@vritti/api-sdk 0.3.3 → 0.3.5

package/dist/catalog-resolver.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/catalog-resolver/index.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/bu-matrix.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts"],"sourcesContent":["// Catalog resolver — the single shared implementation of snapshot resolution (BU catalog, BU matrix, user features)\nexport {\n  type BuMatrix,\n  type BuMatrixApp,\n  type BuMatrixCell,\n  type BuMatrixFeature,\n  type BuMatrixPermission,\n  buildBuMatrix,\n} from './bu-matrix.builder';\nexport { buildBuCatalog, buildBuRoles, isBuLockedOnPlatform, isPlanMember } from './catalog.builder';\nexport { type ComposeRoleGrantsParams, composeRoleGrants, type RevokedGrants } from './compose-role-grants';\nexport {\n  type ClientPlatform,\n  type LockedPermission,\n  type PermissionFeature,\n  pickRouteForPlatform,\n  type ResolveUserFeaturesParams,\n  resolveUserFeatures,\n} from './resolve-user-features';\nexport {\n  type BuFeatureLocks,\n  type CatalogPermission,\n  type FeatureCatalogEntry,\n  type FeatureUnlocks,\n  type LockReason,\n  PLATFORMS,\n  type PlatformBucket,\n  type PlatformCodes,\n  type PlatformDenyCodes,\n  type RoleItem,\n  SNAPSHOT_SCHEMA_VERSION,\n  type SnapshotApp,\n  type SnapshotBusiness,\n  type SnapshotFeature,\n  type SnapshotMicrofrontendMobile,\n  type SnapshotMicrofrontends,\n  type SnapshotMicrofrontendWeb,\n  type SnapshotPermission,\n  type SnapshotPlan,\n  type SnapshotRoleTemplate,\n  type VersionSnapshot,\n} from './types';\n","import type {\n  BuFeatureLocks,\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  RoleItem,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\n\n// Builds the per-BU catalog for ONE platform bucket. The plan is the ceiling (membership + unlocks); buLocks is a\n// deny-list within the plan (undefined or absent entries ⇒ fully available). Each permission carries\n// locked + lockReason + unlockPlans, all evaluated against the requested bucket only.\nexport function buildBuCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  buLocks: BuFeatureLocks | undefined,\n  bucket: PlatformBucket,\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  const plan = planCode ? business.plans?.[planCode] : undefined;\n  const plans = business.plans ?? {};\n\n  const catalog: FeatureCatalogEntry[] = [];\n  for (const app of business.apps) {\n    // The app's renderable features (each feature pins to exactly one app)\n    const businessAppFeatures = app.features\n      .map((code) => snapshot.features?.[code])\n      .filter((f): f is SnapshotFeature => !!f && !!(f.microfrontends?.web || f.microfrontends?.mobile));\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves (rendered as a locked\n    // tile with an upsell) instead of vanishing. Core filters the catalog down to what the user's role grants.\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions?.[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them. A role grant on a\n      // plan-omitted (feature or platform) still resolves as a locked tile with an upsell instead of vanishing.\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      const permissions = buildPermissions(feature, businessCode, membership, buLocks, plans, bucket);\n      // Feature-level lock is EXPLICIT, never derived from permission locks: the plan must include the feature\n      // on this bucket (membership) and the BU must not null-lock the platform. Permission-code locks only\n      // disable individual actions — the feature still renders (sidebar/tile stays enabled).\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const buPlatformLocked = buLocks?.[feature.code]?.[bucket] === null;\n      const locked = !memberOnBucket || buPlatformLocked;\n      const lockReason: LockReason | null = !memberOnBucket ? 'PLAN' : buPlatformLocked ? 'BU' : null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions)\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  return !!entry && (entry.web !== undefined || entry.mobile !== undefined);\n}\n\n// Per-platform BU-lock primitive: platform null locks the whole feature there; string[] locks those codes;\n// entry/platform absent ⇒ not locked\nexport function isBuLockedOnPlatform(\n  entry: BuFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and the BU deny-list.\n// Everything is bucket-scoped: a web resolution ignores mobile unlocks and mobile locks entirely.\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  buLocks: BuFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = buLocks?.[feature.code];\n\n  return (feature.permissions ?? [])\n    .filter((p) => p.isGlobal || p.businesses.includes(businessCode))\n    .map((p) => {\n      const planAllows = planUnlocked.has(p.code);\n      const buAllows = !isBuLockedOnPlatform(lockEntry, bucket, p.code);\n      const locked = !planAllows || !buAllows;\n      // Plan is the ceiling, so a plan-lock wins over a BU-lock when reporting the reason\n      const lockReason: LockReason | null = !planAllows ? 'PLAN' : !buAllows ? 'BU' : null;\n      const unlockPlans = lockReason === 'PLAN' ? plansUnlockingPermission(plans, feature.code, p.code, bucket) : [];\n      return { code: p.code, locked, lockReason, unlockPlans };\n    });\n}\n\n// Plan codes (in the business) whose unlocked set includes this feature+permission on the bucket — upsell targets\nfunction plansUnlockingPermission(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket]?.includes(permCode)) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildBuRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates ?? {});\n}\n","// ——— Platform algebra ———\n// Everything in this domain (plan unlocks, role grants, BU locks) is stored per UI platform bucket.\n\nexport type PlatformBucket = 'web' | 'mobile';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile'];\n\n// Allow entry: a bucket key present (even []) = membership on that platform; the array holds permission codes\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n}\n\n// Deny entry: null locks/revokes the whole bucket, string[] the listed codes, absent = untouched\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n}\n\n// Code-keyed allow-list — plan unlocks, role grants, and matrix selections all share this exact shape\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\n// BU deny-list overlay (same shape as role revokes) — feature absent = fully available within the plan\nexport type BuFeatureLocks = Record<string, PlatformDenyCodes>;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n}\n// WEB microfrontend route — a single remote entry. All non-null: a WEB microfrontend row is\n// CHECK-constrained to have remoteEntry set, and the feature↔MF link's module/route are NOT NULL.\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\n// MOBILE microfrontend route — per-OS remote entries (android + ios). All non-null: a MOBILE row is\n// CHECK-constrained to have both android + ios set, and the link's module/route are NOT NULL.\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\n// Per-platform microfrontend routes — mirrors the PlatformCodes {web?, mobile?} bucket shape\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: string[];\n}\n// Also the shape provisioned to core as a role stub (the template's code is the durable org-role link)\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  // featureCode -> per-platform granted permission codes\n  features: FeatureUnlocks;\n}\n// A plan is a lock overlay: the feature-permissions it UNLOCKS per platform (everything else renders locked).\n// Apps are derived from these.\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxBusinessUnits: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  apps: SnapshotApp[];\n  // Keyed by template code — the same key org roles link to\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  // Shape revision hook for future migrations (absent = pre-versioned snapshots)\n  schemaVersion?: number;\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// The current snapshot shape revision written by the cloud snapshot builder\nexport const SNAPSHOT_SCHEMA_VERSION = 1;\n\n// Why a permission/feature is locked: PLAN (org's plan doesn't unlock it) or BU (this BU restricts it)\nexport type LockReason = 'PLAN' | 'BU';\n\n// A catalog permission: its lock state + reason + (when plan-locked) the plans that would unlock it (upsell)\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n}\n\n// One resolved feature of the per-BU catalog\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  // Per-platform MF route — symmetric { web?, mobile? }; null when the feature has no MF for that platform.\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  // Feature-level lock is explicit — plan non-membership or a BU whole-platform lock (never derived from\n  // permission-code locks, which only disable individual actions)\n  locked: boolean;\n  lockReason: LockReason | null;\n  // Plans (in the business) that would unlock the feature when it's plan-locked — for upsell\n  unlockPlans: string[];\n  permissions: CatalogPermission[];\n}\n\n// Role template pushed to core for provisioning — identical to the snapshot template shape\nexport type RoleItem = SnapshotRoleTemplate;\n","import { isBuLockedOnPlatform, isPlanMember } from './catalog.builder';\nimport { type BuFeatureLocks, PLATFORMS, type PlatformBucket, type SnapshotPlan, type VersionSnapshot } from './types';\n\n// A single (permission, platform) cell. null ⇒ the feature doesn't ship on that platform.\nexport interface BuMatrixCell {\n  inPlan: boolean; // the org's plan unlocks this (feature, platform, permission)\n  selected: boolean; // the BU currently has it enabled (never true when !inPlan)\n  availableIn: string[]; // other plan names that unlock it — upsell; only when !inPlan\n}\n\nexport interface BuMatrixPermission {\n  code: string;\n  label: string;\n  web: BuMatrixCell | null;\n  mobile: BuMatrixCell | null;\n}\n\nexport interface BuMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  platforms: PlatformBucket[]; // platforms the feature ships on\n  inPlan: boolean; // FEATURE-level: is this feature a member of the org's plan at all?\n  availableIn: string[]; // plans that include the feature — upsell when !inPlan\n  permissions: BuMatrixPermission[];\n}\n\nexport interface BuMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  unlockedCount: number; // (feature × platform × permission) cells the plan unlocks\n  totalCount: number; // all possible cells in this app\n  features: BuMatrixFeature[];\n}\n\nexport interface BuMatrix {\n  plan: { code: string; name: string };\n  apps: BuMatrixApp[];\n  // The stored BU deny-list verbatim — lock editors seed from this, never from derived selected flags\n  locks: BuFeatureLocks;\n}\n\n// Builds the full apps/features/permissions matrix from the version snapshot — NOT filtered to plan members.\n// Every app/feature/permission renders; plan-locked items carry inPlan=false + availableIn (the upsell plans).\n// buLocks layers the BU's deny-list within the plan (undefined or absent entries ⇒ the full plan is selected).\nexport function buildBuMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  buLocks: BuFeatureLocks | undefined,\n): BuMatrix {\n  const business = businessCode ? snapshot.businesses?.[businessCode] : undefined;\n  const plans = business?.plans ?? {};\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const locks = buLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: BuMatrixApp[] = [];\n  for (const app of business.apps) {\n    let unlockedCount = 0;\n    let totalCount = 0;\n    const features: BuMatrixFeature[] = [];\n\n    for (const code of app.features) {\n      const feature = snapshot.features?.[code];\n      if (!feature) continue;\n      const platforms = PLATFORMS.filter((p) => !!feature.microfrontends?.[p]);\n      if (platforms.length === 0) continue;\n\n      const membership = plan.unlockedPermissions?.[code];\n      const featureInPlan = isPlanMember(membership);\n      const buEntry = buLocks?.[code];\n\n      const permissions: BuMatrixPermission[] = (feature.permissions ?? [])\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): BuMatrixCell | null => {\n            if (!platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the BU locks it on this platform\n            const selected = inPlan && !isBuLockedOnPlatform(buEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            totalCount += 1;\n            if (inPlan) unlockedCount += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return { code: p.code, label: p.label, web: cell('web'), mobile: cell('mobile') };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        permissions,\n      });\n    }\n\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, unlockedCount, totalCount, features });\n  }\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions?.[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions?.[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\n// Grants removed from a base template — same deny algebra as BU locks\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a based custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10).\n// Platform membership survives a code revoke (may leave [] = view-only); a null revoke removes the\n// platform entirely; a feature with no surviving platform disappears. Inputs are never mutated.\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions ?? {})]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions?.[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set\n    if (composed.web === undefined && composed.mobile === undefined) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildBuCatalog } from './catalog.builder';\nimport type { BuFeatureLocks, FeatureUnlocks, LockReason, PlatformBucket, VersionSnapshot } from './types';\n\n// Client surface requesting resolution — web picks the WEB route block, ios/android pick the MOBILE block per-OS\nexport type ClientPlatform = 'web' | 'ios' | 'android';\n\n// A granted permission that is locked, with why and which plans would unlock it (for upsell)\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  // Lock overlay (for upsell): feature-level locked + reason + unlock plans, and the granted-but-locked permissions\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  lockedPermissions: LockedPermission[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  // undefined = nothing BU-locked (the full plan is available)\n  buLocks: BuFeatureLocks | undefined;\n  // The user's composed role grants: featureCode -> { web?: [permCode…], mobile?: [permCode…] }\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants.\n// platform picks which microfrontend block flows into PermissionFeature.route:\n//   'web'     → WEB block (remoteEntry + exposedModule + routePrefix)\n//   'ios'     → MOBILE block, remoteEntry = remoteEntryIos\n//   'android' → MOBILE block, remoteEntry = remoteEntryAndroid\n// Features missing the requested platform's block are filtered out.\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, buLocks, roleFeatures, platform } = params;\n\n  // Plan unlocks, BU locks, and role grants are all stored per platform; resolve only the requesting\n  // surface's bucket. web → 'web'; ios/android → 'mobile'. (platform still drives the per-OS route below.)\n  const bucket: PlatformBucket = platform === 'web' ? 'web' : 'mobile';\n\n  // Plan ∧ BU overlay for this bucket — emits EVERY business feature (plan non-members come out fully locked)\n  const catalog = buildBuCatalog(snapshot, businessCode, planCode, buLocks, bucket);\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures ?? {})) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant?.[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    const route = pickRouteForPlatform(catalogEntry, platform);\n    // Feature isn't published to this platform — omit so client doesn't see an unloadable tile.\n    if (!route) continue;\n\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [p.code, p]));\n    const grantedPerms = [...permsSet];\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({ code: p.code, reason: p.lockReason ?? null, unlockPlans: p.unlockPlans ?? [] }));\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans ?? [],\n      lockedPermissions,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform.\n// Returns null when the catalog entry doesn't publish to that platform.\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;ACgBO,SAASA,eACdC,UACAC,cACAC,UACAC,SACAC,QAAsB;AAEtB,MAAI,CAACH,aAAc,QAAO,CAAA;AAC1B,QAAMI,WAAWL,SAASM,aAAaL,YAAAA;AACvC,MAAI,CAACI,SAAU,QAAO,CAAA;AACtB,QAAME,OAAOL,WAAWG,SAASG,QAAQN,QAAAA,IAAYO;AACrD,QAAMD,QAAQH,SAASG,SAAS,CAAC;AAEjC,QAAME,UAAiC,CAAA;AACvC,aAAWC,OAAON,SAASO,MAAM;AAE/B,UAAMC,sBAAsBF,IAAIG,SAC7BC,IAAI,CAACC,SAAShB,SAASc,WAAWE,IAAAA,CAAK,EACvCC,OAAO,CAACC,MAA4B,CAAC,CAACA,KAAK,CAAC,EAAEA,EAAEC,gBAAgBC,OAAOF,EAAEC,gBAAgBE,OAAK;AAEjG,QAAIR,oBAAoBS,WAAW,EAAG;AAItC,eAAWC,WAAWV,qBAAqB;AACzC,YAAMW,aAAajB,MAAMkB,sBAAsBF,QAAQP,IAAI;AAG3D,YAAMI,MAAMG,QAAQJ,gBAAgBC;AACpC,YAAMC,SAASE,QAAQJ,gBAAgBE;AAEvC,YAAMK,cAAcC,iBAAiBJ,SAAStB,cAAcuB,YAAYrB,SAASK,OAAOJ,MAAAA;AAIxF,YAAMwB,iBAAiBJ,aAAapB,MAAAA,MAAYK;AAChD,YAAMoB,mBAAmB1B,UAAUoB,QAAQP,IAAI,IAAIZ,MAAAA,MAAY;AAC/D,YAAM0B,SAAS,CAACF,kBAAkBC;AAClC,YAAME,aAAgC,CAACH,iBAAiB,SAASC,mBAAmB,OAAO;AAC3F,YAAMG,cAAcD,eAAe,SAASE,sBAAsBzB,OAAOe,QAAQP,MAAMZ,MAAAA,IAAU,CAAA;AAEjGM,cAAQwB,KAAK;QACXlB,MAAMO,QAAQP;QACdmB,MAAMZ,QAAQY;QACdC,YAAYb,QAAQa,cAAc;QAClCC,UAAUd,QAAQc,YAAY;QAC9BC,gBAAgBf,QAAQe,kBAAkB;QAC1ClB,KAAKA,MACD;UACEmB,aAAanB,IAAImB,eAAe;UAChCC,eAAepB,IAAIoB,iBAAiB;UACpCC,aAAarB,IAAIqB,eAAe;QAClC,IACA;QACJpB,QAAQA,SACJ;UACEqB,oBAAoBrB,OAAOqB,sBAAsB;UACjDC,gBAAgBtB,OAAOsB,kBAAkB;UACzCH,eAAenB,OAAOmB,iBAAiB;UACvCC,aAAapB,OAAOoB,eAAe;QACrC,IACA;QACJG,SAASjC,IAAIK;QACb6B,SAASlC,IAAIwB;QACbW,SAASnC,IAAIoC,QAAQ;QACrBC,cAAcrC,IAAIsC,aAAa;QAC/BnB;QACAC;QACAC;QACAN;MACF,CAAA;IACF;EACF;AACA,SAAOhB;AACT;AA1EgBX;AA6ET,SAASmD,aAAaC,OAAgC;AAC3D,SAAO,CAAC,CAACA,UAAUA,MAAM/B,QAAQX,UAAa0C,MAAM9B,WAAWZ;AACjE;AAFgByC;AAMT,SAASE,qBACdD,OACAE,UACArC,MAAY;AAEZ,QAAMsC,QAAQH,QAAQE,QAAAA;AACtB,SAAOC,UAAU,SAASA,OAAOC,SAASvC,IAAAA,KAAS;AACrD;AAPgBoC;AAWhB,SAASzB,iBACPJ,SACAtB,cACAuD,gBACArD,SACAK,OACAJ,QAAsB;AAEtB,QAAMqD,eAAe,IAAIC,IAAIF,iBAAiBpD,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAMuD,YAAYxD,UAAUoB,QAAQP,IAAI;AAExC,UAAQO,QAAQG,eAAe,CAAA,GAC5BT,OAAO,CAAC2C,MAAMA,EAAEC,YAAYD,EAAEtD,WAAWiD,SAAStD,YAAAA,CAAAA,EAClDc,IAAI,CAAC6C,MAAAA;AACJ,UAAME,aAAaL,aAAaM,IAAIH,EAAE5C,IAAI;AAC1C,UAAMgD,WAAW,CAACZ,qBAAqBO,WAAWvD,QAAQwD,EAAE5C,IAAI;AAChE,UAAMc,SAAS,CAACgC,cAAc,CAACE;AAE/B,UAAMjC,aAAgC,CAAC+B,aAAa,SAAS,CAACE,WAAW,OAAO;AAChF,UAAMhC,cAAcD,eAAe,SAASkC,yBAAyBzD,OAAOe,QAAQP,MAAM4C,EAAE5C,MAAMZ,MAAAA,IAAU,CAAA;AAC5G,WAAO;MAAEY,MAAM4C,EAAE5C;MAAMc;MAAQC;MAAYC;IAAY;EACzD,CAAA;AACJ;AAtBSL;AAyBT,SAASsC,yBACPzD,OACA0D,aACAC,UACA/D,QAAsB;AAEtB,QAAMgE,SAAmB,CAAA;AACzB,aAAW,CAACpD,MAAMT,IAAAA,KAAS8D,OAAOC,QAAQ9D,KAAAA,GAAQ;AAChD,QAAID,KAAKkB,sBAAsByC,WAAAA,IAAe9D,MAAAA,GAASmD,SAASY,QAAAA,EAAWC,QAAOlC,KAAKlB,IAAAA;EACzF;AACA,SAAOoD;AACT;AAXSH;AAcT,SAAShC,sBACPzB,OACA0D,aACA9D,QAAsB;AAEtB,QAAMgE,SAAmB,CAAA;AACzB,aAAW,CAACpD,MAAMT,IAAAA,KAAS8D,OAAOC,QAAQ9D,KAAAA,GAAQ;AAChD,QAAID,KAAKkB,sBAAsByC,WAAAA,IAAe9D,MAAAA,MAAYK,OAAW2D,QAAOlC,KAAKlB,IAAAA;EACnF;AACA,SAAOoD;AACT;AAVSnC;AAaF,SAASsC,aAAavE,UAA2BC,cAAgC;AACtF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMI,WAAWL,SAASM,aAAaL,YAAAA;AACvC,MAAI,CAACI,SAAU,QAAO,CAAA;AACtB,SAAOgE,OAAOG,OAAOnE,SAASoE,iBAAiB,CAAC,CAAA;AAClD;AALgBF;;;AC7JT,IAAMG,YAA8B;EAAC;EAAO;;AAmG5C,IAAMC,0BAA0B;;;AC1DhC,SAASC,cACdC,UACAC,cACAC,UACAC,SAAmC;AAEnC,QAAMC,WAAWH,eAAeD,SAASK,aAAaJ,YAAAA,IAAgBK;AACtE,QAAMC,QAAQH,UAAUG,SAAS,CAAC;AAClC,QAAMC,OAAON,WAAWK,MAAML,QAAAA,IAAYI;AAC1C,QAAMG,WAAW;IAAEC,MAAMR,YAAY;IAAIS,MAAMH,MAAMG,QAAQT,YAAY;EAAG;AAC5E,QAAMU,QAAQT,WAAW,CAAC;AAC1B,MAAI,CAACC,YAAY,CAACI,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAsB,CAAA;AAC5B,aAAWC,OAAOV,SAASS,MAAM;AAC/B,QAAIE,gBAAgB;AACpB,QAAIC,aAAa;AACjB,UAAMC,WAA8B,CAAA;AAEpC,eAAWP,QAAQI,IAAIG,UAAU;AAC/B,YAAMC,UAAUlB,SAASiB,WAAWP,IAAAA;AACpC,UAAI,CAACQ,QAAS;AACd,YAAMC,YAAYC,UAAUC,OAAO,CAACC,MAAM,CAAC,CAACJ,QAAQK,iBAAiBD,CAAAA,CAAE;AACvE,UAAIH,UAAUK,WAAW,EAAG;AAE5B,YAAMC,aAAajB,KAAKkB,sBAAsBhB,IAAAA;AAC9C,YAAMiB,gBAAgBC,aAAaH,UAAAA;AACnC,YAAMI,UAAU1B,UAAUO,IAAAA;AAE1B,YAAMoB,eAAqCZ,QAAQY,eAAe,CAAA,GAC/DT,OAAO,CAACC,MAAMA,EAAES,YAAYT,EAAEjB,WAAW2B,SAAS/B,gBAAgB,EAAA,CAAA,EAClEgC,IAAI,CAACX,MAAAA;AACJ,cAAMY,OAAO,wBAACC,SAAAA;AACZ,cAAI,CAAChB,UAAUa,SAASG,IAAAA,EAAO,QAAO;AACtC,gBAAMC,YAAYX,aAAaU,IAAAA;AAC/B,gBAAME,SAASV,iBAAiBS,cAAc9B,UAAa8B,UAAUJ,SAASV,EAAEZ,IAAI;AAEpF,gBAAM4B,WAAWD,UAAU,CAACE,qBAAqBV,SAASM,MAAMb,EAAEZ,IAAI;AACtE,gBAAM8B,cAAcH,SAAS,CAAA,IAAKI,mBAAmBlC,OAAOG,MAAMY,EAAEZ,MAAMyB,MAAMjC,QAAAA;AAChFc,wBAAc;AACd,cAAIqB,OAAQtB,kBAAiB;AAC7B,iBAAO;YAAEsB;YAAQC;YAAUE;UAAY;QACzC,GAVa;AAWb,eAAO;UAAE9B,MAAMY,EAAEZ;UAAMgC,OAAOpB,EAAEoB;UAAOC,KAAKT,KAAK,KAAA;UAAQU,QAAQV,KAAK,QAAA;QAAU;MAClF,CAAA;AAEFjB,eAAS4B,KAAK;QACZnC,MAAMQ,QAAQR;QACdC,MAAMO,QAAQP;QACdmC,MAAM5B,QAAQ6B,cAAc;QAC5B5B;QACAkB,QAAQV;QACRa,aAAab,gBAAgB,CAAA,IAAKqB,uBAAsBzC,OAAOG,MAAMR,QAAAA;QACrE4B;MACF,CAAA;IACF;AAEAjB,SAAKgC,KAAK;MAAEnC,MAAMI,IAAIJ;MAAMC,MAAMG,IAAIH;MAAMmC,MAAMhC,IAAIgC,QAAQ;MAAM/B;MAAeC;MAAYC;IAAS,CAAA;EAC1G;AAEA,SAAO;IAAET,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AA7DgBb;AAgEhB,SAAS0C,mBACPlC,OACA0C,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAAC3C,MAAMY,CAAAA,KAAMgC,OAAOC,QAAQhD,KAAAA,GAAQ;AAC7C,QAAIG,SAAS0C,YAAa;AAC1B,SAAK9B,EAAEI,sBAAsBuB,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAInB,SAASkB,QAAAA,EAAWG,OAAMR,KAAKvB,EAAEX,IAAI;EACpG;AACA,SAAO0C;AACT;AAbSZ;AAgBT,SAASO,uBACPzC,OACA0C,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAAC3C,MAAMY,CAAAA,KAAMgC,OAAOC,QAAQhD,KAAAA,GAAQ;AAC7C,QAAIG,SAAS0C,YAAa;AAC1B,QAAIxB,aAAaN,EAAEI,sBAAsBuB,WAAAA,CAAY,EAAGI,OAAMR,KAAKvB,EAAEX,IAAI;EAC3E;AACA,SAAO0C;AACT;AAXSL,OAAAA,wBAAAA;;;AClHT,SAASQ,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAQF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,aAAa,CAAC,CAAA;GAAG;AAElG,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,YAAYM,IAAAA,KAAS,CAAC;AAClC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAGA,QAAIN,SAASQ,QAAQrB,UAAaa,SAASS,WAAWtB,OAAW;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA3BgBL;;;ACiCT,SAASqB,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,SAASC,cAAcC,SAAQ,IAAKN;AAI9E,QAAMO,SAAyBD,aAAa,QAAQ,QAAQ;AAG5D,QAAME,UAAUC,eAAeR,UAAUC,cAAcC,UAAUC,SAASG,MAAAA;AAC1E,QAAMG,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAEC;IAAMD;GAAE,CAAA;AAGzD,QAAME,kBAAkB,oBAAIJ,IAAAA;AAC5B,aAAW,CAACG,MAAME,KAAAA,KAAUC,OAAOC,QAAQb,gBAAgB,CAAC,CAAA,GAAI;AAE9D,UAAMc,UAAUH,QAAQT,MAAAA;AACxB,QAAIY,YAAYC,OAAW;AAC3B,QAAI,CAACL,gBAAgBM,IAAIP,IAAAA,EAAOC,iBAAgBO,IAAIR,MAAM,oBAAIS,IAAAA,CAAAA;AAC9D,eAAWC,QAAQL,QAASJ,iBAAgBU,IAAIX,IAAAA,GAAOY,IAAIF,IAAAA;EAC7D;AAGA,QAAMG,WAAgC,CAAA;AACtC,aAAW,CAACb,MAAMc,QAAAA,KAAab,iBAAiB;AAC9C,UAAMc,eAAenB,WAAWe,IAAIX,IAAAA;AACpC,QAAI,CAACe,aAAc;AAEnB,UAAMC,QAAQC,qBAAqBF,cAAcvB,QAAAA;AAEjD,QAAI,CAACwB,MAAO;AAGZ,UAAME,aAAa,IAAIrB,KAAKkB,aAAaI,eAAe,CAAA,GAAIrB,IAAI,CAACsB,MAAM;MAACA,EAAEpB;MAAMoB;KAAE,CAAA;AAClF,UAAMC,eAAe;SAAIP;;AACzB,UAAMQ,oBAAwCD,aAC3CvB,IAAI,CAACyB,MAAML,WAAWP,IAAIY,CAAAA,CAAAA,EAC1BC,OAAO,CAACJ,MAAkC,CAAC,CAACA,GAAGK,MAAAA,EAC/C3B,IAAI,CAACsB,OAAO;MAAEpB,MAAMoB,EAAEpB;MAAM0B,QAAQN,EAAEO,cAAc;MAAMC,aAAaR,EAAEQ,eAAe,CAAA;IAAG,EAAA;AAE9Ff,aAASgB,KAAK;MACZ7B;MACA8B,MAAMf,aAAae;MACnBC,YAAYhB,aAAagB;MACzBC,UAAUjB,aAAaiB;MACvBC,gBAAgBlB,aAAakB;MAC7Bd,aAAaE;MACbI,QAAQV,aAAaU,UAAU;MAC/BE,YAAYZ,aAAaY,cAAc;MACvCC,aAAab,aAAaa,eAAe,CAAA;MACzCN;MACAN;MACAkB,SAASnB,aAAamB;MACtBC,SAASpB,aAAaoB;MACtBC,SAASrB,aAAaqB;MACtBC,cAActB,aAAasB;IAC7B,CAAA;EACF;AAEA,SAAOxB;AACT;AA3DgB5B;AA+DT,SAASgC,qBACdqB,OAaA9C,UAAwB;AAExB,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAAC8C,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLC,aAAahD,aAAa,QAAQ8C,MAAMC,OAAOE,iBAAiBH,MAAMC,OAAOG;MAC7EC,eAAeL,MAAMC,OAAOI;MAC5BC,aAAaN,MAAMC,OAAOK;IAC5B;EACF;AAEA,MAAI,CAACN,MAAMO,IAAK,QAAO;AACvB,SAAO;IACLL,aAAaF,MAAMO,IAAIL;IACvBG,eAAeL,MAAMO,IAAIF;IACzBC,aAAaN,MAAMO,IAAID;EACzB;AACF;AA/BgB3B;","names":["buildBuCatalog","snapshot","businessCode","planCode","buLocks","bucket","business","businesses","plan","plans","undefined","catalog","app","apps","businessAppFeatures","features","map","code","filter","f","microfrontends","web","mobile","length","feature","membership","unlockedPermissions","permissions","buildPermissions","memberOnBucket","buPlatformLocked","locked","lockReason","unlockPlans","plansIncludingFeature","push","name","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","entry","isBuLockedOnPlatform","platform","locks","includes","planMembership","planUnlocked","Set","lockEntry","p","isGlobal","planAllows","has","buAllows","plansUnlockingPermission","featureCode","permCode","result","Object","entries","buildBuRoles","values","roleTemplates","PLATFORMS","SNAPSHOT_SCHEMA_VERSION","buildBuMatrix","snapshot","businessCode","planCode","buLocks","business","businesses","undefined","plans","plan","planMeta","code","name","locks","apps","app","unlockedCount","totalCount","features","feature","platforms","PLATFORMS","filter","p","microfrontends","length","membership","unlockedPermissions","featureInPlan","isPlanMember","buEntry","permissions","isGlobal","includes","map","cell","plat","planCodes","inPlan","selected","isBuLockedOnPlatform","availableIn","plansUnlockingPerm","label","web","mobile","push","icon","lucideIcon","plansIncludingFeature","featureCode","permCode","platform","excludeCode","names","Object","entries","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","web","mobile","resolveUserFeatures","params","snapshot","businessCode","planCode","buLocks","roleFeatures","platform","bucket","catalog","buildBuCatalog","catalogMap","Map","map","f","code","grantedFeatures","grant","Object","entries","granted","undefined","has","set","Set","perm","get","add","features","permsSet","catalogEntry","route","pickRouteForPlatform","permByCode","permissions","p","grantedPerms","lockedPermissions","c","filter","locked","reason","lockReason","unlockPlans","push","name","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","entry","mobile","remoteEntry","remoteEntryIos","remoteEntryAndroid","exposedModule","routePrefix","web"]}
+{"version":3,"sources":["../src/catalog-resolver/index.ts","../src/catalog-resolver/permission-deps.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/site-matrix.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts"],"sourcesContent":["// Catalog resolver — the single shared implementation of snapshot resolution (BU catalog, BU matrix, user features)\nexport {\n  type SiteMatrix,\n  type SiteMatrixApp,\n  type SiteMatrixCell,\n  type SiteMatrixFeature,\n  type SiteMatrixPermission,\n  buildSiteMatrix,\n  buildPlanMatrix,\n} from './site-matrix.builder';\nexport {\n  buildSiteCatalog,\n  buildSiteRoles,\n  featureAppliesAtNode,\n  findFeatureByCode,\n  isSiteLockedOnPlatform,\n  isPlanMember,\n} from './catalog.builder';\nexport { type ComposeRoleGrantsParams, composeRoleGrants, type RevokedGrants } from './compose-role-grants';\nexport {\n  buildDependsMap,\n  cascadeLocked,\n  type DependsMap,\n  filterGrantedByDeps,\n  prereqClosure,\n} from './permission-deps';\nexport {\n  type ClientPlatform,\n  type LockedPermission,\n  type PermissionFeature,\n  pickRouteForPlatform,\n  type ResolveUserFeaturesParams,\n  resolveUserFeatures,\n} from './resolve-user-features';\nexport {\n  type FeatureLocks,\n  type SiteFeatureLocks,\n  type CatalogPermission,\n  type FeatureCatalogEntry,\n  type FeatureUnlocks,\n  type LockReason,\n  PLATFORMS,\n  type PlatformBucket,\n  type PlatformCodes,\n  type PlatformDenyCodes,\n  type RoleItem,\n  SITE_TYPES,\n  type ScopeType,\n  type SiteType,\n  SNAPSHOT_SCHEMA_VERSION,\n  type SnapshotApp,\n  type SnapshotAppFeatureRef,\n  type BusinessVocabulary,\n  type VocabularyEntry,\n  type SnapshotBusiness,\n  type SnapshotFeature,\n  type SnapshotMicrofrontendMobile,\n  type SnapshotMicrofrontends,\n  type SnapshotMicrofrontendWeb,\n  type SnapshotPermission,\n  type SnapshotPlan,\n  type SnapshotRoleTemplate,\n  snapshotFeatureKey,\n  type VersionSnapshot,\n} from './types';\n","// Intra-feature permission prerequisites — only DIRECT edges are declared; the transitive closure is computed by recursion, cycle-guarded\n\nexport type DependsMap = Map<string, string[]>;\n\n// Builds a dependency map from a feature's permissions, keeping only edges to codes present in the set\nexport function buildDependsMap(permissions: Array<{ code: string; dependsOn?: string[] }>): DependsMap {\n  const present = new Set(permissions.map((p) => p.code));\n  const map: DependsMap = new Map();\n  for (const p of permissions) {\n    map.set(\n      p.code,\n      (p.dependsOn ?? []).filter((dep) => dep !== p.code && present.has(dep)),\n    );\n  }\n  return map;\n}\n\n// Transitive prerequisite closure of a code (excludes the code itself), cycle-safe\nexport function prereqClosure(code: string, deps: DependsMap): string[] {\n  const out = new Set<string>();\n  const seen = new Set<string>([code]);\n  const stack = [code];\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    for (const dep of deps.get(current) ?? []) {\n      if (seen.has(dep)) continue;\n      seen.add(dep);\n      out.add(dep);\n      stack.push(dep);\n    }\n  }\n  return [...out];\n}\n\n// Codes locked after cascade: a code is locked if directly locked or any transitive prerequisite is (cycle-safe)\nexport function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string> {\n  const locked = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (locked.has(code)) return true;\n    if (directlyLocked.has(code)) {\n      locked.add(code);\n      return true;\n    }\n    if (visiting.has(code)) return false;\n    visiting.add(code);\n    const viaDep = (deps.get(code) ?? []).some(check);\n    visiting.delete(code);\n    if (viaDep) locked.add(code);\n    return viaDep;\n  };\n  for (const code of codes) check(code);\n  return locked;\n}\n\n// Keeps only codes whose FULL prerequisite closure is also present — drops a dependent missing any prerequisite (cycle-safe)\nexport function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string> {\n  const ok = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (ok.has(code)) return true;\n    if (!granted.has(code)) return false;\n    if (visiting.has(code)) return true;\n    visiting.add(code);\n    const satisfied = (deps.get(code) ?? []).every(check);\n    visiting.delete(code);\n    if (satisfied) ok.add(code);\n    return satisfied;\n  };\n  for (const code of granted) check(code);\n  return ok;\n}\n","// ——— Platform algebra — plan unlocks, role grants, and BU locks are all stored per UI platform bucket ———\n\nexport type PlatformBucket = 'web' | 'mobile';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile'];\n\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n}\n\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n}\n\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\nexport type FeatureLocks = Record<string, PlatformDenyCodes>;\nexport type SiteFeatureLocks = FeatureLocks;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n  dependsOn: string[];\n}\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport type ScopeType = 'ORG' | 'LE' | 'SITE_GROUP' | 'SITE';\nexport type SiteType = 'OUTLET' | 'WAREHOUSE' | 'PRODUCTION';\nexport const SITE_TYPES: SiteType[] = ['OUTLET', 'WAREHOUSE', 'PRODUCTION'];\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n}\nexport interface SnapshotAppFeatureRef {\n  code: string;\n  scope: ScopeType;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: SnapshotAppFeatureRef[];\n}\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  scope: ScopeType;\n  siteType: SiteType;\n  features: FeatureUnlocks;\n}\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxSites: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface VocabularyEntry {\n  singular: string;\n  plural: string;\n}\nexport interface BusinessVocabulary {\n  site?: VocabularyEntry;\n  siteGroup?: VocabularyEntry;\n  outlet?: VocabularyEntry;\n  warehouse?: VocabularyEntry;\n  production?: VocabularyEntry;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  vocabulary?: BusinessVocabulary;\n  apps: SnapshotApp[];\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  schemaVersion?: number;\n  // Flat feature dictionary keyed by `${scope}.${code}` (see snapshotFeatureKey) — same-code features at different scopes stay distinct\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// Composite key for the snapshot feature dictionary — feature identity is (scope, code)\nexport function snapshotFeatureKey(code: string, scope: ScopeType): string {\n  return `${scope}.${code}`;\n}\n\nexport const SNAPSHOT_SCHEMA_VERSION = 2;\n\nexport type LockReason = 'PLAN' | 'SITE';\n\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n}\n\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  permissions: CatalogPermission[];\n}\n\nexport type RoleItem = SnapshotRoleTemplate;\n","import { buildDependsMap, cascadeLocked, prereqClosure } from './permission-deps';\nimport type {\n  ScopeType,\n  SiteType,\n  SiteFeatureLocks,\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  RoleItem,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\n// Whether a feature with the given site-type applicability is exposed at this site type\nexport function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean {\n  return applicableSiteTypes.includes(siteType);\n}\n\n// Scope-agnostic lookup of a feature by bare code — grants/locks key features by code alone, so the first scope-variant's shared metadata (permission graph) answers\nexport function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined {\n  for (const feature of Object.values(snapshot.features ?? {})) {\n    if (feature?.code === code) return feature;\n  }\n  return undefined;\n}\n\n// Builds the per-site catalog for ONE platform bucket — plan is the ceiling, siteLocks is a deny-list within it; each permission carries locked + lockReason + unlockPlans\nexport function buildSiteCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  bucket: PlatformBucket,\n  siteType?: SiteType,\n  scope?: ScopeType,\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  const plan = planCode ? business.plans?.[planCode] : undefined;\n  const plans = business.plans ?? {};\n\n  const catalog: FeatureCatalogEntry[] = [];\n  // Iterate apps alphabetically by name so the resolved feature list (→ core-web sidebar) is app-alphabetical without any frontend re-sort\n  const sortedApps = [...business.apps].sort((a, b) => a.name.localeCompare(b.name));\n  for (const app of sortedApps) {\n    // The app's renderable features (each ref pins scope+code to one app), dropped when they don't belong to this workspace scope or node type (outlet vs container)\n    const businessAppFeatures = app.features\n      .filter((ref) => scope === undefined || ref.scope === scope)\n      .map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)])\n      .filter(\n        (f): f is SnapshotFeature =>\n          !!f &&\n          !!(f.microfrontends?.web || f.microfrontends?.mobile) &&\n          (siteType === undefined || featureAppliesAtNode(f.applicableSiteTypes, siteType)),\n      );\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves as a locked tile instead of vanishing\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions?.[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      const permissions = buildPermissions(feature, businessCode, membership, siteLocks, plans, bucket);\n      // Feature-level lock is EXPLICIT: plan must include the feature on this bucket and the site must not null-lock the platform\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const sitePlatformLocked = siteLocks?.[feature.code]?.[bucket] === null;\n      const locked = !memberOnBucket || sitePlatformLocked;\n      const lockReason: LockReason | null = !memberOnBucket ? 'PLAN' : sitePlatformLocked ? 'SITE' : null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions)\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  return !!entry && (entry.web !== undefined || entry.mobile !== undefined);\n}\n\n// Per-platform site-lock primitive: null locks the whole feature, string[] locks those codes, absent = not locked\nexport function isSiteLockedOnPlatform(\n  entry: SiteFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and site deny-list (bucket-scoped)\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = siteLocks?.[feature.code];\n\n  const perms = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode));\n  const deps = buildDependsMap(perms);\n  const codes = perms.map((p) => p.code);\n\n  // Direct plan/site locks, then cascade so a locked prerequisite (e.g. view) locks its dependents (add/edit/delete)\n  const directlyPlanLocked = new Set<string>();\n  const directlySiteLocked = new Set<string>();\n  for (const p of perms) {\n    if (!planUnlocked.has(p.code)) directlyPlanLocked.add(p.code);\n    if (isSiteLockedOnPlatform(lockEntry, bucket, p.code)) directlySiteLocked.add(p.code);\n  }\n  const directlyLocked = new Set<string>([...directlyPlanLocked, ...directlySiteLocked]);\n  const lockedSet = cascadeLocked(codes, directlyLocked, deps);\n\n  return perms.map((p) => {\n    const locked = lockedSet.has(p.code);\n    // A permission is enabled only if it AND its whole prerequisite closure are unlocked — reason/upsell reflect that\n    const closure = [p.code, ...prereqClosure(p.code, deps)];\n    const planReason = closure.some((c) => directlyPlanLocked.has(c));\n    const siteReason = closure.some((c) => directlySiteLocked.has(c));\n    // Plan is the ceiling, so a plan-lock anywhere in the closure wins over a site-lock when reporting the reason\n    const lockReason: LockReason | null = !locked ? null : planReason ? 'PLAN' : siteReason ? 'SITE' : null;\n    const unlockPlans =\n      locked && lockReason === 'PLAN' ? plansUnlockingClosure(plans, feature.code, closure, bucket) : [];\n    return { code: p.code, locked, lockReason, unlockPlans };\n  });\n}\n\n// Plan codes (in the business) whose unlocked set includes the permission AND its whole prerequisite closure — upsell targets\nfunction plansUnlockingClosure(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  closure: string[],\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlocked = plan.unlockedPermissions?.[featureCode]?.[bucket];\n    if (unlocked && closure.every((c) => unlocked.includes(c))) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates ?? {});\n}\n","import { featureAppliesAtNode, isSiteLockedOnPlatform, isPlanMember } from './catalog.builder';\nimport {\n  type ScopeType,\n  type SiteFeatureLocks,\n  type SiteType,\n  PLATFORMS,\n  type PlatformBucket,\n  type SnapshotPlan,\n  snapshotFeatureKey,\n  type VersionSnapshot,\n} from './types';\n\nexport interface SiteMatrixCell {\n  inPlan: boolean;\n  selected: boolean;\n  availableIn: string[];\n}\n\nexport interface SiteMatrixPermission {\n  code: string;\n  label: string;\n  dependsOn: string[];\n  web: SiteMatrixCell | null;\n  mobile: SiteMatrixCell | null;\n}\n\nexport interface SiteMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  platforms: PlatformBucket[];\n  inPlan: boolean;\n  availableIn: string[];\n  permissions: SiteMatrixPermission[];\n}\n\nexport interface SiteMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  unlockedCount: number;\n  totalCount: number;\n  features: SiteMatrixFeature[];\n}\n\nexport interface SiteMatrix {\n  plan: { code: string; name: string };\n  apps: SiteMatrixApp[];\n  locks: SiteFeatureLocks;\n}\n\n// Builds the SITE-only apps/features/permissions matrix — not filtered to plan members; plan-locked items carry inPlan=false + availableIn\nexport function buildSiteMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  siteType?: SiteType,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, false, siteType);\n}\n\n// Builds the all-scopes apps/features/permissions matrix — every scope's features included, each carrying its real scope; powers the Plan Overview + Create Custom Role picker\nexport function buildPlanMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks?: SiteFeatureLocks,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, true);\n}\n\n// Shared matrix builder — allScopes=false keeps only SITE refs; allScopes=true includes every scope and emits each feature's real scope\nfunction buildMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  allScopes: boolean,\n  siteType?: SiteType,\n): SiteMatrix {\n  const business = businessCode ? snapshot.businesses?.[businessCode] : undefined;\n  const plans = business?.plans ?? {};\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const locks = siteLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: SiteMatrixApp[] = [];\n  for (const app of business.apps) {\n    let unlockedCount = 0;\n    let totalCount = 0;\n    const features: SiteMatrixFeature[] = [];\n\n    for (const ref of app.features) {\n      if (!allScopes && ref.scope !== 'SITE') continue;\n      const code = ref.code;\n      const feature = snapshot.features?.[snapshotFeatureKey(code, ref.scope)];\n      if (!feature) continue;\n      if (siteType !== undefined && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;\n      const platforms = PLATFORMS.filter((p) => !!feature.microfrontends?.[p]);\n      if (platforms.length === 0) continue;\n\n      const membership = plan.unlockedPermissions?.[code];\n      const featureInPlan = isPlanMember(membership);\n      const siteEntry = siteLocks?.[code];\n\n      const permissions: SiteMatrixPermission[] = (feature.permissions ?? [])\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): SiteMatrixCell | null => {\n            if (!platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the site locks it on this platform\n            const selected = inPlan && !isSiteLockedOnPlatform(siteEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            totalCount += 1;\n            if (inPlan) unlockedCount += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return {\n            code: p.code,\n            label: p.label,\n            dependsOn: p.dependsOn ?? [],\n            web: cell('web'),\n            mobile: cell('mobile'),\n          };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        scope: feature.scope,\n        applicableSiteTypes: feature.applicableSiteTypes,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        permissions,\n      });\n    }\n\n    if (features.length === 0) continue;\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, unlockedCount, totalCount, features });\n  }\n\n  // Emit apps alphabetically by name so every consumer (Plan Overview, Role picker, all Locks screens) renders them sorted\n  apps.sort((a, b) => a.name.localeCompare(b.name));\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions?.[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions?.[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10); inputs are never mutated\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions ?? {})]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions?.[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set\n    if (composed.web === undefined && composed.mobile === undefined) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildSiteCatalog, findFeatureByCode } from './catalog.builder';\nimport { buildDependsMap, filterGrantedByDeps } from './permission-deps';\nimport type {\n  SiteFeatureLocks,\n  FeatureUnlocks,\n  LockReason,\n  PlatformBucket,\n  ScopeType,\n  SiteType,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\nexport type ClientPlatform = 'web' | 'ios' | 'android';\n\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n}\n\nexport interface PlanUpsell {\n  plan: string;\n  features: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  lockedPermissions: LockedPermission[];\n  upsell: PlanUpsell[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  siteLocks: SiteFeatureLocks | undefined;\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n  siteType?: SiteType;\n  scope?: ScopeType;\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants, filtered to the requested platform\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, siteLocks, roleFeatures, platform, siteType, scope } = params;\n\n  // Plan unlocks, BU locks, and role grants are stored per platform; resolve only the requesting surface's bucket (web → 'web'; ios/android → 'mobile')\n  const bucket: PlatformBucket = platform === 'web' ? 'web' : 'mobile';\n\n  // Grants/plans/locks key features by bare code; resolve to the workspace scope's variant (or any variant when unscoped)\n  const featureByCode = (code: string) =>\n    scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code);\n\n  // Plan ∧ BU overlay for this bucket, filtered to features that apply to this workspace scope and node type — emits EVERY applicable business feature (plan non-members come out fully locked)\n  const catalog = buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, siteType, scope);\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Per-plan feature-name delta vs the current plan — feeds the plan-locked upsell screen\n  const businessPlans = snapshot.businesses[businessCode]?.plans ?? {};\n  const currentUnlockedCodes = new Set<string>();\n  if (planCode && businessPlans[planCode]) {\n    for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] !== undefined) currentUnlockedCodes.add(featureCode);\n    }\n  }\n  const planAdds = new Map<string, Array<{ code: string; name: string }>>();\n  for (const [planKey, plan] of Object.entries(businessPlans)) {\n    if (planKey === planCode) continue;\n    const adds: Array<{ code: string; name: string }> = [];\n    for (const [featureCode, platforms] of Object.entries(plan.unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] === undefined || currentUnlockedCodes.has(featureCode)) continue;\n      const name = featureByCode(featureCode)?.name;\n      if (name) adds.push({ code: featureCode, name });\n    }\n    planAdds.set(planKey, adds);\n  }\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures ?? {})) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant?.[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    const route = pickRouteForPlatform(catalogEntry, platform);\n    // Feature isn't published to this platform — omit so client doesn't see an unloadable tile.\n    if (!route) continue;\n\n    // Drop granted permissions whose intra-feature prerequisites aren't also granted (e.g. add needs view)\n    const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [p.code, p]));\n    const grantedPerms = [...filterGrantedByDeps(permsSet, featureDeps)];\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({ code: p.code, reason: p.lockReason ?? null, unlockPlans: p.unlockPlans ?? [] }));\n\n    // For a plan-locked feature, list the extra features each unlocking plan would add (excluding this feature)\n    const upsell: PlanUpsell[] =\n      catalogEntry.locked && catalogEntry.lockReason === 'PLAN'\n        ? (catalogEntry.unlockPlans ?? [])\n            .map((plan) => ({\n              plan,\n              features: (planAdds.get(plan) ?? []).filter((f) => f.code !== code).map((f) => f.name),\n            }))\n            .filter((group) => group.features.length > 0)\n        : [];\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans ?? [],\n      lockedPermissions,\n      upsell,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  // Order app-alphabetically so the core-web sidebar (groups by app) renders apps sorted without any frontend re-sort;\n  // stable sort keeps each app's features in their existing relative order\n  features.sort((a, b) => a.appName.localeCompare(b.appName));\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform, or null when it doesn't publish there\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;ACKO,SAASA,gBAAgBC,aAA0D;AACxF,QAAMC,UAAU,IAAIC,IAAIF,YAAYG,IAAI,CAACC,MAAMA,EAAEC,IAAI,CAAA;AACrD,QAAMF,MAAkB,oBAAIG,IAAAA;AAC5B,aAAWF,KAAKJ,aAAa;AAC3BG,QAAII,IACFH,EAAEC,OACDD,EAAEI,aAAa,CAAA,GAAIC,OAAO,CAACC,QAAQA,QAAQN,EAAEC,QAAQJ,QAAQU,IAAID,GAAAA,CAAAA,CAAAA;EAEtE;AACA,SAAOP;AACT;AAVgBJ;AAaT,SAASa,cAAcP,MAAcQ,MAAgB;AAC1D,QAAMC,MAAM,oBAAIZ,IAAAA;AAChB,QAAMa,OAAO,oBAAIb,IAAY;IAACG;GAAK;AACnC,QAAMW,QAAQ;IAACX;;AACf,SAAOW,MAAMC,SAAS,GAAG;AACvB,UAAMC,UAAUF,MAAMG,IAAG;AACzB,eAAWT,OAAOG,KAAKO,IAAIF,OAAAA,KAAY,CAAA,GAAI;AACzC,UAAIH,KAAKJ,IAAID,GAAAA,EAAM;AACnBK,WAAKM,IAAIX,GAAAA;AACTI,UAAIO,IAAIX,GAAAA;AACRM,YAAMM,KAAKZ,GAAAA;IACb;EACF;AACA,SAAO;OAAII;;AACb;AAdgBF;AAiBT,SAASW,cAAcC,OAAiBC,gBAA6BZ,MAAgB;AAC1F,QAAMa,SAAS,oBAAIxB,IAAAA;AACnB,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAIqB,OAAOf,IAAIN,IAAAA,EAAO,QAAO;AAC7B,QAAIoB,eAAed,IAAIN,IAAAA,GAAO;AAC5BqB,aAAOL,IAAIhB,IAAAA;AACX,aAAO;IACT;AACA,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAMwB,UAAUhB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAIyB,KAAKF,KAAAA;AAC3CD,aAASI,OAAO1B,IAAAA;AAChB,QAAIwB,OAAQH,QAAOL,IAAIhB,IAAAA;AACvB,WAAOwB;EACT,GAZc;AAad,aAAWxB,QAAQmB,MAAOI,OAAMvB,IAAAA;AAChC,SAAOqB;AACT;AAlBgBH;AAqBT,SAASS,oBAAoBC,SAAsBpB,MAAgB;AACxE,QAAMqB,KAAK,oBAAIhC,IAAAA;AACf,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAI6B,GAAGvB,IAAIN,IAAAA,EAAO,QAAO;AACzB,QAAI,CAAC4B,QAAQtB,IAAIN,IAAAA,EAAO,QAAO;AAC/B,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAM8B,aAAatB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAI+B,MAAMR,KAAAA;AAC/CD,aAASI,OAAO1B,IAAAA;AAChB,QAAI8B,UAAWD,IAAGb,IAAIhB,IAAAA;AACtB,WAAO8B;EACT,GATc;AAUd,aAAW9B,QAAQ4B,QAASL,OAAMvB,IAAAA;AAClC,SAAO6B;AACT;AAfgBF;;;ACpDT,IAAMK,YAA8B;EAAC;EAAO;;AA+C5C,IAAMC,aAAyB;EAAC;EAAU;EAAa;;AA+DvD,SAASC,mBAAmBC,MAAcC,OAAgB;AAC/D,SAAO,GAAGA,KAAAA,IAASD,IAAAA;AACrB;AAFgBD;AAIT,IAAMG,0BAA0B;;;ACpGhC,SAASC,qBAAqBC,qBAAiCC,UAAkB;AACtF,SAAOD,oBAAoBE,SAASD,QAAAA;AACtC;AAFgBF;AAKT,SAASI,kBAAkBC,UAA2BC,MAAY;AACvE,aAAWC,WAAWC,OAAOC,OAAOJ,SAASK,YAAY,CAAC,CAAA,GAAI;AAC5D,QAAIH,SAASD,SAASA,KAAM,QAAOC;EACrC;AACA,SAAOI;AACT;AALgBP;AAQT,SAASQ,iBACdP,UACAQ,cACAC,UACAC,WACAC,QACAd,UACAe,OAAiB;AAEjB,MAAI,CAACJ,aAAc,QAAO,CAAA;AAC1B,QAAMK,WAAWb,SAASc,aAAaN,YAAAA;AACvC,MAAI,CAACK,SAAU,QAAO,CAAA;AACtB,QAAME,OAAON,WAAWI,SAASG,QAAQP,QAAAA,IAAYH;AACrD,QAAMU,QAAQH,SAASG,SAAS,CAAC;AAEjC,QAAMC,UAAiC,CAAA;AAEvC,QAAMC,aAAa;OAAIL,SAASM;IAAMC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,KAAKC,cAAcF,EAAEC,IAAI,CAAA;AAChF,aAAWE,OAAOP,YAAY;AAE5B,UAAMQ,sBAAsBD,IAAIpB,SAC7BsB,OAAO,CAACC,QAAQhB,UAAUN,UAAasB,IAAIhB,UAAUA,KAAAA,EACrDiB,IAAI,CAACD,QAAQ5B,SAASK,WAAWyB,mBAAmBF,IAAI3B,MAAM2B,IAAIhB,KAAK,CAAA,CAAE,EACzEe,OACC,CAACI,MACC,CAAC,CAACA,KACF,CAAC,EAAEA,EAAEC,gBAAgBC,OAAOF,EAAEC,gBAAgBE,YAC7CrC,aAAaS,UAAaX,qBAAqBoC,EAAEnC,qBAAqBC,QAAAA,EAAQ;AAGrF,QAAI6B,oBAAoBS,WAAW,EAAG;AAGtC,eAAWjC,WAAWwB,qBAAqB;AACzC,YAAMU,aAAarB,MAAMsB,sBAAsBnC,QAAQD,IAAI;AAE3D,YAAMgC,MAAM/B,QAAQ8B,gBAAgBC;AACpC,YAAMC,SAAShC,QAAQ8B,gBAAgBE;AAEvC,YAAMI,cAAcC,iBAAiBrC,SAASM,cAAc4B,YAAY1B,WAAWM,OAAOL,MAAAA;AAE1F,YAAM6B,iBAAiBJ,aAAazB,MAAAA,MAAYL;AAChD,YAAMmC,qBAAqB/B,YAAYR,QAAQD,IAAI,IAAIU,MAAAA,MAAY;AACnE,YAAM+B,SAAS,CAACF,kBAAkBC;AAClC,YAAME,aAAgC,CAACH,iBAAiB,SAASC,qBAAqB,SAAS;AAC/F,YAAMG,cAAcD,eAAe,SAASE,sBAAsB7B,OAAOd,QAAQD,MAAMU,MAAAA,IAAU,CAAA;AAEjGM,cAAQ6B,KAAK;QACX7C,MAAMC,QAAQD;QACdsB,MAAMrB,QAAQqB;QACdwB,YAAY7C,QAAQ6C,cAAc;QAClCC,UAAU9C,QAAQ8C,YAAY;QAC9BC,gBAAgB/C,QAAQ+C,kBAAkB;QAC1ChB,KAAKA,MACD;UACEiB,aAAajB,IAAIiB,eAAe;UAChCC,eAAelB,IAAIkB,iBAAiB;UACpCC,aAAanB,IAAImB,eAAe;QAClC,IACA;QACJlB,QAAQA,SACJ;UACEmB,oBAAoBnB,OAAOmB,sBAAsB;UACjDC,gBAAgBpB,OAAOoB,kBAAkB;UACzCH,eAAejB,OAAOiB,iBAAiB;UACvCC,aAAalB,OAAOkB,eAAe;QACrC,IACA;QACJG,SAAS9B,IAAIxB;QACbuD,SAAS/B,IAAIF;QACbkC,SAAShC,IAAIiC,QAAQ;QACrBC,cAAclC,IAAImC,aAAa;QAC/BlB;QACAC;QACAC;QACAN;MACF,CAAA;IACF;EACF;AACA,SAAOrB;AACT;AAhFgBV;AAmFT,SAASsD,aAAaC,OAAgC;AAC3D,SAAO,CAAC,CAACA,UAAUA,MAAM7B,QAAQ3B,UAAawD,MAAM5B,WAAW5B;AACjE;AAFgBuD;AAKT,SAASE,uBACdD,OACAE,UACA/D,MAAY;AAEZ,QAAMgE,QAAQH,QAAQE,QAAAA;AACtB,SAAOC,UAAU,SAASA,OAAOnE,SAASG,IAAAA,KAAS;AACrD;AAPgB8D;AAUhB,SAASxB,iBACPrC,SACAM,cACA0D,gBACAxD,WACAM,OACAL,QAAsB;AAEtB,QAAMwD,eAAe,IAAIC,IAAIF,iBAAiBvD,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAM0D,YAAY3D,YAAYR,QAAQD,IAAI;AAE1C,QAAMqE,SAASpE,QAAQoC,eAAe,CAAA,GAAIX,OAAO,CAAC4C,MAAMA,EAAEC,YAAYD,EAAEzD,WAAWhB,SAASU,YAAAA,CAAAA;AAC5F,QAAMiE,OAAOC,gBAAgBJ,KAAAA;AAC7B,QAAMK,QAAQL,MAAMzC,IAAI,CAAC0C,MAAMA,EAAEtE,IAAI;AAGrC,QAAM2E,qBAAqB,oBAAIR,IAAAA;AAC/B,QAAMS,qBAAqB,oBAAIT,IAAAA;AAC/B,aAAWG,KAAKD,OAAO;AACrB,QAAI,CAACH,aAAaW,IAAIP,EAAEtE,IAAI,EAAG2E,oBAAmBG,IAAIR,EAAEtE,IAAI;AAC5D,QAAI8D,uBAAuBM,WAAW1D,QAAQ4D,EAAEtE,IAAI,EAAG4E,oBAAmBE,IAAIR,EAAEtE,IAAI;EACtF;AACA,QAAM+E,iBAAiB,oBAAIZ,IAAY;OAAIQ;OAAuBC;GAAmB;AACrF,QAAMI,YAAYC,cAAcP,OAAOK,gBAAgBP,IAAAA;AAEvD,SAAOH,MAAMzC,IAAI,CAAC0C,MAAAA;AAChB,UAAM7B,SAASuC,UAAUH,IAAIP,EAAEtE,IAAI;AAEnC,UAAMkF,UAAU;MAACZ,EAAEtE;SAASmF,cAAcb,EAAEtE,MAAMwE,IAAAA;;AAClD,UAAMY,aAAaF,QAAQG,KAAK,CAACC,MAAMX,mBAAmBE,IAAIS,CAAAA,CAAAA;AAC9D,UAAMC,aAAaL,QAAQG,KAAK,CAACC,MAAMV,mBAAmBC,IAAIS,CAAAA,CAAAA;AAE9D,UAAM5C,aAAgC,CAACD,SAAS,OAAO2C,aAAa,SAASG,aAAa,SAAS;AACnG,UAAM5C,cACJF,UAAUC,eAAe,SAAS8C,sBAAsBzE,OAAOd,QAAQD,MAAMkF,SAASxE,MAAAA,IAAU,CAAA;AAClG,WAAO;MAAEV,MAAMsE,EAAEtE;MAAMyC;MAAQC;MAAYC;IAAY;EACzD,CAAA;AACF;AArCSL;AAwCT,SAASkD,sBACPzE,OACA0E,aACAP,SACAxE,QAAsB;AAEtB,QAAMgF,SAAmB,CAAA;AACzB,aAAW,CAAC1F,MAAMc,IAAAA,KAASZ,OAAOyF,QAAQ5E,KAAAA,GAAQ;AAChD,UAAM6E,WAAW9E,KAAKsB,sBAAsBqD,WAAAA,IAAe/E,MAAAA;AAC3D,QAAIkF,YAAYV,QAAQW,MAAM,CAACP,MAAMM,SAAS/F,SAASyF,CAAAA,CAAAA,EAAKI,QAAO7C,KAAK7C,IAAAA;EAC1E;AACA,SAAO0F;AACT;AAZSF;AAeT,SAAS5C,sBACP7B,OACA0E,aACA/E,QAAsB;AAEtB,QAAMgF,SAAmB,CAAA;AACzB,aAAW,CAAC1F,MAAMc,IAAAA,KAASZ,OAAOyF,QAAQ5E,KAAAA,GAAQ;AAChD,QAAID,KAAKsB,sBAAsBqD,WAAAA,IAAe/E,MAAAA,MAAYL,OAAWqF,QAAO7C,KAAK7C,IAAAA;EACnF;AACA,SAAO0F;AACT;AAVS9C;AAaF,SAASkD,eAAe/F,UAA2BQ,cAAgC;AACxF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMK,WAAWb,SAASc,aAAaN,YAAAA;AACvC,MAAI,CAACK,SAAU,QAAO,CAAA;AACtB,SAAOV,OAAOC,OAAOS,SAASmF,iBAAiB,CAAC,CAAA;AAClD;AALgBD;;;AC/IT,SAASE,gBACdC,UACAC,cACAC,UACAC,WACAC,UAAmB;AAEnB,SAAOC,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,OAAOC,QAAAA;AACzE;AARgBL;AAWT,SAASO,gBACdN,UACAC,cACAC,UACAC,WAA4B;AAE5B,SAAOE,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,IAAA;AAClE;AAPgBG;AAUhB,SAASD,YACPL,UACAC,cACAC,UACAC,WACAI,WACAH,UAAmB;AAEnB,QAAMI,WAAWP,eAAeD,SAASS,aAAaR,YAAAA,IAAgBS;AACtE,QAAMC,QAAQH,UAAUG,SAAS,CAAC;AAClC,QAAMC,OAAOV,WAAWS,MAAMT,QAAAA,IAAYQ;AAC1C,QAAMG,WAAW;IAAEC,MAAMZ,YAAY;IAAIa,MAAMH,MAAMG,QAAQb,YAAY;EAAG;AAC5E,QAAMc,QAAQb,aAAa,CAAC;AAC5B,MAAI,CAACK,YAAY,CAACI,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAwB,CAAA;AAC9B,aAAWC,OAAOV,SAASS,MAAM;AAC/B,QAAIE,gBAAgB;AACpB,QAAIC,aAAa;AACjB,UAAMC,WAAgC,CAAA;AAEtC,eAAWC,OAAOJ,IAAIG,UAAU;AAC9B,UAAI,CAACd,aAAae,IAAIC,UAAU,OAAQ;AACxC,YAAMT,OAAOQ,IAAIR;AACjB,YAAMU,UAAUxB,SAASqB,WAAWI,mBAAmBX,MAAMQ,IAAIC,KAAK,CAAA;AACtE,UAAI,CAACC,QAAS;AACd,UAAIpB,aAAaM,UAAa,CAACgB,qBAAqBF,QAAQG,qBAAqBvB,QAAAA,EAAW;AAC5F,YAAMwB,YAAYC,UAAUC,OAAO,CAACC,MAAM,CAAC,CAACP,QAAQQ,iBAAiBD,CAAAA,CAAE;AACvE,UAAIH,UAAUK,WAAW,EAAG;AAE5B,YAAMC,aAAatB,KAAKuB,sBAAsBrB,IAAAA;AAC9C,YAAMsB,gBAAgBC,aAAaH,UAAAA;AACnC,YAAMI,YAAYnC,YAAYW,IAAAA;AAE9B,YAAMyB,eAAuCf,QAAQe,eAAe,CAAA,GACjET,OAAO,CAACC,MAAMA,EAAES,YAAYT,EAAEtB,WAAWgC,SAASxC,gBAAgB,EAAA,CAAA,EAClEyC,IAAI,CAACX,MAAAA;AACJ,cAAMY,OAAO,wBAACC,SAAAA;AACZ,cAAI,CAAChB,UAAUa,SAASG,IAAAA,EAAO,QAAO;AACtC,gBAAMC,YAAYX,aAAaU,IAAAA;AAC/B,gBAAME,SAASV,iBAAiBS,cAAcnC,UAAamC,UAAUJ,SAASV,EAAEjB,IAAI;AAEpF,gBAAMiC,WAAWD,UAAU,CAACE,uBAAuBV,WAAWM,MAAMb,EAAEjB,IAAI;AAC1E,gBAAMmC,cAAcH,SAAS,CAAA,IAAKI,mBAAmBvC,OAAOG,MAAMiB,EAAEjB,MAAM8B,MAAM1C,QAAAA;AAChFkB,wBAAc;AACd,cAAI0B,OAAQ3B,kBAAiB;AAC7B,iBAAO;YAAE2B;YAAQC;YAAUE;UAAY;QACzC,GAVa;AAWb,eAAO;UACLnC,MAAMiB,EAAEjB;UACRqC,OAAOpB,EAAEoB;UACTC,WAAWrB,EAAEqB,aAAa,CAAA;UAC1BC,KAAKV,KAAK,KAAA;UACVW,QAAQX,KAAK,QAAA;QACf;MACF,CAAA;AAEFtB,eAASkC,KAAK;QACZzC,MAAMU,QAAQV;QACdC,MAAMS,QAAQT;QACdyC,MAAMhC,QAAQiC,cAAc;QAC5BlC,OAAOC,QAAQD;QACfI,qBAAqBH,QAAQG;QAC7BC;QACAkB,QAAQV;QACRa,aAAab,gBAAgB,CAAA,IAAKsB,uBAAsB/C,OAAOG,MAAMZ,QAAAA;QACrEqC;MACF,CAAA;IACF;AAEA,QAAIlB,SAASY,WAAW,EAAG;AAC3BhB,SAAKsC,KAAK;MAAEzC,MAAMI,IAAIJ;MAAMC,MAAMG,IAAIH;MAAMyC,MAAMtC,IAAIsC,QAAQ;MAAMrC;MAAeC;MAAYC;IAAS,CAAA;EAC1G;AAGAJ,OAAK0C,KAAK,CAACC,GAAGC,MAAMD,EAAE7C,KAAK+C,cAAcD,EAAE9C,IAAI,CAAA;AAE/C,SAAO;IAAEH,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AA9ESX;AAiFT,SAAS6C,mBACPvC,OACAoD,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,SAAKnC,EAAEI,sBAAsB4B,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAIxB,SAASuB,QAAAA,EAAWG,OAAMZ,KAAKxB,EAAEhB,IAAI;EACpG;AACA,SAAOoD;AACT;AAbSjB;AAgBT,SAASQ,uBACP/C,OACAoD,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,QAAI7B,aAAaN,EAAEI,sBAAsB4B,WAAAA,CAAY,EAAGI,OAAMZ,KAAKxB,EAAEhB,IAAI;EAC3E;AACA,SAAOoD;AACT;AAXST,OAAAA,wBAAAA;;;ACjKT,SAASY,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAMF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,aAAa,CAAC,CAAA;GAAG;AAElG,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,YAAYM,IAAAA,KAAS,CAAC;AAClC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAGA,QAAIN,SAASQ,QAAQrB,UAAaa,SAASS,WAAWtB,OAAW;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA3BgBL;;;AC4CT,SAASqB,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,WAAWC,cAAcC,UAAUC,UAAUC,MAAK,IAAKR;AAGjG,QAAMS,SAAyBH,aAAa,QAAQ,QAAQ;AAG5D,QAAMI,gBAAgB,wBAACC,SACrBH,QAAQP,SAASW,WAAWC,mBAAmBF,MAAMH,KAAAA,CAAAA,IAAUM,kBAAkBb,UAAUU,IAAAA,GADvE;AAItB,QAAMI,UAAUC,iBAAiBf,UAAUC,cAAcC,UAAUC,WAAWK,QAAQF,UAAUC,KAAAA;AAChG,QAAMS,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAET;IAAMS;GAAE,CAAA;AAGzD,QAAMC,gBAAgBpB,SAASqB,WAAWpB,YAAAA,GAAeqB,SAAS,CAAC;AACnE,QAAMC,uBAAuB,oBAAIC,IAAAA;AACjC,MAAItB,YAAYkB,cAAclB,QAAAA,GAAW;AACvC,eAAW,CAACuB,aAAaC,SAAAA,KAAcC,OAAOC,QAAQR,cAAclB,QAAAA,EAAU2B,uBAAuB,CAAC,CAAA,GAAI;AACxG,UAAIH,YAAYlB,MAAAA,MAAYsB,OAAWP,sBAAqBQ,IAAIN,WAAAA;IAClE;EACF;AACA,QAAMO,WAAW,oBAAIf,IAAAA;AACrB,aAAW,CAACgB,SAASC,IAAAA,KAASP,OAAOC,QAAQR,aAAAA,GAAgB;AAC3D,QAAIa,YAAY/B,SAAU;AAC1B,UAAMiC,OAA8C,CAAA;AACpD,eAAW,CAACV,aAAaC,SAAAA,KAAcC,OAAOC,QAAQM,KAAKL,uBAAuB,CAAC,CAAA,GAAI;AACrF,UAAIH,YAAYlB,MAAAA,MAAYsB,UAAaP,qBAAqBa,IAAIX,WAAAA,EAAc;AAChF,YAAMY,OAAO5B,cAAcgB,WAAAA,GAAcY;AACzC,UAAIA,KAAMF,MAAKG,KAAK;QAAE5B,MAAMe;QAAaY;MAAK,CAAA;IAChD;AACAL,aAASO,IAAIN,SAASE,IAAAA;EACxB;AAGA,QAAMK,kBAAkB,oBAAIvB,IAAAA;AAC5B,aAAW,CAACP,MAAM+B,KAAAA,KAAUd,OAAOC,QAAQxB,gBAAgB,CAAC,CAAA,GAAI;AAE9D,UAAMsC,UAAUD,QAAQjC,MAAAA;AACxB,QAAIkC,YAAYZ,OAAW;AAC3B,QAAI,CAACU,gBAAgBJ,IAAI1B,IAAAA,EAAO8B,iBAAgBD,IAAI7B,MAAM,oBAAIc,IAAAA,CAAAA;AAC9D,eAAWmB,QAAQD,QAASF,iBAAgBI,IAAIlC,IAAAA,GAAOqB,IAAIY,IAAAA;EAC7D;AAGA,QAAMhC,WAAgC,CAAA;AACtC,aAAW,CAACD,MAAMmC,QAAAA,KAAaL,iBAAiB;AAC9C,UAAMM,eAAe9B,WAAW4B,IAAIlC,IAAAA;AACpC,QAAI,CAACoC,aAAc;AAEnB,UAAMC,QAAQC,qBAAqBF,cAAczC,QAAAA;AAEjD,QAAI,CAAC0C,MAAO;AAGZ,UAAME,cAAcC,gBAAgBzC,cAAcC,IAAAA,GAAOyC,eAAe,CAAA,CAAE;AAE1E,UAAMC,aAAa,IAAInC,KAAK6B,aAAaK,eAAe,CAAA,GAAIjC,IAAI,CAACmC,MAAM;MAACA,EAAE3C;MAAM2C;KAAE,CAAA;AAClF,UAAMC,eAAe;SAAIC,oBAAoBV,UAAUI,WAAAA;;AACvD,UAAMO,oBAAwCF,aAC3CpC,IAAI,CAACuC,MAAML,WAAWR,IAAIa,CAAAA,CAAAA,EAC1BC,OAAO,CAACL,MAAkC,CAAC,CAACA,GAAGM,MAAAA,EAC/CzC,IAAI,CAACmC,OAAO;MAAE3C,MAAM2C,EAAE3C;MAAMkD,QAAQP,EAAEQ,cAAc;MAAMC,aAAaT,EAAES,eAAe,CAAA;IAAG,EAAA;AAG9F,UAAMC,SACJjB,aAAaa,UAAUb,aAAae,eAAe,UAC9Cf,aAAagB,eAAe,CAAA,GAC1B5C,IAAI,CAACgB,UAAU;MACdA;MACAvB,WAAWqB,SAASY,IAAIV,IAAAA,KAAS,CAAA,GAAIwB,OAAO,CAACvC,MAAMA,EAAET,SAASA,IAAAA,EAAMQ,IAAI,CAACC,MAAMA,EAAEkB,IAAI;IACvF,EAAA,EACCqB,OAAO,CAACM,UAAUA,MAAMrD,SAASsD,SAAS,CAAA,IAC7C,CAAA;AAENtD,aAAS2B,KAAK;MACZ5B;MACA2B,MAAMS,aAAaT;MACnB6B,YAAYpB,aAAaoB;MACzBC,UAAUrB,aAAaqB;MACvBC,gBAAgBtB,aAAasB;MAC7BjB,aAAaG;MACbK,QAAQb,aAAaa,UAAU;MAC/BE,YAAYf,aAAae,cAAc;MACvCC,aAAahB,aAAagB,eAAe,CAAA;MACzCN;MACAO;MACAhB;MACAsB,SAASvB,aAAauB;MACtBC,SAASxB,aAAawB;MACtBC,SAASzB,aAAayB;MACtBC,cAAc1B,aAAa0B;IAC7B,CAAA;EACF;AAIA7D,WAAS8D,KAAK,CAACC,GAAGC,MAAMD,EAAEJ,QAAQM,cAAcD,EAAEL,OAAO,CAAA;AAEzD,SAAO3D;AACT;AApGgBb;AAuGT,SAASkD,qBACd6B,OAaAxE,UAAwB;AAExB,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAACwE,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLC,aAAa1E,aAAa,QAAQwE,MAAMC,OAAOE,iBAAiBH,MAAMC,OAAOG;MAC7EC,eAAeL,MAAMC,OAAOI;MAC5BC,aAAaN,MAAMC,OAAOK;IAC5B;EACF;AAEA,MAAI,CAACN,MAAMO,IAAK,QAAO;AACvB,SAAO;IACLL,aAAaF,MAAMO,IAAIL;IACvBG,eAAeL,MAAMO,IAAIF;IACzBC,aAAaN,MAAMO,IAAID;EACzB;AACF;AA/BgBnC;","names":["buildDependsMap","permissions","present","Set","map","p","code","Map","set","dependsOn","filter","dep","has","prereqClosure","deps","out","seen","stack","length","current","pop","get","add","push","cascadeLocked","codes","directlyLocked","locked","visiting","check","viaDep","some","delete","filterGrantedByDeps","granted","ok","satisfied","every","PLATFORMS","SITE_TYPES","snapshotFeatureKey","code","scope","SNAPSHOT_SCHEMA_VERSION","featureAppliesAtNode","applicableSiteTypes","siteType","includes","findFeatureByCode","snapshot","code","feature","Object","values","features","undefined","buildSiteCatalog","businessCode","planCode","siteLocks","bucket","scope","business","businesses","plan","plans","catalog","sortedApps","apps","sort","a","b","name","localeCompare","app","businessAppFeatures","filter","ref","map","snapshotFeatureKey","f","microfrontends","web","mobile","length","membership","unlockedPermissions","permissions","buildPermissions","memberOnBucket","sitePlatformLocked","locked","lockReason","unlockPlans","plansIncludingFeature","push","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","entry","isSiteLockedOnPlatform","platform","locks","planMembership","planUnlocked","Set","lockEntry","perms","p","isGlobal","deps","buildDependsMap","codes","directlyPlanLocked","directlySiteLocked","has","add","directlyLocked","lockedSet","cascadeLocked","closure","prereqClosure","planReason","some","c","siteReason","plansUnlockingClosure","featureCode","result","entries","unlocked","every","buildSiteRoles","roleTemplates","buildSiteMatrix","snapshot","businessCode","planCode","siteLocks","siteType","buildMatrix","buildPlanMatrix","allScopes","business","businesses","undefined","plans","plan","planMeta","code","name","locks","apps","app","unlockedCount","totalCount","features","ref","scope","feature","snapshotFeatureKey","featureAppliesAtNode","applicableSiteTypes","platforms","PLATFORMS","filter","p","microfrontends","length","membership","unlockedPermissions","featureInPlan","isPlanMember","siteEntry","permissions","isGlobal","includes","map","cell","plat","planCodes","inPlan","selected","isSiteLockedOnPlatform","availableIn","plansUnlockingPerm","label","dependsOn","web","mobile","push","icon","lucideIcon","plansIncludingFeature","sort","a","b","localeCompare","featureCode","permCode","platform","excludeCode","names","Object","entries","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","web","mobile","resolveUserFeatures","params","snapshot","businessCode","planCode","siteLocks","roleFeatures","platform","siteType","scope","bucket","featureByCode","code","features","snapshotFeatureKey","findFeatureByCode","catalog","buildSiteCatalog","catalogMap","Map","map","f","businessPlans","businesses","plans","currentUnlockedCodes","Set","featureCode","platforms","Object","entries","unlockedPermissions","undefined","add","planAdds","planKey","plan","adds","has","name","push","set","grantedFeatures","grant","granted","perm","get","permsSet","catalogEntry","route","pickRouteForPlatform","featureDeps","buildDependsMap","permissions","permByCode","p","grantedPerms","filterGrantedByDeps","lockedPermissions","c","filter","locked","reason","lockReason","unlockPlans","upsell","group","length","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","sort","a","b","localeCompare","entry","mobile","remoteEntry","remoteEntryIos","remoteEntryAndroid","exposedModule","routePrefix","web"]}

package/dist/catalog-resolver.d.cts

@@ -1,48 +1,54 @@
-import { P as PlatformBucket, B as BuFeatureLocks, V as VersionSnapshot, F as FeatureCatalogEntry, R as RoleItem, a as PlatformCodes, b as FeatureUnlocks, c as PlatformDenyCodes, L as LockReason } from './types-DQRwj5rr.cjs';
-export { C as CatalogPermission, d as PLATFORMS, S as SNAPSHOT_SCHEMA_VERSION, e as SnapshotApp, f as SnapshotBusiness, g as SnapshotFeature, h as SnapshotMicrofrontendMobile, j as SnapshotMicrofrontendWeb, i as SnapshotMicrofrontends, k as SnapshotPermission, l as SnapshotPlan, m as SnapshotRoleTemplate } from './types-DQRwj5rr.cjs';
+import { S as ScopeType, a as SiteType, P as PlatformBucket, b as SiteFeatureLocks, V as VersionSnapshot, F as FeatureCatalogEntry, R as RoleItem, c as SnapshotFeature, d as PlatformCodes, e as FeatureUnlocks, f as PlatformDenyCodes, L as LockReason } from './types-C9jPdQqH.cjs';
+export { B as BusinessVocabulary, C as CatalogPermission, g as FeatureLocks, h as PLATFORMS, i as SITE_TYPES, j as SNAPSHOT_SCHEMA_VERSION, k as SnapshotApp, l as SnapshotAppFeatureRef, n as SnapshotBusiness, o as SnapshotMicrofrontendMobile, q as SnapshotMicrofrontendWeb, p as SnapshotMicrofrontends, r as SnapshotPermission, s as SnapshotPlan, t as SnapshotRoleTemplate, m as VocabularyEntry, u as snapshotFeatureKey } from './types-C9jPdQqH.cjs';
 
-interface BuMatrixCell {
+interface SiteMatrixCell {
     inPlan: boolean;
     selected: boolean;
     availableIn: string[];
 }
-interface BuMatrixPermission {
+interface SiteMatrixPermission {
     code: string;
     label: string;
-    web: BuMatrixCell | null;
-    mobile: BuMatrixCell | null;
+    dependsOn: string[];
+    web: SiteMatrixCell | null;
+    mobile: SiteMatrixCell | null;
 }
-interface BuMatrixFeature {
+interface SiteMatrixFeature {
     code: string;
     name: string;
     icon: string | null;
+    scope: ScopeType;
+    applicableSiteTypes: SiteType[];
     platforms: PlatformBucket[];
     inPlan: boolean;
     availableIn: string[];
-    permissions: BuMatrixPermission[];
+    permissions: SiteMatrixPermission[];
 }
-interface BuMatrixApp {
+interface SiteMatrixApp {
     code: string;
     name: string;
     icon: string | null;
     unlockedCount: number;
     totalCount: number;
-    features: BuMatrixFeature[];
+    features: SiteMatrixFeature[];
 }
-interface BuMatrix {
+interface SiteMatrix {
     plan: {
         code: string;
         name: string;
     };
-    apps: BuMatrixApp[];
-    locks: BuFeatureLocks;
+    apps: SiteMatrixApp[];
+    locks: SiteFeatureLocks;
 }
-declare function buildBuMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, buLocks: BuFeatureLocks | undefined): BuMatrix;
+declare function buildSiteMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, siteType?: SiteType): SiteMatrix;
+declare function buildPlanMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks?: SiteFeatureLocks): SiteMatrix;
 
-declare function buildBuCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, buLocks: BuFeatureLocks | undefined, bucket: PlatformBucket): FeatureCatalogEntry[];
+declare function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean;
+declare function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined;
+declare function buildSiteCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, bucket: PlatformBucket, siteType?: SiteType, scope?: ScopeType): FeatureCatalogEntry[];
 declare function isPlanMember(entry: PlatformCodes | undefined): boolean;
-declare function isBuLockedOnPlatform(entry: BuFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
-declare function buildBuRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
+declare function isSiteLockedOnPlatform(entry: SiteFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
+declare function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
 
 type RevokedGrants = Record<string, PlatformDenyCodes>;
 interface ComposeRoleGrantsParams {
@@ -52,12 +58,25 @@ interface ComposeRoleGrantsParams {
 }
 declare function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks;
 
+type DependsMap = Map<string, string[]>;
+declare function buildDependsMap(permissions: Array<{
+    code: string;
+    dependsOn?: string[];
+}>): DependsMap;
+declare function prereqClosure(code: string, deps: DependsMap): string[];
+declare function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string>;
+declare function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string>;
+
 type ClientPlatform = 'web' | 'ios' | 'android';
 interface LockedPermission {
     code: string;
     reason: LockReason | null;
     unlockPlans: string[];
 }
+interface PlanUpsell {
+    plan: string;
+    features: string[];
+}
 interface PermissionFeature {
     code: string;
     name: string;
@@ -69,6 +88,7 @@ interface PermissionFeature {
     lockReason: LockReason | null;
     unlockPlans: string[];
     lockedPermissions: LockedPermission[];
+    upsell: PlanUpsell[];
     route: {
         remoteEntry: string;
         exposedModule: string;
@@ -83,9 +103,11 @@ interface ResolveUserFeaturesParams {
     snapshot: VersionSnapshot;
     businessCode: string;
     planCode: string | undefined;
-    buLocks: BuFeatureLocks | undefined;
+    siteLocks: SiteFeatureLocks | undefined;
     roleFeatures: FeatureUnlocks;
     platform: ClientPlatform;
+    siteType?: SiteType;
+    scope?: ScopeType;
 }
 declare function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[];
 declare function pickRouteForPlatform(entry: {
@@ -106,4 +128,4 @@ declare function pickRouteForPlatform(entry: {
     routePrefix: string;
 } | null;
 
-export { BuFeatureLocks, type BuMatrix, type BuMatrixApp, type BuMatrixCell, type BuMatrixFeature, type BuMatrixPermission, type ClientPlatform, type ComposeRoleGrantsParams, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, VersionSnapshot, buildBuCatalog, buildBuMatrix, buildBuRoles, composeRoleGrants, isBuLockedOnPlatform, isPlanMember, pickRouteForPlatform, resolveUserFeatures };
+export { type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, pickRouteForPlatform, prereqClosure, resolveUserFeatures };

package/dist/catalog-resolver.d.ts

@@ -1,48 +1,54 @@
-import { P as PlatformBucket, B as BuFeatureLocks, V as VersionSnapshot, F as FeatureCatalogEntry, R as RoleItem, a as PlatformCodes, b as FeatureUnlocks, c as PlatformDenyCodes, L as LockReason } from './types-DQRwj5rr.js';
-export { C as CatalogPermission, d as PLATFORMS, S as SNAPSHOT_SCHEMA_VERSION, e as SnapshotApp, f as SnapshotBusiness, g as SnapshotFeature, h as SnapshotMicrofrontendMobile, j as SnapshotMicrofrontendWeb, i as SnapshotMicrofrontends, k as SnapshotPermission, l as SnapshotPlan, m as SnapshotRoleTemplate } from './types-DQRwj5rr.js';
+import { S as ScopeType, a as SiteType, P as PlatformBucket, b as SiteFeatureLocks, V as VersionSnapshot, F as FeatureCatalogEntry, R as RoleItem, c as SnapshotFeature, d as PlatformCodes, e as FeatureUnlocks, f as PlatformDenyCodes, L as LockReason } from './types-C9jPdQqH.js';
+export { B as BusinessVocabulary, C as CatalogPermission, g as FeatureLocks, h as PLATFORMS, i as SITE_TYPES, j as SNAPSHOT_SCHEMA_VERSION, k as SnapshotApp, l as SnapshotAppFeatureRef, n as SnapshotBusiness, o as SnapshotMicrofrontendMobile, q as SnapshotMicrofrontendWeb, p as SnapshotMicrofrontends, r as SnapshotPermission, s as SnapshotPlan, t as SnapshotRoleTemplate, m as VocabularyEntry, u as snapshotFeatureKey } from './types-C9jPdQqH.js';
 
-interface BuMatrixCell {
+interface SiteMatrixCell {
     inPlan: boolean;
     selected: boolean;
     availableIn: string[];
 }
-interface BuMatrixPermission {
+interface SiteMatrixPermission {
     code: string;
     label: string;
-    web: BuMatrixCell | null;
-    mobile: BuMatrixCell | null;
+    dependsOn: string[];
+    web: SiteMatrixCell | null;
+    mobile: SiteMatrixCell | null;
 }
-interface BuMatrixFeature {
+interface SiteMatrixFeature {
     code: string;
     name: string;
     icon: string | null;
+    scope: ScopeType;
+    applicableSiteTypes: SiteType[];
     platforms: PlatformBucket[];
     inPlan: boolean;
     availableIn: string[];
-    permissions: BuMatrixPermission[];
+    permissions: SiteMatrixPermission[];
 }
-interface BuMatrixApp {
+interface SiteMatrixApp {
     code: string;
     name: string;
     icon: string | null;
     unlockedCount: number;
     totalCount: number;
-    features: BuMatrixFeature[];
+    features: SiteMatrixFeature[];
 }
-interface BuMatrix {
+interface SiteMatrix {
     plan: {
         code: string;
         name: string;
     };
-    apps: BuMatrixApp[];
-    locks: BuFeatureLocks;
+    apps: SiteMatrixApp[];
+    locks: SiteFeatureLocks;
 }
-declare function buildBuMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, buLocks: BuFeatureLocks | undefined): BuMatrix;
+declare function buildSiteMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, siteType?: SiteType): SiteMatrix;
+declare function buildPlanMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks?: SiteFeatureLocks): SiteMatrix;
 
-declare function buildBuCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, buLocks: BuFeatureLocks | undefined, bucket: PlatformBucket): FeatureCatalogEntry[];
+declare function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean;
+declare function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined;
+declare function buildSiteCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, bucket: PlatformBucket, siteType?: SiteType, scope?: ScopeType): FeatureCatalogEntry[];
 declare function isPlanMember(entry: PlatformCodes | undefined): boolean;
-declare function isBuLockedOnPlatform(entry: BuFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
-declare function buildBuRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
+declare function isSiteLockedOnPlatform(entry: SiteFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
+declare function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
 
 type RevokedGrants = Record<string, PlatformDenyCodes>;
 interface ComposeRoleGrantsParams {
@@ -52,12 +58,25 @@ interface ComposeRoleGrantsParams {
 }
 declare function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks;
 
+type DependsMap = Map<string, string[]>;
+declare function buildDependsMap(permissions: Array<{
+    code: string;
+    dependsOn?: string[];
+}>): DependsMap;
+declare function prereqClosure(code: string, deps: DependsMap): string[];
+declare function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string>;
+declare function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string>;
+
 type ClientPlatform = 'web' | 'ios' | 'android';
 interface LockedPermission {
     code: string;
     reason: LockReason | null;
     unlockPlans: string[];
 }
+interface PlanUpsell {
+    plan: string;
+    features: string[];
+}
 interface PermissionFeature {
     code: string;
     name: string;
@@ -69,6 +88,7 @@ interface PermissionFeature {
     lockReason: LockReason | null;
     unlockPlans: string[];
     lockedPermissions: LockedPermission[];
+    upsell: PlanUpsell[];
     route: {
         remoteEntry: string;
         exposedModule: string;
@@ -83,9 +103,11 @@ interface ResolveUserFeaturesParams {
     snapshot: VersionSnapshot;
     businessCode: string;
     planCode: string | undefined;
-    buLocks: BuFeatureLocks | undefined;
+    siteLocks: SiteFeatureLocks | undefined;
     roleFeatures: FeatureUnlocks;
     platform: ClientPlatform;
+    siteType?: SiteType;
+    scope?: ScopeType;
 }
 declare function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[];
 declare function pickRouteForPlatform(entry: {
@@ -106,4 +128,4 @@ declare function pickRouteForPlatform(entry: {
     routePrefix: string;
 } | null;
 
-export { BuFeatureLocks, type BuMatrix, type BuMatrixApp, type BuMatrixCell, type BuMatrixFeature, type BuMatrixPermission, type ClientPlatform, type ComposeRoleGrantsParams, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, VersionSnapshot, buildBuCatalog, buildBuMatrix, buildBuRoles, composeRoleGrants, isBuLockedOnPlatform, isPlanMember, pickRouteForPlatform, resolveUserFeatures };
+export { type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, pickRouteForPlatform, prereqClosure, resolveUserFeatures };