@raybase/core 0.0.2 → 0.3.4

package/dist/policies.js

@@ -0,0 +1,158 @@
+export function policySubjectId(user) {
+    return user.membershipId ?? user.id;
+}
+export function defineRoles(roles) {
+    return roles;
+}
+export function role(first, second) {
+    const roleName = typeof first === "string" ? first : second;
+    if (!roleName)
+        throw new Error("role() requires a role name");
+    return { kind: "role", role: roleName };
+}
+export function owns(column) {
+    return { kind: "owns", column };
+}
+export function fromService(service) {
+    return { kind: "servicePrincipal", service };
+}
+export function operator() {
+    return { kind: "operator" };
+}
+export function anyOf(...policies) {
+    return { kind: "anyOf", policies };
+}
+export function allOf(...policies) {
+    return { kind: "allOf", policies };
+}
+export function not(policy) {
+    return { kind: "not", policy };
+}
+export const allowAll = Object.freeze({ kind: "allowAll" });
+export const denyAll = Object.freeze({ kind: "denyAll" });
+export function serializePolicyExpression(policy) {
+    if (!policy)
+        return undefined;
+    switch (policy.kind) {
+        case "allowAll":
+        case "denyAll":
+        case "operator":
+            return { kind: policy.kind };
+        case "role":
+            return { kind: "role", role: policy.role };
+        case "owns":
+            return { kind: "owns", column: policy.column };
+        case "servicePrincipal":
+            return { kind: "servicePrincipal", service: policy.service };
+        case "anyOf":
+        case "allOf":
+            return { kind: policy.kind, policies: policy.policies.map((candidate) => serializePolicyExpression(candidate)) };
+        case "not":
+            return { kind: "not", policy: serializePolicyExpression(policy.policy) };
+    }
+}
+export function roleAllows(userRole, required) {
+    return userRole === required;
+}
+function hasAppRole(user, required) {
+    const roles = user.appRoles?.length ? user.appRoles : ["user"];
+    return roles.some((candidate) => roleAllows(candidate, required));
+}
+export function evaluatePolicy(policy, ctx) {
+    if (!policy)
+        return false;
+    if (ctx.adminOverride)
+        return true;
+    switch (policy.kind) {
+        case "allowAll":
+            return true;
+        case "denyAll":
+            return false;
+        case "role":
+            return hasAppRole(ctx.user, policy.role);
+        case "owns": {
+            const value = ctx.row?.[policy.column] ?? ctx.newRow?.[policy.column];
+            return typeof value === "string" && value === policySubjectId(ctx.user);
+        }
+        case "servicePrincipal":
+            return ctx.principal?.kind === "service" && ctx.principal.service === policy.service;
+        case "operator":
+            return ctx.action === "read" && ctx.principal?.kind === "operator";
+        case "anyOf":
+            return policy.policies.some((candidate) => evaluatePolicy(candidate, ctx));
+        case "allOf":
+            return policy.policies.every((candidate) => evaluatePolicy(candidate, ctx));
+        case "not":
+            return !evaluatePolicy(policy.policy, ctx);
+    }
+}
+/**
+ * Reduce a read policy using only principal-level context. This deliberately
+ * does not inspect a row: `row_dependent` means the normal row policy still
+ * needs to be applied by the caller.
+ */
+export function classifyReadPolicy(policy, ctx) {
+    if (ctx.adminOverride)
+        return "allowed";
+    if (!policy)
+        return "denied";
+    switch (policy.kind) {
+        case "allowAll":
+            return "allowed";
+        case "denyAll":
+            return "denied";
+        case "role":
+        case "servicePrincipal":
+        case "operator":
+            return evaluatePolicy(policy, { ...ctx, action: "read" }) ? "allowed" : "denied";
+        case "owns":
+            return "row_dependent";
+        case "anyOf": {
+            const scopes = policy.policies.map((candidate) => classifyReadPolicy(candidate, ctx));
+            if (scopes.includes("allowed"))
+                return "allowed";
+            return scopes.every((scope) => scope === "denied") ? "denied" : "row_dependent";
+        }
+        case "allOf": {
+            const scopes = policy.policies.map((candidate) => classifyReadPolicy(candidate, ctx));
+            if (scopes.includes("denied"))
+                return "denied";
+            return scopes.every((scope) => scope === "allowed") ? "allowed" : "row_dependent";
+        }
+        case "not": {
+            const scope = classifyReadPolicy(policy.policy, ctx);
+            if (scope === "row_dependent")
+                return scope;
+            return scope === "allowed" ? "denied" : "allowed";
+        }
+        default: {
+            const unsupported = policy;
+            throw new Error(`Unsupported policy kind: ${String(unsupported.kind)}`);
+        }
+    }
+}
+export function describePolicy(policy) {
+    if (!policy)
+        return "deny-all";
+    switch (policy.kind) {
+        case "allowAll":
+            return "allow all signed-in users";
+        case "denyAll":
+            return "deny all";
+        case "role":
+            return `role ${policy.role}`;
+        case "owns":
+            return `owns ${policy.column}`;
+        case "servicePrincipal":
+            return `service principal ${policy.service}`;
+        case "operator":
+            return "operator";
+        case "anyOf":
+            return `any of (${policy.policies.map(describePolicy).join(", ")})`;
+        case "allOf":
+            return `all of (${policy.policies.map(describePolicy).join(", ")})`;
+        case "not":
+            return `not (${describePolicy(policy.policy)})`;
+    }
+}
+//# sourceMappingURL=policies.js.map

package/dist/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AA+BA,MAAM,UAAU,eAAe,CAAC,IAAiB;IAC/C,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,EAAE,CAAC;AACtC,CAAC;AAoCD,MAAM,UAAU,WAAW,CAAwC,KAAY;IAC7E,OAAO,KAAmC,CAAC;AAC7C,CAAC;AAID,MAAM,UAAU,IAAI,CAAC,KAAwC,EAAE,MAAoB;IACjF,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,QAA4B;IACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,QAA4B;IACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAwB;IAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAW,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC,CAAC;AAEnE,MAAM,UAAU,yBAAyB,CAAC,MAAoC;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjD,KAAK,kBAAkB;YACrB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/D,KAAK,OAAO,CAAC;QACb,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAA+B,CAAC,EAAE,CAAC;QACjJ,KAAK,KAAK;YACR,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAA+B,EAAE,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAqB,EAAE,QAAqB;IACrE,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,IAAiB,EAAE,QAAqB;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAoC,EAAE,GAAkB;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEnC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,kBAAkB;YACrB,OAAO,GAAG,CAAC,SAAS,EAAE,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;QACvF,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,IAAI,KAAK,UAAU,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9E,KAAK,KAAK;YACR,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAoC,EACpC,GAAgE;IAEhE,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAE7B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM,CAAC;QACZ,KAAK,kBAAkB,CAAC;QACxB,KAAK,UAAU;YACb,OAAO,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnF,KAAK,MAAM;YACT,OAAO,eAAe,CAAC;QACzB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;QAClF,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;QACpF,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,KAAK,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YAC5C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAG,MAA4B,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAoC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IAC/B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,2BAA2B,CAAC;QACrC,KAAK,SAAS;YACZ,OAAO,UAAU,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,kBAAkB;YACrB,OAAO,qBAAqB,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/C,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACtE,KAAK,OAAO;YACV,OAAO,WAAW,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACtE,KAAK,KAAK;YACR,OAAO,QAAQ,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/principal.d.ts

@@ -0,0 +1,143 @@
+import type { RaybaseUser } from "./policies.js";
+export type RaybasePrincipal = {
+    kind: "user";
+    user: RaybaseUser;
+    userId?: string;
+    membershipId?: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+    roles?: string[];
+} | {
+    kind: "public";
+    id: string;
+    sessionHash?: string | null;
+    scopeHash?: string | null;
+    source?: string | null;
+    surface?: string;
+    route?: string;
+    origin?: string;
+    ipHash?: string;
+    userAgentHash?: string;
+    organizationId?: string | null;
+    appId?: string | null;
+} | {
+    kind: "operator";
+    user: RaybaseUser;
+    userId?: string;
+    operatorRole: RaybaseUser["operatorRole"];
+    membershipId?: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+} | {
+    kind: "service";
+    service: string;
+    id?: string;
+    organizationId?: string | null;
+    appId?: string | null;
+} | {
+    /**
+     * An agent run acting through an action. The run still carries the
+     * authority of `onBehalfOf` (the conversation member, a public visitor,
+     * or the service user of a scheduled run) for data policies and action
+     * policies; this kind exists so actions and audit can tell an agent's
+     * writes from a person's without trusting prompt discipline.
+     */
+    kind: "agent";
+    /** Registered agent name. */
+    agent: string;
+    onBehalfOf: Extract<RaybasePrincipal, {
+        kind: "user" | "public" | "service";
+    }>;
+    /** The on-behalf-of user when there is one. Service and public runs leave it unset. */
+    user?: RaybaseUser;
+    userId?: string;
+    membershipId?: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+    /** Scopes the agent declares in its definition; the empty list when it declares none. */
+    scopes: string[];
+    runId?: string;
+    conversationId?: string | null;
+};
+export type RaybaseAiPrincipal = Extract<RaybasePrincipal, {
+    kind: "user" | "public" | "service";
+}>;
+export type RaybaseAgentPrincipal = Extract<RaybasePrincipal, {
+    kind: "user" | "public";
+}>;
+export type RaybaseJobPrincipal = Exclude<RaybasePrincipal, {
+    kind: "public";
+}>;
+export type RaybaseStoredPrincipal = {
+    kind: "user" | "operator" | "service" | "agent";
+    id: string | null;
+    userId?: string | null;
+    membershipId?: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+    service?: string | null;
+};
+export declare function principalKind(principal: RaybasePrincipal): RaybasePrincipal["kind"];
+export declare function principalId(principal: RaybasePrincipal): string | null;
+export declare function principalUser(principal: RaybasePrincipal): RaybaseUser | null;
+export declare function userFromPrincipal(principal: RaybasePrincipal): RaybaseUser | null;
+/**
+ * The principal whose authority a call carries: an agent principal unwraps to
+ * the user, visitor, or service it runs on behalf of; every other principal
+ * is its own authority. Policy and audience checks evaluate this one.
+ */
+export declare function principalOnBehalfOf(principal: RaybasePrincipal): Exclude<RaybasePrincipal, {
+    kind: "agent";
+}>;
+/** True only for an agent principal whose definition declares `scope`. */
+export declare function agentPrincipalHasScope(principal: RaybasePrincipal, scope: string): boolean;
+export declare function agentPrincipal(input: {
+    agent: string;
+    onBehalfOf: RaybasePrincipal;
+    scopes?: readonly string[];
+    organizationId?: string | null;
+    appId?: string | null;
+    runId?: string;
+    conversationId?: string | null;
+}): Extract<RaybasePrincipal, {
+    kind: "agent";
+}>;
+export declare function principalToStored(principal: RaybasePrincipal): RaybaseStoredPrincipal;
+export declare function principalFromStored(stored: RaybaseStoredPrincipal | {
+    kind: string | null;
+    id: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+}, user?: RaybaseUser | null): RaybaseJobPrincipal;
+export declare function principalToAuditRef(principal: RaybasePrincipal | null | undefined): RaybaseStoredPrincipal;
+export declare function servicePrincipal(service: string, options?: {
+    id?: string;
+    organizationId?: string | null;
+    appId?: string | null;
+}): Extract<RaybasePrincipal, {
+    kind: "service";
+}>;
+export declare function userPrincipal(user: RaybaseUser, options?: {
+    userId?: string;
+    membershipId?: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+    roles?: string[];
+}): Extract<RaybasePrincipal, {
+    kind: "user";
+}>;
+export declare function operatorPrincipal(user: RaybaseUser, options?: {
+    userId?: string;
+    membershipId?: string | null;
+    organizationId?: string | null;
+    appId?: string | null;
+    operatorRole?: RaybaseUser["operatorRole"];
+}): Extract<RaybasePrincipal, {
+    kind: "operator";
+}>;
+export declare function publicPrincipal(input: Omit<Extract<RaybasePrincipal, {
+    kind: "public";
+}>, "kind">): Extract<RaybasePrincipal, {
+    kind: "public";
+}>;
+//# sourceMappingURL=principal.d.ts.map

package/dist/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../src/principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GACD;IACE;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IAC/E,uFAAuF;IACvF,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,yFAAyF;IACzF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEN,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,CAAC,CAAC;AACpG,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CAAE,CAAC,CAAC;AAC3F,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAC;AAEhF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;IAChD,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,aAAa,CAAC,SAAS,EAAE,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAEnF;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAMtE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,gBAAgB,GAAG,WAAW,GAAG,IAAI,CAG7E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,GAAG,WAAW,GAAG,IAAI,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAE7G;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1F;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,gBAAgB,CAAC;IAC7B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAe/C;AAiBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,GAAG,sBAAsB,CA4CrF;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,mBAAmB,CAgBtN;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,sBAAsB,CAY1G;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAEtL;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAUtO;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAA;CAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAUxQ;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAEjJ"}

package/dist/principal.js

@@ -0,0 +1,174 @@
+export function principalKind(principal) {
+    return principal.kind;
+}
+export function principalId(principal) {
+    if (principal.kind === "user")
+        return principal.membershipId ?? principal.user.membershipId ?? principal.user.id;
+    if (principal.kind === "operator")
+        return principal.userId ?? principal.user.identityId ?? principal.user.id;
+    if (principal.kind === "public")
+        return principal.id;
+    if (principal.kind === "agent")
+        return principal.agent;
+    return principal.id ?? principal.service;
+}
+export function principalUser(principal) {
+    if (principal.kind === "agent")
+        return principal.user ?? null;
+    return principal.kind === "user" || principal.kind === "operator" ? principal.user : null;
+}
+export function userFromPrincipal(principal) {
+    return principal.kind === "user" ? principal.user : null;
+}
+/**
+ * The principal whose authority a call carries: an agent principal unwraps to
+ * the user, visitor, or service it runs on behalf of; every other principal
+ * is its own authority. Policy and audience checks evaluate this one.
+ */
+export function principalOnBehalfOf(principal) {
+    return principal.kind === "agent" ? principal.onBehalfOf : principal;
+}
+/** True only for an agent principal whose definition declares `scope`. */
+export function agentPrincipalHasScope(principal, scope) {
+    return principal.kind === "agent" && principal.scopes.includes(scope);
+}
+export function agentPrincipal(input) {
+    const onBehalfOf = agentOnBehalfOf(input.onBehalfOf);
+    const user = onBehalfOf.kind === "user" ? onBehalfOf.user : undefined;
+    return {
+        kind: "agent",
+        agent: input.agent,
+        onBehalfOf,
+        ...(user ? { user, userId: onBehalfOf.kind === "user" ? onBehalfOf.userId ?? user.identityId ?? user.id : undefined } : {}),
+        membershipId: onBehalfOf.kind === "user" ? onBehalfOf.membershipId ?? user?.membershipId ?? null : null,
+        organizationId: input.organizationId ?? onBehalfOf.organizationId ?? null,
+        appId: input.appId ?? onBehalfOf.appId ?? null,
+        scopes: [...new Set((input.scopes ?? []).map((scope) => scope.trim()).filter(Boolean))],
+        ...(input.runId ? { runId: input.runId } : {}),
+        ...(input.conversationId !== undefined ? { conversationId: input.conversationId } : {})
+    };
+}
+/**
+ * Normalizes whatever a run carries into an on-behalf-of principal. The
+ * agent lane represents scheduled and conversation-less runs as the service
+ * user `service:<name>`; those become service principals here so the audit
+ * trail never claims a person. An operator acts as a user for the run.
+ */
+function agentOnBehalfOf(principal) {
+    if (principal.kind === "agent")
+        return principal.onBehalfOf;
+    if (principal.kind === "operator")
+        return userPrincipal(principal.user, { userId: principal.userId, membershipId: principal.membershipId, organizationId: principal.organizationId, appId: principal.appId });
+    if (principal.kind === "user" && principal.user.id.startsWith("service:")) {
+        return servicePrincipal(principal.user.id.slice("service:".length) || "raybase-agent", { organizationId: principal.organizationId, appId: principal.appId });
+    }
+    return principal;
+}
+export function principalToStored(principal) {
+    if (principal.kind === "public") {
+        throw new Error("Public principals cannot be stored as job execution principals");
+    }
+    if (principal.kind === "agent") {
+        const user = principal.onBehalfOf.kind === "user" ? principal.onBehalfOf.user : null;
+        return {
+            kind: "agent",
+            id: principal.agent,
+            userId: user ? principal.userId ?? user.identityId ?? user.id : null,
+            membershipId: principal.membershipId ?? null,
+            organizationId: principal.organizationId ?? null,
+            appId: principal.appId,
+            service: principal.onBehalfOf.kind === "service" ? principal.onBehalfOf.service : null
+        };
+    }
+    if (principal.kind === "user") {
+        const membershipId = principal.membershipId ?? principal.user.membershipId ?? principal.user.id;
+        return {
+            kind: "user",
+            id: membershipId,
+            membershipId,
+            userId: principal.user.identityId ?? principal.userId ?? principal.user.id,
+            organizationId: principal.organizationId ?? principal.user.organizationId ?? null,
+            appId: principal.appId
+        };
+    }
+    if (principal.kind === "operator") {
+        return {
+            kind: "operator",
+            id: principal.userId ?? principal.user.identityId ?? principal.user.id,
+            userId: principal.userId ?? principal.user.identityId ?? principal.user.id,
+            membershipId: principal.membershipId ?? principal.user.membershipId ?? null,
+            organizationId: principal.organizationId ?? principal.user.organizationId ?? null,
+            appId: principal.appId
+        };
+    }
+    return {
+        kind: "service",
+        id: principal.id ?? principal.service,
+        service: principal.service,
+        organizationId: principal.organizationId,
+        appId: principal.appId
+    };
+}
+export function principalFromStored(stored, user) {
+    if (stored.kind === "service")
+        return servicePrincipal(stored.id || "system", { organizationId: stored.organizationId, appId: stored.appId });
+    if (stored.kind === "agent") {
+        const service = "service" in stored ? stored.service : null;
+        return agentPrincipal({
+            agent: stored.id || "unknown",
+            onBehalfOf: user
+                ? userPrincipal(user, { organizationId: stored.organizationId, appId: stored.appId })
+                : servicePrincipal(service || "raybase-agent", { organizationId: stored.organizationId, appId: stored.appId }),
+            organizationId: stored.organizationId,
+            appId: stored.appId
+        });
+    }
+    if (stored.kind === "operator" && user)
+        return operatorPrincipal(user, { organizationId: stored.organizationId, appId: stored.appId });
+    if (stored.kind === "user" && user)
+        return userPrincipal(user, { membershipId: stored.id, organizationId: stored.organizationId, appId: stored.appId });
+    return servicePrincipal("missing", { organizationId: stored.organizationId, appId: stored.appId });
+}
+export function principalToAuditRef(principal) {
+    if (!principal)
+        return { kind: "service", id: null, service: null };
+    if (principal.kind === "public") {
+        return {
+            kind: "service",
+            id: principal.id,
+            service: "public",
+            organizationId: principal.organizationId,
+            appId: principal.appId
+        };
+    }
+    return principalToStored(principal);
+}
+export function servicePrincipal(service, options = {}) {
+    return { kind: "service", service, id: options.id, organizationId: options.organizationId, appId: options.appId };
+}
+export function userPrincipal(user, options = {}) {
+    return {
+        kind: "user",
+        user,
+        userId: options.userId ?? user.identityId ?? user.id,
+        membershipId: options.membershipId ?? user.membershipId ?? null,
+        organizationId: options.organizationId ?? user.organizationId ?? null,
+        appId: options.appId,
+        roles: options.roles ?? user.appRoles
+    };
+}
+export function operatorPrincipal(user, options = {}) {
+    return {
+        kind: "operator",
+        user,
+        userId: options.userId ?? user.identityId ?? user.id,
+        operatorRole: options.operatorRole ?? user.operatorRole,
+        membershipId: options.membershipId ?? user.membershipId ?? null,
+        organizationId: options.organizationId ?? user.organizationId ?? null,
+        appId: options.appId
+    };
+}
+export function publicPrincipal(input) {
+    return { kind: "public", ...input };
+}
+//# sourceMappingURL=principal.js.map

package/dist/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../src/principal.ts"],"names":[],"mappings":"AAgFA,MAAM,UAAU,aAAa,CAAC,SAA2B;IACvD,OAAO,SAAS,CAAC,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAA2B;IACrD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IACjH,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7G,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,EAAE,CAAC;IACrD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC;IACvD,OAAO,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAA2B;IACvD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC;IAC9D,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAA2B;IAC3D,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAA2B;IAC7D,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,SAA2B,EAAE,KAAa;IAC/E,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAQ9B;IACC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU;QACV,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3H,YAAY,EAAE,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;QACvG,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,UAAU,CAAC,cAAc,IAAI,IAAI;QACzE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,IAAI,IAAI;QAC9C,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,SAA2B;IAClD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,UAAU,CAAC;IAC5D,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9M,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,OAAO,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/J,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAA2B;IAC3D,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,OAAO;YACL,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,SAAS,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YACpE,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,IAAI;YAC5C,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,IAAI;YAChD,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;SACvF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,YAAY;YAChB,YAAY;YACZ,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE;YAC1E,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI;YACjF,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE;YACtE,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE;YAC1E,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI;YAC3E,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI;YACjF,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,OAAO;QACrC,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAkI,EAAE,IAAyB;IAC/L,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9I,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,OAAO,cAAc,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,SAAS;YAC7B,UAAU,EAAE,IAAI;gBACd,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrF,CAAC,CAAC,gBAAgB,CAAC,OAAO,IAAI,eAAe,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAChH,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACvI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxJ,OAAO,gBAAgB,CAAC,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAA8C;IAChF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,UAAkF,EAAE;IACpI,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,UAAsI,EAAE;IACvL,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE;QACpD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI;QAC/D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI;QACrE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,UAAgK,EAAE;IACrN,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE;QACpD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY;QACvD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI;QAC/D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI;QACrE,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAkE;IAChG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;AACtC,CAAC"}