@vertesia/studio-utils 1.4.0-dev.20260615.051508Z → 1.4.0

package/lib/conditions/index.d.ts

@@ -0,0 +1,2 @@
+export { matchConditions, matchLike, resolvePath } from './match.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/conditions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/conditions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/lib/conditions/index.js

@@ -0,0 +1,2 @@
+export { matchConditions, matchLike, resolvePath } from './match.js';
+//# sourceMappingURL=index.js.map

package/lib/conditions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/conditions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}

package/lib/conditions/match.d.ts

@@ -0,0 +1,54 @@
+import type { PropertyConditions } from '@vertesia/common';
+/**
+ * Resolve a property path against a context object.
+ *
+ * Supports:
+ *   - `clearance` → obj.clearance
+ *   - `email` → obj.email
+ *   - `properties.department` → obj.properties.department (one nested level under `properties`)
+ *
+ * Returns `undefined` if any segment is missing or non-traversable.
+ */
+export declare function resolvePath(obj: Record<string, unknown>, path: string): unknown;
+/**
+ * Match a wildcard pattern against a string value.
+ *
+ * Supports `*` as wildcard:
+ *   - `"*@domain.com"` — ends with
+ *   - `"bogdan.*"` — starts with
+ *   - `"bogdan+*@vertesia.com"` — contains
+ *   - `"*"` — match all
+ *
+ * Case-insensitive. Non-string `value` always returns `false`.
+ */
+export declare function matchLike(value: unknown, pattern: string): boolean;
+/**
+ * Evaluate a PropertyConditions object against a set of properties (JS-side, in-memory).
+ *
+ * Supports the MongoDB query syntax subset shared across token-server (principal property
+ * matching at JWT-mint time) and zeno-server (write-path ABAC permission checks against an
+ * in-memory document):
+ *
+ *   - Direct value match (`{ field: literal }`)
+ *   - `$eq`, `$ne`, `$gt`, `$gte`, `$lt`, `$lte`
+ *   - `$in`, `$nin` (against array `expected`)
+ *   - `$exists` (boolean)
+ *   - `$empty` (boolean) — true for undefined/null/empty-string/empty-array
+ *   - `$like` (wildcard string, see {@link matchLike})
+ *
+ * All field-level conditions are AND'd (every field must match). Within a single field, all
+ * operators are AND'd.
+ *
+ * Mirrors the Mongo-side filter built by `conditionsToMongoFilter` (zeno-server utils.ts) and
+ * the ES-side filter built by `conditionsToEsQuery`. Use this when conditions need to be
+ * evaluated against a single hydrated document instead of pushed down as a query.
+ *
+ * Unknown operators emit a warning via the studio-utils logger and return false — surfacing
+ * misconfiguration loudly without breaking the surrounding token mint or permission check.
+ *
+ * `$principal.X` substitutions in conditions are expected to have already been resolved at
+ * JWT-mint time by `resolveConditions` in token-server; values reaching this function are
+ * concrete.
+ */
+export declare function matchConditions(conditions: PropertyConditions, properties: Record<string, unknown>): boolean;
+//# sourceMappingURL=match.d.ts.map

package/lib/conditions/match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.d.ts","sourceRoot":"","sources":["../../src/conditions/match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ/E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKlE;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CA2D5G"}

package/lib/conditions/match.js

@@ -0,0 +1,156 @@
+import { getStudioUtilsLogger } from '../logger.js';
+/**
+ * Resolve a property path against a context object.
+ *
+ * Supports:
+ *   - `clearance` → obj.clearance
+ *   - `email` → obj.email
+ *   - `properties.department` → obj.properties.department (one nested level under `properties`)
+ *
+ * Returns `undefined` if any segment is missing or non-traversable.
+ */
+export function resolvePath(obj, path) {
+    if (path.startsWith('properties.')) {
+        const properties = obj.properties;
+        return properties && typeof properties === 'object'
+            ? properties[path.slice(11)]
+            : undefined;
+    }
+    return obj[path];
+}
+/**
+ * Match a wildcard pattern against a string value.
+ *
+ * Supports `*` as wildcard:
+ *   - `"*@domain.com"` — ends with
+ *   - `"bogdan.*"` — starts with
+ *   - `"bogdan+*@vertesia.com"` — contains
+ *   - `"*"` — match all
+ *
+ * Case-insensitive. Non-string `value` always returns `false`.
+ */
+export function matchLike(value, pattern) {
+    if (typeof value !== 'string')
+        return false;
+    // Convert wildcard pattern to regex: escape regex chars except *, then replace * with .*
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+    return new RegExp(`^${escaped}$`, 'i').test(value);
+}
+function compareOrdered(value, expected, op) {
+    if (typeof value !== 'number' && typeof value !== 'string')
+        return false;
+    if (typeof value !== typeof expected)
+        return false;
+    const left = value;
+    const right = expected;
+    switch (op) {
+        case '$gt':
+            return left > right;
+        case '$gte':
+            return left >= right;
+        case '$lt':
+            return left < right;
+        case '$lte':
+            return left <= right;
+    }
+}
+/**
+ * Evaluate a PropertyConditions object against a set of properties (JS-side, in-memory).
+ *
+ * Supports the MongoDB query syntax subset shared across token-server (principal property
+ * matching at JWT-mint time) and zeno-server (write-path ABAC permission checks against an
+ * in-memory document):
+ *
+ *   - Direct value match (`{ field: literal }`)
+ *   - `$eq`, `$ne`, `$gt`, `$gte`, `$lt`, `$lte`
+ *   - `$in`, `$nin` (against array `expected`)
+ *   - `$exists` (boolean)
+ *   - `$empty` (boolean) — true for undefined/null/empty-string/empty-array
+ *   - `$like` (wildcard string, see {@link matchLike})
+ *
+ * All field-level conditions are AND'd (every field must match). Within a single field, all
+ * operators are AND'd.
+ *
+ * Mirrors the Mongo-side filter built by `conditionsToMongoFilter` (zeno-server utils.ts) and
+ * the ES-side filter built by `conditionsToEsQuery`. Use this when conditions need to be
+ * evaluated against a single hydrated document instead of pushed down as a query.
+ *
+ * Unknown operators emit a warning via the studio-utils logger and return false — surfacing
+ * misconfiguration loudly without breaking the surrounding token mint or permission check.
+ *
+ * `$principal.X` substitutions in conditions are expected to have already been resolved at
+ * JWT-mint time by `resolveConditions` in token-server; values reaching this function are
+ * concrete.
+ */
+export function matchConditions(conditions, properties) {
+    for (const [key, condition] of Object.entries(conditions)) {
+        const value = resolvePath(properties, key);
+        if (condition === null || condition === undefined || typeof condition !== 'object') {
+            // Direct value match
+            if (value !== condition)
+                return false;
+        }
+        else {
+            // Operator object
+            const ops = condition;
+            for (const [op, expected] of Object.entries(ops)) {
+                switch (op) {
+                    case '$eq':
+                        if (value !== expected)
+                            return false;
+                        break;
+                    case '$ne':
+                        if (value === expected)
+                            return false;
+                        break;
+                    case '$gt':
+                        if (!compareOrdered(value, expected, '$gt'))
+                            return false;
+                        break;
+                    case '$gte':
+                        if (!compareOrdered(value, expected, '$gte'))
+                            return false;
+                        break;
+                    case '$lt':
+                        if (!compareOrdered(value, expected, '$lt'))
+                            return false;
+                        break;
+                    case '$lte':
+                        if (!compareOrdered(value, expected, '$lte'))
+                            return false;
+                        break;
+                    case '$in':
+                        if (!Array.isArray(expected) || !expected.includes(value))
+                            return false;
+                        break;
+                    case '$nin':
+                        if (Array.isArray(expected) && expected.includes(value))
+                            return false;
+                        break;
+                    case '$exists':
+                        if (typeof expected !== 'boolean' || (value !== undefined) !== expected)
+                            return false;
+                        break;
+                    case '$empty': {
+                        const isEmpty = value === undefined ||
+                            value === null ||
+                            value === '' ||
+                            (Array.isArray(value) && value.length === 0);
+                        if (typeof expected !== 'boolean' || isEmpty !== expected)
+                            return false;
+                        break;
+                    }
+                    case '$like':
+                        if (typeof expected !== 'string' || !matchLike(value, expected))
+                            return false;
+                        break;
+                    default:
+                        getStudioUtilsLogger().warn({ op, key }, 'Unknown operator in PropertyConditions');
+                        return false;
+                }
+            }
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=match.js.map

package/lib/conditions/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../src/conditions/match.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,GAA4B,EAAE,IAAY;IAClE,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;YAC/C,CAAC,CAAE,UAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,OAAe;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,yFAAyF;IACzF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,QAAiB,EAAE,EAAmC;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,OAAO,KAAK,KAAK,OAAO,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC;IACnB,MAAM,KAAK,GAAG,QAAuB,CAAC;IACtC,QAAQ,EAAE,EAAE,CAAC;QACT,KAAK,KAAK;YACN,OAAO,IAAI,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM;YACP,OAAO,IAAI,IAAI,KAAK,CAAC;QACzB,KAAK,KAAK;YACN,OAAO,IAAI,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM;YACP,OAAO,IAAI,IAAI,KAAK,CAAC;IAC7B,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,eAAe,CAAC,UAA8B,EAAE,UAAmC;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE3C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACjF,qBAAqB;YACrB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QAC1C,CAAC;aAAM,CAAC;YACJ,kBAAkB;YAClB,MAAM,GAAG,GAAG,SAAoC,CAAC;YACjD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,QAAQ,EAAE,EAAE,CAAC;oBACT,KAAK,KAAK;wBACN,IAAI,KAAK,KAAK,QAAQ;4BAAE,OAAO,KAAK,CAAC;wBACrC,MAAM;oBACV,KAAK,KAAK;wBACN,IAAI,KAAK,KAAK,QAAQ;4BAAE,OAAO,KAAK,CAAC;wBACrC,MAAM;oBACV,KAAK,KAAK;wBACN,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC;4BAAE,OAAO,KAAK,CAAC;wBAC1D,MAAM;oBACV,KAAK,MAAM;wBACP,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;4BAAE,OAAO,KAAK,CAAC;wBAC3D,MAAM;oBACV,KAAK,KAAK;wBACN,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC;4BAAE,OAAO,KAAK,CAAC;wBAC1D,MAAM;oBACV,KAAK,MAAM;wBACP,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;4BAAE,OAAO,KAAK,CAAC;wBAC3D,MAAM;oBACV,KAAK,KAAK;wBACN,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;4BAAE,OAAO,KAAK,CAAC;wBACxE,MAAM;oBACV,KAAK,MAAM;wBACP,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;4BAAE,OAAO,KAAK,CAAC;wBACtE,MAAM;oBACV,KAAK,SAAS;wBACV,IAAI,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,QAAQ;4BAAE,OAAO,KAAK,CAAC;wBACtF,MAAM;oBACV,KAAK,QAAQ,CAAC,CAAC,CAAC;wBACZ,MAAM,OAAO,GACT,KAAK,KAAK,SAAS;4BACnB,KAAK,KAAK,IAAI;4BACd,KAAK,KAAK,EAAE;4BACZ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;wBACjD,IAAI,OAAO,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ;4BAAE,OAAO,KAAK,CAAC;wBACxE,MAAM;oBACV,CAAC;oBACD,KAAK,OAAO;wBACR,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;4BAAE,OAAO,KAAK,CAAC;wBAC9E,MAAM;oBACV;wBACI,oBAAoB,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;wBACnF,OAAO,KAAK,CAAC;gBACrB,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/lib/index.d.ts

@@ -2,4 +2,5 @@ export { extractHandlebarsVariables } from './prompts/extract-vars.js';
 export { generateMockData } from './prompts/mock-data.js';
 export { executeHandlebars, executeJST, renderPrompt, renderSegments, renderSegmentsOrErrors, renderTemplate, type SegmentPreview, } from './prompts/render.js';
 export { type PromptValidationInput, type PromptValidationIssue, type PromptValidationIssueSeverity, type PromptValidationIssueType, type PromptValidationResult, validatePrompt, } from './prompts/validate.js';
+export * from './roles/index.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACH,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,KAAK,cAAc,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,cAAc,GACjB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACH,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,KAAK,cAAc,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,cAAc,GACjB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}

package/lib/index.js

@@ -2,4 +2,5 @@ export { extractHandlebarsVariables } from './prompts/extract-vars.js';
 export { generateMockData } from './prompts/mock-data.js';
 export { executeHandlebars, executeJST, renderPrompt, renderSegments, renderSegmentsOrErrors, renderTemplate, } from './prompts/render.js';
 export { validatePrompt, } from './prompts/validate.js';
+export * from './roles/index.js';
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACH,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,cAAc,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAMH,cAAc,GACjB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACH,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,cAAc,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAMH,cAAc,GACjB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}

package/lib/logger.d.ts

@@ -0,0 +1,6 @@
+export interface StudioUtilsLogger {
+    warn(details: Record<string, unknown>, message: string): void;
+}
+export declare function getStudioUtilsLogger(): StudioUtilsLogger;
+export declare function installStudioUtilsLogger(customLogger: StudioUtilsLogger): StudioUtilsLogger;
+//# sourceMappingURL=logger.d.ts.map

package/lib/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAC9B,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjE;AAcD,wBAAgB,oBAAoB,IAAI,iBAAiB,CAExD;AAED,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,iBAAiB,GAAG,iBAAiB,CAI3F"}

package/lib/logger.js

@@ -0,0 +1,15 @@
+const consoleLogger = {
+    warn: (details, message) => {
+        console.warn(message, details);
+    },
+};
+let logger = consoleLogger;
+export function getStudioUtilsLogger() {
+    return logger;
+}
+export function installStudioUtilsLogger(customLogger) {
+    const previousLogger = logger;
+    logger = customLogger;
+    return previousLogger;
+}
+//# sourceMappingURL=logger.js.map

package/lib/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAQA,MAAM,aAAa,GAAsB;IACrC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QACvB,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;CACJ,CAAC;AAEF,IAAI,MAAM,GAAsB,aAAa,CAAC;AAE9C,MAAM,UAAU,oBAAoB;IAChC,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,YAA+B;IACpE,MAAM,cAAc,GAAG,MAAM,CAAC;IAC9B,MAAM,GAAG,YAAY,CAAC;IACtB,OAAO,cAAc,CAAC;AAC1B,CAAC"}

package/lib/roles/classes.d.ts

@@ -0,0 +1,59 @@
+import type { AbacScope, Permission, RoleDomain } from '@vertesia/common';
+/**
+ * Class hierarchy and registry-bound interface for the role system. These
+ * are LOGIC — they have runtime behavior (constructors, instance methods,
+ * subclass dispatch via `instanceof`). They live in `@vertesia/studio-utils`
+ * (not common) per the package-layering contract: only types stay in common.
+ */
+/**
+ * A role: a named bundle of permissions that ACEs reference by name.
+ *
+ * Generic over the permission type so subclasses can tighten it:
+ *  - **System roles** declare `extends Role<Permission>` — construction time
+ *    type-checks against the central `Permission` enum.
+ *  - **ABAC roles** (`AbacRole`) declare `extends Role<string>` — permissions
+ *    are bare verbs (`'read'`, `'write'`, `'delete'`, future domain-specific
+ *    verbs) consumed by the JWT generator to form `{scope}:{verb}` keys in
+ *    `content_security`.
+ *
+ * The registry stores `Role` (defaulting to `Role<string>`) — the loose type
+ * is the lowest common denominator. Tight typing is only enforced at
+ * declaration sites of the role subclasses.
+ */
+export declare class Role<PermissionType extends string = string> {
+    name: string;
+    domain: RoleDomain;
+    permissions: Set<PermissionType>;
+    constructor(name: string, permissions: PermissionType[], domain: RoleDomain);
+    hasPermission(permission: PermissionType): boolean;
+}
+/**
+ * Base class for built-in system roles. Hardcodes `domain: 'system'` and
+ * specializes `Role<Permission>` so subclasses get compile-time type-checking
+ * against the central `Permission` enum at construction.
+ */
+export declare class SystemRole extends Role<Permission> {
+    constructor(name: string, permissions: Permission[]);
+}
+/**
+ * A role usable in ContentSet ACEs. Adds `applicableScopes` — the kinds of
+ * objects the role can be applied to at the ABAC scope level. Inherits
+ * `Role<string>` because ABAC verbs aren't constrained to the central
+ * `Permission` enum.
+ *
+ * The IAM UI filters via `listAbacRolesForScope` which checks `instanceof AbacRole`.
+ */
+export declare class AbacRole extends Role<string> {
+    applicableScopes: readonly AbacScope[];
+    constructor(name: string, permissions: string[], domain: RoleDomain, applicableScopes: readonly AbacScope[]);
+}
+/**
+ * A logical bucket of roles owned by a single domain. The registry iterates
+ * partitions in registration order — first match wins. The `system` partition
+ * is registered first so domain partitions cannot shadow built-in system roles.
+ */
+export interface RolePartition {
+    domain: RoleDomain;
+    roles: Map<string, Role>;
+}
+//# sourceMappingURL=classes.d.ts.map

package/lib/roles/classes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classes.d.ts","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1E;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,qBAAa,IAAI,CAAC,cAAc,SAAS,MAAM,GAAG,MAAM;IAGzC,IAAI,EAAE,MAAM;IAEZ,MAAM,EAAE,UAAU;IAJ7B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAEtB,IAAI,EAAE,MAAM,EACnB,WAAW,EAAE,cAAc,EAAE,EACtB,MAAM,EAAE,UAAU;IAK7B,aAAa,CAAC,UAAU,EAAE,cAAc;CAG3C;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,IAAI,CAAC,UAAU,CAAC;gBAChC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE;CAGtD;AAED;;;;;;;GAOG;AACH,qBAAa,QAAS,SAAQ,IAAI,CAAC,MAAM,CAAC;IAK3B,gBAAgB,EAAE,SAAS,SAAS,EAAE;gBAH7C,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,MAAM,EAAE,UAAU,EACX,gBAAgB,EAAE,SAAS,SAAS,EAAE;CAIpD;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC5B"}

package/lib/roles/classes.js

@@ -0,0 +1,60 @@
+/**
+ * Class hierarchy and registry-bound interface for the role system. These
+ * are LOGIC — they have runtime behavior (constructors, instance methods,
+ * subclass dispatch via `instanceof`). They live in `@vertesia/studio-utils`
+ * (not common) per the package-layering contract: only types stay in common.
+ */
+/**
+ * A role: a named bundle of permissions that ACEs reference by name.
+ *
+ * Generic over the permission type so subclasses can tighten it:
+ *  - **System roles** declare `extends Role<Permission>` — construction time
+ *    type-checks against the central `Permission` enum.
+ *  - **ABAC roles** (`AbacRole`) declare `extends Role<string>` — permissions
+ *    are bare verbs (`'read'`, `'write'`, `'delete'`, future domain-specific
+ *    verbs) consumed by the JWT generator to form `{scope}:{verb}` keys in
+ *    `content_security`.
+ *
+ * The registry stores `Role` (defaulting to `Role<string>`) — the loose type
+ * is the lowest common denominator. Tight typing is only enforced at
+ * declaration sites of the role subclasses.
+ */
+export class Role {
+    name;
+    domain;
+    permissions;
+    constructor(name, permissions, domain) {
+        this.name = name;
+        this.domain = domain;
+        this.permissions = new Set(permissions);
+    }
+    hasPermission(permission) {
+        return this.permissions.has(permission);
+    }
+}
+/**
+ * Base class for built-in system roles. Hardcodes `domain: 'system'` and
+ * specializes `Role<Permission>` so subclasses get compile-time type-checking
+ * against the central `Permission` enum at construction.
+ */
+export class SystemRole extends Role {
+    constructor(name, permissions) {
+        super(name, permissions, 'system');
+    }
+}
+/**
+ * A role usable in ContentSet ACEs. Adds `applicableScopes` — the kinds of
+ * objects the role can be applied to at the ABAC scope level. Inherits
+ * `Role<string>` because ABAC verbs aren't constrained to the central
+ * `Permission` enum.
+ *
+ * The IAM UI filters via `listAbacRolesForScope` which checks `instanceof AbacRole`.
+ */
+export class AbacRole extends Role {
+    applicableScopes;
+    constructor(name, permissions, domain, applicableScopes) {
+        super(name, permissions, domain);
+        this.applicableScopes = applicableScopes;
+    }
+}
+//# sourceMappingURL=classes.js.map

package/lib/roles/classes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classes.js","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,IAAI;IAGF;IAEA;IAJX,WAAW,CAAsB;IACjC,YACW,IAAY,EACnB,WAA6B,EACtB,MAAkB;QAFlB,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAY;QAEzB,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CAAC,UAA0B;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAW,SAAQ,IAAgB;IAC5C,YAAY,IAAY,EAAE,WAAyB;QAC/C,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,IAAY;IAK3B;IAJX,YACI,IAAY,EACZ,WAAqB,EACrB,MAAkB,EACX,gBAAsC;QAE7C,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAF1B,qBAAgB,GAAhB,gBAAgB,CAAsB;IAGjD,CAAC;CACJ"}

package/lib/roles/content.d.ts

@@ -0,0 +1,13 @@
+import { type RolePartition } from './classes.js';
+/**
+ * Names of roles owned by the `content` domain. Apply to ContentSet ACEs
+ * scoped to either `document` or `collection` — the semantics of "read
+ * content" are the same for both kinds.
+ */
+export declare enum ContentRoleNames {
+    content_reader = "content_reader",
+    content_writer = "content_writer",
+    content_manager = "content_manager"
+}
+export declare const contentPartition: RolePartition;
+//# sourceMappingURL=content.d.ts.map

package/lib/roles/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAMvE;;;;GAIG;AACH,oBAAY,gBAAgB;IACxB,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;CACtC;AA0BD,eAAO,MAAM,gBAAgB,EAAE,aAG9B,CAAC"}

package/lib/roles/content.js

@@ -0,0 +1,39 @@
+import { AbacRole } from './classes.js';
+const ContentRoleDomain = 'content';
+const APPLICABLE_SCOPES = ['document', 'collection'];
+/**
+ * Names of roles owned by the `content` domain. Apply to ContentSet ACEs
+ * scoped to either `document` or `collection` — the semantics of "read
+ * content" are the same for both kinds.
+ */
+export var ContentRoleNames;
+(function (ContentRoleNames) {
+    ContentRoleNames["content_reader"] = "content_reader";
+    ContentRoleNames["content_writer"] = "content_writer";
+    ContentRoleNames["content_manager"] = "content_manager";
+})(ContentRoleNames || (ContentRoleNames = {}));
+class ContentReaderRole extends AbacRole {
+    constructor() {
+        super(ContentRoleNames.content_reader, ['read'], ContentRoleDomain, APPLICABLE_SCOPES);
+    }
+}
+class ContentWriterRole extends AbacRole {
+    constructor() {
+        super(ContentRoleNames.content_writer, ['read', 'write'], ContentRoleDomain, APPLICABLE_SCOPES);
+    }
+}
+class ContentManagerRole extends AbacRole {
+    constructor() {
+        super(ContentRoleNames.content_manager, ['read', 'write', 'delete'], ContentRoleDomain, APPLICABLE_SCOPES);
+    }
+}
+const contentRoles = {
+    [ContentRoleNames.content_reader]: new ContentReaderRole(),
+    [ContentRoleNames.content_writer]: new ContentWriterRole(),
+    [ContentRoleNames.content_manager]: new ContentManagerRole(),
+};
+export const contentPartition = {
+    domain: ContentRoleDomain,
+    roles: new Map(Object.entries(contentRoles)),
+};
+//# sourceMappingURL=content.js.map

package/lib/roles/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAiC,MAAM,cAAc,CAAC;AAEvE,MAAM,iBAAiB,GAAe,SAAS,CAAC;AAEhD,MAAM,iBAAiB,GAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IACxB,qDAAiC,CAAA;IACjC,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;AACvC,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,MAAM,iBAAkB,SAAQ,QAAQ;IACpC;QACI,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC3F,CAAC;CACJ;AAED,MAAM,iBAAkB,SAAQ,QAAQ;IACpC;QACI,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IACpG,CAAC;CACJ;AAED,MAAM,kBAAmB,SAAQ,QAAQ;IACrC;QACI,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/G,CAAC;CACJ;AAED,MAAM,YAAY,GAAmC;IACjD,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,IAAI,iBAAiB,EAAE;IAC1D,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,IAAI,iBAAiB,EAAE;IAC1D,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,IAAI,kBAAkB,EAAE;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAkB;IAC3C,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/C,CAAC"}

package/lib/roles/index.d.ts

@@ -0,0 +1,37 @@
+import type { AbacScope, RoleDomain } from '@vertesia/common';
+import { AbacRole, type Role, SystemRole } from './classes.js';
+export { AbacRole, Role, type RolePartition, SystemRole } from './classes.js';
+export { ContentRoleNames } from './content.js';
+/** Look up a role by its name across all registered partitions. */
+export declare function getRoleByName(name: string): Role;
+/** List every role across all partitions, in partition registration order. */
+export declare function listRoles(): Role[];
+/** Roles owned by a specific domain (e.g. `'system'`, `'content'`). */
+export declare function listRolesByDomain(domain: RoleDomain): Role[];
+/**
+ * ABAC roles applicable to a given ContentSet scope (e.g. `'document'`,
+ * `'collection'`). System roles are excluded — they don't carry scope semantics.
+ */
+export declare function listAbacRolesForScope(scope: AbacScope): AbacRole[];
+/** Shortcut for the system partition: returns only `SystemRole` instances. */
+export declare function listSystemRoles(): SystemRole[];
+/** Names of every registered role across all partitions — suited for mongoose schema enum constraints. */
+export declare function getAllRoleNames(): string[];
+/**
+ * Merge the permissions granted by a set of roles into a single array.
+ * Intended for the system-role gating path. For ABAC roles, the bare-verb
+ * permissions returned here aren't directly meaningful — use the JWT
+ * `content_security` pathway instead.
+ */
+export declare function getPermissionsForRoles(roleNames: Iterable<string>): string[];
+/**
+ * A list of roles with a unified `hasPermission` check across them.
+ */
+export declare class RoleList {
+    readonly roles: Role[];
+    private constructor();
+    static fromRoleNames(roleNames: string[]): RoleList;
+    static fromRoleName(roleName: string): RoleList;
+    hasPermission(perm: string): boolean;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/roles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAsB,UAAU,EAAE,MAAM,cAAc,CAAC;AAInF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAShD,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMhD;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,IAAI,IAAI,EAAE,CAQlC;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAG5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,EAAE,CAElE;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,UAAU,EAAE,CAE9C;AAED,0GAA0G;AAC1G,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAS5E;AAED;;GAEG;AACH,qBAAa,QAAQ;aACmB,KAAK,EAAE,IAAI,EAAE;IAAjD,OAAO;IAEP,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ;IAKnD,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ;IAK/C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAGvC"}

package/lib/roles/index.js

@@ -0,0 +1,87 @@
+import { AbacRole, SystemRole } from './classes.js';
+import { contentPartition } from './content.js';
+import { systemPartition } from './system.js';
+export { AbacRole, Role, SystemRole } from './classes.js';
+export { ContentRoleNames } from './content.js';
+/**
+ * The ordered partition registry. Partitions are queried in this order — first
+ * match wins. The `system` partition is registered first so domain-specific
+ * partitions (added later) cannot shadow built-in system roles.
+ */
+const partitions = [systemPartition, contentPartition];
+/** Look up a role by its name across all registered partitions. */
+export function getRoleByName(name) {
+    for (const partition of partitions) {
+        const role = partition.roles.get(name);
+        if (role)
+            return role;
+    }
+    throw new Error(`Role ${name} not found`);
+}
+/** List every role across all partitions, in partition registration order. */
+export function listRoles() {
+    const result = [];
+    for (const partition of partitions) {
+        for (const role of partition.roles.values()) {
+            result.push(role);
+        }
+    }
+    return result;
+}
+/** Roles owned by a specific domain (e.g. `'system'`, `'content'`). */
+export function listRolesByDomain(domain) {
+    const partition = partitions.find((p) => p.domain === domain);
+    return partition ? Array.from(partition.roles.values()) : [];
+}
+/**
+ * ABAC roles applicable to a given ContentSet scope (e.g. `'document'`,
+ * `'collection'`). System roles are excluded — they don't carry scope semantics.
+ */
+export function listAbacRolesForScope(scope) {
+    return listRoles().filter((r) => r instanceof AbacRole && r.applicableScopes.includes(scope));
+}
+/** Shortcut for the system partition: returns only `SystemRole` instances. */
+export function listSystemRoles() {
+    return listRoles().filter((r) => r instanceof SystemRole);
+}
+/** Names of every registered role across all partitions — suited for mongoose schema enum constraints. */
+export function getAllRoleNames() {
+    return listRoles().map((r) => r.name);
+}
+/**
+ * Merge the permissions granted by a set of roles into a single array.
+ * Intended for the system-role gating path. For ABAC roles, the bare-verb
+ * permissions returned here aren't directly meaningful — use the JWT
+ * `content_security` pathway instead.
+ */
+export function getPermissionsForRoles(roleNames) {
+    const permissions = new Set();
+    for (const roleName of roleNames) {
+        const role = getRoleByName(roleName);
+        for (const permission of role.permissions) {
+            permissions.add(permission);
+        }
+    }
+    return Array.from(permissions);
+}
+/**
+ * A list of roles with a unified `hasPermission` check across them.
+ */
+export class RoleList {
+    roles;
+    constructor(roles) {
+        this.roles = roles;
+    }
+    static fromRoleNames(roleNames) {
+        const roles = roleNames.map((r) => getRoleByName(r));
+        return new RoleList(roles);
+    }
+    static fromRoleName(roleName) {
+        const roles = [getRoleByName(roleName)];
+        return new RoleList(roles);
+    }
+    hasPermission(perm) {
+        return this.roles.some((role) => role.hasPermission(perm));
+    }
+}
+//# sourceMappingURL=index.js.map

package/lib/roles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAiC,UAAU,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAsB,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,GAAoB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAExE,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,IAAY;IACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS;IACrB,MAAM,MAAM,GAAW,EAAE,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAChD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAgB;IAClD,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC3B,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC;AAC/E,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe;IAC3B,OAAO,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAA2B;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,QAAQ;IACmB;IAApC,YAAoC,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAErD,MAAM,CAAC,aAAa,CAAC,SAAmB;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,QAAgB;QAChC,MAAM,KAAK,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,aAAa,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;CACJ"}

package/lib/roles/system.d.ts

@@ -0,0 +1,3 @@
+import { type RolePartition } from './classes.js';
+export declare const systemPartition: RolePartition;
+//# sourceMappingURL=system.d.ts.map

package/lib/roles/system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../src/roles/system.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,aAAa,EAAc,MAAM,cAAc,CAAC;AAuMzE,eAAO,MAAM,eAAe,EAAE,aAG7B,CAAC"}