@vritti/api-sdk 0.3.13 → 0.3.14

package/dist/catalog-resolver.cjs

@@ -21,10 +21,15 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/catalog-resolver/index.ts
 var catalog_resolver_exports = {};
 __export(catalog_resolver_exports, {
+  API_BUCKETS: () => API_BUCKETS,
+  API_SURFACES: () => API_SURFACES,
+  BUCKET_BY_SURFACE: () => BUCKET_BY_SURFACE,
   PLATFORMS: () => PLATFORMS,
   SERVICE_CODES: () => SERVICE_CODES,
   SITE_TYPES: () => SITE_TYPES,
   SNAPSHOT_SCHEMA_VERSION: () => SNAPSHOT_SCHEMA_VERSION,
+  SURFACE_BY_BUCKET: () => SURFACE_BY_BUCKET,
+  UI_PLATFORMS: () => UI_PLATFORMS,
   buildDependsMap: () => buildDependsMap,
   buildPlanMatrix: () => buildPlanMatrix,
   buildSiteCatalog: () => buildSiteCatalog,
@@ -35,12 +40,15 @@ __export(catalog_resolver_exports, {
   featureAppliesAtNode: () => featureAppliesAtNode,
   filterGrantedByDeps: () => filterGrantedByDeps,
   findFeatureByCode: () => findFeatureByCode,
+  isApiBucket: () => isApiBucket,
   isPlanMember: () => isPlanMember,
   isSiteLockedOnPlatform: () => isSiteLockedOnPlatform,
+  normalizeApiBuckets: () => normalizeApiBuckets,
   pickRouteForPlatform: () => pickRouteForPlatform,
   prereqClosure: () => prereqClosure,
   resolveUserFeatures: () => resolveUserFeatures,
-  snapshotFeatureKey: () => snapshotFeatureKey
+  snapshotFeatureKey: () => snapshotFeatureKey,
+  surfaceAllows: () => surfaceAllows
 });
 module.exports = __toCommonJS(catalog_resolver_exports);
 
@@ -118,12 +126,33 @@ __name(filterGrantedByDeps, "filterGrantedByDeps");
 var PLATFORMS = [
   "web",
   "mobile",
-  "app"
+  "graphql",
+  "http"
 ];
 var UI_PLATFORMS = [
   "web",
   "mobile"
 ];
+var API_SURFACES = [
+  "GRAPHQL",
+  "HTTP"
+];
+var API_BUCKETS = [
+  "graphql",
+  "http"
+];
+var SURFACE_BY_BUCKET = {
+  graphql: "GRAPHQL",
+  http: "HTTP"
+};
+var BUCKET_BY_SURFACE = {
+  GRAPHQL: "graphql",
+  HTTP: "http"
+};
+function isApiBucket(bucket) {
+  return bucket === "graphql" || bucket === "http";
+}
+__name(isApiBucket, "isApiBucket");
 var SITE_TYPES = [
   "OUTLET",
   "WAREHOUSE",
@@ -136,9 +165,47 @@ function snapshotFeatureKey(code, scope) {
   return `${scope}.${code}`;
 }
 __name(snapshotFeatureKey, "snapshotFeatureKey");
-var SNAPSHOT_SCHEMA_VERSION = 2;
+var SNAPSHOT_SCHEMA_VERSION = 4;
 
 // src/catalog-resolver/catalog.builder.ts
+function normalizeApiBuckets(doc) {
+  if (!doc) return doc;
+  let changed = false;
+  const next = {};
+  for (const [code, entry] of Object.entries(doc)) {
+    const legacy = entry.app;
+    if (legacy === void 0 || entry.graphql !== void 0 && entry.http !== void 0) {
+      next[code] = entry;
+      continue;
+    }
+    changed = true;
+    next[code] = {
+      ...entry,
+      ...entry.graphql === void 0 ? {
+        graphql: legacy
+      } : {},
+      ...entry.http === void 0 ? {
+        http: legacy
+      } : {}
+    };
+  }
+  return changed ? next : doc;
+}
+__name(normalizeApiBuckets, "normalizeApiBuckets");
+function normalizePlans(plans) {
+  let changed = false;
+  const next = {};
+  for (const [code, plan] of Object.entries(plans)) {
+    const unlockedPermissions = normalizeApiBuckets(plan.unlockedPermissions) ?? {};
+    if (unlockedPermissions !== plan.unlockedPermissions) changed = true;
+    next[code] = unlockedPermissions === plan.unlockedPermissions ? plan : {
+      ...plan,
+      unlockedPermissions
+    };
+  }
+  return changed ? next : plans;
+}
+__name(normalizePlans, "normalizePlans");
 function featureAppliesAtNode(applicableSiteTypes, siteType) {
   return applicableSiteTypes.includes(siteType);
 }
@@ -154,26 +221,28 @@ function buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, s
   if (!businessCode) return [];
   const business = snapshot.businesses?.[businessCode];
   if (!business) return [];
-  const plan = planCode ? business.plans?.[planCode] : void 0;
-  const plans = business.plans ?? {};
+  const plans = normalizePlans(business.plans ?? {});
+  const plan = planCode ? plans[planCode] : void 0;
+  const locks = normalizeApiBuckets(siteLocks);
   const catalog = [];
   const sortedApps = [
     ...business.apps
   ].sort((a, b) => a.name.localeCompare(b.name));
   for (const app of sortedApps) {
     const businessAppFeatures = app.features.filter((ref) => scope === void 0 || ref.scope === scope).map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)]).filter((f) => !!f && // A UI bucket needs something to render, so a feature shipping no microfrontend is dropped.
-    // The `app` bucket renders nothing — dropping headless features there would make them
-    // permanently ungrantable to an API client.
-    (bucket === "app" || !!(f.microfrontends?.web || f.microfrontends?.mobile)) && (siteType === void 0 || featureAppliesAtNode(f.applicableSiteTypes, siteType)));
+    // An API bucket renders nothing — there a feature is admitted by the surfaces it declares
+    // instead, so a GRAPHQL credential never resolves an HTTP-only feature. A surface-excluded
+    // feature vanishes from the catalog entirely, which is what makes resolution fail closed.
+    (isApiBucket(bucket) ? surfaceAllows(f.apiSurfaces, SURFACE_BY_BUCKET[bucket]) : !!(f.microfrontends?.web || f.microfrontends?.mobile)) && (siteType === void 0 || featureAppliesAtNode(f.applicableSiteTypes, siteType)));
     if (businessAppFeatures.length === 0) continue;
     for (const feature of businessAppFeatures) {
       const membership = plan?.unlockedPermissions?.[feature.code];
       const web = feature.microfrontends?.web;
       const mobile = feature.microfrontends?.mobile;
       const memberOnBucket = membership?.[bucket] !== void 0;
-      const sitePlatformLocked = siteLocks?.[feature.code]?.[bucket] === null;
+      const sitePlatformLocked = locks?.[feature.code]?.[bucket] === null;
       const missingServices = unmetServices(feature, availableServices);
-      const permissions = buildPermissions(feature, businessCode, membership, siteLocks, plans, bucket, missingServices);
+      const permissions = buildPermissions(feature, businessCode, membership, locks, plans, bucket, missingServices);
       const lockReason = resolveLockReason(!memberOnBucket, sitePlatformLocked, missingServices);
       const locked = lockReason !== null;
       const unlockPlans = lockReason === "PLAN" ? plansIncludingFeature(plans, feature.code, bucket) : [];
@@ -210,9 +279,14 @@ function buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, s
 }
 __name(buildSiteCatalog, "buildSiteCatalog");
 function isPlanMember(entry) {
-  return !!entry && (entry.web !== void 0 || entry.mobile !== void 0);
+  if (!entry) return false;
+  return PLATFORMS.some((platform) => entry[platform] !== void 0) || entry.app !== void 0;
 }
 __name(isPlanMember, "isPlanMember");
+function surfaceAllows(surfaces, surface) {
+  return surface === void 0 || surfaces === void 0 || surfaces.includes(surface);
+}
+__name(surfaceAllows, "surfaceAllows");
 function resolveLockReason(planLocked, siteLocked, missingServices) {
   if (planLocked) return "PLAN";
   if (siteLocked) return "SITE";
@@ -322,7 +396,7 @@ function composeRoleGrants(params) {
       if (revoke === null) continue;
       composed[bucket] = revoke === void 0 ? merged : merged.filter((c) => !revoke.includes(c));
     }
-    if (composed.web === void 0 && composed.mobile === void 0) continue;
+    if (PLATFORMS.every((bucket) => composed[bucket] === void 0)) continue;
     result[code] = composed;
   }
   return result;
@@ -330,21 +404,35 @@ function composeRoleGrants(params) {
 __name(composeRoleGrants, "composeRoleGrants");
 
 // src/catalog-resolver/resolve-user-features.ts
+var BUCKET_BY_CLIENT = {
+  web: "web",
+  ios: "mobile",
+  android: "mobile",
+  graphql: "graphql",
+  http: "http"
+};
 var EMPTY_ROUTE = {
   remoteEntry: "",
   exposedModule: "",
   routePrefix: ""
 };
 function resolveUserFeatures(params) {
-  const { snapshot, businessCode, planCode, siteLocks, roleFeatures, platform, siteType, scope, availableServices } = params;
-  const bucket = platform === "web" ? "web" : platform === "app" ? "app" : "mobile";
+  const { snapshot, businessCode, planCode, siteLocks, platform, siteType, scope, availableServices } = params;
+  const bucket = BUCKET_BY_CLIENT[platform];
+  const roleFeatures = normalizeApiBuckets(params.roleFeatures) ?? {};
   const featureByCode = /* @__PURE__ */ __name((code) => scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code), "featureByCode");
   const catalog = buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, siteType, scope, availableServices);
   const catalogMap = new Map(catalog.map((f) => [
     f.code,
     f
   ]));
-  const businessPlans = snapshot.businesses[businessCode]?.plans ?? {};
+  const businessPlans = Object.fromEntries(Object.entries(snapshot.businesses[businessCode]?.plans ?? {}).map(([code, plan]) => [
+    code,
+    {
+      ...plan,
+      unlockedPermissions: normalizeApiBuckets(plan.unlockedPermissions) ?? {}
+    }
+  ]));
   const currentUnlockedCodes = /* @__PURE__ */ new Set();
   if (planCode && businessPlans[planCode]) {
     for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {
@@ -376,7 +464,7 @@ function resolveUserFeatures(params) {
   for (const [code, permsSet] of grantedFeatures) {
     const catalogEntry = catalogMap.get(code);
     if (!catalogEntry) continue;
-    const route = bucket === "app" ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);
+    const route = isApiBucket(bucket) ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);
     if (!route) continue;
     const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);
     const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [
@@ -421,6 +509,7 @@ function resolveUserFeatures(params) {
 }
 __name(resolveUserFeatures, "resolveUserFeatures");
 function pickRouteForPlatform(entry, platform) {
+  if (platform === "graphql" || platform === "http") return null;
   if (platform === "ios" || platform === "android") {
     if (!entry.mobile) return null;
     return {
@@ -449,13 +538,20 @@ function buildPlanMatrix(snapshot, businessCode, planCode, siteLocks) {
 __name(buildPlanMatrix, "buildPlanMatrix");
 function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, siteType) {
   const business = businessCode ? snapshot.businesses?.[businessCode] : void 0;
-  const plans = business?.plans ?? {};
+  const plans = Object.fromEntries(Object.entries(business?.plans ?? {}).map(([code, p]) => [
+    code,
+    {
+      ...p,
+      unlockedPermissions: normalizeApiBuckets(p.unlockedPermissions) ?? {}
+    }
+  ]));
   const plan = planCode ? plans[planCode] : void 0;
   const planMeta = {
     code: planCode ?? "",
     name: plan?.name ?? planCode ?? ""
   };
-  const locks = siteLocks ?? {};
+  const normalizedLocks = normalizeApiBuckets(siteLocks);
+  const locks = normalizedLocks ?? {};
   if (!business || !plan) return {
     plan: planMeta,
     apps: [],
@@ -474,11 +570,11 @@ function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, sit
       if (siteType !== void 0 && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;
       const platforms = [
         ...UI_PLATFORMS.filter((p) => !!feature.microfrontends?.[p]),
-        "app"
+        ...API_BUCKETS.filter((b) => feature.apiSurfaces === void 0 || feature.apiSurfaces.includes(SURFACE_BY_BUCKET[b]))
       ];
       const membership = plan.unlockedPermissions?.[code];
       const featureInPlan = isPlanMember(membership);
-      const siteEntry = siteLocks?.[code];
+      const siteEntry = normalizedLocks?.[code];
       const permissions = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? "")).map((p) => {
         const cell = /* @__PURE__ */ __name((plat) => {
           if (!platforms.includes(plat)) return null;
@@ -500,7 +596,8 @@ function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, sit
           dependsOn: p.dependsOn ?? [],
           web: cell("web"),
           mobile: cell("mobile"),
-          app: cell("app")
+          graphql: cell("graphql"),
+          http: cell("http")
         };
       });
       features.push({
@@ -512,6 +609,7 @@ function buildMatrix(snapshot, businessCode, planCode, siteLocks, allScopes, sit
         platforms,
         inPlan: featureInPlan,
         availableIn: featureInPlan ? [] : plansIncludingFeature2(plans, code, planCode),
+        apiSurfaces: feature.apiSurfaces,
         permissions
       });
     }
@@ -553,10 +651,15 @@ function plansIncludingFeature2(plans, featureCode, excludeCode) {
 __name(plansIncludingFeature2, "plansIncludingFeature");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  API_BUCKETS,
+  API_SURFACES,
+  BUCKET_BY_SURFACE,
   PLATFORMS,
   SERVICE_CODES,
   SITE_TYPES,
   SNAPSHOT_SCHEMA_VERSION,
+  SURFACE_BY_BUCKET,
+  UI_PLATFORMS,
   buildDependsMap,
   buildPlanMatrix,
   buildSiteCatalog,
@@ -567,11 +670,14 @@ __name(plansIncludingFeature2, "plansIncludingFeature");
   featureAppliesAtNode,
   filterGrantedByDeps,
   findFeatureByCode,
+  isApiBucket,
   isPlanMember,
   isSiteLockedOnPlatform,
+  normalizeApiBuckets,
   pickRouteForPlatform,
   prereqClosure,
   resolveUserFeatures,
-  snapshotFeatureKey
+  snapshotFeatureKey,
+  surfaceAllows
 });
 //# sourceMappingURL=catalog-resolver.cjs.map

package/dist/catalog-resolver.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/catalog-resolver/index.ts","../src/catalog-resolver/permission-deps.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts","../src/catalog-resolver/site-matrix.builder.ts"],"sourcesContent":["// Catalog resolver — the single shared implementation of snapshot resolution (BU catalog, BU matrix, user features)\n\nexport {\n  buildSiteCatalog,\n  buildSiteRoles,\n  featureAppliesAtNode,\n  findFeatureByCode,\n  isPlanMember,\n  isSiteLockedOnPlatform,\n} from './catalog.builder';\nexport { type ComposeRoleGrantsParams, composeRoleGrants, type RevokedGrants } from './compose-role-grants';\nexport {\n  buildDependsMap,\n  cascadeLocked,\n  type DependsMap,\n  filterGrantedByDeps,\n  prereqClosure,\n} from './permission-deps';\nexport {\n  type ClientPlatform,\n  type LockedPermission,\n  type PermissionFeature,\n  pickRouteForPlatform,\n  type ResolveUserFeaturesParams,\n  resolveUserFeatures,\n} from './resolve-user-features';\nexport {\n  buildPlanMatrix,\n  buildSiteMatrix,\n  type SiteMatrix,\n  type SiteMatrixApp,\n  type SiteMatrixCell,\n  type SiteMatrixFeature,\n  type SiteMatrixPermission,\n} from './site-matrix.builder';\nexport {\n  type BusinessVocabulary,\n  type CatalogPermission,\n  type FeatureCatalogEntry,\n  type FeatureLocks,\n  type FeatureUnlocks,\n  type LockReason,\n  PLATFORMS,\n  type PlatformBucket,\n  type PlatformCodes,\n  type PlatformDenyCodes,\n  type RoleItem,\n  type ScopeType,\n  SERVICE_CODES,\n  type ServiceCode,\n  SITE_TYPES,\n  type SiteFeatureLocks,\n  type SiteType,\n  SNAPSHOT_SCHEMA_VERSION,\n  type SnapshotApp,\n  type SnapshotAppFeatureRef,\n  type SnapshotBusiness,\n  type SnapshotFeature,\n  type SnapshotMicrofrontendMobile,\n  type SnapshotMicrofrontends,\n  type SnapshotMicrofrontendWeb,\n  type SnapshotPermission,\n  type SnapshotPlan,\n  type SnapshotRoleTemplate,\n  snapshotFeatureKey,\n  type VersionSnapshot,\n  type VocabularyEntry,\n} from './types';\n","// Intra-feature permission prerequisites — only DIRECT edges are declared; the transitive closure is computed by recursion, cycle-guarded\n\nexport type DependsMap = Map<string, string[]>;\n\n// Builds a dependency map from a feature's permissions, keeping only edges to codes present in the set\nexport function buildDependsMap(permissions: Array<{ code: string; dependsOn?: string[] }>): DependsMap {\n  const present = new Set(permissions.map((p) => p.code));\n  const map: DependsMap = new Map();\n  for (const p of permissions) {\n    map.set(\n      p.code,\n      (p.dependsOn ?? []).filter((dep) => dep !== p.code && present.has(dep)),\n    );\n  }\n  return map;\n}\n\n// Transitive prerequisite closure of a code (excludes the code itself), cycle-safe\nexport function prereqClosure(code: string, deps: DependsMap): string[] {\n  const out = new Set<string>();\n  const seen = new Set<string>([code]);\n  const stack = [code];\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    for (const dep of deps.get(current) ?? []) {\n      if (seen.has(dep)) continue;\n      seen.add(dep);\n      out.add(dep);\n      stack.push(dep);\n    }\n  }\n  return [...out];\n}\n\n// Codes locked after cascade: a code is locked if directly locked or any transitive prerequisite is (cycle-safe)\nexport function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string> {\n  const locked = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (locked.has(code)) return true;\n    if (directlyLocked.has(code)) {\n      locked.add(code);\n      return true;\n    }\n    if (visiting.has(code)) return false;\n    visiting.add(code);\n    const viaDep = (deps.get(code) ?? []).some(check);\n    visiting.delete(code);\n    if (viaDep) locked.add(code);\n    return viaDep;\n  };\n  for (const code of codes) check(code);\n  return locked;\n}\n\n// Keeps only codes whose FULL prerequisite closure is also present — drops a dependent missing any prerequisite (cycle-safe)\nexport function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string> {\n  const ok = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (ok.has(code)) return true;\n    if (!granted.has(code)) return false;\n    if (visiting.has(code)) return true;\n    visiting.add(code);\n    const satisfied = (deps.get(code) ?? []).every(check);\n    visiting.delete(code);\n    if (satisfied) ok.add(code);\n    return satisfied;\n  };\n  for (const code of granted) check(code);\n  return ok;\n}\n","// ——— Platform algebra — plan unlocks, role grants, and BU locks are all stored per platform bucket ———\n\n/**\n * The surfaces a permission can be granted on.\n *\n * `web` and `mobile` are UI buckets: a feature reaches them through a microfrontend, and a grant\n * there means a person can operate it on that surface. `app` is not a UI at all — it is an API\n * client signing its own requests, so it has no microfrontend and no route, and a feature needs\n * neither to be reachable by one.\n *\n * Keeping `app` in the same algebra rather than beside it is what lets plan entitlement, node\n * feature locks and permission prerequisites bind an API client exactly as they bind a person.\n */\nexport type PlatformBucket = 'web' | 'mobile' | 'app';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile', 'app'];\n\n/** Buckets that reach their feature through a microfrontend, and so require one to resolve. */\nexport type UiPlatformBucket = Exclude<PlatformBucket, 'app'>;\n\nexport const UI_PLATFORMS: UiPlatformBucket[] = ['web', 'mobile'];\n\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n  app?: string[];\n}\n\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n  app?: string[] | null;\n}\n\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\nexport type FeatureLocks = Record<string, PlatformDenyCodes>;\nexport type SiteFeatureLocks = FeatureLocks;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n  dependsOn: string[];\n}\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport type ScopeType = 'ORG' | 'LE' | 'SITE_GROUP' | 'SITE';\nexport type SiteType = 'OUTLET' | 'WAREHOUSE' | 'PRODUCTION';\nexport const SITE_TYPES: SiteType[] = ['OUTLET', 'WAREHOUSE', 'PRODUCTION'];\n// External services a feature can depend on — the org must have the service provisioned before the feature\n// unlocks. Add new services here and nowhere else in this package; every lock path is service-agnostic.\nexport const SERVICE_CODES = ['GITEA'] as const;\nexport type ServiceCode = (typeof SERVICE_CODES)[number];\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n  // Optional: snapshots built before service gating existed carry no services, which reads as \"requires none\"\n  requiredServices?: ServiceCode[];\n}\nexport interface SnapshotAppFeatureRef {\n  code: string;\n  scope: ScopeType;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: SnapshotAppFeatureRef[];\n}\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  scope: ScopeType;\n  siteType: SiteType;\n  features: FeatureUnlocks;\n}\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxSites: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface VocabularyEntry {\n  singular: string;\n  plural: string;\n}\nexport interface BusinessVocabulary {\n  site?: VocabularyEntry;\n  siteGroup?: VocabularyEntry;\n  outlet?: VocabularyEntry;\n  warehouse?: VocabularyEntry;\n  production?: VocabularyEntry;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  vocabulary?: BusinessVocabulary;\n  apps: SnapshotApp[];\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  schemaVersion?: number;\n  // Flat feature dictionary keyed by `${scope}.${code}` (see snapshotFeatureKey) — same-code features at different scopes stay distinct\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// Composite key for the snapshot feature dictionary — feature identity is (scope, code)\nexport function snapshotFeatureKey(code: string, scope: ScopeType): string {\n  return `${scope}.${code}`;\n}\n\nexport const SNAPSHOT_SCHEMA_VERSION = 2;\n\n// SERVICE = the org has not provisioned an external service the feature declares; the specific services are\n// reported alongside in `missingServices` so callers never branch on a service code baked into this union\nexport type LockReason = 'PLAN' | 'SITE' | 'SERVICE';\n\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n  permissions: CatalogPermission[];\n}\n\nexport type RoleItem = SnapshotRoleTemplate;\n","import { buildDependsMap, cascadeLocked, prereqClosure } from './permission-deps';\nimport type {\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  RoleItem,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\n// Whether a feature with the given site-type applicability is exposed at this site type\nexport function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean {\n  return applicableSiteTypes.includes(siteType);\n}\n\n// Scope-agnostic lookup of a feature by bare code — grants/locks key features by code alone, so the first scope-variant's shared metadata (permission graph) answers\nexport function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined {\n  for (const feature of Object.values(snapshot.features ?? {})) {\n    if (feature?.code === code) return feature;\n  }\n  return undefined;\n}\n\n// Builds the per-site catalog for ONE platform bucket — plan is the ceiling, siteLocks is a deny-list within it; each permission carries locked + lockReason + unlockPlans\n// availableServices defaults to none, so a caller that doesn't know the org's provisioned services locks every service-dependent feature rather than leaking it\nexport function buildSiteCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  bucket: PlatformBucket,\n  siteType?: SiteType,\n  scope?: ScopeType,\n  availableServices: ServiceCode[] = [],\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  const plan = planCode ? business.plans?.[planCode] : undefined;\n  const plans = business.plans ?? {};\n\n  const catalog: FeatureCatalogEntry[] = [];\n  // Iterate apps alphabetically by name so the resolved feature list (→ core-web sidebar) is app-alphabetical without any frontend re-sort\n  const sortedApps = [...business.apps].sort((a, b) => a.name.localeCompare(b.name));\n  for (const app of sortedApps) {\n    // The app's renderable features (each ref pins scope+code to one app), dropped when they don't belong to this workspace scope or node type (outlet vs container)\n    const businessAppFeatures = app.features\n      .filter((ref) => scope === undefined || ref.scope === scope)\n      .map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)])\n      .filter(\n        (f): f is SnapshotFeature =>\n          !!f &&\n          // A UI bucket needs something to render, so a feature shipping no microfrontend is dropped.\n          // The `app` bucket renders nothing — dropping headless features there would make them\n          // permanently ungrantable to an API client.\n          (bucket === 'app' || !!(f.microfrontends?.web || f.microfrontends?.mobile)) &&\n          (siteType === undefined || featureAppliesAtNode(f.applicableSiteTypes, siteType)),\n      );\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves as a locked tile instead of vanishing\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions?.[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      // Feature-level lock is EXPLICIT: plan must include the feature on this bucket, the site must not null-lock\n      // the platform, and every external service the feature declares must be provisioned for the org\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const sitePlatformLocked = siteLocks?.[feature.code]?.[bucket] === null;\n      const missingServices = unmetServices(feature, availableServices);\n      // Unmet services lock every permission too — otherwise the feature reads locked while its actions still\n      // report as available, which is not how plan and site locks behave\n      const permissions = buildPermissions(\n        feature,\n        businessCode,\n        membership,\n        siteLocks,\n        plans,\n        bucket,\n        missingServices,\n      );\n      const lockReason = resolveLockReason(!memberOnBucket, sitePlatformLocked, missingServices);\n      const locked = lockReason !== null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        missingServices,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions)\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  return !!entry && (entry.web !== undefined || entry.mobile !== undefined);\n}\n\n// The one place lock precedence is decided, for features and permissions alike; null means nothing locks.\n// Plan is the ceiling (an unentitled feature must upsell, not send the user to provision something they still\n// couldn't use), then the site deny-list, then any unprovisioned service.\nfunction resolveLockReason(\n  planLocked: boolean,\n  siteLocked: boolean,\n  missingServices: ServiceCode[],\n): LockReason | null {\n  if (planLocked) return 'PLAN';\n  if (siteLocked) return 'SITE';\n  if (missingServices.length > 0) return 'SERVICE';\n  return null;\n}\n\n// The services a feature declares that this org has not provisioned\nfunction unmetServices(feature: SnapshotFeature, availableServices: ServiceCode[]): ServiceCode[] {\n  return (feature.requiredServices ?? []).filter((service) => !availableServices.includes(service));\n}\n\n// Per-platform site-lock primitive: null locks the whole feature, string[] locks those codes, absent = not locked\nexport function isSiteLockedOnPlatform(\n  entry: SiteFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and site deny-list\n// (bucket-scoped). Unmet services lock the whole set — an unprovisioned service blocks every action on the feature.\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n  missingServices: ServiceCode[] = [],\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = siteLocks?.[feature.code];\n\n  const perms = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode));\n  const deps = buildDependsMap(perms);\n  const codes = perms.map((p) => p.code);\n\n  // Direct plan/site locks, then cascade so a locked prerequisite (e.g. view) locks its dependents (add/edit/delete)\n  const directlyPlanLocked = new Set<string>();\n  const directlySiteLocked = new Set<string>();\n  for (const p of perms) {\n    if (!planUnlocked.has(p.code)) directlyPlanLocked.add(p.code);\n    if (isSiteLockedOnPlatform(lockEntry, bucket, p.code)) directlySiteLocked.add(p.code);\n  }\n  const directlyLocked = new Set<string>([...directlyPlanLocked, ...directlySiteLocked]);\n  const lockedSet = cascadeLocked(codes, directlyLocked, deps);\n\n  return perms.map((p) => {\n    // A permission is enabled only if it AND its whole prerequisite closure are unlocked — reason/upsell reflect that\n    const closure = [p.code, ...prereqClosure(p.code, deps)];\n    const cascaded = lockedSet.has(p.code);\n    const planReason = cascaded && closure.some((c) => directlyPlanLocked.has(c));\n    const siteReason = cascaded && closure.some((c) => directlySiteLocked.has(c));\n    const lockReason = resolveLockReason(planReason, siteReason, missingServices);\n    const locked = lockReason !== null;\n    const unlockPlans = lockReason === 'PLAN' ? plansUnlockingClosure(plans, feature.code, closure, bucket) : [];\n    return { code: p.code, locked, lockReason, unlockPlans, missingServices };\n  });\n}\n\n// Plan codes (in the business) whose unlocked set includes the permission AND its whole prerequisite closure — upsell targets\nfunction plansUnlockingClosure(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  closure: string[],\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlocked = plan.unlockedPermissions?.[featureCode]?.[bucket];\n    if (unlocked && closure.every((c) => unlocked.includes(c))) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates ?? {});\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10); inputs are never mutated\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions ?? {})]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions?.[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set\n    if (composed.web === undefined && composed.mobile === undefined) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildSiteCatalog, findFeatureByCode } from './catalog.builder';\nimport { buildDependsMap, filterGrantedByDeps } from './permission-deps';\nimport type {\n  FeatureUnlocks,\n  LockReason,\n  PlatformBucket,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\n/**\n * The caller's surface, as the caller reports it.\n *\n * Finer than `PlatformBucket` on the mobile side — `ios` and `android` load different remote\n * entries but share one grant bucket. `app` is one-to-one with its bucket: an API client has no\n * variants because it has no UI.\n */\nexport type ClientPlatform = 'web' | 'ios' | 'android' | 'app';\n\n/**\n * Stands in for the microfrontend an API client does not load.\n *\n * `PermissionFeature.route` is non-optional and read by the web sidebar and the mobile host to\n * mount a remote. Nothing on the app path reads it — the permission interceptor uses `code`,\n * `permissions` and `locked` — so an empty route keeps one shape for every bucket instead of\n * widening the field to null across every consumer.\n */\nconst EMPTY_ROUTE = { remoteEntry: '', exposedModule: '', routePrefix: '' };\n\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface PlanUpsell {\n  plan: string;\n  features: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  // Which declared services the org has not provisioned — empty unless lockReason is 'SERVICE'\n  missingServices: ServiceCode[];\n  lockedPermissions: LockedPermission[];\n  upsell: PlanUpsell[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  siteLocks: SiteFeatureLocks | undefined;\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n  siteType?: SiteType;\n  scope?: ScopeType;\n  // External services the org has provisioned; omitting it locks every service-dependent feature\n  availableServices?: ServiceCode[];\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants, filtered to the requested platform\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, siteLocks, roleFeatures, platform, siteType, scope, availableServices } =\n    params;\n\n  // Plan unlocks, BU locks, and role grants are stored per platform; resolve only the requesting\n  // surface's bucket (web → 'web'; ios/android → 'mobile'; app → 'app')\n  const bucket: PlatformBucket = platform === 'web' ? 'web' : platform === 'app' ? 'app' : 'mobile';\n\n  // Grants/plans/locks key features by bare code; resolve to the workspace scope's variant (or any variant when unscoped)\n  const featureByCode = (code: string) =>\n    scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code);\n\n  // Plan ∧ BU overlay for this bucket, filtered to features that apply to this workspace scope and node type — emits EVERY applicable business feature (plan non-members come out fully locked)\n  const catalog = buildSiteCatalog(\n    snapshot,\n    businessCode,\n    planCode,\n    siteLocks,\n    bucket,\n    siteType,\n    scope,\n    availableServices,\n  );\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Per-plan feature-name delta vs the current plan — feeds the plan-locked upsell screen\n  const businessPlans = snapshot.businesses[businessCode]?.plans ?? {};\n  const currentUnlockedCodes = new Set<string>();\n  if (planCode && businessPlans[planCode]) {\n    for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] !== undefined) currentUnlockedCodes.add(featureCode);\n    }\n  }\n  const planAdds = new Map<string, Array<{ code: string; name: string }>>();\n  for (const [planKey, plan] of Object.entries(businessPlans)) {\n    if (planKey === planCode) continue;\n    const adds: Array<{ code: string; name: string }> = [];\n    for (const [featureCode, platforms] of Object.entries(plan.unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] === undefined || currentUnlockedCodes.has(featureCode)) continue;\n      const name = featureByCode(featureCode)?.name;\n      if (name) adds.push({ code: featureCode, name });\n    }\n    planAdds.set(planKey, adds);\n  }\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures ?? {})) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant?.[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    // A UI bucket reaches its feature by loading a microfrontend, so a feature not published to\n    // this platform is omitted rather than handed over as an unloadable tile. An API client loads\n    // nothing — requiring a route there would make every headless feature permanently ungrantable.\n    const route = bucket === 'app' ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);\n    if (!route) continue;\n\n    // Drop granted permissions whose intra-feature prerequisites aren't also granted (e.g. add needs view)\n    const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [p.code, p]));\n    const grantedPerms = [...filterGrantedByDeps(permsSet, featureDeps)];\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({\n        code: p.code,\n        reason: p.lockReason ?? null,\n        unlockPlans: p.unlockPlans ?? [],\n        missingServices: p.missingServices ?? [],\n      }));\n\n    // For a plan-locked feature, list the extra features each unlocking plan would add (excluding this feature)\n    const upsell: PlanUpsell[] =\n      catalogEntry.locked && catalogEntry.lockReason === 'PLAN'\n        ? (catalogEntry.unlockPlans ?? [])\n            .map((plan) => ({\n              plan,\n              features: (planAdds.get(plan) ?? []).filter((f) => f.code !== code).map((f) => f.name),\n            }))\n            .filter((group) => group.features.length > 0)\n        : [];\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans ?? [],\n      missingServices: catalogEntry.missingServices ?? [],\n      lockedPermissions,\n      upsell,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  // Order app-alphabetically so the core-web sidebar (groups by app) renders apps sorted without any frontend re-sort;\n  // stable sort keeps each app's features in their existing relative order\n  features.sort((a, b) => a.appName.localeCompare(b.appName));\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform, or null when it doesn't publish there\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n","import { featureAppliesAtNode, isPlanMember, isSiteLockedOnPlatform } from './catalog.builder';\nimport {\n  PLATFORMS,\n  UI_PLATFORMS,\n  type PlatformBucket,\n  type ScopeType,\n  type SiteFeatureLocks,\n  type SiteType,\n  type SnapshotPlan,\n  snapshotFeatureKey,\n  type VersionSnapshot,\n} from './types';\n\nexport interface SiteMatrixCell {\n  inPlan: boolean;\n  selected: boolean;\n  availableIn: string[];\n}\n\nexport interface SiteMatrixPermission {\n  code: string;\n  label: string;\n  dependsOn: string[];\n  web: SiteMatrixCell | null;\n  mobile: SiteMatrixCell | null;\n  app: SiteMatrixCell | null;\n}\n\nexport interface SiteMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  platforms: PlatformBucket[];\n  inPlan: boolean;\n  availableIn: string[];\n  permissions: SiteMatrixPermission[];\n}\n\nexport interface SiteMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  unlockedCount: number;\n  totalCount: number;\n  features: SiteMatrixFeature[];\n}\n\nexport interface SiteMatrix {\n  plan: { code: string; name: string };\n  apps: SiteMatrixApp[];\n  locks: SiteFeatureLocks;\n}\n\n// Builds the SITE-only apps/features/permissions matrix — not filtered to plan members; plan-locked items carry inPlan=false + availableIn\nexport function buildSiteMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  siteType?: SiteType,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, false, siteType);\n}\n\n// Builds the all-scopes apps/features/permissions matrix — every scope's features included, each carrying its real scope; powers the Plan Overview + Create Custom Role picker\nexport function buildPlanMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks?: SiteFeatureLocks,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, true);\n}\n\n// Shared matrix builder — allScopes=false keeps only SITE refs; allScopes=true includes every scope and emits each feature's real scope\nfunction buildMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  allScopes: boolean,\n  siteType?: SiteType,\n): SiteMatrix {\n  const business = businessCode ? snapshot.businesses?.[businessCode] : undefined;\n  const plans = business?.plans ?? {};\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const locks = siteLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: SiteMatrixApp[] = [];\n  for (const app of business.apps) {\n    let unlockedCount = 0;\n    let totalCount = 0;\n    const features: SiteMatrixFeature[] = [];\n\n    for (const ref of app.features) {\n      if (!allScopes && ref.scope !== 'SITE') continue;\n      const code = ref.code;\n      const feature = snapshot.features?.[snapshotFeatureKey(code, ref.scope)];\n      if (!feature) continue;\n      if (siteType !== undefined && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;\n      // A UI bucket is offered only where the feature publishes a microfrontend; `app` is offered\n      // always, because an API client has nothing to load. So a headless feature still yields one\n      // platform and must not be skipped.\n      const platforms: PlatformBucket[] = [\n        ...UI_PLATFORMS.filter((p) => !!feature.microfrontends?.[p]),\n        'app',\n      ];\n\n      const membership = plan.unlockedPermissions?.[code];\n      const featureInPlan = isPlanMember(membership);\n      const siteEntry = siteLocks?.[code];\n\n      const permissions: SiteMatrixPermission[] = (feature.permissions ?? [])\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): SiteMatrixCell | null => {\n            if (!platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the site locks it on this platform\n            const selected = inPlan && !isSiteLockedOnPlatform(siteEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            totalCount += 1;\n            if (inPlan) unlockedCount += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return {\n            code: p.code,\n            label: p.label,\n            dependsOn: p.dependsOn ?? [],\n            web: cell('web'),\n            mobile: cell('mobile'),\n            app: cell('app'),\n          };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        scope: feature.scope,\n        applicableSiteTypes: feature.applicableSiteTypes,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        permissions,\n      });\n    }\n\n    if (features.length === 0) continue;\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, unlockedCount, totalCount, features });\n  }\n\n  // Emit apps alphabetically by name so every consumer (Plan Overview, Role picker, all Locks screens) renders them sorted\n  apps.sort((a, b) => a.name.localeCompare(b.name));\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions?.[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions?.[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;ACKO,SAASA,gBAAgBC,aAA0D;AACxF,QAAMC,UAAU,IAAIC,IAAIF,YAAYG,IAAI,CAACC,MAAMA,EAAEC,IAAI,CAAA;AACrD,QAAMF,MAAkB,oBAAIG,IAAAA;AAC5B,aAAWF,KAAKJ,aAAa;AAC3BG,QAAII,IACFH,EAAEC,OACDD,EAAEI,aAAa,CAAA,GAAIC,OAAO,CAACC,QAAQA,QAAQN,EAAEC,QAAQJ,QAAQU,IAAID,GAAAA,CAAAA,CAAAA;EAEtE;AACA,SAAOP;AACT;AAVgBJ;AAaT,SAASa,cAAcP,MAAcQ,MAAgB;AAC1D,QAAMC,MAAM,oBAAIZ,IAAAA;AAChB,QAAMa,OAAO,oBAAIb,IAAY;IAACG;GAAK;AACnC,QAAMW,QAAQ;IAACX;;AACf,SAAOW,MAAMC,SAAS,GAAG;AACvB,UAAMC,UAAUF,MAAMG,IAAG;AACzB,eAAWT,OAAOG,KAAKO,IAAIF,OAAAA,KAAY,CAAA,GAAI;AACzC,UAAIH,KAAKJ,IAAID,GAAAA,EAAM;AACnBK,WAAKM,IAAIX,GAAAA;AACTI,UAAIO,IAAIX,GAAAA;AACRM,YAAMM,KAAKZ,GAAAA;IACb;EACF;AACA,SAAO;OAAII;;AACb;AAdgBF;AAiBT,SAASW,cAAcC,OAAiBC,gBAA6BZ,MAAgB;AAC1F,QAAMa,SAAS,oBAAIxB,IAAAA;AACnB,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAIqB,OAAOf,IAAIN,IAAAA,EAAO,QAAO;AAC7B,QAAIoB,eAAed,IAAIN,IAAAA,GAAO;AAC5BqB,aAAOL,IAAIhB,IAAAA;AACX,aAAO;IACT;AACA,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAMwB,UAAUhB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAIyB,KAAKF,KAAAA;AAC3CD,aAASI,OAAO1B,IAAAA;AAChB,QAAIwB,OAAQH,QAAOL,IAAIhB,IAAAA;AACvB,WAAOwB;EACT,GAZc;AAad,aAAWxB,QAAQmB,MAAOI,OAAMvB,IAAAA;AAChC,SAAOqB;AACT;AAlBgBH;AAqBT,SAASS,oBAAoBC,SAAsBpB,MAAgB;AACxE,QAAMqB,KAAK,oBAAIhC,IAAAA;AACf,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAI6B,GAAGvB,IAAIN,IAAAA,EAAO,QAAO;AACzB,QAAI,CAAC4B,QAAQtB,IAAIN,IAAAA,EAAO,QAAO;AAC/B,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAM8B,aAAatB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAI+B,MAAMR,KAAAA;AAC/CD,aAASI,OAAO1B,IAAAA;AAChB,QAAI8B,UAAWD,IAAGb,IAAIhB,IAAAA;AACtB,WAAO8B;EACT,GATc;AAUd,aAAW9B,QAAQ4B,QAASL,OAAMvB,IAAAA;AAClC,SAAO6B;AACT;AAfgBF;;;ACzCT,IAAMK,YAA8B;EAAC;EAAO;EAAU;;AAKtD,IAAMC,eAAmC;EAAC;EAAO;;AAiDjD,IAAMC,aAAyB;EAAC;EAAU;EAAa;;AAGvD,IAAMC,gBAAgB;EAAC;;AAkEvB,SAASC,mBAAmBC,MAAcC,OAAgB;AAC/D,SAAO,GAAGA,KAAAA,IAASD,IAAAA;AACrB;AAFgBD;AAIT,IAAMG,0BAA0B;;;AC3HhC,SAASC,qBAAqBC,qBAAiCC,UAAkB;AACtF,SAAOD,oBAAoBE,SAASD,QAAAA;AACtC;AAFgBF;AAKT,SAASI,kBAAkBC,UAA2BC,MAAY;AACvE,aAAWC,WAAWC,OAAOC,OAAOJ,SAASK,YAAY,CAAC,CAAA,GAAI;AAC5D,QAAIH,SAASD,SAASA,KAAM,QAAOC;EACrC;AACA,SAAOI;AACT;AALgBP;AAST,SAASQ,iBACdP,UACAQ,cACAC,UACAC,WACAC,QACAd,UACAe,OACAC,oBAAmC,CAAA,GAAE;AAErC,MAAI,CAACL,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWd,SAASe,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,QAAME,OAAOP,WAAWK,SAASG,QAAQR,QAAAA,IAAYH;AACrD,QAAMW,QAAQH,SAASG,SAAS,CAAC;AAEjC,QAAMC,UAAiC,CAAA;AAEvC,QAAMC,aAAa;OAAIL,SAASM;IAAMC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,KAAKC,cAAcF,EAAEC,IAAI,CAAA;AAChF,aAAWE,OAAOP,YAAY;AAE5B,UAAMQ,sBAAsBD,IAAIrB,SAC7BuB,OAAO,CAACC,QAAQjB,UAAUN,UAAauB,IAAIjB,UAAUA,KAAAA,EACrDkB,IAAI,CAACD,QAAQ7B,SAASK,WAAW0B,mBAAmBF,IAAI5B,MAAM4B,IAAIjB,KAAK,CAAA,CAAE,EACzEgB,OACC,CAACI,MACC,CAAC,CAACA;;;KAIDrB,WAAW,SAAS,CAAC,EAAEqB,EAAEC,gBAAgBC,OAAOF,EAAEC,gBAAgBE,aAClEtC,aAAaS,UAAaX,qBAAqBqC,EAAEpC,qBAAqBC,QAAAA,EAAQ;AAGrF,QAAI8B,oBAAoBS,WAAW,EAAG;AAGtC,eAAWlC,WAAWyB,qBAAqB;AACzC,YAAMU,aAAarB,MAAMsB,sBAAsBpC,QAAQD,IAAI;AAE3D,YAAMiC,MAAMhC,QAAQ+B,gBAAgBC;AACpC,YAAMC,SAASjC,QAAQ+B,gBAAgBE;AAIvC,YAAMI,iBAAiBF,aAAa1B,MAAAA,MAAYL;AAChD,YAAMkC,qBAAqB9B,YAAYR,QAAQD,IAAI,IAAIU,MAAAA,MAAY;AACnE,YAAM8B,kBAAkBC,cAAcxC,SAASW,iBAAAA;AAG/C,YAAM8B,cAAcC,iBAClB1C,SACAM,cACA6B,YACA3B,WACAO,OACAN,QACA8B,eAAAA;AAEF,YAAMI,aAAaC,kBAAkB,CAACP,gBAAgBC,oBAAoBC,eAAAA;AAC1E,YAAMM,SAASF,eAAe;AAC9B,YAAMG,cAAcH,eAAe,SAASI,sBAAsBhC,OAAOf,QAAQD,MAAMU,MAAAA,IAAU,CAAA;AAEjGO,cAAQgC,KAAK;QACXjD,MAAMC,QAAQD;QACduB,MAAMtB,QAAQsB;QACd2B,YAAYjD,QAAQiD,cAAc;QAClCC,UAAUlD,QAAQkD,YAAY;QAC9BC,gBAAgBnD,QAAQmD,kBAAkB;QAC1CnB,KAAKA,MACD;UACEoB,aAAapB,IAAIoB,eAAe;UAChCC,eAAerB,IAAIqB,iBAAiB;UACpCC,aAAatB,IAAIsB,eAAe;QAClC,IACA;QACJrB,QAAQA,SACJ;UACEsB,oBAAoBtB,OAAOsB,sBAAsB;UACjDC,gBAAgBvB,OAAOuB,kBAAkB;UACzCH,eAAepB,OAAOoB,iBAAiB;UACvCC,aAAarB,OAAOqB,eAAe;QACrC,IACA;QACJG,SAASjC,IAAIzB;QACb2D,SAASlC,IAAIF;QACbqC,SAASnC,IAAIoC,QAAQ;QACrBC,cAAcrC,IAAIsC,aAAa;QAC/BjB;QACAF;QACAG;QACAP;QACAE;MACF,CAAA;IACF;EACF;AACA,SAAOzB;AACT;AAjGgBX;AAoGT,SAAS0D,aAAaC,OAAgC;AAC3D,SAAO,CAAC,CAACA,UAAUA,MAAMhC,QAAQ5B,UAAa4D,MAAM/B,WAAW7B;AACjE;AAFgB2D;AAOhB,SAASnB,kBACPqB,YACAC,YACA3B,iBAA8B;AAE9B,MAAI0B,WAAY,QAAO;AACvB,MAAIC,WAAY,QAAO;AACvB,MAAI3B,gBAAgBL,SAAS,EAAG,QAAO;AACvC,SAAO;AACT;AATSU;AAYT,SAASJ,cAAcxC,SAA0BW,mBAAgC;AAC/E,UAAQX,QAAQmE,oBAAoB,CAAA,GAAIzC,OAAO,CAAC0C,YAAY,CAACzD,kBAAkBf,SAASwE,OAAAA,CAAAA;AAC1F;AAFS5B;AAKF,SAAS6B,uBACdL,OACAM,UACAvE,MAAY;AAEZ,QAAMwE,QAAQP,QAAQM,QAAAA;AACtB,SAAOC,UAAU,SAASA,OAAO3E,SAASG,IAAAA,KAAS;AACrD;AAPgBsE;AAWhB,SAAS3B,iBACP1C,SACAM,cACAkE,gBACAhE,WACAO,OACAN,QACA8B,kBAAiC,CAAA,GAAE;AAEnC,QAAMkC,eAAe,IAAIC,IAAIF,iBAAiB/D,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAMkE,YAAYnE,YAAYR,QAAQD,IAAI;AAE1C,QAAM6E,SAAS5E,QAAQyC,eAAe,CAAA,GAAIf,OAAO,CAACmD,MAAMA,EAAEC,YAAYD,EAAEhE,WAAWjB,SAASU,YAAAA,CAAAA;AAC5F,QAAMyE,OAAOC,gBAAgBJ,KAAAA;AAC7B,QAAMK,QAAQL,MAAMhD,IAAI,CAACiD,MAAMA,EAAE9E,IAAI;AAGrC,QAAMmF,qBAAqB,oBAAIR,IAAAA;AAC/B,QAAMS,qBAAqB,oBAAIT,IAAAA;AAC/B,aAAWG,KAAKD,OAAO;AACrB,QAAI,CAACH,aAAaW,IAAIP,EAAE9E,IAAI,EAAGmF,oBAAmBG,IAAIR,EAAE9E,IAAI;AAC5D,QAAIsE,uBAAuBM,WAAWlE,QAAQoE,EAAE9E,IAAI,EAAGoF,oBAAmBE,IAAIR,EAAE9E,IAAI;EACtF;AACA,QAAMuF,iBAAiB,oBAAIZ,IAAY;OAAIQ;OAAuBC;GAAmB;AACrF,QAAMI,YAAYC,cAAcP,OAAOK,gBAAgBP,IAAAA;AAEvD,SAAOH,MAAMhD,IAAI,CAACiD,MAAAA;AAEhB,UAAMY,UAAU;MAACZ,EAAE9E;SAAS2F,cAAcb,EAAE9E,MAAMgF,IAAAA;;AAClD,UAAMY,WAAWJ,UAAUH,IAAIP,EAAE9E,IAAI;AACrC,UAAM6F,aAAaD,YAAYF,QAAQI,KAAK,CAACC,MAAMZ,mBAAmBE,IAAIU,CAAAA,CAAAA;AAC1E,UAAMC,aAAaJ,YAAYF,QAAQI,KAAK,CAACC,MAAMX,mBAAmBC,IAAIU,CAAAA,CAAAA;AAC1E,UAAMnD,aAAaC,kBAAkBgD,YAAYG,YAAYxD,eAAAA;AAC7D,UAAMM,SAASF,eAAe;AAC9B,UAAMG,cAAcH,eAAe,SAASqD,sBAAsBjF,OAAOf,QAAQD,MAAM0F,SAAShF,MAAAA,IAAU,CAAA;AAC1G,WAAO;MAAEV,MAAM8E,EAAE9E;MAAM8C;MAAQF;MAAYG;MAAaP;IAAgB;EAC1E,CAAA;AACF;AArCSG;AAwCT,SAASsD,sBACPjF,OACAkF,aACAR,SACAhF,QAAsB;AAEtB,QAAMyF,SAAmB,CAAA;AACzB,aAAW,CAACnG,MAAMe,IAAAA,KAASb,OAAOkG,QAAQpF,KAAAA,GAAQ;AAChD,UAAMqF,WAAWtF,KAAKsB,sBAAsB6D,WAAAA,IAAexF,MAAAA;AAC3D,QAAI2F,YAAYX,QAAQY,MAAM,CAACP,MAAMM,SAASxG,SAASkG,CAAAA,CAAAA,EAAKI,QAAOlD,KAAKjD,IAAAA;EAC1E;AACA,SAAOmG;AACT;AAZSF;AAeT,SAASjD,sBACPhC,OACAkF,aACAxF,QAAsB;AAEtB,QAAMyF,SAAmB,CAAA;AACzB,aAAW,CAACnG,MAAMe,IAAAA,KAASb,OAAOkG,QAAQpF,KAAAA,GAAQ;AAChD,QAAID,KAAKsB,sBAAsB6D,WAAAA,IAAexF,MAAAA,MAAYL,OAAW8F,QAAOlD,KAAKjD,IAAAA;EACnF;AACA,SAAOmG;AACT;AAVSnD;AAaF,SAASuD,eAAexG,UAA2BQ,cAAgC;AACxF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWd,SAASe,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,SAAOX,OAAOC,OAAOU,SAAS2F,iBAAiB,CAAC,CAAA;AAClD;AALgBD;;;ACjOhB,SAASE,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAMF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,aAAa,CAAC,CAAA;GAAG;AAElG,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,YAAYM,IAAAA,KAAS,CAAC;AAClC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAGA,QAAIN,SAASQ,QAAQrB,UAAaa,SAASS,WAAWtB,OAAW;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA3BgBL;;;ACchB,IAAMqB,cAAc;EAAEC,aAAa;EAAIC,eAAe;EAAIC,aAAa;AAAG;AAqDnE,SAASC,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,WAAWC,cAAcC,UAAUC,UAAUC,OAAOC,kBAAiB,IAC7GT;AAIF,QAAMU,SAAyBJ,aAAa,QAAQ,QAAQA,aAAa,QAAQ,QAAQ;AAGzF,QAAMK,gBAAgB,wBAACC,SACrBJ,QAAQP,SAASY,WAAWC,mBAAmBF,MAAMJ,KAAAA,CAAAA,IAAUO,kBAAkBd,UAAUW,IAAAA,GADvE;AAItB,QAAMI,UAAUC,iBACdhB,UACAC,cACAC,UACAC,WACAM,QACAH,UACAC,OACAC,iBAAAA;AAEF,QAAMS,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAET;IAAMS;GAAE,CAAA;AAGzD,QAAMC,gBAAgBrB,SAASsB,WAAWrB,YAAAA,GAAesB,SAAS,CAAC;AACnE,QAAMC,uBAAuB,oBAAIC,IAAAA;AACjC,MAAIvB,YAAYmB,cAAcnB,QAAAA,GAAW;AACvC,eAAW,CAACwB,aAAaC,SAAAA,KAAcC,OAAOC,QAAQR,cAAcnB,QAAAA,EAAU4B,uBAAuB,CAAC,CAAA,GAAI;AACxG,UAAIH,YAAYlB,MAAAA,MAAYsB,OAAWP,sBAAqBQ,IAAIN,WAAAA;IAClE;EACF;AACA,QAAMO,WAAW,oBAAIf,IAAAA;AACrB,aAAW,CAACgB,SAASC,IAAAA,KAASP,OAAOC,QAAQR,aAAAA,GAAgB;AAC3D,QAAIa,YAAYhC,SAAU;AAC1B,UAAMkC,OAA8C,CAAA;AACpD,eAAW,CAACV,aAAaC,SAAAA,KAAcC,OAAOC,QAAQM,KAAKL,uBAAuB,CAAC,CAAA,GAAI;AACrF,UAAIH,YAAYlB,MAAAA,MAAYsB,UAAaP,qBAAqBa,IAAIX,WAAAA,EAAc;AAChF,YAAMY,OAAO5B,cAAcgB,WAAAA,GAAcY;AACzC,UAAIA,KAAMF,MAAKG,KAAK;QAAE5B,MAAMe;QAAaY;MAAK,CAAA;IAChD;AACAL,aAASO,IAAIN,SAASE,IAAAA;EACxB;AAGA,QAAMK,kBAAkB,oBAAIvB,IAAAA;AAC5B,aAAW,CAACP,MAAM+B,KAAAA,KAAUd,OAAOC,QAAQzB,gBAAgB,CAAC,CAAA,GAAI;AAE9D,UAAMuC,UAAUD,QAAQjC,MAAAA;AACxB,QAAIkC,YAAYZ,OAAW;AAC3B,QAAI,CAACU,gBAAgBJ,IAAI1B,IAAAA,EAAO8B,iBAAgBD,IAAI7B,MAAM,oBAAIc,IAAAA,CAAAA;AAC9D,eAAWmB,QAAQD,QAASF,iBAAgBI,IAAIlC,IAAAA,GAAOqB,IAAIY,IAAAA;EAC7D;AAGA,QAAMhC,WAAgC,CAAA;AACtC,aAAW,CAACD,MAAMmC,QAAAA,KAAaL,iBAAiB;AAC9C,UAAMM,eAAe9B,WAAW4B,IAAIlC,IAAAA;AACpC,QAAI,CAACoC,aAAc;AAKnB,UAAMC,QAAQvC,WAAW,QAAQf,cAAcuD,qBAAqBF,cAAc1C,QAAAA;AAClF,QAAI,CAAC2C,MAAO;AAGZ,UAAME,cAAcC,gBAAgBzC,cAAcC,IAAAA,GAAOyC,eAAe,CAAA,CAAE;AAE1E,UAAMC,aAAa,IAAInC,KAAK6B,aAAaK,eAAe,CAAA,GAAIjC,IAAI,CAACmC,MAAM;MAACA,EAAE3C;MAAM2C;KAAE,CAAA;AAClF,UAAMC,eAAe;SAAIC,oBAAoBV,UAAUI,WAAAA;;AACvD,UAAMO,oBAAwCF,aAC3CpC,IAAI,CAACuC,MAAML,WAAWR,IAAIa,CAAAA,CAAAA,EAC1BC,OAAO,CAACL,MAAkC,CAAC,CAACA,GAAGM,MAAAA,EAC/CzC,IAAI,CAACmC,OAAO;MACX3C,MAAM2C,EAAE3C;MACRkD,QAAQP,EAAEQ,cAAc;MACxBC,aAAaT,EAAES,eAAe,CAAA;MAC9BC,iBAAiBV,EAAEU,mBAAmB,CAAA;IACxC,EAAA;AAGF,UAAMC,SACJlB,aAAaa,UAAUb,aAAae,eAAe,UAC9Cf,aAAagB,eAAe,CAAA,GAC1B5C,IAAI,CAACgB,UAAU;MACdA;MACAvB,WAAWqB,SAASY,IAAIV,IAAAA,KAAS,CAAA,GAAIwB,OAAO,CAACvC,MAAMA,EAAET,SAASA,IAAAA,EAAMQ,IAAI,CAACC,MAAMA,EAAEkB,IAAI;IACvF,EAAA,EACCqB,OAAO,CAACO,UAAUA,MAAMtD,SAASuD,SAAS,CAAA,IAC7C,CAAA;AAENvD,aAAS2B,KAAK;MACZ5B;MACA2B,MAAMS,aAAaT;MACnB8B,YAAYrB,aAAaqB;MACzBC,UAAUtB,aAAasB;MACvBC,gBAAgBvB,aAAauB;MAC7BlB,aAAaG;MACbK,QAAQb,aAAaa,UAAU;MAC/BE,YAAYf,aAAae,cAAc;MACvCC,aAAahB,aAAagB,eAAe,CAAA;MACzCC,iBAAiBjB,aAAaiB,mBAAmB,CAAA;MACjDP;MACAQ;MACAjB;MACAuB,SAASxB,aAAawB;MACtBC,SAASzB,aAAayB;MACtBC,SAAS1B,aAAa0B;MACtBC,cAAc3B,aAAa2B;IAC7B,CAAA;EACF;AAIA9D,WAAS+D,KAAK,CAACC,GAAGC,MAAMD,EAAEJ,QAAQM,cAAcD,EAAEL,OAAO,CAAA;AAEzD,SAAO5D;AACT;AAvHgBd;AA0HT,SAASmD,qBACd8B,OAaA1E,UAAwB;AAExB,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAAC0E,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLrF,aAAaU,aAAa,QAAQ0E,MAAMC,OAAOC,iBAAiBF,MAAMC,OAAOE;MAC7EtF,eAAemF,MAAMC,OAAOpF;MAC5BC,aAAakF,MAAMC,OAAOnF;IAC5B;EACF;AAEA,MAAI,CAACkF,MAAMI,IAAK,QAAO;AACvB,SAAO;IACLxF,aAAaoF,MAAMI,IAAIxF;IACvBC,eAAemF,MAAMI,IAAIvF;IACzBC,aAAakF,MAAMI,IAAItF;EACzB;AACF;AA/BgBoD;;;ACtJT,SAASmC,gBACdC,UACAC,cACAC,UACAC,WACAC,UAAmB;AAEnB,SAAOC,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,OAAOC,QAAAA;AACzE;AARgBL;AAWT,SAASO,gBACdN,UACAC,cACAC,UACAC,WAA4B;AAE5B,SAAOE,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,IAAA;AAClE;AAPgBG;AAUhB,SAASD,YACPL,UACAC,cACAC,UACAC,WACAI,WACAH,UAAmB;AAEnB,QAAMI,WAAWP,eAAeD,SAASS,aAAaR,YAAAA,IAAgBS;AACtE,QAAMC,QAAQH,UAAUG,SAAS,CAAC;AAClC,QAAMC,OAAOV,WAAWS,MAAMT,QAAAA,IAAYQ;AAC1C,QAAMG,WAAW;IAAEC,MAAMZ,YAAY;IAAIa,MAAMH,MAAMG,QAAQb,YAAY;EAAG;AAC5E,QAAMc,QAAQb,aAAa,CAAC;AAC5B,MAAI,CAACK,YAAY,CAACI,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAwB,CAAA;AAC9B,aAAWC,OAAOV,SAASS,MAAM;AAC/B,QAAIE,gBAAgB;AACpB,QAAIC,aAAa;AACjB,UAAMC,WAAgC,CAAA;AAEtC,eAAWC,OAAOJ,IAAIG,UAAU;AAC9B,UAAI,CAACd,aAAae,IAAIC,UAAU,OAAQ;AACxC,YAAMT,OAAOQ,IAAIR;AACjB,YAAMU,UAAUxB,SAASqB,WAAWI,mBAAmBX,MAAMQ,IAAIC,KAAK,CAAA;AACtE,UAAI,CAACC,QAAS;AACd,UAAIpB,aAAaM,UAAa,CAACgB,qBAAqBF,QAAQG,qBAAqBvB,QAAAA,EAAW;AAI5F,YAAMwB,YAA8B;WAC/BC,aAAaC,OAAO,CAACC,MAAM,CAAC,CAACP,QAAQQ,iBAAiBD,CAAAA,CAAE;QAC3D;;AAGF,YAAME,aAAarB,KAAKsB,sBAAsBpB,IAAAA;AAC9C,YAAMqB,gBAAgBC,aAAaH,UAAAA;AACnC,YAAMI,YAAYlC,YAAYW,IAAAA;AAE9B,YAAMwB,eAAuCd,QAAQc,eAAe,CAAA,GACjER,OAAO,CAACC,MAAMA,EAAEQ,YAAYR,EAAEtB,WAAW+B,SAASvC,gBAAgB,EAAA,CAAA,EAClEwC,IAAI,CAACV,MAAAA;AACJ,cAAMW,OAAO,wBAACC,SAAAA;AACZ,cAAI,CAACf,UAAUY,SAASG,IAAAA,EAAO,QAAO;AACtC,gBAAMC,YAAYX,aAAaU,IAAAA;AAC/B,gBAAME,SAASV,iBAAiBS,cAAclC,UAAakC,UAAUJ,SAAST,EAAEjB,IAAI;AAEpF,gBAAMgC,WAAWD,UAAU,CAACE,uBAAuBV,WAAWM,MAAMZ,EAAEjB,IAAI;AAC1E,gBAAMkC,cAAcH,SAAS,CAAA,IAAKI,mBAAmBtC,OAAOG,MAAMiB,EAAEjB,MAAM6B,MAAMzC,QAAAA;AAChFkB,wBAAc;AACd,cAAIyB,OAAQ1B,kBAAiB;AAC7B,iBAAO;YAAE0B;YAAQC;YAAUE;UAAY;QACzC,GAVa;AAWb,eAAO;UACLlC,MAAMiB,EAAEjB;UACRoC,OAAOnB,EAAEmB;UACTC,WAAWpB,EAAEoB,aAAa,CAAA;UAC1BC,KAAKV,KAAK,KAAA;UACVW,QAAQX,KAAK,QAAA;UACbxB,KAAKwB,KAAK,KAAA;QACZ;MACF,CAAA;AAEFrB,eAASiC,KAAK;QACZxC,MAAMU,QAAQV;QACdC,MAAMS,QAAQT;QACdwC,MAAM/B,QAAQgC,cAAc;QAC5BjC,OAAOC,QAAQD;QACfI,qBAAqBH,QAAQG;QAC7BC;QACAiB,QAAQV;QACRa,aAAab,gBAAgB,CAAA,IAAKsB,uBAAsB9C,OAAOG,MAAMZ,QAAAA;QACrEoC;MACF,CAAA;IACF;AAEA,QAAIjB,SAASqC,WAAW,EAAG;AAC3BzC,SAAKqC,KAAK;MAAExC,MAAMI,IAAIJ;MAAMC,MAAMG,IAAIH;MAAMwC,MAAMrC,IAAIqC,QAAQ;MAAMpC;MAAeC;MAAYC;IAAS,CAAA;EAC1G;AAGAJ,OAAK0C,KAAK,CAACC,GAAGC,MAAMD,EAAE7C,KAAK+C,cAAcD,EAAE9C,IAAI,CAAA;AAE/C,SAAO;IAAEH,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AApFSX;AAuFT,SAAS4C,mBACPtC,OACAoD,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,SAAKnC,EAAEG,sBAAsB6B,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAIzB,SAASwB,QAAAA,EAAWG,OAAMb,KAAKvB,EAAEhB,IAAI;EACpG;AACA,SAAOoD;AACT;AAbSlB;AAgBT,SAASQ,uBACP9C,OACAoD,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,QAAI9B,aAAaL,EAAEG,sBAAsB6B,WAAAA,CAAY,EAAGI,OAAMb,KAAKvB,EAAEhB,IAAI;EAC3E;AACA,SAAOoD;AACT;AAXSV,OAAAA,wBAAAA;","names":["buildDependsMap","permissions","present","Set","map","p","code","Map","set","dependsOn","filter","dep","has","prereqClosure","deps","out","seen","stack","length","current","pop","get","add","push","cascadeLocked","codes","directlyLocked","locked","visiting","check","viaDep","some","delete","filterGrantedByDeps","granted","ok","satisfied","every","PLATFORMS","UI_PLATFORMS","SITE_TYPES","SERVICE_CODES","snapshotFeatureKey","code","scope","SNAPSHOT_SCHEMA_VERSION","featureAppliesAtNode","applicableSiteTypes","siteType","includes","findFeatureByCode","snapshot","code","feature","Object","values","features","undefined","buildSiteCatalog","businessCode","planCode","siteLocks","bucket","scope","availableServices","business","businesses","plan","plans","catalog","sortedApps","apps","sort","a","b","name","localeCompare","app","businessAppFeatures","filter","ref","map","snapshotFeatureKey","f","microfrontends","web","mobile","length","membership","unlockedPermissions","memberOnBucket","sitePlatformLocked","missingServices","unmetServices","permissions","buildPermissions","lockReason","resolveLockReason","locked","unlockPlans","plansIncludingFeature","push","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","entry","planLocked","siteLocked","requiredServices","service","isSiteLockedOnPlatform","platform","locks","planMembership","planUnlocked","Set","lockEntry","perms","p","isGlobal","deps","buildDependsMap","codes","directlyPlanLocked","directlySiteLocked","has","add","directlyLocked","lockedSet","cascadeLocked","closure","prereqClosure","cascaded","planReason","some","c","siteReason","plansUnlockingClosure","featureCode","result","entries","unlocked","every","buildSiteRoles","roleTemplates","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","web","mobile","EMPTY_ROUTE","remoteEntry","exposedModule","routePrefix","resolveUserFeatures","params","snapshot","businessCode","planCode","siteLocks","roleFeatures","platform","siteType","scope","availableServices","bucket","featureByCode","code","features","snapshotFeatureKey","findFeatureByCode","catalog","buildSiteCatalog","catalogMap","Map","map","f","businessPlans","businesses","plans","currentUnlockedCodes","Set","featureCode","platforms","Object","entries","unlockedPermissions","undefined","add","planAdds","planKey","plan","adds","has","name","push","set","grantedFeatures","grant","granted","perm","get","permsSet","catalogEntry","route","pickRouteForPlatform","featureDeps","buildDependsMap","permissions","permByCode","p","grantedPerms","filterGrantedByDeps","lockedPermissions","c","filter","locked","reason","lockReason","unlockPlans","missingServices","upsell","group","length","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","sort","a","b","localeCompare","entry","mobile","remoteEntryIos","remoteEntryAndroid","web","buildSiteMatrix","snapshot","businessCode","planCode","siteLocks","siteType","buildMatrix","buildPlanMatrix","allScopes","business","businesses","undefined","plans","plan","planMeta","code","name","locks","apps","app","unlockedCount","totalCount","features","ref","scope","feature","snapshotFeatureKey","featureAppliesAtNode","applicableSiteTypes","platforms","UI_PLATFORMS","filter","p","microfrontends","membership","unlockedPermissions","featureInPlan","isPlanMember","siteEntry","permissions","isGlobal","includes","map","cell","plat","planCodes","inPlan","selected","isSiteLockedOnPlatform","availableIn","plansUnlockingPerm","label","dependsOn","web","mobile","push","icon","lucideIcon","plansIncludingFeature","length","sort","a","b","localeCompare","featureCode","permCode","platform","excludeCode","names","Object","entries"]}
+{"version":3,"sources":["../src/catalog-resolver/index.ts","../src/catalog-resolver/permission-deps.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts","../src/catalog-resolver/site-matrix.builder.ts"],"sourcesContent":["// Catalog resolver — the single shared implementation of snapshot resolution (BU catalog, BU matrix, user features)\n\nexport {\n  buildSiteCatalog,\n  buildSiteRoles,\n  featureAppliesAtNode,\n  findFeatureByCode,\n  isPlanMember,\n  isSiteLockedOnPlatform,\n  normalizeApiBuckets,\n  surfaceAllows,\n} from './catalog.builder';\nexport { type ComposeRoleGrantsParams, composeRoleGrants, type RevokedGrants } from './compose-role-grants';\nexport {\n  buildDependsMap,\n  cascadeLocked,\n  type DependsMap,\n  filterGrantedByDeps,\n  prereqClosure,\n} from './permission-deps';\nexport {\n  type ClientPlatform,\n  type LockedPermission,\n  type PermissionFeature,\n  pickRouteForPlatform,\n  type ResolveUserFeaturesParams,\n  resolveUserFeatures,\n} from './resolve-user-features';\nexport {\n  buildPlanMatrix,\n  buildSiteMatrix,\n  type SiteMatrix,\n  type SiteMatrixApp,\n  type SiteMatrixCell,\n  type SiteMatrixFeature,\n  type SiteMatrixPermission,\n} from './site-matrix.builder';\nexport {\n  API_BUCKETS,\n  API_SURFACES,\n  type ApiBucket,\n  type ApiSurface,\n  BUCKET_BY_SURFACE,\n  type BusinessVocabulary,\n  type CatalogPermission,\n  type FeatureCatalogEntry,\n  type FeatureLocks,\n  type FeatureUnlocks,\n  isApiBucket,\n  type LockReason,\n  PLATFORMS,\n  type PlatformBucket,\n  type PlatformCodes,\n  type PlatformDenyCodes,\n  type RoleItem,\n  type ScopeType,\n  SERVICE_CODES,\n  type ServiceCode,\n  SITE_TYPES,\n  type SiteFeatureLocks,\n  type SiteType,\n  SNAPSHOT_SCHEMA_VERSION,\n  type SnapshotApp,\n  type SnapshotAppFeatureRef,\n  type SnapshotBusiness,\n  type SnapshotFeature,\n  type SnapshotMicrofrontendMobile,\n  type SnapshotMicrofrontends,\n  type SnapshotMicrofrontendWeb,\n  type SnapshotPermission,\n  type SnapshotPlan,\n  type SnapshotRoleTemplate,\n  SURFACE_BY_BUCKET,\n  snapshotFeatureKey,\n  UI_PLATFORMS,\n  type UiPlatformBucket,\n  type VersionSnapshot,\n  type VocabularyEntry,\n} from './types';\n","// Intra-feature permission prerequisites — only DIRECT edges are declared; the transitive closure is computed by recursion, cycle-guarded\n\nexport type DependsMap = Map<string, string[]>;\n\n// Builds a dependency map from a feature's permissions, keeping only edges to codes present in the set\nexport function buildDependsMap(permissions: Array<{ code: string; dependsOn?: string[] }>): DependsMap {\n  const present = new Set(permissions.map((p) => p.code));\n  const map: DependsMap = new Map();\n  for (const p of permissions) {\n    map.set(\n      p.code,\n      (p.dependsOn ?? []).filter((dep) => dep !== p.code && present.has(dep)),\n    );\n  }\n  return map;\n}\n\n// Transitive prerequisite closure of a code (excludes the code itself), cycle-safe\nexport function prereqClosure(code: string, deps: DependsMap): string[] {\n  const out = new Set<string>();\n  const seen = new Set<string>([code]);\n  const stack = [code];\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    for (const dep of deps.get(current) ?? []) {\n      if (seen.has(dep)) continue;\n      seen.add(dep);\n      out.add(dep);\n      stack.push(dep);\n    }\n  }\n  return [...out];\n}\n\n// Codes locked after cascade: a code is locked if directly locked or any transitive prerequisite is (cycle-safe)\nexport function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string> {\n  const locked = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (locked.has(code)) return true;\n    if (directlyLocked.has(code)) {\n      locked.add(code);\n      return true;\n    }\n    if (visiting.has(code)) return false;\n    visiting.add(code);\n    const viaDep = (deps.get(code) ?? []).some(check);\n    visiting.delete(code);\n    if (viaDep) locked.add(code);\n    return viaDep;\n  };\n  for (const code of codes) check(code);\n  return locked;\n}\n\n// Keeps only codes whose FULL prerequisite closure is also present — drops a dependent missing any prerequisite (cycle-safe)\nexport function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string> {\n  const ok = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (ok.has(code)) return true;\n    if (!granted.has(code)) return false;\n    if (visiting.has(code)) return true;\n    visiting.add(code);\n    const satisfied = (deps.get(code) ?? []).every(check);\n    visiting.delete(code);\n    if (satisfied) ok.add(code);\n    return satisfied;\n  };\n  for (const code of granted) check(code);\n  return ok;\n}\n","// ——— Platform algebra — plan unlocks, role grants, and BU locks are all stored per platform bucket ———\n\n/**\n * The surfaces a permission can be granted on.\n *\n * `web` and `mobile` are UI buckets: a feature reaches them through a microfrontend, and a grant\n * there means a person can operate it on that surface. `graphql` and `http` are not UIs at all —\n * each is an API surface a credential signs its own requests against, so they have no\n * microfrontend and no route, and a feature needs neither to be reachable on one.\n *\n * Keeping the API buckets in the same algebra rather than beside it is what lets plan entitlement,\n * node feature locks and permission prerequisites bind an API client exactly as they bind a person.\n * One bucket per surface is what lets a plan entitle GraphQL and HTTP access independently.\n */\nexport type PlatformBucket = 'web' | 'mobile' | 'graphql' | 'http';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile', 'graphql', 'http'];\n\n/** Buckets that reach their feature through a microfrontend, and so require one to resolve. */\nexport type UiPlatformBucket = 'web' | 'mobile';\n\nexport const UI_PLATFORMS: UiPlatformBucket[] = ['web', 'mobile'];\n\n// The API surfaces an app credential can present — literally the values of core's `app_type` enum, so\n// enforcement is a plain lookup with no mapping. A feature declares which surfaces expose it.\nexport const API_SURFACES = ['GRAPHQL', 'HTTP'] as const;\nexport type ApiSurface = (typeof API_SURFACES)[number];\n\n/** Buckets that admit an API credential rather than a person — exactly one per surface. */\nexport type ApiBucket = Exclude<PlatformBucket, UiPlatformBucket>;\n\nexport const API_BUCKETS: ApiBucket[] = ['graphql', 'http'];\n\nexport const SURFACE_BY_BUCKET: Record<ApiBucket, ApiSurface> = { graphql: 'GRAPHQL', http: 'HTTP' };\nexport const BUCKET_BY_SURFACE: Record<ApiSurface, ApiBucket> = { GRAPHQL: 'graphql', HTTP: 'http' };\n\nexport function isApiBucket(bucket: PlatformBucket): bucket is ApiBucket {\n  return bucket === 'graphql' || bucket === 'http';\n}\n\n// Documents written before GraphQL and HTTP were entitled separately may still carry a single legacy\n// `app` bucket meaning \"any API surface\". It is deliberately NOT part of these shapes — nothing may\n// write it — and is honoured only inside `normalizeApiBuckets`, which copies it into graphql/http.\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n  graphql?: string[];\n  http?: string[];\n}\n\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n  graphql?: string[] | null;\n  http?: string[] | null;\n}\n\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\nexport type FeatureLocks = Record<string, PlatformDenyCodes>;\nexport type SiteFeatureLocks = FeatureLocks;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n  dependsOn: string[];\n}\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport type ScopeType = 'ORG' | 'LE' | 'SITE_GROUP' | 'SITE';\nexport type SiteType = 'OUTLET' | 'WAREHOUSE' | 'PRODUCTION';\nexport const SITE_TYPES: SiteType[] = ['OUTLET', 'WAREHOUSE', 'PRODUCTION'];\n// External services a feature can depend on — the org must have the service provisioned before the feature\n// unlocks. Add new services here and nowhere else in this package; every lock path is service-agnostic.\nexport const SERVICE_CODES = ['GITEA'] as const;\nexport type ServiceCode = (typeof SERVICE_CODES)[number];\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n  // Optional: snapshots built before service gating existed carry no services, which reads as \"requires none\"\n  requiredServices?: ServiceCode[];\n  // Optional: snapshots built before surface gating existed carry no list, which reads as \"reachable by any\n  // app credential\". A present list is strict — it decides which of the `graphql`/`http` buckets the feature\n  // offers at all, and `[]` offers neither. The builder always emits it, so only pre-flag snapshots are lenient.\n  apiSurfaces?: ApiSurface[];\n}\nexport interface SnapshotAppFeatureRef {\n  code: string;\n  scope: ScopeType;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: SnapshotAppFeatureRef[];\n}\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  scope: ScopeType;\n  siteType: SiteType;\n  features: FeatureUnlocks;\n}\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxSites: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface VocabularyEntry {\n  singular: string;\n  plural: string;\n}\nexport interface BusinessVocabulary {\n  site?: VocabularyEntry;\n  siteGroup?: VocabularyEntry;\n  outlet?: VocabularyEntry;\n  warehouse?: VocabularyEntry;\n  production?: VocabularyEntry;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  vocabulary?: BusinessVocabulary;\n  apps: SnapshotApp[];\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  schemaVersion?: number;\n  // Flat feature dictionary keyed by `${scope}.${code}` (see snapshotFeatureKey) — same-code features at different scopes stay distinct\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// Composite key for the snapshot feature dictionary — feature identity is (scope, code)\nexport function snapshotFeatureKey(code: string, scope: ScopeType): string {\n  return `${scope}.${code}`;\n}\n\nexport const SNAPSHOT_SCHEMA_VERSION = 4;\n\n// SERVICE = the org has not provisioned an external service the feature declares; the specific services are\n// reported alongside in `missingServices` so callers never branch on a service code baked into this union\nexport type LockReason = 'PLAN' | 'SITE' | 'SERVICE';\n\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n  permissions: CatalogPermission[];\n}\n\nexport type RoleItem = SnapshotRoleTemplate;\n","import { buildDependsMap, cascadeLocked, prereqClosure } from './permission-deps';\nimport type {\n  ApiSurface,\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  PlatformDenyCodes,\n  RoleItem,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\nimport { isApiBucket, PLATFORMS, SURFACE_BY_BUCKET, snapshotFeatureKey } from './types';\n\n/**\n * Copies a legacy `app` bucket into whichever of `graphql`/`http` an entry lacks.\n *\n * Documents written before the API surfaces were entitled separately — old snapshots, old\n * credential grants, old deny-lists — carry one `app` bucket that meant \"any API surface\".\n * Normalising at read time is what lets those documents keep working without a re-key: an\n * `app` grant admits both surfaces, and an `app` lock fails closed on both. Entries already\n * carrying a surface bucket keep it — the legacy value only fills gaps.\n */\nexport function normalizeApiBuckets<T extends PlatformCodes | PlatformDenyCodes>(\n  doc: Record<string, T> | undefined,\n): Record<string, T> | undefined {\n  if (!doc) return doc;\n  let changed = false;\n  const next: Record<string, T> = {};\n  for (const [code, entry] of Object.entries(doc)) {\n    // The legacy key is deliberately absent from the public shapes so nothing can write it;\n    // stored documents predating the split are the only place it still occurs.\n    const legacy = (entry as T & LegacyApiBucket).app;\n    if (legacy === undefined || (entry.graphql !== undefined && entry.http !== undefined)) {\n      next[code] = entry;\n      continue;\n    }\n    changed = true;\n    next[code] = {\n      ...entry,\n      ...(entry.graphql === undefined ? { graphql: legacy } : {}),\n      ...(entry.http === undefined ? { http: legacy } : {}),\n    };\n  }\n  return changed ? next : doc;\n}\n\n// The pre-split single API bucket, as old persisted jsonb still carries it\ntype LegacyApiBucket = { app?: string[] | null };\n\n// Normalizes every plan's unlock document in one pass, so per-plan upsell lookups read legacy docs correctly too\nfunction normalizePlans(plans: Record<string, SnapshotPlan>): Record<string, SnapshotPlan> {\n  let changed = false;\n  const next: Record<string, SnapshotPlan> = {};\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlockedPermissions = normalizeApiBuckets(plan.unlockedPermissions) ?? {};\n    if (unlockedPermissions !== plan.unlockedPermissions) changed = true;\n    next[code] = unlockedPermissions === plan.unlockedPermissions ? plan : { ...plan, unlockedPermissions };\n  }\n  return changed ? next : plans;\n}\n\n// Whether a feature with the given site-type applicability is exposed at this site type\nexport function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean {\n  return applicableSiteTypes.includes(siteType);\n}\n\n// Scope-agnostic lookup of a feature by bare code — grants/locks key features by code alone, so the first scope-variant's shared metadata (permission graph) answers\nexport function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined {\n  for (const feature of Object.values(snapshot.features ?? {})) {\n    if (feature?.code === code) return feature;\n  }\n  return undefined;\n}\n\n// Builds the per-site catalog for ONE platform bucket — plan is the ceiling, siteLocks is a deny-list within it; each permission carries locked + lockReason + unlockPlans\n// availableServices defaults to none, so a caller that doesn't know the org's provisioned services locks every service-dependent feature rather than leaking it\nexport function buildSiteCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  bucket: PlatformBucket,\n  siteType?: SiteType,\n  scope?: ScopeType,\n  availableServices: ServiceCode[] = [],\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  // Legacy `app` buckets in stored documents read as both API surfaces — see normalizeApiBuckets\n  const plans = normalizePlans(business.plans ?? {});\n  const plan = planCode ? plans[planCode] : undefined;\n  const locks = normalizeApiBuckets(siteLocks);\n\n  const catalog: FeatureCatalogEntry[] = [];\n  // Iterate apps alphabetically by name so the resolved feature list (→ core-web sidebar) is app-alphabetical without any frontend re-sort\n  const sortedApps = [...business.apps].sort((a, b) => a.name.localeCompare(b.name));\n  for (const app of sortedApps) {\n    // The app's renderable features (each ref pins scope+code to one app), dropped when they don't belong to this workspace scope or node type (outlet vs container)\n    const businessAppFeatures = app.features\n      .filter((ref) => scope === undefined || ref.scope === scope)\n      .map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)])\n      .filter(\n        (f): f is SnapshotFeature =>\n          !!f &&\n          // A UI bucket needs something to render, so a feature shipping no microfrontend is dropped.\n          // An API bucket renders nothing — there a feature is admitted by the surfaces it declares\n          // instead, so a GRAPHQL credential never resolves an HTTP-only feature. A surface-excluded\n          // feature vanishes from the catalog entirely, which is what makes resolution fail closed.\n          (isApiBucket(bucket)\n            ? surfaceAllows(f.apiSurfaces, SURFACE_BY_BUCKET[bucket])\n            : !!(f.microfrontends?.web || f.microfrontends?.mobile)) &&\n          (siteType === undefined || featureAppliesAtNode(f.applicableSiteTypes, siteType)),\n      );\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves as a locked tile instead of vanishing\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions?.[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      // Feature-level lock is EXPLICIT: plan must include the feature on this bucket, the site must not null-lock\n      // the platform, and every external service the feature declares must be provisioned for the org\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const sitePlatformLocked = locks?.[feature.code]?.[bucket] === null;\n      const missingServices = unmetServices(feature, availableServices);\n      // Unmet services lock every permission too — otherwise the feature reads locked while its actions still\n      // report as available, which is not how plan and site locks behave\n      const permissions = buildPermissions(feature, businessCode, membership, locks, plans, bucket, missingServices);\n      const lockReason = resolveLockReason(!memberOnBucket, sitePlatformLocked, missingServices);\n      const locked = lockReason !== null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        missingServices,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions).\n// Iterates PLATFORMS plus the legacy `app` key, so a caller handing over an un-normalized document\n// still reads a legacy API entitlement as membership.\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  if (!entry) return false;\n  return PLATFORMS.some((platform) => entry[platform] !== undefined) || (entry as LegacyApiBucket).app !== undefined;\n}\n\n/**\n * Whether a feature's declared API surfaces admit a caller's surface.\n *\n * Lenient on either side being unknown: a pre-flag snapshot declares nothing (`undefined`), and a\n * caller resolving without a surface (cloud's matrix builders, UI buckets) filters nothing. Strictness\n * comes from both sides being present — including a declared `[]`, which admits no surface at all.\n */\nexport function surfaceAllows(surfaces: ApiSurface[] | undefined, surface: ApiSurface | undefined): boolean {\n  return surface === undefined || surfaces === undefined || surfaces.includes(surface);\n}\n\n// The one place lock precedence is decided, for features and permissions alike; null means nothing locks.\n// Plan is the ceiling (an unentitled feature must upsell, not send the user to provision something they still\n// couldn't use), then the site deny-list, then any unprovisioned service.\nfunction resolveLockReason(\n  planLocked: boolean,\n  siteLocked: boolean,\n  missingServices: ServiceCode[],\n): LockReason | null {\n  if (planLocked) return 'PLAN';\n  if (siteLocked) return 'SITE';\n  if (missingServices.length > 0) return 'SERVICE';\n  return null;\n}\n\n// The services a feature declares that this org has not provisioned\nfunction unmetServices(feature: SnapshotFeature, availableServices: ServiceCode[]): ServiceCode[] {\n  return (feature.requiredServices ?? []).filter((service) => !availableServices.includes(service));\n}\n\n// Per-platform site-lock primitive: null locks the whole feature, string[] locks those codes, absent = not locked\nexport function isSiteLockedOnPlatform(\n  entry: SiteFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and site deny-list\n// (bucket-scoped). Unmet services lock the whole set — an unprovisioned service blocks every action on the feature.\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n  missingServices: ServiceCode[] = [],\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = siteLocks?.[feature.code];\n\n  const perms = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode));\n  const deps = buildDependsMap(perms);\n  const codes = perms.map((p) => p.code);\n\n  // Direct plan/site locks, then cascade so a locked prerequisite (e.g. view) locks its dependents (add/edit/delete)\n  const directlyPlanLocked = new Set<string>();\n  const directlySiteLocked = new Set<string>();\n  for (const p of perms) {\n    if (!planUnlocked.has(p.code)) directlyPlanLocked.add(p.code);\n    if (isSiteLockedOnPlatform(lockEntry, bucket, p.code)) directlySiteLocked.add(p.code);\n  }\n  const directlyLocked = new Set<string>([...directlyPlanLocked, ...directlySiteLocked]);\n  const lockedSet = cascadeLocked(codes, directlyLocked, deps);\n\n  return perms.map((p) => {\n    // A permission is enabled only if it AND its whole prerequisite closure are unlocked — reason/upsell reflect that\n    const closure = [p.code, ...prereqClosure(p.code, deps)];\n    const cascaded = lockedSet.has(p.code);\n    const planReason = cascaded && closure.some((c) => directlyPlanLocked.has(c));\n    const siteReason = cascaded && closure.some((c) => directlySiteLocked.has(c));\n    const lockReason = resolveLockReason(planReason, siteReason, missingServices);\n    const locked = lockReason !== null;\n    const unlockPlans = lockReason === 'PLAN' ? plansUnlockingClosure(plans, feature.code, closure, bucket) : [];\n    return { code: p.code, locked, lockReason, unlockPlans, missingServices };\n  });\n}\n\n// Plan codes (in the business) whose unlocked set includes the permission AND its whole prerequisite closure — upsell targets\nfunction plansUnlockingClosure(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  closure: string[],\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlocked = plan.unlockedPermissions?.[featureCode]?.[bucket];\n    if (unlocked && closure.every((c) => unlocked.includes(c))) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates ?? {});\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10); inputs are never mutated\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions ?? {})]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions?.[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set.\n    // Iterates PLATFORMS rather than naming buckets — the web/mobile-only version silently\n    // dropped a grant surviving only on an API bucket.\n    if (PLATFORMS.every((bucket) => composed[bucket] === undefined)) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildSiteCatalog, findFeatureByCode, normalizeApiBuckets } from './catalog.builder';\nimport { buildDependsMap, filterGrantedByDeps } from './permission-deps';\nimport type {\n  FeatureUnlocks,\n  LockReason,\n  PlatformBucket,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  VersionSnapshot,\n} from './types';\nimport { isApiBucket, snapshotFeatureKey } from './types';\n\n/**\n * The caller's surface, as the caller reports it.\n *\n * Finer than `PlatformBucket` on the mobile side — `ios` and `android` load different remote\n * entries but share one grant bucket. The API platforms are one-to-one with their buckets: an\n * API client has no variants because it has no UI.\n */\nexport type ClientPlatform = 'web' | 'ios' | 'android' | 'graphql' | 'http';\n\n// Exhaustive by type, so adding a ClientPlatform without deciding its bucket fails the build instead\n// of silently falling through to mobile — which is how an API caller would end up resolving a UI bucket.\nconst BUCKET_BY_CLIENT: Record<ClientPlatform, PlatformBucket> = {\n  web: 'web',\n  ios: 'mobile',\n  android: 'mobile',\n  graphql: 'graphql',\n  http: 'http',\n};\n\n/**\n * Stands in for the microfrontend an API client does not load.\n *\n * `PermissionFeature.route` is non-optional and read by the web sidebar and the mobile host to\n * mount a remote. Nothing on the API paths reads it — the permission interceptor uses `code`,\n * `permissions` and `locked` — so an empty route keeps one shape for every bucket instead of\n * widening the field to null across every consumer.\n */\nconst EMPTY_ROUTE = { remoteEntry: '', exposedModule: '', routePrefix: '' };\n\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface PlanUpsell {\n  plan: string;\n  features: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  // Which declared services the org has not provisioned — empty unless lockReason is 'SERVICE'\n  missingServices: ServiceCode[];\n  lockedPermissions: LockedPermission[];\n  upsell: PlanUpsell[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  siteLocks: SiteFeatureLocks | undefined;\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n  siteType?: SiteType;\n  scope?: ScopeType;\n  // External services the org has provisioned; omitting it locks every service-dependent feature\n  availableServices?: ServiceCode[];\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants, filtered to the requested platform\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, siteLocks, platform, siteType, scope, availableServices } = params;\n\n  // Plan unlocks, BU locks, and role grants are stored per platform; resolve only the requesting\n  // surface's bucket (web → web; ios/android → mobile; graphql/http → themselves)\n  const bucket: PlatformBucket = BUCKET_BY_CLIENT[platform];\n\n  // Legacy `app` buckets in stored grants read as both API surfaces — see normalizeApiBuckets\n  const roleFeatures = normalizeApiBuckets(params.roleFeatures) ?? {};\n\n  // Grants/plans/locks key features by bare code; resolve to the workspace scope's variant (or any variant when unscoped)\n  const featureByCode = (code: string) =>\n    scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code);\n\n  // Plan ∧ BU overlay for this bucket, filtered to features that apply to this workspace scope and node type — emits EVERY applicable business feature (plan non-members come out fully locked)\n  const catalog = buildSiteCatalog(\n    snapshot,\n    businessCode,\n    planCode,\n    siteLocks,\n    bucket,\n    siteType,\n    scope,\n    availableServices,\n  );\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Per-plan feature-name delta vs the current plan — feeds the plan-locked upsell screen.\n  // Normalized so a legacy plan document's `app` entitlement still counts for either API bucket.\n  const businessPlans = Object.fromEntries(\n    Object.entries(snapshot.businesses[businessCode]?.plans ?? {}).map(([code, plan]) => [\n      code,\n      { ...plan, unlockedPermissions: normalizeApiBuckets(plan.unlockedPermissions) ?? {} },\n    ]),\n  );\n  const currentUnlockedCodes = new Set<string>();\n  if (planCode && businessPlans[planCode]) {\n    for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] !== undefined) currentUnlockedCodes.add(featureCode);\n    }\n  }\n  const planAdds = new Map<string, Array<{ code: string; name: string }>>();\n  for (const [planKey, plan] of Object.entries(businessPlans)) {\n    if (planKey === planCode) continue;\n    const adds: Array<{ code: string; name: string }> = [];\n    for (const [featureCode, platforms] of Object.entries(plan.unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] === undefined || currentUnlockedCodes.has(featureCode)) continue;\n      const name = featureByCode(featureCode)?.name;\n      if (name) adds.push({ code: featureCode, name });\n    }\n    planAdds.set(planKey, adds);\n  }\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures ?? {})) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant?.[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    // A UI bucket reaches its feature by loading a microfrontend, so a feature not published to\n    // this platform is omitted rather than handed over as an unloadable tile. An API client loads\n    // nothing — requiring a route there would make every headless feature permanently ungrantable.\n    const route = isApiBucket(bucket) ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);\n    if (!route) continue;\n\n    // Drop granted permissions whose intra-feature prerequisites aren't also granted (e.g. add needs view)\n    const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [p.code, p]));\n    const grantedPerms = [...filterGrantedByDeps(permsSet, featureDeps)];\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({\n        code: p.code,\n        reason: p.lockReason ?? null,\n        unlockPlans: p.unlockPlans ?? [],\n        missingServices: p.missingServices ?? [],\n      }));\n\n    // For a plan-locked feature, list the extra features each unlocking plan would add (excluding this feature)\n    const upsell: PlanUpsell[] =\n      catalogEntry.locked && catalogEntry.lockReason === 'PLAN'\n        ? (catalogEntry.unlockPlans ?? [])\n            .map((plan) => ({\n              plan,\n              features: (planAdds.get(plan) ?? []).filter((f) => f.code !== code).map((f) => f.name),\n            }))\n            .filter((group) => group.features.length > 0)\n        : [];\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans ?? [],\n      missingServices: catalogEntry.missingServices ?? [],\n      lockedPermissions,\n      upsell,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  // Order app-alphabetically so the core-web sidebar (groups by app) renders apps sorted without any frontend re-sort;\n  // stable sort keeps each app's features in their existing relative order\n  features.sort((a, b) => a.appName.localeCompare(b.appName));\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform, or null when it doesn't publish there\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  // API platforms load nothing — resolveUserFeatures never routes them here, and answering with the\n  // web block for an unhandled value would hand an API caller a remote it cannot mount\n  if (platform === 'graphql' || platform === 'http') return null;\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n","import { featureAppliesAtNode, isPlanMember, isSiteLockedOnPlatform, normalizeApiBuckets } from './catalog.builder';\nimport {\n  API_BUCKETS,\n  type ApiSurface,\n  type PlatformBucket,\n  type ScopeType,\n  type SiteFeatureLocks,\n  type SiteType,\n  type SnapshotPlan,\n  SURFACE_BY_BUCKET,\n  snapshotFeatureKey,\n  UI_PLATFORMS,\n  type VersionSnapshot,\n} from './types';\n\nexport interface SiteMatrixCell {\n  inPlan: boolean;\n  selected: boolean;\n  availableIn: string[];\n}\n\nexport interface SiteMatrixPermission {\n  code: string;\n  label: string;\n  dependsOn: string[];\n  web: SiteMatrixCell | null;\n  mobile: SiteMatrixCell | null;\n  graphql: SiteMatrixCell | null;\n  http: SiteMatrixCell | null;\n}\n\nexport interface SiteMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  platforms: PlatformBucket[];\n  inPlan: boolean;\n  availableIn: string[];\n  // The API surfaces the feature declares — what lets the app-credential editor filter by the\n  // credential's type. Absent on pre-flag snapshots, which reads as \"any surface\".\n  apiSurfaces?: ApiSurface[];\n  permissions: SiteMatrixPermission[];\n}\n\nexport interface SiteMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  unlockedCount: number;\n  totalCount: number;\n  features: SiteMatrixFeature[];\n}\n\nexport interface SiteMatrix {\n  plan: { code: string; name: string };\n  apps: SiteMatrixApp[];\n  locks: SiteFeatureLocks;\n}\n\n// Builds the SITE-only apps/features/permissions matrix — not filtered to plan members; plan-locked items carry inPlan=false + availableIn\nexport function buildSiteMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  siteType?: SiteType,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, false, siteType);\n}\n\n// Builds the all-scopes apps/features/permissions matrix — every scope's features included, each carrying its real scope; powers the Plan Overview + Create Custom Role picker\nexport function buildPlanMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks?: SiteFeatureLocks,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, true);\n}\n\n// Shared matrix builder — allScopes=false keeps only SITE refs; allScopes=true includes every scope and emits each feature's real scope\nfunction buildMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  allScopes: boolean,\n  siteType?: SiteType,\n): SiteMatrix {\n  const business = businessCode ? snapshot.businesses?.[businessCode] : undefined;\n  // Legacy `app` buckets in stored documents read as both API surfaces — see normalizeApiBuckets\n  const plans = Object.fromEntries(\n    Object.entries(business?.plans ?? {}).map(([code, p]) => [\n      code,\n      { ...p, unlockedPermissions: normalizeApiBuckets(p.unlockedPermissions) ?? {} },\n    ]),\n  );\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const normalizedLocks = normalizeApiBuckets(siteLocks);\n  const locks = normalizedLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: SiteMatrixApp[] = [];\n  for (const app of business.apps) {\n    let unlockedCount = 0;\n    let totalCount = 0;\n    const features: SiteMatrixFeature[] = [];\n\n    for (const ref of app.features) {\n      if (!allScopes && ref.scope !== 'SITE') continue;\n      const code = ref.code;\n      const feature = snapshot.features?.[snapshotFeatureKey(code, ref.scope)];\n      if (!feature) continue;\n      if (siteType !== undefined && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;\n      // A UI bucket is offered only where the feature publishes a microfrontend; each API bucket is\n      // offered where the feature declares its surface. An undeclared list (pre-flag snapshot) keeps\n      // the old always-offered behaviour on both; an undeclared surface shows an em dash like a\n      // missing microfrontend does.\n      const platforms: PlatformBucket[] = [\n        ...UI_PLATFORMS.filter((p) => !!feature.microfrontends?.[p]),\n        ...API_BUCKETS.filter(\n          (b) => feature.apiSurfaces === undefined || feature.apiSurfaces.includes(SURFACE_BY_BUCKET[b]),\n        ),\n      ];\n\n      const membership = plan.unlockedPermissions?.[code];\n      const featureInPlan = isPlanMember(membership);\n      const siteEntry = normalizedLocks?.[code];\n\n      const permissions: SiteMatrixPermission[] = (feature.permissions ?? [])\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): SiteMatrixCell | null => {\n            if (!platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the site locks it on this platform\n            const selected = inPlan && !isSiteLockedOnPlatform(siteEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            totalCount += 1;\n            if (inPlan) unlockedCount += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return {\n            code: p.code,\n            label: p.label,\n            dependsOn: p.dependsOn ?? [],\n            web: cell('web'),\n            mobile: cell('mobile'),\n            graphql: cell('graphql'),\n            http: cell('http'),\n          };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        scope: feature.scope,\n        applicableSiteTypes: feature.applicableSiteTypes,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        apiSurfaces: feature.apiSurfaces,\n        permissions,\n      });\n    }\n\n    if (features.length === 0) continue;\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, unlockedCount, totalCount, features });\n  }\n\n  // Emit apps alphabetically by name so every consumer (Plan Overview, Role picker, all Locks screens) renders them sorted\n  apps.sort((a, b) => a.name.localeCompare(b.name));\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions?.[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions?.[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACKO,SAASA,gBAAgBC,aAA0D;AACxF,QAAMC,UAAU,IAAIC,IAAIF,YAAYG,IAAI,CAACC,MAAMA,EAAEC,IAAI,CAAA;AACrD,QAAMF,MAAkB,oBAAIG,IAAAA;AAC5B,aAAWF,KAAKJ,aAAa;AAC3BG,QAAII,IACFH,EAAEC,OACDD,EAAEI,aAAa,CAAA,GAAIC,OAAO,CAACC,QAAQA,QAAQN,EAAEC,QAAQJ,QAAQU,IAAID,GAAAA,CAAAA,CAAAA;EAEtE;AACA,SAAOP;AACT;AAVgBJ;AAaT,SAASa,cAAcP,MAAcQ,MAAgB;AAC1D,QAAMC,MAAM,oBAAIZ,IAAAA;AAChB,QAAMa,OAAO,oBAAIb,IAAY;IAACG;GAAK;AACnC,QAAMW,QAAQ;IAACX;;AACf,SAAOW,MAAMC,SAAS,GAAG;AACvB,UAAMC,UAAUF,MAAMG,IAAG;AACzB,eAAWT,OAAOG,KAAKO,IAAIF,OAAAA,KAAY,CAAA,GAAI;AACzC,UAAIH,KAAKJ,IAAID,GAAAA,EAAM;AACnBK,WAAKM,IAAIX,GAAAA;AACTI,UAAIO,IAAIX,GAAAA;AACRM,YAAMM,KAAKZ,GAAAA;IACb;EACF;AACA,SAAO;OAAII;;AACb;AAdgBF;AAiBT,SAASW,cAAcC,OAAiBC,gBAA6BZ,MAAgB;AAC1F,QAAMa,SAAS,oBAAIxB,IAAAA;AACnB,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAIqB,OAAOf,IAAIN,IAAAA,EAAO,QAAO;AAC7B,QAAIoB,eAAed,IAAIN,IAAAA,GAAO;AAC5BqB,aAAOL,IAAIhB,IAAAA;AACX,aAAO;IACT;AACA,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAMwB,UAAUhB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAIyB,KAAKF,KAAAA;AAC3CD,aAASI,OAAO1B,IAAAA;AAChB,QAAIwB,OAAQH,QAAOL,IAAIhB,IAAAA;AACvB,WAAOwB;EACT,GAZc;AAad,aAAWxB,QAAQmB,MAAOI,OAAMvB,IAAAA;AAChC,SAAOqB;AACT;AAlBgBH;AAqBT,SAASS,oBAAoBC,SAAsBpB,MAAgB;AACxE,QAAMqB,KAAK,oBAAIhC,IAAAA;AACf,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAI6B,GAAGvB,IAAIN,IAAAA,EAAO,QAAO;AACzB,QAAI,CAAC4B,QAAQtB,IAAIN,IAAAA,EAAO,QAAO;AAC/B,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAM8B,aAAatB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAI+B,MAAMR,KAAAA;AAC/CD,aAASI,OAAO1B,IAAAA;AAChB,QAAI8B,UAAWD,IAAGb,IAAIhB,IAAAA;AACtB,WAAO8B;EACT,GATc;AAUd,aAAW9B,QAAQ4B,QAASL,OAAMvB,IAAAA;AAClC,SAAO6B;AACT;AAfgBF;;;ACxCT,IAAMK,YAA8B;EAAC;EAAO;EAAU;EAAW;;AAKjE,IAAMC,eAAmC;EAAC;EAAO;;AAIjD,IAAMC,eAAe;EAAC;EAAW;;AAMjC,IAAMC,cAA2B;EAAC;EAAW;;AAE7C,IAAMC,oBAAmD;EAAEC,SAAS;EAAWC,MAAM;AAAO;AAC5F,IAAMC,oBAAmD;EAAEC,SAAS;EAAWC,MAAM;AAAO;AAE5F,SAASC,YAAYC,QAAsB;AAChD,SAAOA,WAAW,aAAaA,WAAW;AAC5C;AAFgBD;AAwDT,IAAME,aAAyB;EAAC;EAAU;EAAa;;AAGvD,IAAMC,gBAAgB;EAAC;;AAsEvB,SAASC,mBAAmBC,MAAcC,OAAgB;AAC/D,SAAO,GAAGA,KAAAA,IAASD,IAAAA;AACrB;AAFgBD;AAIT,IAAMG,0BAA0B;;;AC5IhC,SAASC,oBACdC,KAAkC;AAElC,MAAI,CAACA,IAAK,QAAOA;AACjB,MAAIC,UAAU;AACd,QAAMC,OAA0B,CAAC;AACjC,aAAW,CAACC,MAAMC,KAAAA,KAAUC,OAAOC,QAAQN,GAAAA,GAAM;AAG/C,UAAMO,SAAUH,MAA8BI;AAC9C,QAAID,WAAWE,UAAcL,MAAMM,YAAYD,UAAaL,MAAMO,SAASF,QAAY;AACrFP,WAAKC,IAAAA,IAAQC;AACb;IACF;AACAH,cAAU;AACVC,SAAKC,IAAAA,IAAQ;MACX,GAAGC;MACH,GAAIA,MAAMM,YAAYD,SAAY;QAAEC,SAASH;MAAO,IAAI,CAAC;MACzD,GAAIH,MAAMO,SAASF,SAAY;QAAEE,MAAMJ;MAAO,IAAI,CAAC;IACrD;EACF;AACA,SAAON,UAAUC,OAAOF;AAC1B;AAtBgBD;AA4BhB,SAASa,eAAeC,OAAmC;AACzD,MAAIZ,UAAU;AACd,QAAMC,OAAqC,CAAC;AAC5C,aAAW,CAACC,MAAMW,IAAAA,KAAST,OAAOC,QAAQO,KAAAA,GAAQ;AAChD,UAAME,sBAAsBhB,oBAAoBe,KAAKC,mBAAmB,KAAK,CAAC;AAC9E,QAAIA,wBAAwBD,KAAKC,oBAAqBd,WAAU;AAChEC,SAAKC,IAAAA,IAAQY,wBAAwBD,KAAKC,sBAAsBD,OAAO;MAAE,GAAGA;MAAMC;IAAoB;EACxG;AACA,SAAOd,UAAUC,OAAOW;AAC1B;AATSD;AAYF,SAASI,qBAAqBC,qBAAiCC,UAAkB;AACtF,SAAOD,oBAAoBE,SAASD,QAAAA;AACtC;AAFgBF;AAKT,SAASI,kBAAkBC,UAA2BlB,MAAY;AACvE,aAAWmB,WAAWjB,OAAOkB,OAAOF,SAASG,YAAY,CAAC,CAAA,GAAI;AAC5D,QAAIF,SAASnB,SAASA,KAAM,QAAOmB;EACrC;AACA,SAAOb;AACT;AALgBW;AAST,SAASK,iBACdJ,UACAK,cACAC,UACAC,WACAC,QACAX,UACAY,OACAC,oBAAmC,CAAA,GAAE;AAErC,MAAI,CAACL,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWX,SAASY,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AAEtB,QAAMnB,QAAQD,eAAeoB,SAASnB,SAAS,CAAC,CAAA;AAChD,QAAMC,OAAOa,WAAWd,MAAMc,QAAAA,IAAYlB;AAC1C,QAAMyB,QAAQnC,oBAAoB6B,SAAAA;AAElC,QAAMO,UAAiC,CAAA;AAEvC,QAAMC,aAAa;OAAIJ,SAASK;IAAMC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,KAAKC,cAAcF,EAAEC,IAAI,CAAA;AAChF,aAAWjC,OAAO4B,YAAY;AAE5B,UAAMO,sBAAsBnC,IAAIgB,SAC7BoB,OAAO,CAACC,QAAQf,UAAUrB,UAAaoC,IAAIf,UAAUA,KAAAA,EACrDgB,IAAI,CAACD,QAAQxB,SAASG,WAAWuB,mBAAmBF,IAAI1C,MAAM0C,IAAIf,KAAK,CAAA,CAAE,EACzEc,OACC,CAACI,MACC,CAAC,CAACA;;;;KAKDC,YAAYpB,MAAAA,IACTqB,cAAcF,EAAEG,aAAaC,kBAAkBvB,MAAAA,CAAO,IACtD,CAAC,EAAEmB,EAAEK,gBAAgBC,OAAON,EAAEK,gBAAgBE,aACjDrC,aAAaT,UAAaO,qBAAqBgC,EAAE/B,qBAAqBC,QAAAA,EAAQ;AAGrF,QAAIyB,oBAAoBa,WAAW,EAAG;AAGtC,eAAWlC,WAAWqB,qBAAqB;AACzC,YAAMc,aAAa3C,MAAMC,sBAAsBO,QAAQnB,IAAI;AAE3D,YAAMmD,MAAMhC,QAAQ+B,gBAAgBC;AACpC,YAAMC,SAASjC,QAAQ+B,gBAAgBE;AAIvC,YAAMG,iBAAiBD,aAAa5B,MAAAA,MAAYpB;AAChD,YAAMkD,qBAAqBzB,QAAQZ,QAAQnB,IAAI,IAAI0B,MAAAA,MAAY;AAC/D,YAAM+B,kBAAkBC,cAAcvC,SAASS,iBAAAA;AAG/C,YAAM+B,cAAcC,iBAAiBzC,SAASI,cAAc+B,YAAYvB,OAAOrB,OAAOgB,QAAQ+B,eAAAA;AAC9F,YAAMI,aAAaC,kBAAkB,CAACP,gBAAgBC,oBAAoBC,eAAAA;AAC1E,YAAMM,SAASF,eAAe;AAC9B,YAAMG,cAAcH,eAAe,SAASI,sBAAsBvD,OAAOS,QAAQnB,MAAM0B,MAAAA,IAAU,CAAA;AAEjGM,cAAQkC,KAAK;QACXlE,MAAMmB,QAAQnB;QACdsC,MAAMnB,QAAQmB;QACd6B,YAAYhD,QAAQgD,cAAc;QAClCC,UAAUjD,QAAQiD,YAAY;QAC9BC,gBAAgBlD,QAAQkD,kBAAkB;QAC1ClB,KAAKA,MACD;UACEmB,aAAanB,IAAImB,eAAe;UAChCC,eAAepB,IAAIoB,iBAAiB;UACpCC,aAAarB,IAAIqB,eAAe;QAClC,IACA;QACJpB,QAAQA,SACJ;UACEqB,oBAAoBrB,OAAOqB,sBAAsB;UACjDC,gBAAgBtB,OAAOsB,kBAAkB;UACzCH,eAAenB,OAAOmB,iBAAiB;UACvCC,aAAapB,OAAOoB,eAAe;QACrC,IACA;QACJG,SAAStE,IAAIL;QACb4E,SAASvE,IAAIiC;QACbuC,SAASxE,IAAIyE,QAAQ;QACrBC,cAAc1E,IAAI2E,aAAa;QAC/BjB;QACAF;QACAG;QACAP;QACAE;MACF,CAAA;IACF;EACF;AACA,SAAO3B;AACT;AA9FgBV;AAmGT,SAAS2D,aAAahF,OAAgC;AAC3D,MAAI,CAACA,MAAO,QAAO;AACnB,SAAOiF,UAAUC,KAAK,CAACC,aAAanF,MAAMmF,QAAAA,MAAc9E,MAAAA,KAAeL,MAA0BI,QAAQC;AAC3G;AAHgB2E;AAYT,SAASlC,cAAcsC,UAAoCC,SAA+B;AAC/F,SAAOA,YAAYhF,UAAa+E,aAAa/E,UAAa+E,SAASrE,SAASsE,OAAAA;AAC9E;AAFgBvC;AAOhB,SAASe,kBACPyB,YACAC,YACA/B,iBAA8B;AAE9B,MAAI8B,WAAY,QAAO;AACvB,MAAIC,WAAY,QAAO;AACvB,MAAI/B,gBAAgBJ,SAAS,EAAG,QAAO;AACvC,SAAO;AACT;AATSS;AAYT,SAASJ,cAAcvC,SAA0BS,mBAAgC;AAC/E,UAAQT,QAAQsE,oBAAoB,CAAA,GAAIhD,OAAO,CAACiD,YAAY,CAAC9D,kBAAkBZ,SAAS0E,OAAAA,CAAAA;AAC1F;AAFShC;AAKF,SAASiC,uBACd1F,OACAmF,UACApF,MAAY;AAEZ,QAAM+B,QAAQ9B,QAAQmF,QAAAA;AACtB,SAAOrD,UAAU,SAASA,OAAOf,SAAShB,IAAAA,KAAS;AACrD;AAPgB2F;AAWhB,SAAS/B,iBACPzC,SACAI,cACAqE,gBACAnE,WACAf,OACAgB,QACA+B,kBAAiC,CAAA,GAAE;AAEnC,QAAMoC,eAAe,IAAIC,IAAIF,iBAAiBlE,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAMqE,YAAYtE,YAAYN,QAAQnB,IAAI;AAE1C,QAAMgG,SAAS7E,QAAQwC,eAAe,CAAA,GAAIlB,OAAO,CAACwD,MAAMA,EAAEC,YAAYD,EAAEnE,WAAWd,SAASO,YAAAA,CAAAA;AAC5F,QAAM4E,OAAOC,gBAAgBJ,KAAAA;AAC7B,QAAMK,QAAQL,MAAMrD,IAAI,CAACsD,MAAMA,EAAEjG,IAAI;AAGrC,QAAMsG,qBAAqB,oBAAIR,IAAAA;AAC/B,QAAMS,qBAAqB,oBAAIT,IAAAA;AAC/B,aAAWG,KAAKD,OAAO;AACrB,QAAI,CAACH,aAAaW,IAAIP,EAAEjG,IAAI,EAAGsG,oBAAmBG,IAAIR,EAAEjG,IAAI;AAC5D,QAAI2F,uBAAuBI,WAAWrE,QAAQuE,EAAEjG,IAAI,EAAGuG,oBAAmBE,IAAIR,EAAEjG,IAAI;EACtF;AACA,QAAM0G,iBAAiB,oBAAIZ,IAAY;OAAIQ;OAAuBC;GAAmB;AACrF,QAAMI,YAAYC,cAAcP,OAAOK,gBAAgBP,IAAAA;AAEvD,SAAOH,MAAMrD,IAAI,CAACsD,MAAAA;AAEhB,UAAMY,UAAU;MAACZ,EAAEjG;SAAS8G,cAAcb,EAAEjG,MAAMmG,IAAAA;;AAClD,UAAMY,WAAWJ,UAAUH,IAAIP,EAAEjG,IAAI;AACrC,UAAMgH,aAAaD,YAAYF,QAAQ1B,KAAK,CAAC8B,MAAMX,mBAAmBE,IAAIS,CAAAA,CAAAA;AAC1E,UAAMC,aAAaH,YAAYF,QAAQ1B,KAAK,CAAC8B,MAAMV,mBAAmBC,IAAIS,CAAAA,CAAAA;AAC1E,UAAMpD,aAAaC,kBAAkBkD,YAAYE,YAAYzD,eAAAA;AAC7D,UAAMM,SAASF,eAAe;AAC9B,UAAMG,cAAcH,eAAe,SAASsD,sBAAsBzG,OAAOS,QAAQnB,MAAM6G,SAASnF,MAAAA,IAAU,CAAA;AAC1G,WAAO;MAAE1B,MAAMiG,EAAEjG;MAAM+D;MAAQF;MAAYG;MAAaP;IAAgB;EAC1E,CAAA;AACF;AArCSG;AAwCT,SAASuD,sBACPzG,OACA0G,aACAP,SACAnF,QAAsB;AAEtB,QAAM2F,SAAmB,CAAA;AACzB,aAAW,CAACrH,MAAMW,IAAAA,KAAST,OAAOC,QAAQO,KAAAA,GAAQ;AAChD,UAAM4G,WAAW3G,KAAKC,sBAAsBwG,WAAAA,IAAe1F,MAAAA;AAC3D,QAAI4F,YAAYT,QAAQU,MAAM,CAACN,MAAMK,SAAStG,SAASiG,CAAAA,CAAAA,EAAKI,QAAOnD,KAAKlE,IAAAA;EAC1E;AACA,SAAOqH;AACT;AAZSF;AAeT,SAASlD,sBACPvD,OACA0G,aACA1F,QAAsB;AAEtB,QAAM2F,SAAmB,CAAA;AACzB,aAAW,CAACrH,MAAMW,IAAAA,KAAST,OAAOC,QAAQO,KAAAA,GAAQ;AAChD,QAAIC,KAAKC,sBAAsBwG,WAAAA,IAAe1F,MAAAA,MAAYpB,OAAW+G,QAAOnD,KAAKlE,IAAAA;EACnF;AACA,SAAOqH;AACT;AAVSpD;AAaF,SAASuD,eAAetG,UAA2BK,cAAgC;AACxF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWX,SAASY,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,SAAO3B,OAAOkB,OAAOS,SAAS4F,iBAAiB,CAAC,CAAA;AAClD;AALgBD;;;AC9RhB,SAASE,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAMF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,aAAa,CAAC,CAAA;GAAG;AAElG,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,YAAYM,IAAAA,KAAS,CAAC;AAClC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAKA,QAAIJ,UAAUM,MAAM,CAACP,WAAWD,SAASC,MAAAA,MAAYd,MAAAA,EAAY;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA7BgBL;;;ACQhB,IAAMoB,mBAA2D;EAC/DC,KAAK;EACLC,KAAK;EACLC,SAAS;EACTC,SAAS;EACTC,MAAM;AACR;AAUA,IAAMC,cAAc;EAAEC,aAAa;EAAIC,eAAe;EAAIC,aAAa;AAAG;AAqDnE,SAASC,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,WAAWC,UAAUC,UAAUC,OAAOC,kBAAiB,IAAKR;AAItG,QAAMS,SAAyBpB,iBAAiBgB,QAAAA;AAGhD,QAAMK,eAAeC,oBAAoBX,OAAOU,YAAY,KAAK,CAAC;AAGlE,QAAME,gBAAgB,wBAACC,SACrBN,QAAQN,SAASa,WAAWC,mBAAmBF,MAAMN,KAAAA,CAAAA,IAAUS,kBAAkBf,UAAUY,IAAAA,GADvE;AAItB,QAAMI,UAAUC,iBACdjB,UACAC,cACAC,UACAC,WACAK,QACAH,UACAC,OACAC,iBAAAA;AAEF,QAAMW,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAET;IAAMS;GAAE,CAAA;AAIzD,QAAMC,gBAAgBC,OAAOC,YAC3BD,OAAOE,QAAQzB,SAAS0B,WAAWzB,YAAAA,GAAe0B,SAAS,CAAC,CAAA,EAAGP,IAAI,CAAC,CAACR,MAAMgB,IAAAA,MAAU;IACnFhB;IACA;MAAE,GAAGgB;MAAMC,qBAAqBnB,oBAAoBkB,KAAKC,mBAAmB,KAAK,CAAC;IAAE;GACrF,CAAA;AAEH,QAAMC,uBAAuB,oBAAIC,IAAAA;AACjC,MAAI7B,YAAYoB,cAAcpB,QAAAA,GAAW;AACvC,eAAW,CAAC8B,aAAaC,SAAAA,KAAcV,OAAOE,QAAQH,cAAcpB,QAAAA,EAAU2B,uBAAuB,CAAC,CAAA,GAAI;AACxG,UAAII,YAAYzB,MAAAA,MAAY0B,OAAWJ,sBAAqBK,IAAIH,WAAAA;IAClE;EACF;AACA,QAAMI,WAAW,oBAAIjB,IAAAA;AACrB,aAAW,CAACkB,SAAST,IAAAA,KAASL,OAAOE,QAAQH,aAAAA,GAAgB;AAC3D,QAAIe,YAAYnC,SAAU;AAC1B,UAAMoC,OAA8C,CAAA;AACpD,eAAW,CAACN,aAAaC,SAAAA,KAAcV,OAAOE,QAAQG,KAAKC,uBAAuB,CAAC,CAAA,GAAI;AACrF,UAAII,YAAYzB,MAAAA,MAAY0B,UAAaJ,qBAAqBS,IAAIP,WAAAA,EAAc;AAChF,YAAMQ,OAAO7B,cAAcqB,WAAAA,GAAcQ;AACzC,UAAIA,KAAMF,MAAKG,KAAK;QAAE7B,MAAMoB;QAAaQ;MAAK,CAAA;IAChD;AACAJ,aAASM,IAAIL,SAASC,IAAAA;EACxB;AAGA,QAAMK,kBAAkB,oBAAIxB,IAAAA;AAC5B,aAAW,CAACP,MAAMgC,KAAAA,KAAUrB,OAAOE,QAAQhB,gBAAgB,CAAC,CAAA,GAAI;AAE9D,UAAMoC,UAAUD,QAAQpC,MAAAA;AACxB,QAAIqC,YAAYX,OAAW;AAC3B,QAAI,CAACS,gBAAgBJ,IAAI3B,IAAAA,EAAO+B,iBAAgBD,IAAI9B,MAAM,oBAAImB,IAAAA,CAAAA;AAC9D,eAAWe,QAAQD,QAASF,iBAAgBI,IAAInC,IAAAA,GAAOuB,IAAIW,IAAAA;EAC7D;AAGA,QAAMjC,WAAgC,CAAA;AACtC,aAAW,CAACD,MAAMoC,QAAAA,KAAaL,iBAAiB;AAC9C,UAAMM,eAAe/B,WAAW6B,IAAInC,IAAAA;AACpC,QAAI,CAACqC,aAAc;AAKnB,UAAMC,QAAQC,YAAY3C,MAAAA,IAAUd,cAAc0D,qBAAqBH,cAAc7C,QAAAA;AACrF,QAAI,CAAC8C,MAAO;AAGZ,UAAMG,cAAcC,gBAAgB3C,cAAcC,IAAAA,GAAO2C,eAAe,CAAA,CAAE;AAE1E,UAAMC,aAAa,IAAIrC,KAAK8B,aAAaM,eAAe,CAAA,GAAInC,IAAI,CAACqC,MAAM;MAACA,EAAE7C;MAAM6C;KAAE,CAAA;AAClF,UAAMC,eAAe;SAAIC,oBAAoBX,UAAUK,WAAAA;;AACvD,UAAMO,oBAAwCF,aAC3CtC,IAAI,CAACyC,MAAML,WAAWT,IAAIc,CAAAA,CAAAA,EAC1BC,OAAO,CAACL,MAAkC,CAAC,CAACA,GAAGM,MAAAA,EAC/C3C,IAAI,CAACqC,OAAO;MACX7C,MAAM6C,EAAE7C;MACRoD,QAAQP,EAAEQ,cAAc;MACxBC,aAAaT,EAAES,eAAe,CAAA;MAC9BC,iBAAiBV,EAAEU,mBAAmB,CAAA;IACxC,EAAA;AAGF,UAAMC,SACJnB,aAAac,UAAUd,aAAagB,eAAe,UAC9ChB,aAAaiB,eAAe,CAAA,GAC1B9C,IAAI,CAACQ,UAAU;MACdA;MACAf,WAAWuB,SAASW,IAAInB,IAAAA,KAAS,CAAA,GAAIkC,OAAO,CAACzC,MAAMA,EAAET,SAASA,IAAAA,EAAMQ,IAAI,CAACC,MAAMA,EAAEmB,IAAI;IACvF,EAAA,EACCsB,OAAO,CAACO,UAAUA,MAAMxD,SAASyD,SAAS,CAAA,IAC7C,CAAA;AAENzD,aAAS4B,KAAK;MACZ7B;MACA4B,MAAMS,aAAaT;MACnB+B,YAAYtB,aAAasB;MACzBC,UAAUvB,aAAauB;MACvBC,gBAAgBxB,aAAawB;MAC7BlB,aAAaG;MACbK,QAAQd,aAAac,UAAU;MAC/BE,YAAYhB,aAAagB,cAAc;MACvCC,aAAajB,aAAaiB,eAAe,CAAA;MACzCC,iBAAiBlB,aAAakB,mBAAmB,CAAA;MACjDP;MACAQ;MACAlB;MACAwB,SAASzB,aAAayB;MACtBC,SAAS1B,aAAa0B;MACtBC,SAAS3B,aAAa2B;MACtBC,cAAc5B,aAAa4B;IAC7B,CAAA;EACF;AAIAhE,WAASiE,KAAK,CAACC,GAAGC,MAAMD,EAAEJ,QAAQM,cAAcD,EAAEL,OAAO,CAAA;AAEzD,SAAO9D;AACT;AA/HgBf;AAkIT,SAASsD,qBACd8B,OAaA9E,UAAwB;AAIxB,MAAIA,aAAa,aAAaA,aAAa,OAAQ,QAAO;AAC1D,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAAC8E,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLxF,aAAaS,aAAa,QAAQ8E,MAAMC,OAAOC,iBAAiBF,MAAMC,OAAOE;MAC7EzF,eAAesF,MAAMC,OAAOvF;MAC5BC,aAAaqF,MAAMC,OAAOtF;IAC5B;EACF;AAEA,MAAI,CAACqF,MAAM7F,IAAK,QAAO;AACvB,SAAO;IACLM,aAAauF,MAAM7F,IAAIM;IACvBC,eAAesF,MAAM7F,IAAIO;IACzBC,aAAaqF,MAAM7F,IAAIQ;EACzB;AACF;AAlCgBuD;;;AClKT,SAASkC,gBACdC,UACAC,cACAC,UACAC,WACAC,UAAmB;AAEnB,SAAOC,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,OAAOC,QAAAA;AACzE;AARgBL;AAWT,SAASO,gBACdN,UACAC,cACAC,UACAC,WAA4B;AAE5B,SAAOE,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,IAAA;AAClE;AAPgBG;AAUhB,SAASD,YACPL,UACAC,cACAC,UACAC,WACAI,WACAH,UAAmB;AAEnB,QAAMI,WAAWP,eAAeD,SAASS,aAAaR,YAAAA,IAAgBS;AAEtE,QAAMC,QAAQC,OAAOC,YACnBD,OAAOE,QAAQN,UAAUG,SAAS,CAAC,CAAA,EAAGI,IAAI,CAAC,CAACC,MAAMC,CAAAA,MAAO;IACvDD;IACA;MAAE,GAAGC;MAAGC,qBAAqBC,oBAAoBF,EAAEC,mBAAmB,KAAK,CAAC;IAAE;GAC/E,CAAA;AAEH,QAAME,OAAOlB,WAAWS,MAAMT,QAAAA,IAAYQ;AAC1C,QAAMW,WAAW;IAAEL,MAAMd,YAAY;IAAIoB,MAAMF,MAAME,QAAQpB,YAAY;EAAG;AAC5E,QAAMqB,kBAAkBJ,oBAAoBhB,SAAAA;AAC5C,QAAMqB,QAAQD,mBAAmB,CAAC;AAClC,MAAI,CAACf,YAAY,CAACY,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAwB,CAAA;AAC9B,aAAWC,OAAOlB,SAASiB,MAAM;AAC/B,QAAIE,gBAAgB;AACpB,QAAIC,aAAa;AACjB,UAAMC,WAAgC,CAAA;AAEtC,eAAWC,OAAOJ,IAAIG,UAAU;AAC9B,UAAI,CAACtB,aAAauB,IAAIC,UAAU,OAAQ;AACxC,YAAMf,OAAOc,IAAId;AACjB,YAAMgB,UAAUhC,SAAS6B,WAAWI,mBAAmBjB,MAAMc,IAAIC,KAAK,CAAA;AACtE,UAAI,CAACC,QAAS;AACd,UAAI5B,aAAaM,UAAa,CAACwB,qBAAqBF,QAAQG,qBAAqB/B,QAAAA,EAAW;AAK5F,YAAMgC,YAA8B;WAC/BC,aAAaC,OAAO,CAACrB,MAAM,CAAC,CAACe,QAAQO,iBAAiBtB,CAAAA,CAAE;WACxDuB,YAAYF,OACb,CAACG,MAAMT,QAAQU,gBAAgBhC,UAAasB,QAAQU,YAAYC,SAASC,kBAAkBH,CAAAA,CAAE,CAAA;;AAIjG,YAAMI,aAAazB,KAAKF,sBAAsBF,IAAAA;AAC9C,YAAM8B,gBAAgBC,aAAaF,UAAAA;AACnC,YAAMG,YAAYzB,kBAAkBP,IAAAA;AAEpC,YAAMiC,eAAuCjB,QAAQiB,eAAe,CAAA,GACjEX,OAAO,CAACrB,MAAMA,EAAEiC,YAAYjC,EAAER,WAAWkC,SAAS1C,gBAAgB,EAAA,CAAA,EAClEc,IAAI,CAACE,MAAAA;AACJ,cAAMkC,OAAO,wBAACC,SAAAA;AACZ,cAAI,CAAChB,UAAUO,SAASS,IAAAA,EAAO,QAAO;AACtC,gBAAMC,YAAYR,aAAaO,IAAAA;AAC/B,gBAAME,SAASR,iBAAiBO,cAAc3C,UAAa2C,UAAUV,SAAS1B,EAAED,IAAI;AAEpF,gBAAMuC,WAAWD,UAAU,CAACE,uBAAuBR,WAAWI,MAAMnC,EAAED,IAAI;AAC1E,gBAAMyC,cAAcH,SAAS,CAAA,IAAKI,mBAAmB/C,OAAOK,MAAMC,EAAED,MAAMoC,MAAMlD,QAAAA;AAChF0B,wBAAc;AACd,cAAI0B,OAAQ3B,kBAAiB;AAC7B,iBAAO;YAAE2B;YAAQC;YAAUE;UAAY;QACzC,GAVa;AAWb,eAAO;UACLzC,MAAMC,EAAED;UACR2C,OAAO1C,EAAE0C;UACTC,WAAW3C,EAAE2C,aAAa,CAAA;UAC1BC,KAAKV,KAAK,KAAA;UACVW,QAAQX,KAAK,QAAA;UACbY,SAASZ,KAAK,SAAA;UACda,MAAMb,KAAK,MAAA;QACb;MACF,CAAA;AAEFtB,eAASoC,KAAK;QACZjD,MAAMgB,QAAQhB;QACdM,MAAMU,QAAQV;QACd4C,MAAMlC,QAAQmC,cAAc;QAC5BpC,OAAOC,QAAQD;QACfI,qBAAqBH,QAAQG;QAC7BC;QACAkB,QAAQR;QACRW,aAAaX,gBAAgB,CAAA,IAAKsB,uBAAsBzD,OAAOK,MAAMd,QAAAA;QACrEwC,aAAaV,QAAQU;QACrBO;MACF,CAAA;IACF;AAEA,QAAIpB,SAASwC,WAAW,EAAG;AAC3B5C,SAAKwC,KAAK;MAAEjD,MAAMU,IAAIV;MAAMM,MAAMI,IAAIJ;MAAM4C,MAAMxC,IAAIwC,QAAQ;MAAMvC;MAAeC;MAAYC;IAAS,CAAA;EAC1G;AAGAJ,OAAK6C,KAAK,CAACC,GAAG9B,MAAM8B,EAAEjD,KAAKkD,cAAc/B,EAAEnB,IAAI,CAAA;AAE/C,SAAO;IAAEF,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AAhGSnB;AAmGT,SAASqD,mBACP/C,OACA8D,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAAC7D,MAAMC,CAAAA,KAAML,OAAOE,QAAQH,KAAAA,GAAQ;AAC7C,QAAIK,SAAS4D,YAAa;AAC1B,SAAK3D,EAAEC,sBAAsBuD,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAIhC,SAAS+B,QAAAA,EAAWG,OAAMZ,KAAKhD,EAAEK,IAAI;EACpG;AACA,SAAOuD;AACT;AAbSnB;AAgBT,SAASU,uBACPzD,OACA8D,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAAC7D,MAAMC,CAAAA,KAAML,OAAOE,QAAQH,KAAAA,GAAQ;AAC7C,QAAIK,SAAS4D,YAAa;AAC1B,QAAI7B,aAAa9B,EAAEC,sBAAsBuD,WAAAA,CAAY,EAAGI,OAAMZ,KAAKhD,EAAEK,IAAI;EAC3E;AACA,SAAOuD;AACT;AAXST,OAAAA,wBAAAA;","names":["buildDependsMap","permissions","present","Set","map","p","code","Map","set","dependsOn","filter","dep","has","prereqClosure","deps","out","seen","stack","length","current","pop","get","add","push","cascadeLocked","codes","directlyLocked","locked","visiting","check","viaDep","some","delete","filterGrantedByDeps","granted","ok","satisfied","every","PLATFORMS","UI_PLATFORMS","API_SURFACES","API_BUCKETS","SURFACE_BY_BUCKET","graphql","http","BUCKET_BY_SURFACE","GRAPHQL","HTTP","isApiBucket","bucket","SITE_TYPES","SERVICE_CODES","snapshotFeatureKey","code","scope","SNAPSHOT_SCHEMA_VERSION","normalizeApiBuckets","doc","changed","next","code","entry","Object","entries","legacy","app","undefined","graphql","http","normalizePlans","plans","plan","unlockedPermissions","featureAppliesAtNode","applicableSiteTypes","siteType","includes","findFeatureByCode","snapshot","feature","values","features","buildSiteCatalog","businessCode","planCode","siteLocks","bucket","scope","availableServices","business","businesses","locks","catalog","sortedApps","apps","sort","a","b","name","localeCompare","businessAppFeatures","filter","ref","map","snapshotFeatureKey","f","isApiBucket","surfaceAllows","apiSurfaces","SURFACE_BY_BUCKET","microfrontends","web","mobile","length","membership","memberOnBucket","sitePlatformLocked","missingServices","unmetServices","permissions","buildPermissions","lockReason","resolveLockReason","locked","unlockPlans","plansIncludingFeature","push","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","PLATFORMS","some","platform","surfaces","surface","planLocked","siteLocked","requiredServices","service","isSiteLockedOnPlatform","planMembership","planUnlocked","Set","lockEntry","perms","p","isGlobal","deps","buildDependsMap","codes","directlyPlanLocked","directlySiteLocked","has","add","directlyLocked","lockedSet","cascadeLocked","closure","prereqClosure","cascaded","planReason","c","siteReason","plansUnlockingClosure","featureCode","result","unlocked","every","buildSiteRoles","roleTemplates","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","every","BUCKET_BY_CLIENT","web","ios","android","graphql","http","EMPTY_ROUTE","remoteEntry","exposedModule","routePrefix","resolveUserFeatures","params","snapshot","businessCode","planCode","siteLocks","platform","siteType","scope","availableServices","bucket","roleFeatures","normalizeApiBuckets","featureByCode","code","features","snapshotFeatureKey","findFeatureByCode","catalog","buildSiteCatalog","catalogMap","Map","map","f","businessPlans","Object","fromEntries","entries","businesses","plans","plan","unlockedPermissions","currentUnlockedCodes","Set","featureCode","platforms","undefined","add","planAdds","planKey","adds","has","name","push","set","grantedFeatures","grant","granted","perm","get","permsSet","catalogEntry","route","isApiBucket","pickRouteForPlatform","featureDeps","buildDependsMap","permissions","permByCode","p","grantedPerms","filterGrantedByDeps","lockedPermissions","c","filter","locked","reason","lockReason","unlockPlans","missingServices","upsell","group","length","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","sort","a","b","localeCompare","entry","mobile","remoteEntryIos","remoteEntryAndroid","buildSiteMatrix","snapshot","businessCode","planCode","siteLocks","siteType","buildMatrix","buildPlanMatrix","allScopes","business","businesses","undefined","plans","Object","fromEntries","entries","map","code","p","unlockedPermissions","normalizeApiBuckets","plan","planMeta","name","normalizedLocks","locks","apps","app","unlockedCount","totalCount","features","ref","scope","feature","snapshotFeatureKey","featureAppliesAtNode","applicableSiteTypes","platforms","UI_PLATFORMS","filter","microfrontends","API_BUCKETS","b","apiSurfaces","includes","SURFACE_BY_BUCKET","membership","featureInPlan","isPlanMember","siteEntry","permissions","isGlobal","cell","plat","planCodes","inPlan","selected","isSiteLockedOnPlatform","availableIn","plansUnlockingPerm","label","dependsOn","web","mobile","graphql","http","push","icon","lucideIcon","plansIncludingFeature","length","sort","a","localeCompare","featureCode","permCode","platform","excludeCode","names"]}