@synoikia/core 0.6.0 → 0.8.0

package/dist/catalog/role-levels.js

@@ -0,0 +1,297 @@
+import { randomUUID } from 'node:crypto';
+import { and, asc, eq, inArray } from 'drizzle-orm';
+import { writeAudit } from '../audit.js';
+import { operationGroups, operations, roleInstances, roleLevels, roles, userLevels, users } from '../db/schema.js';
+import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+import { ACCESS_LEVELS, ADMIN_ROLE_ID, allowedLevels, capLevel, effectiveAccess, isAccessLevel, levelInForce, normalizeLevel, tighterLevel, } from '../gate/access.js';
+import { accessInput } from './groups.js';
+const toLayers = (rows) => ({
+    byGroup: new Map(rows.filter((r) => r.groupId).map((r) => [r.groupId, r.level])),
+    byOp: new Map(rows.filter((r) => r.operationId).map((r) => [r.operationId, r.level])),
+});
+const layerFor = (layers, op) => ({
+    group: layers.byGroup.get(op.groupId) ?? null,
+    op: layers.byOp.get(op.id) ?? null,
+});
+export function roleInstanceIds(db, roleId) {
+    return db
+        .select({ id: roleInstances.instanceId })
+        .from(roleInstances)
+        .where(eq(roleInstances.roleId, roleId))
+        .all()
+        .map((r) => r.id);
+}
+export function roleHasInstance(db, roleId, instanceId) {
+    if (roleId === ADMIN_ROLE_ID)
+        return true;
+    return !!db
+        .select({ id: roleInstances.instanceId })
+        .from(roleInstances)
+        .where(and(eq(roleInstances.roleId, roleId), eq(roleInstances.instanceId, instanceId)))
+        .get();
+}
+/** The caps a principal's role and own levels put on one endpoint's operations; undefined for admins. */
+export function loadCaps(db, instanceId, principal) {
+    if (principal.roleId === ADMIN_ROLE_ID)
+        return undefined;
+    const role = db.select().from(roles).where(eq(roles.id, principal.roleId)).get();
+    if (!role || !roleHasInstance(db, role.id, instanceId))
+        return () => ({ role: null });
+    const roleRows = toLayers(db
+        .select()
+        .from(roleLevels)
+        .where(and(eq(roleLevels.roleId, role.id), eq(roleLevels.instanceId, instanceId)))
+        .all());
+    const ownRows = role.canSetOwnLevels && principal.userId
+        ? toLayers(db
+            .select()
+            .from(userLevels)
+            .where(and(eq(userLevels.userId, principal.userId), eq(userLevels.instanceId, instanceId)))
+            .all())
+        : undefined;
+    return (op) => ({ role: layerFor(roleRows, op), own: ownRows && layerFor(ownRows, op) });
+}
+const describeOf = (op) => {
+    const docs = op.docs;
+    if (typeof docs?.summary === 'string')
+        return docs.summary;
+    return typeof docs?.description === 'string' ? docs.description : null;
+};
+/** The levels one role (and, with `userId`, one user) has on an endpoint. `reachableOnly` leaves out
+ * what the user can't call: a non-admin sees only that. */
+export function levelView(db, instanceId, who, opts = {}) {
+    const groups = db
+        .select()
+        .from(operationGroups)
+        .where(and(eq(operationGroups.instanceId, instanceId), eq(operationGroups.stale, false)))
+        .orderBy(asc(operationGroups.key))
+        .all();
+    const groupById = new Map(groups.map((g) => [g.id, g]));
+    const ops = db
+        .select()
+        .from(operations)
+        .where(and(eq(operations.instanceId, instanceId), eq(operations.stale, false)))
+        .orderBy(asc(operations.key))
+        .all();
+    const principal = { ceiling: 'write', roleId: who.roleId, userId: who.userId };
+    const caps = loadCaps(db, instanceId, principal);
+    const opRows = ops.map((op) => {
+        const group = groupById.get(op.groupId);
+        const input = accessInput(op);
+        const endpointLevel = levelInForce(input, group);
+        const cap = caps?.(op);
+        const roleMax = cap?.role ? capLevel(input, endpointLevel, cap.role) : cap ? 'none' : endpointLevel;
+        const access = effectiveAccess(input, group, principal, cap);
+        return {
+            id: op.id,
+            key: op.key,
+            displayName: op.displayName,
+            description: describeOf(op),
+            group: group?.key ?? null,
+            classification: op.locked ? 'locked' : op.classification,
+            matchProfile: op.matchProfile,
+            allowedLevels: allowedLevels(op),
+            endpointLevel,
+            roleLevel: cap?.role?.op ?? null,
+            roleMax,
+            ownLevel: cap?.own?.op ?? null,
+            level: access.reachable ? access.level : 'none',
+            reachable: access.reachable,
+            mode: access.reachable ? access.mode : null,
+            reason: access.reachable ? null : access.reason,
+        };
+    });
+    const visible = opts.reachableOnly ? opRows.filter((o) => o.reachable) : opRows;
+    const shownGroups = new Set(visible.map((o) => o.group));
+    const groupLayer = (g, pick) => {
+        const cap = caps?.({ id: '', groupId: g.id });
+        return (pick === 'role' ? cap?.role?.group : cap?.own?.group) ?? null;
+    };
+    return {
+        groups: groups
+            .filter((g) => !opts.reachableOnly || shownGroups.has(g.key))
+            .map((g) => ({
+            key: g.key,
+            label: g.label,
+            endpointLevel: g.level,
+            roleLevel: groupLayer(g, 'role'),
+            ownLevel: groupLayer(g, 'own'),
+        })),
+        operations: visible,
+    };
+}
+// ── changes ──────────────────────────────────────────────────────────────────────────────────────
+function assertLevel(level) {
+    if (!isAccessLevel(level)) {
+        throw new ValidationError('invalid_level', `Level must be one of ${ACCESS_LEVELS.join(', ')}`);
+    }
+}
+function resolveTarget(db, instanceId, target) {
+    if ('group' in target) {
+        const group = db
+            .select()
+            .from(operationGroups)
+            .where(and(eq(operationGroups.instanceId, instanceId), eq(operationGroups.key, target.group)))
+            .get();
+        if (!group)
+            throw new NotFoundError('group_not_found', `No group "${target.group}" on this endpoint`);
+        return { group };
+    }
+    const op = db
+        .select()
+        .from(operations)
+        .where(and(eq(operations.instanceId, instanceId), eq(operations.id, target.operationId)))
+        .get();
+    if (!op)
+        throw new NotFoundError('operation_not_found', 'No such operation on this endpoint');
+    return { op };
+}
+function checkOpLevel(op, level) {
+    if (!allowedLevels(op).includes(level)) {
+        throw new ValidationError('level_not_allowed', `${op.key} can be ${allowedLevels(op).join(', ')}`);
+    }
+}
+/** Sets (or, with null, clears) a role's maximum for a group or an operation. A group level resets the
+ * role's entries for that group's operations, as the endpoint's group level does. */
+export function setRoleLevel(db, roleId, instanceId, target, level, opts = {}) {
+    if (roleId === ADMIN_ROLE_ID)
+        throw new ConflictError('built_in_role', "The Admin role uses the endpoint's own levels");
+    if (!db.select().from(roles).where(eq(roles.id, roleId)).get())
+        throw new NotFoundError('role_not_found', 'No such role');
+    if (!roleHasInstance(db, roleId, instanceId))
+        throw new ConflictError('not_in_role', 'Add the endpoint to the role first');
+    if (level !== null)
+        assertLevel(level);
+    const now = opts.now ?? new Date();
+    db.transaction((tx) => {
+        const { group, op } = resolveTarget(tx, instanceId, target);
+        if (op && level !== null)
+            checkOpLevel(op, level);
+        const scope = and(eq(roleLevels.roleId, roleId), eq(roleLevels.instanceId, instanceId));
+        if (group) {
+            const opIds = tx
+                .select({ id: operations.id })
+                .from(operations)
+                .where(eq(operations.groupId, group.id))
+                .all()
+                .map((o) => o.id);
+            if (opIds.length)
+                tx.delete(roleLevels)
+                    .where(and(scope, inArray(roleLevels.operationId, opIds)))
+                    .run();
+            tx.delete(roleLevels)
+                .where(and(scope, eq(roleLevels.groupId, group.id)))
+                .run();
+        }
+        else {
+            tx.delete(roleLevels)
+                .where(and(scope, eq(roleLevels.operationId, op.id)))
+                .run();
+        }
+        if (level !== null) {
+            tx.insert(roleLevels)
+                .values({
+                id: randomUUID(),
+                roleId,
+                instanceId,
+                groupId: group?.id ?? null,
+                operationId: op?.id ?? null,
+                level,
+                changedAt: now,
+                changedBy: opts.actor?.userId ?? null,
+            })
+                .run();
+        }
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            decision: 'role_level_changed',
+            actorKind: 'user',
+            actorId: opts.actor?.userId,
+            detail: { roleId, group: group?.key, operation: op?.key, level },
+        }, now);
+    });
+}
+/** Sets every group of the endpoint to one maximum for the role and clears its operation entries. */
+export function setRoleBulkLevel(db, roleId, instanceId, level, opts = {}) {
+    assertLevel(level);
+    const groups = db.select().from(operationGroups).where(eq(operationGroups.instanceId, instanceId)).all();
+    for (const g of groups)
+        setRoleLevel(db, roleId, instanceId, { group: g.key }, level, opts);
+}
+/** A user's own level (design §6.4): only with the role's switch, on the role's endpoints, and never
+ * above the role's maximum. */
+export function setOwnLevel(db, userId, instanceId, target, level, now = new Date()) {
+    const user = db.select().from(users).where(eq(users.id, userId)).get();
+    if (!user)
+        throw new NotFoundError('user_not_found', 'No such user');
+    const role = db.select().from(roles).where(eq(roles.id, user.roleId)).get();
+    if (!role?.canSetOwnLevels || role.id === ADMIN_ROLE_ID)
+        throw new ConflictError('own_levels_off', 'Your role does not let you set your own levels');
+    if (!roleHasInstance(db, role.id, instanceId))
+        throw new NotFoundError('instance_not_found', 'No such endpoint');
+    if (level !== null)
+        assertLevel(level);
+    db.transaction((tx) => {
+        const { group, op } = resolveTarget(tx, instanceId, target);
+        const caps = loadCaps(tx, instanceId, { ceiling: 'write', roleId: role.id });
+        if (level !== null) {
+            if (op) {
+                checkOpLevel(op, level);
+                const endpoint = levelInForce(accessInput(op), tx.select().from(operationGroups).where(eq(operationGroups.id, op.groupId)).get());
+                const max = capLevel(accessInput(op), endpoint, caps(op).role ?? {});
+                const own = normalizeLevel(op, level);
+                if (tighterLevel(own, max) !== own)
+                    throw new ValidationError('above_role_max', `Your role allows at most ${max} for ${op.key}`);
+            }
+            else {
+                const max = caps({ id: '', groupId: group.id }).role?.group ?? 'none';
+                if (ACCESS_LEVELS.indexOf(level) > ACCESS_LEVELS.indexOf(max))
+                    throw new ValidationError('above_role_max', `Your role allows at most ${max} for ${group.key}`);
+            }
+        }
+        const scope = and(eq(userLevels.userId, userId), eq(userLevels.instanceId, instanceId));
+        if (group) {
+            const opIds = tx
+                .select({ id: operations.id })
+                .from(operations)
+                .where(eq(operations.groupId, group.id))
+                .all()
+                .map((o) => o.id);
+            if (opIds.length)
+                tx.delete(userLevels)
+                    .where(and(scope, inArray(userLevels.operationId, opIds)))
+                    .run();
+            tx.delete(userLevels)
+                .where(and(scope, eq(userLevels.groupId, group.id)))
+                .run();
+        }
+        else {
+            tx.delete(userLevels)
+                .where(and(scope, eq(userLevels.operationId, op.id)))
+                .run();
+        }
+        if (level !== null) {
+            tx.insert(userLevels)
+                .values({
+                id: randomUUID(),
+                userId,
+                instanceId,
+                groupId: group?.id ?? null,
+                operationId: op?.id ?? null,
+                level,
+                changedAt: now,
+            })
+                .run();
+        }
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            decision: 'own_level_changed',
+            actorKind: 'user',
+            actorId: userId,
+            detail: { group: group?.key, operation: op?.key, level },
+        }, now);
+    });
+}
+//# sourceMappingURL=role-levels.js.map

package/dist/catalog/role-levels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-levels.js","sourceRoot":"","sources":["../../src/catalog/role-levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACnH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,QAAQ,EACR,eAAe,EACf,aAAa,EACb,YAAY,EACZ,cAAc,EACd,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgB1C,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;CACvF,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAwC,EAAc,EAAE,CAAC,CAAC;IAC1F,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI;IAC7C,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI;CACnC,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,MAAc;IACxD,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC;SACxC,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACvC,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,MAAc,EAAE,UAAkB;IAC5E,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,CAAC,CAAC,EAAE;SACR,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC;SACxC,IAAI,CAAC,aAAa,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACtF,GAAG,EAAE,CAAC;AACX,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,QAAQ,CACtB,EAAU,EACV,UAAkB,EAClB,SAA0B;IAE1B,IAAI,SAAS,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACjF,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,CACvB,EAAE;SACC,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACjF,GAAG,EAAE,CACT,CAAC;IACF,MAAM,OAAO,GACX,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,MAAM;QACtC,CAAC,CAAC,QAAQ,CACN,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;aAC1F,GAAG,EAAE,CACT;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAmCD,MAAM,UAAU,GAAG,CAAC,EAAgB,EAAE,EAAE;IACtC,MAAM,IAAI,GAAG,EAAE,CAAC,IAA2D,CAAC;IAC5E,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IAC3D,OAAO,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC,CAAC;AAEF;2DAC2D;AAC3D,MAAM,UAAU,SAAS,CACvB,EAAU,EACV,UAAkB,EAClB,GAAwC,EACxC,OAAoC,EAAE;IAEtC,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SACxF,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,EAAE,CAAC;IACT,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SAC9E,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAC5B,GAAG,EAAE,CAAC;IACT,MAAM,SAAS,GAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAChG,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QACpG,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3B,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;YACzB,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc;YACnE,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;YAChC,aAAa;YACb,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YAChC,OAAO;YACP,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,IAAI;YAC9B,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YAC3C,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;SAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,CAAC,CAAW,EAAE,IAAoB,EAAE,EAAE;QACvD,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;IACxE,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,MAAM;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;aAC5D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,aAAa,EAAE,CAAC,CAAC,KAAK;YACtB,SAAS,EAAE,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC;YAChC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC;SAC/B,CAAC,CAAC;QACL,UAAU,EAAE,OAAO;KACpB,CAAC;AACJ,CAAC;AAED,oGAAoG;AAEpG,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAU,EAAE,UAAkB,EAAE,MAAmB;IACxE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,EAAE;aACb,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aAC7F,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,aAAa,MAAM,CAAC,KAAK,oBAAoB,CAAC,CAAC;QACtG,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE;SACV,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;SACxF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IAC9F,OAAO,EAAE,EAAE,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAgB,EAAE,KAAkB;IACxD,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,GAAG,WAAW,aAAa,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED;qFACqF;AACrF,MAAM,UAAU,YAAY,CAC1B,EAAM,EACN,MAAc,EACd,UAAkB,EAClB,MAAmB,EACnB,KAAoB,EACpB,OAAsC,EAAE;IAExC,IAAI,MAAM,KAAK,aAAa;QAC1B,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAC5F,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE;QAC5D,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;QAC1C,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IAC/E,IAAI,KAAK,KAAK,IAAI;QAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,EAAE,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QACxF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,EAAE;iBACb,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;iBAC7B,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;iBACvC,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,KAAK,CAAC,MAAM;gBACd,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;qBAClB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;qBACzD,GAAG,EAAE,CAAC;YACX,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;iBACnD,GAAG,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAG,CAAC,EAAE,CAAC,CAAC,CAAC;iBACrD,GAAG,EAAE,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,MAAM,CAAC;gBACN,EAAE,EAAE,UAAU,EAAE;gBAChB,MAAM;gBACN,UAAU;gBACV,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;gBAC1B,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI;gBAC3B,KAAK;gBACL,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI;aACtC,CAAC;iBACD,GAAG,EAAE,CAAC;QACX,CAAC;QACD,UAAU,CACR,EAAE,EACF;YACE,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,oBAAoB;YAC9B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM;YAC3B,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;SACjE,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAC9B,EAAM,EACN,MAAc,EACd,UAAkB,EAClB,KAAa,EACb,OAAsC,EAAE;IAExC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED;+BAC+B;AAC/B,MAAM,UAAU,WAAW,CACzB,EAAM,EACN,MAAc,EACd,UAAkB,EAClB,MAAmB,EACnB,KAAoB,EACpB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACvE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5E,IAAI,CAAC,IAAI,EAAE,eAAe,IAAI,IAAI,CAAC,EAAE,KAAK,aAAa;QACrD,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;IAC9F,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;IACjH,IAAI,KAAK,KAAK,IAAI;QAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAE,CAAC;QAC9E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,EAAE,EAAE,CAAC;gBACP,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACxB,MAAM,QAAQ,GAAG,YAAY,CAC3B,WAAW,CAAC,EAAE,CAAC,EACf,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAClF,CAAC;gBACF,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACrE,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACtC,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,GAAG;oBAChC,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,4BAA4B,GAAG,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YACjG,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;gBACvE,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;oBAC3D,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,4BAA4B,GAAG,QAAQ,KAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QACxF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,EAAE;iBACb,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;iBAC7B,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;iBACvC,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,KAAK,CAAC,MAAM;gBACd,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;qBAClB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;qBACzD,GAAG,EAAE,CAAC;YACX,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;iBACnD,GAAG,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAG,CAAC,EAAE,CAAC,CAAC,CAAC;iBACrD,GAAG,EAAE,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;iBAClB,MAAM,CAAC;gBACN,EAAE,EAAE,UAAU,EAAE;gBAChB,MAAM;gBACN,UAAU;gBACV,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;gBAC1B,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI;gBAC3B,KAAK;gBACL,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,GAAG,EAAE,CAAC;QACX,CAAC;QACD,UAAU,CACR,EAAE,EACF;YACE,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,mBAAmB;YAC7B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;SACzD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/catalog/rules.d.ts

@@ -34,82 +34,106 @@ type OperationRow = typeof operations.$inferSelect;
 /** Why a rule's match doesn't fit the operation's declared fields (design §8.3), or null if it does. */
 export declare function matchMisfit(manifest: Pick<Manifest, 'matchProfiles' | 'targets'>, op: Pick<OperationRow, 'key' | 'matchProfile'>, match: RuleInput['match']): ValidationError | null;
 export declare function listRules(db: Db, instanceId: string): {
+    owner: {
+        id: string;
+        username: string;
+    } | null;
     operation: {
         id: string;
         key: string;
         locked: boolean;
         matchProfile: string | null;
     };
-    /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it). */
+    /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it).
+     * An admin rule is inert only if it is for every role that has the endpoint. */
     inert: string | null;
+    reason: string;
     id: string;
     match: unknown;
     createdAt: Date;
+    updatedAt: Date | null;
     expiresAt: Date | null;
     enabled: boolean;
     instanceId: string;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
-    reason: string;
     createdBy: string | null;
-    updatedAt: Date | null;
+    ownerUserId: string | null;
     lastTriggeredAt: Date | null;
     strictMissAt: Date | null;
 }[];
 export declare function createRule(db: Db, manifest: Manifest, instanceId: string, raw: unknown, actor?: {
     userId?: string;
+}, opts?: {
+    owner?: string;
 }): {
+    owner: {
+        id: string;
+        username: string;
+    } | null;
     operation: {
         id: string;
         key: string;
         locked: boolean;
         matchProfile: string | null;
     };
-    /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it). */
+    /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it).
+     * An admin rule is inert only if it is for every role that has the endpoint. */
     inert: string | null;
+    reason: string;
     id: string;
     match: unknown;
     createdAt: Date;
+    updatedAt: Date | null;
     expiresAt: Date | null;
     enabled: boolean;
     instanceId: string;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
-    reason: string;
     createdBy: string | null;
-    updatedAt: Date | null;
+    ownerUserId: string | null;
     lastTriggeredAt: Date | null;
     strictMissAt: Date | null;
 };
 export declare function updateRule(db: Db, manifest: Manifest, instanceId: string, ruleId: string, raw: unknown, actor?: {
     userId?: string;
+}, opts?: {
+    owner?: string;
 }): {
+    owner: {
+        id: string;
+        username: string;
+    } | null;
     operation: {
         id: string;
         key: string;
         locked: boolean;
         matchProfile: string | null;
     };
-    /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it). */
+    /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it).
+     * An admin rule is inert only if it is for every role that has the endpoint. */
     inert: string | null;
+    reason: string;
     id: string;
     match: unknown;
     createdAt: Date;
+    updatedAt: Date | null;
     expiresAt: Date | null;
     enabled: boolean;
     instanceId: string;
     operationId: string;
     rateLimit: number | null;
     windowSeconds: number | null;
-    reason: string;
     createdBy: string | null;
-    updatedAt: Date | null;
+    ownerUserId: string | null;
     lastTriggeredAt: Date | null;
     strictMissAt: Date | null;
 };
 export declare function deleteRule(db: Db, instanceId: string, ruleId: string, actor?: {
     userId?: string;
+}, opts?: {
+    owner?: string;
 }): void;
 export {};

package/dist/catalog/rules.js

@@ -2,8 +2,9 @@ import { randomUUID } from 'node:crypto';
 import { and, asc, eq } from 'drizzle-orm';
 import { z } from 'zod';
 import { writeAudit } from '../audit.js';
-import { operations, preApprovalRules } from '../db/schema.js';
+import { operations, preApprovalRules, roleInstances, roles, users } from '../db/schema.js';
 import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+import { FULL_ACCESS } from '../gate/access.js';
 import { MatchSchema } from '../gate/match.js';
 import { resolveAccess } from './groups.js';
 /** Pre-approval rules (design §5.2): from the catalog, with a required reason, structured match and
@@ -65,26 +66,62 @@ function checkMatchAgainstProfile(manifest, op, match) {
     if (misfit)
         throw misfit;
 }
-function describe(db, instanceId, rule, op) {
-    const access = resolveAccess(db, instanceId, op.key);
+/** Whether some role that has the endpoint can reach the operation at Ask, or lower it to Ask itself. */
+function firesForSomeRole(db, instanceId, key) {
+    return db
+        .select({ role: roles })
+        .from(roleInstances)
+        .innerJoin(roles, eq(roleInstances.roleId, roles.id))
+        .where(eq(roleInstances.instanceId, instanceId))
+        .all()
+        .some(({ role }) => {
+        const access = resolveAccess(db, instanceId, key, { ceiling: 'write', roleId: role.id });
+        return access.reachable && (access.level === 'ask' || (role.canSetOwnLevels && access.level === 'write'));
+    });
+}
+function describe(db, instanceId, rule, op, owner) {
+    // An own rule fires only where its owner's levels put the operation at Ask (design §6.4).
+    const principal = owner ? { ceiling: 'write', roleId: owner.roleId, userId: owner.id } : FULL_ACCESS;
+    const access = resolveAccess(db, instanceId, op.key, principal);
+    const inert = !rule.enabled
+        ? null
+        : !access.reachable
+            ? access.reason
+            : access.level === 'write'
+                ? 'level_write'
+                : null;
     return {
         ...rule,
+        owner: owner ? { id: owner.id, username: owner.username } : null,
         operation: { id: op.id, key: op.key, locked: op.locked, matchProfile: op.matchProfile },
-        /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it). */
-        inert: !rule.enabled ? null : !access.reachable ? access.reason : access.level === 'write' ? 'level_write' : null,
+        /** Rules only fire at level `ask`; on unreachable or `write` operations they never do (UI flags it).
+         * An admin rule is inert only if it is for every role that has the endpoint. */
+        inert: inert && !owner && firesForSomeRole(db, instanceId, op.key) ? null : inert,
     };
 }
 export function listRules(db, instanceId) {
     return db
-        .select({ rule: preApprovalRules, op: operations })
+        .select({ rule: preApprovalRules, op: operations, owner: users })
         .from(preApprovalRules)
         .innerJoin(operations, eq(preApprovalRules.operationId, operations.id))
+        .leftJoin(users, eq(preApprovalRules.ownerUserId, users.id))
         .where(eq(preApprovalRules.instanceId, instanceId))
         .orderBy(asc(operations.key), asc(preApprovalRules.createdAt))
         .all()
-        .map(({ rule, op }) => describe(db, instanceId, rule, op));
+        .map(({ rule, op, owner }) => describe(db, instanceId, rule, op, owner ?? undefined));
+}
+/** A rule as the given owner may touch it: admins (no owner) any rule, a user only their own. */
+function ownedRule(db, instanceId, ruleId, owner) {
+    const rule = db
+        .select()
+        .from(preApprovalRules)
+        .where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
+        .get();
+    if (!rule || (owner !== undefined && rule.ownerUserId !== owner))
+        throw new NotFoundError('rule_not_found', 'No such rule');
+    return rule;
 }
-export function createRule(db, manifest, instanceId, raw, actor = {}) {
+export function createRule(db, manifest, instanceId, raw, actor = {}, opts = {}) {
     const input = RuleInputSchema.parse(raw);
     const op = loadOperation(db, instanceId, input.operationId);
     if (op.locked)
@@ -104,6 +141,7 @@ export function createRule(db, manifest, instanceId, raw, actor = {}) {
             reason: input.reason,
             enabled: input.enabled,
             createdBy: actor.userId ?? null,
+            ownerUserId: opts.owner ?? null,
             createdAt: new Date(),
         })
             .run();
@@ -114,19 +152,13 @@ export function createRule(db, manifest, instanceId, raw, actor = {}) {
             decision: 'rule_created',
             actorKind: 'user',
             actorId: actor.userId,
-            detail: { ruleId: id, ...input },
+            detail: { ruleId: id, ...input, ...(opts.owner ? { owner: opts.owner } : {}) },
         });
     });
     return listRules(db, instanceId).find((r) => r.id === id);
 }
-export function updateRule(db, manifest, instanceId, ruleId, raw, actor = {}) {
-    const before = db
-        .select()
-        .from(preApprovalRules)
-        .where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
-        .get();
-    if (!before)
-        throw new NotFoundError('rule_not_found', 'No such rule');
+export function updateRule(db, manifest, instanceId, ruleId, raw, actor = {}, opts = {}) {
+    const before = ownedRule(db, instanceId, ruleId, opts.owner);
     const input = RuleInputSchema.parse({ ...before, ...raw });
     const op = loadOperation(db, instanceId, input.operationId);
     if (op.locked)
@@ -156,14 +188,8 @@ export function updateRule(db, manifest, instanceId, ruleId, raw, actor = {}) {
     });
     return listRules(db, instanceId).find((r) => r.id === ruleId);
 }
-export function deleteRule(db, instanceId, ruleId, actor = {}) {
-    const before = db
-        .select()
-        .from(preApprovalRules)
-        .where(and(eq(preApprovalRules.id, ruleId), eq(preApprovalRules.instanceId, instanceId)))
-        .get();
-    if (!before)
-        throw new NotFoundError('rule_not_found', 'No such rule');
+export function deleteRule(db, instanceId, ruleId, actor = {}, opts = {}) {
+    const before = ownedRule(db, instanceId, ruleId, opts.owner);
     db.transaction((tx) => {
         tx.delete(preApprovalRules).where(eq(preApprovalRules.id, ruleId)).run();
         writeAudit(tx, {

package/dist/catalog/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/catalog/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;uGACuG;AAEvG,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAMH,SAAS,aAAa,CAAC,EAAM,EAAE,UAAkB,EAAE,WAAmB;IACpE,MAAM,EAAE,GAAG,EAAE;SACV,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACjF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,WAAW,CACzB,QAAqD,EACrD,EAA8C,EAC9C,KAAyB;IAEzB,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,8CAA8C,CAAC,CAAC;IACtH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,iGAAiG;QACjG,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;YAAE,SAAS;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,KAAK,gCAAgC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,OAAO,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,OAAO,GACV,KAAK,CAAC,OAAO,EAAE,MAA+B,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,IAAI,eAAe,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,GAAG,6BAA6B,OAAO,GAAG,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAkB,EAAE,EAAgB,EAAE,KAAyB;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,MAAM,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,EAAM,EAAE,UAAkB,EAAE,IAAa,EAAE,EAAgB;IAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE;QACvF,wGAAwG;QACxG,KAAK,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;KAClH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAM,EAAE,UAAkB;IAClD,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;SAClD,IAAI,CAAC,gBAAgB,CAAC;SACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;SACtE,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;SAC7D,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,GAAY,EACZ,QAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,CAAC;YACN,EAAE;YACF,UAAU;YACV,WAAW,EAAE,EAAE,CAAC,EAAE;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,GAAY,EACZ,QAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACxF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG;QACV,WAAW,EAAE,EAAE,CAAC,EAAE;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClF,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAM,EAAE,UAAkB,EAAE,MAAc,EAAE,QAA6B,EAAE;IACpG,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACxF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACvE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzE,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/catalog/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;uGACuG;AAEvG,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,CAAC;SACP,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAOH,SAAS,aAAa,CAAC,EAAM,EAAE,UAAkB,EAAE,WAAmB;IACpE,MAAM,EAAE,GAAG,EAAE;SACV,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACjF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;IAC9F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,WAAW,CACzB,QAAqD,EACrD,EAA8C,EAC9C,KAAyB;IAEzB,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,8CAA8C,CAAC,CAAC;IACtH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,iGAAiG;QACjG,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;YAAE,SAAS;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,KAAK,gCAAgC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,OAAO,IAAI,eAAe,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,KAAK,kBAAkB,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,OAAO,GACV,KAAK,CAAC,OAAO,EAAE,MAA+B,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,IAAI,eAAe,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,GAAG,6BAA6B,OAAO,GAAG,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAkB,EAAE,EAAgB,EAAE,KAAyB;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,MAAM,MAAM,CAAC;AAC3B,CAAC;AAED,yGAAyG;AACzG,SAAS,gBAAgB,CAAC,EAAM,EAAE,UAAkB,EAAE,GAAW;IAC/D,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,aAAa,CAAC;SACnB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SACpD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC/C,GAAG,EAAE;SACL,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,QAAQ,CAAC,EAAM,EAAE,UAAkB,EAAE,IAAa,EAAE,EAAgB,EAAE,KAAe;IAC5F,0FAA0F;IAC1F,MAAM,SAAS,GAAoB,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACtH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO;QACzB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS;YACjB,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO;gBACxB,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,IAAI,CAAC;IACb,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;QAChE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE;QACvF;wFACgF;QAChF,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;KAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAM,EAAE,UAAkB;IAClD,OAAO,EAAE;SACN,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SAChE,IAAI,CAAC,gBAAgB,CAAC;SACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;SACtE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SAC3D,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAClD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;SAC7D,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,SAAS,SAAS,CAAC,EAAM,EAAE,UAAkB,EAAE,MAAc,EAAE,KAAc;IAC3E,MAAM,IAAI,GAAG,EAAE;SACZ,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;SACxF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC;QAC9D,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,GAAY,EACZ,QAA6B,EAAE,EAC/B,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,CAAC;YACN,EAAE;YACF,UAAU;YACV,WAAW,EAAE,EAAE,CAAC,EAAE;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC/B,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC/E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,QAAkB,EAClB,UAAkB,EAClB,MAAc,EACd,GAAY,EACZ,QAA6B,EAAE,EAC/B,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,0CAA0C,CAAC,CAAC;IAChH,wBAAwB,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG;QACV,WAAW,EAAE,EAAE,CAAC,EAAE;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACrE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IACF,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClF,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,EAAM,EACN,UAAkB,EAClB,MAAc,EACd,QAA6B,EAAE,EAC/B,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzE,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}