@via-profit/ability 3.6.5 → 3.7.3

package/dist/index.js

@@ -1,3344 +1 @@
-function brand$4(code) {
-    return code;
-}
-const AbilityCompare = {
-    or: brand$4('or'),
-    and: brand$4('and'),
-};
-
-class AbilityError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'AbilityError';
-        if (Error.captureStackTrace) {
-            Error.captureStackTrace(this, this.constructor);
-        }
-    }
-}
-class AbilityParserError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'AbilityParserError';
-        if (Error.captureStackTrace) {
-            Error.captureStackTrace(this, this.constructor);
-        }
-    }
-}
-
-function brand$3(code) {
-    return code;
-}
-const AbilityCondition = {
-    equals: brand$3('='),
-    not_equals: brand$3('<>'),
-    greater_than: brand$3('>'),
-    less_than: brand$3('<'),
-    less_or_equal: brand$3('<='),
-    greater_or_equal: brand$3('>='),
-    in: brand$3('in'),
-    not_in: brand$3('not in'),
-    contains: brand$3('contains'),
-    not_contains: brand$3('not contains'),
-    length_greater_than: brand$3('length greater than'),
-    length_less_than: brand$3('length less than'),
-    length_equals: brand$3('length equals'),
-    always: brand$3('always'),
-    never: brand$3('never'),
-};
-function fromLiteral(literal) {
-    const map = {
-        equals: AbilityCondition.equals,
-        not_equals: AbilityCondition.not_equals,
-        greater_than: AbilityCondition.greater_than,
-        less_than: AbilityCondition.less_than,
-        less_or_equal: AbilityCondition.less_or_equal,
-        greater_or_equal: AbilityCondition.greater_or_equal,
-        in: AbilityCondition.in,
-        not_in: AbilityCondition.not_in,
-        contains: AbilityCondition.contains,
-        not_contains: AbilityCondition.not_contains,
-        length_greater_than: AbilityCondition.length_greater_than,
-        length_less_than: AbilityCondition.length_less_than,
-        length_equals: AbilityCondition.length_equals,
-        always: AbilityCondition.always,
-        never: AbilityCondition.never,
-    };
-    const value = map[literal];
-    if (!value) {
-        const expected = Object.keys(map).join(', ');
-        throw new AbilityParserError(`Literal "${literal}" does not found in AbilityCondition. Expected one of: ${expected}`);
-    }
-    return value;
-}
-function toLiteral(cond) {
-    switch (cond) {
-        case AbilityCondition.equals:
-            return 'equals';
-        case AbilityCondition.not_equals:
-            return 'not_equals';
-        case AbilityCondition.greater_than:
-            return 'greater_than';
-        case AbilityCondition.less_than:
-            return 'less_than';
-        case AbilityCondition.less_or_equal:
-            return 'less_or_equal';
-        case AbilityCondition.greater_or_equal:
-            return 'greater_or_equal';
-        case AbilityCondition.in:
-            return 'in';
-        case AbilityCondition.not_in:
-            return 'not_in';
-        case AbilityCondition.contains:
-            return 'contains';
-        case AbilityCondition.not_contains:
-            return 'not_contains';
-        case AbilityCondition.length_greater_than:
-            return 'length_greater_than';
-        case AbilityCondition.length_less_than:
-            return 'length_less_than';
-        case AbilityCondition.length_equals:
-            return 'length_equals';
-        case AbilityCondition.always:
-            return 'always';
-        case AbilityCondition.never:
-            return 'never';
-        default:
-            return 'never';
-    }
-}
-function isConditionEqual(a, b) {
-    return a !== null && b !== null && a === b;
-}
-function isConditionNotEqual(a, b) {
-    return !isConditionEqual(a, b);
-}
-
-function brand$2(code) {
-    return code;
-}
-const AbilityMatch = {
-    pending: brand$2('pending'),
-    match: brand$2('match'),
-    mismatch: brand$2('mismatch'),
-    exceptMismatch: brand$2('except-mismatch'),
-    disabled: brand$2('disabled'),
-};
-
-const colors = {
-    reset: '\x1b[0m',
-    green: '\x1b[32m',
-    red: '\x1b[31m',
-    blue: '\x1b[34m',
-    yellow: '\x1b[33m',
-    white: '\x1b[37m',
-    gray: '\x1b[90m',
-};
-class AbilityExplain {
-    type;
-    children;
-    name;
-    match;
-    debugInfo;
-    constructor(config, children = []) {
-        this.type = config.type;
-        this.children = children;
-        this.name = config.name;
-        this.match = config.match;
-        this.debugInfo = config.debugInfo;
-    }
-    toString(indentPrefix = '', isLast = true) {
-        const isMatch = this.match === AbilityMatch.match;
-        const mark = isMatch ? `${colors.green}✓${colors.reset}` : `${colors.red}✗${colors.reset}`;
-        let label;
-        switch (this.type) {
-            case 'policy':
-                label = `${colors.blue}POLICY${colors.reset}`;
-                break;
-            case 'ruleSet':
-                label = `${colors.yellow}RULESET${colors.reset}`;
-                break;
-            default:
-                label = `${colors.white}RULE${colors.reset}`;
-        }
-        const branch = indentPrefix.length === 0
-            ? ''
-            : isLast
-                ? `${colors.gray}└─${colors.reset} `
-                : `${colors.gray}├─${colors.reset} `;
-        let out = `${indentPrefix}${branch}${label} ${this.name} — ${mark}`;
-        if (this.debugInfo)
-            out += ` ${colors.gray}(${this.debugInfo})${colors.reset}`;
-        const nextIndent = indentPrefix + (isLast ? '   ' : `${colors.gray}│  ${colors.reset}`);
-        this.children.forEach((child, idx) => {
-            out += '\n' + child.toString(nextIndent, idx === this.children.length - 1);
-        });
-        return out;
-    }
-}
-class AbilityExplainRule extends AbilityExplain {
-    constructor(rule) {
-        super({
-            type: 'rule',
-            match: rule.state,
-            name: rule.name,
-        });
-    }
-}
-class AbilityExplainRuleSet extends AbilityExplain {
-    constructor(ruleSet) {
-        const children = ruleSet.rules.map(rule => new AbilityExplainRule(rule));
-        super({
-            type: 'ruleSet',
-            match: ruleSet.state,
-            name: ruleSet.name,
-        }, children);
-    }
-}
-class AbilityExplainPolicy extends AbilityExplain {
-    constructor(policy) {
-        const children = policy.ruleSet.map(ruleSet => new AbilityExplainRuleSet(ruleSet));
-        super({
-            type: 'policy',
-            name: policy.priority > -1 ? `@priority ${policy.priority} ${policy.name}` : policy.name,
-            match: policy.matchState,
-        }, children);
-    }
-}
-
-class AbilityResult {
-    effect;
-    strategy;
-    constructor(effect, strategy) {
-        this.effect = effect;
-        this.strategy = strategy;
-    }
-    /**
-     * Returns a list of explanations for each policy involved in the ability evaluation.
-     * Each item describes how a specific policy contributed to the final permission result.
-     *
-     * Useful for debugging, logging, or building UI tools that visualize permission logic.
-     */
-    explain() {
-        return this.strategy.policies
-            .map(policy => {
-            return new AbilityExplainPolicy(policy).toString();
-        })
-            .join('\n');
-    }
-    decisive() {
-        return this.strategy.decisivePolicy();
-    }
-    explainDecisive() {
-        const policy = this.decisive();
-        if (!policy) {
-            return null;
-        }
-        return new AbilityExplainPolicy(policy).toString();
-    }
-    isAllowed = () => {
-        return this.strategy.isAllowed();
-    };
-    isDenied = () => {
-        return this.strategy.isDenied();
-    };
-}
-
-class AbilityResolver {
-    StrategyClass;
-    policyEntries;
-    constructor(
-    /**
-     * `Important!` The incorrect Resources type was intentionally passed to AbilityPolicy so that TypeScript could suggest the name of the permission and the structure of its resource in the parse method.
-     */
-    policyOrListOfPolicies, strategy, options = {}) {
-        const policies = this.toArray(policyOrListOfPolicies);
-        const filtered = options.tags
-            ? policies.filter(p => p.tags.some(tag => options.tags.includes(tag)))
-            : policies;
-        const sorted = [...filtered].sort((a, b) => b.priority - a.priority);
-        this.policyEntries = sorted.map(policy => ({
-            policy,
-            normalizedPermission: AbilityResolver.normalizePermission(policy.permission),
-            segments: AbilityResolver.normalizePermission(policy.permission).split('.'),
-        }));
-        this.StrategyClass = strategy;
-    }
-    /**
-     * Resolve policy for the resource and permission key
-     *
-     * @param permission - Permission key
-     * @param resource - Resource
-     * @param environment
-     */
-    resolve(permission, resource, environment) {
-        const inputNormalized = AbilityResolver.normalizePermission(String(permission));
-        const inputSegments = inputNormalized.split('.');
-        const filteredPolicies = this.policyEntries
-            .filter(entry => AbilityResolver.matchPermissions(entry.segments, inputSegments))
-            .map(entry => entry.policy);
-        // 2. check the policies
-        for (const policy of filteredPolicies) {
-            if (policy.disabled) {
-                continue;
-            }
-            const policyMatchState = policy.check(resource, environment);
-            if (policyMatchState === AbilityMatch.pending) {
-                throw new AbilityError(`The policy "${policy.name}" is still in a pending state. Make sure to call "check" to evaluate the policy before resolving permissions.`);
-            }
-        }
-        // 3. Use strategy
-        const strategy = new this.StrategyClass(filteredPolicies);
-        const effect = strategy.evaluate();
-        return new AbilityResult(effect, strategy);
-    }
-    enforce(permission, resource, environment) {
-        const result = this.resolve(permission, resource, environment);
-        if (result.isDenied()) {
-            throw new AbilityError(`Permission denied`);
-        }
-    }
-    /**
-     * @deprecated - will be removed
-     *
-     * Check if the permission key is contained in another permission key
-     * @param permissionA - The first permission to check
-     * @param permissionB - The second permission to check
-     */
-    static isInPermissionContain(permissionA, permissionB) {
-        const A = permissionA.split('.');
-        const B = permissionB.split('.');
-        const [longer, shorter] = A.length >= B.length ? [A, B] : [B, A];
-        return shorter.every((chunk, i) => {
-            return chunk === '*' || longer[i] === '*' || chunk === longer[i];
-        });
-    }
-    toArray(value) {
-        return [...(Array.isArray(value) ? value : [value])];
-    }
-    static normalizePermission(permission) {
-        return permission
-            .trim()
-            .replace(/^permission\./, '') // remove prefix
-            .replace(/\.+/g, '.') // collapse multiple dots
-            .toLowerCase(); // optional: make case-insensitive
-    }
-    static matchPermissions(policySegments, inputSegments) {
-        let i = 0;
-        for (; i < policySegments.length; i++) {
-            const pSeg = policySegments[i];
-            const iSeg = inputSegments[i];
-            // '*' — глобальный wildcard: матчим всё, что дальше
-            if (pSeg === '*') {
-                return true;
-            }
-            // input закончился раньше — mismatch
-            if (iSeg === undefined) {
-                return false;
-            }
-            // обычное сравнение
-            if (pSeg !== iSeg) {
-                return false;
-            }
-        }
-        // Если политика закончилась, но input длиннее — match только если последний сегмент был '*'
-        return i === inputSegments.length;
-    }
-}
-
-class AbilityTypeGenerator {
-    policies;
-    policyEntries;
-    constructor(policies) {
-        this.policies = policies;
-        this.policyEntries = policies.map(policy => ({
-            policy,
-            normalizedPermission: AbilityResolver.normalizePermission(policy.permission),
-            segments: AbilityResolver.normalizePermission(policy.permission).split('.'),
-        }));
-    }
-    /**
-     * Generates TypeScript type definitions based on the provided policies.
-     * @returns A generated type definitions.
-     */
-    generateTypeDefs() {
-        // Structure to store types: { [action]: { [subjectPath]: type } }
-        const resorceStructure = {};
-        const environmentStructure = {};
-        // tags
-        const allTags = new Set();
-        // Iterate through all policies
-        this.policies.forEach(policy => {
-            policy.tags.forEach(tag => allTags.add(tag));
-            const action = policy.permission;
-            // Initialize object for action if it doesn't exist
-            if (!resorceStructure[action]) {
-                resorceStructure[action] = {};
-            }
-            // Iterate through all ruleSets in the policy
-            policy.ruleSet.forEach(ruleSet => {
-                // Iterate through all rules in the ruleSet
-                ruleSet.rules.forEach(rule => {
-                    const subjectPath = rule.subject;
-                    const ruleType = this.determineTypeFromRule(rule);
-                    if (!ruleType) {
-                        return;
-                    }
-                    // -----------------------------
-                    // ENVIRONMENT HANDLING (subject)
-                    // -----------------------------
-                    if (subjectPath.startsWith('env.')) {
-                        const envPath = subjectPath.replace(/^env\./, '');
-                        if (!environmentStructure[action]) {
-                            environmentStructure[action] = {};
-                        }
-                        environmentStructure[action][envPath] = ruleType;
-                    }
-                    else {
-                        const existingType = resorceStructure[action][subjectPath];
-                        if (existingType && existingType !== ruleType) {
-                            resorceStructure[action][subjectPath] = `${existingType} | ${ruleType}`;
-                        }
-                        else {
-                            resorceStructure[action][subjectPath] = ruleType;
-                        }
-                    }
-                    // -----------------------------
-                    // RESOURCE PATH HANDLING (right side)
-                    // -----------------------------
-                    if (typeof rule.resource === 'string' && this.isPath(rule.resource)) {
-                        const resourcePath = rule.resource;
-                        // env.* справа
-                        if (resourcePath.startsWith('env.')) {
-                            const envPath = resourcePath.replace(/^env\./, '');
-                            if (!environmentStructure[action]) {
-                                environmentStructure[action] = {};
-                            }
-                            const existingEnvType = environmentStructure[action][envPath];
-                            const targetType = ruleType; // или 'unknown', если хочешь жёстко
-                            if (existingEnvType && existingEnvType !== targetType) {
-                                environmentStructure[action][envPath] = `${existingEnvType} | ${targetType}`;
-                            }
-                            else {
-                                environmentStructure[action][envPath] = targetType;
-                            }
-                        }
-                        else {
-                            // обычный ресурс справа
-                            if (!resorceStructure[action]) {
-                                resorceStructure[action] = {};
-                            }
-                            const existingResType = resorceStructure[action][resourcePath];
-                            const targetType = ruleType; // или 'unknown'
-                            if (existingResType && existingResType !== targetType) {
-                                resorceStructure[action][resourcePath] = `${existingResType} | ${targetType}`;
-                            }
-                            else {
-                                resorceStructure[action][resourcePath] = targetType;
-                            }
-                        }
-                    }
-                });
-            });
-        });
-        const filteredStructure = {};
-        Object.entries(resorceStructure).forEach(([action, fields]) => {
-            if (!action.endsWith('.*')) {
-                filteredStructure[action] = fields;
-            }
-        });
-        // Transform flat structure into nested structure for easier use
-        const nestedStructure = this.buildNestedStructure(filteredStructure);
-        const nestedEnvironment = this.buildNestedStructure(environmentStructure);
-        return this.formatTypeDefinitions(nestedStructure, nestedEnvironment, allTags);
-    }
-    isPath(value) {
-        if (typeof value !== 'string') {
-            return false;
-        }
-        if (value.startsWith('"') || value.startsWith("'")) {
-            return false;
-        }
-        return value.includes('.');
-    }
-    /**
-     * Determines TypeScript type based on the rule
-     * @param rule - The rule to analyze
-     * @returns TypeScript type as string
-     */
-    determineTypeFromRule(rule) {
-        if (rule.condition === AbilityCondition.never || rule.condition === AbilityCondition.always) {
-            return null;
-        }
-        if (rule.condition === AbilityCondition.contains ||
-            rule.condition === AbilityCondition.not_contains) {
-            return this.getArrayType(rule.resource);
-        }
-        if (rule.condition === AbilityCondition.length_equals ||
-            rule.condition === AbilityCondition.length_greater_than ||
-            rule.condition === AbilityCondition.length_less_than) {
-            return 'string | readonly unknown[]';
-        }
-        // Numeric comparisons - always number
-        if (rule.condition === AbilityCondition.greater_than ||
-            rule.condition === AbilityCondition.greater_or_equal ||
-            rule.condition === AbilityCondition.less_than ||
-            rule.condition === AbilityCondition.less_or_equal) {
-            return 'number';
-        }
-        // Array operations
-        if (rule.condition === AbilityCondition.in || rule.condition === AbilityCondition.not_in) {
-            return this.getInArrayType(rule.resource);
-        }
-        // Equality/Inequality operations
-        if (rule.condition === AbilityCondition.equals ||
-            rule.condition === AbilityCondition.not_equals) {
-            return this.getPrimitiveType(rule.resource);
-        }
-        return 'any';
-    }
-    /**
-     * Gets TypeScript type for array values
-     * @param resource - The resource value to analyze
-     * @returns TypeScript array type as string
-     */
-    getArrayType(resource) {
-        const elementType = this.getInArrayType(resource);
-        return `readonly ${elementType}[]`;
-    }
-    getInArrayType(resource) {
-        if (Array.isArray(resource)) {
-            if (resource.length === 0) {
-                return 'unknown';
-            }
-            // Determine types of array elements
-            const elementTypes = new Set(resource.map(item => this.getPrimitiveType(item)));
-            return elementTypes.size === 1
-                ? Array.from(elementTypes)[0]
-                : `(${Array.from(elementTypes).join(' | ')})`;
-        }
-        // If resource is not an array but condition is in/not_in,
-        // it expects an array of such elements
-        return this.getPrimitiveType(resource);
-    }
-    /**
-     * Gets primitive TypeScript type for a value
-     * @param value - The value to analyze
-     * @returns TypeScript primitive type as string
-     */
-    getPrimitiveType(value) {
-        if (value === null) {
-            return 'null | unknown';
-        }
-        if (value === undefined) {
-            return 'undefined';
-        }
-        if (typeof value === 'string' && this.isPath(value)) {
-            // This is not a string literal, but a path to another field.
-            return 'unknown';
-        }
-        switch (typeof value) {
-            case 'string':
-                return 'string';
-            case 'number':
-                return 'number';
-            case 'boolean':
-                return 'boolean';
-            case 'object':
-                if (Array.isArray(value)) {
-                    return 'array'; // special marker, handled separately
-                }
-                return 'object';
-            default:
-                return 'any';
-        }
-    }
-    /**
-     * Builds nested structure from flat paths
-     * Example: 'user.profile.name' -> { user: { profile: { name: 'string' } } }
-     * @param flatStructure - Flat structure with dot notation paths
-     * @returns Nested object structure
-     */
-    buildNestedStructure(flatStructure) {
-        const result = {};
-        Object.entries(flatStructure).forEach(([action, paths]) => {
-            result[action] = {};
-            Object.entries(paths).forEach(([path, type]) => {
-                const parts = path.split('.');
-                let current = result[action];
-                // Iterate through all parts except the last one
-                for (let i = 0; i < parts.length - 1; i++) {
-                    const part = parts[i];
-                    const currentValue = current[part];
-                    if (!currentValue || typeof currentValue !== 'object') {
-                        const newObj = {};
-                        current[part] = newObj;
-                        current = newObj;
-                    }
-                    else {
-                        current = currentValue;
-                    }
-                }
-                // Set type for the last part
-                const lastPart = parts[parts.length - 1];
-                current[lastPart] = type;
-            });
-        });
-        return result;
-    }
-    /**
-     * Formats type structure into a string
-     * @param structure - Nested type structure
-     * @param environment
-     * @param allTags
-     * @returns Formatted TypeScript type definition string
-     */
-    formatTypeDefinitions(structure, environment, allTags) {
-        let output = '// Automatically generated by via-profit/ability\n';
-        output += '// Do not edit manually\n';
-        output += 'export type Resources = {\n';
-        const sortedActions = Object.keys(structure).sort();
-        sortedActions.forEach(permission => {
-            const actionObj = structure[permission];
-            const isEmpty = Object.keys(actionObj).length === 0;
-            const inputNormalized = AbilityResolver.normalizePermission(permission);
-            const inputSegments = inputNormalized.split('.');
-            const filteredPolicies = this.policyEntries
-                .filter(entry => AbilityResolver.matchPermissions(entry.segments, inputSegments))
-                .map(entry => entry.policy);
-            // Effects
-            const effects = [...new Set(filteredPolicies.map(p => p.effect))].sort();
-            // Policies list
-            const items = filteredPolicies
-                .sort((a, b) => a.id.localeCompare(b.id))
-                .map(p => {
-                const effect = p.effect.padEnd(6, ' '); // permit / deny / audit
-                const displayName = p.name === p.id ? 'Unnamed policy' : p.name;
-                return `  *   - ${effect} ${p.id}  "${displayName}"`;
-            })
-                .join('\n');
-            //
-            output += `
- /**
-  * Permission: ${permission}
-  * Effects: ${effects.join(', ')}
-  * Policies:
-${items}
-  */
-`;
-            if (isEmpty) {
-                // empty object → undefined
-                output += `  ['${permission}']: undefined;\n`;
-            }
-            else {
-                // not empty object
-                output += `  ['${permission}']: {\n`;
-                output += this.formatNestedObject(actionObj, 4);
-                output += '  } | null | undefined;\n';
-            }
-        });
-        output += '}\n';
-        // tags
-        const tagsUnion = allTags.size > 0
-            ? Array.from(allTags)
-                .sort()
-                .map(tag => `'${tag}'`)
-                .join(' | ')
-            : 'never';
-        output += `\n\nexport type PolicyTags = ${tagsUnion};\n`;
-        // environments
-        output += '\n\nexport type Environment = {\n';
-        Object.entries(environment).forEach(([permission, envObj]) => {
-            const isEmpty = Object.keys(envObj).length === 0;
-            const inputNormalized = AbilityResolver.normalizePermission(permission);
-            const inputSegments = inputNormalized.split('.');
-            const filteredPolicies = this.policyEntries
-                .filter(entry => AbilityResolver.matchPermissions(entry.segments, inputSegments))
-                .map(entry => entry.policy);
-            const effects = [...new Set(filteredPolicies.map(p => p.effect))].sort();
-            const items = filteredPolicies
-                .sort((a, b) => a.id.localeCompare(b.id))
-                .map(p => {
-                const effect = p.effect.padEnd(6, ' ');
-                const displayName = p.name === p.id ? 'Unnamed policy' : p.name;
-                return `  *   - ${effect} ${p.id}  "${displayName}"`;
-            })
-                .join('\n');
-            output += `
- /**
-  * Permission: ${permission}
-  * Effects: ${effects.join(', ')}
-  * Policies:
-${items}
-  */
-`;
-            if (isEmpty) {
-                output += `  ['${permission}']: undefined;\n`;
-            }
-            else {
-                output += `  ['${permission}']: {\n`;
-                output += this.formatNestedObject(envObj, 4);
-                output += '  } | null | undefined;\n';
-            }
-        });
-        output += '}\n';
-        // complex
-        return output;
-    }
-    /**
-     * Recursively formats nested object
-     * @param obj - Object to format
-     * @param indent - Current indentation level
-     * @returns Formatted string
-     */
-    formatNestedObject(obj, indent) {
-        const spaces = ' '.repeat(indent);
-        let output = '';
-        // Sort keys for stable output
-        const sortedKeys = Object.keys(obj).sort();
-        sortedKeys.forEach(key => {
-            const value = obj[key];
-            if (typeof value === 'object' && value !== null) {
-                // Nested object
-                output += `${spaces}readonly ${key}: {\n`;
-                output += this.formatNestedObject(value, indent + 2);
-                output += `${spaces}} | null | undefined;\n`;
-            }
-            else {
-                // Primitive type
-                const va = [String(value)];
-                let v = String(value);
-                if (!v.match(/unknown/)) {
-                    if (!v.match(/null/)) {
-                        va.push('null');
-                    }
-                    if (!v.match(/undefined/)) {
-                        va.push('undefined');
-                    }
-                }
-                output += `${spaces}readonly ${key}: ${va.join(' | ')} \n`;
-            }
-        });
-        return output;
-    }
-}
-
-class AbilityHash {
-    static sha1(message) {
-        const msgBytes = AbilityHash.stringToBytes(message);
-        const msgBitLength = msgBytes.length * 8;
-        const withOne = new Uint8Array(msgBytes.length + 1);
-        withOne.set(msgBytes, 0);
-        withOne[msgBytes.length] = 0x80;
-        let zeroBytes = (56 - (withOne.length % 64) + 64) % 64;
-        const padded = new Uint8Array(withOne.length + zeroBytes + 8);
-        padded.set(withOne, 0);
-        const bitLenHigh = Math.floor(msgBitLength / 0x100000000);
-        const bitLenLow = msgBitLength >>> 0;
-        padded[padded.length - 8] = (bitLenHigh >>> 24) & 0xff;
-        padded[padded.length - 7] = (bitLenHigh >>> 16) & 0xff;
-        padded[padded.length - 6] = (bitLenHigh >>> 8) & 0xff;
-        padded[padded.length - 5] = bitLenHigh & 0xff;
-        padded[padded.length - 4] = (bitLenLow >>> 24) & 0xff;
-        padded[padded.length - 3] = (bitLenLow >>> 16) & 0xff;
-        padded[padded.length - 2] = (bitLenLow >>> 8) & 0xff;
-        padded[padded.length - 1] = bitLenLow & 0xff;
-        let h0 = 0x67452301;
-        let h1 = 0xefcdab89;
-        let h2 = 0x98badcfe;
-        let h3 = 0x10325476;
-        let h4 = 0xc3d2e1f0;
-        const w = new Array(80);
-        for (let i = 0; i < padded.length; i += 64) {
-            for (let j = 0; j < 16; j++) {
-                const idx = i + j * 4;
-                w[j] =
-                    (padded[idx] << 24) | (padded[idx + 1] << 16) | (padded[idx + 2] << 8) | padded[idx + 3];
-            }
-            for (let j = 16; j < 80; j++) {
-                w[j] = AbilityHash.leftRotate(w[j - 3] ^ w[j - 8] ^ w[j - 14] ^ w[j - 16], 1);
-            }
-            let a = h0;
-            let b = h1;
-            let c = h2;
-            let d = h3;
-            let e = h4;
-            for (let j = 0; j < 80; j++) {
-                let f;
-                let k;
-                if (j < 20) {
-                    f = (b & c) | (~b & d);
-                    k = 0x5a827999;
-                }
-                else {
-                    if (j < 40) {
-                        f = b ^ c ^ d;
-                        k = 0x6ed9eba1;
-                    }
-                    else {
-                        if (j < 60) {
-                            f = (b & c) | (b & d) | (c & d);
-                            k = 0x8f1bbcdc;
-                        }
-                        else {
-                            f = b ^ c ^ d;
-                            k = 0xca62c1d6;
-                        }
-                    }
-                }
-                const temp = (AbilityHash.leftRotate(a, 5) + f + e + k + (w[j] | 0)) | 0;
-                e = d;
-                d = c;
-                c = AbilityHash.leftRotate(b, 30);
-                b = a;
-                a = temp;
-            }
-            h0 = (h0 + a) | 0;
-            h1 = (h1 + b) | 0;
-            h2 = (h2 + c) | 0;
-            h3 = (h3 + d) | 0;
-            h4 = (h4 + e) | 0;
-        }
-        return [
-            AbilityHash.toHex32(h0),
-            AbilityHash.toHex32(h1),
-            AbilityHash.toHex32(h2),
-            AbilityHash.toHex32(h3),
-            AbilityHash.toHex32(h4),
-        ].join('');
-    }
-    static leftRotate(value, bits) {
-        return ((value << bits) | (value >>> (32 - bits))) >>> 0;
-    }
-    static toHex32(num) {
-        return (num >>> 0).toString(16).padStart(8, '0');
-    }
-    static stringToBytes(str) {
-        if (typeof TextEncoder !== 'undefined') {
-            const encoder = new TextEncoder();
-            return encoder.encode(str);
-        }
-        else {
-            const buf = Buffer.from(str, 'utf8');
-            return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-        }
-    }
-}
-
-class AbilityPolicy {
-    matchState = AbilityMatch.pending;
-    /**
-     * List of rules
-     */
-    ruleSet = [];
-    /**
-     * Policy effect
-     */
-    effect;
-    /**
-     * Rules compare method.\
-     * For the «and» method the rule will be permitted if all\
-     * rules will be returns «permit» status and for the «or» - if\
-     * one of the rules returns as «permit»
-     */
-    compareMethod = AbilityCompare.and;
-    /**
-     * Policy ID
-     */
-    id;
-    /**
-     * Policy name
-     */
-    name;
-    description;
-    /**
-     * Running the `enforce` or `resolve` method
-     * will select only those from all passed policies that fall under the specified permission key.
-     */
-    permission;
-    priority = -1;
-    disabled;
-    tags;
-    constructor(params) {
-        const { name, description, id, permission, effect, compareMethod = AbilityCompare.and, priority, disabled, tags, } = params;
-        this.permission = permission;
-        this.description = description;
-        this.effect = effect;
-        this.compareMethod = compareMethod;
-        this.priority = typeof priority === 'number' ? priority : -1;
-        this.disabled = typeof disabled === 'boolean' ? disabled : false;
-        this.tags = (tags || []);
-        this.id = id || `p_${this.hash().slice(0, 10)}`;
-        this.name = name || this.id;
-    }
-    /**
-     * Add rule set to the policy
-     * @param ruleSet - The rule set to add
-     */
-    addRuleSet(ruleSet) {
-        this.ruleSet.push(ruleSet);
-        return this;
-    }
-    /**
-     * Add rule set to the policy
-     * @param ruleSets - The array of rule set to add
-     */
-    addRuleSets(ruleSets) {
-        for (const ruleSet of ruleSets) {
-            this.ruleSet.push(ruleSet);
-        }
-        return this;
-    }
-    /**
-     * Extract all rules of all ruleSets of this policy
-     */
-    extractRules() {
-        const rules = [];
-        for (const ruleSet of this.ruleSet) {
-            for (const rule of ruleSet.rules) {
-                rules.push(rule);
-            }
-        }
-        return rules;
-    }
-    /**
-     * Check if the policy is matched
-     * @param resource - The resource to check
-     * @param environment - The user environment object
-     */
-    check(resource, environment) {
-        this.matchState = AbilityMatch.mismatch;
-        if (this.disabled) {
-            this.matchState = AbilityMatch.disabled;
-            return this.matchState;
-        }
-        if (!this.ruleSet.length) {
-            return this.matchState;
-        }
-        const normalGroups = this.ruleSet.filter(g => !g.isExcept);
-        const exceptGroups = this.ruleSet.filter(g => g.isExcept);
-        const normalStates = [];
-        for (const group of normalGroups) {
-            if (group.disabled) {
-                continue;
-            }
-            const state = group.check(resource, environment);
-            normalStates.push(state);
-            if (AbilityCompare.and === this.compareMethod && AbilityMatch.mismatch === state) {
-                this.matchState = AbilityMatch.mismatch;
-                return this.matchState;
-            }
-            if (AbilityCompare.or === this.compareMethod && AbilityMatch.match === state) {
-                this.matchState = AbilityMatch.match;
-                // break to check except-rule sets
-                break;
-            }
-        }
-        // 3. Simple rule sets
-        let normalMatch = false;
-        if (AbilityCompare.and === this.compareMethod) {
-            normalMatch = normalStates.every(s => AbilityMatch.match === s);
-        }
-        else {
-            normalMatch = normalStates.some(s => AbilityMatch.match === s);
-        }
-        if (!normalMatch) {
-            this.matchState = AbilityMatch.mismatch;
-            return this.matchState;
-        }
-        // 4. except-rule sets
-        for (const group of exceptGroups) {
-            if (group.disabled) {
-                continue;
-            }
-            const state = group.check(resource, environment);
-            if (AbilityMatch.match === state) {
-                this.matchState = AbilityMatch.exceptMismatch;
-                return this.matchState;
-            }
-        }
-        // 5. match
-        this.matchState = AbilityMatch.match;
-        return this.matchState;
-    }
-    explain() {
-        if (this.matchState === AbilityMatch.pending) {
-            throw new AbilityError('First, run the check method, then explain');
-        }
-        return new AbilityExplainPolicy(this);
-    }
-    copyWith(props) {
-        const policy = new AbilityPolicy({
-            id: props.id ?? this.id,
-            name: props.name ?? this.name,
-            description: props.description ?? this.description,
-            priority: typeof props.priority !== 'undefined' ? props.priority : this.priority,
-            permission: props.permission ?? this.permission,
-            effect: props.effect ?? this.effect,
-            compareMethod: props.compareMethod ?? this.compareMethod,
-        });
-        const nextRuleSet = props.ruleSet ?? this.ruleSet;
-        for (const rule of nextRuleSet) {
-            policy.addRuleSet(rule);
-        }
-        return policy;
-    }
-    hash() {
-        const parts = [
-            `permission:${this.permission}`,
-            `effect:${this.effect}`,
-            `compareMethod:${this.compareMethod}`,
-            `priority:${this.priority}`,
-            `disabled:${this.disabled}`,
-        ];
-        if (this.tags && this.tags.length > 0) {
-            parts.push(`tags:${[...this.tags].sort().join(',')}`);
-        }
-        if (this.ruleSet && this.ruleSet.length > 0) {
-            const ruleHashes = this.ruleSet.map(r => r.hash());
-            parts.push(`rules:${ruleHashes.sort().join('|')}`);
-        }
-        const str = parts.join(';');
-        return AbilityHash.sha1(str);
-    }
-}
-
-function brand$1(code) {
-    return code;
-}
-const AbilityPolicyEffect = {
-    deny: brand$1('deny'),
-    permit: brand$1('permit'),
-};
-
-/**
- * Represents a rule that defines a condition to be checked against a subject and resource.
- */
-class AbilityRule {
-    /**
-     * Subject key path like a 'user.name'
-     */
-    subject;
-    /**
-     * Resource key path like a 'user.name' or value
-     */
-    resource;
-    condition;
-    name;
-    description;
-    id;
-    state = AbilityMatch.pending;
-    disabled;
-    /**
-     * Creates an instance of AbilityRule.
-     * @param {string} params.id - The unique identifier of the rule.
-     * @param {string} params.name - The name of the rule.
-     * @param {AbilityCondition} params.condition - The condition to evaluate.
-     * @param {string} params.subject - The subject of the rule.
-     * @param {string} params.resource - The resource to compare against.
-     * @param {boolean} params.disabled - Disabling flag.
-     * @param params
-     */
-    constructor(params) {
-        const { id, name, subject, resource, condition, disabled, description } = params;
-        this.description = description;
-        this.disabled = typeof disabled === 'boolean' ? disabled : false;
-        this.subject = subject;
-        this.resource = resource;
-        this.condition = condition;
-        this.state = this.disabled ? AbilityMatch.disabled : this.state;
-        this.id = id || `r_${this.hash().slice(0, 10)}`;
-        this.name = name || this.id;
-    }
-    static isPrimitive(v) {
-        return typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean' || v === null;
-    }
-    static isNumber(v) {
-        return typeof v === 'number';
-    }
-    static isString(v) {
-        return typeof v === 'string';
-    }
-    static valueLen = (v) => this.isString(v) || Array.isArray(v) ? v.length : null;
-    static operatorHandlers = {
-        [toLiteral(AbilityCondition.always)]: () => true,
-        [toLiteral(AbilityCondition.never)]: () => false,
-        [toLiteral(AbilityCondition.equals)]: (a, b) => a === b,
-        [toLiteral(AbilityCondition.not_equals)]: (a, b) => a !== b,
-        [toLiteral(AbilityCondition.contains)]: (a, b) => {
-            if (Array.isArray(a) && AbilityRule.isPrimitive(b)) {
-                return a.includes(b);
-            }
-            if (Array.isArray(a) && Array.isArray(b)) {
-                return a.some(v => b.includes(v));
-            }
-            return false;
-        },
-        [toLiteral(AbilityCondition.not_contains)]: (a, b) => {
-            if (Array.isArray(a) && AbilityRule.isPrimitive(b)) {
-                return !a.includes(b);
-            }
-            if (Array.isArray(a) && Array.isArray(b)) {
-                return !a.some(v => b.includes(v));
-            }
-            return false;
-        },
-        [toLiteral(AbilityCondition.in)]: (a, b) => {
-            if (AbilityRule.isPrimitive(a) && Array.isArray(b)) {
-                return b.includes(a);
-            }
-            if (Array.isArray(a) && Array.isArray(b)) {
-                return a.some(v => b.includes(v));
-            }
-            return false;
-        },
-        [toLiteral(AbilityCondition.not_in)]: (a, b) => {
-            if (AbilityRule.isPrimitive(a) && Array.isArray(b)) {
-                return !b.includes(a);
-            }
-            if (Array.isArray(a) && Array.isArray(b)) {
-                return !a.some(v => b.includes(v));
-            }
-            return false;
-        },
-        [toLiteral(AbilityCondition.greater_than)]: (a, b) => {
-            return AbilityRule.isNumber(a) && AbilityRule.isNumber(b) ? a > b : false;
-        },
-        [toLiteral(AbilityCondition.less_than)]: (a, b) => {
-            return AbilityRule.isNumber(a) && AbilityRule.isNumber(b) ? a < b : false;
-        },
-        [toLiteral(AbilityCondition.greater_or_equal)]: (a, b) => {
-            return AbilityRule.isNumber(a) && AbilityRule.isNumber(b) ? a >= b : false;
-        },
-        [toLiteral(AbilityCondition.less_or_equal)]: (a, b) => {
-            return AbilityRule.isNumber(a) && AbilityRule.isNumber(b) ? a <= b : false;
-        },
-        [toLiteral(AbilityCondition.length_greater_than)]: (a, b) => {
-            const alen = AbilityRule.valueLen(a);
-            if (alen === null) {
-                return false;
-            }
-            if (AbilityRule.isNumber(b)) {
-                return alen > b;
-            }
-            const bLen = AbilityRule.valueLen(b);
-            if (bLen !== null) {
-                return alen > bLen;
-            }
-            return false;
-        },
-        [toLiteral(AbilityCondition.length_less_than)]: (a, b) => {
-            const alen = AbilityRule.valueLen(a);
-            if (alen === null) {
-                return false;
-            }
-            if (AbilityRule.isNumber(b)) {
-                return alen < b;
-            }
-            const bLen = AbilityRule.valueLen(b);
-            if (bLen !== null) {
-                return alen < bLen;
-            }
-            return false;
-        },
-        [toLiteral(AbilityCondition.length_equals)]: (a, b) => {
-            const alen = AbilityRule.valueLen(a);
-            if (alen === null) {
-                return false;
-            }
-            if (AbilityRule.isNumber(b)) {
-                return alen === b;
-            }
-            const bLen = AbilityRule.valueLen(b);
-            if (bLen !== null) {
-                return alen === bLen;
-            }
-            return false;
-        },
-    };
-    /**
-     * Check if the rule is matched
-     * @param resource - The resource to check
-     * @param environment
-     */
-    check(resource, environment) {
-        if (this.disabled) {
-            this.state = AbilityMatch.disabled;
-            return this.state;
-        }
-        const [subjectValue, resourceValue] = this.extractValues(resource, environment);
-        const handler = AbilityRule.operatorHandlers[toLiteral(this.condition)];
-        const result = handler(subjectValue, resourceValue);
-        this.state = result ? AbilityMatch.match : AbilityMatch.mismatch;
-        return this.state;
-    }
-    /**
-     * Extract values from the resourceData
-     * @param resourceData - The resourceData to extract values from
-     * @param environment - Environment data
-     */
-    extractValues(resourceData, environment) {
-        let subjectValue;
-        let resourceValue;
-        if ((resourceData === null || typeof resourceData === 'undefined') &&
-            (environment === null || typeof environment === 'undefined')) {
-            return [NaN, NaN];
-        }
-        // left side resolve
-        if (this.subject.includes('.')) {
-            // if is environment
-            if (this.subject.startsWith('env.') && typeof environment !== 'undefined') {
-                subjectValue = this.getDotNotationValue(environment, this.subject.replace(/^env\./, ''));
-                // if is resource
-            }
-            else {
-                subjectValue = this.getDotNotationValue(resourceData, this.subject);
-            }
-        }
-        else {
-            subjectValue = this.subject;
-        }
-        // right side resolve
-        if (typeof this.resource === 'string' && this.resource.includes('.')) {
-            // if is environment
-            if (this.resource.startsWith('env.') && typeof environment !== 'undefined') {
-                resourceValue = this.getDotNotationValue(environment, this.resource.replace(/^env\./, ''));
-            }
-            else {
-                // if is resource
-                resourceValue = this.getDotNotationValue(resourceData, this.resource);
-            }
-        }
-        else {
-            resourceValue = this.resource;
-        }
-        return [subjectValue, resourceValue];
-    }
-    static _pathCache = new Map();
-    static _parsePath(desc) {
-        const cached = AbilityRule._pathCache.get(desc);
-        if (cached)
-            return cached;
-        const parts = desc.split('.');
-        const segments = [];
-        for (const part of parts) {
-            const bracketIdx = part.indexOf('[');
-            if (bracketIdx !== -1) {
-                // формат: "prop[index]" (индекс может быть только числом)
-                const prop = part.slice(0, bracketIdx);
-                const indexStr = part.slice(bracketIdx + 1, -1);
-                const index = Number(indexStr);
-                segments.push({ prop, index });
-            }
-            else {
-                segments.push(part);
-            }
-        }
-        AbilityRule._pathCache.set(desc, segments);
-        return segments;
-    }
-    /**
-     * Get the value of the object by dot notation
-     * @param resource - The object to get the value from
-     * @param desc - The dot notation string
-     */
-    getDotNotationValue(resource, desc) {
-        if (resource == null) {
-            return undefined;
-        }
-        const segments = AbilityRule._parsePath(desc);
-        let current = resource;
-        for (const seg of segments) {
-            if (current == null) {
-                return undefined;
-            }
-            if (typeof seg === 'string') {
-                current = current[seg];
-            }
-            else {
-                const arr = current[seg.prop];
-                current = Array.isArray(arr) ? arr[seg.index] : undefined;
-            }
-        }
-        return current;
-    }
-    toString() {
-        return `AbilityRule: ${this.name} condition: ${toLiteral(this.condition)} subject: "${this.subject?.toString()}" resource: "${this.resource?.toString()}"`;
-    }
-    copyWith(props) {
-        return new AbilityRule({
-            id: props.id ?? this.id,
-            name: props.name ?? this.name,
-            description: props.description ?? this.description,
-            subject: props.subject ?? this.subject,
-            resource: props.resource ?? this.resource,
-            condition: props.condition ?? this.condition,
-        });
-    }
-    hash() {
-        const parts = [];
-        parts.push(`subject:${this.subject}`);
-        parts.push(`resource:${JSON.stringify(this.resource)}`);
-        parts.push(`condition:${this.condition}`);
-        parts.push(`disabled:${this.disabled}`);
-        return AbilityHash.sha1(parts.join(';'));
-    }
-    static equals(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.equals,
-            subject,
-            resource,
-        });
-    }
-    static notEquals(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.not_equals,
-            subject,
-            resource,
-        });
-    }
-    static contains(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.contains,
-            subject,
-            resource,
-        });
-    }
-    static notContains(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.not_contains,
-            subject,
-            resource,
-        });
-    }
-    static notIn(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.not_in,
-            subject,
-            resource,
-        });
-    }
-    static in(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.in,
-            subject,
-            resource,
-        });
-    }
-    static notEqual(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.not_equals,
-            subject,
-            resource,
-        });
-    }
-    static lessThan(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.less_than,
-            subject,
-            resource,
-        });
-    }
-    static lessOrEqual(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.less_or_equal,
-            subject,
-            resource,
-        });
-    }
-    static moreThan(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.greater_than,
-            subject,
-            resource,
-        });
-    }
-    static moreOrEqual(subject, resource) {
-        return new AbilityRule({
-            condition: AbilityCondition.greater_or_equal,
-            subject,
-            resource,
-        });
-    }
-}
-
-class AbilityRuleSet {
-    state = AbilityMatch.pending;
-    /**
-     * List of rules
-     */
-    rules = [];
-    /**
-     * Rules compare method.\
-     * For the «and» method the rule will be permitted if all\
-     * rules will be returns «permit» status and for the «or» - if\
-     * one of the rules returns as «permit»
-     */
-    compareMethod = AbilityCompare.and;
-    /**
-     * Group name
-     */
-    name;
-    description;
-    /**
-     * Group ID
-     */
-    id;
-    isExcept = false;
-    disabled;
-    constructor(params) {
-        const { name, id, compareMethod, isExcept, disabled, description } = params;
-        this.description = description;
-        this.compareMethod = compareMethod;
-        this.isExcept = isExcept;
-        this.disabled = typeof disabled === 'boolean' ? disabled : false;
-        this.state = this.disabled ? AbilityMatch.disabled : this.state;
-        this.id = id || `g_${this.hash().slice(0, 10)}`;
-        this.name = name || this.id;
-    }
-    addRule(rule) {
-        this.rules.push(rule);
-        return this;
-    }
-    addRules(rules) {
-        rules.forEach(rule => this.addRule(rule));
-        return this;
-    }
-    check(resources, environment) {
-        this.state = AbilityMatch.mismatch;
-        if (this.disabled) {
-            this.state = AbilityMatch.disabled;
-            return this.state;
-        }
-        if (!this.rules.length) {
-            return this.state;
-        }
-        const ruleCheckStates = [];
-        for (const rule of this.rules) {
-            if (rule.disabled) {
-                continue;
-            }
-            const state = rule.check(resources, environment);
-            ruleCheckStates.push(state);
-            if (AbilityCompare.and === this.compareMethod && AbilityMatch.mismatch === state) {
-                return this.state; // mismatch
-            }
-            if (AbilityCompare.or === this.compareMethod && AbilityMatch.match === state) {
-                this.state = AbilityMatch.match;
-                return this.state;
-            }
-        }
-        if (AbilityCompare.and === this.compareMethod) {
-            if (ruleCheckStates.every(s => AbilityMatch.match === s)) {
-                this.state = AbilityMatch.match;
-            }
-        }
-        if (AbilityCompare.or === this.compareMethod) {
-            if (ruleCheckStates.some(s => AbilityMatch.match === s)) {
-                this.state = AbilityMatch.match;
-            }
-        }
-        return this.state;
-    }
-    toString() {
-        return `AbilityRuleSet: ${this.name} compareMethod: ${this.compareMethod}, rules: ${this.rules.map(rule => rule.toString()).join('\n')}`;
-    }
-    copyWith(props) {
-        const next = new AbilityRuleSet({
-            id: props.id ?? this.id,
-            name: props.name ?? this.name,
-            description: props.description ?? this.description,
-            compareMethod: props.compareMethod ?? this.compareMethod,
-        });
-        const nextRules = props.rules ?? this.rules;
-        for (const rule of nextRules) {
-            next.addRule(rule);
-        }
-        return next;
-    }
-    hash() {
-        const ruleHashes = this.rules.map(r => r.hash()).sort();
-        const parts = [
-            `compareMethod:${this.compareMethod}`,
-            `isExcept:${this.isExcept}`,
-            `disabled:${this.disabled}`,
-            `rules:${ruleHashes.join('|')}`,
-        ];
-        return AbilityHash.sha1(parts.join(';'));
-    }
-    static and(rules) {
-        return new AbilityRuleSet({
-            compareMethod: AbilityCompare.and,
-        }).addRules(rules);
-    }
-    static or(rules) {
-        return new AbilityRuleSet({
-            compareMethod: AbilityCompare.or,
-        }).addRules(rules);
-    }
-}
-
-class AbilityJSONParser {
-    /**
-     * Parses an array of policy configurations into an array of AbilityPolicy instances.
-     * @param configs - Array of policy configurations
-     * @returns Array of AbilityPolicy instances
-     */
-    static parse(configs) {
-        return configs.map(config => AbilityJSONParser.parsePolicy(config));
-    }
-    static parsePolicy(config) {
-        const { id, name, ruleSet, compareMethod, permission, effect, priority, disabled, tags } = config;
-        // Create the empty policy
-        const policy = new AbilityPolicy({
-            name,
-            id,
-            permission: permission,
-            priority: priority,
-            effect: effect,
-            disabled,
-            tags,
-        });
-        policy.compareMethod = compareMethod;
-        ruleSet.forEach(ruleSetConfig => {
-            policy.addRuleSet(AbilityJSONParser.parseRuleSet(ruleSetConfig));
-        });
-        return policy;
-    }
-    static parseRule(config) {
-        const { id, name, subject, resource, condition, disabled } = config;
-        return new AbilityRule({
-            id,
-            name,
-            subject,
-            resource,
-            disabled,
-            condition,
-        });
-    }
-    /**
-     * Parse the config JSON format to Group class instance
-     */
-    static parseRuleSet(config) {
-        const { id, name, rules, compareMethod, disabled } = config;
-        const ruleSet = new AbilityRuleSet({
-            disabled,
-            compareMethod: compareMethod,
-            name,
-            id,
-        });
-        // Adding rules if exists
-        if (rules && rules.length > 0) {
-            const abilityRules = rules.map(ruleConfig => AbilityJSONParser.parseRule(ruleConfig));
-            ruleSet.addRules(abilityRules);
-        }
-        return ruleSet;
-    }
-    static ruleToJSON(rule) {
-        return {
-            id: rule.id,
-            name: rule.name,
-            disabled: rule.disabled,
-            subject: rule.subject,
-            resource: rule.resource,
-            condition: rule.condition,
-        };
-    }
-    static ruleSetToJSON(ruleSet) {
-        return {
-            id: ruleSet.id.toString(),
-            name: ruleSet.name.toString(),
-            disabled: ruleSet.disabled,
-            compareMethod: ruleSet.compareMethod,
-            rules: ruleSet.rules.map(rule => AbilityJSONParser.ruleToJSON(rule)),
-        };
-    }
-    static policyToJSON(policy) {
-        return {
-            id: policy.id.toString(),
-            name: policy.name.toString(),
-            disabled: policy.disabled,
-            priority: policy.priority,
-            permission: policy.permission,
-            effect: policy.effect,
-            compareMethod: policy.compareMethod,
-            tags: policy.tags,
-            ruleSet: policy.ruleSet.map(ruleSet => AbilityJSONParser.ruleSetToJSON(ruleSet)),
-        };
-    }
-    static toJSON(policies) {
-        return policies.map(policy => AbilityJSONParser.policyToJSON(policy));
-    }
-}
-
-function brand(code) {
-    return code;
-}
-const TokenTypes = {
-    EFFECT: brand('EFFECT'),
-    IF: brand('IF'),
-    PERMISSION: brand('PERMISSION'),
-    IDENTIFIER: brand('IDENTIFIER'),
-    COLON: brand('COLON'),
-    COMMA: brand('COMMA'),
-    DOT: brand('DOT'),
-    LBRACKET: brand('LBRACKET'),
-    RBRACKET: brand('RBRACKET'),
-    ALL: brand('ALL'),
-    ANY: brand('ANY'),
-    OF: brand('OF'),
-    EOF: brand('EOF'),
-    COMMENT: brand('COMMENT'),
-    EQ: brand('EQ'),
-    CONTAINS: brand('CONTAINS'),
-    IN: brand('IN'),
-    NOT_IN: brand('NOT_IN'),
-    NOT_CONTAINS: brand('NOT_CONTAINS'),
-    GT: brand('GT'),
-    GTE: brand('GTE'),
-    LT: brand('LT'),
-    LTE: brand('LTE'),
-    NULL: brand('NULL'),
-    EQ_NULL: brand('EQ_NULL'),
-    NOT_EQ_NULL: brand('NOT_EQ_NULL'),
-    NOT_EQ: brand('NOT_EQ'),
-    LEN_GT: brand('LEN_GT'),
-    LEN_LT: brand('LEN_LT'),
-    LEN_EQ: brand('LEN_EQ'),
-    ALWAYS: brand('ALWAYS'),
-    NEVER: brand('NEVER'),
-    EXCEPT: brand('EXCEPT'),
-    ANNOTATION: brand('ANNOTATION'),
-    STRING: brand('STRING'),
-    NUMBER: brand('NUMBER'),
-    BOOLEAN: brand('BOOLEAN'),
-    SYMBOL: brand('SYMBOL'),
-    KEYWORD: brand('KEYWORD'),
-    ALIAS: brand('ALIAS'),
-    UNKNOWN: brand('UNKNOWN'),
-};
-class AbilityDSLToken {
-    type;
-    value;
-    line;
-    column;
-    constructor(type, value, line, column) {
-        this.type = type;
-        this.value = value;
-        this.line = line;
-        this.column = column;
-    }
-    toString() {
-        return `AbilityDSLToken([${this.type}] "${this.value}" at ${this.line}:${this.column})`;
-    }
-}
-
-class AbilityDSLLexer {
-    input;
-    pos = 0;
-    tokens = [];
-    line = 1;
-    column = 1;
-    keywords = new Set([
-        'if',
-        'all',
-        'any',
-        'of',
-        'permit',
-        'allow',
-        'deny',
-        'forbidden',
-        'true',
-        'false',
-        'null',
-        'contains',
-        'includes',
-        'length',
-        'has',
-        'in',
-        'gt',
-        'lt',
-        'gte',
-        'lte',
-        'equals',
-        'greater',
-        'less',
-        'not',
-        'is',
-        'or',
-        'than',
-        'always',
-        'never',
-        'except',
-        'alias',
-    ]);
-    constructor(input) {
-        this.input = input;
-    }
-    tokenize() {
-        while (!this.isAtEnd()) {
-            this.skipWhitespace();
-            if (this.isAtEnd())
-                break;
-            const char = this.peek();
-            if (char === '@') {
-                this.tokens.push(this.readAnnotation());
-                continue;
-            }
-            if (char === '#') {
-                this.tokens.push(this.readComment());
-                continue;
-            }
-            if (char === '"' || char === "'") {
-                this.tokens.push(this.readString());
-                continue;
-            }
-            if (this.isDigit(char)) {
-                this.tokens.push(this.readNumber());
-                continue;
-            }
-            if (this.isSymbol(char)) {
-                this.tokens.push(this.readSymbol());
-                continue;
-            }
-            if (this.isAlpha(char)) {
-                this.tokens.push(this.readWord());
-                continue;
-            }
-            throw new Error(`Unexpected character '${char}' at ${this.line}:${this.column}`);
-        }
-        this.tokens.push(new AbilityDSLToken(TokenTypes.EOF, '', this.line, this.column));
-        return this.tokens;
-    }
-    readComment() {
-        const startLine = this.line;
-        const startColumn = this.column;
-        this.advance(); // skip '#'
-        let value = '';
-        while (!this.isAtEnd() && !this.isNewline()) {
-            value += this.advance();
-        }
-        return new AbilityDSLToken(TokenTypes.COMMENT, value.trim(), startLine, startColumn);
-    }
-    // private readAlias(): AbilityDSLToken {
-    //   const startLine = this.line;
-    //   const startColumn = this.column;
-    //
-    //   this.advance(); // skip "alias" keyword
-    //
-    //   // Read colon
-    //   this.readSymbol();
-    //
-    //   let value = '';
-    //   while (!this.isAtEnd() && !this.isNewline()) {
-    //     value += this.advance();
-    //   }
-    //   return new AbilityDSLToken(TokenTypes.ALIAS, value.trim(), startLine, startColumn);
-    // }
-    readAnnotation() {
-        const startLine = this.line;
-        const startColumn = this.column;
-        let raw = '';
-        // читаем всю строку после @
-        while (!this.isAtEnd() && !this.isNewline()) {
-            raw += this.advance();
-        }
-        raw = raw.trim();
-        // parse literals
-        let result = '';
-        let i = 0;
-        let inString = false;
-        let quote = null;
-        let escaped = false;
-        while (i < raw.length) {
-            const ch = raw[i];
-            if (inString) {
-                if (escaped) {
-                    result += ch;
-                    escaped = false;
-                }
-                else if (ch === '\\') {
-                    escaped = true;
-                }
-                else if (ch === quote) {
-                    inString = false;
-                    quote = null;
-                }
-                else {
-                    result += ch;
-                }
-                i++;
-                continue;
-            }
-            // start of string
-            if (ch === '"' || ch === "'") {
-                inString = true;
-                quote = ch;
-                i++;
-                continue;
-            }
-            result += ch;
-            i++;
-        }
-        return new AbilityDSLToken(TokenTypes.ANNOTATION, result.trim(), startLine, startColumn);
-    }
-    readString() {
-        const startLine = this.line;
-        const startColumn = this.column;
-        const quote = this.advance();
-        let value = '';
-        let escaped = false;
-        while (!this.isAtEnd()) {
-            const char = this.advance();
-            if (escaped) {
-                value += char;
-                escaped = false;
-                continue;
-            }
-            if (char === '\\') {
-                escaped = true;
-                continue;
-            }
-            if (char === quote) {
-                return new AbilityDSLToken(TokenTypes.STRING, value, startLine, startColumn);
-            }
-            value += char;
-        }
-        throw new Error(`Unterminated string at ${startLine}:${startColumn}`);
-    }
-    readNumber() {
-        const startLine = this.line;
-        const startColumn = this.column;
-        const start = this.pos;
-        while (!this.isAtEnd() && this.isDigit(this.peek())) {
-            this.advance();
-        }
-        const value = this.input.slice(start, this.pos);
-        return new AbilityDSLToken(TokenTypes.NUMBER, value, startLine, startColumn);
-    }
-    readSymbol() {
-        const startLine = this.line;
-        const startColumn = this.column;
-        const char = this.advance();
-        switch (char) {
-            case '.':
-                return new AbilityDSLToken(TokenTypes.DOT, char, startLine, startColumn);
-            case ':':
-                return new AbilityDSLToken(TokenTypes.COLON, char, startLine, startColumn);
-            case ',':
-                return new AbilityDSLToken(TokenTypes.COMMA, char, startLine, startColumn);
-            case '[':
-                return new AbilityDSLToken(TokenTypes.LBRACKET, char, startLine, startColumn);
-            case ']':
-                return new AbilityDSLToken(TokenTypes.RBRACKET, char, startLine, startColumn);
-            case '>':
-                if (this.peek() === '=') {
-                    this.advance();
-                    return new AbilityDSLToken(TokenTypes.SYMBOL, '>=', startLine, startColumn);
-                }
-                return new AbilityDSLToken(TokenTypes.SYMBOL, '>', startLine, startColumn);
-            case '<':
-                if (this.peek() === '=') {
-                    this.advance();
-                    return new AbilityDSLToken(TokenTypes.SYMBOL, '<=', startLine, startColumn);
-                }
-                if (this.peek() === '>') {
-                    this.advance();
-                    return new AbilityDSLToken(TokenTypes.SYMBOL, '<>', startLine, startColumn);
-                }
-                return new AbilityDSLToken(TokenTypes.SYMBOL, '<', startLine, startColumn);
-            case '=':
-                if (this.peek() === '=') {
-                    this.advance();
-                    return new AbilityDSLToken(TokenTypes.SYMBOL, '==', startLine, startColumn);
-                }
-                return new AbilityDSLToken(TokenTypes.SYMBOL, '=', startLine, startColumn);
-            case '!':
-                if (this.peek() === '=') {
-                    this.advance();
-                    return new AbilityDSLToken(TokenTypes.SYMBOL, '!=', startLine, startColumn);
-                }
-                throw new Error(`Unexpected symbol '!' at ${this.line}:${this.column}`);
-            default:
-                throw new Error(`Unknown symbol '${char}' at ${this.line}:${this.column}`);
-        }
-    }
-    readWord() {
-        const startLine = this.line;
-        const startColumn = this.column;
-        const start = this.pos;
-        // Первый сегмент
-        while (!this.isAtEnd() && /[a-zA-Z0-9_*]/.test(this.peek())) {
-            this.advance();
-        }
-        // Сегменты через точку
-        while (!this.isAtEnd() && this.peek() === '.') {
-            this.advance(); // dot
-            if (!/[a-zA-Z_*]/.test(this.peek())) {
-                break;
-            }
-            while (!this.isAtEnd() && /[a-zA-Z0-9_*]/.test(this.peek())) {
-                this.advance();
-            }
-        }
-        const word = this.input.slice(start, this.pos);
-        if (word === 'always') {
-            return new AbilityDSLToken(TokenTypes.ALWAYS, word, startLine, startColumn);
-        }
-        if (word === 'never') {
-            return new AbilityDSLToken(TokenTypes.NEVER, word, startLine, startColumn);
-        }
-        // Если есть точка — это путь (identifier или permission)
-        if (word.includes('.')) {
-            const last = this.tokens[this.tokens.length - 1];
-            if (last?.type === TokenTypes.EFFECT) {
-                if (word.startsWith('permission.')) {
-                    return new AbilityDSLToken(TokenTypes.PERMISSION, word, startLine, startColumn);
-                }
-            }
-            return new AbilityDSLToken(TokenTypes.IDENTIFIER, word, startLine, startColumn);
-        }
-        // Ключевые слова
-        if (this.keywords.has(word)) {
-            // Эффекты
-            if (word === 'permit' || word === 'allow') {
-                return new AbilityDSLToken(TokenTypes.EFFECT, 'permit', startLine, startColumn);
-            }
-            if (word === 'deny' || word === 'forbidden') {
-                return new AbilityDSLToken(TokenTypes.EFFECT, 'deny', startLine, startColumn);
-            }
-            // Групповые ключевые слова
-            if (word === 'all') {
-                return new AbilityDSLToken(TokenTypes.ALL, word, startLine, startColumn);
-            }
-            if (word === 'any') {
-                return new AbilityDSLToken(TokenTypes.ANY, word, startLine, startColumn);
-            }
-            if (word === 'of') {
-                return new AbilityDSLToken(TokenTypes.OF, word, startLine, startColumn);
-            }
-            if (word === 'if') {
-                return new AbilityDSLToken(TokenTypes.IF, word, startLine, startColumn);
-            }
-            // Булевы и null
-            if (word === 'true' || word === 'false') {
-                return new AbilityDSLToken(TokenTypes.BOOLEAN, word, startLine, startColumn);
-            }
-            if (word === 'null') {
-                return new AbilityDSLToken(TokenTypes.NULL, word, startLine, startColumn);
-            }
-            if (word === 'except') {
-                return new AbilityDSLToken(TokenTypes.EXCEPT, word, startLine, startColumn);
-            }
-            if (word === 'alias') {
-                return new AbilityDSLToken(TokenTypes.ALIAS, word, startLine, startColumn);
-            }
-            // Остальные ключевые слова (contains, in, equals, greater, less, not, is, or, than, equal)
-            return new AbilityDSLToken(TokenTypes.KEYWORD, word, startLine, startColumn);
-        }
-        // Если после EFFECT и нет точки — действие (например, "create")
-        const lastToken = this.tokens[this.tokens.length - 1];
-        if (lastToken?.type === TokenTypes.EFFECT) {
-            return new AbilityDSLToken(TokenTypes.PERMISSION, word, startLine, startColumn);
-        }
-        // Обычный идентификатор
-        return new AbilityDSLToken(TokenTypes.IDENTIFIER, word, startLine, startColumn);
-    }
-    skipWhitespace() {
-        while (!this.isAtEnd() && /\s/.test(this.peek())) {
-            this.advance();
-        }
-    }
-    isDigit(char) {
-        return char >= '0' && char <= '9';
-    }
-    isAlpha(char) {
-        return /[a-zA-Z_]/.test(char);
-    }
-    isSymbol(char) {
-        return ['.', ':', ',', '[', ']', '>', '<', '=', '!'].includes(char);
-    }
-    isNewline() {
-        return this.peek() === '\n';
-    }
-    peek() {
-        return this.input[this.pos];
-    }
-    advance() {
-        const ch = this.input[this.pos++];
-        if (ch === '\n') {
-            this.line++;
-            this.column = 1;
-        }
-        else {
-            this.column++;
-        }
-        return ch;
-    }
-    isAtEnd() {
-        return this.pos >= this.input.length;
-    }
-}
-
-class AbilityDSLSyntaxError extends Error {
-    line;
-    column;
-    context;
-    details;
-    _formattedMessage;
-    _originalStack;
-    constructor(line, column, context, // строка DSL + ^ + соседние строки
-    details) {
-        super(details.split('\n')[0]); // message = только первая строка
-        this.line = line;
-        this.column = column;
-        this.context = context;
-        this.details = details;
-        this.name = 'AbilityDSLSyntaxError';
-        if (Error.captureStackTrace) {
-            Error.captureStackTrace(this, AbilityDSLSyntaxError);
-        }
-        this._originalStack = this.stack;
-        this._formattedMessage = this.formatMessage();
-        Object.defineProperty(this, 'stack', {
-            get: () => this._formattedMessage,
-            configurable: true,
-        });
-    }
-    static supportsColor() {
-        return typeof process !== 'undefined' && process.stdout?.isTTY;
-    }
-    formatMessage() {
-        const useColor = AbilityDSLSyntaxError.supportsColor();
-        const BOLD = useColor ? '\x1b[1m' : '';
-        const RED = useColor ? '\x1b[31m' : '';
-        const ORANGE = useColor ? '\x1b[33;1m' : '';
-        const GRAY = useColor ? '\x1b[90m' : '';
-        const RESET = useColor ? '\x1b[0m' : '';
-        const lines = this.context.split('\n');
-        // Find line with ^
-        const pointerIndex = lines.findIndex(l => l.includes('^') || l.includes('~'));
-        const commentIndex = lines.findIndex(l => l.trim().includes('#'));
-        const formattedLines = lines.map((line, idx) => {
-            if (idx === pointerIndex - 1) {
-                // Error line
-                return `${BOLD}${ORANGE}${line}${RESET}`;
-            }
-            if (idx === pointerIndex) {
-                // Error with ~~~~~
-                return `${RED}${line}${RESET}`;
-            }
-            // Comments # ...
-            if (idx === commentIndex) {
-                return `${GRAY}${line}${RESET}`;
-            }
-            return line;
-        });
-        const contextBlock = formattedLines.join('\n');
-        return `${BOLD}${RED}${this.name}: ${this.details}${RESET}\n\n` + contextBlock;
-    }
-    toString() {
-        return this._formattedMessage;
-    }
-}
-
-class AbilityDSLTokenStream {
-    tokens;
-    pos = 0;
-    dsl;
-    marks = [];
-    lastToken = null;
-    next() {
-        const token = this.tokens[this.pos++];
-        this.lastToken = token;
-        return token;
-    }
-    prev() {
-        if (this.pos === 0) {
-            return null;
-        }
-        const token = this.tokens[this.pos--];
-        this.lastToken = token;
-        return token;
-    }
-    lookPrev() {
-        return this.lastToken;
-    }
-    constructor(tokens, dsl) {
-        this.tokens = tokens;
-        this.dsl = dsl;
-    }
-    peek() {
-        return this.tokens[this.pos];
-    }
-    eof() {
-        return this.peek().type === TokenTypes.EOF;
-    }
-    check(type) {
-        if (this.eof()) {
-            return false;
-        }
-        return this.peek().type === type;
-    }
-    match(type) {
-        if (this.check(type)) {
-            return this.next();
-        }
-        return null;
-    }
-    expect(type, message) {
-        const token = this.peek();
-        if (token && token.type === type) {
-            return this.next();
-        }
-        this.syntaxError(message, token, [type]);
-    }
-    expectOneOf(types, message) {
-        const token = this.peek();
-        for (const t of types) {
-            if (token && token.type === t) {
-                return this.next();
-            }
-        }
-        this.syntaxError(message, token, types);
-    }
-    mark() {
-        this.marks.push(this.pos);
-    }
-    reset() {
-        const pos = this.marks.pop();
-        if (pos !== undefined) {
-            this.pos = pos;
-        }
-    }
-    commit() {
-        this.marks.pop();
-    }
-    syntaxError(details, token, expected) {
-        const lines = this.dsl.split(/\r?\n/);
-        const lineIdx = token.line - 1;
-        const lineBefore = lineIdx > 0 ? lines[lineIdx - 1] : '';
-        const current = lines[lineIdx];
-        const linesAfter = lineIdx + 1 < lines.length ? lines[lineIdx + 1] : '';
-        const wave = ' '.repeat(Math.max(0, token.column - 1)) + '~'.repeat(token.value.length);
-        const lineNumWidth = String(token.line + 1).length;
-        const num = (n) => String(n).padStart(lineNumWidth, ' ');
-        let context = '';
-        if (lineBefore.trim() !== '') {
-            context += `${num(token.line - 1)} | ${lineBefore}\n`;
-        }
-        context += `${num(token.line)} | ${current}\n`;
-        context += `${' '.repeat(lineNumWidth)} | ${wave}\n`;
-        if (linesAfter.trim() !== '') {
-            context += `${num(token.line + 1)} | ${linesAfter}`;
-        }
-        let finalDetails = details;
-        if (expected && expected?.length > 0) {
-            const actual = token.value;
-            const suggestion = this.suggest(actual, expected);
-            const detailsMsg = `${details}\nDetails: Unexpected value token \`${actual}\``;
-            finalDetails = suggestion ? `${detailsMsg} Did you mean \`${suggestion}\`?` : detailsMsg;
-        }
-        throw new AbilityDSLSyntaxError(token.line, token.column, context + '\n', finalDetails);
-    }
-    suggest(actual, expectedTypes) {
-        const candidates = [];
-        for (const type of expectedTypes) {
-            candidates.push(type);
-        }
-        const uniqueCandidates = [...new Set(candidates)];
-        let best = null;
-        let bestDist = 3;
-        for (const candidate of uniqueCandidates) {
-            const d = this.levenshteinDistance(actual.toLowerCase(), candidate.toLowerCase());
-            if (d < bestDist) {
-                bestDist = d;
-                best = candidate;
-            }
-        }
-        return best;
-    }
-    levenshteinDistance(a, b) {
-        const matrix = Array.from({ length: b.length + 1 }, () => Array.from({ length: a.length + 1 }, () => 0));
-        for (let i = 0; i <= a.length; i++)
-            matrix[0][i] = i;
-        for (let j = 0; j <= b.length; j++)
-            matrix[j][0] = j;
-        for (let j = 1; j <= b.length; j++) {
-            for (let i = 1; i <= a.length; i++) {
-                const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-                matrix[j][i] = Math.min(matrix[j][i - 1] + 1, matrix[j - 1][i] + 1, matrix[j - 1][i - 1] + cost);
-            }
-        }
-        return matrix[b.length][a.length];
-    }
-}
-
-class AbilityDSLAnnotations {
-    store = {
-        id: undefined,
-        name: undefined,
-        priority: undefined,
-        description: undefined,
-        disabled: undefined,
-        tags: undefined,
-    };
-    get(key) {
-        return this.store[key] ?? null;
-    }
-    set(key, value, token) {
-        if (value === null) {
-            this.store[key] = undefined;
-        }
-        else {
-            this.store[key] = {
-                key,
-                value,
-                token,
-            };
-        }
-        return this;
-    }
-    clear() {
-        for (const key of Object.keys(this.store)) {
-            this.store[key] = undefined;
-        }
-    }
-    clone() {
-        const cloned = new AbilityDSLAnnotations();
-        for (const key of Object.keys(this.store)) {
-            const entry = this.store[key];
-            cloned.store[key] = entry
-                ? { ...entry }
-                : undefined;
-        }
-        return cloned;
-    }
-    // convenience getters
-    get id() { return this.get('id'); }
-    get name() { return this.get('name'); }
-    get description() { return this.get('description'); }
-    get priority() { return this.get('priority'); }
-    get disabled() { return this.get('disabled'); }
-    get tags() { return this.get('tags'); }
-    // convenience setters
-    setID(v, t) { return this.set('id', v, t); }
-    setName(v, t) { return this.set('name', v, t); }
-    setDescription(v, t) { return this.set('description', v, t); }
-    setPriority(v, t) { return this.set('priority', v, t); }
-    setDisabled(v, t) { return this.set('disabled', v, t); }
-    setTags(v, t) { return this.set('tags', v, t); }
-}
-
-const AnnotationAllowed = {
-    policy: new Set(["id", "name", "description", "priority", "disabled", "tags"]),
-    ruleSet: new Set(["id", "name", "description", "disabled"]),
-    rule: new Set(["id", "name", "disabled"]),
-    alias: new Set(["name", "disabled"]),
-};
-
-class AbilityDSLAliases {
-    store = new Map();
-    get(alias) {
-        return this.store.get(alias) || null;
-    }
-    set(alias, rule) {
-        this.store.set(alias, rule);
-        return this;
-    }
-    has(alias) {
-        return this.store.has(alias);
-    }
-}
-
-/**
- * Parser for the Ability DSL.
- *
- * Converts a DSL string into one or more AbilityPolicy instances.
- * The grammar follows the structure:
- *
- *   <effect> <permission> if <group> [ <group> ... ]
- *
- * where <group> is either "all of:" or "any of:", followed by a colon,
- * and then a list of rules (one per line).
- *
- * Each rule is: <identifier> <operator> <value>
- *
- * Operators can be simple (equals, contains, in) or
- * composed (is null, is not null, greater than, less than or equal, etc.).
- */
-class AbilityDSLParser {
-    dsl;
-    stream;
-    annBuffer = new AbilityDSLAnnotations();
-    aliasBuffer = new AbilityDSLAliases();
-    constructor(dsl) {
-        this.dsl = dsl;
-    }
-    /**
-     * Main entry point: tokenize the input and parse all policies.
-     * @returns Array of AbilityPolicy instances.
-     */
-    parse() {
-        this.annBuffer.clear();
-        // 1. Лексер → токены
-        const tokens = new AbilityDSLLexer(this.dsl).tokenize();
-        // 2. Создаём TokenStream
-        this.stream = new AbilityDSLTokenStream(tokens, this.dsl);
-        const policies = [];
-        while (!this.stream.eof()) {
-            this.consumeLeadingComments();
-            this.consumeLeadingAnnotations();
-            this.consumeLeadingAliases();
-            if (!this.isStartOfPolicy()) {
-                const token = this.stream.peek();
-                this.stream.syntaxError(`Expected policy, got ${token.type}.`, token, [TokenTypes.EFFECT]);
-            }
-            policies.push(this.parsePolicy());
-        }
-        return policies;
-    }
-    // -------------------------------------------------------------------------
-    // #region Policy parsing
-    // -------------------------------------------------------------------------
-    /**
-     * Parses a single policy from the current token position.
-     *
-     * Grammar:
-     *   policy = EFFECT PERMISSION IF (ALL | ANY) COLON ruleSets
-     */
-    parsePolicy() {
-        this.consumeLeadingComments();
-        this.consumeLeadingAnnotations();
-        this.consumeLeadingAliases();
-        const annotations = this.takeAnnotations('policy');
-        // Effect: "permit" or "deny"
-        const effectToken = this.stream.expect(TokenTypes.EFFECT, 'Expected effect');
-        const effect = effectToken.value;
-        // Permission: e.g. "order.update"
-        const permissionToken = this.stream.expect(TokenTypes.PERMISSION, 'Expected permission');
-        const permission = permissionToken.value;
-        if (!permission.startsWith('permission.')) {
-            return this.stream.syntaxError(`Unexpected token. The permission key, must be starts with prefix \`permission.\`, but got \`${permission}\`.\nDid you mean \`permission.${permission}\`?`, permissionToken);
-        }
-        // "if" keyword
-        this.stream.expect(TokenTypes.IF, 'Expected "if"');
-        // Group selector: "all" or "any" – determines how the top‑level rule sets are combined.
-        const compareToken = this.stream.expectOneOf([TokenTypes.ALL, TokenTypes.ANY], 'Expected "all" or "any"');
-        const compareMethod = compareToken.type === TokenTypes.ALL ? AbilityCompare.and : AbilityCompare.or;
-        // Colon after the group keyword
-        this.stream.expect(TokenTypes.COLON, 'Expected ":"');
-        // Parse the list of rule sets (each "all of:" or "any of:" block)
-        const ruleSets = this.parseRuleSets(compareMethod);
-        // Construct the policy instance.
-        return new AbilityPolicy({
-            id: annotations.id?.value || null,
-            name: annotations.name?.value || null,
-            description: annotations.description?.value || null,
-            priority: annotations.priority?.value || null,
-            permission: permission.replace(/^permission\./, ''),
-            effect: effect === 'permit' ? AbilityPolicyEffect.permit : AbilityPolicyEffect.deny,
-            disabled: annotations.disabled?.value ?? undefined,
-            tags: annotations.tags?.value ?? undefined,
-            compareMethod,
-        }).addRuleSets(ruleSets);
-    }
-    // -------------------------------------------------------------------------
-    // #region Rule set parsing (groups of rules)
-    // -------------------------------------------------------------------------
-    /**
-     * Parses a sequence of rule sets (groups) until a new policy starts or EOF.
-     */
-    parseRuleSets(policyCompareMethod) {
-        const sets = [];
-        this.consumeLeadingComments();
-        this.consumeLeadingAnnotations();
-        while (!this.stream.eof() && !this.isStartOfPolicy()) {
-            // maybe except ruleSet
-            if (this.isStartOfExcept()) {
-                sets.push(this.parseExceptGroup(policyCompareMethod));
-                continue;
-            }
-            // maybe ruleSet
-            if (this.isStartOfGroup()) {
-                sets.push(this.parseGroup());
-                continue;
-            }
-            // implicit ruleSet
-            // if (!this.isStartOfRule()) {
-            //   this.consumeLeadingComments();
-            //   this.consumeLeadingAnnotations();
-            // }
-            // is implicit group
-            // const annotation = this.takeAnnotations('ruleSet');
-            const group = new AbilityRuleSet({
-                // id: annotation.id?.value || null,
-                compareMethod: policyCompareMethod,
-                // name: annotation.name?.value ?? null,
-                // description: annotation.description?.value || null,
-                // disabled: annotation.disabled?.value ?? undefined,
-            });
-            // Read rules of implicit-группы
-            while (!this.stream.eof()) {
-                this.consumeLeadingComments();
-                this.consumeLeadingAnnotations();
-                if (this.isStartOfGroup() || this.isStartOfPolicy() || this.isStartOfExcept()) {
-                    break;
-                }
-                if (this.stream.check(TokenTypes.IDENTIFIER) ||
-                    this.stream.check(TokenTypes.ALWAYS) ||
-                    this.stream.check(TokenTypes.NEVER)) {
-                    group.addRule(this.parseRule());
-                }
-                else {
-                    this.stream.syntaxError(`Unexpected token in implicit group: ${this.stream.peek().type}`, this.stream.peek());
-                }
-            }
-            sets.push(group);
-        }
-        return sets;
-    }
-    /**
-     * Parses a single group, e.g. "all of:" or "any of:", and returns a RuleSet.
-     */
-    parseGroup() {
-        this.consumeLeadingComments();
-        this.consumeLeadingAnnotations();
-        const annotations = this.takeAnnotations('ruleSet');
-        const compareToken = this.stream.expectOneOf([TokenTypes.ALL, TokenTypes.ANY, TokenTypes.ALWAYS, TokenTypes.NEVER], 'Expected "all" or "any" or "always" or "never"');
-        const compareMethod = compareToken.type === TokenTypes.ALL ? AbilityCompare.and : AbilityCompare.or;
-        if (this.stream.check(TokenTypes.OF)) {
-            this.stream.next();
-        }
-        this.stream.expect(TokenTypes.COLON, 'Expected ":"');
-        const group = new AbilityRuleSet({
-            id: annotations.id?.value || null,
-            compareMethod,
-            name: annotations.name?.value || null,
-            description: annotations.description?.value || null,
-            disabled: annotations.disabled?.value ?? undefined,
-        });
-        while (!this.stream.eof()) {
-            this.consumeLeadingComments();
-            this.consumeLeadingAnnotations();
-            if (this.isStartOfExcept()) {
-                break;
-            }
-            if (this.isStartOfGroup() || this.isStartOfPolicy()) {
-                break;
-            }
-            if (this.stream.check(TokenTypes.IDENTIFIER)) {
-                group.addRule(this.parseRule());
-            }
-            else {
-                this.stream.syntaxError(`Unexpected token in group: ${this.stream.peek().type}`, this.stream.peek());
-            }
-        }
-        return group;
-    }
-    // -------------------------------------------------------------------------
-    // #region Except RuleSet parsing
-    // -------------------------------------------------------------------------
-    parseExceptGroup(policyCompareMethod) {
-        this.consumeLeadingComments();
-        this.consumeLeadingAnnotations();
-        const annotations = this.takeAnnotations('ruleSet');
-        // consume "except"
-        this.stream.expect(TokenTypes.EXCEPT, 'Expected "except"');
-        let compareMethod = policyCompareMethod;
-        // optional: "all" / "any"
-        if (this.stream.check(TokenTypes.ALL) || this.stream.check(TokenTypes.ANY)) {
-            const compareToken = this.stream.next();
-            compareMethod = compareToken.type === TokenTypes.ALL ? AbilityCompare.and : AbilityCompare.or;
-            if (this.stream.check(TokenTypes.OF)) {
-                this.stream.next();
-            }
-            this.stream.expect(TokenTypes.COLON, 'Expected ":" after except group');
-        }
-        else {
-            // implicit except group — no "all/any of:"
-            // but still must end with colon
-            this.stream.expect(TokenTypes.COLON, 'Expected ":" after "except"');
-        }
-        const group = new AbilityRuleSet({
-            id: annotations.id?.value || null,
-            compareMethod,
-            name: annotations.name?.value || null,
-            description: annotations.description?.value || null,
-            isExcept: true,
-            disabled: annotations.disabled?.value ?? undefined,
-        });
-        // read rules
-        while (!this.stream.eof()) {
-            this.consumeLeadingComments();
-            this.consumeLeadingAnnotations();
-            if (this.isStartOfGroup() || this.isStartOfPolicy() || this.isStartOfExcept()) {
-                break;
-            }
-            if (this.stream.check(TokenTypes.IDENTIFIER)) {
-                group.addRule(this.parseRule());
-            }
-            else {
-                this.stream.syntaxError(`Unexpected token in except group: ${this.stream.peek().type}`, this.stream.peek());
-            }
-        }
-        return group;
-    }
-    // -------------------------------------------------------------------------
-    // #region Rule parsing
-    // -------------------------------------------------------------------------
-    /**
-     * Parses a single rule: subject operator value
-     */
-    parseRule() {
-        this.consumeLeadingComments();
-        this.consumeLeadingAnnotations();
-        const annotations = this.takeAnnotations('rule');
-        const isNeverAlways = this.stream.check(TokenTypes.ALWAYS) || this.stream.check(TokenTypes.NEVER);
-        if (!isNeverAlways && !this.stream.check(TokenTypes.IDENTIFIER)) {
-            this.stream.syntaxError(`Expected identifier, but got ${this.stream.peek().type}`, this.stream.peek());
-        }
-        // subject
-        const subject = isNeverAlways
-            ? ''
-            : this.stream.expect(TokenTypes.IDENTIFIER, 'Expected field').value;
-        // check alias
-        if (this.aliasBuffer.has(subject)) {
-            return this.aliasBuffer.get(subject);
-        }
-        // operator
-        const { condition, operator } = this.parseConditionOperator();
-        // value
-        let resource = null;
-        let valueToken = null;
-        const operatorConsumesValue = operator !== TokenTypes.EQ_NULL &&
-            operator !== TokenTypes.NOT_EQ_NULL &&
-            operator !== TokenTypes.NULL &&
-            operator !== TokenTypes.ALWAYS &&
-            operator !== TokenTypes.NEVER;
-        if (operatorConsumesValue) {
-            this.stream.mark();
-            resource = this.parseValue();
-            valueToken = this.stream.lookPrev();
-            this.stream.commit();
-        }
-        this.consumeLeadingComments();
-        this.consumeLeadingAnnotations();
-        this.consumeLeadingAliases();
-        // validation: identifier without dot → error
-        if (typeof resource === 'string' &&
-            valueToken &&
-            valueToken.type === TokenTypes.IDENTIFIER &&
-            !valueToken.value.includes('.')) {
-            this.stream.syntaxError(`Expected comparison operator or value, got \`${resource}\``, valueToken, [TokenTypes.KEYWORD]);
-        }
-        return new AbilityRule({
-            id: annotations.id?.value || null,
-            subject,
-            resource,
-            condition,
-            name: annotations.name?.value || null,
-            description: annotations.description?.value || null,
-            disabled: annotations.disabled?.value ?? undefined,
-        });
-    }
-    // -------------------------------------------------------------------------
-    // #region Operator parsing
-    // -------------------------------------------------------------------------
-    /**
-     * Parses the comparison operator part of a rule.
-     * Returns both the resulting AbilityCondition and the token type that was consumed.
-     */
-    parseConditionOperator() {
-        // "always"
-        this.stream.mark();
-        if (this.matchWord('always')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.always, operator: TokenTypes.ALWAYS };
-        }
-        this.stream.reset();
-        // "never"
-        this.stream.mark();
-        if (this.matchWord('never')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.never, operator: TokenTypes.NEVER };
-        }
-        this.stream.reset();
-        // "length equals"
-        this.stream.mark();
-        if (this.matchWord('length') && this.matchWord('equals')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.length_equals, operator: TokenTypes.LEN_EQ };
-        }
-        this.stream.reset();
-        // "length ="
-        this.stream.mark();
-        if (this.matchWord('length') && this.matchSymbol('=')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.length_equals, operator: TokenTypes.LEN_EQ };
-        }
-        this.stream.reset();
-        // "length greater than"
-        this.stream.mark();
-        if (this.matchWord('length') && this.matchWord('greater') && this.matchWord('than')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.length_greater_than, operator: TokenTypes.LEN_GT };
-        }
-        this.stream.reset();
-        // "length >"
-        this.stream.mark();
-        if (this.matchWord('length') && this.matchSymbol('>')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.length_greater_than, operator: TokenTypes.LEN_GT };
-        }
-        this.stream.reset();
-        // "length less than"
-        this.stream.mark();
-        if (this.matchWord('length') && this.matchWord('less') && this.matchWord('than')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.length_less_than, operator: TokenTypes.LEN_LT };
-        }
-        this.stream.reset();
-        // "length <"
-        this.stream.mark();
-        if (this.matchWord('length') && this.matchSymbol('<')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.length_less_than, operator: TokenTypes.LEN_LT };
-        }
-        this.stream.reset();
-        // "greater than or equal"
-        this.stream.mark();
-        if (this.matchWord('greater') &&
-            this.matchWord('than') &&
-            this.matchWord('or') &&
-            this.matchWord('equal')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.greater_or_equal, operator: TokenTypes.GTE };
-        }
-        this.stream.reset();
-        // greater than
-        this.stream.mark();
-        if (this.matchWord('greater') && this.matchWord('than')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.greater_than, operator: TokenTypes.GT };
-        }
-        this.stream.reset();
-        // less than or equal
-        this.stream.mark();
-        if (this.matchWord('less') &&
-            this.matchWord('than') &&
-            this.matchWord('or') &&
-            this.matchWord('equal')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.less_or_equal, operator: TokenTypes.LTE };
-        }
-        this.stream.reset();
-        // less than
-        if (this.matchWord('less') && this.matchWord('than')) {
-            return { condition: AbilityCondition.less_than, operator: TokenTypes.LT };
-        }
-        this.stream.reset();
-        // "not contains"
-        this.stream.mark();
-        if (this.matchWord('not') && this.matchWord('contains')) {
-            this.stream.commit();
-            return {
-                condition: AbilityCondition.not_contains,
-                operator: TokenTypes.NOT_CONTAINS,
-            };
-        }
-        this.stream.reset();
-        // "not includes"
-        this.stream.mark();
-        if (this.matchWord('not') && this.matchWord('includes')) {
-            this.stream.commit();
-            return {
-                condition: AbilityCondition.not_contains,
-                operator: TokenTypes.NOT_CONTAINS,
-            };
-        }
-        this.stream.reset();
-        // "not includes"
-        this.stream.mark();
-        if (this.matchWord('not') && this.matchWord('has')) {
-            this.stream.commit();
-            return {
-                condition: AbilityCondition.not_contains,
-                operator: TokenTypes.NOT_CONTAINS,
-            };
-        }
-        this.stream.reset();
-        // "is equals"
-        this.stream.mark();
-        if (this.matchWord('is') && this.matchWord('equals')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.equals, operator: TokenTypes.EQ };
-        }
-        this.stream.reset();
-        // not equal
-        this.stream.mark();
-        if (this.matchWord('not') && this.matchWord('equals')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.not_equals, operator: TokenTypes.NOT_EQ };
-        }
-        this.stream.reset();
-        // is not equals
-        this.stream.mark();
-        if (this.matchWord('is') && this.matchWord('not') && this.matchWord('equals')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.not_equals, operator: TokenTypes.NOT_EQ };
-        }
-        this.stream.reset();
-        // is in
-        this.stream.mark();
-        if (this.matchWord('is') && this.matchWord('in')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.in, operator: TokenTypes.IN };
-        }
-        this.stream.reset();
-        // not in
-        this.stream.mark();
-        if (this.matchWord('not') && this.matchWord('in')) {
-            this.stream.commit();
-            return { condition: AbilityCondition.not_in, operator: TokenTypes.NOT_IN };
-        }
-        this.stream.reset();
-        // is not null
-        this.stream.mark();
-        if (this.matchWord('is') && this.matchWord('not')) {
-            if (this.stream.check(TokenTypes.NULL)) {
-                this.stream.next();
-                this.stream.commit();
-                return {
-                    condition: AbilityCondition.not_equals,
-                    operator: TokenTypes.NOT_EQ_NULL,
-                };
-            }
-        }
-        this.stream.reset();
-        // is null
-        this.stream.mark();
-        if (this.matchWord('is') && this.matchWord('null')) {
-            if (this.stream.check(TokenTypes.NULL)) {
-                this.stream.commit();
-                this.stream.next();
-                return {
-                    condition: AbilityCondition.equals,
-                    operator: TokenTypes.EQ_NULL,
-                };
-            }
-        }
-        this.stream.reset();
-        // Single token (symbol or keyword)
-        const token = this.stream.peek();
-        if (token.type !== TokenTypes.SYMBOL &&
-            token.type !== TokenTypes.KEYWORD &&
-            token.type !== TokenTypes.NULL) {
-            this.stream.syntaxError(`Expected comparison operator, got \`${token.value}\``, token, [
-                TokenTypes.SYMBOL,
-                TokenTypes.KEYWORD,
-                TokenTypes.NULL,
-            ]);
-        }
-        this.stream.next();
-        switch (token.type) {
-            case TokenTypes.SYMBOL:
-                if (token.value === '=' || token.value === '==')
-                    return { condition: AbilityCondition.equals, operator: TokenTypes.EQ };
-                if (token.value === '!=' || token.value === '<>')
-                    return { condition: AbilityCondition.not_equals, operator: TokenTypes.NOT_EQ };
-                if (token.value === '>')
-                    return { condition: AbilityCondition.greater_than, operator: TokenTypes.GT };
-                if (token.value === '<')
-                    return { condition: AbilityCondition.less_than, operator: TokenTypes.LT };
-                if (token.value === '>=')
-                    return { condition: AbilityCondition.greater_or_equal, operator: TokenTypes.GTE };
-                if (token.value === '<=')
-                    return { condition: AbilityCondition.less_or_equal, operator: TokenTypes.LTE };
-                break;
-            case TokenTypes.KEYWORD:
-                if (token.value === 'contains' || token.value === 'includes' || token.value === 'has')
-                    return { condition: AbilityCondition.contains, operator: TokenTypes.CONTAINS };
-                if (token.value === 'in')
-                    return { condition: AbilityCondition.in, operator: TokenTypes.IN };
-                if (token.value === 'equals')
-                    return { condition: AbilityCondition.equals, operator: TokenTypes.EQ };
-                if (token.value === 'gte') {
-                    return { condition: AbilityCondition.greater_or_equal, operator: TokenTypes.GTE };
-                }
-                if (token.value === 'greater' || token.value === 'gt') {
-                    // If we come here, it means "greater" without "than" – treat as '>'
-                    return { condition: AbilityCondition.greater_than, operator: TokenTypes.GT };
-                }
-                if (token.value === 'less' || token.value === 'lt') {
-                    return { condition: AbilityCondition.less_than, operator: TokenTypes.LT };
-                }
-                if (token.value === 'lte') {
-                    return { condition: AbilityCondition.less_or_equal, operator: TokenTypes.LTE };
-                }
-                if (token.value === 'is') {
-                    // "is" alone -> equals
-                    return { condition: AbilityCondition.equals, operator: TokenTypes.EQ };
-                }
-                break;
-        }
-        return this.stream.syntaxError(`Unexpected operator token \`${token.value}\``, token, [
-            TokenTypes.SYMBOL,
-            TokenTypes.KEYWORD,
-        ]);
-    }
-    /**
-     * Helper to match and consume a specific word token (KEYWORD or IDENTIFIER).
-     * @param word The exact string to look for.
-     * @returns True if the next token has that value.
-     */
-    matchWord(word) {
-        if (this.stream.eof()) {
-            return false;
-        }
-        const token = this.stream.peek();
-        if ((token.type === TokenTypes.KEYWORD ||
-            token.type === TokenTypes.IDENTIFIER ||
-            token.type === TokenTypes.ALWAYS ||
-            token.type === TokenTypes.NEVER) &&
-            token.value === word) {
-            this.stream.next();
-            return true;
-        }
-        return false;
-    }
-    matchSymbol(symbol) {
-        if (this.stream.eof())
-            return false;
-        const token = this.stream.peek();
-        if (token.type === TokenTypes.SYMBOL && token.value === symbol) {
-            this.stream.next();
-            return true;
-        }
-        return false;
-    }
-    // -------------------------------------------------------------------------
-    // #region Value parsing (literals, arrays, identifiers)
-    // -------------------------------------------------------------------------
-    /**
-     * Parses a resource value. Can be a string literal, number, boolean,
-     * null, a path (identifier), or an array.
-     */
-    parseValue() {
-        // Arrays start with a left bracket
-        if (this.stream.check(TokenTypes.LBRACKET)) {
-            this.stream.next();
-            return this.parseArray();
-        }
-        // Ensure we are not about to read a structural token as a value.
-        const token = this.stream.peek();
-        if (token.type === TokenTypes.ALL ||
-            token.type === TokenTypes.ANY ||
-            token.type === TokenTypes.EFFECT) {
-            this.stream.syntaxError(`Unexpected ${token.type} in value position`, token);
-        }
-        this.stream.next();
-        // CHECK THIS SWITCH COMPARE
-        switch (token.type) {
-            case TokenTypes.STRING:
-                return token.value;
-            case TokenTypes.NUMBER:
-                return Number(token.value);
-            case TokenTypes.BOOLEAN:
-                return token.value === 'true';
-            case TokenTypes.NULL:
-                return null;
-            case TokenTypes.IDENTIFIER:
-                return token.value;
-            default: {
-                this.stream.syntaxError(`Unexpected value token "${token.value}"`, token, [
-                    TokenTypes.KEYWORD,
-                ]);
-            }
-        }
-    }
-    /**
-     * Parses an array literal: [ <value>, <value>, ... ]
-     * The opening bracket has already been consumed.
-     */
-    parseArray() {
-        const arr = [];
-        // Handle empty array
-        if (this.stream.check(TokenTypes.RBRACKET)) {
-            this.stream.next();
-            return arr;
-        }
-        while (!this.stream.eof() && !this.stream.check(TokenTypes.RBRACKET)) {
-            const value = this.parseValue();
-            // Flatten nested arrays if they appear (though grammar doesn't currently allow nesting).
-            if (Array.isArray(value)) {
-                arr.push(...value);
-            }
-            else if (typeof value === 'string' ||
-                typeof value === 'number' ||
-                typeof value === 'boolean') {
-                arr.push(value);
-            }
-            else if (value === null) {
-                // Null is allowed in arrays? Currently, we throw.
-                this.stream.syntaxError('Unexpected null in array', this.stream.peek());
-            }
-            // Optional comma between elements
-            if (this.stream.check(TokenTypes.COMMA)) {
-                this.stream.next();
-            }
-        }
-        this.stream.expect(TokenTypes.RBRACKET, 'Expected "]"');
-        return arr;
-    }
-    // -------------------------------------------------------------------------
-    // #region comments
-    // -------------------------------------------------------------------------
-    consumeLeadingComments() {
-        while (this.stream.check(TokenTypes.COMMENT)) {
-            this.stream.next();
-            // this.processCommentToken(token);
-        }
-    }
-    // private _consumeLeadingAnnotations() {
-    //   while (this.stream.check(TokenTypes.ANNOTATION)) {
-    //     const token = this.stream.next();
-    //     this.processAnnotationToken(token);
-    //   }
-    // }
-    consumeLeadingAliases() {
-        while (this.stream.check(TokenTypes.ALIAS)) {
-            this.stream.next(); // consume "alias"
-            const nameToken = this.stream.expect(TokenTypes.IDENTIFIER, `Expected alias name`);
-            const aliasKey = nameToken.value;
-            this.stream.expect(TokenTypes.COLON, `Expected colon after an alias`);
-            const annotations = this.takeAnnotations('alias');
-            while (!this.stream.eof() && !this.isStartOfAlias() && !this.isStartOfPolicy()) {
-                const rule = this.parseRule();
-                rule.name = annotations.get('name')?.value || aliasKey;
-                rule.description = annotations.get('description')?.value;
-                if (annotations.get('disabled')?.value === true) {
-                    rule.disabled = true;
-                }
-                this.aliasBuffer.set(aliasKey, rule);
-            }
-        }
-    }
-    consumeLeadingAnnotations() {
-        while (this.stream.check(TokenTypes.ANNOTATION)) {
-            const token = this.stream.next();
-            const text = token.value.trim();
-            if (text.startsWith('@id ')) {
-                this.annBuffer.setID(text.slice(4).trim(), token);
-            }
-            if (text.startsWith('@name ')) {
-                this.annBuffer.setName(text.slice(6).trim(), token);
-            }
-            if (text.startsWith('@description ')) {
-                this.annBuffer.setDescription(text.slice(13).trim(), token);
-            }
-            if (text.startsWith('@priority ')) {
-                this.annBuffer.setPriority(parseInt(text.slice(10).trim(), 10), token);
-            }
-            if (text.startsWith('@disabled')) {
-                const value = text.slice(9).trim();
-                this.annBuffer.setDisabled(value.length === 0 ? true : text.slice(9).trim() === 'true', token);
-            }
-            if (text.startsWith('@tags ')) {
-                const value = text
-                    .slice(6)
-                    .trim()
-                    .split(',')
-                    .map(tag => tag.trim());
-                this.annBuffer.setTags(value, token);
-            }
-        }
-    }
-    takeAnnotations(owner) {
-        const ann = this.annBuffer.clone();
-        this.annBuffer.clear();
-        const allowed = AnnotationAllowed[owner];
-        for (const key of Object.keys(ann['store'])) {
-            const entry = ann.get(key);
-            if (!entry)
-                continue;
-            if (!allowed.has(key)) {
-                this.stream.syntaxError(`Annotation @${key} is not allowed on ${owner}. Allowed: ${[...allowed]
-                    .map(a => '@' + a)
-                    .join(', ')}`, entry.token ?? this.stream.peek());
-            }
-        }
-        return ann;
-    }
-    // -------------------------------------------------------------------------
-    // #region Helpers
-    // -------------------------------------------------------------------------
-    isStartOfPolicy() {
-        return this.stream.check(TokenTypes.EFFECT);
-    }
-    isStartOfGroup() {
-        return this.stream.check(TokenTypes.ALL) || this.stream.check(TokenTypes.ANY);
-    }
-    isStartOfRule() {
-        return (this.stream.check(TokenTypes.IDENTIFIER) ||
-            this.stream.check(TokenTypes.ALWAYS) ||
-            this.stream.check(TokenTypes.NEVER));
-    }
-    isStartOfExcept() {
-        return this.stream.check(TokenTypes.EXCEPT);
-    }
-    isStartOfAlias() {
-        return this.stream.check(TokenTypes.ALIAS);
-    }
-}
-
-function ability(strings, ...expr) {
-    const dsl = strings.reduce((acc, s, i) => acc + s + (expr[i] ?? ''), '');
-    return new AbilityDSLParser(dsl).parse();
-}
-
-class AbilityStrategy {
-    policies;
-    matched;
-    constructor(policies) {
-        this.policies = policies;
-        this.matched = policies.filter(p => p.matchState === AbilityMatch.match);
-    }
-    matchedPolicies() {
-        return this.matched;
-    }
-    hasMatched() {
-        return this.matched.length > 0;
-    }
-    firstMatched() {
-        return this.matchedPolicies()[0] ?? null;
-    }
-    lastMatched() {
-        const list = this.matchedPolicies();
-        return list.length > 0 ? list[list.length - 1] : null;
-    }
-    firstDenied() {
-        return this.getDenyPolicies()[0] ?? null;
-    }
-    firstPermitted() {
-        return this.getPermitPolicies()[0] ?? null;
-    }
-    getPermitPolicies() {
-        return this.matched.filter(p => p.effect === AbilityPolicyEffect.permit);
-    }
-    getDenyPolicies() {
-        return this.matched.filter(p => p.effect === AbilityPolicyEffect.deny);
-    }
-    hasPermit() {
-        return this.getPermitPolicies().length > 0;
-    }
-    hasDeny() {
-        return this.getDenyPolicies().length > 0;
-    }
-    isAllowed() {
-        return this.evaluate() === AbilityPolicyEffect.permit;
-    }
-    isDenied() {
-        return this.evaluate() === AbilityPolicyEffect.deny;
-    }
-}
-
-/**
- * AllMustPermitStrategy
- *
- * This strategy requires *every applicable policy* to return "permit".
- * If at least one policy returns "deny" or "not applicable", the final result is "deny".
- *
- * Use this strategy when:
- * - You want strict, conservative access control.
- * - All rules must explicitly allow the action.
- *
- * Example:
- *   Policies:
- *     P1 → permit
- *     P2 → permit
- *     P3 → deny
- *   Result: deny (because not all policies permitted)
- */
-class AllMustPermitStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        // 1. Нет совпавших политик → deny, но решающей политики нет
-        if (!this.hasMatched()) {
-            this._decisive = null;
-            return AbilityPolicyEffect.deny;
-        }
-        // 2. Если есть deny — она решающая
-        const deny = this.firstDenied();
-        if (deny) {
-            this._decisive = deny;
-            return AbilityPolicyEffect.deny;
-        }
-        this._decisive = this.firstPermitted();
-        return AbilityPolicyEffect.permit;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-/**
- * AnyPermitStrategy
- *
- * This strategy returns "permit" as soon as *any* applicable policy permits the action.
- * If no policy permits, the result is "deny".
- *
- * Use this strategy when:
- * - You want optimistic access control.
- * - A single positive rule should be enough to grant access.
- *
- * Example:
- *   Policies:
- *     P1 → deny
- *     P2 → permit
- *     P3 → deny
- *   Result: permit (because at least one policy permitted)
- */
-class AnyPermitStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        // 1. Если есть permit — он решающий
-        const permit = this.firstPermitted();
-        if (permit) {
-            this._decisive = permit;
-            return AbilityPolicyEffect.permit;
-        }
-        // 2. Нет permit → deny по умолчанию
-        this._decisive = null;
-        return AbilityPolicyEffect.deny;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-/**
- * DenyOverridesStrategy
- *
- * This strategy gives absolute priority to "deny".
- * If any applicable policy returns "deny", the final result is "deny".
- * Otherwise, if at least one policy permits, the result is "permit".
- *
- * Use this strategy when:
- * - Security is critical.
- * - A single denial must block access.
- *
- * Example:
- *   Policies:
- *     P1 → permit
- *     P2 → deny
- *     P3 → permit
- *   Result: deny (because deny overrides everything)
- */
-class DenyOverridesStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        // 1. Если есть deny — он решающий
-        const deny = this.firstDenied();
-        if (deny) {
-            this._decisive = deny;
-            return AbilityPolicyEffect.deny;
-        }
-        // 2. Если есть permit — он решающий
-        const permit = this.firstPermitted();
-        if (permit) {
-            this._decisive = permit;
-            return AbilityPolicyEffect.permit;
-        }
-        // 3. Нет ни permit, ни deny → deny по умолчанию
-        this._decisive = null;
-        return AbilityPolicyEffect.deny;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-/**
- * FirstMatchStrategy
- *
- * This strategy evaluates policies in order and returns the result of the *first applicable* policy.
- * Remaining policies are ignored.
- *
- * Use this strategy when:
- * - Policy order matters.
- * - You want predictable, sequential rule evaluation.
- *
- * Example:
- *   Policies:
- *     P1 → not applicable
- *     P2 → permit
- *     P3 → deny
- *   Result: permit (P2 is the first applicable)
- */
-class FirstMatchStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        const first = this.firstMatched();
-        // Если нет совпавших политик → deny по умолчанию
-        if (!first) {
-            this._decisive = null;
-            return AbilityPolicyEffect.deny;
-        }
-        // Первая совпавшая политика — решающая
-        this._decisive = first;
-        return first.effect;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-/**
- * OnlyOneApplicableStrategy
- *
- * This strategy requires that *exactly one* policy is applicable.
- * If zero or more than one policy applies, the result is "deny".
- *
- * Use this strategy when:
- * - Policies must be mutually exclusive.
- * - You want to detect ambiguous or conflicting rules.
- *
- * Example:
- *   Policies:
- *     P1 → applicable
- *     P2 → applicable
- *   Result: deny (more than one applicable policy)
- */
-class OnlyOneApplicableStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        const matched = this.matchedPolicies();
-        // 1. Ровно одна совпавшая политика → она решающая
-        if (matched.length === 1) {
-            this._decisive = matched[0];
-            return matched[0].effect;
-        }
-        // 2. Иначе deny, решающей политики нет
-        this._decisive = null;
-        return AbilityPolicyEffect.deny;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-/**
- * PermitOverridesStrategy
- *
- * This strategy gives priority to "permit".
- * If any applicable policy permits, the final result is "permit".
- * Deny is returned only if no policy permits.
- *
- * Use this strategy when:
- * - You want permissive behavior.
- * - A single positive rule should override denials.
- *
- * Example:
- *   Policies:
- *     P1 → deny
- *     P2 → permit
- *     P3 → deny
- *   Result: permit (permit overrides deny)
- */
-class PermitOverridesStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        // 1. Если есть permit — он выигрывает
-        const permit = this.matchedPolicies().find(p => p.effect === AbilityPolicyEffect.permit);
-        if (permit) {
-            this._decisive = permit;
-            return AbilityPolicyEffect.permit;
-        }
-        // 2. Если permit нет — ищем deny
-        const deny = this.matchedPolicies().find(p => p.effect === AbilityPolicyEffect.deny);
-        if (deny) {
-            this._decisive = deny;
-            return AbilityPolicyEffect.deny;
-        }
-        // 3. Нет ни permit, ни deny → deny по умолчанию
-        this._decisive = null;
-        return AbilityPolicyEffect.deny;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-/**
- * SequentialLastMatchStrategy
- *
- * This strategy evaluates all applicable policies in order and returns the result of the *last* applicable one.
- *
- * Use this strategy when:
- * - Later policies should override earlier ones.
- * - You want a "last rule wins" behavior.
- *
- * Example:
- *   Policies:
- *     P1 → permit
- *     P2 → deny
- *     P3 → permit
- *   Result: permit (P3 is the last applicable)
- */
-class SequentialLastMatchStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        const last = this.lastMatched();
-        // Нет совпавших политик → deny по умолчанию
-        if (!last) {
-            this._decisive = null;
-            return AbilityPolicyEffect.deny;
-        }
-        // Последняя совпавшая политика — решающая
-        this._decisive = last;
-        return last.effect;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-/**
- * PriorityStrategy
- *
- * This strategy evaluates policies based on their numeric priority.
- * The policy with the highest priority (lowest number or highest number depending on implementation)
- * determines the final result.
- *
- * Use this strategy when:
- * - Policies have explicit priority levels.
- * - You want deterministic resolution based on ranking.
- *
- * Example:
- *   Policies:
- *     P1 (priority 10) → deny
- *     P2 (priority 1)  → permit
- *   Result: permit (P2 has higher priority)
- */
-class PriorityStrategy extends AbilityStrategy {
-    _decisive = null;
-    evaluate() {
-        const matched = this.matchedPolicies();
-        // 1. Нет совпавших политик → deny, решающей политики нет
-        if (matched.length === 0) {
-            this._decisive = null;
-            return AbilityPolicyEffect.deny;
-        }
-        // 2. Сортируем по приоритету (больший приоритет — выше)
-        const sorted = [...matched].sort((a, b) => b.priority - a.priority);
-        // 3. Самая приоритетная политика — решающая
-        const top = sorted[0];
-        this._decisive = top;
-        return top.effect;
-    }
-    decisivePolicy() {
-        return this._decisive;
-    }
-}
-
-export { AbilityCompare, AbilityCondition, AbilityDSLLexer, AbilityDSLParser, AbilityDSLToken, AbilityError, AbilityExplain, AbilityExplainPolicy, AbilityExplainRule, AbilityExplainRuleSet, AbilityJSONParser, AbilityMatch, AbilityParserError, AbilityPolicy, AbilityPolicyEffect, AbilityResolver, AbilityResult, AbilityRule, AbilityRuleSet, AbilityStrategy, AbilityTypeGenerator, AllMustPermitStrategy, AnyPermitStrategy, DenyOverridesStrategy, FirstMatchStrategy, OnlyOneApplicableStrategy, PermitOverridesStrategy, PriorityStrategy, SequentialLastMatchStrategy, TokenTypes, ability, fromLiteral, isConditionEqual, isConditionNotEqual, toLiteral };
+const t={or:"or",and:"and"};class e extends Error{constructor(t,e){super(t,e),this.name="AbilityError",Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}}class s extends Error{constructor(t,e){super(t,e),this.name="AbilityParserError",Error.captureStackTrace&&Error.captureStackTrace(this,this.constructor)}}const i={equals:"=",defined:"defined",not_defined:"not_defined",not_equals:"<>",greater_than:">",less_than:"<",less_or_equal:"<=",greater_or_equal:">=",in:"in",not_in:"not in",contains:"contains",not_contains:"not contains",length_greater_than:"length greater than",length_less_than:"length less than",length_equals:"length equals",always:"always",never:"never"};function r(t){const e={equals:i.equals,not_equals:i.not_equals,greater_than:i.greater_than,less_than:i.less_than,less_or_equal:i.less_or_equal,greater_or_equal:i.greater_or_equal,in:i.in,not_in:i.not_in,contains:i.contains,not_contains:i.not_contains,length_greater_than:i.length_greater_than,length_less_than:i.length_less_than,length_equals:i.length_equals,always:i.always,never:i.never,defined:i.defined,not_defined:i.not_defined},r=e[t];if(!r){const i=Object.keys(e).join(", ");throw new s(`Literal "${t}" does not found in AbilityCondition. Expected one of: ${i}`)}return r}function n(t){switch(t){case i.equals:return"equals";case i.not_equals:return"not_equals";case i.greater_than:return"greater_than";case i.less_than:return"less_than";case i.less_or_equal:return"less_or_equal";case i.greater_or_equal:return"greater_or_equal";case i.in:return"in";case i.not_in:return"not_in";case i.contains:return"contains";case i.not_contains:return"not_contains";case i.length_greater_than:return"length_greater_than";case i.length_less_than:return"length_less_than";case i.length_equals:return"length_equals";case i.always:return"always";case i.never:return"never";case i.defined:return"defined";case i.not_defined:return"not_defined";default:return"never"}}function a(t,e){return null!==t&&null!==e&&t===e}function o(t,e){return!a(t,e)}const c={pending:"pending",match:"match",mismatch:"mismatch",exceptMismatch:"except-mismatch",disabled:"disabled"};class h{type;children;name;match;debugInfo;constructor(t,e=[]){this.type=t.type,this.children=e,this.name=t.name,this.match=t.match,this.debugInfo=t.debugInfo}toString(t="",e=!0){const s=this.match===c.match,i=this.match===c.mismatch,r=this.match===c.pending,n=s?"<match ✓>":i?"<mismatch ✗>":r?"<pending …>":"<disabled ⊘>";let a;switch(this.type){case"policy":a="POLICY";break;case"ruleSet":a="RULESET";break;default:a="RULE"}let o=`${t}${0===t.length?"":e?"└─ ":"├─ "}${a} ${this.name} — ${n}`;this.debugInfo&&(o+=` (${this.debugInfo})`);const h=t+(e?"   ":"│  ");return this.children.forEach((t,e)=>{o+="\n"+t.toString(h,e===this.children.length-1)}),o}}class l extends h{constructor(t){super({type:"rule",match:t.state,name:t.name,debugInfo:`${t.subject} ${t.condition} ${JSON.stringify(t.resource)}`})}}class u extends h{constructor(t){const e=t.rules.map(t=>new l(t));super({type:"ruleSet",match:t.state,name:t.name},e)}}class d extends h{constructor(t){const e=t.ruleSet.map(t=>new u(t));super({type:"policy",name:t.priority>-1?`@priority ${t.priority} ${t.name}`:t.name,match:t.matchState},e)}}class m{effect;strategy;constructor(t,e){this.effect=t,this.strategy=e}explain(){return`${this.strategy.isDenied()?"== DENIED==":"== ALLOWED =="}\n${this.strategy.policies.map(t=>new d(t).toString()).join("\n")}\n`}decisive(){return this.strategy.decisivePolicy()}explainDecisive(){const t=this.decisive();return t?new d(t).toString():null}isAllowed=()=>this.strategy.isAllowed();isDenied=()=>this.strategy.isDenied()}const p={deny:"deny",permit:"permit"};class f{onDeny;onAllow;StrategyClass;policyEntries;constructor(t,e,s={}){const i=this.toArray(t);this.onDeny=s.onDeny,this.onAllow=s.onAllow;const r=[...s.tags?i.filter(t=>t.tags.some(t=>s.tags.includes(t))):i].sort((t,e)=>e.priority-t.priority);this.policyEntries=r.map(t=>({policy:t,normalizedPermission:f.normalizePermission(t.permission),segments:f.normalizePermission(t.permission).split(".")})),this.StrategyClass=e}resolve(t,s,i){const r=f.normalizePermission(String(t)).split("."),n=this.policyEntries.filter(t=>f.matchPermissions(t.segments,r)).map(t=>t.policy);for(const t of n)if(!t.disabled&&t.check(s,i)===c.pending)throw new e(`The policy "${t.name}" is still in a pending state. Make sure to call "check" to evaluate the policy before resolving permissions.`);const a=new this.StrategyClass(n),o=a.evaluate(),h=new m(o,a);return o===p.deny&&this.onDeny&&this.onDeny(h),o===p.permit&&this.onAllow&&this.onAllow(h),h}enforce(t,s,i,r){const n=this.resolve(t,s,i);if(n.isDenied())throw r?.onDeny&&r?.onDeny(n),new e("Permission denied")}static isInPermissionContain(t,e){const s=t.split("."),i=e.split("."),[r,n]=s.length>=i.length?[s,i]:[i,s];return n.every((t,e)=>"*"===t||"*"===r[e]||t===r[e])}toArray(t){return[...Array.isArray(t)?t:[t]]}static normalizePermission(t){return t.trim().replace(/^permission\./,"").replace(/\.+/g,".").toLowerCase()}static matchPermissions(t,e){let s=0;for(;s<t.length;s++){const i=t[s],r=e[s];if("*"===i)return!0;if(void 0===r)return!1;if(i!==r)return!1}return s===e.length}}class y{policies;policyEntries;constructor(t){this.policies=t,this.policyEntries=t.map(t=>({policy:t,normalizedPermission:f.normalizePermission(t.permission),segments:f.normalizePermission(t.permission).split(".")}))}generateTypeDefs(){const t={},e={},s=new Set;this.policies.forEach(i=>{i.tags.forEach(t=>s.add(t));const r=i.permission;t[r]||(t[r]={}),i.ruleSet.forEach(s=>{s.rules.forEach(s=>{const i=s.subject,n=this.determineTypeFromRule(s);if(n){if(i.startsWith("env.")){const t=i.replace(/^env\./,"");e[r]||(e[r]={}),e[r][t]=n}else{const e=t[r][i];t[r][i]=e&&e!==n?`${e} | ${n}`:n}if("string"==typeof s.resource&&this.isPath(s.resource)){const i=s.resource;if(i.startsWith("env.")){const t=i.replace(/^env\./,"");e[r]||(e[r]={});const s=e[r][t],a=n;e[r][t]=s&&s!==a?`${s} | ${a}`:a}else{t[r]||(t[r]={});const e=t[r][i],s=n;t[r][i]=e&&e!==s?`${e} | ${s}`:s}}}})})});const i={};Object.entries(t).forEach(([t,e])=>{t.endsWith(".*")||(i[t]=e)});const r=this.buildNestedStructure(i),n=this.buildNestedStructure(e);return this.formatTypeDefinitions(r,n,s)}isPath(t){return"string"==typeof t&&!t.startsWith('"')&&!t.startsWith("'")&&t.includes(".")}determineTypeFromRule(t){return t.condition===i.never||t.condition===i.always?null:t.condition===i.contains||t.condition===i.not_contains?this.getArrayType(t.resource):t.condition===i.length_equals||t.condition===i.length_greater_than||t.condition===i.length_less_than?"string | readonly unknown[]":t.condition===i.greater_than||t.condition===i.greater_or_equal||t.condition===i.less_than||t.condition===i.less_or_equal?"number":t.condition===i.in||t.condition===i.not_in?this.getInArrayType(t.resource):t.condition===i.equals||t.condition===i.not_equals?this.getPrimitiveType(t.resource):"any"}getArrayType(t){return`readonly ${this.getInArrayType(t)}[]`}getInArrayType(t){if(Array.isArray(t)){if(0===t.length)return"unknown";const e=new Set(t.map(t=>this.getPrimitiveType(t)));return 1===e.size?Array.from(e)[0]:`(${Array.from(e).join(" | ")})`}return this.getPrimitiveType(t)}getPrimitiveType(t){if(null===t)return"null | unknown";if(void 0===t)return"undefined";if("string"==typeof t&&this.isPath(t))return"unknown";switch(typeof t){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"object":return Array.isArray(t)?"array":"object";default:return"any"}}buildNestedStructure(t){const e={};return Object.entries(t).forEach(([t,s])=>{e[t]={},Object.entries(s).forEach(([s,i])=>{const r=s.split(".");let n=e[t];for(let t=0;t<r.length-1;t++){const e=r[t],s=n[e];if(s&&"object"==typeof s)n=s;else{const t={};n[e]=t,n=t}}n[r[r.length-1]]=i})}),e}formatTypeDefinitions(t,e,s){let i="// Automatically generated by via-profit/ability\n";i+="// Do not edit manually\n",i+="export type Resources = {\n",Object.keys(t).sort().forEach(e=>{const s=t[e],r=0===Object.keys(s).length,n=f.normalizePermission(e).split("."),a=this.policyEntries.filter(t=>f.matchPermissions(t.segments,n)).map(t=>t.policy),o=[...new Set(a.map(t=>t.effect))].sort(),c=a.sort((t,e)=>t.id.localeCompare(e.id)).map(t=>{const e=t.effect.padEnd(6," "),s=t.name===t.id?"Unnamed policy":t.name;return`  *   - ${e} ${t.id}  "${s}"`}).join("\n");i+=`\n /**\n  * Permission: ${e}\n  * Effects: ${o.join(", ")}\n  * Policies:\n${c}\n  */\n`,r?i+=`  ['${e}']: undefined;\n`:(i+=`  ['${e}']: {\n`,i+=this.formatNestedObject(s,4),i+="  } | null | undefined;\n")}),i+="}\n";const r=s.size>0?Array.from(s).sort().map(t=>`'${t}'`).join(" | "):"never";return i+=`\n\nexport type PolicyTags = ${r};\n`,i+="\n\nexport type Environment = {\n",Object.entries(e).forEach(([t,e])=>{const s=0===Object.keys(e).length,r=f.normalizePermission(t).split("."),n=this.policyEntries.filter(t=>f.matchPermissions(t.segments,r)).map(t=>t.policy),a=[...new Set(n.map(t=>t.effect))].sort(),o=n.sort((t,e)=>t.id.localeCompare(e.id)).map(t=>{const e=t.effect.padEnd(6," "),s=t.name===t.id?"Unnamed policy":t.name;return`  *   - ${e} ${t.id}  "${s}"`}).join("\n");i+=`\n /**\n  * Permission: ${t}\n  * Effects: ${a.join(", ")}\n  * Policies:\n${o}\n  */\n`,s?i+=`  ['${t}']: undefined;\n`:(i+=`  ['${t}']: {\n`,i+=this.formatNestedObject(e,4),i+="  } | null | undefined;\n")}),i+="}\n",i}formatNestedObject(t,e){const s=" ".repeat(e);let i="";return Object.keys(t).sort().forEach(r=>{const n=t[r];if("object"==typeof n&&null!==n)i+=`${s}readonly ${r}: {\n`,i+=this.formatNestedObject(n,e+2),i+=`${s}} | null | undefined;\n`;else{const t=[String(n)];let e=String(n);e.match(/unknown/)||(e.match(/null/)||t.push("null"),e.match(/undefined/)||t.push("undefined")),i+=`${s}readonly ${r}: ${t.join(" | ")} \n`}}),i}}class g{static sha1(t){const e=g.stringToBytes(t),s=8*e.length,i=new Uint8Array(e.length+1);i.set(e,0),i[e.length]=128;let r=(56-i.length%64+64)%64;const n=new Uint8Array(i.length+r+8);n.set(i,0);const a=Math.floor(s/4294967296),o=s>>>0;n[n.length-8]=a>>>24&255,n[n.length-7]=a>>>16&255,n[n.length-6]=a>>>8&255,n[n.length-5]=255&a,n[n.length-4]=o>>>24&255,n[n.length-3]=o>>>16&255,n[n.length-2]=o>>>8&255,n[n.length-1]=255&o;let c=1732584193,h=4023233417,l=2562383102,u=271733878,d=3285377520;const m=new Array(80);for(let t=0;t<n.length;t+=64){for(let e=0;e<16;e++){const s=t+4*e;m[e]=n[s]<<24|n[s+1]<<16|n[s+2]<<8|n[s+3]}for(let t=16;t<80;t++)m[t]=g.leftRotate(m[t-3]^m[t-8]^m[t-14]^m[t-16],1);let e=c,s=h,i=l,r=u,a=d;for(let t=0;t<80;t++){let n,o;t<20?(n=s&i|~s&r,o=1518500249):t<40?(n=s^i^r,o=1859775393):t<60?(n=s&i|s&r|i&r,o=2400959708):(n=s^i^r,o=3395469782);const c=g.leftRotate(e,5)+n+a+o+(0|m[t])|0;a=r,r=i,i=g.leftRotate(s,30),s=e,e=c}c=c+e|0,h=h+s|0,l=l+i|0,u=u+r|0,d=d+a|0}return[g.toHex32(c),g.toHex32(h),g.toHex32(l),g.toHex32(u),g.toHex32(d)].join("")}static leftRotate(t,e){return(t<<e|t>>>32-e)>>>0}static toHex32(t){return(t>>>0).toString(16).padStart(8,"0")}static stringToBytes(t){if("undefined"!=typeof TextEncoder)return(new TextEncoder).encode(t);{const e=Buffer.from(t,"utf8");return new Uint8Array(e.buffer,e.byteOffset,e.byteLength)}}}class E{matchState=c.pending;ruleSet=[];effect;compareMethod=t.and;id;name;description;permission;priority=-1;disabled;tags;constructor(e){const{name:s,description:i,id:r,permission:n,effect:a,compareMethod:o=t.and,priority:c,disabled:h,tags:l}=e;this.permission=n,this.description=i,this.effect=a,this.compareMethod=o,this.priority="number"==typeof c?c:-1,this.disabled="boolean"==typeof h&&h,this.tags=l||[],this.id=r||`p_${this.hash().slice(0,10)}`,this.name=s||this.id}addRuleSet(t){return this.ruleSet.push(t),this}addRuleSets(t){for(const e of t)this.ruleSet.push(e);return this}extractRules(){const t=[];for(const e of this.ruleSet)for(const s of e.rules)t.push(s);return t}check(e,s){if(this.matchState=c.mismatch,this.disabled)return this.matchState=c.disabled,this.matchState;if(!this.ruleSet.length)return this.matchState;const i=this.ruleSet.filter(t=>!t.isExcept),r=this.ruleSet.filter(t=>t.isExcept),n=[];for(const r of i){if(r.disabled)continue;const i=r.check(e,s);if(n.push(i),t.and===this.compareMethod&&c.mismatch===i)return this.matchState=c.mismatch,this.matchState;if(t.or===this.compareMethod&&c.match===i){this.matchState=c.match;break}}let a=!1;if(a=t.and===this.compareMethod?n.every(t=>c.match===t):n.some(t=>c.match===t),!a)return this.matchState=c.mismatch,this.matchState;for(const t of r){if(t.disabled)continue;const i=t.check(e,s);if(c.match===i)return this.matchState=c.exceptMismatch,this.matchState}return this.matchState=c.match,this.matchState}explain(){if(this.matchState===c.pending)throw new e("First, run the check method, then explain");return new d(this)}copyWith(t){const e=new E({id:t.id??this.id,name:t.name??this.name,description:t.description??this.description,priority:void 0!==t.priority?t.priority:this.priority,permission:t.permission??this.permission,effect:t.effect??this.effect,compareMethod:t.compareMethod??this.compareMethod}),s=t.ruleSet??this.ruleSet;for(const t of s)e.addRuleSet(t);return e}hash(){const t=[`permission:${this.permission}`,`effect:${this.effect}`,`compareMethod:${this.compareMethod}`,`priority:${this.priority}`,`disabled:${this.disabled}`];if(this.tags&&this.tags.length>0&&t.push(`tags:${[...this.tags].sort().join(",")}`),this.ruleSet&&this.ruleSet.length>0){const e=this.ruleSet.map(t=>t.hash());t.push(`rules:${e.sort().join("|")}`)}const e=t.join(";");return g.sha1(e)}}class _{subject;resource;condition;name;description;id;state=c.pending;disabled;constructor(t){const{id:e,name:s,subject:i,resource:r,condition:n,disabled:a,description:o}=t;this.description=o,this.disabled="boolean"==typeof a&&a,this.subject=i,this.resource=r,this.condition=n,this.state=this.disabled?c.disabled:this.state,this.id=e||`r_${this.hash().slice(0,10)}`,this.name=s||this.id}static isPrimitive(t){return"string"==typeof t||"number"==typeof t||"boolean"==typeof t||null===t}static isNumber(t){return"number"==typeof t}static isString(t){return"string"==typeof t}static valueLen=t=>this.isString(t)||Array.isArray(t)?t.length:null;static operatorHandlers={[n(i.always)]:()=>!0,[n(i.defined)]:t=>void 0!==t,[n(i.not_defined)]:t=>void 0===t,[n(i.never)]:()=>!1,[n(i.equals)]:(t,e)=>t===e,[n(i.not_equals)]:(t,e)=>t!==e,[n(i.contains)]:(t,e)=>Array.isArray(t)&&_.isPrimitive(e)?t.includes(e):!(!Array.isArray(t)||!Array.isArray(e))&&t.some(t=>e.includes(t)),[n(i.not_contains)]:(t,e)=>Array.isArray(t)&&_.isPrimitive(e)?!t.includes(e):!(!Array.isArray(t)||!Array.isArray(e)||t.some(t=>e.includes(t))),[n(i.in)]:(t,e)=>_.isPrimitive(t)&&Array.isArray(e)?e.includes(t):!(!Array.isArray(t)||!Array.isArray(e))&&t.some(t=>e.includes(t)),[n(i.not_in)]:(t,e)=>_.isPrimitive(t)&&Array.isArray(e)?!e.includes(t):!(!Array.isArray(t)||!Array.isArray(e)||t.some(t=>e.includes(t))),[n(i.greater_than)]:(t,e)=>!(!_.isNumber(t)||!_.isNumber(e))&&t>e,[n(i.less_than)]:(t,e)=>!(!_.isNumber(t)||!_.isNumber(e))&&t<e,[n(i.greater_or_equal)]:(t,e)=>!(!_.isNumber(t)||!_.isNumber(e))&&t>=e,[n(i.less_or_equal)]:(t,e)=>!(!_.isNumber(t)||!_.isNumber(e))&&t<=e,[n(i.length_greater_than)]:(t,e)=>{const s=_.valueLen(t);if(null===s)return!1;if(_.isNumber(e))return s>e;const i=_.valueLen(e);return null!==i&&s>i},[n(i.length_less_than)]:(t,e)=>{const s=_.valueLen(t);if(null===s)return!1;if(_.isNumber(e))return s<e;const i=_.valueLen(e);return null!==i&&s<i},[n(i.length_equals)]:(t,e)=>{const s=_.valueLen(t);if(null===s)return!1;if(_.isNumber(e))return s===e;const i=_.valueLen(e);return null!==i&&s===i}};check(t,e){if(this.disabled)return this.state=c.disabled,this.state;const[s,i]=this.extractValues(t,e),r=(0,_.operatorHandlers[n(this.condition)])(s,i);return this.state=r?c.match:c.mismatch,this.state}extractValues(t,e){let s,i;return null==t&&null==e?[NaN,NaN]:(s=this.subject.includes(".")?this.subject.startsWith("env.")&&void 0!==e?this.getDotNotationValue(e,this.subject.replace(/^env\./,"")):this.getDotNotationValue(t,this.subject):this.subject,i="string"==typeof this.resource&&this.resource.includes(".")?this.resource.startsWith("env.")&&void 0!==e?this.getDotNotationValue(e,this.resource.replace(/^env\./,"")):this.getDotNotationValue(t,this.resource):this.resource,[s,i])}static _pathCache=new Map;static _parsePath(t){const e=_._pathCache.get(t);if(e)return e;const s=t.split("."),i=[];for(const t of s){const e=t.indexOf("[");if(-1!==e){const s=t.slice(0,e),r=t.slice(e+1,-1),n=Number(r);i.push({prop:s,index:n})}else i.push(t)}return _._pathCache.set(t,i),i}getDotNotationValue(t,e){if(null==t)return;const s=_._parsePath(e);let i=t;for(const t of s){if(null==i)return;if("string"==typeof t)i=i[t];else{const e=i[t.prop];i=Array.isArray(e)?e[t.index]:void 0}}return i}toString(){return`AbilityRule: ${this.name} condition: ${n(this.condition)} subject: "${this.subject?.toString()}" resource: "${this.resource?.toString()}"`}copyWith(t){return new _({id:t.id??this.id,name:t.name??this.name,description:t.description??this.description,subject:t.subject??this.subject,resource:t.resource??this.resource,condition:t.condition??this.condition})}hash(){const t=[];return t.push(`subject:${this.subject}`),t.push(`resource:${JSON.stringify(this.resource)}`),t.push(`condition:${this.condition}`),t.push(`disabled:${this.disabled}`),g.sha1(t.join(";"))}static equals(t,e){return new _({condition:i.equals,subject:t,resource:e})}static notEquals(t,e){return new _({condition:i.not_equals,subject:t,resource:e})}static contains(t,e){return new _({condition:i.contains,subject:t,resource:e})}static notContains(t,e){return new _({condition:i.not_contains,subject:t,resource:e})}static notIn(t,e){return new _({condition:i.not_in,subject:t,resource:e})}static in(t,e){return new _({condition:i.in,subject:t,resource:e})}static notEqual(t,e){return new _({condition:i.not_equals,subject:t,resource:e})}static lessThan(t,e){return new _({condition:i.less_than,subject:t,resource:e})}static lessOrEqual(t,e){return new _({condition:i.less_or_equal,subject:t,resource:e})}static moreThan(t,e){return new _({condition:i.greater_than,subject:t,resource:e})}static moreOrEqual(t,e){return new _({condition:i.greater_or_equal,subject:t,resource:e})}}class v{state=c.pending;rules=[];compareMethod=t.and;name;description;id;isExcept=!1;disabled;constructor(t){const{name:e,id:s,compareMethod:i,isExcept:r,disabled:n,description:a}=t;this.description=a,this.compareMethod=i,this.isExcept=r,this.disabled="boolean"==typeof n&&n,this.state=this.disabled?c.disabled:this.state,this.id=s||`g_${this.hash().slice(0,10)}`,this.name=e||this.id}addRule(t){return this.rules.push(t),this}addRules(t){return t.forEach(t=>this.addRule(t)),this}check(e,s){if(this.state=c.mismatch,this.disabled)return this.state=c.disabled,this.state;if(!this.rules.length)return this.state;const i=[];for(const r of this.rules){if(r.disabled)continue;const n=r.check(e,s);if(i.push(n),t.and===this.compareMethod&&c.mismatch===n)return this.state;if(t.or===this.compareMethod&&c.match===n)return this.state=c.match,this.state}return t.and===this.compareMethod&&i.every(t=>c.match===t)&&(this.state=c.match),t.or===this.compareMethod&&i.some(t=>c.match===t)&&(this.state=c.match),this.state}toString(){return`AbilityRuleSet: ${this.name} compareMethod: ${this.compareMethod}, rules: ${this.rules.map(t=>t.toString()).join("\n")}`}copyWith(t){const e=new v({id:t.id??this.id,name:t.name??this.name,description:t.description??this.description,compareMethod:t.compareMethod??this.compareMethod}),s=t.rules??this.rules;for(const t of s)e.addRule(t);return e}hash(){const t=this.rules.map(t=>t.hash()).sort(),e=[`compareMethod:${this.compareMethod}`,`isExcept:${this.isExcept}`,`disabled:${this.disabled}`,`rules:${t.join("|")}`];return g.sha1(e.join(";"))}static and(e){return new v({compareMethod:t.and}).addRules(e)}static or(e){return new v({compareMethod:t.or}).addRules(e)}}class N{static parse(t){return t.map(t=>N.parsePolicy(t))}static parsePolicy(t){const{id:e,name:s,ruleSet:i,compareMethod:r,permission:n,effect:a,priority:o,disabled:c,tags:h}=t,l=new E({name:s,id:e,permission:n,priority:o,effect:a,disabled:c,tags:h});return l.compareMethod=r,i.forEach(t=>{l.addRuleSet(N.parseRuleSet(t))}),l}static parseRule(t){const{id:e,name:s,subject:i,resource:r,condition:n,disabled:a}=t;return new _({id:e,name:s,subject:i,resource:r,disabled:a,condition:n})}static parseRuleSet(t){const{id:e,name:s,rules:i,compareMethod:r,disabled:n}=t,a=new v({disabled:n,compareMethod:r,name:s,id:e});if(i&&i.length>0){const t=i.map(t=>N.parseRule(t));a.addRules(t)}return a}static ruleToJSON(t){return{id:t.id,name:t.name,disabled:t.disabled,subject:t.subject,resource:t.resource,condition:t.condition}}static ruleSetToJSON(t){return{id:t.id.toString(),name:t.name.toString(),disabled:t.disabled,compareMethod:t.compareMethod,rules:t.rules.map(t=>N.ruleToJSON(t))}}static policyToJSON(t){return{id:t.id.toString(),name:t.name.toString(),disabled:t.disabled,priority:t.priority,permission:t.permission,effect:t.effect,compareMethod:t.compareMethod,tags:t.tags,ruleSet:t.ruleSet.map(t=>N.ruleSetToJSON(t))}}static toJSON(t){return t.map(t=>N.policyToJSON(t))}}const A={EFFECT:"EFFECT",IF:"IF",PERMISSION:"PERMISSION",IDENTIFIER:"IDENTIFIER",COLON:"COLON",COMMA:"COMMA",DOT:"DOT",LBRACKET:"LBRACKET",RBRACKET:"RBRACKET",ALL:"ALL",ANY:"ANY",OF:"OF",EOF:"EOF",COMMENT:"COMMENT",EQ:"EQ",CONTAINS:"CONTAINS",IN:"IN",NOT_IN:"NOT_IN",NOT_CONTAINS:"NOT_CONTAINS",GT:"GT",GTE:"GTE",LT:"LT",LTE:"LTE",NULL:"NULL",EQ_NULL:"EQ_NULL",NOT_EQ_NULL:"NOT_EQ_NULL",DEFINED:"DEFINED",NOT_EQ:"NOT_EQ",LEN_GT:"LEN_GT",LEN_LT:"LEN_LT",LEN_EQ:"LEN_EQ",ALWAYS:"ALWAYS",NEVER:"NEVER",EXCEPT:"EXCEPT",ANNOTATION:"ANNOTATION",STRING:"STRING",NUMBER:"NUMBER",BOOLEAN:"BOOLEAN",SYMBOL:"SYMBOL",KEYWORD:"KEYWORD",ALIAS:"ALIAS",UNKNOWN:"UNKNOWN"};class S{type;value;line;column;constructor(t,e,s,i){this.type=t,this.value=e,this.line=s,this.column=i}toString(){return`AbilityDSLToken([${this.type}] "${this.value}" at ${this.line}:${this.column})`}}class b{input;pos=0;tokens=[];line=1;column=1;keywords=new Set(["if","all","any","of","permit","allow","deny","forbidden","true","false","null","defined","contains","includes","length","len","has","in","gt","lt","gte","lte","equals","greater","less","not","is","or","than","always","never","except","alias"]);constructor(t){this.input=t}tokenize(){for(;!this.isAtEnd()&&(this.skipWhitespace(),!this.isAtEnd());){const t=this.peek();if("@"!==t)if("#"!==t)if('"'!==t&&"'"!==t)if(this.isDigit(t))this.tokens.push(this.readNumber());else if(this.isSymbol(t))this.tokens.push(this.readSymbol());else{if(!this.isAlpha(t))throw new Error(`Unexpected character '${t}' at ${this.line}:${this.column}`);this.tokens.push(this.readWord())}else this.tokens.push(this.readString());else this.tokens.push(this.readComment());else this.tokens.push(this.readAnnotation())}return this.tokens.push(new S(A.EOF,"",this.line,this.column)),this.tokens}readComment(){const t=this.line,e=this.column;this.advance();let s="";for(;!this.isAtEnd()&&!this.isNewline();)s+=this.advance();return new S(A.COMMENT,s.trim(),t,e)}readAnnotation(){const t=this.line,e=this.column;let s="";for(;!this.isAtEnd()&&!this.isNewline();)s+=this.advance();s=s.trim();let i="",r=0,n=!1,a=null,o=!1;for(;r<s.length;){const t=s[r];n?(o?(i+=t,o=!1):"\\"===t?o=!0:t===a?(n=!1,a=null):i+=t,r++):'"'!==t&&"'"!==t?(i+=t,r++):(n=!0,a=t,r++)}return new S(A.ANNOTATION,i.trim(),t,e)}readString(){const t=this.line,e=this.column,s=this.advance();let i="",r=!1;for(;!this.isAtEnd();){const n=this.advance();if(r)i+=n,r=!1;else if("\\"!==n){if(n===s)return new S(A.STRING,i,t,e);i+=n}else r=!0}throw new Error(`Unterminated string at ${t}:${e}`)}readNumber(){const t=this.line,e=this.column,s=this.pos;for(;!this.isAtEnd()&&this.isDigit(this.peek());)this.advance();const i=this.input.slice(s,this.pos);return new S(A.NUMBER,i,t,e)}readSymbol(){const t=this.line,e=this.column,s=this.advance();switch(s){case".":return new S(A.DOT,s,t,e);case":":return new S(A.COLON,s,t,e);case",":return new S(A.COMMA,s,t,e);case"[":return new S(A.LBRACKET,s,t,e);case"]":return new S(A.RBRACKET,s,t,e);case">":return"="===this.peek()?(this.advance(),new S(A.SYMBOL,">=",t,e)):new S(A.SYMBOL,">",t,e);case"<":return"="===this.peek()?(this.advance(),new S(A.SYMBOL,"<=",t,e)):">"===this.peek()?(this.advance(),new S(A.SYMBOL,"<>",t,e)):new S(A.SYMBOL,"<",t,e);case"=":return"="===this.peek()?(this.advance(),new S(A.SYMBOL,"==",t,e)):new S(A.SYMBOL,"=",t,e);case"!":if("="===this.peek())return this.advance(),new S(A.SYMBOL,"!=",t,e);throw new Error(`Unexpected symbol '!' at ${this.line}:${this.column}`);default:throw new Error(`Unknown symbol '${s}' at ${this.line}:${this.column}`)}}readWord(){const t=this.line,e=this.column,s=this.pos;for(;!this.isAtEnd()&&/[a-zA-Z0-9_*]/.test(this.peek());)this.advance();for(;!this.isAtEnd()&&"."===this.peek()&&(this.advance(),/[a-zA-Z_*]/.test(this.peek()));)for(;!this.isAtEnd()&&/[a-zA-Z0-9_*]/.test(this.peek());)this.advance();const i=this.input.slice(s,this.pos);if("always"===i)return new S(A.ALWAYS,i,t,e);if("never"===i)return new S(A.NEVER,i,t,e);if(i.includes(".")){const s=this.tokens[this.tokens.length-1];return s?.type===A.EFFECT&&i.startsWith("permission.")?new S(A.PERMISSION,i,t,e):new S(A.IDENTIFIER,i,t,e)}if(this.keywords.has(i))return"permit"===i||"allow"===i?new S(A.EFFECT,"permit",t,e):"deny"===i||"forbidden"===i?new S(A.EFFECT,"deny",t,e):new S("all"===i?A.ALL:"any"===i?A.ANY:"of"===i?A.OF:"if"===i?A.IF:"true"===i||"false"===i?A.BOOLEAN:"null"===i?A.NULL:"defined"===i?A.DEFINED:"except"===i?A.EXCEPT:"alias"===i?A.ALIAS:A.KEYWORD,i,t,e);const r=this.tokens[this.tokens.length-1];return new S(r?.type===A.EFFECT?A.PERMISSION:A.IDENTIFIER,i,t,e)}skipWhitespace(){for(;!this.isAtEnd()&&/\s/.test(this.peek());)this.advance()}isDigit(t){return t>="0"&&t<="9"}isAlpha(t){return/[a-zA-Z_]/.test(t)}isSymbol(t){return[".",":",",","[","]",">","<","=","!"].includes(t)}isNewline(){return"\n"===this.peek()}peek(){return this.input[this.pos]}advance(){const t=this.input[this.pos++];return"\n"===t?(this.line++,this.column=1):this.column++,t}isAtEnd(){return this.pos>=this.input.length}}class k extends Error{line;column;context;details;_formattedMessage;_originalStack;constructor(t,e,s,i){super(i.split("\n")[0]),this.line=t,this.column=e,this.context=s,this.details=i,this.name="AbilityDSLSyntaxError",Error.captureStackTrace&&Error.captureStackTrace(this,k),this._originalStack=this.stack,this._formattedMessage=this.formatMessage(),Object.defineProperty(this,"stack",{get:()=>this._formattedMessage,configurable:!0})}static supportsColor(){return"undefined"!=typeof process&&process.stdout?.isTTY}formatMessage(){const t=k.supportsColor(),e=t?"":"",s=t?"":"",i=t?"":"",r=t?"":"",n=t?"":"",a=this.context.split("\n"),o=a.findIndex(t=>t.includes("^")||t.includes("~")),c=a.findIndex(t=>t.trim().includes("#")),h=a.map((t,a)=>a===o-1?`${e}${i}${t}${n}`:a===o?`${s}${t}${n}`:a===c?`${r}${t}${n}`:t).join("\n");return`${e}${s}${this.name}: ${this.details}${n}\n\n`+h}toString(){return this._formattedMessage}}class L{tokens;pos=0;dsl;marks=[];lastToken=null;next(){const t=this.tokens[this.pos++];return this.lastToken=t,t}prev(){if(0===this.pos)return null;const t=this.tokens[this.pos--];return this.lastToken=t,t}lookPrev(){return this.lastToken}constructor(t,e){this.tokens=t,this.dsl=e}peek(){return this.tokens[this.pos]}eof(){return this.peek().type===A.EOF}check(t){return!this.eof()&&this.peek().type===t}match(t){return this.check(t)?this.next():null}expect(t,e){const s=this.peek();if(s&&s.type===t)return this.next();this.syntaxError(e,s,[t])}expectOneOf(t,e){const s=this.peek();for(const e of t)if(s&&s.type===e)return this.next();this.syntaxError(e,s,t)}mark(){this.marks.push(this.pos)}reset(){const t=this.marks.pop();void 0!==t&&(this.pos=t)}commit(){this.marks.pop()}syntaxError(t,e,s){const i=this.dsl.split(/\r?\n/),r=e.line-1,n=r>0?i[r-1]:"",a=i[r],o=r+1<i.length?i[r+1]:"",c=" ".repeat(Math.max(0,e.column-1))+"~".repeat(e.value.length),h=String(e.line+1).length,l=t=>String(t).padStart(h," ");let u="";""!==n.trim()&&(u+=`${l(e.line-1)} | ${n}\n`),u+=`${l(e.line)} | ${a}\n`,u+=`${" ".repeat(h)} | ${c}\n`,""!==o.trim()&&(u+=`${l(e.line+1)} | ${o}`);let d=t;if(s&&s?.length>0){const i=e.value,r=this.suggest(i,s),n=`${t}\nDetails: Unexpected value token \`${i}\``;d=r?`${n} Did you mean \`${r}\`?`:n}throw new k(e.line,e.column,u+"\n",d)}suggest(t,e){const s=[];for(const t of e)s.push(t);const i=[...new Set(s)];let r=null,n=3;for(const e of i){const s=this.levenshteinDistance(t.toLowerCase(),e.toLowerCase());s<n&&(n=s,r=e)}return r}levenshteinDistance(t,e){const s=Array.from({length:e.length+1},()=>Array.from({length:t.length+1},()=>0));for(let e=0;e<=t.length;e++)s[0][e]=e;for(let t=0;t<=e.length;t++)s[t][0]=t;for(let i=1;i<=e.length;i++)for(let r=1;r<=t.length;r++){const n=t[r-1]===e[i-1]?0:1;s[i][r]=Math.min(s[i][r-1]+1,s[i-1][r]+1,s[i-1][r-1]+n)}return s[e.length][t.length]}}class O{store={id:void 0,name:void 0,priority:void 0,description:void 0,disabled:void 0,tags:void 0};get(t){return this.store[t]??null}set(t,e,s){return this.store[t]=null===e?void 0:{key:t,value:e,token:s},this}clear(){for(const t of Object.keys(this.store))this.store[t]=void 0}clone(){const t=new O;for(const e of Object.keys(this.store)){const s=this.store[e];t.store[e]=s?{...s}:void 0}return t}get id(){return this.get("id")}get name(){return this.get("name")}get description(){return this.get("description")}get priority(){return this.get("priority")}get disabled(){return this.get("disabled")}get tags(){return this.get("tags")}setID(t,e){return this.set("id",t,e)}setName(t,e){return this.set("name",t,e)}setDescription(t,e){return this.set("description",t,e)}setPriority(t,e){return this.set("priority",t,e)}setDisabled(t,e){return this.set("disabled",t,e)}setTags(t,e){return this.set("tags",t,e)}}const T={policy:new Set(["id","name","description","priority","disabled","tags"]),ruleSet:new Set(["id","name","description","disabled"]),rule:new Set(["id","name","disabled"]),alias:new Set(["name","disabled"])};class x{store=new Map;get(t){return this.store.get(t)||null}set(t,e){return this.store.set(t,e),this}has(t){return this.store.has(t)}}class w{dsl;stream;annBuffer=new O;aliasBuffer=new x;constructor(t){this.dsl=t}parse(){this.annBuffer.clear();const t=new b(this.dsl).tokenize();this.stream=new L(t,this.dsl);const e=[];for(;!this.stream.eof();){if(this.consumeLeadingComments(),this.consumeLeadingAnnotations(),this.consumeLeadingAliases(),!this.isStartOfPolicy()){const t=this.stream.peek();this.stream.syntaxError(`Expected policy, got ${t.type}.`,t,[A.EFFECT])}e.push(this.parsePolicy())}return e}parsePolicy(){this.consumeLeadingComments(),this.consumeLeadingAnnotations(),this.consumeLeadingAliases();const e=this.takeAnnotations("policy"),s=this.stream.expect(A.EFFECT,"Expected effect").value,i=this.stream.expect(A.PERMISSION,"Expected permission"),r=i.value;if(!r.startsWith("permission."))return this.stream.syntaxError(`Unexpected token. The permission key, must be starts with prefix \`permission.\`, but got \`${r}\`.\nDid you mean \`permission.${r}\`?`,i);this.stream.expect(A.IF,'Expected "if"');const n=this.stream.expectOneOf([A.ALL,A.ANY],'Expected "all" or "any"').type===A.ALL?t.and:t.or;this.stream.expect(A.COLON,'Expected ":"');const a=this.parseRuleSets(n);return new E({id:e.id?.value||null,name:e.name?.value||null,description:e.description?.value||null,priority:e.priority?.value||null,permission:r.replace(/^permission\./,""),effect:"permit"===s?p.permit:p.deny,disabled:e.disabled?.value??void 0,tags:e.tags?.value??void 0,compareMethod:n}).addRuleSets(a)}parseRuleSets(t){const e=[];for(this.consumeLeadingComments(),this.consumeLeadingAnnotations();!this.stream.eof()&&!this.isStartOfPolicy();){if(this.isStartOfExcept()){e.push(this.parseExceptGroup(t));continue}if(this.isStartOfGroup()){e.push(this.parseGroup());continue}const s=new v({compareMethod:t});for(;!(this.stream.eof()||(this.consumeLeadingComments(),this.consumeLeadingAnnotations(),this.isStartOfGroup()||this.isStartOfPolicy()||this.isStartOfExcept()));)this.stream.check(A.IDENTIFIER)||this.stream.check(A.ALWAYS)||this.stream.check(A.NEVER)?s.addRule(this.parseRule()):this.stream.syntaxError(`Unexpected token in implicit group: ${this.stream.peek().type}`,this.stream.peek());e.push(s)}return e}parseGroup(){this.consumeLeadingComments(),this.consumeLeadingAnnotations();const e=this.takeAnnotations("ruleSet"),s=this.stream.expectOneOf([A.ALL,A.ANY,A.ALWAYS,A.NEVER],'Expected "all" or "any" or "always" or "never"').type===A.ALL?t.and:t.or;this.stream.check(A.OF)&&this.stream.next(),this.stream.expect(A.COLON,'Expected ":"');const i=new v({id:e.id?.value||null,compareMethod:s,name:e.name?.value||null,description:e.description?.value||null,disabled:e.disabled?.value??void 0});for(;!(this.stream.eof()||(this.consumeLeadingComments(),this.consumeLeadingAnnotations(),this.isStartOfExcept())||this.isStartOfGroup()||this.isStartOfPolicy());)this.stream.check(A.IDENTIFIER)?i.addRule(this.parseRule()):this.stream.syntaxError(`Unexpected token in group: ${this.stream.peek().type}`,this.stream.peek());return i}parseExceptGroup(e){this.consumeLeadingComments(),this.consumeLeadingAnnotations();const s=this.takeAnnotations("ruleSet");this.stream.expect(A.EXCEPT,'Expected "except"');let i=e;this.stream.check(A.ALL)||this.stream.check(A.ANY)?(i=this.stream.next().type===A.ALL?t.and:t.or,this.stream.check(A.OF)&&this.stream.next(),this.stream.expect(A.COLON,'Expected ":" after except group')):this.stream.expect(A.COLON,'Expected ":" after "except"');const r=new v({id:s.id?.value||null,compareMethod:i,name:s.name?.value||null,description:s.description?.value||null,isExcept:!0,disabled:s.disabled?.value??void 0});for(;!(this.stream.eof()||(this.consumeLeadingComments(),this.consumeLeadingAnnotations(),this.isStartOfGroup()||this.isStartOfPolicy()||this.isStartOfExcept()));)this.stream.check(A.IDENTIFIER)?r.addRule(this.parseRule()):this.stream.syntaxError(`Unexpected token in except group: ${this.stream.peek().type}`,this.stream.peek());return r}parseRule(){this.consumeLeadingComments(),this.consumeLeadingAnnotations();const t=this.takeAnnotations("rule"),e=this.stream.check(A.ALWAYS)||this.stream.check(A.NEVER);e||this.stream.check(A.IDENTIFIER)||this.stream.syntaxError(`Expected identifier, but got ${this.stream.peek().type}`,this.stream.peek());const s=e?"":this.stream.expect(A.IDENTIFIER,"Expected field").value;if(this.aliasBuffer.has(s))return this.aliasBuffer.get(s);const{condition:i,operator:r}=this.parseConditionOperator();let n=null,a=null;return r!==A.EQ_NULL&&r!==A.NOT_EQ_NULL&&r!==A.NULL&&r!==A.DEFINED&&r!==A.ALWAYS&&r!==A.NEVER&&(this.stream.mark(),n=this.parseValue(),a=this.stream.lookPrev(),this.stream.commit()),this.consumeLeadingComments(),this.consumeLeadingAnnotations(),this.consumeLeadingAliases(),"string"==typeof n&&a&&a.type===A.IDENTIFIER&&!a.value.includes(".")&&this.stream.syntaxError(`Expected comparison operator or value, got \`${n}\``,a,[A.KEYWORD]),new _({id:t.id?.value||null,subject:s,resource:n,condition:i,name:t.name?.value||null,description:t.description?.value||null,disabled:t.disabled?.value??void 0})}parseConditionOperator(){if(this.stream.mark(),this.matchWord("always"))return this.stream.commit(),{condition:i.always,operator:A.ALWAYS};if(this.stream.reset(),this.stream.mark(),this.matchWord("never"))return this.stream.commit(),{condition:i.never,operator:A.NEVER};if(this.stream.reset(),this.stream.mark(),(this.matchWord("length")||this.matchWord("len"))&&this.matchWord("equals"))return this.stream.commit(),{condition:i.length_equals,operator:A.LEN_EQ};if(this.stream.reset(),this.stream.mark(),(this.matchWord("length")||this.matchWord("len"))&&this.matchSymbol("="))return this.stream.commit(),{condition:i.length_equals,operator:A.LEN_EQ};if(this.stream.reset(),this.stream.mark(),(this.matchWord("length")||this.matchWord("len"))&&this.matchWord("greater")&&this.matchWord("than"))return this.stream.commit(),{condition:i.length_greater_than,operator:A.LEN_GT};if(this.stream.reset(),this.stream.mark(),(this.matchWord("length")||this.matchWord("len"))&&this.matchSymbol(">"))return this.stream.commit(),{condition:i.length_greater_than,operator:A.LEN_GT};if(this.stream.reset(),this.stream.mark(),(this.matchWord("length")||this.matchWord("len"))&&this.matchWord("less")&&this.matchWord("than"))return this.stream.commit(),{condition:i.length_less_than,operator:A.LEN_LT};if(this.stream.reset(),this.stream.mark(),(this.matchWord("length")||this.matchWord("len"))&&this.matchSymbol("<"))return this.stream.commit(),{condition:i.length_less_than,operator:A.LEN_LT};if(this.stream.reset(),this.stream.mark(),this.matchWord("greater")&&this.matchWord("than")&&this.matchWord("or")&&this.matchWord("equal"))return this.stream.commit(),{condition:i.greater_or_equal,operator:A.GTE};if(this.stream.reset(),this.stream.mark(),this.matchWord("greater")&&this.matchWord("than"))return this.stream.commit(),{condition:i.greater_than,operator:A.GT};if(this.stream.reset(),this.stream.mark(),this.matchWord("less")&&this.matchWord("than")&&this.matchWord("or")&&this.matchWord("equal"))return this.stream.commit(),{condition:i.less_or_equal,operator:A.LTE};if(this.stream.reset(),this.matchWord("less")&&this.matchWord("than"))return{condition:i.less_than,operator:A.LT};if(this.stream.reset(),this.stream.mark(),this.matchWord("not")&&this.matchWord("contains"))return this.stream.commit(),{condition:i.not_contains,operator:A.NOT_CONTAINS};if(this.stream.reset(),this.stream.mark(),this.matchWord("not")&&this.matchWord("includes"))return this.stream.commit(),{condition:i.not_contains,operator:A.NOT_CONTAINS};if(this.stream.reset(),this.stream.mark(),this.matchWord("not")&&this.matchWord("has"))return this.stream.commit(),{condition:i.not_contains,operator:A.NOT_CONTAINS};if(this.stream.reset(),this.stream.mark(),this.matchWord("is")&&this.matchWord("equals"))return this.stream.commit(),{condition:i.equals,operator:A.EQ};if(this.stream.reset(),this.stream.mark(),this.matchWord("not")&&this.matchWord("equals"))return this.stream.commit(),{condition:i.not_equals,operator:A.NOT_EQ};if(this.stream.reset(),this.stream.mark(),this.matchWord("is")&&this.matchWord("not")&&this.matchWord("equals"))return this.stream.commit(),{condition:i.not_equals,operator:A.NOT_EQ};if(this.stream.reset(),this.stream.mark(),this.matchWord("is")&&this.matchWord("in"))return this.stream.commit(),{condition:i.in,operator:A.IN};if(this.stream.reset(),this.stream.mark(),this.matchWord("not")&&this.matchWord("in"))return this.stream.commit(),{condition:i.not_in,operator:A.NOT_IN};if(this.stream.reset(),this.stream.mark(),this.matchWord("is")&&this.matchWord("not")&&this.stream.check(A.NULL))return this.stream.next(),this.stream.commit(),{condition:i.not_equals,operator:A.NOT_EQ_NULL};if(this.stream.reset(),this.stream.mark(),this.matchWord("is")&&this.matchWord("null")&&this.stream.check(A.NULL))return this.stream.commit(),this.stream.next(),{condition:i.equals,operator:A.EQ_NULL};if(this.stream.reset(),this.stream.mark(),this.matchWord("is")&&this.matchWord("defined"))return this.stream.commit(),{condition:i.defined,operator:A.DEFINED};if(this.stream.reset(),this.stream.mark(),this.matchWord("is")&&this.matchWord("not")&&this.matchWord("defined"))return this.stream.commit(),{condition:i.not_defined,operator:A.DEFINED};this.stream.reset();const t=this.stream.peek();switch(t.type!==A.SYMBOL&&t.type!==A.KEYWORD&&t.type!==A.NULL&&this.stream.syntaxError(`Expected comparison operator, got \`${t.value}\``,t,[A.SYMBOL,A.KEYWORD,A.NULL]),this.stream.next(),t.type){case A.SYMBOL:if("="===t.value||"=="===t.value)return{condition:i.equals,operator:A.EQ};if("!="===t.value||"<>"===t.value)return{condition:i.not_equals,operator:A.NOT_EQ};if(">"===t.value)return{condition:i.greater_than,operator:A.GT};if("<"===t.value)return{condition:i.less_than,operator:A.LT};if(">="===t.value)return{condition:i.greater_or_equal,operator:A.GTE};if("<="===t.value)return{condition:i.less_or_equal,operator:A.LTE};break;case A.KEYWORD:if("contains"===t.value||"includes"===t.value||"has"===t.value)return{condition:i.contains,operator:A.CONTAINS};if("in"===t.value)return{condition:i.in,operator:A.IN};if("equals"===t.value)return{condition:i.equals,operator:A.EQ};if("gte"===t.value)return{condition:i.greater_or_equal,operator:A.GTE};if("greater"===t.value||"gt"===t.value)return{condition:i.greater_than,operator:A.GT};if("less"===t.value||"lt"===t.value)return{condition:i.less_than,operator:A.LT};if("lte"===t.value)return{condition:i.less_or_equal,operator:A.LTE};if("is"===t.value)return{condition:i.equals,operator:A.EQ}}return this.stream.syntaxError(`Unexpected operator token \`${t.value}\``,t,[A.SYMBOL,A.KEYWORD])}matchWord(t){if(this.stream.eof())return!1;const e=this.stream.peek();return(e.type===A.KEYWORD||e.type===A.IDENTIFIER||e.type===A.ALWAYS||e.type===A.NEVER||e.type===A.DEFINED)&&e.value===t&&(this.stream.next(),!0)}matchSymbol(t){if(this.stream.eof())return!1;const e=this.stream.peek();return e.type===A.SYMBOL&&e.value===t&&(this.stream.next(),!0)}parseValue(){if(this.stream.check(A.LBRACKET))return this.stream.next(),this.parseArray();const t=this.stream.peek();switch(t.type!==A.ALL&&t.type!==A.ANY&&t.type!==A.EFFECT||this.stream.syntaxError(`Unexpected ${t.type} in value position`,t),this.stream.next(),t.type){case A.STRING:return t.value;case A.NUMBER:return Number(t.value);case A.BOOLEAN:return"true"===t.value;case A.NULL:return null;case A.DEFINED:return void 0!==t.value;case A.IDENTIFIER:return null;default:this.stream.syntaxError(`Unexpected value token "${t.value}"`,t,[A.KEYWORD])}}parseArray(){const t=[];if(this.stream.check(A.RBRACKET))return this.stream.next(),t;for(;!this.stream.eof()&&!this.stream.check(A.RBRACKET);){const e=this.parseValue();Array.isArray(e)?t.push(...e):"string"==typeof e||"number"==typeof e||"boolean"==typeof e?t.push(e):null===e&&this.stream.syntaxError("Unexpected null in array",this.stream.peek()),this.stream.check(A.COMMA)&&this.stream.next()}return this.stream.expect(A.RBRACKET,'Expected "]"'),t}consumeLeadingComments(){for(;this.stream.check(A.COMMENT);)this.stream.next()}consumeLeadingAliases(){for(;this.stream.check(A.ALIAS);){this.stream.next();const t=this.stream.expect(A.IDENTIFIER,"Expected alias name").value;this.stream.expect(A.COLON,"Expected colon after an alias");const e=this.takeAnnotations("alias");for(;!this.stream.eof()&&!this.isStartOfAlias()&&!this.isStartOfPolicy();){const s=this.parseRule();s.name=e.get("name")?.value||t,s.description=e.get("description")?.value,!0===e.get("disabled")?.value&&(s.disabled=!0),this.aliasBuffer.set(t,s)}}}consumeLeadingAnnotations(){for(;this.stream.check(A.ANNOTATION);){const t=this.stream.next(),e=t.value.trim();if(e.startsWith("@id ")&&this.annBuffer.setID(e.slice(4).trim(),t),e.startsWith("@name ")&&this.annBuffer.setName(e.slice(6).trim(),t),e.startsWith("@description ")&&this.annBuffer.setDescription(e.slice(13).trim(),t),e.startsWith("@priority ")&&this.annBuffer.setPriority(parseInt(e.slice(10).trim(),10),t),e.startsWith("@disabled")){const s=e.slice(9).trim();this.annBuffer.setDisabled(0===s.length||"true"===e.slice(9).trim(),t)}if(e.startsWith("@tags ")){const s=e.slice(6).trim().split(",").map(t=>t.trim());this.annBuffer.setTags(s,t)}}}takeAnnotations(t){const e=this.annBuffer.clone();this.annBuffer.clear();const s=T[t];for(const i of Object.keys(e.store)){const r=e.get(i);r&&(s.has(i)||this.stream.syntaxError(`Annotation @${i} is not allowed on ${t}. Allowed: ${[...s].map(t=>"@"+t).join(", ")}`,r.token??this.stream.peek()))}return e}isStartOfPolicy(){return this.stream.check(A.EFFECT)}isStartOfGroup(){return this.stream.check(A.ALL)||this.stream.check(A.ANY)}isStartOfRule(){return this.stream.check(A.IDENTIFIER)||this.stream.check(A.ALWAYS)||this.stream.check(A.NEVER)}isStartOfExcept(){return this.stream.check(A.EXCEPT)}isStartOfAlias(){return this.stream.check(A.ALIAS)}}function $(t,...e){const s=t.reduce((t,s,i)=>t+s+(e[i]??""),"");return new w(s).parse()}class I{policies;matched;constructor(t){this.policies=t,this.matched=t.filter(t=>t.matchState===c.match)}matchedPolicies(){return this.matched}hasMatched(){return this.matched.length>0}firstMatched(){return this.matchedPolicies()[0]??null}lastMatched(){const t=this.matchedPolicies();return t.length>0?t[t.length-1]:null}firstDenied(){return this.getDenyPolicies()[0]??null}firstPermitted(){return this.getPermitPolicies()[0]??null}getPermitPolicies(){return this.matched.filter(t=>t.effect===p.permit)}getDenyPolicies(){return this.matched.filter(t=>t.effect===p.deny)}hasPermit(){return this.getPermitPolicies().length>0}hasDeny(){return this.getDenyPolicies().length>0}isAllowed(){return this.evaluate()===p.permit}isDenied(){return this.evaluate()===p.deny}}class W extends I{_decisive=null;evaluate(){if(!this.hasMatched())return this._decisive=null,p.deny;const t=this.firstDenied();return t?(this._decisive=t,p.deny):(this._decisive=this.firstPermitted(),p.permit)}decisivePolicy(){return this._decisive}}class R extends I{_decisive=null;evaluate(){const t=this.firstPermitted();return t?(this._decisive=t,p.permit):(this._decisive=null,p.deny)}decisivePolicy(){return this._decisive}}class M extends I{_decisive=null;evaluate(){const t=this.firstDenied();if(t)return this._decisive=t,p.deny;const e=this.firstPermitted();return e?(this._decisive=e,p.permit):(this._decisive=null,p.deny)}decisivePolicy(){return this._decisive}}class P extends I{_decisive=null;evaluate(){const t=this.firstMatched();return t?(this._decisive=t,t.effect):(this._decisive=null,p.deny)}decisivePolicy(){return this._decisive}}class D extends I{_decisive=null;evaluate(){const t=this.matchedPolicies();return 1===t.length?(this._decisive=t[0],t[0].effect):(this._decisive=null,p.deny)}decisivePolicy(){return this._decisive}}class C extends I{_decisive=null;evaluate(){const t=this.matchedPolicies().find(t=>t.effect===p.permit);if(t)return this._decisive=t,p.permit;const e=this.matchedPolicies().find(t=>t.effect===p.deny);return e?(this._decisive=e,p.deny):(this._decisive=null,p.deny)}decisivePolicy(){return this._decisive}}class j extends I{_decisive=null;evaluate(){const t=this.lastMatched();return t?(this._decisive=t,t.effect):(this._decisive=null,p.deny)}decisivePolicy(){return this._decisive}}class q extends I{_decisive=null;evaluate(){const t=this.matchedPolicies();if(0===t.length)return this._decisive=null,p.deny;const e=[...t].sort((t,e)=>e.priority-t.priority)[0];return this._decisive=e,e.effect}decisivePolicy(){return this._decisive}}export{t as AbilityCompare,i as AbilityCondition,b as AbilityDSLLexer,w as AbilityDSLParser,S as AbilityDSLToken,e as AbilityError,h as AbilityExplain,d as AbilityExplainPolicy,l as AbilityExplainRule,u as AbilityExplainRuleSet,N as AbilityJSONParser,c as AbilityMatch,s as AbilityParserError,E as AbilityPolicy,p as AbilityPolicyEffect,f as AbilityResolver,m as AbilityResult,_ as AbilityRule,v as AbilityRuleSet,I as AbilityStrategy,y as AbilityTypeGenerator,W as AllMustPermitStrategy,R as AnyPermitStrategy,M as DenyOverridesStrategy,P as FirstMatchStrategy,D as OnlyOneApplicableStrategy,C as PermitOverridesStrategy,q as PriorityStrategy,j as SequentialLastMatchStrategy,A as TokenTypes,$ as ability,r as fromLiteral,a as isConditionEqual,o as isConditionNotEqual,n as toLiteral};