@stratal/framework 0.0.27 → 0.1.0

package/README.md

@@ -1,6 +1,6 @@
 # @stratal/framework
 
-Authentication, database ORM, RBAC, guards, and test factories for [Stratal](https://github.com/strataljs/stratal) applications.
+Authentication, database ORM, access control, guards, and test factories for [Stratal](https://stratal.dev) applications.
 
 [![npm version](https://img.shields.io/npm/v/@stratal/framework)](https://www.npmjs.com/package/@stratal/framework)
 [![CI](https://github.com/strataljs/stratal/actions/workflows/ci.yml/badge.svg)](https://github.com/strataljs/stratal/actions/workflows/ci.yml)
@@ -13,13 +13,13 @@ Authentication, database ORM, RBAC, guards, and test factories for [Stratal](htt
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/strataljs/stratal/pulls)
 [![GitHub stars](https://img.shields.io/github/stars/strataljs/stratal?style=social)](https://github.com/strataljs/stratal)
 
-## Modules
+## What's inside
 
-- **AuthModule** — Better Auth integration with session management and middleware
-- **DatabaseModule** — ZenStack ORM with support for multiple named connections
-- **RbacModule** — Casbin-based role-based access control with ZenStack policy adapter
-- **AuthGuard** — Authentication and scoped authorization guard for route protection
-- **AuthContext** — Request-scoped user context for accessing the authenticated user
+- **DatabaseModule** — ZenStack ORM with multiple named connections, plus `db:*` and `migrate:*` Quarry commands
+- **AuthModule** — Better Auth integration with session verification middleware and a `ctx.user()` shorthand
+- **Access control** — Resources, roles and permissions built on Better Auth's `access` plugin
+- **AuthGuard** — Authentication and permission enforcement for routes and controllers
+- **AuthContext** — Request-scoped user context for the authenticated user
 - **Factory** — Test data factories with sequenced attributes powered by Faker.js
 
 ## Installation
@@ -32,16 +32,25 @@ yarn add @stratal/framework
 
 ### Peer dependencies
 
-| Package | Required |
+| Package | Notes |
 |---|---|
-| `stratal` | Yes |
-| `@zenstackhq/orm` | Yes |
-| `pg` | Yes |
-| `better-auth` | No — needed for `AuthModule` |
-| `@better-auth/core` | No — needed for `AuthModule` |
-| `@zenstackhq/better-auth` | No — needed for `AuthModule` |
-| `casbin` | No — needed for `RbacModule` |
-| `@faker-js/faker` | No — needed for `Factory` |
+| `stratal` | The core framework |
+| `@zenstackhq/orm` | ORM runtime |
+| `@zenstackhq/schema` | Generated schema types |
+| `pg` | PostgreSQL driver |
+| `better-auth` | Authentication |
+| `@better-auth/core` | Authentication |
+
+### Sub-path exports
+
+```typescript
+import { AuthModule } from '@stratal/framework/auth'
+import { DatabaseModule } from '@stratal/framework/database'
+import { createAccessControl } from '@stratal/framework/access-control'
+import { AuthGuard } from '@stratal/framework/guards'
+import type { AuthContext, AuthUser } from '@stratal/framework/context'
+import { Factory } from '@stratal/framework/factory'
+```
 
 ### AI Agent Skills
 
@@ -53,27 +62,48 @@ npx skills add strataljs/stratal
 
 | Skill | Description |
 |---|---|
-| `stratal` | Build Cloudflare Workers apps with the Stratal framework — modules, DI, controllers, routing, OpenAPI, queues, cron, events, seeders, CLI, auth, database, RBAC, testing, and more |
+| `stratal` | Build Cloudflare Workers apps with the Stratal framework — modules, DI, controllers, routing, OpenAPI, queues, cron, events, seeders, CLI, auth, database, access control, testing, and more |
 
 ## Quick Start
 
 ```typescript
 import { Stratal } from 'stratal'
+import { DI_TOKENS } from 'stratal/di'
 import { Module } from 'stratal/module'
 import { AuthModule } from '@stratal/framework/auth'
-import { DatabaseModule } from '@stratal/framework/database'
-import { RbacModule } from '@stratal/framework/rbac'
+import { createPoolFactory, DatabaseModule } from '@stratal/framework/database'
+import { PostgresDialect } from 'kysely'
+import { Pool } from 'pg'
+import { permissions } from './permissions'
+import { schema } from './zenstack/schema'
 
 @Module({
   imports: [
-    DatabaseModule.forRoot({
-      connections: [{ name: 'default', connectionString: 'DATABASE_URL' }],
+    DatabaseModule.forRootAsync({
+      inject: [DI_TOKENS.CloudflareEnv],
+      useFactory: (env) => ({
+        default: 'main',
+        connections: [
+          {
+            name: 'main',
+            schema,
+            dialect: () => new PostgresDialect({
+              pool: createPoolFactory(env, () => new Pool({
+                connectionString: env.HYPERDRIVE.connectionString,
+              })),
+            }),
+          },
+        ],
+      }),
     }),
     AuthModule.forRootAsync({
-      inject: [],
-      useFactory: () => ({ /* Better Auth options */ }),
+      inject: [DI_TOKENS.Database],
+      useFactory: (db) => ({
+        database: db,
+        emailAndPassword: { enabled: true },
+        accessControl: permissions,
+      }),
     }),
-    RbacModule.forRoot({ model: MODEL }),
   ],
 })
 class AppModule {}
@@ -81,10 +111,122 @@ class AppModule {}
 export default new Stratal({ module: AppModule })
 ```
 
+A connection takes a generated ZenStack `schema` and a `dialect` factory. `createPoolFactory()` picks the connection topology from the environment — a fresh pool per resolution behind Hyperdrive in production, one shared pool under `@stratal/testing` — so your app config never branches on whether it is running under test.
+
+The factory is only called when the module initializes, so a large generated schema can sit behind an `import()` and stay out of the isolate's startup budget.
+
+## Access control
+
+Define resources and roles once with `createAccessControl()`, then hand the result to Better Auth:
+
+```typescript
+// permissions.ts
+import { createAccessControl } from '@stratal/framework/access-control'
+
+export const permissions = createAccessControl({
+  resources: {
+    posts: ['create', 'read', 'update', 'delete'],
+    admin: ['access'],
+  } as const,
+  roles: {
+    user: { posts: ['create', 'read'] },
+    editor: { posts: ['create', 'read', 'update'] },
+    admin: { posts: ['create', 'read', 'update', 'delete'], admin: ['access'] },
+  },
+})
+```
+
+Compose roles with `extendRole()` — duplicate resource keys are merged, not overwritten:
+
+```typescript
+import { extendRole } from '@stratal/framework/access-control'
+
+const { ac, roles } = permissions
+const superAdmin = extendRole(ac, roles.admin, { users: ['ban', 'delete'] })
+```
+
+## Guards
+
+`AuthGuard()` enforces authentication; pass `permissions` to enforce authorization too. Prefer guards over checking the auth context by hand — they throw the right 401 / 403 automatically.
+
+```typescript
+import { AuthGuard } from '@stratal/framework/guards'
+import { UseGuards } from 'stratal/guards'
+import { Controller } from 'stratal/router'
+
+@Controller('/profile', { version: '1' })
+@UseGuards(AuthGuard())
+export class ProfileController {}
+
+@Controller('/admin', { version: '1' })
+@UseGuards(AuthGuard({ permissions: 'admin:access' }))
+export class AdminController {}
+
+// Several permissions — all must be satisfied by one of the user's roles
+@Controller('/posts', { version: '1' })
+@UseGuards(AuthGuard({ permissions: ['posts:update', 'posts:delete'] }))
+export class PostsController {}
+```
+
+Permissions are written `resource:action`; `resource` alone means "any action on that resource". A list is combined with AND — every permission must be granted — while a user holding several roles passes if any one role satisfies the whole list.
+
+Guards can also be applied per method, and combined with Stratal's [versioning](https://stratal.dev) so the version never has to be written into the path.
+
+## Reading the authenticated user
+
+Enforcement belongs on the guard, not in the handler. Once `AuthGuard()` is applied, the route only runs for an authenticated user, so reading the user is just a read:
+
+```typescript
+@Controller('/profile', { version: '1' })
+@UseGuards(AuthGuard())
+export class ProfileController {
+  async show(ctx: RouterContext) {
+    return ctx.json(await this.service.forUser(ctx.user().id))
+  }
+}
+```
+
+`ctx.user()` is a `RouterContext` shorthand that `AuthModule` adds. Inject `AuthContext` where you don't have the request context to hand:
+
+```typescript
+import type { AuthContext } from '@stratal/framework/context'
+import { DI_TOKENS, inject, Transient } from 'stratal/di'
+
+@Transient()
+export class ProfileService {
+  constructor(@inject(DI_TOKENS.AuthContext) private auth: AuthContext) {}
+
+  profile() {
+    return this.auth.requireUser()
+  }
+}
+```
+
+`requireUser()` throws `UserNotAuthenticatedError` when signed out — a backstop for code reachable outside a guarded route, not a substitute for the guard. `getUser()` returns `AuthUser | undefined` instead of throwing, and `getRoles()` splits `user.role` on commas.
+
+Augment `AuthUser` to type your own fields:
+
+```typescript
+declare module '@stratal/framework/context' {
+  interface AuthUser {
+    firstName: string
+    role: string
+  }
+}
+```
+
 ## Documentation
 
 Full guides and examples are available at **[stratal.dev](https://stratal.dev)**.
 
+## Support the project
+
+If Stratal is useful to you, **[star the repository](https://github.com/strataljs/stratal)** — it is the simplest way to help others find it.
+
+## Maintainer
+
+Built and maintained by **Temitayo Fadojutimi** — [@adesege_](https://x.com/adesege_).
+
 ## License
 
 MIT

package/dist/access-control/index.d.mts

@@ -1,13 +1,14 @@
-import { n as RolePermissions, t as AccessControlOptions } from "../types-DabF8LGz.mjs";
-import { M as DatabaseService } from "../index-Dt0YUA7r.mjs";
-import { t as AuthContext } from "../auth-context-CGVbiSX3.mjs";
+import { n as AccessControlOptions, r as RolePermissions, t as AuthService } from "../auth.service-Onf3JkyL.mjs";
+import { t as AuthContext } from "../auth-context-C1om3Zsr.mjs";
 import { HttpException } from "stratal/errors";
+import { Middleware, Next, RouterContext } from "stratal/router";
 import { AccessControl, Role, Statements } from "better-auth/plugins/access";
 import { BetterAuthPlugin } from "better-auth";
-
 //#region src/access-control/tokens.d.ts
-declare const AC_TOKENS: {
-  /** Request-scoped access service */readonly AccessService: symbol; /** Access control module options (ac, roles) */
+export declare const AC_TOKENS: {
+  /** Request-scoped access service */
+  readonly AccessService: symbol;
+  /** Access control module options (ac, roles) */
   readonly Options: symbol;
 };
 //#endregion
@@ -24,7 +25,7 @@ declare const AC_TOKENS: {
  *   resources: {
  *     posts: ['create', 'read', 'update', 'delete'],
  *     admin: ['access'],
- *   } as const,
+ *   },
  *   roles: {
  *     admin: { posts: ['create', 'read', 'update', 'delete'], admin: ['access'] },
  *     user:  { posts: ['create', 'read'] },
@@ -38,7 +39,7 @@ declare const AC_TOKENS: {
  * plugins: [admin({ ...permissions })]
  * ```
  */
-declare function createAccessControl<TResources extends Statements, TRoles extends Record<string, RolePermissions<TResources>>>(config: {
+export declare function createAccessControl<const TResources extends Statements, const TRoles extends Record<string, RolePermissions<TResources>>>(config: {
   resources: TResources;
   roles: TRoles;
 }): AccessControlOptions<TResources, TRoles>;
@@ -55,7 +56,7 @@ declare function createAccessControl<TResources extends Statements, TRoles exten
  * // → { posts: readonly ('create' | 'read' | 'update')[]; admin: readonly ['access'] }
  * ```
  */
-type MergeStatements<A extends Statements, B extends Partial<Record<string, readonly string[]>>> = { [K in keyof A | keyof B]: K extends keyof A ? K extends keyof B ? readonly (A[K][number] | NonNullable<B[K]>[number])[] : A[K] : K extends keyof B ? NonNullable<B[K]> : never } & {};
+type MergeStatements<A extends Statements, B extends Partial<Record<string, readonly string[]>>> = { [K in keyof A | keyof B]: K extends keyof A ? K extends keyof B ? readonly (A[K][number] | NonNullable<B[K]>[number])[] : A[K] : K extends keyof B ? NonNullable<B[K]> : never; } & {};
 /**
  * Extend an existing role with additional permissions.
  *
@@ -73,7 +74,7 @@ type MergeStatements<A extends Statements, B extends Partial<Record<string, read
  * // if userRole had posts: ['create', 'read'], editorRole has posts: ['create', 'read', 'update']
  * ```
  */
-declare function extendRole<TParent extends Statements, TExtra extends Partial<Record<string, readonly string[]>>>(ac: AccessControl<TParent>, parent: Role<TParent>, extra: TExtra): Role<MergeStatements<TParent, TExtra>>;
+export declare function extendRole<TParent extends Statements, TExtra extends Partial<Record<string, readonly string[]>>>(ac: AccessControl<TParent>, parent: Role<TParent>, extra: TExtra): Role<MergeStatements<TParent, TExtra>>;
 //#endregion
 //#region src/access-control/plugin.d.ts
 /**
@@ -85,7 +86,7 @@ declare function extendRole<TParent extends Statements, TExtra extends Partial<R
  * Auto-added to Better Auth options when `accessControl` is provided to
  * `AuthModule.forRootAsync()`. Users never call this directly.
  */
-declare function createStratalAcPlugin(_options: AccessControlOptions): BetterAuthPlugin;
+export declare function createStratalAcPlugin(_options: AccessControlOptions): BetterAuthPlugin;
 //#endregion
 //#region src/access-control/services/access.service.d.ts
 /**
@@ -115,11 +116,11 @@ declare function createStratalAcPlugin(_options: AccessControlOptions): BetterAu
  * await accessService.setUserRole(userId, ['editor', 'reviewer'])
  * ```
  */
-declare class AccessService {
+export declare class AccessService {
   private readonly authContext;
-  private readonly db;
+  private readonly authService;
   private readonly options;
-  constructor(authContext: AuthContext, db: DatabaseService, options: AccessControlOptions);
+  constructor(authContext: AuthContext, authService: AuthService, options: AccessControlOptions);
   /**
    * Get all roles for a user.
    *
@@ -163,12 +164,38 @@ declare class AccessService {
   private mergePermissions;
 }
 //#endregion
+//#region src/access-control/access-share.middleware.d.ts
+/**
+ * Shares the current user's roles and merged permissions as the `access` prop
+ * on every Inertia page rendered during the request, so the client can gate
+ * rendering with `<Can>` / `<HasRole>` from `@stratal/inertia/react/access`.
+ *
+ * Both values come from `AuthContext` (populated by
+ * `SessionVerificationMiddleware`) — no database hit and no I/O, which is why
+ * this is registered globally by `AuthModule` rather than being opt-in the way
+ * `FeatureFlagShareMiddleware` is.
+ *
+ * Inert unless access control is configured and Inertia is installed. Not
+ * restricted to `GET`: an Inertia render can legally happen on any method —
+ * e.g. `return ctx.inertia('Posts/Create', {...})` from a `POST` handler
+ * re-rendering after a validation failure — and every `<Can>` / `useCan` on
+ * that page needs `access` just as much as it would on a full `GET` visit.
+ *
+ * Wrapped in `ctx.always()` so partial reloads never drop the prop; the client
+ * treats an absent `access` prop as a wiring error, not as "denied".
+ */
+export declare class AccessShareMiddleware implements Middleware {
+  private readonly access?;
+  constructor(access?: AccessService | undefined);
+  handle(ctx: RouterContext, next: Next): Promise<void>;
+}
+//#endregion
 //#region src/access-control/errors/insufficient-permissions.error.d.ts
-declare class InsufficientPermissionsError extends HttpException {
+export declare class InsufficientPermissionsError extends HttpException {
   readonly requiredPermissions: string;
   readonly userId?: string;
   constructor(requiredPermissions: string | string[], userId?: string);
 }
 //#endregion
-export { AC_TOKENS, type AccessControlOptions, AccessService, InsufficientPermissionsError, createAccessControl, createStratalAcPlugin, extendRole };
+export type { AccessControlOptions };
 //# sourceMappingURL=index.d.mts.map

package/dist/access-control/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/access-control/tokens.ts","../../src/access-control/create-access-control.ts","../../src/access-control/extend-role.ts","../../src/access-control/plugin.ts","../../src/access-control/services/access.service.ts","../../src/access-control/errors/insufficient-permissions.error.ts"],"mappings":";;;;;;;;cAAa,SAAA;+CAKH,aAAA;WAAA,OAAA;AAAA;;;;;;;;;AALV;;;;;;;;AC8BA;;;;;;;;;;;;iBAAgB,mBAAA,oBACK,UAAA,iBACJ,MAAA,SAAe,eAAA,CAAgB,UAAA,IAC9C,MAAA;EACA,SAAA,EAAW,UAAA;EACX,KAAA,EAAO,MAAA;AAAA,IACL,oBAAA,CAAqB,UAAA,EAAY,MAAA;;;;;;;;;;ADpCrC;;;;KEaK,eAAA,WACO,UAAA,YACA,OAAA,CAAQ,MAAA,8CAEN,CAAA,SAAU,CAAA,GAAI,CAAA,eAAgB,CAAA,GACxC,CAAA,eAAgB,CAAA,aACN,CAAA,CAAE,CAAA,YAAa,WAAA,CAAY,CAAA,CAAE,CAAA,gBACvC,CAAA,CAAE,CAAA,IACF,CAAA,eAAgB,CAAA,GAChB,WAAA,CAAY,CAAA,CAAE,CAAA;;ADQlB;;;;;;;;;;;;;;;;iBCagB,UAAA,iBACE,UAAA,iBACD,OAAA,CAAQ,MAAA,8BAEvB,EAAA,EAAI,aAAA,CAAc,OAAA,GAClB,MAAA,EAAQ,IAAA,CAAK,OAAA,GACb,KAAA,EAAO,MAAA,GACN,IAAA,CAAK,eAAA,CAAgB,OAAA,EAAS,MAAA;;;;;;;;;AFlDjC;;;iBGYgB,qBAAA,CAAsB,QAAA,EAAU,oBAAA,GAAuB,gBAAgB;;;;;;;;AHZvF;;;;;;;;AC8BA;;;;;;;;;;;;;;cGSa,aAAA;EAAA,iBAGQ,WAAA;EAAA,iBAEA,EAAA;EAAA,iBAEA,OAAA;cAJA,WAAA,EAAa,WAAA,EAEb,EAAA,EAAI,eAAA,EAEJ,OAAA,EAAS,oBAAA;EHdkB;;;;;;EGuBxC,YAAA,CAAa,MAAA,WAAiB,OAAA;EHnBb;;;AAAkB;;EGoCnC,WAAA,CAAY,MAAA,UAAgB,IAAA,sBAA0B,OAAA;;AFxEmB;;;;EEqFzE,aAAA,CAAc,MAAA,UAAgB,WAAA,EAAa,MAAA,qBAA2B,OAAA;EFtElE;;;;EE+EJ,qBAAA,CAAsB,MAAA,WAAiB,OAAA,CAAQ,MAAA;EF5EnD;;;;EEqFF,mBAAA;EFpFyC;;;;EE4FzC,wBAAA,CAAyB,WAAA,EAAa,MAAA;EF1FpB;;;;EEoGlB,yBAAA,IAA6B,MAAA;EAAA,QAKrB,gBAAA;EAAA,QAqBA,gBAAA;AAAA;;;cCjJG,4BAAA,SAAqC,aAAa;EAAA,SAC7C,mBAAA;EAAA,SACA,MAAA;cAEJ,mBAAA,qBAAwC,MAAA;AAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/access-control/tokens.ts","../../src/access-control/create-access-control.ts","../../src/access-control/extend-role.ts","../../src/access-control/plugin.ts","../../src/access-control/services/access.service.ts","../../src/access-control/access-share.middleware.ts","../../src/access-control/errors/insufficient-permissions.error.ts"],"mappings":";;;;;;;qBAAa;;WAEX;;WAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC0Bc,0BACR,mBAAmB,kBACnB,eAAe,eAAe,gBAAgB,cACpD;EACA,WAAW;EACX,OAAO;IACL,qBAAqB,YAAY;;;;;;;;;;;;;;KCvBhC,gBACH,UAAU,YACV,UAAU,QAAQ,yCAEjB,WAAW,UAAU,IAAI,gBAAgB,IACxC,gBAAgB,cACN,EAAE,aAAa,YAAY,EAAE,iBACvC,EAAE,KACF,gBAAgB,IAChB,YAAY,EAAE;;;;;;;;;;;;;;;;;;wBAqBF,WACd,gBAAgB,YAChB,eAAe,QAAQ,oCAEvB,IAAI,cAAc,UAClB,QAAQ,KAAK,UACb,OAAO,SACN,KAAK,gBAAgB,SAAS;;;;;;;;;;;;wBCtCjB,sBAAsB,UAAU,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC4B1D;mBAGQ;mBAEA;mBAEA;EANnB,YAEmB,aAAa,aAEb,aAAa,aAEb,SAAS;;;;;;;EAStB,aAAa,iBAAiB;;;;;;EAe9B,YAAY,gBAAgB,0BAA0B;;;;;;EActD,cAAc,gBAAgB,aAAa,2BAA2B;;;;;EAStE,sBAAsB,iBAAiB,QAAQ;;;;;EASrD;;;;;EAQA,yBAAyB,aAAa;;;;;EAUtC,6BAA6B;UAKrB;UAqBA;;;;;;;;;;;;;;;;;;;;;;;qBC7GG,iCAAiC;mBAGzB;EAFnB,YAEmB,SAAS;EAGtB,OAAO,KAAK,eAAe,MAAM,OAAO;;;;qBC1CnC,qCAAqC;WAChC;WACA;EAEhB,YAAY,wCAAwC"}

package/dist/access-control/index.mjs

@@ -1,5 +1,5 @@
-import { n as createStratalAcPlugin, t as AccessService } from "../access.service-BmDhE-re.mjs";
-import { n as AC_TOKENS } from "../decorateParam-DwV9LSPl.mjs";
+import { n as AC_TOKENS } from "../decorateParam-xwTkq9gO.mjs";
+import { a as AccessShareMiddleware, i as createStratalAcPlugin, t as AccessService } from "../access.service-BjmnWBEo.mjs";
 import { t as InsufficientPermissionsError } from "../insufficient-permissions.error-DeEyZRgy.mjs";
 import { createAccessControl as createAccessControl$1 } from "better-auth/plugins/access";
 //#region src/access-control/create-access-control.ts
@@ -15,7 +15,7 @@ import { createAccessControl as createAccessControl$1 } from "better-auth/plugin
 *   resources: {
 *     posts: ['create', 'read', 'update', 'delete'],
 *     admin: ['access'],
-*   } as const,
+*   },
 *   roles: {
 *     admin: { posts: ['create', 'read', 'update', 'delete'], admin: ['access'] },
 *     user:  { posts: ['create', 'read'] },
@@ -60,12 +60,12 @@ function extendRole(ac, parent, extra) {
 	for (const [key, actions] of Object.entries(parent.statements)) merged[key] = [...actions];
 	for (const [key, actions] of Object.entries(extra)) {
 		if (!actions) continue;
-		if (key in merged) merged[key] = [...new Set([...merged[key], ...actions])];
+		if (key in merged) merged[key] = [.../* @__PURE__ */ new Set([...merged[key], ...actions])];
 		else merged[key] = [...actions];
 	}
 	return ac.newRole(merged);
 }
 //#endregion
-export { AC_TOKENS, AccessService, InsufficientPermissionsError, createAccessControl, createStratalAcPlugin, extendRole };
+export { AC_TOKENS, AccessService, AccessShareMiddleware, InsufficientPermissionsError, createAccessControl, createStratalAcPlugin, extendRole };
 
 //# sourceMappingURL=index.mjs.map

package/dist/access-control/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["baCreateAC"],"sources":["../../src/access-control/create-access-control.ts","../../src/access-control/extend-role.ts"],"sourcesContent":["import type { Role, Statements } from 'better-auth/plugins/access'\nimport { createAccessControl as baCreateAC } from 'better-auth/plugins/access'\nimport type { AccessControlOptions, RolePermissions } from './types'\n\n/**\n * Define access control resources and roles in one place.\n *\n * Returns `{ ac, roles }` — spread this directly into `accessControl`,\n * `admin({ ...permissions })`, or `organization({ ...permissions })`.\n *\n * @example\n * ```typescript\n * export const permissions = createAccessControl({\n *   resources: {\n *     posts: ['create', 'read', 'update', 'delete'],\n *     admin: ['access'],\n *   } as const,\n *   roles: {\n *     admin: { posts: ['create', 'read', 'update', 'delete'], admin: ['access'] },\n *     user:  { posts: ['create', 'read'] },\n *   },\n * })\n *\n * // In AuthModule:\n * accessControl: permissions\n *\n * // With Better Auth admin plugin (same object):\n * plugins: [admin({ ...permissions })]\n * ```\n */\nexport function createAccessControl<\n  TResources extends Statements,\n  TRoles extends Record<string, RolePermissions<TResources>>,\n>(config: {\n  resources: TResources\n  roles: TRoles\n}): AccessControlOptions<TResources, TRoles> {\n  const ac = baCreateAC(config.resources)\n  const roles = Object.fromEntries(\n    Object.entries(config.roles).map(([name, perms]) => [name, ac.newRole(perms as unknown as Statements)])\n  ) as { [K in keyof TRoles]: Role<TResources> }\n  return { ac, roles }\n}\n","import type { AccessControl, Role, Statements } from 'better-auth/plugins/access'\n\n/**\n * Merges two Statements types, unioning the action arrays for overlapping resource keys.\n *\n * @example\n * ```typescript\n * type A = { posts: readonly ['create', 'read'] }\n * type B = { posts: readonly ['update']; admin: readonly ['access'] }\n * type M = MergeStatements<A, B>\n * // → { posts: readonly ('create' | 'read' | 'update')[]; admin: readonly ['access'] }\n * ```\n */\ntype MergeStatements<\n  A extends Statements,\n  B extends Partial<Record<string, readonly string[]>>\n> = {\n  [K in keyof A | keyof B]: K extends keyof A\n  ? K extends keyof B\n  ? readonly (A[K][number] | NonNullable<B[K]>[number])[]\n  : A[K]\n  : K extends keyof B\n  ? NonNullable<B[K]>\n  : never\n} & {}\n\n/**\n * Extend an existing role with additional permissions.\n *\n * Duplicate resource keys are merged (actions are unioned), not overwritten.\n * Better Auth has no built-in role inheritance — use this to compose roles.\n *\n * @example\n * ```typescript\n * const adminRole = ac.newRole({ posts: ['create', 'read', 'update', 'delete'] })\n * const superAdminRole = extendRole(ac, adminRole, { users: ['ban', 'delete'] })\n * // superAdminRole has both posts and users permissions\n *\n * // Duplicate keys are merged, not overwritten:\n * const editorRole = extendRole(ac, userRole, { posts: ['update'] })\n * // if userRole had posts: ['create', 'read'], editorRole has posts: ['create', 'read', 'update']\n * ```\n */\nexport function extendRole<\n  TParent extends Statements,\n  TExtra extends Partial<Record<string, readonly string[]>>\n>(\n  ac: AccessControl<TParent>,\n  parent: Role<TParent>,\n  extra: TExtra\n): Role<MergeStatements<TParent, TExtra>> {\n  const merged: Record<string, string[]> = {}\n\n  for (const [key, actions] of Object.entries(parent.statements)) {\n    merged[key] = [...(actions as string[])]\n  }\n\n  for (const [key, actions] of Object.entries(extra)) {\n    if (!actions) continue\n    if (key in merged) {\n      merged[key] = [...new Set([...merged[key], ...actions])]\n    } else {\n      merged[key] = [...actions]\n    }\n  }\n\n  return ac.newRole(merged) as Role<MergeStatements<TParent, TExtra>>\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,oBAGd,QAG2C;CAC3C,MAAM,KAAKA,sBAAW,OAAO,SAAS;CAItC,OAAO;EAAE;EAAI,OAHC,OAAO,YACnB,OAAO,QAAQ,OAAO,KAAK,EAAE,KAAK,CAAC,MAAM,WAAW,CAAC,MAAM,GAAG,QAAQ,KAA8B,CAAC,CAAC,CAEvF;CAAE;AACrB;;;;;;;;;;;;;;;;;;;;ACCA,SAAgB,WAId,IACA,QACA,OACwC;CACxC,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,KAAK,YAAY,OAAO,QAAQ,OAAO,UAAU,GAC3D,OAAO,OAAO,CAAC,GAAI,OAAoB;CAGzC,KAAK,MAAM,CAAC,KAAK,YAAY,OAAO,QAAQ,KAAK,GAAG;EAClD,IAAI,CAAC,SAAS;EACd,IAAI,OAAO,QACT,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,OAAO,MAAM,GAAG,OAAO,CAAC,CAAC;OAEvD,OAAO,OAAO,CAAC,GAAG,OAAO;CAE7B;CAEA,OAAO,GAAG,QAAQ,MAAM;AAC1B"}
+{"version":3,"file":"index.mjs","names":["baCreateAC"],"sources":["../../src/access-control/create-access-control.ts","../../src/access-control/extend-role.ts"],"sourcesContent":["import type { Role, Statements } from 'better-auth/plugins/access'\nimport { createAccessControl as baCreateAC } from 'better-auth/plugins/access'\nimport type { AccessControlOptions, RolePermissions } from './types'\n\n/**\n * Define access control resources and roles in one place.\n *\n * Returns `{ ac, roles }` — spread this directly into `accessControl`,\n * `admin({ ...permissions })`, or `organization({ ...permissions })`.\n *\n * @example\n * ```typescript\n * export const permissions = createAccessControl({\n *   resources: {\n *     posts: ['create', 'read', 'update', 'delete'],\n *     admin: ['access'],\n *   },\n *   roles: {\n *     admin: { posts: ['create', 'read', 'update', 'delete'], admin: ['access'] },\n *     user:  { posts: ['create', 'read'] },\n *   },\n * })\n *\n * // In AuthModule:\n * accessControl: permissions\n *\n * // With Better Auth admin plugin (same object):\n * plugins: [admin({ ...permissions })]\n * ```\n */\nexport function createAccessControl<\n  const TResources extends Statements,\n  const TRoles extends Record<string, RolePermissions<TResources>>,\n>(config: {\n  resources: TResources\n  roles: TRoles\n}): AccessControlOptions<TResources, TRoles> {\n  const ac = baCreateAC(config.resources)\n  const roles = Object.fromEntries(\n    Object.entries(config.roles).map(([name, perms]) => [name, ac.newRole(perms as unknown as Statements)])\n  ) as { [K in keyof TRoles]: Role<TResources> }\n  return { ac, roles }\n}\n","import type { AccessControl, Role, Statements } from 'better-auth/plugins/access'\n\n/**\n * Merges two Statements types, unioning the action arrays for overlapping resource keys.\n *\n * @example\n * ```typescript\n * type A = { posts: readonly ['create', 'read'] }\n * type B = { posts: readonly ['update']; admin: readonly ['access'] }\n * type M = MergeStatements<A, B>\n * // → { posts: readonly ('create' | 'read' | 'update')[]; admin: readonly ['access'] }\n * ```\n */\ntype MergeStatements<\n  A extends Statements,\n  B extends Partial<Record<string, readonly string[]>>\n> = {\n  [K in keyof A | keyof B]: K extends keyof A\n  ? K extends keyof B\n  ? readonly (A[K][number] | NonNullable<B[K]>[number])[]\n  : A[K]\n  : K extends keyof B\n  ? NonNullable<B[K]>\n  : never\n} & {}\n\n/**\n * Extend an existing role with additional permissions.\n *\n * Duplicate resource keys are merged (actions are unioned), not overwritten.\n * Better Auth has no built-in role inheritance — use this to compose roles.\n *\n * @example\n * ```typescript\n * const adminRole = ac.newRole({ posts: ['create', 'read', 'update', 'delete'] })\n * const superAdminRole = extendRole(ac, adminRole, { users: ['ban', 'delete'] })\n * // superAdminRole has both posts and users permissions\n *\n * // Duplicate keys are merged, not overwritten:\n * const editorRole = extendRole(ac, userRole, { posts: ['update'] })\n * // if userRole had posts: ['create', 'read'], editorRole has posts: ['create', 'read', 'update']\n * ```\n */\nexport function extendRole<\n  TParent extends Statements,\n  TExtra extends Partial<Record<string, readonly string[]>>\n>(\n  ac: AccessControl<TParent>,\n  parent: Role<TParent>,\n  extra: TExtra\n): Role<MergeStatements<TParent, TExtra>> {\n  const merged: Record<string, string[]> = {}\n\n  for (const [key, actions] of Object.entries(parent.statements)) {\n    merged[key] = [...(actions as string[])]\n  }\n\n  for (const [key, actions] of Object.entries(extra)) {\n    if (!actions) continue\n    if (key in merged) {\n      merged[key] = [...new Set([...merged[key], ...actions])]\n    } else {\n      merged[key] = [...actions]\n    }\n  }\n\n  return ac.newRole(merged) as Role<MergeStatements<TParent, TExtra>>\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,oBAGd,QAG2C;CAC3C,MAAM,KAAKA,sBAAW,OAAO,SAAS;CAItC,OAAO;EAAE;EAAI,OAHC,OAAO,YACnB,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,MAAM,GAAG,QAAQ,KAA8B,CAAC,CAAC,CAEvF;CAAE;AACrB;;;;;;;;;;;;;;;;;;;;ACCA,SAAgB,WAId,IACA,QACA,OACwC;CACxC,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,KAAK,YAAY,OAAO,QAAQ,OAAO,UAAU,GAC3D,OAAO,OAAO,CAAC,GAAI,OAAoB;CAGzC,KAAK,MAAM,CAAC,KAAK,YAAY,OAAO,QAAQ,KAAK,GAAG;EAClD,IAAI,CAAC,SAAS;EACd,IAAI,OAAO,QACT,OAAO,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,OAAO,MAAM,GAAG,OAAO,CAAC,CAAC;OAEvD,OAAO,OAAO,CAAC,GAAG,OAAO;CAE7B;CAEA,OAAO,GAAG,QAAQ,MAAM;AAC1B"}

package/dist/{access.service-BmDhE-re.mjs → access.service-BjmnWBEo.mjs}

@@ -1,6 +1,24 @@
-import { n as AC_TOKENS, t as __decorateParam } from "./decorateParam-DwV9LSPl.mjs";
-import { t as __decorate } from "./decorate-B7nr7eBl.mjs";
-import { DI_TOKENS, Request, inject } from "stratal/di";
+import { n as AC_TOKENS, t as __decorateParam } from "./decorateParam-xwTkq9gO.mjs";
+import { t as __decorate } from "./decorate-RQD1h28J.mjs";
+import { DI_TOKENS, Request, Transient, inject } from "stratal/di";
+//#region src/access-control/access-share.middleware.ts
+let AccessShareMiddleware = class AccessShareMiddleware {
+	access;
+	constructor(access) {
+		this.access = access;
+	}
+	async handle(ctx, next) {
+		const access = this.access;
+		const inertia = ctx;
+		if (access && typeof inertia.share === "function" && typeof inertia.always === "function") inertia.share("access", inertia.always(() => ({
+			roles: access.getCurrentUserRoles(),
+			permissions: access.getCurrentUserPermissions()
+		})));
+		await next();
+	}
+};
+AccessShareMiddleware = __decorate([Transient(), __decorateParam(0, inject(AC_TOKENS.AccessService, { isOptional: true }))], AccessShareMiddleware);
+//#endregion
 //#region src/access-control/plugin.ts
 /**
 * Creates the Stratal access control Better Auth plugin.
@@ -23,6 +41,12 @@ function createStratalAcPlugin(_options) {
 	};
 }
 //#endregion
+//#region src/auth/auth.tokens.ts
+/** Token for AuthService - core authentication service */
+const AUTH_SERVICE = Symbol.for("stratal:auth:service");
+/** Token for Better Auth options configuration */
+const AUTH_OPTIONS = Symbol.for("stratal:auth:options");
+//#endregion
 //#region src/access-control/services/access.service.ts
 function parseRoles(role) {
 	if (!role) return [];
@@ -30,11 +54,11 @@ function parseRoles(role) {
 }
 let AccessService = class AccessService {
 	authContext;
-	db;
+	authService;
 	options;
-	constructor(authContext, db, options) {
+	constructor(authContext, authService, options) {
 		this.authContext = authContext;
-		this.db = db;
+		this.authService = authService;
 		this.options = options;
 	}
 	/**
@@ -48,10 +72,7 @@ let AccessService = class AccessService {
 			const roles = this.authContext.getRoles();
 			if (roles.length > 0) return roles;
 		}
-		return parseRoles((await this.db.user.findUnique({
-			where: { id: userId },
-			select: { role: true }
-		}))?.role);
+		return parseRoles((await (await this.authService.auth.$context).internalAdapter.findUserById(userId))?.role);
 	}
 	/**
 	* Assign one or more roles to a user.
@@ -60,10 +81,7 @@ let AccessService = class AccessService {
 	*/
 	async setUserRole(userId, role) {
 		const roleStr = Array.isArray(role) ? role.join(",") : role;
-		await this.db.user.update({
-			where: { id: userId },
-			data: { role: roleStr }
-		});
+		await (await this.authService.auth.$context).internalAdapter.updateUser(userId, { role: roleStr });
 	}
 	/**
 	* Check if a user has the required permissions.
@@ -133,10 +151,10 @@ let AccessService = class AccessService {
 AccessService = __decorate([
 	Request(AC_TOKENS.AccessService),
 	__decorateParam(0, inject(DI_TOKENS.AuthContext)),
-	__decorateParam(1, inject(DI_TOKENS.Database)),
+	__decorateParam(1, inject(AUTH_SERVICE)),
 	__decorateParam(2, inject(AC_TOKENS.Options))
 ], AccessService);
 //#endregion
-export { createStratalAcPlugin as n, AccessService as t };
+export { AccessShareMiddleware as a, createStratalAcPlugin as i, AUTH_OPTIONS as n, AUTH_SERVICE as r, AccessService as t };
 
-//# sourceMappingURL=access.service-BmDhE-re.mjs.map
+//# sourceMappingURL=access.service-BjmnWBEo.mjs.map

package/dist/access.service-BjmnWBEo.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.service-BjmnWBEo.mjs","names":[],"sources":["../src/access-control/access-share.middleware.ts","../src/access-control/plugin.ts","../src/auth/auth.tokens.ts","../src/access-control/services/access.service.ts"],"sourcesContent":["import { inject, Transient } from 'stratal/di'\nimport type { Middleware, Next, RouterContext } from 'stratal/router'\nimport type { AccessService } from './services/access.service'\nimport { AC_TOKENS } from './tokens'\n\n/**\n * The Inertia methods this middleware needs, declared structurally.\n *\n * `@stratal/framework` must not depend on `@stratal/inertia` (the dependency\n * runs the other way at the type level, via the generated registry), so the\n * two optional context methods are described here and probed at runtime\n * instead of pulled in through a `/// <reference types=\"...\" />`.\n */\ninterface MaybeInertiaContext {\n  share?: (key: string, value: unknown) => void\n  always?: <T>(callback: () => T) => unknown\n}\n\n/**\n * Shares the current user's roles and merged permissions as the `access` prop\n * on every Inertia page rendered during the request, so the client can gate\n * rendering with `<Can>` / `<HasRole>` from `@stratal/inertia/react/access`.\n *\n * Both values come from `AuthContext` (populated by\n * `SessionVerificationMiddleware`) — no database hit and no I/O, which is why\n * this is registered globally by `AuthModule` rather than being opt-in the way\n * `FeatureFlagShareMiddleware` is.\n *\n * Inert unless access control is configured and Inertia is installed. Not\n * restricted to `GET`: an Inertia render can legally happen on any method —\n * e.g. `return ctx.inertia('Posts/Create', {...})` from a `POST` handler\n * re-rendering after a validation failure — and every `<Can>` / `useCan` on\n * that page needs `access` just as much as it would on a full `GET` visit.\n *\n * Wrapped in `ctx.always()` so partial reloads never drop the prop; the client\n * treats an absent `access` prop as a wiring error, not as \"denied\".\n */\n@Transient()\nexport class AccessShareMiddleware implements Middleware {\n  constructor(\n    @inject(AC_TOKENS.AccessService, { isOptional: true })\n    private readonly access?: AccessService,\n  ) { }\n\n  async handle(ctx: RouterContext, next: Next): Promise<void> {\n    const access = this.access\n    const inertia = ctx as RouterContext & MaybeInertiaContext\n\n    if (\n      access\n      && typeof inertia.share === 'function'\n      && typeof inertia.always === 'function'\n    ) {\n      inertia.share('access', inertia.always(() => ({\n        roles: access.getCurrentUserRoles(),\n        permissions: access.getCurrentUserPermissions(),\n      })))\n    }\n\n    await next()\n  }\n}\n","import type { BetterAuthPlugin } from 'better-auth'\nimport type { AccessControlOptions } from './types'\n\n/**\n * Creates the Stratal access control Better Auth plugin.\n *\n * Ensures the `user.role` schema field exists.\n * No endpoints are added — all permission logic lives in AccessService.\n *\n * Auto-added to Better Auth options when `accessControl` is provided to\n * `AuthModule.forRootAsync()`. Users never call this directly.\n */\nexport function createStratalAcPlugin(_options: AccessControlOptions): BetterAuthPlugin {\n  return {\n    id: 'stratal-ac',\n    schema: {\n      user: {\n        fields: {\n          role: {\n            type: 'string',\n            required: false,\n            input: false,\n            defaultValue: 'user',\n          },\n        },\n      },\n    },\n  }\n}\n","/** Token for AuthService - core authentication service */\nexport const AUTH_SERVICE = Symbol.for('stratal:auth:service')\n\n/** Token for Better Auth options configuration */\nexport const AUTH_OPTIONS = Symbol.for('stratal:auth:options')\n","import { DI_TOKENS, inject, Request } from 'stratal/di'\nimport { AUTH_SERVICE } from '../../auth/auth.tokens'\nimport type { AuthService } from '../../auth/services/auth.service'\nimport type { AuthContext } from '../../context/auth-context'\nimport { AC_TOKENS } from '../tokens'\nimport type { AccessControlOptions } from '../types'\n\nfunction parseRoles(role: string | null | undefined): string[] {\n  if (!role) return []\n  return role.split(',').map(r => r.trim()).filter(Boolean)\n}\n\n/**\n * AccessService\n *\n * Request-scoped service for role and permission management.\n *\n * Roles for the current user are read from AuthContext (populated by\n * SessionVerificationMiddleware — no DB hit). Other users are resolved\n * from the database.\n *\n * Permission checks use Better Auth's `role.authorize()` locally with\n * OR logic — access is granted if any of the user's roles allows it.\n *\n * @example\n * ```typescript\n * // Check current user\n * await accessService.currentUserHasPermission({ posts: ['update'] })\n *\n * // Check arbitrary user (e.g. from an admin action)\n * await accessService.hasPermission(userId, { admin: ['access'] })\n *\n * // Assign a role\n * await accessService.setUserRole(userId, 'admin')\n *\n * // Assign multiple roles\n * await accessService.setUserRole(userId, ['editor', 'reviewer'])\n * ```\n */\n@Request(AC_TOKENS.AccessService)\nexport class AccessService {\n  constructor(\n    @inject(DI_TOKENS.AuthContext)\n    private readonly authContext: AuthContext,\n    @inject(AUTH_SERVICE)\n    private readonly authService: AuthService,\n    @inject(AC_TOKENS.Options)\n    private readonly options: AccessControlOptions\n  ) { }\n\n  /**\n   * Get all roles for a user.\n   *\n   * Uses AuthContext for the current user (no DB hit).\n   * Falls back to DB for other users.\n   */\n  async getUserRoles(userId: string): Promise<string[]> {\n    if (userId === this.authContext.getUserId()) {\n      const roles = this.authContext.getRoles()\n      if (roles.length > 0) return roles\n    }\n    const ctx = await this.authService.auth.$context\n    const user = await ctx.internalAdapter.findUserById(userId)\n    return parseRoles((user as { role?: string | null } | null)?.role)\n  }\n\n  /**\n   * Assign one or more roles to a user.\n   *\n   * Multiple roles are stored as a comma-separated string in `user.role`.\n   */\n  async setUserRole(userId: string, role: string | string[]): Promise<void> {\n    const roleStr = Array.isArray(role) ? role.join(',') : role\n    const ctx = await this.authService.auth.$context\n    await ctx.internalAdapter.updateUser(\n      userId,\n      { role: roleStr } as Parameters<typeof ctx.internalAdapter.updateUser>[1]\n    )\n  }\n\n  /**\n   * Check if a user has the required permissions.\n   *\n   * Returns true if any of the user's roles grants all of the requested permissions.\n   */\n  async hasPermission(userId: string, permissions: Record<string, string[]>): Promise<boolean> {\n    const roles = await this.getUserRoles(userId)\n    return this.checkPermissions(roles, permissions)\n  }\n\n  /**\n   * Get the merged permission set for a user across all their roles.\n   * Useful for sending to the frontend.\n   */\n  async getPermissionsForUser(userId: string): Promise<Record<string, string[]>> {\n    const roles = await this.getUserRoles(userId)\n    return this.mergePermissions(roles)\n  }\n\n  /**\n   * Get all roles for the currently authenticated user.\n   * Reads from AuthContext — no DB hit.\n   */\n  getCurrentUserRoles(): string[] {\n    return this.authContext.getRoles()\n  }\n\n  /**\n   * Check if the currently authenticated user has the required permissions.\n   * Reads roles from AuthContext — no DB hit.\n   */\n  currentUserHasPermission(permissions: Record<string, string[]>): boolean {\n    const roles = this.authContext.getRoles()\n    if (roles.length === 0) return false\n    return this.checkPermissions(roles, permissions)\n  }\n\n  /**\n   * Get merged permissions for the currently authenticated user.\n   * Reads roles from AuthContext — no DB hit.\n   */\n  getCurrentUserPermissions(): Record<string, string[]> {\n    const roles = this.authContext.getRoles()\n    return this.mergePermissions(roles)\n  }\n\n  private checkPermissions(roles: string[], permissions: Record<string, string[]>): boolean {\n    return roles.some(roleName => {\n      const roleObj = this.options.roles[roleName]\n      if (!roleObj) return false\n\n      const specific: Record<string, string[]> = {}\n\n      for (const [resource, actions] of Object.entries(permissions)) {\n        if (actions.includes('*')) {\n          // Wildcard: role must have at least one action defined for this resource\n          const roleActions = (roleObj.statements as Record<string, readonly string[]>)[resource]\n          if (!roleActions?.length) return false\n        } else {\n          specific[resource] = actions\n        }\n      }\n\n      return Object.keys(specific).length === 0 || roleObj.authorize(specific).success\n    })\n  }\n\n  private mergePermissions(roles: string[]): Record<string, string[]> {\n    const result: Record<string, string[]> = {}\n    for (const roleName of roles) {\n      const roleObj = this.options.roles[roleName]\n      if (!roleObj) continue\n      for (const [resource, actions] of Object.entries(roleObj.statements)) {\n        result[resource] ??= []\n        for (const action of actions as string[]) {\n          if (!result[resource].includes(action)) {\n            result[resource].push(action)\n          }\n        }\n      }\n    }\n    return result\n  }\n}\n"],"mappings":";;;;AAsCO,IAAM,wBAAN,MAAM,sBAA4C;CAGpC;CAFnB,YACE,QAEA;EADiB,KAAA,SAAA;CACf;CAEJ,MAAM,OAAO,KAAoB,MAA2B;EAC1D,MAAM,SAAS,KAAK;EACpB,MAAM,UAAU;EAEhB,IACE,UACG,OAAO,QAAQ,UAAU,cACzB,OAAO,QAAQ,WAAW,YAE7B,QAAQ,MAAM,UAAU,QAAQ,cAAc;GAC5C,OAAO,OAAO,oBAAoB;GAClC,aAAa,OAAO,0BAA0B;EAChD,EAAE,CAAC;EAGL,MAAM,KAAK;CACb;AACF;AAxBC,wBAAA,WAAA,CAAA,UAAU,GAAA,gBAAA,GAGN,OAAO,UAAU,eAAe,EAAE,YAAY,KAAK,CAAC,CAAA,CAAA,GAAA,qBAAA;;;;;;;;;;;;AC5BzD,SAAgB,sBAAsB,UAAkD;CACtF,OAAO;EACL,IAAI;EACJ,QAAQ,EACN,MAAM,EACJ,QAAQ,EACN,MAAM;GACJ,MAAM;GACN,UAAU;GACV,OAAO;GACP,cAAc;EAChB,EACF,EACF,EACF;CACF;AACF;;;;AC3BA,MAAa,eAAe,OAAO,IAAI,sBAAsB;;AAG7D,MAAa,eAAe,OAAO,IAAI,sBAAsB;;;ACG7D,SAAS,WAAW,MAA2C;CAC7D,IAAI,CAAC,MAAM,OAAO,CAAC;CACnB,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;AAC1D;AA8BO,IAAM,gBAAN,MAAM,cAAc;CAGN;CAEA;CAEA;CANnB,YACE,aAEA,aAEA,SAEA;EALiB,KAAA,cAAA;EAEA,KAAA,cAAA;EAEA,KAAA,UAAA;CACf;;;;;;;CAQJ,MAAM,aAAa,QAAmC;EACpD,IAAI,WAAW,KAAK,YAAY,UAAU,GAAG;GAC3C,MAAM,QAAQ,KAAK,YAAY,SAAS;GACxC,IAAI,MAAM,SAAS,GAAG,OAAO;EAC/B;EAGA,OAAO,YAAY,OADA,MADD,KAAK,YAAY,KAAK,SAAA,CACjB,gBAAgB,aAAa,MAAM,EAAA,EACG,IAAI;CACnE;;;;;;CAOA,MAAM,YAAY,QAAgB,MAAwC;EACxE,MAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,GAAG,IAAI;EAEvD,OAAM,MADY,KAAK,YAAY,KAAK,SAAA,CAC9B,gBAAgB,WACxB,QACA,EAAE,MAAM,QAAQ,CAClB;CACF;;;;;;CAOA,MAAM,cAAc,QAAgB,aAAyD;EAC3F,MAAM,QAAQ,MAAM,KAAK,aAAa,MAAM;EAC5C,OAAO,KAAK,iBAAiB,OAAO,WAAW;CACjD;;;;;CAMA,MAAM,sBAAsB,QAAmD;EAC7E,MAAM,QAAQ,MAAM,KAAK,aAAa,MAAM;EAC5C,OAAO,KAAK,iBAAiB,KAAK;CACpC;;;;;CAMA,sBAAgC;EAC9B,OAAO,KAAK,YAAY,SAAS;CACnC;;;;;CAMA,yBAAyB,aAAgD;EACvE,MAAM,QAAQ,KAAK,YAAY,SAAS;EACxC,IAAI,MAAM,WAAW,GAAG,OAAO;EAC/B,OAAO,KAAK,iBAAiB,OAAO,WAAW;CACjD;;;;;CAMA,4BAAsD;EACpD,MAAM,QAAQ,KAAK,YAAY,SAAS;EACxC,OAAO,KAAK,iBAAiB,KAAK;CACpC;CAEA,iBAAyB,OAAiB,aAAgD;EACxF,OAAO,MAAM,MAAK,aAAY;GAC5B,MAAM,UAAU,KAAK,QAAQ,MAAM;GACnC,IAAI,CAAC,SAAS,OAAO;GAErB,MAAM,WAAqC,CAAC;GAE5C,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,WAAW,GAC1D,IAAI,QAAQ,SAAS,GAAG,GAGlB;QAAA,CADiB,QAAQ,WAAiD,SAC9D,EAAE,QAAQ,OAAO;GAAA,OAEjC,SAAS,YAAY;GAIzB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,KAAK,QAAQ,UAAU,QAAQ,CAAC,CAAC;EAC3E,CAAC;CACH;CAEA,iBAAyB,OAA2C;EAClE,MAAM,SAAmC,CAAC;EAC1C,KAAK,MAAM,YAAY,OAAO;GAC5B,MAAM,UAAU,KAAK,QAAQ,MAAM;GACnC,IAAI,CAAC,SAAS;GACd,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,QAAQ,UAAU,GAAG;IACpE,OAAO,cAAc,CAAC;IACtB,KAAK,MAAM,UAAU,SACnB,IAAI,CAAC,OAAO,SAAS,CAAC,SAAS,MAAM,GACnC,OAAO,SAAS,CAAC,KAAK,MAAM;GAGlC;EACF;EACA,OAAO;CACT;AACF;;CA5HC,QAAQ,UAAU,aAAa;CAG3B,gBAAA,GAAA,OAAO,UAAU,WAAW,CAAA;CAE5B,gBAAA,GAAA,OAAO,YAAY,CAAA;CAEnB,gBAAA,GAAA,OAAO,UAAU,OAAO,CAAA"}