@venizia/ignis-kernel 0.2.0-0

package/dist/esm/base/auth/authorize/builders/grant.builder.d.ts

@@ -0,0 +1,75 @@
+import type { IdType } from '../../../../base/index.js';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { type TNullable } from '@venizia/ignis-helpers/common';
+import { type TAuthorizationAction, type TAuthorizationDecision, type TGrantIntent, type TPlannedGrantRow } from '../common/index.js';
+import { type TPolicyDomainInput } from './policy.builder.js';
+export declare class GrantBuilder extends BaseHelper {
+    static readonly SINGLETON_REAL_KEY = "grant-builder";
+    /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */
+    private static readonly PLANNABLE_TIERS;
+    /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */
+    private static readonly NARROW_TIERS;
+    constructor();
+    static getInstance(): GrantBuilder;
+    decodeMetadata<MetadataType = unknown>(opts: {
+        metadata: MetadataType;
+    }): any;
+    /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */
+    parseCustomGrantMetadata(opts: {
+        metadata: unknown;
+    }): {
+        ops: string[];
+    } | null;
+    /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */
+    validateCustomGrantOps(opts: {
+        ops: string[];
+        subject: string;
+        catalog: Array<{
+            subject: string;
+            method: string;
+        }>;
+    }): {
+        valid: string[];
+        unknown: string[];
+    };
+    /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */
+    actionsCoveredBy(opts: {
+        tier: TAuthorizationAction;
+    }): Set<string>;
+    /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */
+    planGrant(opts: {
+        subject: {
+            type: string;
+            id: IdType;
+        };
+        resource: {
+            type: string;
+            id: IdType;
+            subject: string;
+        };
+        intent: TGrantIntent;
+        catalog: Array<{
+            subject: string;
+            method: string;
+            code: string;
+            action: string;
+        }>;
+        domain?: TNullable<TPolicyDomainInput>;
+        effect?: TAuthorizationDecision;
+        supportsCustomMetadata?: boolean;
+        exact?: boolean;
+    }): TPlannedGrantRow[];
+    /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */
+    protected collapseRemainingIntoTiers(opts: {
+        subjectCatalog: Array<{
+            subject: string;
+            method: string;
+            code: string;
+            action: string;
+        }>;
+        remaining: Set<string>;
+        rows: TPlannedGrantRow[];
+        tierRow: (tier: TAuthorizationAction) => TPlannedGrantRow;
+    }): void;
+}
+//# sourceMappingURL=grant.builder.d.ts.map

package/dist/esm/base/auth/authorize/builders/grant.builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAA8B,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAmBvF,qBAAa,YAAa,SAAQ,UAAU;IAC1C,MAAM,CAAC,QAAQ,CAAC,kBAAkB,mBAAmB;IAErD,8FAA8F;IAC9F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAKpC;IAEH,oGAAoG;IACpG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAIlC;;IAMF,MAAM,CAAC,WAAW;IAOlB,cAAc,CAAC,YAAY,GAAG,OAAO,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,YAAY,CAAA;KAAE;IAevE,+JAA+J;IAC/J,wBAAwB,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IA6B/E,uMAAuM;IACvM,sBAAsB,CAAC,IAAI,EAAE;QAC3B,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACrD,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;IAwB1C,kGAAkG;IAClG,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,oBAAoB,CAAA;KAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAWnE,gSAAgS;IAChS,SAAS,CAAC,IAAI,EAAE;QACd,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QACtC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QACxD,MAAM,EAAE,YAAY,CAAC;QACrB,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClF,MAAM,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,sBAAsB,CAAC;QAChC,sBAAsB,CAAC,EAAE,OAAO,CAAC;QACjC,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,gBAAgB,EAAE;IA0GtB,sGAAsG;IACtG,SAAS,CAAC,0BAA0B,CAAC,IAAI,EAAE;QACzC,cAAc,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACzF,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,gBAAgB,CAAC;KAC3D,GAAG,IAAI;CA2CT"}

package/dist/esm/base/auth/authorize/builders/grant.builder.js

@@ -0,0 +1,225 @@
+import { SingletonRealm } from '../../../../helpers/singleton-realm.js';
+import { BaseHelper, getError } from '@venizia/ignis-helpers/core';
+import { AuthorizationActions, AuthorizationDecisions, } from '../common/index.js';
+import { AuthorizationPolicyBuilder } from './policy.builder.js';
+/** One closure pass over the action lattice: adds every child reachable from an already-covered parent, reporting whether the set grew. */
+const expandCoveredActions = (opts) => {
+    const { covered } = opts;
+    let grew = false;
+    for (const edge of AuthorizationActions.LATTICE) {
+        if (!covered.has(edge.parent) || covered.has(edge.child)) {
+            continue;
+        }
+        covered.add(edge.child);
+        grew = true;
+    }
+    return grew;
+};
+export class GrantBuilder extends BaseHelper {
+    static { this.SINGLETON_REAL_KEY = 'grant-builder'; }
+    /** Tiers a caller may ask for; `custom` is an encoding marker and is never a valid intent. */
+    static { this.PLANNABLE_TIERS = new Set([
+        AuthorizationActions.READ,
+        AuthorizationActions.WRITE,
+        AuthorizationActions.EXECUTE,
+        AuthorizationActions.MANAGE,
+    ]); }
+    /** Tried after `manage`; disjoint from each other, since an operation has one catalogued action. */
+    static { this.NARROW_TIERS = [
+        AuthorizationActions.READ,
+        AuthorizationActions.WRITE,
+        AuthorizationActions.EXECUTE,
+    ]; }
+    constructor() {
+        super({ scope: GrantBuilder.name });
+    }
+    static getInstance() {
+        return SingletonRealm.resolve({
+            key: GrantBuilder.SINGLETON_REAL_KEY,
+            create: () => new GrantBuilder(),
+        });
+    }
+    decodeMetadata(opts) {
+        if (typeof opts.metadata !== 'string') {
+            return opts.metadata;
+        }
+        try {
+            return JSON.parse(opts.metadata);
+        }
+        catch (error) {
+            this.logger
+                .for(this.decodeMetadata.name)
+                .error('Failed to parse metadata | Error: %s', error);
+            return null;
+        }
+    }
+    /** Read `{ ops }` off a grant row's metadata, or null when the shape is unusable. Callers treat null as a defect to log and skip - never as an empty grant. */
+    parseCustomGrantMetadata(opts) {
+        const decoded = this.decodeMetadata(opts);
+        if (typeof decoded !== 'object' || decoded === null || Array.isArray(decoded)) {
+            return null;
+        }
+        const ops = decoded.ops;
+        if (!Array.isArray(ops) || ops.length === 0) {
+            return null;
+        }
+        const seen = new Set();
+        const unique = [];
+        for (const op of ops) {
+            if (typeof op !== 'string' || op.length === 0) {
+                return null;
+            }
+            if (!seen.has(op)) {
+                seen.add(op);
+                unique.push(op);
+            }
+        }
+        return { ops: unique };
+    }
+    /** Split operation names into those present in the catalog for `subject` and those that are not. Pure - the caller supplies the catalog slice; the adapter re-runs this independently at read time. */
+    validateCustomGrantOps(opts) {
+        const known = new Set();
+        for (const entry of opts.catalog) {
+            if (entry.subject === opts.subject) {
+                known.add(entry.method);
+            }
+        }
+        const valid = [];
+        const unknown = [];
+        for (const op of opts.ops) {
+            if (known.has(op)) {
+                valid.push(op);
+                continue;
+            }
+            unknown.push(op);
+        }
+        return { valid, unknown };
+    }
+    /** Actions a tier confers, derived from LATTICE rather than hardcoded so the two cannot drift. */
+    actionsCoveredBy(opts) {
+        const covered = new Set([opts.tier]);
+        let grew = true;
+        while (grew) {
+            grew = expandCoveredActions({ covered });
+        }
+        return covered;
+    }
+    /** Decide which rows express an intent: a custom row is a last resort, so as much of the selection as possible collapses into tier grants first. `exact` disables collapsing when the caller means these operations and no future ones. Pure - the caller supplies the catalog and persists. */
+    planGrant(opts) {
+        const effect = opts.effect ?? AuthorizationDecisions.ALLOW;
+        const domain = opts.domain ?? null;
+        if ('tier' in opts.intent) {
+            if (!GrantBuilder.PLANNABLE_TIERS.has(opts.intent.tier)) {
+                throw getError({
+                    message: `[planGrant] Invalid tier: ${opts.intent.tier} | Valids: [${[...GrantBuilder.PLANNABLE_TIERS].join(', ')}]`,
+                });
+            }
+            return [
+                AuthorizationPolicyBuilder.grant({
+                    subject: opts.subject,
+                    permission: { type: opts.resource.type, id: opts.resource.id },
+                    action: opts.intent.tier,
+                    domain,
+                    effect,
+                }),
+            ];
+        }
+        const seen = new Set();
+        const ops = [];
+        for (const op of opts.intent.ops) {
+            if (seen.has(op)) {
+                continue;
+            }
+            seen.add(op);
+            ops.push(op);
+        }
+        if (!ops.length) {
+            throw getError({ message: '[planGrant] intent.ops must not be empty.' });
+        }
+        const subjectCatalog = opts.catalog.filter(entry => entry.subject === opts.resource.subject);
+        const byMethod = new Map(subjectCatalog.map(entry => [entry.method, entry]));
+        const unknown = ops.filter(op => !byMethod.has(op));
+        if (unknown.length) {
+            throw getError({
+                message: `[planGrant] Unknown operations for resource "${opts.resource.subject}": ${unknown.join(', ')}`,
+            });
+        }
+        const tierRow = (tier) => AuthorizationPolicyBuilder.grant({
+            subject: opts.subject,
+            permission: { type: opts.resource.type, id: opts.resource.id },
+            action: tier,
+            domain,
+            effect,
+        });
+        const rows = [];
+        const remaining = new Set(ops);
+        if (opts.exact !== true) {
+            this.collapseRemainingIntoTiers({ subjectCatalog, remaining, rows, tierRow });
+        }
+        const leftover = ops.filter(op => remaining.has(op));
+        if (!leftover.length) {
+            return rows;
+        }
+        const isPerOperationGrant = leftover.length === 1 || opts.supportsCustomMetadata === false;
+        if (!isPerOperationGrant) {
+            rows.push(AuthorizationPolicyBuilder.customGrant({
+                subject: opts.subject,
+                permission: { type: opts.resource.type, id: opts.resource.id },
+                ops: leftover,
+                domain,
+                effect,
+            }));
+            return rows;
+        }
+        for (const op of leftover) {
+            const entry = byMethod.get(op);
+            if (!entry) {
+                throw getError({ message: `[planGrant] No catalog entry for operation "${op}".` });
+            }
+            rows.push(AuthorizationPolicyBuilder.grant({
+                subject: opts.subject,
+                permission: { type: opts.resource.type, id: entry.code },
+                action: entry.action,
+                domain,
+                effect,
+            }));
+        }
+        return rows;
+    }
+    /** Collapse `remaining` into the fewest tier grants, mutating `remaining` and appending to `rows`. */
+    collapseRemainingIntoTiers(opts) {
+        const { subjectCatalog, remaining, rows, tierRow } = opts;
+        // manage equals read+write+execute only when the subject has at least one operation in EACH narrow tier; otherwise manage also covers a future tier, which is more than the narrow tiers confer today.
+        const spansAllNarrowTiers = GrantBuilder.NARROW_TIERS.every(tier => {
+            const covered = this.actionsCoveredBy({ tier });
+            return subjectCatalog.some(entry => covered.has(entry.action));
+        });
+        const manageCovered = this.actionsCoveredBy({ tier: AuthorizationActions.MANAGE });
+        const manageOps = subjectCatalog
+            .filter(entry => manageCovered.has(entry.action))
+            .map(entry => entry.method);
+        if (spansAllNarrowTiers &&
+            manageOps.length &&
+            manageOps.every(method => remaining.has(method))) {
+            rows.push(tierRow(AuthorizationActions.MANAGE));
+            for (const method of manageOps) {
+                remaining.delete(method);
+            }
+            return;
+        }
+        for (const tier of GrantBuilder.NARROW_TIERS) {
+            const covered = this.actionsCoveredBy({ tier });
+            const methods = subjectCatalog
+                .filter(entry => covered.has(entry.action))
+                .map(entry => entry.method);
+            if (!methods.length || !methods.every(method => remaining.has(method))) {
+                continue;
+            }
+            rows.push(tierRow(tier));
+            for (const method of methods) {
+                remaining.delete(method);
+            }
+        }
+    }
+}
+//# sourceMappingURL=grant.builder.js.map

package/dist/esm/base/auth/authorize/builders/grant.builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/grant.builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GAKvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,0BAA0B,EAA2B,MAAM,kBAAkB,CAAC;AAEvF,2IAA2I;AAC3I,MAAM,oBAAoB,GAAG,CAAC,IAA8B,EAAW,EAAE;IACvE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,SAAS;QACX,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,OAAO,YAAa,SAAQ,UAAU;aAC1B,uBAAkB,GAAG,eAAe,CAAC;IAErD,8FAA8F;aACtE,oBAAe,GAAG,IAAI,GAAG,CAAS;QACxD,oBAAoB,CAAC,IAAI;QACzB,oBAAoB,CAAC,KAAK;QAC1B,oBAAoB,CAAC,OAAO;QAC5B,oBAAoB,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,oGAAoG;aAC5E,iBAAY,GAAwC;QAC1E,oBAAoB,CAAC,IAAI;QACzB,oBAAoB,CAAC,KAAK;QAC1B,oBAAoB,CAAC,OAAO;KAC7B,CAAC;IAEF;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,OAAO,cAAc,CAAC,OAAO,CAAC;YAC5B,GAAG,EAAE,YAAY,CAAC,kBAAkB;YACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAyB,IAAgC;QACrE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;iBAC7B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,+JAA+J;IAC/J,wBAAwB,CAAC,IAA2B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,uMAAuM;IACvM,sBAAsB,CAAC,IAItB;QACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAClG,gBAAgB,CAAC,IAAoC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7C,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gSAAgS;IAChS,SAAS,CAAC,IAST;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAEnC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,6BAA6B,IAAI,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACrH,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,0BAA0B,CAAC,KAAK,CAAC;oBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACxB,MAAM;oBACN,MAAM;iBACP,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,gDAAgD,IAAI,CAAC,QAAQ,CAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACzG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAA0B,EAAE,EAAE,CAC7C,0BAA0B,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC9D,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QAEL,MAAM,IAAI,GAAuB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,0BAA0B,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAErD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,KAAK,KAAK,CAAC;QAE3F,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CACP,0BAA0B,CAAC,WAAW,CAAC;gBACrC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9D,GAAG,EAAE,QAAQ;gBACb,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,CAAC,IAAI,CACP,0BAA0B,CAAC,KAAK,CAAC;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;gBACxD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM;gBACN,MAAM;aACP,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sGAAsG;IAC5F,0BAA0B,CAAC,IAKpC;QACC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAE1D,uMAAuM;QACvM,MAAM,mBAAmB,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,cAAc;aAC7B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9B,IACE,mBAAmB;YACnB,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YAED,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,cAAc;iBAC3B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC"}

package/dist/esm/base/auth/authorize/builders/index.d.ts

@@ -0,0 +1,4 @@
+export * from './grant.builder.js';
+export * from './permission.builder.js';
+export * from './policy.builder.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authorize/builders/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/dist/esm/base/auth/authorize/builders/index.js

@@ -0,0 +1,4 @@
+export * from './grant.builder.js';
+export * from './permission.builder.js';
+export * from './policy.builder.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authorize/builders/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}

package/dist/esm/base/auth/authorize/builders/permission.builder.d.ts

@@ -0,0 +1,80 @@
+import type { IdType } from '../../../../base/index.js';
+import type { TNullable } from '@venizia/ignis-helpers/common';
+import type { TAuthorizationAction } from '../common/constants.js';
+/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
+export declare class AuthorizationPermissionBuilder {
+    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
+    static readonly RESOURCE_NODE_METHOD = "*";
+    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
+    static readonly METHOD_ACTIONS: Readonly<Record<string, TAuthorizationAction>>;
+    /** The CRUD methods {@link crud} generates by default. */
+    static readonly DEFAULT_CRUD_METHODS: ReadonlyArray<string>;
+    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
+    static actionForMethod(method: string): TAuthorizationAction;
+    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
+    static operation<TName>(opts: {
+        subject: string;
+        method: string;
+        scope: string;
+        name: TName;
+        description?: TNullable<TName>;
+        action?: TAuthorizationAction;
+        parentId?: TNullable<IdType>;
+    }): {
+        code: string;
+        subject: string;
+        method: string;
+        action: string;
+        scope: string;
+        description: NonNullable<TName> | null;
+        parentId: IdType | null;
+        name: TName;
+    };
+    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
+    static resourceNode<TName>(opts: {
+        code: string;
+        subject?: string;
+        scope: string;
+        name: TName;
+        description?: TNullable<TName>;
+        action?: TAuthorizationAction;
+        parentId?: TNullable<IdType>;
+    }): {
+        code: string;
+        subject: string;
+        method: string;
+        action: string;
+        scope: string;
+        description: NonNullable<TName> | null;
+        parentId: IdType | null;
+        name: TName;
+    };
+    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
+    static crud<TName>(opts: {
+        subject: string;
+        scope: string;
+        name: (ctx: {
+            subject: string;
+            method: string;
+            action: TAuthorizationAction;
+        }) => TName;
+        description?: (ctx: {
+            subject: string;
+            method: string;
+            action: TAuthorizationAction;
+        }) => TNullable<TName>;
+        methods?: ReadonlyArray<string>;
+    }): {
+        code: string;
+        subject: string;
+        method: string;
+        action: string;
+        scope: string;
+        description: NonNullable<TName> | null;
+        parentId: IdType | null;
+        name: TName;
+    }[];
+    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
+    static objectMatch(requested: string, granted: string): boolean;
+}
+//# sourceMappingURL=permission.builder.d.ts.map

package/dist/esm/base/auth/authorize/builders/permission.builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.builder.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhE,+RAA+R;AAC/R,qBAAa,8BAA8B;IACzC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,oBAAoB,OAAO;IAE3C,gHAAgH;IAChH,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAU5E;IAEF,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAUzD;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB;IAI5D,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,WAAW,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;KAC9B;;;;;;;;;;IAaD,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,oBAAoB,CAAA;SAAE,KAAK,KAAK,CAAC;QACxF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,oBAAoB,CAAC;SAC9B,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KACjC;;;;;;;;;;IAsBD,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;CAWhE"}

package/dist/esm/base/auth/authorize/builders/permission.builder.js

@@ -0,0 +1,91 @@
+import { AuthorizationActions } from '../common/constants.js';
+/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
+export class AuthorizationPermissionBuilder {
+    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
+    static { this.RESOURCE_NODE_METHOD = '*'; }
+    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
+    static { this.METHOD_ACTIONS = {
+        find: AuthorizationActions.READ,
+        findById: AuthorizationActions.READ,
+        findOne: AuthorizationActions.READ,
+        count: AuthorizationActions.READ,
+        create: AuthorizationActions.CREATE,
+        updateById: AuthorizationActions.UPDATE,
+        updateBy: AuthorizationActions.UPDATE,
+        deleteById: AuthorizationActions.DELETE,
+        deleteBy: AuthorizationActions.DELETE,
+    }; }
+    /** The CRUD methods {@link crud} generates by default. */
+    static { this.DEFAULT_CRUD_METHODS = [
+        'find',
+        'findById',
+        'findOne',
+        'count',
+        'create',
+        'updateById',
+        'updateBy',
+        'deleteById',
+        'deleteBy',
+    ]; }
+    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
+    static actionForMethod(method) {
+        return AuthorizationPermissionBuilder.METHOD_ACTIONS[method] ?? AuthorizationActions.EXECUTE;
+    }
+    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
+    static operation(opts) {
+        return {
+            code: [opts.subject, opts.method].join('.'),
+            subject: opts.subject,
+            method: opts.method,
+            action: opts.action ?? AuthorizationPermissionBuilder.actionForMethod(opts.method),
+            scope: opts.scope,
+            description: opts.description ?? null,
+            parentId: opts.parentId ?? null,
+            name: opts.name,
+        };
+    }
+    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
+    static resourceNode(opts) {
+        return {
+            code: opts.code,
+            subject: opts.subject ?? opts.code,
+            method: AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD,
+            action: opts.action ?? AuthorizationActions.MANAGE,
+            scope: opts.scope,
+            description: opts.description ?? null,
+            parentId: opts.parentId ?? null,
+            name: opts.name,
+        };
+    }
+    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
+    static crud(opts) {
+        const methods = opts.methods ?? AuthorizationPermissionBuilder.DEFAULT_CRUD_METHODS;
+        return methods.map(method => {
+            const action = AuthorizationPermissionBuilder.actionForMethod(method);
+            const ctx = {
+                subject: opts.subject,
+                method,
+                action,
+            };
+            return AuthorizationPermissionBuilder.operation({
+                subject: opts.subject,
+                method,
+                scope: opts.scope,
+                action,
+                name: opts.name(ctx),
+                description: opts.description ? opts.description(ctx) : undefined,
+            });
+        });
+    }
+    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
+    static objectMatch(requested, granted) {
+        if (granted === '*') {
+            return true;
+        }
+        if (requested === granted) {
+            return true;
+        }
+        return requested.startsWith(`${granted}.`);
+    }
+}
+//# sourceMappingURL=permission.builder.js.map

package/dist/esm/base/auth/authorize/builders/permission.builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.builder.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authorize/builders/permission.builder.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,+RAA+R;AAC/R,MAAM,OAAO,8BAA8B;IACzC,yFAAyF;aACzE,yBAAoB,GAAG,GAAG,CAAC;IAE3C,gHAAgH;aAChG,mBAAc,GAAmD;QAC/E,IAAI,EAAE,oBAAoB,CAAC,IAAI;QAC/B,QAAQ,EAAE,oBAAoB,CAAC,IAAI;QACnC,OAAO,EAAE,oBAAoB,CAAC,IAAI;QAClC,KAAK,EAAE,oBAAoB,CAAC,IAAI;QAChC,MAAM,EAAE,oBAAoB,CAAC,MAAM;QACnC,UAAU,EAAE,oBAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,oBAAoB,CAAC,MAAM;QACrC,UAAU,EAAE,oBAAoB,CAAC,MAAM;QACvC,QAAQ,EAAE,oBAAoB,CAAC,MAAM;KACtC,CAAC;IAEF,0DAA0D;aAC1C,yBAAoB,GAA0B;QAC5D,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,YAAY;QACZ,UAAU;KACX,CAAC;IAEF,kHAAkH;IAClH,MAAM,CAAC,eAAe,CAAC,MAAc;QACnC,OAAO,8BAA8B,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC;IAC/F,CAAC;IAED,iHAAiH;IACjH,MAAM,CAAC,SAAS,CAAQ,IAQvB;QACC,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,8BAA8B,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAClF,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,iMAAiM;IACjM,MAAM,CAAC,YAAY,CAAQ,IAQ1B;QACC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI;YAClC,MAAM,EAAE,8BAA8B,CAAC,oBAAoB;YAC3D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,MAAM;YAClD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,0NAA0N;IAC1N,MAAM,CAAC,IAAI,CAAQ,IAUlB;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,8BAA8B,CAAC,oBAAoB,CAAC;QAEpF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM,MAAM,GAAG,8BAA8B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,GAAG,GAAsE;gBAC7E,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,MAAM;aACP,CAAC;YAEF,OAAO,8BAA8B,CAAC,SAAS,CAAQ;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2RAA2R;IAC3R,MAAM,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QACnD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC7C,CAAC"}