    });
+});
+//# sourceMappingURL=capability-executor.test.js.map

package/dist/execution/__tests__/capability-executor.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-executor.test.js","sourceRoot":"","sources":["../../../src/execution/__tests__/capability-executor.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,SAAS,QAAQ,CAAC,YAAkC,EAAE;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,CAAC,OAAO,CAAC;QAChB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,YAAyC,EAAE;IACjE,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;QAChE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;QAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,WAAW;SAClB,CAAC;QACF,GAAG,SAAS;KACS,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,gBAAsC,EAAE;IACvD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC7B,IAAI,EAAE,EAAE;QACR,KAAK;KACN,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAE9D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE;SAC3B,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,SAAS,EAAS,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;SACK,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,GAAQ,EAAE,EAAE;gBAC1B,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC9C,CAAC;SACK,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SACnC,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QAEjC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACvC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC;YACtB,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,SAAS;SACnB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE;SAC3B,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEtD,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACvC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC;YACtB,OAAO,EAAE,QAAQ;SAClB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;SACK,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QAEjC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CACvC,oBAAoB,EACpB,MAAM,CAAC,gBAAgB,CAAC;YACtB,OAAO,EAAE,SAAS;SACnB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;SAClC,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QAEjC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE;SAC9C,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QAEjC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAClB,CAAC,CAAC;QACV,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/execution/__tests__/capability-registry.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capability-registry.test.d.ts.map

package/dist/execution/__tests__/capability-registry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-registry.test.d.ts","sourceRoot":"","sources":["../../../src/execution/__tests__/capability-registry.test.ts"],"names":[],"mappings":""}

package/dist/execution/__tests__/capability-registry.test.js

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+import { z } from 'zod';
+import { CapabilityRegistry } from '../capability-registry.js';
+function makeCap(name, domain = 'core') {
+    return {
+        name,
+        kind: 'query',
+        domain,
+        input: z.object({}),
+        output: z.object({}),
+        effects: { data: [], events: [], external: [], ai: false },
+        handler: async () => ({}),
+    };
+}
+describe('CapabilityRegistry', () => {
+    it('registers and retrieves a capability', () => {
+        const reg = new CapabilityRegistry();
+        const cap = makeCap('getUser', 'users');
+        reg.register(cap);
+        expect(reg.get('getUser')).toBe(cap);
+        expect(reg.has('getUser')).toBe(true);
+    });
+    it('throws on duplicate registration', () => {
+        const reg = new CapabilityRegistry();
+        reg.register(makeCap('getUser'));
+        expect(() => reg.register(makeCap('getUser'))).toThrow('Capability "getUser" is already registered');
+    });
+    it('returns undefined for unknown capability', () => {
+        const reg = new CapabilityRegistry();
+        expect(reg.get('missing')).toBeUndefined();
+        expect(reg.has('missing')).toBe(false);
+    });
+    it('registers multiple capabilities', () => {
+        const reg = new CapabilityRegistry();
+        reg.registerAll([makeCap('a'), makeCap('b'), makeCap('c')]);
+        expect(reg.getAll()).toHaveLength(3);
+    });
+    it('filters by domain', () => {
+        const reg = new CapabilityRegistry();
+        reg.registerAll([
+            makeCap('getUser', 'users'),
+            makeCap('createUser', 'users'),
+            makeCap('getProject', 'projects'),
+        ]);
+        const userCaps = reg.getByDomain('users');
+        expect(userCaps).toHaveLength(2);
+        expect(userCaps.map((c) => c.name)).toEqual(['getUser', 'createUser']);
+    });
+});
+//# sourceMappingURL=capability-registry.test.js.map

package/dist/execution/__tests__/capability-registry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-registry.test.js","sourceRoot":"","sources":["../../../src/execution/__tests__/capability-registry.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,SAAS,OAAO,CAAC,IAAY,EAAE,MAAM,GAAG,MAAM;IAC5C,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,OAAO;QACb,MAAM;QACN,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;QAC1D,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KACJ,CAAC;AAC1B,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAElB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CACpD,4CAA4C,CAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,CAAC;YACd,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;YAC3B,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;YAC9B,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/execution/__tests__/context-factory.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context-factory.test.d.ts.map

package/dist/execution/__tests__/context-factory.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-factory.test.d.ts","sourceRoot":"","sources":["../../../src/execution/__tests__/context-factory.test.ts"],"names":[],"mappings":""}

package/dist/execution/__tests__/context-factory.test.js

@@ -0,0 +1,116 @@
+import { describe, expect, it } from 'vitest';
+import { createExecutionContext } from '../context-factory.js';
+function makeAuth(overrides = {}) {
+    return {
+        userId: 'user-1',
+        roles: ['admin'],
+        scopes: ['read', 'write'],
+        provider: 'test',
+        tenantId: 'tenant-1',
+        ...overrides,
+    };
+}
+describe('createExecutionContext', () => {
+    it('assembles a full context from dependencies', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth(),
+            data: {},
+        });
+        expect(ctx.auth.userId).toBe('user-1');
+        expect(ctx.data).toEqual({});
+        expect(ctx.events).toBeDefined();
+        expect(ctx.flows).toBeDefined();
+        expect(ctx.ai).toBeDefined();
+        expect(ctx.audit).toBeDefined();
+        expect(ctx.errors).toBeDefined();
+        expect(ctx.logger).toBeDefined();
+        expect(ctx.time).toBeDefined();
+        expect(ctx.config).toBeDefined();
+    });
+    it('uses provided services when given', async () => {
+        const customEvents = {
+            emit: async () => { },
+        };
+        const ctx = createExecutionContext({
+            auth: makeAuth(),
+            data: {},
+            events: customEvents,
+        });
+        expect(ctx.events).toBe(customEvents);
+    });
+    it('provides working error service', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth(),
+            data: {},
+        });
+        const err = ctx.errors.validation('bad input');
+        expect(err.code).toBe('validation');
+        expect(err.message).toBe('bad input');
+    });
+    it('provides working time service', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth(),
+            data: {},
+        });
+        const now = ctx.time.now();
+        expect(now).toBeInstanceOf(Date);
+    });
+    it('stubs AI service to throw when not configured', async () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth(),
+            data: {},
+        });
+        await expect(ctx.ai.generate({ prompt: 'test', input: {} })).rejects.toThrow('AI service not configured');
+    });
+    it('passes through custom config', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth(),
+            data: {},
+            config: { appName: 'test-app' },
+        });
+        expect(ctx.config.appName).toBe('test-app');
+    });
+    it('provides security service with hasRole/hasScope', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth({ roles: ['admin', 'editor'], scopes: ['read', 'write'] }),
+            data: {},
+        });
+        expect(ctx.security.hasRole('admin')).toBe(true);
+        expect(ctx.security.hasRole('viewer')).toBe(false);
+        expect(ctx.security.hasScope('read')).toBe(true);
+        expect(ctx.security.hasScope('delete')).toBe(false);
+    });
+    it('security.hasAllRoles checks multiple roles', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth({ roles: ['admin', 'editor'] }),
+            data: {},
+        });
+        expect(ctx.security.hasAllRoles(['admin', 'editor'])).toBe(true);
+        expect(ctx.security.hasAllRoles(['admin', 'superadmin'])).toBe(false);
+    });
+    it('security.hasAllScopes checks multiple scopes', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth({ scopes: ['read', 'write'] }),
+            data: {},
+        });
+        expect(ctx.security.hasAllScopes(['read', 'write'])).toBe(true);
+        expect(ctx.security.hasAllScopes(['read', 'delete'])).toBe(false);
+    });
+    it('security.requireRole throws for missing role', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth({ roles: ['editor'] }),
+            data: {},
+        });
+        expect(() => ctx.security.requireRole('editor')).not.toThrow();
+        expect(() => ctx.security.requireRole('admin')).toThrow('Forbidden');
+    });
+    it('security.requireScope throws for missing scope', () => {
+        const ctx = createExecutionContext({
+            auth: makeAuth({ scopes: ['read'] }),
+            data: {},
+        });
+        expect(() => ctx.security.requireScope('read')).not.toThrow();
+        expect(() => ctx.security.requireScope('write')).toThrow('Forbidden');
+    });
+});
+//# sourceMappingURL=context-factory.test.js.map

package/dist/execution/__tests__/context-factory.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-factory.test.js","sourceRoot":"","sources":["../../../src/execution/__tests__/context-factory.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,SAAS,QAAQ,CAAC,YAAkC,EAAE;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,CAAC,OAAO,CAAC;QAChB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE;YAChB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;SACrB,CAAC;QACF,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE;YAChB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE;YAChB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE;YAChB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE;YAChB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1E,2BAA2B,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,EAAE;YAChB,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;SAChC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACzE,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/execution/authorization.d.ts

@@ -0,0 +1,11 @@
+import type { AccessPolicy, AuthContext } from '../types/security.js';
+export interface AuthorizationResult {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Evaluate an AccessPolicy against an AuthContext.
+ * Deny-by-default: if no policy is provided, access is denied.
+ */
+export declare function evaluateAccess(policy: AccessPolicy | undefined, auth: AuthContext): AuthorizationResult;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/execution/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/execution/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,IAAI,EAAE,WAAW,GAChB,mBAAmB,CAmDrB"}

package/dist/execution/authorization.js

@@ -0,0 +1,50 @@
+/**
+ * Evaluate an AccessPolicy against an AuthContext.
+ * Deny-by-default: if no policy is provided, access is denied.
+ */
+export function evaluateAccess(policy, auth) {
+    // No policy → deny by default
+    if (!policy) {
+        return { allowed: false, reason: 'No access policy defined' };
+    }
+    // Public capabilities are always allowed
+    if (policy.public) {
+        return { allowed: true };
+    }
+    // Must be authenticated (have a userId)
+    if (!auth.userId) {
+        return { allowed: false, reason: 'Authentication required' };
+    }
+    // Service account check — if the caller is a recognized service account, allow
+    if (policy.serviceAccounts && policy.serviceAccounts.length > 0) {
+        if (auth.userId && policy.serviceAccounts.includes(auth.userId)) {
+            return { allowed: true };
+        }
+    }
+    // Tenant scope enforcement
+    if (policy.tenantScoped && !auth.tenantId) {
+        return { allowed: false, reason: 'Tenant context required' };
+    }
+    // Role check — caller must have at least one required role
+    if (policy.roles && policy.roles.length > 0) {
+        const hasRole = policy.roles.some((r) => auth.roles.includes(r));
+        if (!hasRole) {
+            return {
+                allowed: false,
+                reason: `Required roles: ${policy.roles.join(', ')}`,
+            };
+        }
+    }
+    // Scope check — caller must have all required scopes
+    if (policy.scopes && policy.scopes.length > 0) {
+        const missingScopes = policy.scopes.filter((s) => !auth.scopes.includes(s));
+        if (missingScopes.length > 0) {
+            return {
+                allowed: false,
+                reason: `Missing scopes: ${missingScopes.join(', ')}`,
+            };
+        }
+    }
+    return { allowed: true };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/execution/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/execution/authorization.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAgC,EAChC,IAAiB;IAEjB,8BAA8B;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChE,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,+EAA+E;IAC/E,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,2DAA2D;IAC3D,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,mBAAmB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,mBAAmB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/execution/capability-executor.d.ts

@@ -0,0 +1,23 @@
+import type { z } from 'zod';
+import type { CapabilityContract } from '../types/capability.js';
+import type { ExecutionContext } from '../types/context.js';
+import type { PlumbusError } from '../types/errors.js';
+export interface ExecutionResult<T = unknown> {
+    success: true;
+    data: T;
+}
+export interface ExecutionFailure {
+    success: false;
+    error: PlumbusError;
+}
+export type CapabilityResult<T = unknown> = ExecutionResult<T> | ExecutionFailure;
+/**
+ * Execute a capability through the full pipeline:
+ * 1. Validate input
+ * 2. Evaluate access policy
+ * 3. Execute handler
+ * 4. Validate output
+ * 5. Record audit
+ */
+export declare function executeCapability<TInput extends z.ZodTypeAny, TOutput extends z.ZodTypeAny>(capability: CapabilityContract<TInput, TOutput>, ctx: ExecutionContext, rawInput: unknown): Promise<CapabilityResult<z.infer<TOutput>>>;
+//# sourceMappingURL=capability-executor.d.ts.map

package/dist/execution/capability-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-executor.d.ts","sourceRoot":"","sources":["../../src/execution/capability-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,CAAC,CAAC;CACT;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC;AAElF;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,SAAS,CAAC,CAAC,UAAU,EAAE,OAAO,SAAS,CAAC,CAAC,UAAU,EAC/F,UAAU,EAAE,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/C,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CA+D7C"}

package/dist/execution/capability-executor.js

@@ -0,0 +1,91 @@
+import { isPlumbusError } from '../errors/index.js';
+import { evaluateAccess } from './authorization.js';
+/**
+ * Execute a capability through the full pipeline:
+ * 1. Validate input
+ * 2. Evaluate access policy
+ * 3. Execute handler
+ * 4. Validate output
+ * 5. Record audit
+ */
+export async function executeCapability(capability, ctx, rawInput) {
+    // 1. Validate input against schema
+    const inputResult = capability.input.safeParse(rawInput);
+    if (!inputResult.success) {
+        const error = ctx.errors.validation('Invalid input', {
+            capability: capability.name,
+            issues: inputResult.error.issues,
+        });
+        await recordAudit(ctx, capability, 'failure', { error });
+        return { success: false, error };
+    }
+    const input = inputResult.data;
+    // 2. Evaluate access policy (deny-by-default)
+    const authResult = evaluateAccess(capability.access, ctx.auth);
+    if (!authResult.allowed) {
+        const error = ctx.errors.forbidden(authResult.reason ?? 'Access denied', {
+            capability: capability.name,
+        });
+        await recordAudit(ctx, capability, 'denied', { error });
+        return { success: false, error };
+    }
+    // 3. Execute handler
+    let rawOutput;
+    try {
+        rawOutput = await capability.handler(ctx, input);
+    }
+    catch (err) {
+        // If the handler threw a PlumbusError, surface it directly
+        if (isPlumbusError(err)) {
+            await recordAudit(ctx, capability, 'failure', { error: err });
+            return { success: false, error: err };
+        }
+        const error = ctx.errors.internal('Capability execution failed', {
+            capability: capability.name,
+            message: err instanceof Error ? err.message : String(err),
+        });
+        ctx.logger.error(`Capability "${capability.name}" threw an error`, {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        await recordAudit(ctx, capability, 'failure', { error });
+        return { success: false, error };
+    }
+    // 4. Validate output against schema
+    const outputResult = capability.output.safeParse(rawOutput);
+    if (!outputResult.success) {
+        const error = ctx.errors.internal('Invalid output from capability', {
+            capability: capability.name,
+            issues: outputResult.error.issues,
+        });
+        ctx.logger.error(`Capability "${capability.name}" returned invalid output`, {
+            issues: outputResult.error.issues,
+        });
+        await recordAudit(ctx, capability, 'failure', { error });
+        return { success: false, error };
+    }
+    // 5. Record success audit
+    await recordAudit(ctx, capability, 'success');
+    return { success: true, data: outputResult.data };
+}
+async function recordAudit(ctx, capability, outcome, metadata) {
+    // Skip if audit is explicitly disabled for this capability
+    if (capability.audit?.enabled === false)
+        return;
+    const auditEvent = capability.audit?.event ?? `capability.${capability.name}`;
+    try {
+        await ctx.audit.record(auditEvent, {
+            capability: capability.name,
+            domain: capability.domain,
+            kind: capability.kind,
+            outcome,
+            actor: ctx.auth.userId,
+            tenantId: ctx.auth.tenantId,
+            ...metadata,
+        });
+    }
+    catch {
+        // Audit failures should not break capability execution
+        ctx.logger.error(`Failed to record audit for capability "${capability.name}"`);
+    }
+}
+//# sourceMappingURL=capability-executor.js.map

package/dist/execution/capability-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-executor.js","sourceRoot":"","sources":["../../src/execution/capability-executor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIpD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAcpD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA+C,EAC/C,GAAqB,EACrB,QAAiB;IAEjB,mCAAmC;IACnC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,EAAE;YACnD,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM;SACjC,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAuB,CAAC;IAElD,8CAA8C;IAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,eAAe,EAAE;YACvE,UAAU,EAAE,UAAU,CAAC,IAAI;SAC5B,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,qBAAqB;IACrB,IAAI,SAA2B,CAAC;IAChC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2DAA2D;QAC3D,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,EAAE;YAC/D,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,IAAI,kBAAkB,EAAE;YACjE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,oCAAoC;IACpC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YAClE,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,IAAI,2BAA2B,EAAE;YAC1E,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAE9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAwB,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAqB,EACrB,UAAwC,EACxC,OAAyC,EACzC,QAAkC;IAElC,2DAA2D;IAC3D,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO;IAEhD,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,IAAI,cAAc,UAAU,CAAC,IAAI,EAAE,CAAC;IAE9E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE;YACjC,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,OAAO;YACP,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YACtB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;YAC3B,GAAG,QAAQ;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;QACvD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;IACjF,CAAC;AACH,CAAC"}

package/dist/execution/capability-registry.d.ts

@@ -0,0 +1,33 @@
+import type { CapabilityContract } from '../types/capability.js';
+/**
+ * Registry that holds all discovered/registered capabilities,
+ * indexed by name for lookup during execution and route generation.
+ */
+export declare class CapabilityRegistry {
+    private capabilities;
+    /**
+     * Register a capability contract. Throws on duplicate names.
+     */
+    register(capability: CapabilityContract): void;
+    /**
+     * Register multiple capabilities at once.
+     */
+    registerAll(capabilities: CapabilityContract[]): void;
+    /**
+     * Get a capability by name.
+     */
+    get(name: string): CapabilityContract | undefined;
+    /**
+     * Return all registered capabilities.
+     */
+    getAll(): CapabilityContract[];
+    /**
+     * Return all capabilities for a specific domain.
+     */
+    getByDomain(domain: string): CapabilityContract[];
+    /**
+     * Check if a capability is registered.
+     */
+    has(name: string): boolean;
+}
+//# sourceMappingURL=capability-registry.d.ts.map

package/dist/execution/capability-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-registry.d.ts","sourceRoot":"","sources":["../../src/execution/capability-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,YAAY,CAAyC;IAE7D;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAO9C;;OAEG;IACH,WAAW,CAAC,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI;IAMrD;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIjD;;OAEG;IACH,MAAM,IAAI,kBAAkB,EAAE;IAI9B;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAIjD;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAG3B"}