@usehercules/convex 0.0.0

package/dist/shared/projection-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-protocol.d.ts","sourceRoot":"","sources":["../../src/shared/projection-protocol.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,4BAA4B;;;EAA4B,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,mCAAmC;;;EAG9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;EAA2C,CAAC;AAC3F,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,8CAA8C;;;EAAsC,CAAC;AAClG,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAC5D,OAAO,8CAA8C,CACtD,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;EAAsC,CAAC;AACnF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,iCAAiC;;;EAAiC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,sCAAsC;;;;;EAKjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAC;AAMF,eAAO,MAAM,qCAAqC;;;;;;EAMhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAGpG,eAAO,MAAM,oBAAoB;;;;;;;;;kBAS/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAKlE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;kBAOtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,eAAO,MAAM,iCAAiC;;;;;;;;;;;kBAQ5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAG5F,eAAO,MAAM,qCAAqC;;;;;;;;kBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAGxE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;kBAQxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAiClC,CAAC;AACL,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mCAAmC;;;;kBAI9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAIhG,eAAO,MAAM,+BAA+B;;;;;;;;kBAY1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAGxF,eAAO,MAAM,2CAA2C;;;;;;;;;kBAMtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,2CAA2C,CACnD,CAAC;AAIF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;kBAqB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAI1F,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;kBAkC/C,CAAC;AACL,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAC;AAsCF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAY9B,CAAC;AACL,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA2CvC,CAAC;AACL,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAOtF,eAAO,MAAM,+BAA+B;;;EAA+B,CAAC;AAC5E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,0BAA0B;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,eAAO,MAAM,0BAA0B;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;kBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,oCAAoC;;;;;;;;kBAK/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,+BAA+B;;;;;;;kBAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,+BAA+B;;;;;;;kBAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,yCAAyC;;;;;;;;kBAKpD,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,yCAAyC,CACjD,CAAC;AAEF,eAAO,MAAM,4CAA4C;;;;;;;;;kBAMvD,CAAC;AACH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,4CAA4C,CACpD,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;;;;kBAI5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,uCAAuC;;;;;;;kBAIlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAKF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;kCAIxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAWjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;AAKlE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAGlF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;kBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAK5E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqCnC,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyDpC,CAAC;AACL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/shared/projection-protocol.js

@@ -0,0 +1,561 @@
+// Hercules Access Control projection wire protocol — v3 (schemaVersion 3).
+//
+// CONSUMER side. This module mirrors, as zod schemas, the producer-side source of
+// truth at packages/backend-shared/src/access-control/projection-protocol.ts in the
+// hercules platform repo. Shared golden fixtures prove the two agree.
+//
+// Two payload kinds:
+//   • snapshot — bootstrap ("initialize") or destructive rebuild ("reset"). ONE
+//     aggregate, applied atomically, default scope first.
+//   • event — normal delivery. A stored, complete, valid delta at an exact
+//     sourceVersion.
+//
+// Layout rules (load-bearing): the deployment-wide catalog (reusable roles,
+// permissions, base role permissions) and deployment-wide users live at the TOP
+// LEVEL and are NEVER duplicated per scope. Each scope carries only its own runtime
+// state (principals, memberships, tenant roles, per-scope overrides, role bindings,
+// permission bindings).
+import { z } from "zod";
+// ── leaf enums ────────────────────────────────────────────────────────────────
+export const accessProjectionEffectSchema = z.enum(["allow", "deny"]);
+export const accessProjectionApplicabilitySchema = z.enum([
+    "self",
+    "self_and_descendants",
+]);
+export const accessProjectionWildcardModeSchema = z.enum(["none", "immutable", "default"]);
+export const accessProjectionPermissionClassificationSchema = z.enum(["delegable", "owner_only"]);
+export const accessProjectionScopeKindSchema = z.enum(["default", "org", "suite"]);
+export const accessProjectionScopeStatusSchema = z.enum(["active", "disabled"]);
+export const accessProjectionAccountEntryModeSchema = z.enum([
+    "open",
+    "allowlisted_only",
+    "invite_only",
+    "approval_required",
+]);
+// "blocked" and "pending_approval" are POLICY states (admission reconciliation
+// may move principals among active/pending_approval/blocked). "suspended" and
+// "removed" are MANUAL states (admin suspension/eviction) that reconciliation
+// must never touch; only an explicit manual action brings such a principal back.
+export const accessProjectionPrincipalStatusSchema = z.enum([
+    "active",
+    "blocked",
+    "suspended",
+    "pending_approval",
+    "removed",
+]);
+// ── deployment-wide identity ─────────────────────────────────────────────────
+export const projectionUserSchema = z.strictObject({
+    herculesAuthUserId: z.string().min(1),
+    name: z.string(),
+    email: z.string().min(1),
+    emailVerified: z.boolean(),
+    image: z.string().optional(),
+    phone: z.string().optional(),
+    phoneVerified: z.boolean(),
+    updatedAt: z.number().int().nonnegative(),
+});
+// ── deployment-wide catalog (NEVER duplicated per scope) ──────────────────────
+// `baseWildcard` is the role's INTRINSIC wildcard mode only. The EFFECTIVE
+// wildcard is derived per scope by the consumer and is never on the wire.
+export const projectionCatalogRoleSchema = z.strictObject({
+    roleId: z.string().min(1),
+    key: z.string().min(1),
+    source: z.enum(["system", "iam"]),
+    name: z.string().min(1),
+    baseWildcard: accessProjectionWildcardModeSchema,
+    updatedAt: z.number().int().nonnegative(),
+});
+// Deployment-owned permission catalog. `classification` drives owner-only gating.
+export const projectionCatalogPermissionSchema = z.strictObject({
+    permissionId: z.string().min(1),
+    key: z.string().min(1),
+    resourceType: z.string().min(1),
+    action: z.string().min(1),
+    classification: accessProjectionPermissionClassificationSchema,
+    tenantAssignable: z.boolean(),
+    updatedAt: z.number().int().nonnegative(),
+});
+// Base role→permission mapping (deployment-wide; the catalog definition).
+export const projectionCatalogRolePermissionSchema = z.strictObject({
+    roleId: z.string().min(1),
+    permissionId: z.string().min(1),
+    effect: accessProjectionEffectSchema,
+    updatedAt: z.number().int().nonnegative(),
+});
+export const projectionCatalogSchema = z.strictObject({
+    roles: z.array(projectionCatalogRoleSchema),
+    permissions: z.array(projectionCatalogPermissionSchema),
+    rolePermissions: z.array(projectionCatalogRolePermissionSchema),
+});
+// ── per-scope state ───────────────────────────────────────────────────────────
+export const projectionScopeMetadataSchema = z.strictObject({
+    accessScopeId: z.string().min(1),
+    name: z.string().min(1),
+    kind: accessProjectionScopeKindSchema,
+    status: accessProjectionScopeStatusSchema,
+    accountEntryMode: accessProjectionAccountEntryModeSchema,
+    defaultRoleId: z.string().min(1),
+    updatedAt: z.number().int().nonnegative(),
+});
+export const projectionPrincipalSchema = z
+    .strictObject({
+    principalId: z.string().min(1),
+    type: z.enum(["user", "group"]),
+    herculesAuthUserId: z.string().min(1).optional(),
+    // Display name for a `group` principal (e.g. "Engineering"). A user
+    // principal's display name lives on the deployment-wide user row and is
+    // never carried here; consumers ignore this field for user principals.
+    name: z.string().min(1).optional(),
+    status: accessProjectionPrincipalStatusSchema,
+    joinedAt: z.number().int().nonnegative(),
+    updatedAt: z.number().int().nonnegative(),
+})
+    // E1 (impersonation fence): the herculesAuthUserId is the identity key the
+    // evaluator resolves a caller to (by_scope_auth_user). A `user` principal MUST
+    // carry it; a `group` principal MUST NOT. A group principal smuggling a
+    // victim's herculesAuthUserId on a malformed payload would otherwise be
+    // resolved as that user. Fail closed at the parse boundary.
+    .superRefine((principal, ctx) => {
+    if (principal.type === "user" && principal.herculesAuthUserId === undefined) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["herculesAuthUserId"],
+            message: "A user principal requires a herculesAuthUserId",
+        });
+    }
+    if (principal.type === "group" && principal.herculesAuthUserId !== undefined) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["herculesAuthUserId"],
+            message: "A group principal must not carry a herculesAuthUserId",
+        });
+    }
+});
+export const projectionPrincipalMembershipSchema = z.strictObject({
+    groupPrincipalId: z.string().min(1),
+    memberPrincipalId: z.string().min(1),
+    updatedAt: z.number().int().nonnegative(),
+});
+// Org-authored role owned by THIS scope (source='tenant'). `baseWildcard` is
+// always "none" for tenant roles; kept for shape parity with catalog roles.
+export const projectionScopeTenantRoleSchema = z.strictObject({
+    roleId: z.string().min(1),
+    accessScopeId: z.string().min(1),
+    key: z.string().min(1),
+    source: z.literal("tenant"),
+    name: z.string().min(1),
+    // E2 (tenant role wildcard fence): a tenant (org-authored) role is ALWAYS a
+    // non-wildcard role. The effective wildcard derivation (resolvePrincipalWildcard)
+    // trusts baseWildcard, so a tenant role carrying "default"/"immutable" on a
+    // malformed payload could become Admin/Owner-equivalent. Pin it to "none".
+    baseWildcard: z.literal("none"),
+    updatedAt: z.number().int().nonnegative(),
+});
+// One scope's override of a reusable role's base mapping. Layered over the base map.
+export const projectionScopeRolePermissionOverrideSchema = z.strictObject({
+    accessScopeId: z.string().min(1),
+    roleId: z.string().min(1),
+    permissionId: z.string().min(1),
+    effect: accessProjectionEffectSchema,
+    updatedAt: z.number().int().nonnegative(),
+});
+// A role assigned to a principal. (resourceType, resourceId) target:
+// (∅,∅)=scope, (type,∅)=type-wide, (type,id)=one exact resource.
+export const projectionScopeRoleBindingSchema = z.strictObject({
+    bindingId: z.string().min(1),
+    subjectPrincipalId: z.string().min(1),
+    roleId: z.string().min(1),
+    accessScopeId: z.string().min(1),
+    resourceType: z.string().min(1).optional(),
+    resourceId: z.string().min(1).optional(),
+    appliesTo: accessProjectionApplicabilitySchema.default("self"),
+    expiresAt: z.number().int().nonnegative().optional(),
+    updatedAt: z.number().int().nonnegative(),
+}).superRefine((binding, ctx) => {
+    if (binding.appliesTo === "self_and_descendants" &&
+        (binding.resourceType === undefined || binding.resourceId === undefined)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["appliesTo"],
+            message: "Descendant applicability requires an exact resource",
+        });
+    }
+});
+// Direct permission authority. Exactly one subject: subjectPrincipalId XOR
+// subjectRoleId. Same nullable (resourceType, resourceId) target shape.
+export const projectionScopePermissionBindingSchema = z
+    .strictObject({
+    bindingId: z.string().min(1),
+    subjectPrincipalId: z.string().min(1).optional(),
+    subjectRoleId: z.string().min(1).optional(),
+    permissionId: z.string().min(1),
+    effect: accessProjectionEffectSchema,
+    accessScopeId: z.string().min(1),
+    resourceType: z.string().min(1).optional(),
+    resourceId: z.string().min(1).optional(),
+    appliesTo: accessProjectionApplicabilitySchema.default("self"),
+    expiresAt: z.number().int().nonnegative().optional(),
+    updatedAt: z.number().int().nonnegative(),
+})
+    .superRefine((binding, ctx) => {
+    const subjectCount = [binding.subjectPrincipalId, binding.subjectRoleId].filter((value) => value !== undefined).length;
+    if (subjectCount !== 1) {
+        ctx.addIssue({
+            code: "custom",
+            message: "Exactly one permission binding subject is required (principal XOR role)",
+        });
+    }
+    if (binding.appliesTo === "self_and_descendants" &&
+        (binding.resourceType === undefined || binding.resourceId === undefined)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["appliesTo"],
+            message: "Descendant applicability requires an exact resource",
+        });
+    }
+});
+// E4 (cross-scope escalation fence): every embedded row that names an
+// accessScopeId (tenant roles, role-permission overrides, role bindings,
+// permission bindings) MUST belong to the enclosing scope. A scope-A block that
+// nests a scope-B-targeted binding would otherwise be applied verbatim and grant
+// authority in scope B (the apply pins to the enclosing scope after this fix, but
+// we ALSO reject the malformed payload at the parse boundary). Reused by both the
+// snapshot scope and the scope delta.
+function assertEmbeddedScopePinned(enclosingScopeId, embedded, ctx) {
+    const checkArray = (field) => {
+        for (const [index, row] of embedded[field].entries()) {
+            if (row.accessScopeId !== enclosingScopeId) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: [field, index, "accessScopeId"],
+                    message: `Embedded ${field} accessScopeId must equal the enclosing scope`,
+                });
+            }
+        }
+    };
+    checkArray("roles");
+    checkArray("rolePermissionOverrides");
+    checkArray("roleBindings");
+    checkArray("permissionBindings");
+}
+export const projectionScopeSchema = z
+    .strictObject({
+    scope: projectionScopeMetadataSchema,
+    principals: z.array(projectionPrincipalSchema),
+    principalMemberships: z.array(projectionPrincipalMembershipSchema),
+    roles: z.array(projectionScopeTenantRoleSchema),
+    rolePermissionOverrides: z.array(projectionScopeRolePermissionOverrideSchema),
+    roleBindings: z.array(projectionScopeRoleBindingSchema),
+    permissionBindings: z.array(projectionScopePermissionBindingSchema),
+})
+    .superRefine((entry, ctx) => {
+    assertEmbeddedScopePinned(entry.scope.accessScopeId, entry, ctx);
+});
+// ── snapshot (bootstrap / reset) ──────────────────────────────────────────────
+// Top-level order: metadata, deployment-wide catalog, deployment-wide users, then
+// scopes (default scope first, then every organization/suite scope). Applied
+// atomically: no scope becomes visible before the whole snapshot commits.
+export const accessProjectionSnapshotSchema = z
+    .strictObject({
+    type: z.literal("access.projection.snapshot"),
+    schemaVersion: z.literal(3),
+    eventId: z.string().min(1),
+    mode: z.enum(["initialize", "reset"]),
+    sourceVersion: z.number().int().nonnegative(),
+    expectedIssuer: z.string().min(1),
+    catalog: projectionCatalogSchema,
+    users: z.array(projectionUserSchema),
+    scopes: z.array(projectionScopeSchema).min(1),
+})
+    .superRefine((payload, ctx) => {
+    const scopeIds = new Set();
+    let defaultScopeCount = 0;
+    for (const [index, entry] of payload.scopes.entries()) {
+        const scopeId = entry.scope.accessScopeId;
+        if (scopeIds.has(scopeId)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["scopes", index, "scope", "accessScopeId"],
+                message: "Projection snapshot scope ids must be unique",
+            });
+        }
+        scopeIds.add(scopeId);
+        if (entry.scope.kind === "default") {
+            defaultScopeCount += 1;
+            if (index !== 0) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["scopes", index, "scope", "kind"],
+                    message: "The default scope must be first",
+                });
+            }
+        }
+    }
+    if (defaultScopeCount !== 1) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["scopes"],
+            message: "Exactly one default scope is required",
+        });
+    }
+});
+// ── event change identities (discriminated by entityType) ─────────────────────
+// A change identity is the entity's STABLE natural key — never an opaque composite
+// string, and never a mutable column. role_permission identity is (roleId,
+// permissionId), NOT effect; override identity excludes effect; membership identity
+// is the pair of principal ids.
+export const projectionChangeOperationSchema = z.enum(["upsert", "delete"]);
+export const projectionUserChangeSchema = z.strictObject({
+    entityType: z.literal("user"),
+    herculesAuthUserId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+// Catalog (reusable) role in a catalog delta; tenant role in a scope delta. Same
+// identity (roleId); the enclosing block selects which role table it matches.
+export const projectionRoleChangeSchema = z.strictObject({
+    entityType: z.literal("role"),
+    roleId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionPermissionChangeSchema = z.strictObject({
+    entityType: z.literal("permission"),
+    permissionId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionRolePermissionChangeSchema = z.strictObject({
+    entityType: z.literal("role_permission"),
+    roleId: z.string().min(1),
+    permissionId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionScopeMetaChangeSchema = z.strictObject({
+    entityType: z.literal("scope"),
+    accessScopeId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionPrincipalChangeSchema = z.strictObject({
+    entityType: z.literal("principal"),
+    principalId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionPrincipalMembershipChangeSchema = z.strictObject({
+    entityType: z.literal("principal_membership"),
+    groupPrincipalId: z.string().min(1),
+    memberPrincipalId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionRolePermissionOverrideChangeSchema = z.strictObject({
+    entityType: z.literal("role_permission_override"),
+    accessScopeId: z.string().min(1),
+    roleId: z.string().min(1),
+    permissionId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionRoleBindingChangeSchema = z.strictObject({
+    entityType: z.literal("role_binding"),
+    bindingId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+export const projectionPermissionBindingChangeSchema = z.strictObject({
+    entityType: z.literal("permission_binding"),
+    bindingId: z.string().min(1),
+    operation: projectionChangeOperationSchema,
+});
+// Each delta block accepts only its own entity kinds (contract point 3, enforced at
+// the type level here by the discriminated union; revalidated at runtime by the
+// integrity superRefine below).
+export const projectionCatalogChangeSchema = z.discriminatedUnion("entityType", [
+    projectionRoleChangeSchema,
+    projectionPermissionChangeSchema,
+    projectionRolePermissionChangeSchema,
+]);
+export const projectionScopeChangeSchema = z.discriminatedUnion("entityType", [
+    projectionScopeMetaChangeSchema,
+    projectionPrincipalChangeSchema,
+    projectionPrincipalMembershipChangeSchema,
+    projectionRoleChangeSchema,
+    projectionRolePermissionOverrideChangeSchema,
+    projectionRoleBindingChangeSchema,
+    projectionPermissionBindingChangeSchema,
+]);
+export const projectionChangeSchema = z.discriminatedUnion("entityType", [
+    projectionUserChangeSchema,
+    projectionRoleChangeSchema,
+    projectionPermissionChangeSchema,
+    projectionRolePermissionChangeSchema,
+    projectionScopeMetaChangeSchema,
+    projectionPrincipalChangeSchema,
+    projectionPrincipalMembershipChangeSchema,
+    projectionRolePermissionOverrideChangeSchema,
+    projectionRoleBindingChangeSchema,
+    projectionPermissionBindingChangeSchema,
+]);
+// ── event delta blocks ────────────────────────────────────────────────────────
+// Deployment-wide catalog delta (e.g. an iam.jsonc apply). `changes` only names
+// catalog entity types (role/permission/role_permission).
+export const projectionCatalogDeltaSchema = z.strictObject({
+    changes: z.array(projectionCatalogChangeSchema),
+    roles: z.array(projectionCatalogRoleSchema),
+    permissions: z.array(projectionCatalogPermissionSchema),
+    rolePermissions: z.array(projectionCatalogRolePermissionSchema),
+});
+// Deployment-wide user delta (profile changes). `changes` only names `user`.
+export const projectionUserDeltaSchema = z.strictObject({
+    changes: z.array(projectionUserChangeSchema),
+    users: z.array(projectionUserSchema),
+});
+// One scope's delta. `scope` is present when the scope metadata is upserted
+// (including scope creation); a scope deletion is a `changes` entry with
+// entityType `scope`, operation `delete`, and the scope's accessScopeId.
+export const projectionScopeDeltaSchema = z
+    .strictObject({
+    accessScopeId: z.string().min(1),
+    scope: projectionScopeMetadataSchema.optional(),
+    changes: z.array(projectionScopeChangeSchema),
+    principals: z.array(projectionPrincipalSchema),
+    principalMemberships: z.array(projectionPrincipalMembershipSchema),
+    roles: z.array(projectionScopeTenantRoleSchema),
+    rolePermissionOverrides: z.array(projectionScopeRolePermissionOverrideSchema),
+    roleBindings: z.array(projectionScopeRoleBindingSchema),
+    permissionBindings: z.array(projectionScopePermissionBindingSchema),
+})
+    // E4 (cross-scope escalation fence): the delta names one enclosing scope, and
+    // every embedded row plus every scope-change identity that carries an
+    // accessScopeId MUST equal it. The `scope` metadata row (when present) must
+    // describe this same scope.
+    .superRefine((delta, ctx) => {
+    assertEmbeddedScopePinned(delta.accessScopeId, delta, ctx);
+    if (delta.scope !== undefined && delta.scope.accessScopeId !== delta.accessScopeId) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["scope", "accessScopeId"],
+            message: "Embedded scope metadata accessScopeId must equal the enclosing scope",
+        });
+    }
+    for (const [index, change] of delta.changes.entries()) {
+        if ((change.entityType === "scope" || change.entityType === "role_permission_override") &&
+            change.accessScopeId !== delta.accessScopeId) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["changes", index, "accessScopeId"],
+                message: "Scope change accessScopeId must equal the enclosing scope",
+            });
+        }
+    }
+});
+// ── event (normal delivery) ──────────────────────────────────────────────────
+// A stored event is ALWAYS complete and valid: every `upsert` change ships its full
+// row in the matching array; every `delete` change ships only its id. At least one
+// of catalog/users/scopes is present, and the integrity rule (contract point C3) is
+// enforced by the superRefine, mirroring `assertProjectionEventIntegrity`.
+export const accessProjectionEventSchema = z
+    .strictObject({
+    type: z.literal("access.projection.event"),
+    schemaVersion: z.literal(3),
+    eventId: z.string().min(1),
+    sourceVersion: z.number().int().nonnegative(),
+    catalog: projectionCatalogDeltaSchema.optional(),
+    users: projectionUserDeltaSchema.optional(),
+    scopes: z.array(projectionScopeDeltaSchema).optional(),
+})
+    .superRefine((event, ctx) => {
+    if (event.catalog === undefined && event.users === undefined && event.scopes === undefined) {
+        ctx.addIssue({
+            code: "custom",
+            message: "event has no catalog, users, or scopes delta block",
+        });
+    }
+    const checkRows = (path, change, matches) => {
+        if (change.operation === "upsert" && matches !== 1) {
+            ctx.addIssue({
+                code: "custom",
+                path,
+                message: `upsert ${changeKey(change)} expected exactly 1 row, found ${matches}`,
+            });
+        }
+        if (change.operation === "delete" && matches !== 0) {
+            ctx.addIssue({
+                code: "custom",
+                path,
+                message: `delete ${changeKey(change)} expected 0 rows, found ${matches}`,
+            });
+        }
+    };
+    if (event.catalog) {
+        for (const [index, change] of event.catalog.changes.entries()) {
+            checkRows(["catalog", "changes", index], change, countCatalogRows(event.catalog, change));
+        }
+    }
+    if (event.users) {
+        for (const [index, change] of event.users.changes.entries()) {
+            const matches = event.users.users.filter((u) => u.herculesAuthUserId === change.herculesAuthUserId).length;
+            checkRows(["users", "changes", index], change, matches);
+        }
+    }
+    for (const [scopeIndex, scope] of (event.scopes ?? []).entries()) {
+        for (const [index, change] of scope.changes.entries()) {
+            checkRows(["scopes", scopeIndex, "changes", index], change, countScopeRows(scope, change));
+        }
+    }
+});
+export const accessProjectionSyncPayloadSchema = z.union([
+    accessProjectionSnapshotSchema,
+    accessProjectionEventSchema,
+]);
+// ── integrity helpers (mirror of producer assertProjectionEventIntegrity) ──────
+function changeKey(change) {
+    switch (change.entityType) {
+        case "user":
+            return `user:${change.herculesAuthUserId}`;
+        case "role":
+            return `role:${change.roleId}`;
+        case "permission":
+            return `permission:${change.permissionId}`;
+        case "role_permission":
+            return `role_permission:${change.roleId}/${change.permissionId}`;
+        case "scope":
+            return `scope:${change.accessScopeId}`;
+        case "principal":
+            return `principal:${change.principalId}`;
+        case "principal_membership":
+            return `principal_membership:${change.groupPrincipalId}/${change.memberPrincipalId}`;
+        case "role_permission_override":
+            return `role_permission_override:${change.accessScopeId}/${change.roleId}/${change.permissionId}`;
+        case "role_binding":
+            return `role_binding:${change.bindingId}`;
+        case "permission_binding":
+            return `permission_binding:${change.bindingId}`;
+    }
+}
+function countCatalogRows(catalog, change) {
+    switch (change.entityType) {
+        case "role":
+            return catalog.roles.filter((r) => r.roleId === change.roleId).length;
+        case "permission":
+            return catalog.permissions.filter((p) => p.permissionId === change.permissionId).length;
+        case "role_permission":
+            return catalog.rolePermissions.filter((rp) => rp.roleId === change.roleId && rp.permissionId === change.permissionId).length;
+    }
+}
+function countScopeRows(scope, change) {
+    switch (change.entityType) {
+        case "scope":
+            return scope.scope !== undefined && scope.accessScopeId === change.accessScopeId ? 1 : 0;
+        case "principal":
+            return scope.principals.filter((p) => p.principalId === change.principalId).length;
+        case "principal_membership":
+            return scope.principalMemberships.filter((m) => m.groupPrincipalId === change.groupPrincipalId &&
+                m.memberPrincipalId === change.memberPrincipalId).length;
+        case "role":
+            return scope.roles.filter((r) => r.roleId === change.roleId).length;
+        case "role_permission_override":
+            return scope.rolePermissionOverrides.filter((o) => o.accessScopeId === change.accessScopeId &&
+                o.roleId === change.roleId &&
+                o.permissionId === change.permissionId).length;
+        case "role_binding":
+            return scope.roleBindings.filter((b) => b.bindingId === change.bindingId).length;
+        case "permission_binding":
+            return scope.permissionBindings.filter((b) => b.bindingId === change.bindingId).length;
+    }
+}
+//# sourceMappingURL=projection-protocol.js.map

package/dist/shared/projection-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-protocol.js","sourceRoot":"","sources":["../../src/shared/projection-protocol.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,sEAAsE;AACtE,EAAE;AACF,qBAAqB;AACrB,gFAAgF;AAChF,0DAA0D;AAC1D,2EAA2E;AAC3E,qBAAqB;AACrB,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,wBAAwB;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAGtE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC;IACxD,MAAM;IACN,sBAAsB;CACvB,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAG3F,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAKlG,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAGhF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM;IACN,kBAAkB;IAClB,aAAa;IACb,mBAAmB;CACpB,CAAC,CAAC;AAKH,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1D,QAAQ;IACR,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,SAAS;CACV,CAAC,CAAC;AAGH,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,iFAAiF;AACjF,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,YAAY,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,kCAAkC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,cAAc,EAAE,8CAA8C;IAC9D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,4BAA4B;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC;CAChE,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,+BAA+B;IACrC,MAAM,EAAE,iCAAiC;IACzC,gBAAgB,EAAE,sCAAsC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,YAAY,CAAC;IACZ,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,qCAAqC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,wEAAwE;IACxE,wEAAwE;IACxE,4DAA4D;KAC3D,WAAW,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE;IAC9B,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,oBAAoB,CAAC;YAC5B,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,oBAAoB,CAAC;YAC5B,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,4EAA4E;IAC5E,kFAAkF;IAClF,4EAA4E;IAC5E,2EAA2E;IAC3E,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,qFAAqF;AACrF,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,4BAA4B;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAKH,qEAAqE;AACrE,iEAAiE;AACjE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC9B,IACE,OAAO,CAAC,SAAS,KAAK,sBAAsB;QAC5C,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,EACxE,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,2EAA2E;AAC3E,wEAAwE;AACxE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,YAAY,CAAC;IACZ,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,4BAA4B;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAC7E,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAC/B,CAAC,MAAM,CAAC;IACT,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yEAAyE;SACnF,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,CAAC,SAAS,KAAK,sBAAsB;QAC5C,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,EACxE,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL,sEAAsE;AACtE,yEAAyE;AACzE,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,sCAAsC;AACtC,SAAS,yBAAyB,CAChC,gBAAwB,EACxB,QAKC,EACD,GAAoB;IAEpB,MAAM,UAAU,GAAG,CACjB,KAAkF,EAC5E,EAAE;QACR,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,CAAC,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBAC3C,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC;oBACrC,OAAO,EAAE,YAAY,KAAK,+CAA+C;iBAC1E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,UAAU,CAAC,OAAO,CAAC,CAAC;IACpB,UAAU,CAAC,yBAAyB,CAAC,CAAC;IACtC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC3B,UAAU,CAAC,oBAAoB,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,YAAY,CAAC;IACZ,KAAK,EAAE,6BAA6B;IACpC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAC9C,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;IAC/C,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;CACpE,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAGL,iFAAiF;AACjF,kFAAkF;AAClF,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,YAAY,CAAC;IACZ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,uBAAuB;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;gBACjD,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,iBAAiB,IAAI,CAAC,CAAC;YACvB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;oBACxC,OAAO,EAAE,iCAAiC;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,iFAAiF;AACjF,mFAAmF;AACnF,2EAA2E;AAC3E,oFAAoF;AACpF,gCAAgC;AAChC,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAGH,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,YAAY,CAAC;IACzE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAKH,oFAAoF;AACpF,gFAAgF;AAChF,gCAAgC;AAChC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IAC9E,0BAA0B;IAC1B,gCAAgC;IAChC,oCAAoC;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IAC5E,+BAA+B;IAC/B,+BAA+B;IAC/B,yCAAyC;IACzC,0BAA0B;IAC1B,4CAA4C;IAC5C,iCAAiC;IACjC,uCAAuC;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE;IACvE,0BAA0B;IAC1B,0BAA0B;IAC1B,gCAAgC;IAChC,oCAAoC;IACpC,+BAA+B;IAC/B,+BAA+B;IAC/B,yCAAyC;IACzC,4CAA4C;IAC5C,iCAAiC;IACjC,uCAAuC;CACxC,CAAC,CAAC;AAIH,iFAAiF;AACjF,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,YAAY,CAAC;IACzD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC;CAChE,CAAC,CAAC;AAGH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACrC,CAAC,CAAC;AAGH,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,KAAK,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAC9C,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;IAC/C,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC;IAC7E,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;CACpE,CAAC;IACF,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,4BAA4B;KAC3B,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,yBAAyB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;YAChC,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IACE,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,0BAA0B,CAAC;YACnF,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAC5C,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC;gBACzC,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,gFAAgF;AAChF,oFAAoF;AACpF,mFAAmF;AACnF,oFAAoF;AACpF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,YAAY,CAAC;IACZ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,CAChB,IAAyB,EACzB,MAAwB,EACxB,OAAe,EACT,EAAE;QACR,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI;gBACJ,OAAO,EAAE,UAAU,SAAS,CAAC,MAAM,CAAC,kCAAkC,OAAO,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI;gBACJ,OAAO,EAAE,UAAU,SAAS,CAAC,MAAM,CAAC,2BAA2B,OAAO,EAAE;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB,CAC1D,CAAC,MAAM,CAAC;YACT,SAAS,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,SAAS,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC;IACvD,8BAA8B;IAC9B,2BAA2B;CAC5B,CAAC,CAAC;AAGH,kFAAkF;AAClF,SAAS,SAAS,CAAC,MAAwB;IACzC,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,MAAM;YACT,OAAO,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC7C,KAAK,MAAM;YACT,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,YAAY;YACf,OAAO,cAAc,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,KAAK,iBAAiB;YACpB,OAAO,mBAAmB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACnE,KAAK,OAAO;YACV,OAAO,SAAS,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,KAAK,WAAW;YACd,OAAO,aAAa,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,sBAAsB;YACzB,OAAO,wBAAwB,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACvF,KAAK,0BAA0B;YAC7B,OAAO,4BAA4B,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACpG,KAAK,cAAc;YACjB,OAAO,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,KAAK,oBAAoB;YACvB,OAAO,sBAAsB,MAAM,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,MAA+B;IAE/B,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACxE,KAAK,YAAY;YACf,OAAO,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QAC1F,KAAK,iBAAiB;YACpB,OAAO,OAAO,CAAC,eAAe,CAAC,MAAM,CACnC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAC/E,CAAC,MAAM,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA2B,EAAE,MAA6B;IAChF,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,WAAW;YACd,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QACrF,KAAK,sBAAsB;YACzB,OAAO,KAAK,CAAC,oBAAoB,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;gBAC9C,CAAC,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,CACnD,CAAC,MAAM,CAAC;QACX,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACtE,KAAK,0BAA0B;YAC7B,OAAO,KAAK,CAAC,uBAAuB,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;gBACxC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAC1B,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CACzC,CAAC,MAAM,CAAC;QACX,KAAK,cAAc;YACjB,OAAO,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACnF,KAAK,oBAAoB;YACvB,OAAO,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC3F,CAAC;AACH,CAAC"}

package/dist/shared/sync.d.ts

@@ -0,0 +1,24 @@
+export declare const ACCESS_CONTROL_SYNC_PATH = "/_hercules/access-control/sync";
+export { accessProjectionSyncPayloadSchema, accessProjectionSnapshotSchema, accessProjectionEventSchema, accessProjectionEffectSchema, accessProjectionApplicabilitySchema, accessProjectionWildcardModeSchema, accessProjectionPermissionClassificationSchema, accessProjectionScopeKindSchema, accessProjectionScopeStatusSchema, accessProjectionAccountEntryModeSchema, accessProjectionPrincipalStatusSchema, projectionUserSchema, projectionCatalogRoleSchema, projectionCatalogPermissionSchema, projectionCatalogRolePermissionSchema, projectionCatalogSchema, projectionScopeMetadataSchema, projectionPrincipalSchema, projectionPrincipalMembershipSchema, projectionScopeTenantRoleSchema, projectionScopeRolePermissionOverrideSchema, projectionScopeRoleBindingSchema, projectionScopePermissionBindingSchema, projectionScopeSchema, projectionScopeDeltaSchema, projectionCatalogDeltaSchema, projectionUserDeltaSchema, } from "./projection-protocol";
+export type { AccessProjectionSyncPayload, AccessProjectionSnapshot, AccessProjectionEvent, AccessProjectionEffect, AccessProjectionApplicability, AccessProjectionWildcardMode, AccessProjectionPermissionClassification, AccessProjectionScopeKind, AccessProjectionScopeStatus, AccessProjectionAccountEntryMode, AccessProjectionPrincipalStatus, ProjectionUser, ProjectionCatalogRole, ProjectionCatalogPermission, ProjectionCatalogRolePermission, ProjectionCatalog, ProjectionScopeMetadata, ProjectionPrincipal, ProjectionPrincipalMembership, ProjectionScopeTenantRole, ProjectionScopeRolePermissionOverride, ProjectionScopeRoleBinding, ProjectionScopePermissionBinding, ProjectionScope, ProjectionScopeDelta, ProjectionCatalogDelta, ProjectionUserDelta, ProjectionChange, ProjectionChangeOperation, ProjectionEntityType, ProjectionCatalogChange, ProjectionScopeChange, } from "./projection-protocol";
+import type { AccessProjectionScopeKind } from "./projection-protocol";
+export type ScopeKind = AccessProjectionScopeKind;
+export type SyncResponse = {
+    ok: true;
+    status: "applied" | "duplicate";
+    acknowledgedVersion: number;
+} | {
+    ok: false;
+    status: "version_gap";
+    currentVersion: number;
+    expectedVersion: number;
+    receivedVersion: number;
+} | {
+    ok: false;
+    status: "invalid_signature" | "invalid_payload" | "unsupported_schema" | "issuer_mismatch" | "default_scope_required";
+} | {
+    ok: false;
+    status: "not_ready" | "reset_required";
+    currentVersion: number;
+};
+//# sourceMappingURL=sync.d.ts.map

package/dist/shared/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/shared/sync.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,wBAAwB,mCAAmC,CAAC;AAGzE,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,EAC5B,mCAAmC,EACnC,kCAAkC,EAClC,8CAA8C,EAC9C,+BAA+B,EAC/B,iCAAiC,EACjC,sCAAsC,EACtC,qCAAqC,EACrC,oBAAoB,EACpB,2BAA2B,EAC3B,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,6BAA6B,EAC7B,yBAAyB,EACzB,mCAAmC,EACnC,+BAA+B,EAC/B,2CAA2C,EAC3C,gCAAgC,EAChC,sCAAsC,EACtC,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,2BAA2B,EAC3B,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,wCAAwC,EACxC,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,+BAA+B,EAC/B,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,qCAAqC,EACrC,0BAA0B,EAC1B,gCAAgC,EAChC,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,MAAM,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAOlD,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,GAC1E;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,aAAa,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,mBAAmB,GACnB,iBAAiB,GACjB,oBAAoB,GACpB,iBAAiB,GACjB,wBAAwB,CAAC;CAC9B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC"}