@vritti/api-sdk 0.3.5 → 0.3.7

package/dist/catalog-resolver.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/catalog-resolver/permission-deps.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/site-matrix.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts"],"sourcesContent":["// Intra-feature permission prerequisites — only DIRECT edges are declared; the transitive closure is computed by recursion, cycle-guarded\n\nexport type DependsMap = Map<string, string[]>;\n\n// Builds a dependency map from a feature's permissions, keeping only edges to codes present in the set\nexport function buildDependsMap(permissions: Array<{ code: string; dependsOn?: string[] }>): DependsMap {\n  const present = new Set(permissions.map((p) => p.code));\n  const map: DependsMap = new Map();\n  for (const p of permissions) {\n    map.set(\n      p.code,\n      (p.dependsOn ?? []).filter((dep) => dep !== p.code && present.has(dep)),\n    );\n  }\n  return map;\n}\n\n// Transitive prerequisite closure of a code (excludes the code itself), cycle-safe\nexport function prereqClosure(code: string, deps: DependsMap): string[] {\n  const out = new Set<string>();\n  const seen = new Set<string>([code]);\n  const stack = [code];\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    for (const dep of deps.get(current) ?? []) {\n      if (seen.has(dep)) continue;\n      seen.add(dep);\n      out.add(dep);\n      stack.push(dep);\n    }\n  }\n  return [...out];\n}\n\n// Codes locked after cascade: a code is locked if directly locked or any transitive prerequisite is (cycle-safe)\nexport function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string> {\n  const locked = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (locked.has(code)) return true;\n    if (directlyLocked.has(code)) {\n      locked.add(code);\n      return true;\n    }\n    if (visiting.has(code)) return false;\n    visiting.add(code);\n    const viaDep = (deps.get(code) ?? []).some(check);\n    visiting.delete(code);\n    if (viaDep) locked.add(code);\n    return viaDep;\n  };\n  for (const code of codes) check(code);\n  return locked;\n}\n\n// Keeps only codes whose FULL prerequisite closure is also present — drops a dependent missing any prerequisite (cycle-safe)\nexport function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string> {\n  const ok = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (ok.has(code)) return true;\n    if (!granted.has(code)) return false;\n    if (visiting.has(code)) return true;\n    visiting.add(code);\n    const satisfied = (deps.get(code) ?? []).every(check);\n    visiting.delete(code);\n    if (satisfied) ok.add(code);\n    return satisfied;\n  };\n  for (const code of granted) check(code);\n  return ok;\n}\n","// ——— Platform algebra — plan unlocks, role grants, and BU locks are all stored per UI platform bucket ———\n\nexport type PlatformBucket = 'web' | 'mobile';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile'];\n\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n}\n\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n}\n\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\nexport type FeatureLocks = Record<string, PlatformDenyCodes>;\nexport type SiteFeatureLocks = FeatureLocks;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n  dependsOn: string[];\n}\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport type ScopeType = 'ORG' | 'LE' | 'SITE_GROUP' | 'SITE';\nexport type SiteType = 'OUTLET' | 'WAREHOUSE' | 'PRODUCTION';\nexport const SITE_TYPES: SiteType[] = ['OUTLET', 'WAREHOUSE', 'PRODUCTION'];\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n}\nexport interface SnapshotAppFeatureRef {\n  code: string;\n  scope: ScopeType;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: SnapshotAppFeatureRef[];\n}\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  scope: ScopeType;\n  siteType: SiteType;\n  features: FeatureUnlocks;\n}\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxSites: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface VocabularyEntry {\n  singular: string;\n  plural: string;\n}\nexport interface BusinessVocabulary {\n  site?: VocabularyEntry;\n  siteGroup?: VocabularyEntry;\n  outlet?: VocabularyEntry;\n  warehouse?: VocabularyEntry;\n  production?: VocabularyEntry;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  vocabulary?: BusinessVocabulary;\n  apps: SnapshotApp[];\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  schemaVersion?: number;\n  // Flat feature dictionary keyed by `${scope}.${code}` (see snapshotFeatureKey) — same-code features at different scopes stay distinct\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// Composite key for the snapshot feature dictionary — feature identity is (scope, code)\nexport function snapshotFeatureKey(code: string, scope: ScopeType): string {\n  return `${scope}.${code}`;\n}\n\nexport const SNAPSHOT_SCHEMA_VERSION = 2;\n\nexport type LockReason = 'PLAN' | 'SITE';\n\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n}\n\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  permissions: CatalogPermission[];\n}\n\nexport type RoleItem = SnapshotRoleTemplate;\n","import { buildDependsMap, cascadeLocked, prereqClosure } from './permission-deps';\nimport type {\n  ScopeType,\n  SiteType,\n  SiteFeatureLocks,\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  RoleItem,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\n// Whether a feature with the given site-type applicability is exposed at this site type\nexport function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean {\n  return applicableSiteTypes.includes(siteType);\n}\n\n// Scope-agnostic lookup of a feature by bare code — grants/locks key features by code alone, so the first scope-variant's shared metadata (permission graph) answers\nexport function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined {\n  for (const feature of Object.values(snapshot.features ?? {})) {\n    if (feature?.code === code) return feature;\n  }\n  return undefined;\n}\n\n// Builds the per-site catalog for ONE platform bucket — plan is the ceiling, siteLocks is a deny-list within it; each permission carries locked + lockReason + unlockPlans\nexport function buildSiteCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  bucket: PlatformBucket,\n  siteType?: SiteType,\n  scope?: ScopeType,\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  const plan = planCode ? business.plans?.[planCode] : undefined;\n  const plans = business.plans ?? {};\n\n  const catalog: FeatureCatalogEntry[] = [];\n  // Iterate apps alphabetically by name so the resolved feature list (→ core-web sidebar) is app-alphabetical without any frontend re-sort\n  const sortedApps = [...business.apps].sort((a, b) => a.name.localeCompare(b.name));\n  for (const app of sortedApps) {\n    // The app's renderable features (each ref pins scope+code to one app), dropped when they don't belong to this workspace scope or node type (outlet vs container)\n    const businessAppFeatures = app.features\n      .filter((ref) => scope === undefined || ref.scope === scope)\n      .map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)])\n      .filter(\n        (f): f is SnapshotFeature =>\n          !!f &&\n          !!(f.microfrontends?.web || f.microfrontends?.mobile) &&\n          (siteType === undefined || featureAppliesAtNode(f.applicableSiteTypes, siteType)),\n      );\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves as a locked tile instead of vanishing\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions?.[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      const permissions = buildPermissions(feature, businessCode, membership, siteLocks, plans, bucket);\n      // Feature-level lock is EXPLICIT: plan must include the feature on this bucket and the site must not null-lock the platform\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const sitePlatformLocked = siteLocks?.[feature.code]?.[bucket] === null;\n      const locked = !memberOnBucket || sitePlatformLocked;\n      const lockReason: LockReason | null = !memberOnBucket ? 'PLAN' : sitePlatformLocked ? 'SITE' : null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions)\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  return !!entry && (entry.web !== undefined || entry.mobile !== undefined);\n}\n\n// Per-platform site-lock primitive: null locks the whole feature, string[] locks those codes, absent = not locked\nexport function isSiteLockedOnPlatform(\n  entry: SiteFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and site deny-list (bucket-scoped)\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = siteLocks?.[feature.code];\n\n  const perms = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode));\n  const deps = buildDependsMap(perms);\n  const codes = perms.map((p) => p.code);\n\n  // Direct plan/site locks, then cascade so a locked prerequisite (e.g. view) locks its dependents (add/edit/delete)\n  const directlyPlanLocked = new Set<string>();\n  const directlySiteLocked = new Set<string>();\n  for (const p of perms) {\n    if (!planUnlocked.has(p.code)) directlyPlanLocked.add(p.code);\n    if (isSiteLockedOnPlatform(lockEntry, bucket, p.code)) directlySiteLocked.add(p.code);\n  }\n  const directlyLocked = new Set<string>([...directlyPlanLocked, ...directlySiteLocked]);\n  const lockedSet = cascadeLocked(codes, directlyLocked, deps);\n\n  return perms.map((p) => {\n    const locked = lockedSet.has(p.code);\n    // A permission is enabled only if it AND its whole prerequisite closure are unlocked — reason/upsell reflect that\n    const closure = [p.code, ...prereqClosure(p.code, deps)];\n    const planReason = closure.some((c) => directlyPlanLocked.has(c));\n    const siteReason = closure.some((c) => directlySiteLocked.has(c));\n    // Plan is the ceiling, so a plan-lock anywhere in the closure wins over a site-lock when reporting the reason\n    const lockReason: LockReason | null = !locked ? null : planReason ? 'PLAN' : siteReason ? 'SITE' : null;\n    const unlockPlans =\n      locked && lockReason === 'PLAN' ? plansUnlockingClosure(plans, feature.code, closure, bucket) : [];\n    return { code: p.code, locked, lockReason, unlockPlans };\n  });\n}\n\n// Plan codes (in the business) whose unlocked set includes the permission AND its whole prerequisite closure — upsell targets\nfunction plansUnlockingClosure(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  closure: string[],\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlocked = plan.unlockedPermissions?.[featureCode]?.[bucket];\n    if (unlocked && closure.every((c) => unlocked.includes(c))) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates ?? {});\n}\n","import { featureAppliesAtNode, isSiteLockedOnPlatform, isPlanMember } from './catalog.builder';\nimport {\n  type ScopeType,\n  type SiteFeatureLocks,\n  type SiteType,\n  PLATFORMS,\n  type PlatformBucket,\n  type SnapshotPlan,\n  snapshotFeatureKey,\n  type VersionSnapshot,\n} from './types';\n\nexport interface SiteMatrixCell {\n  inPlan: boolean;\n  selected: boolean;\n  availableIn: string[];\n}\n\nexport interface SiteMatrixPermission {\n  code: string;\n  label: string;\n  dependsOn: string[];\n  web: SiteMatrixCell | null;\n  mobile: SiteMatrixCell | null;\n}\n\nexport interface SiteMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  platforms: PlatformBucket[];\n  inPlan: boolean;\n  availableIn: string[];\n  permissions: SiteMatrixPermission[];\n}\n\nexport interface SiteMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  unlockedCount: number;\n  totalCount: number;\n  features: SiteMatrixFeature[];\n}\n\nexport interface SiteMatrix {\n  plan: { code: string; name: string };\n  apps: SiteMatrixApp[];\n  locks: SiteFeatureLocks;\n}\n\n// Builds the SITE-only apps/features/permissions matrix — not filtered to plan members; plan-locked items carry inPlan=false + availableIn\nexport function buildSiteMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  siteType?: SiteType,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, false, siteType);\n}\n\n// Builds the all-scopes apps/features/permissions matrix — every scope's features included, each carrying its real scope; powers the Plan Overview + Create Custom Role picker\nexport function buildPlanMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks?: SiteFeatureLocks,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, true);\n}\n\n// Shared matrix builder — allScopes=false keeps only SITE refs; allScopes=true includes every scope and emits each feature's real scope\nfunction buildMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  allScopes: boolean,\n  siteType?: SiteType,\n): SiteMatrix {\n  const business = businessCode ? snapshot.businesses?.[businessCode] : undefined;\n  const plans = business?.plans ?? {};\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const locks = siteLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: SiteMatrixApp[] = [];\n  for (const app of business.apps) {\n    let unlockedCount = 0;\n    let totalCount = 0;\n    const features: SiteMatrixFeature[] = [];\n\n    for (const ref of app.features) {\n      if (!allScopes && ref.scope !== 'SITE') continue;\n      const code = ref.code;\n      const feature = snapshot.features?.[snapshotFeatureKey(code, ref.scope)];\n      if (!feature) continue;\n      if (siteType !== undefined && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;\n      const platforms = PLATFORMS.filter((p) => !!feature.microfrontends?.[p]);\n      if (platforms.length === 0) continue;\n\n      const membership = plan.unlockedPermissions?.[code];\n      const featureInPlan = isPlanMember(membership);\n      const siteEntry = siteLocks?.[code];\n\n      const permissions: SiteMatrixPermission[] = (feature.permissions ?? [])\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): SiteMatrixCell | null => {\n            if (!platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the site locks it on this platform\n            const selected = inPlan && !isSiteLockedOnPlatform(siteEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            totalCount += 1;\n            if (inPlan) unlockedCount += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return {\n            code: p.code,\n            label: p.label,\n            dependsOn: p.dependsOn ?? [],\n            web: cell('web'),\n            mobile: cell('mobile'),\n          };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        scope: feature.scope,\n        applicableSiteTypes: feature.applicableSiteTypes,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        permissions,\n      });\n    }\n\n    if (features.length === 0) continue;\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, unlockedCount, totalCount, features });\n  }\n\n  // Emit apps alphabetically by name so every consumer (Plan Overview, Role picker, all Locks screens) renders them sorted\n  apps.sort((a, b) => a.name.localeCompare(b.name));\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions?.[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions?.[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10); inputs are never mutated\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions ?? {})]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions?.[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set\n    if (composed.web === undefined && composed.mobile === undefined) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildSiteCatalog, findFeatureByCode } from './catalog.builder';\nimport { buildDependsMap, filterGrantedByDeps } from './permission-deps';\nimport type {\n  SiteFeatureLocks,\n  FeatureUnlocks,\n  LockReason,\n  PlatformBucket,\n  ScopeType,\n  SiteType,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\nexport type ClientPlatform = 'web' | 'ios' | 'android';\n\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n}\n\nexport interface PlanUpsell {\n  plan: string;\n  features: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  lockedPermissions: LockedPermission[];\n  upsell: PlanUpsell[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  siteLocks: SiteFeatureLocks | undefined;\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n  siteType?: SiteType;\n  scope?: ScopeType;\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants, filtered to the requested platform\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, siteLocks, roleFeatures, platform, siteType, scope } = params;\n\n  // Plan unlocks, BU locks, and role grants are stored per platform; resolve only the requesting surface's bucket (web → 'web'; ios/android → 'mobile')\n  const bucket: PlatformBucket = platform === 'web' ? 'web' : 'mobile';\n\n  // Grants/plans/locks key features by bare code; resolve to the workspace scope's variant (or any variant when unscoped)\n  const featureByCode = (code: string) =>\n    scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code);\n\n  // Plan ∧ BU overlay for this bucket, filtered to features that apply to this workspace scope and node type — emits EVERY applicable business feature (plan non-members come out fully locked)\n  const catalog = buildSiteCatalog(snapshot, businessCode, planCode, siteLocks, bucket, siteType, scope);\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Per-plan feature-name delta vs the current plan — feeds the plan-locked upsell screen\n  const businessPlans = snapshot.businesses[businessCode]?.plans ?? {};\n  const currentUnlockedCodes = new Set<string>();\n  if (planCode && businessPlans[planCode]) {\n    for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] !== undefined) currentUnlockedCodes.add(featureCode);\n    }\n  }\n  const planAdds = new Map<string, Array<{ code: string; name: string }>>();\n  for (const [planKey, plan] of Object.entries(businessPlans)) {\n    if (planKey === planCode) continue;\n    const adds: Array<{ code: string; name: string }> = [];\n    for (const [featureCode, platforms] of Object.entries(plan.unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] === undefined || currentUnlockedCodes.has(featureCode)) continue;\n      const name = featureByCode(featureCode)?.name;\n      if (name) adds.push({ code: featureCode, name });\n    }\n    planAdds.set(planKey, adds);\n  }\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures ?? {})) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant?.[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    const route = pickRouteForPlatform(catalogEntry, platform);\n    // Feature isn't published to this platform — omit so client doesn't see an unloadable tile.\n    if (!route) continue;\n\n    // Drop granted permissions whose intra-feature prerequisites aren't also granted (e.g. add needs view)\n    const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [p.code, p]));\n    const grantedPerms = [...filterGrantedByDeps(permsSet, featureDeps)];\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({ code: p.code, reason: p.lockReason ?? null, unlockPlans: p.unlockPlans ?? [] }));\n\n    // For a plan-locked feature, list the extra features each unlocking plan would add (excluding this feature)\n    const upsell: PlanUpsell[] =\n      catalogEntry.locked && catalogEntry.lockReason === 'PLAN'\n        ? (catalogEntry.unlockPlans ?? [])\n            .map((plan) => ({\n              plan,\n              features: (planAdds.get(plan) ?? []).filter((f) => f.code !== code).map((f) => f.name),\n            }))\n            .filter((group) => group.features.length > 0)\n        : [];\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans ?? [],\n      lockedPermissions,\n      upsell,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  // Order app-alphabetically so the core-web sidebar (groups by app) renders apps sorted without any frontend re-sort;\n  // stable sort keeps each app's features in their existing relative order\n  features.sort((a, b) => a.appName.localeCompare(b.appName));\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform, or null when it doesn't publish there\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n"],"mappings":";;;;AAKO,SAASA,gBAAgBC,aAA0D;AACxF,QAAMC,UAAU,IAAIC,IAAIF,YAAYG,IAAI,CAACC,MAAMA,EAAEC,IAAI,CAAA;AACrD,QAAMF,MAAkB,oBAAIG,IAAAA;AAC5B,aAAWF,KAAKJ,aAAa;AAC3BG,QAAII,IACFH,EAAEC,OACDD,EAAEI,aAAa,CAAA,GAAIC,OAAO,CAACC,QAAQA,QAAQN,EAAEC,QAAQJ,QAAQU,IAAID,GAAAA,CAAAA,CAAAA;EAEtE;AACA,SAAOP;AACT;AAVgBJ;AAaT,SAASa,cAAcP,MAAcQ,MAAgB;AAC1D,QAAMC,MAAM,oBAAIZ,IAAAA;AAChB,QAAMa,OAAO,oBAAIb,IAAY;IAACG;GAAK;AACnC,QAAMW,QAAQ;IAACX;;AACf,SAAOW,MAAMC,SAAS,GAAG;AACvB,UAAMC,UAAUF,MAAMG,IAAG;AACzB,eAAWT,OAAOG,KAAKO,IAAIF,OAAAA,KAAY,CAAA,GAAI;AACzC,UAAIH,KAAKJ,IAAID,GAAAA,EAAM;AACnBK,WAAKM,IAAIX,GAAAA;AACTI,UAAIO,IAAIX,GAAAA;AACRM,YAAMM,KAAKZ,GAAAA;IACb;EACF;AACA,SAAO;OAAII;;AACb;AAdgBF;AAiBT,SAASW,cAAcC,OAAiBC,gBAA6BZ,MAAgB;AAC1F,QAAMa,SAAS,oBAAIxB,IAAAA;AACnB,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAIqB,OAAOf,IAAIN,IAAAA,EAAO,QAAO;AAC7B,QAAIoB,eAAed,IAAIN,IAAAA,GAAO;AAC5BqB,aAAOL,IAAIhB,IAAAA;AACX,aAAO;IACT;AACA,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAMwB,UAAUhB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAIyB,KAAKF,KAAAA;AAC3CD,aAASI,OAAO1B,IAAAA;AAChB,QAAIwB,OAAQH,QAAOL,IAAIhB,IAAAA;AACvB,WAAOwB;EACT,GAZc;AAad,aAAWxB,QAAQmB,MAAOI,OAAMvB,IAAAA;AAChC,SAAOqB;AACT;AAlBgBH;AAqBT,SAASS,oBAAoBC,SAAsBpB,MAAgB;AACxE,QAAMqB,KAAK,oBAAIhC,IAAAA;AACf,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAI6B,GAAGvB,IAAIN,IAAAA,EAAO,QAAO;AACzB,QAAI,CAAC4B,QAAQtB,IAAIN,IAAAA,EAAO,QAAO;AAC/B,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAM8B,aAAatB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAI+B,MAAMR,KAAAA;AAC/CD,aAASI,OAAO1B,IAAAA;AAChB,QAAI8B,UAAWD,IAAGb,IAAIhB,IAAAA;AACtB,WAAO8B;EACT,GATc;AAUd,aAAW9B,QAAQ4B,QAASL,OAAMvB,IAAAA;AAClC,SAAO6B;AACT;AAfgBF;;;ACpDT,IAAMK,YAA8B;EAAC;EAAO;;AA+C5C,IAAMC,aAAyB;EAAC;EAAU;EAAa;;AA+DvD,SAASC,mBAAmBC,MAAcC,OAAgB;AAC/D,SAAO,GAAGA,KAAAA,IAASD,IAAAA;AACrB;AAFgBD;AAIT,IAAMG,0BAA0B;;;ACpGhC,SAASC,qBAAqBC,qBAAiCC,UAAkB;AACtF,SAAOD,oBAAoBE,SAASD,QAAAA;AACtC;AAFgBF;AAKT,SAASI,kBAAkBC,UAA2BC,MAAY;AACvE,aAAWC,WAAWC,OAAOC,OAAOJ,SAASK,YAAY,CAAC,CAAA,GAAI;AAC5D,QAAIH,SAASD,SAASA,KAAM,QAAOC;EACrC;AACA,SAAOI;AACT;AALgBP;AAQT,SAASQ,iBACdP,UACAQ,cACAC,UACAC,WACAC,QACAd,UACAe,OAAiB;AAEjB,MAAI,CAACJ,aAAc,QAAO,CAAA;AAC1B,QAAMK,WAAWb,SAASc,aAAaN,YAAAA;AACvC,MAAI,CAACK,SAAU,QAAO,CAAA;AACtB,QAAME,OAAON,WAAWI,SAASG,QAAQP,QAAAA,IAAYH;AACrD,QAAMU,QAAQH,SAASG,SAAS,CAAC;AAEjC,QAAMC,UAAiC,CAAA;AAEvC,QAAMC,aAAa;OAAIL,SAASM;IAAMC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,KAAKC,cAAcF,EAAEC,IAAI,CAAA;AAChF,aAAWE,OAAOP,YAAY;AAE5B,UAAMQ,sBAAsBD,IAAIpB,SAC7BsB,OAAO,CAACC,QAAQhB,UAAUN,UAAasB,IAAIhB,UAAUA,KAAAA,EACrDiB,IAAI,CAACD,QAAQ5B,SAASK,WAAWyB,mBAAmBF,IAAI3B,MAAM2B,IAAIhB,KAAK,CAAA,CAAE,EACzEe,OACC,CAACI,MACC,CAAC,CAACA,KACF,CAAC,EAAEA,EAAEC,gBAAgBC,OAAOF,EAAEC,gBAAgBE,YAC7CrC,aAAaS,UAAaX,qBAAqBoC,EAAEnC,qBAAqBC,QAAAA,EAAQ;AAGrF,QAAI6B,oBAAoBS,WAAW,EAAG;AAGtC,eAAWjC,WAAWwB,qBAAqB;AACzC,YAAMU,aAAarB,MAAMsB,sBAAsBnC,QAAQD,IAAI;AAE3D,YAAMgC,MAAM/B,QAAQ8B,gBAAgBC;AACpC,YAAMC,SAAShC,QAAQ8B,gBAAgBE;AAEvC,YAAMI,cAAcC,iBAAiBrC,SAASM,cAAc4B,YAAY1B,WAAWM,OAAOL,MAAAA;AAE1F,YAAM6B,iBAAiBJ,aAAazB,MAAAA,MAAYL;AAChD,YAAMmC,qBAAqB/B,YAAYR,QAAQD,IAAI,IAAIU,MAAAA,MAAY;AACnE,YAAM+B,SAAS,CAACF,kBAAkBC;AAClC,YAAME,aAAgC,CAACH,iBAAiB,SAASC,qBAAqB,SAAS;AAC/F,YAAMG,cAAcD,eAAe,SAASE,sBAAsB7B,OAAOd,QAAQD,MAAMU,MAAAA,IAAU,CAAA;AAEjGM,cAAQ6B,KAAK;QACX7C,MAAMC,QAAQD;QACdsB,MAAMrB,QAAQqB;QACdwB,YAAY7C,QAAQ6C,cAAc;QAClCC,UAAU9C,QAAQ8C,YAAY;QAC9BC,gBAAgB/C,QAAQ+C,kBAAkB;QAC1ChB,KAAKA,MACD;UACEiB,aAAajB,IAAIiB,eAAe;UAChCC,eAAelB,IAAIkB,iBAAiB;UACpCC,aAAanB,IAAImB,eAAe;QAClC,IACA;QACJlB,QAAQA,SACJ;UACEmB,oBAAoBnB,OAAOmB,sBAAsB;UACjDC,gBAAgBpB,OAAOoB,kBAAkB;UACzCH,eAAejB,OAAOiB,iBAAiB;UACvCC,aAAalB,OAAOkB,eAAe;QACrC,IACA;QACJG,SAAS9B,IAAIxB;QACbuD,SAAS/B,IAAIF;QACbkC,SAAShC,IAAIiC,QAAQ;QACrBC,cAAclC,IAAImC,aAAa;QAC/BlB;QACAC;QACAC;QACAN;MACF,CAAA;IACF;EACF;AACA,SAAOrB;AACT;AAhFgBV;AAmFT,SAASsD,aAAaC,OAAgC;AAC3D,SAAO,CAAC,CAACA,UAAUA,MAAM7B,QAAQ3B,UAAawD,MAAM5B,WAAW5B;AACjE;AAFgBuD;AAKT,SAASE,uBACdD,OACAE,UACA/D,MAAY;AAEZ,QAAMgE,QAAQH,QAAQE,QAAAA;AACtB,SAAOC,UAAU,SAASA,OAAOnE,SAASG,IAAAA,KAAS;AACrD;AAPgB8D;AAUhB,SAASxB,iBACPrC,SACAM,cACA0D,gBACAxD,WACAM,OACAL,QAAsB;AAEtB,QAAMwD,eAAe,IAAIC,IAAIF,iBAAiBvD,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAM0D,YAAY3D,YAAYR,QAAQD,IAAI;AAE1C,QAAMqE,SAASpE,QAAQoC,eAAe,CAAA,GAAIX,OAAO,CAAC4C,MAAMA,EAAEC,YAAYD,EAAEzD,WAAWhB,SAASU,YAAAA,CAAAA;AAC5F,QAAMiE,OAAOC,gBAAgBJ,KAAAA;AAC7B,QAAMK,QAAQL,MAAMzC,IAAI,CAAC0C,MAAMA,EAAEtE,IAAI;AAGrC,QAAM2E,qBAAqB,oBAAIR,IAAAA;AAC/B,QAAMS,qBAAqB,oBAAIT,IAAAA;AAC/B,aAAWG,KAAKD,OAAO;AACrB,QAAI,CAACH,aAAaW,IAAIP,EAAEtE,IAAI,EAAG2E,oBAAmBG,IAAIR,EAAEtE,IAAI;AAC5D,QAAI8D,uBAAuBM,WAAW1D,QAAQ4D,EAAEtE,IAAI,EAAG4E,oBAAmBE,IAAIR,EAAEtE,IAAI;EACtF;AACA,QAAM+E,iBAAiB,oBAAIZ,IAAY;OAAIQ;OAAuBC;GAAmB;AACrF,QAAMI,YAAYC,cAAcP,OAAOK,gBAAgBP,IAAAA;AAEvD,SAAOH,MAAMzC,IAAI,CAAC0C,MAAAA;AAChB,UAAM7B,SAASuC,UAAUH,IAAIP,EAAEtE,IAAI;AAEnC,UAAMkF,UAAU;MAACZ,EAAEtE;SAASmF,cAAcb,EAAEtE,MAAMwE,IAAAA;;AAClD,UAAMY,aAAaF,QAAQG,KAAK,CAACC,MAAMX,mBAAmBE,IAAIS,CAAAA,CAAAA;AAC9D,UAAMC,aAAaL,QAAQG,KAAK,CAACC,MAAMV,mBAAmBC,IAAIS,CAAAA,CAAAA;AAE9D,UAAM5C,aAAgC,CAACD,SAAS,OAAO2C,aAAa,SAASG,aAAa,SAAS;AACnG,UAAM5C,cACJF,UAAUC,eAAe,SAAS8C,sBAAsBzE,OAAOd,QAAQD,MAAMkF,SAASxE,MAAAA,IAAU,CAAA;AAClG,WAAO;MAAEV,MAAMsE,EAAEtE;MAAMyC;MAAQC;MAAYC;IAAY;EACzD,CAAA;AACF;AArCSL;AAwCT,SAASkD,sBACPzE,OACA0E,aACAP,SACAxE,QAAsB;AAEtB,QAAMgF,SAAmB,CAAA;AACzB,aAAW,CAAC1F,MAAMc,IAAAA,KAASZ,OAAOyF,QAAQ5E,KAAAA,GAAQ;AAChD,UAAM6E,WAAW9E,KAAKsB,sBAAsBqD,WAAAA,IAAe/E,MAAAA;AAC3D,QAAIkF,YAAYV,QAAQW,MAAM,CAACP,MAAMM,SAAS/F,SAASyF,CAAAA,CAAAA,EAAKI,QAAO7C,KAAK7C,IAAAA;EAC1E;AACA,SAAO0F;AACT;AAZSF;AAeT,SAAS5C,sBACP7B,OACA0E,aACA/E,QAAsB;AAEtB,QAAMgF,SAAmB,CAAA;AACzB,aAAW,CAAC1F,MAAMc,IAAAA,KAASZ,OAAOyF,QAAQ5E,KAAAA,GAAQ;AAChD,QAAID,KAAKsB,sBAAsBqD,WAAAA,IAAe/E,MAAAA,MAAYL,OAAWqF,QAAO7C,KAAK7C,IAAAA;EACnF;AACA,SAAO0F;AACT;AAVS9C;AAaF,SAASkD,eAAe/F,UAA2BQ,cAAgC;AACxF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMK,WAAWb,SAASc,aAAaN,YAAAA;AACvC,MAAI,CAACK,SAAU,QAAO,CAAA;AACtB,SAAOV,OAAOC,OAAOS,SAASmF,iBAAiB,CAAC,CAAA;AAClD;AALgBD;;;AC/IT,SAASE,gBACdC,UACAC,cACAC,UACAC,WACAC,UAAmB;AAEnB,SAAOC,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,OAAOC,QAAAA;AACzE;AARgBL;AAWT,SAASO,gBACdN,UACAC,cACAC,UACAC,WAA4B;AAE5B,SAAOE,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,IAAA;AAClE;AAPgBG;AAUhB,SAASD,YACPL,UACAC,cACAC,UACAC,WACAI,WACAH,UAAmB;AAEnB,QAAMI,WAAWP,eAAeD,SAASS,aAAaR,YAAAA,IAAgBS;AACtE,QAAMC,QAAQH,UAAUG,SAAS,CAAC;AAClC,QAAMC,OAAOV,WAAWS,MAAMT,QAAAA,IAAYQ;AAC1C,QAAMG,WAAW;IAAEC,MAAMZ,YAAY;IAAIa,MAAMH,MAAMG,QAAQb,YAAY;EAAG;AAC5E,QAAMc,QAAQb,aAAa,CAAC;AAC5B,MAAI,CAACK,YAAY,CAACI,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAwB,CAAA;AAC9B,aAAWC,OAAOV,SAASS,MAAM;AAC/B,QAAIE,gBAAgB;AACpB,QAAIC,aAAa;AACjB,UAAMC,WAAgC,CAAA;AAEtC,eAAWC,OAAOJ,IAAIG,UAAU;AAC9B,UAAI,CAACd,aAAae,IAAIC,UAAU,OAAQ;AACxC,YAAMT,OAAOQ,IAAIR;AACjB,YAAMU,UAAUxB,SAASqB,WAAWI,mBAAmBX,MAAMQ,IAAIC,KAAK,CAAA;AACtE,UAAI,CAACC,QAAS;AACd,UAAIpB,aAAaM,UAAa,CAACgB,qBAAqBF,QAAQG,qBAAqBvB,QAAAA,EAAW;AAC5F,YAAMwB,YAAYC,UAAUC,OAAO,CAACC,MAAM,CAAC,CAACP,QAAQQ,iBAAiBD,CAAAA,CAAE;AACvE,UAAIH,UAAUK,WAAW,EAAG;AAE5B,YAAMC,aAAatB,KAAKuB,sBAAsBrB,IAAAA;AAC9C,YAAMsB,gBAAgBC,aAAaH,UAAAA;AACnC,YAAMI,YAAYnC,YAAYW,IAAAA;AAE9B,YAAMyB,eAAuCf,QAAQe,eAAe,CAAA,GACjET,OAAO,CAACC,MAAMA,EAAES,YAAYT,EAAEtB,WAAWgC,SAASxC,gBAAgB,EAAA,CAAA,EAClEyC,IAAI,CAACX,MAAAA;AACJ,cAAMY,OAAO,wBAACC,SAAAA;AACZ,cAAI,CAAChB,UAAUa,SAASG,IAAAA,EAAO,QAAO;AACtC,gBAAMC,YAAYX,aAAaU,IAAAA;AAC/B,gBAAME,SAASV,iBAAiBS,cAAcnC,UAAamC,UAAUJ,SAASV,EAAEjB,IAAI;AAEpF,gBAAMiC,WAAWD,UAAU,CAACE,uBAAuBV,WAAWM,MAAMb,EAAEjB,IAAI;AAC1E,gBAAMmC,cAAcH,SAAS,CAAA,IAAKI,mBAAmBvC,OAAOG,MAAMiB,EAAEjB,MAAM8B,MAAM1C,QAAAA;AAChFkB,wBAAc;AACd,cAAI0B,OAAQ3B,kBAAiB;AAC7B,iBAAO;YAAE2B;YAAQC;YAAUE;UAAY;QACzC,GAVa;AAWb,eAAO;UACLnC,MAAMiB,EAAEjB;UACRqC,OAAOpB,EAAEoB;UACTC,WAAWrB,EAAEqB,aAAa,CAAA;UAC1BC,KAAKV,KAAK,KAAA;UACVW,QAAQX,KAAK,QAAA;QACf;MACF,CAAA;AAEFtB,eAASkC,KAAK;QACZzC,MAAMU,QAAQV;QACdC,MAAMS,QAAQT;QACdyC,MAAMhC,QAAQiC,cAAc;QAC5BlC,OAAOC,QAAQD;QACfI,qBAAqBH,QAAQG;QAC7BC;QACAkB,QAAQV;QACRa,aAAab,gBAAgB,CAAA,IAAKsB,uBAAsB/C,OAAOG,MAAMZ,QAAAA;QACrEqC;MACF,CAAA;IACF;AAEA,QAAIlB,SAASY,WAAW,EAAG;AAC3BhB,SAAKsC,KAAK;MAAEzC,MAAMI,IAAIJ;MAAMC,MAAMG,IAAIH;MAAMyC,MAAMtC,IAAIsC,QAAQ;MAAMrC;MAAeC;MAAYC;IAAS,CAAA;EAC1G;AAGAJ,OAAK0C,KAAK,CAACC,GAAGC,MAAMD,EAAE7C,KAAK+C,cAAcD,EAAE9C,IAAI,CAAA;AAE/C,SAAO;IAAEH,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AA9ESX;AAiFT,SAAS6C,mBACPvC,OACAoD,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,SAAKnC,EAAEI,sBAAsB4B,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAIxB,SAASuB,QAAAA,EAAWG,OAAMZ,KAAKxB,EAAEhB,IAAI;EACpG;AACA,SAAOoD;AACT;AAbSjB;AAgBT,SAASQ,uBACP/C,OACAoD,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,QAAI7B,aAAaN,EAAEI,sBAAsB4B,WAAAA,CAAY,EAAGI,OAAMZ,KAAKxB,EAAEhB,IAAI;EAC3E;AACA,SAAOoD;AACT;AAXST,OAAAA,wBAAAA;;;ACjKT,SAASY,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAMF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,aAAa,CAAC,CAAA;GAAG;AAElG,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,YAAYM,IAAAA,KAAS,CAAC;AAClC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAGA,QAAIN,SAASQ,QAAQrB,UAAaa,SAASS,WAAWtB,OAAW;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA3BgBL;;;AC4CT,SAASqB,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,WAAWC,cAAcC,UAAUC,UAAUC,MAAK,IAAKR;AAGjG,QAAMS,SAAyBH,aAAa,QAAQ,QAAQ;AAG5D,QAAMI,gBAAgB,wBAACC,SACrBH,QAAQP,SAASW,WAAWC,mBAAmBF,MAAMH,KAAAA,CAAAA,IAAUM,kBAAkBb,UAAUU,IAAAA,GADvE;AAItB,QAAMI,UAAUC,iBAAiBf,UAAUC,cAAcC,UAAUC,WAAWK,QAAQF,UAAUC,KAAAA;AAChG,QAAMS,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAET;IAAMS;GAAE,CAAA;AAGzD,QAAMC,gBAAgBpB,SAASqB,WAAWpB,YAAAA,GAAeqB,SAAS,CAAC;AACnE,QAAMC,uBAAuB,oBAAIC,IAAAA;AACjC,MAAItB,YAAYkB,cAAclB,QAAAA,GAAW;AACvC,eAAW,CAACuB,aAAaC,SAAAA,KAAcC,OAAOC,QAAQR,cAAclB,QAAAA,EAAU2B,uBAAuB,CAAC,CAAA,GAAI;AACxG,UAAIH,YAAYlB,MAAAA,MAAYsB,OAAWP,sBAAqBQ,IAAIN,WAAAA;IAClE;EACF;AACA,QAAMO,WAAW,oBAAIf,IAAAA;AACrB,aAAW,CAACgB,SAASC,IAAAA,KAASP,OAAOC,QAAQR,aAAAA,GAAgB;AAC3D,QAAIa,YAAY/B,SAAU;AAC1B,UAAMiC,OAA8C,CAAA;AACpD,eAAW,CAACV,aAAaC,SAAAA,KAAcC,OAAOC,QAAQM,KAAKL,uBAAuB,CAAC,CAAA,GAAI;AACrF,UAAIH,YAAYlB,MAAAA,MAAYsB,UAAaP,qBAAqBa,IAAIX,WAAAA,EAAc;AAChF,YAAMY,OAAO5B,cAAcgB,WAAAA,GAAcY;AACzC,UAAIA,KAAMF,MAAKG,KAAK;QAAE5B,MAAMe;QAAaY;MAAK,CAAA;IAChD;AACAL,aAASO,IAAIN,SAASE,IAAAA;EACxB;AAGA,QAAMK,kBAAkB,oBAAIvB,IAAAA;AAC5B,aAAW,CAACP,MAAM+B,KAAAA,KAAUd,OAAOC,QAAQxB,gBAAgB,CAAC,CAAA,GAAI;AAE9D,UAAMsC,UAAUD,QAAQjC,MAAAA;AACxB,QAAIkC,YAAYZ,OAAW;AAC3B,QAAI,CAACU,gBAAgBJ,IAAI1B,IAAAA,EAAO8B,iBAAgBD,IAAI7B,MAAM,oBAAIc,IAAAA,CAAAA;AAC9D,eAAWmB,QAAQD,QAASF,iBAAgBI,IAAIlC,IAAAA,GAAOqB,IAAIY,IAAAA;EAC7D;AAGA,QAAMhC,WAAgC,CAAA;AACtC,aAAW,CAACD,MAAMmC,QAAAA,KAAaL,iBAAiB;AAC9C,UAAMM,eAAe9B,WAAW4B,IAAIlC,IAAAA;AACpC,QAAI,CAACoC,aAAc;AAEnB,UAAMC,QAAQC,qBAAqBF,cAAczC,QAAAA;AAEjD,QAAI,CAAC0C,MAAO;AAGZ,UAAME,cAAcC,gBAAgBzC,cAAcC,IAAAA,GAAOyC,eAAe,CAAA,CAAE;AAE1E,UAAMC,aAAa,IAAInC,KAAK6B,aAAaK,eAAe,CAAA,GAAIjC,IAAI,CAACmC,MAAM;MAACA,EAAE3C;MAAM2C;KAAE,CAAA;AAClF,UAAMC,eAAe;SAAIC,oBAAoBV,UAAUI,WAAAA;;AACvD,UAAMO,oBAAwCF,aAC3CpC,IAAI,CAACuC,MAAML,WAAWR,IAAIa,CAAAA,CAAAA,EAC1BC,OAAO,CAACL,MAAkC,CAAC,CAACA,GAAGM,MAAAA,EAC/CzC,IAAI,CAACmC,OAAO;MAAE3C,MAAM2C,EAAE3C;MAAMkD,QAAQP,EAAEQ,cAAc;MAAMC,aAAaT,EAAES,eAAe,CAAA;IAAG,EAAA;AAG9F,UAAMC,SACJjB,aAAaa,UAAUb,aAAae,eAAe,UAC9Cf,aAAagB,eAAe,CAAA,GAC1B5C,IAAI,CAACgB,UAAU;MACdA;MACAvB,WAAWqB,SAASY,IAAIV,IAAAA,KAAS,CAAA,GAAIwB,OAAO,CAACvC,MAAMA,EAAET,SAASA,IAAAA,EAAMQ,IAAI,CAACC,MAAMA,EAAEkB,IAAI;IACvF,EAAA,EACCqB,OAAO,CAACM,UAAUA,MAAMrD,SAASsD,SAAS,CAAA,IAC7C,CAAA;AAENtD,aAAS2B,KAAK;MACZ5B;MACA2B,MAAMS,aAAaT;MACnB6B,YAAYpB,aAAaoB;MACzBC,UAAUrB,aAAaqB;MACvBC,gBAAgBtB,aAAasB;MAC7BjB,aAAaG;MACbK,QAAQb,aAAaa,UAAU;MAC/BE,YAAYf,aAAae,cAAc;MACvCC,aAAahB,aAAagB,eAAe,CAAA;MACzCN;MACAO;MACAhB;MACAsB,SAASvB,aAAauB;MACtBC,SAASxB,aAAawB;MACtBC,SAASzB,aAAayB;MACtBC,cAAc1B,aAAa0B;IAC7B,CAAA;EACF;AAIA7D,WAAS8D,KAAK,CAACC,GAAGC,MAAMD,EAAEJ,QAAQM,cAAcD,EAAEL,OAAO,CAAA;AAEzD,SAAO3D;AACT;AApGgBb;AAuGT,SAASkD,qBACd6B,OAaAxE,UAAwB;AAExB,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAACwE,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLC,aAAa1E,aAAa,QAAQwE,MAAMC,OAAOE,iBAAiBH,MAAMC,OAAOG;MAC7EC,eAAeL,MAAMC,OAAOI;MAC5BC,aAAaN,MAAMC,OAAOK;IAC5B;EACF;AAEA,MAAI,CAACN,MAAMO,IAAK,QAAO;AACvB,SAAO;IACLL,aAAaF,MAAMO,IAAIL;IACvBG,eAAeL,MAAMO,IAAIF;IACzBC,aAAaN,MAAMO,IAAID;EACzB;AACF;AA/BgBnC;","names":["buildDependsMap","permissions","present","Set","map","p","code","Map","set","dependsOn","filter","dep","has","prereqClosure","deps","out","seen","stack","length","current","pop","get","add","push","cascadeLocked","codes","directlyLocked","locked","visiting","check","viaDep","some","delete","filterGrantedByDeps","granted","ok","satisfied","every","PLATFORMS","SITE_TYPES","snapshotFeatureKey","code","scope","SNAPSHOT_SCHEMA_VERSION","featureAppliesAtNode","applicableSiteTypes","siteType","includes","findFeatureByCode","snapshot","code","feature","Object","values","features","undefined","buildSiteCatalog","businessCode","planCode","siteLocks","bucket","scope","business","businesses","plan","plans","catalog","sortedApps","apps","sort","a","b","name","localeCompare","app","businessAppFeatures","filter","ref","map","snapshotFeatureKey","f","microfrontends","web","mobile","length","membership","unlockedPermissions","permissions","buildPermissions","memberOnBucket","sitePlatformLocked","locked","lockReason","unlockPlans","plansIncludingFeature","push","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","entry","isSiteLockedOnPlatform","platform","locks","planMembership","planUnlocked","Set","lockEntry","perms","p","isGlobal","deps","buildDependsMap","codes","directlyPlanLocked","directlySiteLocked","has","add","directlyLocked","lockedSet","cascadeLocked","closure","prereqClosure","planReason","some","c","siteReason","plansUnlockingClosure","featureCode","result","entries","unlocked","every","buildSiteRoles","roleTemplates","buildSiteMatrix","snapshot","businessCode","planCode","siteLocks","siteType","buildMatrix","buildPlanMatrix","allScopes","business","businesses","undefined","plans","plan","planMeta","code","name","locks","apps","app","unlockedCount","totalCount","features","ref","scope","feature","snapshotFeatureKey","featureAppliesAtNode","applicableSiteTypes","platforms","PLATFORMS","filter","p","microfrontends","length","membership","unlockedPermissions","featureInPlan","isPlanMember","siteEntry","permissions","isGlobal","includes","map","cell","plat","planCodes","inPlan","selected","isSiteLockedOnPlatform","availableIn","plansUnlockingPerm","label","dependsOn","web","mobile","push","icon","lucideIcon","plansIncludingFeature","sort","a","b","localeCompare","featureCode","permCode","platform","excludeCode","names","Object","entries","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","web","mobile","resolveUserFeatures","params","snapshot","businessCode","planCode","siteLocks","roleFeatures","platform","siteType","scope","bucket","featureByCode","code","features","snapshotFeatureKey","findFeatureByCode","catalog","buildSiteCatalog","catalogMap","Map","map","f","businessPlans","businesses","plans","currentUnlockedCodes","Set","featureCode","platforms","Object","entries","unlockedPermissions","undefined","add","planAdds","planKey","plan","adds","has","name","push","set","grantedFeatures","grant","granted","perm","get","permsSet","catalogEntry","route","pickRouteForPlatform","featureDeps","buildDependsMap","permissions","permByCode","p","grantedPerms","filterGrantedByDeps","lockedPermissions","c","filter","locked","reason","lockReason","unlockPlans","upsell","group","length","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","sort","a","b","localeCompare","entry","mobile","remoteEntry","remoteEntryIos","remoteEntryAndroid","exposedModule","routePrefix","web"]}
+{"version":3,"sources":["../src/catalog-resolver/permission-deps.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts","../src/catalog-resolver/site-matrix.builder.ts"],"sourcesContent":["// Intra-feature permission prerequisites — only DIRECT edges are declared; the transitive closure is computed by recursion, cycle-guarded\n\nexport type DependsMap = Map<string, string[]>;\n\n// Builds a dependency map from a feature's permissions, keeping only edges to codes present in the set\nexport function buildDependsMap(permissions: Array<{ code: string; dependsOn?: string[] }>): DependsMap {\n  const present = new Set(permissions.map((p) => p.code));\n  const map: DependsMap = new Map();\n  for (const p of permissions) {\n    map.set(\n      p.code,\n      (p.dependsOn ?? []).filter((dep) => dep !== p.code && present.has(dep)),\n    );\n  }\n  return map;\n}\n\n// Transitive prerequisite closure of a code (excludes the code itself), cycle-safe\nexport function prereqClosure(code: string, deps: DependsMap): string[] {\n  const out = new Set<string>();\n  const seen = new Set<string>([code]);\n  const stack = [code];\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    for (const dep of deps.get(current) ?? []) {\n      if (seen.has(dep)) continue;\n      seen.add(dep);\n      out.add(dep);\n      stack.push(dep);\n    }\n  }\n  return [...out];\n}\n\n// Codes locked after cascade: a code is locked if directly locked or any transitive prerequisite is (cycle-safe)\nexport function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string> {\n  const locked = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (locked.has(code)) return true;\n    if (directlyLocked.has(code)) {\n      locked.add(code);\n      return true;\n    }\n    if (visiting.has(code)) return false;\n    visiting.add(code);\n    const viaDep = (deps.get(code) ?? []).some(check);\n    visiting.delete(code);\n    if (viaDep) locked.add(code);\n    return viaDep;\n  };\n  for (const code of codes) check(code);\n  return locked;\n}\n\n// Keeps only codes whose FULL prerequisite closure is also present — drops a dependent missing any prerequisite (cycle-safe)\nexport function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string> {\n  const ok = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (ok.has(code)) return true;\n    if (!granted.has(code)) return false;\n    if (visiting.has(code)) return true;\n    visiting.add(code);\n    const satisfied = (deps.get(code) ?? []).every(check);\n    visiting.delete(code);\n    if (satisfied) ok.add(code);\n    return satisfied;\n  };\n  for (const code of granted) check(code);\n  return ok;\n}\n","// ——— Platform algebra — plan unlocks, role grants, and BU locks are all stored per UI platform bucket ———\n\nexport type PlatformBucket = 'web' | 'mobile';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile'];\n\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n}\n\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n}\n\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\nexport type FeatureLocks = Record<string, PlatformDenyCodes>;\nexport type SiteFeatureLocks = FeatureLocks;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n  dependsOn: string[];\n}\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport type ScopeType = 'ORG' | 'LE' | 'SITE_GROUP' | 'SITE';\nexport type SiteType = 'OUTLET' | 'WAREHOUSE' | 'PRODUCTION';\nexport const SITE_TYPES: SiteType[] = ['OUTLET', 'WAREHOUSE', 'PRODUCTION'];\n// External services a feature can depend on — the org must have the service provisioned before the feature\n// unlocks. Add new services here and nowhere else in this package; every lock path is service-agnostic.\nexport const SERVICE_CODES = ['GITEA'] as const;\nexport type ServiceCode = (typeof SERVICE_CODES)[number];\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n  // Optional: snapshots built before service gating existed carry no services, which reads as \"requires none\"\n  requiredServices?: ServiceCode[];\n}\nexport interface SnapshotAppFeatureRef {\n  code: string;\n  scope: ScopeType;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: SnapshotAppFeatureRef[];\n}\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  scope: ScopeType;\n  siteType: SiteType;\n  features: FeatureUnlocks;\n}\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxSites: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface VocabularyEntry {\n  singular: string;\n  plural: string;\n}\nexport interface BusinessVocabulary {\n  site?: VocabularyEntry;\n  siteGroup?: VocabularyEntry;\n  outlet?: VocabularyEntry;\n  warehouse?: VocabularyEntry;\n  production?: VocabularyEntry;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  vocabulary?: BusinessVocabulary;\n  apps: SnapshotApp[];\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  schemaVersion?: number;\n  // Flat feature dictionary keyed by `${scope}.${code}` (see snapshotFeatureKey) — same-code features at different scopes stay distinct\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// Composite key for the snapshot feature dictionary — feature identity is (scope, code)\nexport function snapshotFeatureKey(code: string, scope: ScopeType): string {\n  return `${scope}.${code}`;\n}\n\nexport const SNAPSHOT_SCHEMA_VERSION = 2;\n\n// SERVICE = the org has not provisioned an external service the feature declares; the specific services are\n// reported alongside in `missingServices` so callers never branch on a service code baked into this union\nexport type LockReason = 'PLAN' | 'SITE' | 'SERVICE';\n\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n  permissions: CatalogPermission[];\n}\n\nexport type RoleItem = SnapshotRoleTemplate;\n","import { buildDependsMap, cascadeLocked, prereqClosure } from './permission-deps';\nimport type {\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  RoleItem,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\n// Whether a feature with the given site-type applicability is exposed at this site type\nexport function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean {\n  return applicableSiteTypes.includes(siteType);\n}\n\n// Scope-agnostic lookup of a feature by bare code — grants/locks key features by code alone, so the first scope-variant's shared metadata (permission graph) answers\nexport function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined {\n  for (const feature of Object.values(snapshot.features ?? {})) {\n    if (feature?.code === code) return feature;\n  }\n  return undefined;\n}\n\n// Builds the per-site catalog for ONE platform bucket — plan is the ceiling, siteLocks is a deny-list within it; each permission carries locked + lockReason + unlockPlans\n// availableServices defaults to none, so a caller that doesn't know the org's provisioned services locks every service-dependent feature rather than leaking it\nexport function buildSiteCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  bucket: PlatformBucket,\n  siteType?: SiteType,\n  scope?: ScopeType,\n  availableServices: ServiceCode[] = [],\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  const plan = planCode ? business.plans?.[planCode] : undefined;\n  const plans = business.plans ?? {};\n\n  const catalog: FeatureCatalogEntry[] = [];\n  // Iterate apps alphabetically by name so the resolved feature list (→ core-web sidebar) is app-alphabetical without any frontend re-sort\n  const sortedApps = [...business.apps].sort((a, b) => a.name.localeCompare(b.name));\n  for (const app of sortedApps) {\n    // The app's renderable features (each ref pins scope+code to one app), dropped when they don't belong to this workspace scope or node type (outlet vs container)\n    const businessAppFeatures = app.features\n      .filter((ref) => scope === undefined || ref.scope === scope)\n      .map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)])\n      .filter(\n        (f): f is SnapshotFeature =>\n          !!f &&\n          !!(f.microfrontends?.web || f.microfrontends?.mobile) &&\n          (siteType === undefined || featureAppliesAtNode(f.applicableSiteTypes, siteType)),\n      );\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves as a locked tile instead of vanishing\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions?.[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      // Feature-level lock is EXPLICIT: plan must include the feature on this bucket, the site must not null-lock\n      // the platform, and every external service the feature declares must be provisioned for the org\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const sitePlatformLocked = siteLocks?.[feature.code]?.[bucket] === null;\n      const missingServices = unmetServices(feature, availableServices);\n      // Unmet services lock every permission too — otherwise the feature reads locked while its actions still\n      // report as available, which is not how plan and site locks behave\n      const permissions = buildPermissions(\n        feature,\n        businessCode,\n        membership,\n        siteLocks,\n        plans,\n        bucket,\n        missingServices,\n      );\n      const lockReason = resolveLockReason(!memberOnBucket, sitePlatformLocked, missingServices);\n      const locked = lockReason !== null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        missingServices,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions)\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  return !!entry && (entry.web !== undefined || entry.mobile !== undefined);\n}\n\n// The one place lock precedence is decided, for features and permissions alike; null means nothing locks.\n// Plan is the ceiling (an unentitled feature must upsell, not send the user to provision something they still\n// couldn't use), then the site deny-list, then any unprovisioned service.\nfunction resolveLockReason(\n  planLocked: boolean,\n  siteLocked: boolean,\n  missingServices: ServiceCode[],\n): LockReason | null {\n  if (planLocked) return 'PLAN';\n  if (siteLocked) return 'SITE';\n  if (missingServices.length > 0) return 'SERVICE';\n  return null;\n}\n\n// The services a feature declares that this org has not provisioned\nfunction unmetServices(feature: SnapshotFeature, availableServices: ServiceCode[]): ServiceCode[] {\n  return (feature.requiredServices ?? []).filter((service) => !availableServices.includes(service));\n}\n\n// Per-platform site-lock primitive: null locks the whole feature, string[] locks those codes, absent = not locked\nexport function isSiteLockedOnPlatform(\n  entry: SiteFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and site deny-list\n// (bucket-scoped). Unmet services lock the whole set — an unprovisioned service blocks every action on the feature.\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n  missingServices: ServiceCode[] = [],\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = siteLocks?.[feature.code];\n\n  const perms = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode));\n  const deps = buildDependsMap(perms);\n  const codes = perms.map((p) => p.code);\n\n  // Direct plan/site locks, then cascade so a locked prerequisite (e.g. view) locks its dependents (add/edit/delete)\n  const directlyPlanLocked = new Set<string>();\n  const directlySiteLocked = new Set<string>();\n  for (const p of perms) {\n    if (!planUnlocked.has(p.code)) directlyPlanLocked.add(p.code);\n    if (isSiteLockedOnPlatform(lockEntry, bucket, p.code)) directlySiteLocked.add(p.code);\n  }\n  const directlyLocked = new Set<string>([...directlyPlanLocked, ...directlySiteLocked]);\n  const lockedSet = cascadeLocked(codes, directlyLocked, deps);\n\n  return perms.map((p) => {\n    // A permission is enabled only if it AND its whole prerequisite closure are unlocked — reason/upsell reflect that\n    const closure = [p.code, ...prereqClosure(p.code, deps)];\n    const cascaded = lockedSet.has(p.code);\n    const planReason = cascaded && closure.some((c) => directlyPlanLocked.has(c));\n    const siteReason = cascaded && closure.some((c) => directlySiteLocked.has(c));\n    const lockReason = resolveLockReason(planReason, siteReason, missingServices);\n    const locked = lockReason !== null;\n    const unlockPlans = lockReason === 'PLAN' ? plansUnlockingClosure(plans, feature.code, closure, bucket) : [];\n    return { code: p.code, locked, lockReason, unlockPlans, missingServices };\n  });\n}\n\n// Plan codes (in the business) whose unlocked set includes the permission AND its whole prerequisite closure — upsell targets\nfunction plansUnlockingClosure(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  closure: string[],\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlocked = plan.unlockedPermissions?.[featureCode]?.[bucket];\n    if (unlocked && closure.every((c) => unlocked.includes(c))) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates ?? {});\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10); inputs are never mutated\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions ?? {})]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions?.[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set\n    if (composed.web === undefined && composed.mobile === undefined) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildSiteCatalog, findFeatureByCode } from './catalog.builder';\nimport { buildDependsMap, filterGrantedByDeps } from './permission-deps';\nimport type {\n  FeatureUnlocks,\n  LockReason,\n  PlatformBucket,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  VersionSnapshot,\n} from './types';\nimport { snapshotFeatureKey } from './types';\n\nexport type ClientPlatform = 'web' | 'ios' | 'android';\n\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface PlanUpsell {\n  plan: string;\n  features: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  // Which declared services the org has not provisioned — empty unless lockReason is 'SERVICE'\n  missingServices: ServiceCode[];\n  lockedPermissions: LockedPermission[];\n  upsell: PlanUpsell[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  siteLocks: SiteFeatureLocks | undefined;\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n  siteType?: SiteType;\n  scope?: ScopeType;\n  // External services the org has provisioned; omitting it locks every service-dependent feature\n  availableServices?: ServiceCode[];\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants, filtered to the requested platform\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, siteLocks, roleFeatures, platform, siteType, scope, availableServices } =\n    params;\n\n  // Plan unlocks, BU locks, and role grants are stored per platform; resolve only the requesting surface's bucket (web → 'web'; ios/android → 'mobile')\n  const bucket: PlatformBucket = platform === 'web' ? 'web' : 'mobile';\n\n  // Grants/plans/locks key features by bare code; resolve to the workspace scope's variant (or any variant when unscoped)\n  const featureByCode = (code: string) =>\n    scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code);\n\n  // Plan ∧ BU overlay for this bucket, filtered to features that apply to this workspace scope and node type — emits EVERY applicable business feature (plan non-members come out fully locked)\n  const catalog = buildSiteCatalog(\n    snapshot,\n    businessCode,\n    planCode,\n    siteLocks,\n    bucket,\n    siteType,\n    scope,\n    availableServices,\n  );\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Per-plan feature-name delta vs the current plan — feeds the plan-locked upsell screen\n  const businessPlans = snapshot.businesses[businessCode]?.plans ?? {};\n  const currentUnlockedCodes = new Set<string>();\n  if (planCode && businessPlans[planCode]) {\n    for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] !== undefined) currentUnlockedCodes.add(featureCode);\n    }\n  }\n  const planAdds = new Map<string, Array<{ code: string; name: string }>>();\n  for (const [planKey, plan] of Object.entries(businessPlans)) {\n    if (planKey === planCode) continue;\n    const adds: Array<{ code: string; name: string }> = [];\n    for (const [featureCode, platforms] of Object.entries(plan.unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] === undefined || currentUnlockedCodes.has(featureCode)) continue;\n      const name = featureByCode(featureCode)?.name;\n      if (name) adds.push({ code: featureCode, name });\n    }\n    planAdds.set(planKey, adds);\n  }\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures ?? {})) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant?.[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    const route = pickRouteForPlatform(catalogEntry, platform);\n    // Feature isn't published to this platform — omit so client doesn't see an unloadable tile.\n    if (!route) continue;\n\n    // Drop granted permissions whose intra-feature prerequisites aren't also granted (e.g. add needs view)\n    const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [p.code, p]));\n    const grantedPerms = [...filterGrantedByDeps(permsSet, featureDeps)];\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({\n        code: p.code,\n        reason: p.lockReason ?? null,\n        unlockPlans: p.unlockPlans ?? [],\n        missingServices: p.missingServices ?? [],\n      }));\n\n    // For a plan-locked feature, list the extra features each unlocking plan would add (excluding this feature)\n    const upsell: PlanUpsell[] =\n      catalogEntry.locked && catalogEntry.lockReason === 'PLAN'\n        ? (catalogEntry.unlockPlans ?? [])\n            .map((plan) => ({\n              plan,\n              features: (planAdds.get(plan) ?? []).filter((f) => f.code !== code).map((f) => f.name),\n            }))\n            .filter((group) => group.features.length > 0)\n        : [];\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans ?? [],\n      missingServices: catalogEntry.missingServices ?? [],\n      lockedPermissions,\n      upsell,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  // Order app-alphabetically so the core-web sidebar (groups by app) renders apps sorted without any frontend re-sort;\n  // stable sort keeps each app's features in their existing relative order\n  features.sort((a, b) => a.appName.localeCompare(b.appName));\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform, or null when it doesn't publish there\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n","import { featureAppliesAtNode, isPlanMember, isSiteLockedOnPlatform } from './catalog.builder';\nimport {\n  PLATFORMS,\n  type PlatformBucket,\n  type ScopeType,\n  type SiteFeatureLocks,\n  type SiteType,\n  type SnapshotPlan,\n  snapshotFeatureKey,\n  type VersionSnapshot,\n} from './types';\n\nexport interface SiteMatrixCell {\n  inPlan: boolean;\n  selected: boolean;\n  availableIn: string[];\n}\n\nexport interface SiteMatrixPermission {\n  code: string;\n  label: string;\n  dependsOn: string[];\n  web: SiteMatrixCell | null;\n  mobile: SiteMatrixCell | null;\n}\n\nexport interface SiteMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  platforms: PlatformBucket[];\n  inPlan: boolean;\n  availableIn: string[];\n  permissions: SiteMatrixPermission[];\n}\n\nexport interface SiteMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  unlockedCount: number;\n  totalCount: number;\n  features: SiteMatrixFeature[];\n}\n\nexport interface SiteMatrix {\n  plan: { code: string; name: string };\n  apps: SiteMatrixApp[];\n  locks: SiteFeatureLocks;\n}\n\n// Builds the SITE-only apps/features/permissions matrix — not filtered to plan members; plan-locked items carry inPlan=false + availableIn\nexport function buildSiteMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  siteType?: SiteType,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, false, siteType);\n}\n\n// Builds the all-scopes apps/features/permissions matrix — every scope's features included, each carrying its real scope; powers the Plan Overview + Create Custom Role picker\nexport function buildPlanMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks?: SiteFeatureLocks,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, true);\n}\n\n// Shared matrix builder — allScopes=false keeps only SITE refs; allScopes=true includes every scope and emits each feature's real scope\nfunction buildMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  allScopes: boolean,\n  siteType?: SiteType,\n): SiteMatrix {\n  const business = businessCode ? snapshot.businesses?.[businessCode] : undefined;\n  const plans = business?.plans ?? {};\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const locks = siteLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: SiteMatrixApp[] = [];\n  for (const app of business.apps) {\n    let unlockedCount = 0;\n    let totalCount = 0;\n    const features: SiteMatrixFeature[] = [];\n\n    for (const ref of app.features) {\n      if (!allScopes && ref.scope !== 'SITE') continue;\n      const code = ref.code;\n      const feature = snapshot.features?.[snapshotFeatureKey(code, ref.scope)];\n      if (!feature) continue;\n      if (siteType !== undefined && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;\n      const platforms = PLATFORMS.filter((p) => !!feature.microfrontends?.[p]);\n      if (platforms.length === 0) continue;\n\n      const membership = plan.unlockedPermissions?.[code];\n      const featureInPlan = isPlanMember(membership);\n      const siteEntry = siteLocks?.[code];\n\n      const permissions: SiteMatrixPermission[] = (feature.permissions ?? [])\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): SiteMatrixCell | null => {\n            if (!platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the site locks it on this platform\n            const selected = inPlan && !isSiteLockedOnPlatform(siteEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            totalCount += 1;\n            if (inPlan) unlockedCount += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return {\n            code: p.code,\n            label: p.label,\n            dependsOn: p.dependsOn ?? [],\n            web: cell('web'),\n            mobile: cell('mobile'),\n          };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        scope: feature.scope,\n        applicableSiteTypes: feature.applicableSiteTypes,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        permissions,\n      });\n    }\n\n    if (features.length === 0) continue;\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, unlockedCount, totalCount, features });\n  }\n\n  // Emit apps alphabetically by name so every consumer (Plan Overview, Role picker, all Locks screens) renders them sorted\n  apps.sort((a, b) => a.name.localeCompare(b.name));\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions?.[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions?.[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n"],"mappings":";;;;AAKO,SAASA,gBAAgBC,aAA0D;AACxF,QAAMC,UAAU,IAAIC,IAAIF,YAAYG,IAAI,CAACC,MAAMA,EAAEC,IAAI,CAAA;AACrD,QAAMF,MAAkB,oBAAIG,IAAAA;AAC5B,aAAWF,KAAKJ,aAAa;AAC3BG,QAAII,IACFH,EAAEC,OACDD,EAAEI,aAAa,CAAA,GAAIC,OAAO,CAACC,QAAQA,QAAQN,EAAEC,QAAQJ,QAAQU,IAAID,GAAAA,CAAAA,CAAAA;EAEtE;AACA,SAAOP;AACT;AAVgBJ;AAaT,SAASa,cAAcP,MAAcQ,MAAgB;AAC1D,QAAMC,MAAM,oBAAIZ,IAAAA;AAChB,QAAMa,OAAO,oBAAIb,IAAY;IAACG;GAAK;AACnC,QAAMW,QAAQ;IAACX;;AACf,SAAOW,MAAMC,SAAS,GAAG;AACvB,UAAMC,UAAUF,MAAMG,IAAG;AACzB,eAAWT,OAAOG,KAAKO,IAAIF,OAAAA,KAAY,CAAA,GAAI;AACzC,UAAIH,KAAKJ,IAAID,GAAAA,EAAM;AACnBK,WAAKM,IAAIX,GAAAA;AACTI,UAAIO,IAAIX,GAAAA;AACRM,YAAMM,KAAKZ,GAAAA;IACb;EACF;AACA,SAAO;OAAII;;AACb;AAdgBF;AAiBT,SAASW,cAAcC,OAAiBC,gBAA6BZ,MAAgB;AAC1F,QAAMa,SAAS,oBAAIxB,IAAAA;AACnB,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAIqB,OAAOf,IAAIN,IAAAA,EAAO,QAAO;AAC7B,QAAIoB,eAAed,IAAIN,IAAAA,GAAO;AAC5BqB,aAAOL,IAAIhB,IAAAA;AACX,aAAO;IACT;AACA,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAMwB,UAAUhB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAIyB,KAAKF,KAAAA;AAC3CD,aAASI,OAAO1B,IAAAA;AAChB,QAAIwB,OAAQH,QAAOL,IAAIhB,IAAAA;AACvB,WAAOwB;EACT,GAZc;AAad,aAAWxB,QAAQmB,MAAOI,OAAMvB,IAAAA;AAChC,SAAOqB;AACT;AAlBgBH;AAqBT,SAASS,oBAAoBC,SAAsBpB,MAAgB;AACxE,QAAMqB,KAAK,oBAAIhC,IAAAA;AACf,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAI6B,GAAGvB,IAAIN,IAAAA,EAAO,QAAO;AACzB,QAAI,CAAC4B,QAAQtB,IAAIN,IAAAA,EAAO,QAAO;AAC/B,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAM8B,aAAatB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAI+B,MAAMR,KAAAA;AAC/CD,aAASI,OAAO1B,IAAAA;AAChB,QAAI8B,UAAWD,IAAGb,IAAIhB,IAAAA;AACtB,WAAO8B;EACT,GATc;AAUd,aAAW9B,QAAQ4B,QAASL,OAAMvB,IAAAA;AAClC,SAAO6B;AACT;AAfgBF;;;ACpDT,IAAMK,YAA8B;EAAC;EAAO;;AA+C5C,IAAMC,aAAyB;EAAC;EAAU;EAAa;;AAGvD,IAAMC,gBAAgB;EAAC;;AAkEvB,SAASC,mBAAmBC,MAAcC,OAAgB;AAC/D,SAAO,GAAGA,KAAAA,IAASD,IAAAA;AACrB;AAFgBD;AAIT,IAAMG,0BAA0B;;;ACzGhC,SAASC,qBAAqBC,qBAAiCC,UAAkB;AACtF,SAAOD,oBAAoBE,SAASD,QAAAA;AACtC;AAFgBF;AAKT,SAASI,kBAAkBC,UAA2BC,MAAY;AACvE,aAAWC,WAAWC,OAAOC,OAAOJ,SAASK,YAAY,CAAC,CAAA,GAAI;AAC5D,QAAIH,SAASD,SAASA,KAAM,QAAOC;EACrC;AACA,SAAOI;AACT;AALgBP;AAST,SAASQ,iBACdP,UACAQ,cACAC,UACAC,WACAC,QACAd,UACAe,OACAC,oBAAmC,CAAA,GAAE;AAErC,MAAI,CAACL,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWd,SAASe,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,QAAME,OAAOP,WAAWK,SAASG,QAAQR,QAAAA,IAAYH;AACrD,QAAMW,QAAQH,SAASG,SAAS,CAAC;AAEjC,QAAMC,UAAiC,CAAA;AAEvC,QAAMC,aAAa;OAAIL,SAASM;IAAMC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,KAAKC,cAAcF,EAAEC,IAAI,CAAA;AAChF,aAAWE,OAAOP,YAAY;AAE5B,UAAMQ,sBAAsBD,IAAIrB,SAC7BuB,OAAO,CAACC,QAAQjB,UAAUN,UAAauB,IAAIjB,UAAUA,KAAAA,EACrDkB,IAAI,CAACD,QAAQ7B,SAASK,WAAW0B,mBAAmBF,IAAI5B,MAAM4B,IAAIjB,KAAK,CAAA,CAAE,EACzEgB,OACC,CAACI,MACC,CAAC,CAACA,KACF,CAAC,EAAEA,EAAEC,gBAAgBC,OAAOF,EAAEC,gBAAgBE,YAC7CtC,aAAaS,UAAaX,qBAAqBqC,EAAEpC,qBAAqBC,QAAAA,EAAQ;AAGrF,QAAI8B,oBAAoBS,WAAW,EAAG;AAGtC,eAAWlC,WAAWyB,qBAAqB;AACzC,YAAMU,aAAarB,MAAMsB,sBAAsBpC,QAAQD,IAAI;AAE3D,YAAMiC,MAAMhC,QAAQ+B,gBAAgBC;AACpC,YAAMC,SAASjC,QAAQ+B,gBAAgBE;AAIvC,YAAMI,iBAAiBF,aAAa1B,MAAAA,MAAYL;AAChD,YAAMkC,qBAAqB9B,YAAYR,QAAQD,IAAI,IAAIU,MAAAA,MAAY;AACnE,YAAM8B,kBAAkBC,cAAcxC,SAASW,iBAAAA;AAG/C,YAAM8B,cAAcC,iBAClB1C,SACAM,cACA6B,YACA3B,WACAO,OACAN,QACA8B,eAAAA;AAEF,YAAMI,aAAaC,kBAAkB,CAACP,gBAAgBC,oBAAoBC,eAAAA;AAC1E,YAAMM,SAASF,eAAe;AAC9B,YAAMG,cAAcH,eAAe,SAASI,sBAAsBhC,OAAOf,QAAQD,MAAMU,MAAAA,IAAU,CAAA;AAEjGO,cAAQgC,KAAK;QACXjD,MAAMC,QAAQD;QACduB,MAAMtB,QAAQsB;QACd2B,YAAYjD,QAAQiD,cAAc;QAClCC,UAAUlD,QAAQkD,YAAY;QAC9BC,gBAAgBnD,QAAQmD,kBAAkB;QAC1CnB,KAAKA,MACD;UACEoB,aAAapB,IAAIoB,eAAe;UAChCC,eAAerB,IAAIqB,iBAAiB;UACpCC,aAAatB,IAAIsB,eAAe;QAClC,IACA;QACJrB,QAAQA,SACJ;UACEsB,oBAAoBtB,OAAOsB,sBAAsB;UACjDC,gBAAgBvB,OAAOuB,kBAAkB;UACzCH,eAAepB,OAAOoB,iBAAiB;UACvCC,aAAarB,OAAOqB,eAAe;QACrC,IACA;QACJG,SAASjC,IAAIzB;QACb2D,SAASlC,IAAIF;QACbqC,SAASnC,IAAIoC,QAAQ;QACrBC,cAAcrC,IAAIsC,aAAa;QAC/BjB;QACAF;QACAG;QACAP;QACAE;MACF,CAAA;IACF;EACF;AACA,SAAOzB;AACT;AA9FgBX;AAiGT,SAAS0D,aAAaC,OAAgC;AAC3D,SAAO,CAAC,CAACA,UAAUA,MAAMhC,QAAQ5B,UAAa4D,MAAM/B,WAAW7B;AACjE;AAFgB2D;AAOhB,SAASnB,kBACPqB,YACAC,YACA3B,iBAA8B;AAE9B,MAAI0B,WAAY,QAAO;AACvB,MAAIC,WAAY,QAAO;AACvB,MAAI3B,gBAAgBL,SAAS,EAAG,QAAO;AACvC,SAAO;AACT;AATSU;AAYT,SAASJ,cAAcxC,SAA0BW,mBAAgC;AAC/E,UAAQX,QAAQmE,oBAAoB,CAAA,GAAIzC,OAAO,CAAC0C,YAAY,CAACzD,kBAAkBf,SAASwE,OAAAA,CAAAA;AAC1F;AAFS5B;AAKF,SAAS6B,uBACdL,OACAM,UACAvE,MAAY;AAEZ,QAAMwE,QAAQP,QAAQM,QAAAA;AACtB,SAAOC,UAAU,SAASA,OAAO3E,SAASG,IAAAA,KAAS;AACrD;AAPgBsE;AAWhB,SAAS3B,iBACP1C,SACAM,cACAkE,gBACAhE,WACAO,OACAN,QACA8B,kBAAiC,CAAA,GAAE;AAEnC,QAAMkC,eAAe,IAAIC,IAAIF,iBAAiB/D,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAMkE,YAAYnE,YAAYR,QAAQD,IAAI;AAE1C,QAAM6E,SAAS5E,QAAQyC,eAAe,CAAA,GAAIf,OAAO,CAACmD,MAAMA,EAAEC,YAAYD,EAAEhE,WAAWjB,SAASU,YAAAA,CAAAA;AAC5F,QAAMyE,OAAOC,gBAAgBJ,KAAAA;AAC7B,QAAMK,QAAQL,MAAMhD,IAAI,CAACiD,MAAMA,EAAE9E,IAAI;AAGrC,QAAMmF,qBAAqB,oBAAIR,IAAAA;AAC/B,QAAMS,qBAAqB,oBAAIT,IAAAA;AAC/B,aAAWG,KAAKD,OAAO;AACrB,QAAI,CAACH,aAAaW,IAAIP,EAAE9E,IAAI,EAAGmF,oBAAmBG,IAAIR,EAAE9E,IAAI;AAC5D,QAAIsE,uBAAuBM,WAAWlE,QAAQoE,EAAE9E,IAAI,EAAGoF,oBAAmBE,IAAIR,EAAE9E,IAAI;EACtF;AACA,QAAMuF,iBAAiB,oBAAIZ,IAAY;OAAIQ;OAAuBC;GAAmB;AACrF,QAAMI,YAAYC,cAAcP,OAAOK,gBAAgBP,IAAAA;AAEvD,SAAOH,MAAMhD,IAAI,CAACiD,MAAAA;AAEhB,UAAMY,UAAU;MAACZ,EAAE9E;SAAS2F,cAAcb,EAAE9E,MAAMgF,IAAAA;;AAClD,UAAMY,WAAWJ,UAAUH,IAAIP,EAAE9E,IAAI;AACrC,UAAM6F,aAAaD,YAAYF,QAAQI,KAAK,CAACC,MAAMZ,mBAAmBE,IAAIU,CAAAA,CAAAA;AAC1E,UAAMC,aAAaJ,YAAYF,QAAQI,KAAK,CAACC,MAAMX,mBAAmBC,IAAIU,CAAAA,CAAAA;AAC1E,UAAMnD,aAAaC,kBAAkBgD,YAAYG,YAAYxD,eAAAA;AAC7D,UAAMM,SAASF,eAAe;AAC9B,UAAMG,cAAcH,eAAe,SAASqD,sBAAsBjF,OAAOf,QAAQD,MAAM0F,SAAShF,MAAAA,IAAU,CAAA;AAC1G,WAAO;MAAEV,MAAM8E,EAAE9E;MAAM8C;MAAQF;MAAYG;MAAaP;IAAgB;EAC1E,CAAA;AACF;AArCSG;AAwCT,SAASsD,sBACPjF,OACAkF,aACAR,SACAhF,QAAsB;AAEtB,QAAMyF,SAAmB,CAAA;AACzB,aAAW,CAACnG,MAAMe,IAAAA,KAASb,OAAOkG,QAAQpF,KAAAA,GAAQ;AAChD,UAAMqF,WAAWtF,KAAKsB,sBAAsB6D,WAAAA,IAAexF,MAAAA;AAC3D,QAAI2F,YAAYX,QAAQY,MAAM,CAACP,MAAMM,SAASxG,SAASkG,CAAAA,CAAAA,EAAKI,QAAOlD,KAAKjD,IAAAA;EAC1E;AACA,SAAOmG;AACT;AAZSF;AAeT,SAASjD,sBACPhC,OACAkF,aACAxF,QAAsB;AAEtB,QAAMyF,SAAmB,CAAA;AACzB,aAAW,CAACnG,MAAMe,IAAAA,KAASb,OAAOkG,QAAQpF,KAAAA,GAAQ;AAChD,QAAID,KAAKsB,sBAAsB6D,WAAAA,IAAexF,MAAAA,MAAYL,OAAW8F,QAAOlD,KAAKjD,IAAAA;EACnF;AACA,SAAOmG;AACT;AAVSnD;AAaF,SAASuD,eAAexG,UAA2BQ,cAAgC;AACxF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWd,SAASe,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,SAAOX,OAAOC,OAAOU,SAAS2F,iBAAiB,CAAC,CAAA;AAClD;AALgBD;;;AC9NhB,SAASE,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAMF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,aAAa,CAAC,CAAA;GAAG;AAElG,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,YAAYM,IAAAA,KAAS,CAAC;AAClC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAGA,QAAIN,SAASQ,QAAQrB,UAAaa,SAASS,WAAWtB,OAAW;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA3BgBL;;;ACkDT,SAASqB,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,WAAWC,cAAcC,UAAUC,UAAUC,OAAOC,kBAAiB,IAC7GT;AAGF,QAAMU,SAAyBJ,aAAa,QAAQ,QAAQ;AAG5D,QAAMK,gBAAgB,wBAACC,SACrBJ,QAAQP,SAASY,WAAWC,mBAAmBF,MAAMJ,KAAAA,CAAAA,IAAUO,kBAAkBd,UAAUW,IAAAA,GADvE;AAItB,QAAMI,UAAUC,iBACdhB,UACAC,cACAC,UACAC,WACAM,QACAH,UACAC,OACAC,iBAAAA;AAEF,QAAMS,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAET;IAAMS;GAAE,CAAA;AAGzD,QAAMC,gBAAgBrB,SAASsB,WAAWrB,YAAAA,GAAesB,SAAS,CAAC;AACnE,QAAMC,uBAAuB,oBAAIC,IAAAA;AACjC,MAAIvB,YAAYmB,cAAcnB,QAAAA,GAAW;AACvC,eAAW,CAACwB,aAAaC,SAAAA,KAAcC,OAAOC,QAAQR,cAAcnB,QAAAA,EAAU4B,uBAAuB,CAAC,CAAA,GAAI;AACxG,UAAIH,YAAYlB,MAAAA,MAAYsB,OAAWP,sBAAqBQ,IAAIN,WAAAA;IAClE;EACF;AACA,QAAMO,WAAW,oBAAIf,IAAAA;AACrB,aAAW,CAACgB,SAASC,IAAAA,KAASP,OAAOC,QAAQR,aAAAA,GAAgB;AAC3D,QAAIa,YAAYhC,SAAU;AAC1B,UAAMkC,OAA8C,CAAA;AACpD,eAAW,CAACV,aAAaC,SAAAA,KAAcC,OAAOC,QAAQM,KAAKL,uBAAuB,CAAC,CAAA,GAAI;AACrF,UAAIH,YAAYlB,MAAAA,MAAYsB,UAAaP,qBAAqBa,IAAIX,WAAAA,EAAc;AAChF,YAAMY,OAAO5B,cAAcgB,WAAAA,GAAcY;AACzC,UAAIA,KAAMF,MAAKG,KAAK;QAAE5B,MAAMe;QAAaY;MAAK,CAAA;IAChD;AACAL,aAASO,IAAIN,SAASE,IAAAA;EACxB;AAGA,QAAMK,kBAAkB,oBAAIvB,IAAAA;AAC5B,aAAW,CAACP,MAAM+B,KAAAA,KAAUd,OAAOC,QAAQzB,gBAAgB,CAAC,CAAA,GAAI;AAE9D,UAAMuC,UAAUD,QAAQjC,MAAAA;AACxB,QAAIkC,YAAYZ,OAAW;AAC3B,QAAI,CAACU,gBAAgBJ,IAAI1B,IAAAA,EAAO8B,iBAAgBD,IAAI7B,MAAM,oBAAIc,IAAAA,CAAAA;AAC9D,eAAWmB,QAAQD,QAASF,iBAAgBI,IAAIlC,IAAAA,GAAOqB,IAAIY,IAAAA;EAC7D;AAGA,QAAMhC,WAAgC,CAAA;AACtC,aAAW,CAACD,MAAMmC,QAAAA,KAAaL,iBAAiB;AAC9C,UAAMM,eAAe9B,WAAW4B,IAAIlC,IAAAA;AACpC,QAAI,CAACoC,aAAc;AAEnB,UAAMC,QAAQC,qBAAqBF,cAAc1C,QAAAA;AAEjD,QAAI,CAAC2C,MAAO;AAGZ,UAAME,cAAcC,gBAAgBzC,cAAcC,IAAAA,GAAOyC,eAAe,CAAA,CAAE;AAE1E,UAAMC,aAAa,IAAInC,KAAK6B,aAAaK,eAAe,CAAA,GAAIjC,IAAI,CAACmC,MAAM;MAACA,EAAE3C;MAAM2C;KAAE,CAAA;AAClF,UAAMC,eAAe;SAAIC,oBAAoBV,UAAUI,WAAAA;;AACvD,UAAMO,oBAAwCF,aAC3CpC,IAAI,CAACuC,MAAML,WAAWR,IAAIa,CAAAA,CAAAA,EAC1BC,OAAO,CAACL,MAAkC,CAAC,CAACA,GAAGM,MAAAA,EAC/CzC,IAAI,CAACmC,OAAO;MACX3C,MAAM2C,EAAE3C;MACRkD,QAAQP,EAAEQ,cAAc;MACxBC,aAAaT,EAAES,eAAe,CAAA;MAC9BC,iBAAiBV,EAAEU,mBAAmB,CAAA;IACxC,EAAA;AAGF,UAAMC,SACJlB,aAAaa,UAAUb,aAAae,eAAe,UAC9Cf,aAAagB,eAAe,CAAA,GAC1B5C,IAAI,CAACgB,UAAU;MACdA;MACAvB,WAAWqB,SAASY,IAAIV,IAAAA,KAAS,CAAA,GAAIwB,OAAO,CAACvC,MAAMA,EAAET,SAASA,IAAAA,EAAMQ,IAAI,CAACC,MAAMA,EAAEkB,IAAI;IACvF,EAAA,EACCqB,OAAO,CAACO,UAAUA,MAAMtD,SAASuD,SAAS,CAAA,IAC7C,CAAA;AAENvD,aAAS2B,KAAK;MACZ5B;MACA2B,MAAMS,aAAaT;MACnB8B,YAAYrB,aAAaqB;MACzBC,UAAUtB,aAAasB;MACvBC,gBAAgBvB,aAAauB;MAC7BlB,aAAaG;MACbK,QAAQb,aAAaa,UAAU;MAC/BE,YAAYf,aAAae,cAAc;MACvCC,aAAahB,aAAagB,eAAe,CAAA;MACzCC,iBAAiBjB,aAAaiB,mBAAmB,CAAA;MACjDP;MACAQ;MACAjB;MACAuB,SAASxB,aAAawB;MACtBC,SAASzB,aAAayB;MACtBC,SAAS1B,aAAa0B;MACtBC,cAAc3B,aAAa2B;IAC7B,CAAA;EACF;AAIA9D,WAAS+D,KAAK,CAACC,GAAGC,MAAMD,EAAEJ,QAAQM,cAAcD,EAAEL,OAAO,CAAA;AAEzD,SAAO5D;AACT;AApHgBd;AAuHT,SAASmD,qBACd8B,OAaA1E,UAAwB;AAExB,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAAC0E,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLC,aAAa5E,aAAa,QAAQ0E,MAAMC,OAAOE,iBAAiBH,MAAMC,OAAOG;MAC7EC,eAAeL,MAAMC,OAAOI;MAC5BC,aAAaN,MAAMC,OAAOK;IAC5B;EACF;AAEA,MAAI,CAACN,MAAMO,IAAK,QAAO;AACvB,SAAO;IACLL,aAAaF,MAAMO,IAAIL;IACvBG,eAAeL,MAAMO,IAAIF;IACzBC,aAAaN,MAAMO,IAAID;EACzB;AACF;AA/BgBpC;;;ACpIT,SAASsC,gBACdC,UACAC,cACAC,UACAC,WACAC,UAAmB;AAEnB,SAAOC,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,OAAOC,QAAAA;AACzE;AARgBL;AAWT,SAASO,gBACdN,UACAC,cACAC,UACAC,WAA4B;AAE5B,SAAOE,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,IAAA;AAClE;AAPgBG;AAUhB,SAASD,YACPL,UACAC,cACAC,UACAC,WACAI,WACAH,UAAmB;AAEnB,QAAMI,WAAWP,eAAeD,SAASS,aAAaR,YAAAA,IAAgBS;AACtE,QAAMC,QAAQH,UAAUG,SAAS,CAAC;AAClC,QAAMC,OAAOV,WAAWS,MAAMT,QAAAA,IAAYQ;AAC1C,QAAMG,WAAW;IAAEC,MAAMZ,YAAY;IAAIa,MAAMH,MAAMG,QAAQb,YAAY;EAAG;AAC5E,QAAMc,QAAQb,aAAa,CAAC;AAC5B,MAAI,CAACK,YAAY,CAACI,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAwB,CAAA;AAC9B,aAAWC,OAAOV,SAASS,MAAM;AAC/B,QAAIE,gBAAgB;AACpB,QAAIC,aAAa;AACjB,UAAMC,WAAgC,CAAA;AAEtC,eAAWC,OAAOJ,IAAIG,UAAU;AAC9B,UAAI,CAACd,aAAae,IAAIC,UAAU,OAAQ;AACxC,YAAMT,OAAOQ,IAAIR;AACjB,YAAMU,UAAUxB,SAASqB,WAAWI,mBAAmBX,MAAMQ,IAAIC,KAAK,CAAA;AACtE,UAAI,CAACC,QAAS;AACd,UAAIpB,aAAaM,UAAa,CAACgB,qBAAqBF,QAAQG,qBAAqBvB,QAAAA,EAAW;AAC5F,YAAMwB,YAAYC,UAAUC,OAAO,CAACC,MAAM,CAAC,CAACP,QAAQQ,iBAAiBD,CAAAA,CAAE;AACvE,UAAIH,UAAUK,WAAW,EAAG;AAE5B,YAAMC,aAAatB,KAAKuB,sBAAsBrB,IAAAA;AAC9C,YAAMsB,gBAAgBC,aAAaH,UAAAA;AACnC,YAAMI,YAAYnC,YAAYW,IAAAA;AAE9B,YAAMyB,eAAuCf,QAAQe,eAAe,CAAA,GACjET,OAAO,CAACC,MAAMA,EAAES,YAAYT,EAAEtB,WAAWgC,SAASxC,gBAAgB,EAAA,CAAA,EAClEyC,IAAI,CAACX,MAAAA;AACJ,cAAMY,OAAO,wBAACC,SAAAA;AACZ,cAAI,CAAChB,UAAUa,SAASG,IAAAA,EAAO,QAAO;AACtC,gBAAMC,YAAYX,aAAaU,IAAAA;AAC/B,gBAAME,SAASV,iBAAiBS,cAAcnC,UAAamC,UAAUJ,SAASV,EAAEjB,IAAI;AAEpF,gBAAMiC,WAAWD,UAAU,CAACE,uBAAuBV,WAAWM,MAAMb,EAAEjB,IAAI;AAC1E,gBAAMmC,cAAcH,SAAS,CAAA,IAAKI,mBAAmBvC,OAAOG,MAAMiB,EAAEjB,MAAM8B,MAAM1C,QAAAA;AAChFkB,wBAAc;AACd,cAAI0B,OAAQ3B,kBAAiB;AAC7B,iBAAO;YAAE2B;YAAQC;YAAUE;UAAY;QACzC,GAVa;AAWb,eAAO;UACLnC,MAAMiB,EAAEjB;UACRqC,OAAOpB,EAAEoB;UACTC,WAAWrB,EAAEqB,aAAa,CAAA;UAC1BC,KAAKV,KAAK,KAAA;UACVW,QAAQX,KAAK,QAAA;QACf;MACF,CAAA;AAEFtB,eAASkC,KAAK;QACZzC,MAAMU,QAAQV;QACdC,MAAMS,QAAQT;QACdyC,MAAMhC,QAAQiC,cAAc;QAC5BlC,OAAOC,QAAQD;QACfI,qBAAqBH,QAAQG;QAC7BC;QACAkB,QAAQV;QACRa,aAAab,gBAAgB,CAAA,IAAKsB,uBAAsB/C,OAAOG,MAAMZ,QAAAA;QACrEqC;MACF,CAAA;IACF;AAEA,QAAIlB,SAASY,WAAW,EAAG;AAC3BhB,SAAKsC,KAAK;MAAEzC,MAAMI,IAAIJ;MAAMC,MAAMG,IAAIH;MAAMyC,MAAMtC,IAAIsC,QAAQ;MAAMrC;MAAeC;MAAYC;IAAS,CAAA;EAC1G;AAGAJ,OAAK0C,KAAK,CAACC,GAAGC,MAAMD,EAAE7C,KAAK+C,cAAcD,EAAE9C,IAAI,CAAA;AAE/C,SAAO;IAAEH,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AA9ESX;AAiFT,SAAS6C,mBACPvC,OACAoD,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,SAAKnC,EAAEI,sBAAsB4B,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAIxB,SAASuB,QAAAA,EAAWG,OAAMZ,KAAKxB,EAAEhB,IAAI;EACpG;AACA,SAAOoD;AACT;AAbSjB;AAgBT,SAASQ,uBACP/C,OACAoD,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACrD,MAAMiB,CAAAA,KAAMqC,OAAOC,QAAQ1D,KAAAA,GAAQ;AAC7C,QAAIG,SAASoD,YAAa;AAC1B,QAAI7B,aAAaN,EAAEI,sBAAsB4B,WAAAA,CAAY,EAAGI,OAAMZ,KAAKxB,EAAEhB,IAAI;EAC3E;AACA,SAAOoD;AACT;AAXST,OAAAA,wBAAAA;","names":["buildDependsMap","permissions","present","Set","map","p","code","Map","set","dependsOn","filter","dep","has","prereqClosure","deps","out","seen","stack","length","current","pop","get","add","push","cascadeLocked","codes","directlyLocked","locked","visiting","check","viaDep","some","delete","filterGrantedByDeps","granted","ok","satisfied","every","PLATFORMS","SITE_TYPES","SERVICE_CODES","snapshotFeatureKey","code","scope","SNAPSHOT_SCHEMA_VERSION","featureAppliesAtNode","applicableSiteTypes","siteType","includes","findFeatureByCode","snapshot","code","feature","Object","values","features","undefined","buildSiteCatalog","businessCode","planCode","siteLocks","bucket","scope","availableServices","business","businesses","plan","plans","catalog","sortedApps","apps","sort","a","b","name","localeCompare","app","businessAppFeatures","filter","ref","map","snapshotFeatureKey","f","microfrontends","web","mobile","length","membership","unlockedPermissions","memberOnBucket","sitePlatformLocked","missingServices","unmetServices","permissions","buildPermissions","lockReason","resolveLockReason","locked","unlockPlans","plansIncludingFeature","push","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","entry","planLocked","siteLocked","requiredServices","service","isSiteLockedOnPlatform","platform","locks","planMembership","planUnlocked","Set","lockEntry","perms","p","isGlobal","deps","buildDependsMap","codes","directlyPlanLocked","directlySiteLocked","has","add","directlyLocked","lockedSet","cascadeLocked","closure","prereqClosure","cascaded","planReason","some","c","siteReason","plansUnlockingClosure","featureCode","result","entries","unlocked","every","buildSiteRoles","roleTemplates","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","web","mobile","resolveUserFeatures","params","snapshot","businessCode","planCode","siteLocks","roleFeatures","platform","siteType","scope","availableServices","bucket","featureByCode","code","features","snapshotFeatureKey","findFeatureByCode","catalog","buildSiteCatalog","catalogMap","Map","map","f","businessPlans","businesses","plans","currentUnlockedCodes","Set","featureCode","platforms","Object","entries","unlockedPermissions","undefined","add","planAdds","planKey","plan","adds","has","name","push","set","grantedFeatures","grant","granted","perm","get","permsSet","catalogEntry","route","pickRouteForPlatform","featureDeps","buildDependsMap","permissions","permByCode","p","grantedPerms","filterGrantedByDeps","lockedPermissions","c","filter","locked","reason","lockReason","unlockPlans","missingServices","upsell","group","length","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","sort","a","b","localeCompare","entry","mobile","remoteEntry","remoteEntryIos","remoteEntryAndroid","exposedModule","routePrefix","web","buildSiteMatrix","snapshot","businessCode","planCode","siteLocks","siteType","buildMatrix","buildPlanMatrix","allScopes","business","businesses","undefined","plans","plan","planMeta","code","name","locks","apps","app","unlockedCount","totalCount","features","ref","scope","feature","snapshotFeatureKey","featureAppliesAtNode","applicableSiteTypes","platforms","PLATFORMS","filter","p","microfrontends","length","membership","unlockedPermissions","featureInPlan","isPlanMember","siteEntry","permissions","isGlobal","includes","map","cell","plat","planCodes","inPlan","selected","isSiteLockedOnPlatform","availableIn","plansUnlockingPerm","label","dependsOn","web","mobile","push","icon","lucideIcon","plansIncludingFeature","sort","a","b","localeCompare","featureCode","permCode","platform","excludeCode","names","Object","entries"]}

package/dist/license.d.cts

@@ -1,4 +1,4 @@
-import { V as VersionSnapshot } from './types-C9jPdQqH.cjs';
+import { V as VersionSnapshot } from './types-BBK6MG-U.cjs';
 export { S as SignedDocument } from './document-BoS0NIbf.cjs';
 
 declare function hashSnapshot(value: unknown): string;

package/dist/license.d.ts

@@ -1,4 +1,4 @@
-import { V as VersionSnapshot } from './types-C9jPdQqH.js';
+import { V as VersionSnapshot } from './types-BBK6MG-U.js';
 export { S as SignedDocument } from './document-BoS0NIbf.js';
 
 declare function hashSnapshot(value: unknown): string;