@vritti/api-sdk 0.4.1 → 0.4.2

package/dist/catalog-resolver.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/catalog-resolver/index.ts","../src/catalog-resolver/permission-deps.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts","../src/catalog-resolver/site-matrix.builder.ts"],"sourcesContent":["// Catalog resolver — the single shared implementation of snapshot resolution (BU catalog, BU matrix, user features)\n\nexport {\n  buildSiteCatalog,\n  buildSiteRoles,\n  featureAppliesAtNode,\n  findFeatureByCode,\n  isPlanMember,\n  isSiteLockedOnPlatform,\n  normalizeApiBuckets,\n  surfaceAllows,\n} from './catalog.builder';\nexport { type ComposeRoleGrantsParams, composeRoleGrants, type RevokedGrants } from './compose-role-grants';\nexport {\n  buildDependsMap,\n  cascadeLocked,\n  type DependsMap,\n  filterGrantedByDeps,\n  prereqClosure,\n} from './permission-deps';\nexport {\n  type ClientPlatform,\n  type LockedPermission,\n  type PermissionFeature,\n  pickRouteForPlatform,\n  type ResolveUserFeaturesParams,\n  resolveUserFeatures,\n} from './resolve-user-features';\nexport {\n  buildPlanMatrix,\n  buildSiteMatrix,\n  type SiteMatrix,\n  type SiteMatrixApp,\n  type SiteMatrixCell,\n  type SiteMatrixFeature,\n  type SiteMatrixPermission,\n} from './site-matrix.builder';\nexport {\n  API_BUCKETS,\n  API_SURFACES,\n  type ApiBucket,\n  type ApiSurface,\n  BUCKET_BY_SURFACE,\n  type BusinessVocabulary,\n  type CatalogPermission,\n  type FeatureCatalogEntry,\n  type FeatureLocks,\n  type FeatureUnlocks,\n  isApiBucket,\n  type LockReason,\n  PLATFORMS,\n  type PlatformBucket,\n  type PlatformCodes,\n  type PlatformDenyCodes,\n  type RoleItem,\n  type ScopeType,\n  SERVICE_CODES,\n  type ServiceCode,\n  SITE_TYPES,\n  type SiteFeatureLocks,\n  type SiteType,\n  SNAPSHOT_SCHEMA_VERSION,\n  type SnapshotApp,\n  type SnapshotAppFeatureRef,\n  type SnapshotBusiness,\n  type SnapshotFeature,\n  type SnapshotMicrofrontendMobile,\n  type SnapshotMicrofrontends,\n  type SnapshotMicrofrontendWeb,\n  type SnapshotPermission,\n  type SnapshotPlan,\n  type SnapshotRoleTemplate,\n  SURFACE_BY_BUCKET,\n  snapshotFeatureKey,\n  UI_PLATFORMS,\n  type UiPlatformBucket,\n  type VersionSnapshot,\n  type VocabularyEntry,\n} from './types';\n","// Intra-feature permission prerequisites — only DIRECT edges are declared; the transitive closure is computed by recursion, cycle-guarded\n\nexport type DependsMap = Map<string, string[]>;\n\n// Builds a dependency map from a feature's permissions, keeping only edges to codes present in the set\nexport function buildDependsMap(permissions: Array<{ code: string; dependsOn?: string[] }>): DependsMap {\n  const present = new Set(permissions.map((p) => p.code));\n  const map: DependsMap = new Map();\n  for (const p of permissions) {\n    map.set(\n      p.code,\n      (p.dependsOn ?? []).filter((dep) => dep !== p.code && present.has(dep)),\n    );\n  }\n  return map;\n}\n\n// Transitive prerequisite closure of a code (excludes the code itself), cycle-safe\nexport function prereqClosure(code: string, deps: DependsMap): string[] {\n  const out = new Set<string>();\n  const seen = new Set<string>([code]);\n  const stack = [code];\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    for (const dep of deps.get(current) ?? []) {\n      if (seen.has(dep)) continue;\n      seen.add(dep);\n      out.add(dep);\n      stack.push(dep);\n    }\n  }\n  return [...out];\n}\n\n// Codes locked after cascade: a code is locked if directly locked or any transitive prerequisite is (cycle-safe)\nexport function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string> {\n  const locked = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (locked.has(code)) return true;\n    if (directlyLocked.has(code)) {\n      locked.add(code);\n      return true;\n    }\n    if (visiting.has(code)) return false;\n    visiting.add(code);\n    const viaDep = (deps.get(code) ?? []).some(check);\n    visiting.delete(code);\n    if (viaDep) locked.add(code);\n    return viaDep;\n  };\n  for (const code of codes) check(code);\n  return locked;\n}\n\n// Keeps only codes whose FULL prerequisite closure is also present — drops a dependent missing any prerequisite (cycle-safe)\nexport function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string> {\n  const ok = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (ok.has(code)) return true;\n    if (!granted.has(code)) return false;\n    if (visiting.has(code)) return true;\n    visiting.add(code);\n    const satisfied = (deps.get(code) ?? []).every(check);\n    visiting.delete(code);\n    if (satisfied) ok.add(code);\n    return satisfied;\n  };\n  for (const code of granted) check(code);\n  return ok;\n}\n","// ——— Platform algebra — plan unlocks, role grants, and BU locks are all stored per platform bucket ———\n\n/**\n * The surfaces a permission can be granted on.\n *\n * `web` and `mobile` are UI buckets: a feature reaches them through a microfrontend, and a grant\n * there means a person can operate it on that surface. `graphql` and `http` are not UIs at all —\n * each is an API surface a credential signs its own requests against, so they have no\n * microfrontend and no route, and a feature needs neither to be reachable on one.\n *\n * Keeping the API buckets in the same algebra rather than beside it is what lets plan entitlement,\n * node feature locks and permission prerequisites bind an API client exactly as they bind a person.\n * One bucket per surface is what lets a plan entitle GraphQL and HTTP access independently.\n */\nexport type PlatformBucket = 'web' | 'mobile' | 'graphql' | 'http';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile', 'graphql', 'http'];\n\n/** Buckets that reach their feature through a microfrontend, and so require one to resolve. */\nexport type UiPlatformBucket = 'web' | 'mobile';\n\nexport const UI_PLATFORMS: UiPlatformBucket[] = ['web', 'mobile'];\n\n// The API surfaces an app credential can present — literally the values of core's `app_type` enum, so\n// enforcement is a plain lookup with no mapping. A feature declares which surfaces expose it.\nexport const API_SURFACES = ['GRAPHQL', 'HTTP'] as const;\nexport type ApiSurface = (typeof API_SURFACES)[number];\n\n/** Buckets that admit an API credential rather than a person — exactly one per surface. */\nexport type ApiBucket = Exclude<PlatformBucket, UiPlatformBucket>;\n\nexport const API_BUCKETS: ApiBucket[] = ['graphql', 'http'];\n\nexport const SURFACE_BY_BUCKET: Record<ApiBucket, ApiSurface> = { graphql: 'GRAPHQL', http: 'HTTP' };\nexport const BUCKET_BY_SURFACE: Record<ApiSurface, ApiBucket> = { GRAPHQL: 'graphql', HTTP: 'http' };\n\nexport function isApiBucket(bucket: PlatformBucket): bucket is ApiBucket {\n  return bucket === 'graphql' || bucket === 'http';\n}\n\n// Documents written before GraphQL and HTTP were entitled separately may still carry a single legacy\n// `app` bucket meaning \"any API surface\". It is deliberately NOT part of these shapes — nothing may\n// write it — and is honoured only inside `normalizeApiBuckets`, which copies it into graphql/http.\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n  graphql?: string[];\n  http?: string[];\n}\n\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n  graphql?: string[] | null;\n  http?: string[] | null;\n}\n\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\nexport type FeatureLocks = Record<string, PlatformDenyCodes>;\nexport type SiteFeatureLocks = FeatureLocks;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n  dependsOn: string[];\n}\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport type ScopeType = 'ORG' | 'LE' | 'SITE_GROUP' | 'SITE';\nexport type SiteType = 'OUTLET' | 'WAREHOUSE' | 'PRODUCTION';\nexport const SITE_TYPES: SiteType[] = ['OUTLET', 'WAREHOUSE', 'PRODUCTION'];\n// External services a feature can depend on — the org must have the service provisioned before the feature\n// unlocks. Add new services here and nowhere else in this package; every lock path is service-agnostic.\nexport const SERVICE_CODES = ['GITEA'] as const;\nexport type ServiceCode = (typeof SERVICE_CODES)[number];\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n  // Optional: snapshots built before service gating existed carry no services, which reads as \"requires none\"\n  requiredServices?: ServiceCode[];\n  // Optional: snapshots built before surface gating existed carry no list, which reads as \"reachable by any\n  // app credential\". A present list is strict — it decides which of the `graphql`/`http` buckets the feature\n  // offers at all, and `[]` offers neither. The builder always emits it, so only pre-flag snapshots are lenient.\n  apiSurfaces?: ApiSurface[];\n}\nexport interface SnapshotAppFeatureRef {\n  code: string;\n  scope: ScopeType;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: SnapshotAppFeatureRef[];\n}\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  scope: ScopeType;\n  siteType: SiteType;\n  features: FeatureUnlocks;\n}\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxSites: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface VocabularyEntry {\n  singular: string;\n  plural: string;\n}\nexport interface BusinessVocabulary {\n  site?: VocabularyEntry;\n  siteGroup?: VocabularyEntry;\n  outlet?: VocabularyEntry;\n  warehouse?: VocabularyEntry;\n  production?: VocabularyEntry;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  vocabulary?: BusinessVocabulary;\n  apps: SnapshotApp[];\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  schemaVersion?: number;\n  // Flat feature dictionary keyed by `${scope}.${code}` (see snapshotFeatureKey) — same-code features at different scopes stay distinct\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// Composite key for the snapshot feature dictionary — feature identity is (scope, code)\nexport function snapshotFeatureKey(code: string, scope: ScopeType): string {\n  return `${scope}.${code}`;\n}\n\nexport const SNAPSHOT_SCHEMA_VERSION = 4;\n\n// SERVICE = the org has not provisioned an external service the feature declares; the specific services are\n// reported alongside in `missingServices` so callers never branch on a service code baked into this union\nexport type LockReason = 'PLAN' | 'SITE' | 'SERVICE';\n\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n  permissions: CatalogPermission[];\n}\n\nexport type RoleItem = SnapshotRoleTemplate;\n","import { buildDependsMap, cascadeLocked, prereqClosure } from './permission-deps';\nimport type {\n  ApiSurface,\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  PlatformDenyCodes,\n  RoleItem,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\nimport { isApiBucket, PLATFORMS, SURFACE_BY_BUCKET, snapshotFeatureKey } from './types';\n\n/**\n * Copies a legacy `app` bucket into whichever of `graphql`/`http` an entry lacks.\n *\n * Documents written before the API surfaces were entitled separately — old snapshots, old\n * credential grants, old deny-lists — carry one `app` bucket that meant \"any API surface\".\n * Normalising at read time is what lets those documents keep working without a re-key: an\n * `app` grant admits both surfaces, and an `app` lock fails closed on both. Entries already\n * carrying a surface bucket keep it — the legacy value only fills gaps.\n */\nexport function normalizeApiBuckets<T extends PlatformCodes | PlatformDenyCodes>(\n  doc: Record<string, T> | undefined,\n): Record<string, T> | undefined {\n  if (!doc) return doc;\n  let changed = false;\n  const next: Record<string, T> = {};\n  for (const [code, entry] of Object.entries(doc)) {\n    // The legacy key is deliberately absent from the public shapes so nothing can write it;\n    // stored documents predating the split are the only place it still occurs.\n    const legacy = (entry as T & LegacyApiBucket).app;\n    if (legacy === undefined || (entry.graphql !== undefined && entry.http !== undefined)) {\n      next[code] = entry;\n      continue;\n    }\n    changed = true;\n    next[code] = {\n      ...entry,\n      ...(entry.graphql === undefined ? { graphql: legacy } : {}),\n      ...(entry.http === undefined ? { http: legacy } : {}),\n    };\n  }\n  return changed ? next : doc;\n}\n\n// The pre-split single API bucket, as old persisted jsonb still carries it\ntype LegacyApiBucket = { app?: string[] | null };\n\n// Normalizes every plan's unlock document in one pass, so per-plan upsell lookups read legacy docs correctly too\nfunction normalizePlans(plans: Record<string, SnapshotPlan>): Record<string, SnapshotPlan> {\n  let changed = false;\n  const next: Record<string, SnapshotPlan> = {};\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlockedPermissions = normalizeApiBuckets(plan.unlockedPermissions) ?? {};\n    if (unlockedPermissions !== plan.unlockedPermissions) changed = true;\n    next[code] = unlockedPermissions === plan.unlockedPermissions ? plan : { ...plan, unlockedPermissions };\n  }\n  return changed ? next : plans;\n}\n\n// Whether a feature with the given site-type applicability is exposed at this site type\nexport function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean {\n  return applicableSiteTypes.includes(siteType);\n}\n\n// Scope-agnostic lookup of a feature by bare code — grants/locks key features by code alone, so the first scope-variant's shared metadata (permission graph) answers\nexport function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined {\n  for (const feature of Object.values(snapshot.features ?? {})) {\n    if (feature?.code === code) return feature;\n  }\n  return undefined;\n}\n\n// Builds the per-site catalog for ONE platform bucket — plan is the ceiling, siteLocks is a deny-list within it; each permission carries locked + lockReason + unlockPlans\n// availableServices defaults to none, so a caller that doesn't know the org's provisioned services locks every service-dependent feature rather than leaking it\nexport function buildSiteCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  bucket: PlatformBucket,\n  siteType?: SiteType,\n  scope?: ScopeType,\n  availableServices: ServiceCode[] = [],\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  // Legacy `app` buckets in stored documents read as both API surfaces — see normalizeApiBuckets\n  const plans = normalizePlans(business.plans ?? {});\n  const plan = planCode ? plans[planCode] : undefined;\n  const locks = normalizeApiBuckets(siteLocks);\n\n  const catalog: FeatureCatalogEntry[] = [];\n  // Iterate apps alphabetically by name so the resolved feature list (→ core-web sidebar) is app-alphabetical without any frontend re-sort\n  const sortedApps = [...business.apps].sort((a, b) => a.name.localeCompare(b.name));\n  for (const app of sortedApps) {\n    // The app's renderable features (each ref pins scope+code to one app), dropped when they don't belong to this workspace scope or node type (outlet vs container)\n    const businessAppFeatures = app.features\n      .filter((ref) => scope === undefined || ref.scope === scope)\n      .map((ref) => snapshot.features?.[snapshotFeatureKey(ref.code, ref.scope)])\n      .filter(\n        (f): f is SnapshotFeature =>\n          !!f &&\n          // A UI bucket needs something to render, so a feature shipping no microfrontend is dropped.\n          // An API bucket renders nothing — there a feature is admitted by the surfaces it declares\n          // instead, so a GRAPHQL credential never resolves an HTTP-only feature. A surface-excluded\n          // feature vanishes from the catalog entirely, which is what makes resolution fail closed.\n          (isApiBucket(bucket)\n            ? surfaceAllows(f.apiSurfaces, SURFACE_BY_BUCKET[bucket])\n            : !!(f.microfrontends?.web || f.microfrontends?.mobile)) &&\n          (siteType === undefined || featureAppliesAtNode(f.applicableSiteTypes, siteType)),\n      );\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves as a locked tile instead of vanishing\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions?.[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      // Feature-level lock is EXPLICIT: plan must include the feature on this bucket, the site must not null-lock\n      // the platform, and every external service the feature declares must be provisioned for the org\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const sitePlatformLocked = locks?.[feature.code]?.[bucket] === null;\n      const missingServices = unmetServices(feature, availableServices);\n      // Unmet services lock every permission too — otherwise the feature reads locked while its actions still\n      // report as available, which is not how plan and site locks behave\n      const permissions = buildPermissions(feature, businessCode, membership, locks, plans, bucket, missingServices);\n      const lockReason = resolveLockReason(!memberOnBucket, sitePlatformLocked, missingServices);\n      const locked = lockReason !== null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        missingServices,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions).\n// Iterates PLATFORMS plus the legacy `app` key, so a caller handing over an un-normalized document\n// still reads a legacy API entitlement as membership.\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  if (!entry) return false;\n  return PLATFORMS.some((platform) => entry[platform] !== undefined) || (entry as LegacyApiBucket).app !== undefined;\n}\n\n/**\n * Whether a feature's declared API surfaces admit a caller's surface.\n *\n * Lenient on either side being unknown: a pre-flag snapshot declares nothing (`undefined`), and a\n * caller resolving without a surface (cloud's matrix builders, UI buckets) filters nothing. Strictness\n * comes from both sides being present — including a declared `[]`, which admits no surface at all.\n */\nexport function surfaceAllows(surfaces: ApiSurface[] | undefined, surface: ApiSurface | undefined): boolean {\n  return surface === undefined || surfaces === undefined || surfaces.includes(surface);\n}\n\n// The one place lock precedence is decided, for features and permissions alike; null means nothing locks.\n// Plan is the ceiling (an unentitled feature must upsell, not send the user to provision something they still\n// couldn't use), then the site deny-list, then any unprovisioned service.\nfunction resolveLockReason(\n  planLocked: boolean,\n  siteLocked: boolean,\n  missingServices: ServiceCode[],\n): LockReason | null {\n  if (planLocked) return 'PLAN';\n  if (siteLocked) return 'SITE';\n  if (missingServices.length > 0) return 'SERVICE';\n  return null;\n}\n\n// The services a feature declares that this org has not provisioned\nfunction unmetServices(feature: SnapshotFeature, availableServices: ServiceCode[]): ServiceCode[] {\n  return (feature.requiredServices ?? []).filter((service) => !availableServices.includes(service));\n}\n\n// Per-platform site-lock primitive: null locks the whole feature, string[] locks those codes, absent = not locked\nexport function isSiteLockedOnPlatform(\n  entry: SiteFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and site deny-list\n// (bucket-scoped). Unmet services lock the whole set — an unprovisioned service blocks every action on the feature.\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n  missingServices: ServiceCode[] = [],\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = siteLocks?.[feature.code];\n\n  const perms = (feature.permissions ?? []).filter((p) => p.isGlobal || p.businesses.includes(businessCode));\n  const deps = buildDependsMap(perms);\n  const codes = perms.map((p) => p.code);\n\n  // Direct plan/site locks, then cascade so a locked prerequisite (e.g. view) locks its dependents (add/edit/delete)\n  const directlyPlanLocked = new Set<string>();\n  const directlySiteLocked = new Set<string>();\n  for (const p of perms) {\n    if (!planUnlocked.has(p.code)) directlyPlanLocked.add(p.code);\n    if (isSiteLockedOnPlatform(lockEntry, bucket, p.code)) directlySiteLocked.add(p.code);\n  }\n  const directlyLocked = new Set<string>([...directlyPlanLocked, ...directlySiteLocked]);\n  const lockedSet = cascadeLocked(codes, directlyLocked, deps);\n\n  return perms.map((p) => {\n    // A permission is enabled only if it AND its whole prerequisite closure are unlocked — reason/upsell reflect that\n    const closure = [p.code, ...prereqClosure(p.code, deps)];\n    const cascaded = lockedSet.has(p.code);\n    const planReason = cascaded && closure.some((c) => directlyPlanLocked.has(c));\n    const siteReason = cascaded && closure.some((c) => directlySiteLocked.has(c));\n    const lockReason = resolveLockReason(planReason, siteReason, missingServices);\n    const locked = lockReason !== null;\n    const unlockPlans = lockReason === 'PLAN' ? plansUnlockingClosure(plans, feature.code, closure, bucket) : [];\n    return { code: p.code, locked, lockReason, unlockPlans, missingServices };\n  });\n}\n\n// Plan codes (in the business) whose unlocked set includes the permission AND its whole prerequisite closure — upsell targets\nfunction plansUnlockingClosure(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  closure: string[],\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlocked = plan.unlockedPermissions?.[featureCode]?.[bucket];\n    if (unlocked && closure.every((c) => unlocked.includes(c))) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions?.[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses?.[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates ?? {});\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10); inputs are never mutated\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions ?? {})]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions?.[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set.\n    // Iterates PLATFORMS rather than naming buckets — the web/mobile-only version silently\n    // dropped a grant surviving only on an API bucket.\n    if (PLATFORMS.every((bucket) => composed[bucket] === undefined)) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildSiteCatalog, findFeatureByCode, normalizeApiBuckets } from './catalog.builder';\nimport { buildDependsMap, filterGrantedByDeps } from './permission-deps';\nimport type {\n  FeatureUnlocks,\n  LockReason,\n  PlatformBucket,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  VersionSnapshot,\n} from './types';\nimport { isApiBucket, snapshotFeatureKey } from './types';\n\n/**\n * The caller's surface, as the caller reports it.\n *\n * Finer than `PlatformBucket` on the mobile side — `ios` and `android` load different remote\n * entries but share one grant bucket. The API platforms are one-to-one with their buckets: an\n * API client has no variants because it has no UI.\n */\nexport type ClientPlatform = 'web' | 'ios' | 'android' | 'graphql' | 'http';\n\n// Exhaustive by type, so adding a ClientPlatform without deciding its bucket fails the build instead\n// of silently falling through to mobile — which is how an API caller would end up resolving a UI bucket.\nconst BUCKET_BY_CLIENT: Record<ClientPlatform, PlatformBucket> = {\n  web: 'web',\n  ios: 'mobile',\n  android: 'mobile',\n  graphql: 'graphql',\n  http: 'http',\n};\n\n/**\n * Stands in for the microfrontend an API client does not load.\n *\n * `PermissionFeature.route` is non-optional and read by the web sidebar and the mobile host to\n * mount a remote. Nothing on the API paths reads it — the permission interceptor uses `code`,\n * `permissions` and `locked` — so an empty route keeps one shape for every bucket instead of\n * widening the field to null across every consumer.\n */\nconst EMPTY_ROUTE = { remoteEntry: '', exposedModule: '', routePrefix: '' };\n\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface PlanUpsell {\n  plan: string;\n  features: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  // Which declared services the org has not provisioned — empty unless lockReason is 'SERVICE'\n  missingServices: ServiceCode[];\n  lockedPermissions: LockedPermission[];\n  upsell: PlanUpsell[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  siteLocks: SiteFeatureLocks | undefined;\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n  siteType?: SiteType;\n  scope?: ScopeType;\n  // External services the org has provisioned; omitting it locks every service-dependent feature\n  availableServices?: ServiceCode[];\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants, filtered to the requested platform\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, siteLocks, platform, siteType, scope, availableServices } = params;\n\n  // Plan unlocks, BU locks, and role grants are stored per platform; resolve only the requesting\n  // surface's bucket (web → web; ios/android → mobile; graphql/http → themselves)\n  const bucket: PlatformBucket = BUCKET_BY_CLIENT[platform];\n\n  // Legacy `app` buckets in stored grants read as both API surfaces — see normalizeApiBuckets\n  const roleFeatures = normalizeApiBuckets(params.roleFeatures) ?? {};\n\n  // Grants/plans/locks key features by bare code; resolve to the workspace scope's variant (or any variant when unscoped)\n  const featureByCode = (code: string) =>\n    scope ? snapshot.features?.[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code);\n\n  // Plan ∧ BU overlay for this bucket, filtered to features that apply to this workspace scope and node type — emits EVERY applicable business feature (plan non-members come out fully locked)\n  const catalog = buildSiteCatalog(\n    snapshot,\n    businessCode,\n    planCode,\n    siteLocks,\n    bucket,\n    siteType,\n    scope,\n    availableServices,\n  );\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Per-plan feature-name delta vs the current plan — feeds the plan-locked upsell screen.\n  // Normalized so a legacy plan document's `app` entitlement still counts for either API bucket.\n  const businessPlans = Object.fromEntries(\n    Object.entries(snapshot.businesses[businessCode]?.plans ?? {}).map(([code, plan]) => [\n      code,\n      { ...plan, unlockedPermissions: normalizeApiBuckets(plan.unlockedPermissions) ?? {} },\n    ]),\n  );\n  const currentUnlockedCodes = new Set<string>();\n  if (planCode && businessPlans[planCode]) {\n    for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] !== undefined) currentUnlockedCodes.add(featureCode);\n    }\n  }\n  const planAdds = new Map<string, Array<{ code: string; name: string }>>();\n  for (const [planKey, plan] of Object.entries(businessPlans)) {\n    if (planKey === planCode) continue;\n    const adds: Array<{ code: string; name: string }> = [];\n    for (const [featureCode, platforms] of Object.entries(plan.unlockedPermissions ?? {})) {\n      if (platforms?.[bucket] === undefined || currentUnlockedCodes.has(featureCode)) continue;\n      const name = featureByCode(featureCode)?.name;\n      if (name) adds.push({ code: featureCode, name });\n    }\n    planAdds.set(planKey, adds);\n  }\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures ?? {})) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant?.[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    // A UI bucket reaches its feature by loading a microfrontend, so a feature not published to\n    // this platform is omitted rather than handed over as an unloadable tile. An API client loads\n    // nothing — requiring a route there would make every headless feature permanently ungrantable.\n    const route = isApiBucket(bucket) ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);\n    if (!route) continue;\n\n    // Drop granted permissions whose intra-feature prerequisites aren't also granted (e.g. add needs view)\n    const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map((catalogEntry.permissions ?? []).map((p) => [p.code, p]));\n    const grantedPerms = [...filterGrantedByDeps(permsSet, featureDeps)];\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({\n        code: p.code,\n        reason: p.lockReason ?? null,\n        unlockPlans: p.unlockPlans ?? [],\n        missingServices: p.missingServices ?? [],\n      }));\n\n    // For a plan-locked feature, list the extra features each unlocking plan would add (excluding this feature)\n    const upsell: PlanUpsell[] =\n      catalogEntry.locked && catalogEntry.lockReason === 'PLAN'\n        ? (catalogEntry.unlockPlans ?? [])\n            .map((plan) => ({\n              plan,\n              features: (planAdds.get(plan) ?? []).filter((f) => f.code !== code).map((f) => f.name),\n            }))\n            .filter((group) => group.features.length > 0)\n        : [];\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans ?? [],\n      missingServices: catalogEntry.missingServices ?? [],\n      lockedPermissions,\n      upsell,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  // Order app-alphabetically so the core-web sidebar (groups by app) renders apps sorted without any frontend re-sort;\n  // stable sort keeps each app's features in their existing relative order\n  features.sort((a, b) => a.appName.localeCompare(b.appName));\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform, or null when it doesn't publish there\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  // API platforms load nothing — resolveUserFeatures never routes them here, and answering with the\n  // web block for an unhandled value would hand an API caller a remote it cannot mount\n  if (platform === 'graphql' || platform === 'http') return null;\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n","import { featureAppliesAtNode, isPlanMember, isSiteLockedOnPlatform, normalizeApiBuckets } from './catalog.builder';\nimport {\n  API_BUCKETS,\n  type ApiSurface,\n  type PlatformBucket,\n  type ScopeType,\n  type SiteFeatureLocks,\n  type SiteType,\n  type SnapshotPlan,\n  SURFACE_BY_BUCKET,\n  snapshotFeatureKey,\n  UI_PLATFORMS,\n  type VersionSnapshot,\n} from './types';\n\nexport interface SiteMatrixCell {\n  inPlan: boolean;\n  selected: boolean;\n  availableIn: string[];\n}\n\nexport interface SiteMatrixPermission {\n  code: string;\n  label: string;\n  dependsOn: string[];\n  web: SiteMatrixCell | null;\n  mobile: SiteMatrixCell | null;\n  graphql: SiteMatrixCell | null;\n  http: SiteMatrixCell | null;\n}\n\nexport interface SiteMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  platforms: PlatformBucket[];\n  inPlan: boolean;\n  availableIn: string[];\n  // The API surfaces the feature declares — what lets the app-credential editor filter by the\n  // credential's type. Absent on pre-flag snapshots, which reads as \"any surface\".\n  apiSurfaces?: ApiSurface[];\n  permissions: SiteMatrixPermission[];\n}\n\nexport interface SiteMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  unlockedCount: number;\n  totalCount: number;\n  features: SiteMatrixFeature[];\n}\n\nexport interface SiteMatrix {\n  plan: { code: string; name: string };\n  apps: SiteMatrixApp[];\n  locks: SiteFeatureLocks;\n}\n\n// Builds the SITE-only apps/features/permissions matrix — not filtered to plan members; plan-locked items carry inPlan=false + availableIn\nexport function buildSiteMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  siteType?: SiteType,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, false, siteType);\n}\n\n// Builds the all-scopes apps/features/permissions matrix — every scope's features included, each carrying its real scope; powers the Plan Overview + Create Custom Role picker\nexport function buildPlanMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks?: SiteFeatureLocks,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, true);\n}\n\n// Shared matrix builder — allScopes=false keeps only SITE refs; allScopes=true includes every scope and emits each feature's real scope\nfunction buildMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  allScopes: boolean,\n  siteType?: SiteType,\n): SiteMatrix {\n  const business = businessCode ? snapshot.businesses?.[businessCode] : undefined;\n  // Legacy `app` buckets in stored documents read as both API surfaces — see normalizeApiBuckets\n  const plans = Object.fromEntries(\n    Object.entries(business?.plans ?? {}).map(([code, p]) => [\n      code,\n      { ...p, unlockedPermissions: normalizeApiBuckets(p.unlockedPermissions) ?? {} },\n    ]),\n  );\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const normalizedLocks = normalizeApiBuckets(siteLocks);\n  const locks = normalizedLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: SiteMatrixApp[] = [];\n  for (const app of business.apps) {\n    let unlockedCount = 0;\n    let totalCount = 0;\n    const features: SiteMatrixFeature[] = [];\n\n    for (const ref of app.features) {\n      if (!allScopes && ref.scope !== 'SITE') continue;\n      const code = ref.code;\n      const feature = snapshot.features?.[snapshotFeatureKey(code, ref.scope)];\n      if (!feature) continue;\n      if (siteType !== undefined && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;\n      // A UI bucket is offered only where the feature publishes a microfrontend; each API bucket is\n      // offered where the feature declares its surface. An undeclared list (pre-flag snapshot) keeps\n      // the old always-offered behaviour on both; an undeclared surface shows an em dash like a\n      // missing microfrontend does.\n      const platforms: PlatformBucket[] = [\n        ...UI_PLATFORMS.filter((p) => !!feature.microfrontends?.[p]),\n        ...API_BUCKETS.filter(\n          (b) => feature.apiSurfaces === undefined || feature.apiSurfaces.includes(SURFACE_BY_BUCKET[b]),\n        ),\n      ];\n\n      const membership = plan.unlockedPermissions?.[code];\n      const featureInPlan = isPlanMember(membership);\n      const siteEntry = normalizedLocks?.[code];\n\n      const permissions: SiteMatrixPermission[] = (feature.permissions ?? [])\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): SiteMatrixCell | null => {\n            if (!platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the site locks it on this platform\n            const selected = inPlan && !isSiteLockedOnPlatform(siteEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            totalCount += 1;\n            if (inPlan) unlockedCount += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return {\n            code: p.code,\n            label: p.label,\n            dependsOn: p.dependsOn ?? [],\n            web: cell('web'),\n            mobile: cell('mobile'),\n            graphql: cell('graphql'),\n            http: cell('http'),\n          };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        scope: feature.scope,\n        applicableSiteTypes: feature.applicableSiteTypes,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        apiSurfaces: feature.apiSurfaces,\n        permissions,\n      });\n    }\n\n    if (features.length === 0) continue;\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, unlockedCount, totalCount, features });\n  }\n\n  // Emit apps alphabetically by name so every consumer (Plan Overview, Role picker, all Locks screens) renders them sorted\n  apps.sort((a, b) => a.name.localeCompare(b.name));\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions?.[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions?.[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACKO,SAASA,gBAAgBC,aAA0D;AACxF,QAAMC,UAAU,IAAIC,IAAIF,YAAYG,IAAI,CAACC,MAAMA,EAAEC,IAAI,CAAA;AACrD,QAAMF,MAAkB,oBAAIG,IAAAA;AAC5B,aAAWF,KAAKJ,aAAa;AAC3BG,QAAII,IACFH,EAAEC,OACDD,EAAEI,aAAa,CAAA,GAAIC,OAAO,CAACC,QAAQA,QAAQN,EAAEC,QAAQJ,QAAQU,IAAID,GAAAA,CAAAA,CAAAA;EAEtE;AACA,SAAOP;AACT;AAVgBJ;AAaT,SAASa,cAAcP,MAAcQ,MAAgB;AAC1D,QAAMC,MAAM,oBAAIZ,IAAAA;AAChB,QAAMa,OAAO,oBAAIb,IAAY;IAACG;GAAK;AACnC,QAAMW,QAAQ;IAACX;;AACf,SAAOW,MAAMC,SAAS,GAAG;AACvB,UAAMC,UAAUF,MAAMG,IAAG;AACzB,eAAWT,OAAOG,KAAKO,IAAIF,OAAAA,KAAY,CAAA,GAAI;AACzC,UAAIH,KAAKJ,IAAID,GAAAA,EAAM;AACnBK,WAAKM,IAAIX,GAAAA;AACTI,UAAIO,IAAIX,GAAAA;AACRM,YAAMM,KAAKZ,GAAAA;IACb;EACF;AACA,SAAO;OAAII;;AACb;AAdgBF;AAiBT,SAASW,cAAcC,OAAiBC,gBAA6BZ,MAAgB;AAC1F,QAAMa,SAAS,oBAAIxB,IAAAA;AACnB,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAIqB,OAAOf,IAAIN,IAAAA,EAAO,QAAO;AAC7B,QAAIoB,eAAed,IAAIN,IAAAA,GAAO;AAC5BqB,aAAOL,IAAIhB,IAAAA;AACX,aAAO;IACT;AACA,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAMwB,UAAUhB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAIyB,KAAKF,KAAAA;AAC3CD,aAASI,OAAO1B,IAAAA;AAChB,QAAIwB,OAAQH,QAAOL,IAAIhB,IAAAA;AACvB,WAAOwB;EACT,GAZc;AAad,aAAWxB,QAAQmB,MAAOI,OAAMvB,IAAAA;AAChC,SAAOqB;AACT;AAlBgBH;AAqBT,SAASS,oBAAoBC,SAAsBpB,MAAgB;AACxE,QAAMqB,KAAK,oBAAIhC,IAAAA;AACf,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAI6B,GAAGvB,IAAIN,IAAAA,EAAO,QAAO;AACzB,QAAI,CAAC4B,QAAQtB,IAAIN,IAAAA,EAAO,QAAO;AAC/B,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAM8B,aAAatB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAI+B,MAAMR,KAAAA;AAC/CD,aAASI,OAAO1B,IAAAA;AAChB,QAAI8B,UAAWD,IAAGb,IAAIhB,IAAAA;AACtB,WAAO8B;EACT,GATc;AAUd,aAAW9B,QAAQ4B,QAASL,OAAMvB,IAAAA;AAClC,SAAO6B;AACT;AAfgBF;;;ACxCT,IAAMK,YAA8B;EAAC;EAAO;EAAU;EAAW;;AAKjE,IAAMC,eAAmC;EAAC;EAAO;;AAIjD,IAAMC,eAAe;EAAC;EAAW;;AAMjC,IAAMC,cAA2B;EAAC;EAAW;;AAE7C,IAAMC,oBAAmD;EAAEC,SAAS;EAAWC,MAAM;AAAO;AAC5F,IAAMC,oBAAmD;EAAEC,SAAS;EAAWC,MAAM;AAAO;AAE5F,SAASC,YAAYC,QAAsB;AAChD,SAAOA,WAAW,aAAaA,WAAW;AAC5C;AAFgBD;AAwDT,IAAME,aAAyB;EAAC;EAAU;EAAa;;AAGvD,IAAMC,gBAAgB;EAAC;;AAsEvB,SAASC,mBAAmBC,MAAcC,OAAgB;AAC/D,SAAO,GAAGA,KAAAA,IAASD,IAAAA;AACrB;AAFgBD;AAIT,IAAMG,0BAA0B;;;AC5IhC,SAASC,oBACdC,KAAkC;AAElC,MAAI,CAACA,IAAK,QAAOA;AACjB,MAAIC,UAAU;AACd,QAAMC,OAA0B,CAAC;AACjC,aAAW,CAACC,MAAMC,KAAAA,KAAUC,OAAOC,QAAQN,GAAAA,GAAM;AAG/C,UAAMO,SAAUH,MAA8BI;AAC9C,QAAID,WAAWE,UAAcL,MAAMM,YAAYD,UAAaL,MAAMO,SAASF,QAAY;AACrFP,WAAKC,IAAAA,IAAQC;AACb;IACF;AACAH,cAAU;AACVC,SAAKC,IAAAA,IAAQ;MACX,GAAGC;MACH,GAAIA,MAAMM,YAAYD,SAAY;QAAEC,SAASH;MAAO,IAAI,CAAC;MACzD,GAAIH,MAAMO,SAASF,SAAY;QAAEE,MAAMJ;MAAO,IAAI,CAAC;IACrD;EACF;AACA,SAAON,UAAUC,OAAOF;AAC1B;AAtBgBD;AA4BhB,SAASa,eAAeC,OAAmC;AACzD,MAAIZ,UAAU;AACd,QAAMC,OAAqC,CAAC;AAC5C,aAAW,CAACC,MAAMW,IAAAA,KAAST,OAAOC,QAAQO,KAAAA,GAAQ;AAChD,UAAME,sBAAsBhB,oBAAoBe,KAAKC,mBAAmB,KAAK,CAAC;AAC9E,QAAIA,wBAAwBD,KAAKC,oBAAqBd,WAAU;AAChEC,SAAKC,IAAAA,IAAQY,wBAAwBD,KAAKC,sBAAsBD,OAAO;MAAE,GAAGA;MAAMC;IAAoB;EACxG;AACA,SAAOd,UAAUC,OAAOW;AAC1B;AATSD;AAYF,SAASI,qBAAqBC,qBAAiCC,UAAkB;AACtF,SAAOD,oBAAoBE,SAASD,QAAAA;AACtC;AAFgBF;AAKT,SAASI,kBAAkBC,UAA2BlB,MAAY;AACvE,aAAWmB,WAAWjB,OAAOkB,OAAOF,SAASG,YAAY,CAAC,CAAA,GAAI;AAC5D,QAAIF,SAASnB,SAASA,KAAM,QAAOmB;EACrC;AACA,SAAOb;AACT;AALgBW;AAST,SAASK,iBACdJ,UACAK,cACAC,UACAC,WACAC,QACAX,UACAY,OACAC,oBAAmC,CAAA,GAAE;AAErC,MAAI,CAACL,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWX,SAASY,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AAEtB,QAAMnB,QAAQD,eAAeoB,SAASnB,SAAS,CAAC,CAAA;AAChD,QAAMC,OAAOa,WAAWd,MAAMc,QAAAA,IAAYlB;AAC1C,QAAMyB,QAAQnC,oBAAoB6B,SAAAA;AAElC,QAAMO,UAAiC,CAAA;AAEvC,QAAMC,aAAa;OAAIJ,SAASK;IAAMC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,KAAKC,cAAcF,EAAEC,IAAI,CAAA;AAChF,aAAWjC,OAAO4B,YAAY;AAE5B,UAAMO,sBAAsBnC,IAAIgB,SAC7BoB,OAAO,CAACC,QAAQf,UAAUrB,UAAaoC,IAAIf,UAAUA,KAAAA,EACrDgB,IAAI,CAACD,QAAQxB,SAASG,WAAWuB,mBAAmBF,IAAI1C,MAAM0C,IAAIf,KAAK,CAAA,CAAE,EACzEc,OACC,CAACI,MACC,CAAC,CAACA;;;;KAKDC,YAAYpB,MAAAA,IACTqB,cAAcF,EAAEG,aAAaC,kBAAkBvB,MAAAA,CAAO,IACtD,CAAC,EAAEmB,EAAEK,gBAAgBC,OAAON,EAAEK,gBAAgBE,aACjDrC,aAAaT,UAAaO,qBAAqBgC,EAAE/B,qBAAqBC,QAAAA,EAAQ;AAGrF,QAAIyB,oBAAoBa,WAAW,EAAG;AAGtC,eAAWlC,WAAWqB,qBAAqB;AACzC,YAAMc,aAAa3C,MAAMC,sBAAsBO,QAAQnB,IAAI;AAE3D,YAAMmD,MAAMhC,QAAQ+B,gBAAgBC;AACpC,YAAMC,SAASjC,QAAQ+B,gBAAgBE;AAIvC,YAAMG,iBAAiBD,aAAa5B,MAAAA,MAAYpB;AAChD,YAAMkD,qBAAqBzB,QAAQZ,QAAQnB,IAAI,IAAI0B,MAAAA,MAAY;AAC/D,YAAM+B,kBAAkBC,cAAcvC,SAASS,iBAAAA;AAG/C,YAAM+B,cAAcC,iBAAiBzC,SAASI,cAAc+B,YAAYvB,OAAOrB,OAAOgB,QAAQ+B,eAAAA;AAC9F,YAAMI,aAAaC,kBAAkB,CAACP,gBAAgBC,oBAAoBC,eAAAA;AAC1E,YAAMM,SAASF,eAAe;AAC9B,YAAMG,cAAcH,eAAe,SAASI,sBAAsBvD,OAAOS,QAAQnB,MAAM0B,MAAAA,IAAU,CAAA;AAEjGM,cAAQkC,KAAK;QACXlE,MAAMmB,QAAQnB;QACdsC,MAAMnB,QAAQmB;QACd6B,YAAYhD,QAAQgD,cAAc;QAClCC,UAAUjD,QAAQiD,YAAY;QAC9BC,gBAAgBlD,QAAQkD,kBAAkB;QAC1ClB,KAAKA,MACD;UACEmB,aAAanB,IAAImB,eAAe;UAChCC,eAAepB,IAAIoB,iBAAiB;UACpCC,aAAarB,IAAIqB,eAAe;QAClC,IACA;QACJpB,QAAQA,SACJ;UACEqB,oBAAoBrB,OAAOqB,sBAAsB;UACjDC,gBAAgBtB,OAAOsB,kBAAkB;UACzCH,eAAenB,OAAOmB,iBAAiB;UACvCC,aAAapB,OAAOoB,eAAe;QACrC,IACA;QACJG,SAAStE,IAAIL;QACb4E,SAASvE,IAAIiC;QACbuC,SAASxE,IAAIyE,QAAQ;QACrBC,cAAc1E,IAAI2E,aAAa;QAC/BjB;QACAF;QACAG;QACAP;QACAE;MACF,CAAA;IACF;EACF;AACA,SAAO3B;AACT;AA9FgBV;AAmGT,SAAS2D,aAAahF,OAAgC;AAC3D,MAAI,CAACA,MAAO,QAAO;AACnB,SAAOiF,UAAUC,KAAK,CAACC,aAAanF,MAAMmF,QAAAA,MAAc9E,MAAAA,KAAeL,MAA0BI,QAAQC;AAC3G;AAHgB2E;AAYT,SAASlC,cAAcsC,UAAoCC,SAA+B;AAC/F,SAAOA,YAAYhF,UAAa+E,aAAa/E,UAAa+E,SAASrE,SAASsE,OAAAA;AAC9E;AAFgBvC;AAOhB,SAASe,kBACPyB,YACAC,YACA/B,iBAA8B;AAE9B,MAAI8B,WAAY,QAAO;AACvB,MAAIC,WAAY,QAAO;AACvB,MAAI/B,gBAAgBJ,SAAS,EAAG,QAAO;AACvC,SAAO;AACT;AATSS;AAYT,SAASJ,cAAcvC,SAA0BS,mBAAgC;AAC/E,UAAQT,QAAQsE,oBAAoB,CAAA,GAAIhD,OAAO,CAACiD,YAAY,CAAC9D,kBAAkBZ,SAAS0E,OAAAA,CAAAA;AAC1F;AAFShC;AAKF,SAASiC,uBACd1F,OACAmF,UACApF,MAAY;AAEZ,QAAM+B,QAAQ9B,QAAQmF,QAAAA;AACtB,SAAOrD,UAAU,SAASA,OAAOf,SAAShB,IAAAA,KAAS;AACrD;AAPgB2F;AAWhB,SAAS/B,iBACPzC,SACAI,cACAqE,gBACAnE,WACAf,OACAgB,QACA+B,kBAAiC,CAAA,GAAE;AAEnC,QAAMoC,eAAe,IAAIC,IAAIF,iBAAiBlE,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAMqE,YAAYtE,YAAYN,QAAQnB,IAAI;AAE1C,QAAMgG,SAAS7E,QAAQwC,eAAe,CAAA,GAAIlB,OAAO,CAACwD,MAAMA,EAAEC,YAAYD,EAAEnE,WAAWd,SAASO,YAAAA,CAAAA;AAC5F,QAAM4E,OAAOC,gBAAgBJ,KAAAA;AAC7B,QAAMK,QAAQL,MAAMrD,IAAI,CAACsD,MAAMA,EAAEjG,IAAI;AAGrC,QAAMsG,qBAAqB,oBAAIR,IAAAA;AAC/B,QAAMS,qBAAqB,oBAAIT,IAAAA;AAC/B,aAAWG,KAAKD,OAAO;AACrB,QAAI,CAACH,aAAaW,IAAIP,EAAEjG,IAAI,EAAGsG,oBAAmBG,IAAIR,EAAEjG,IAAI;AAC5D,QAAI2F,uBAAuBI,WAAWrE,QAAQuE,EAAEjG,IAAI,EAAGuG,oBAAmBE,IAAIR,EAAEjG,IAAI;EACtF;AACA,QAAM0G,iBAAiB,oBAAIZ,IAAY;OAAIQ;OAAuBC;GAAmB;AACrF,QAAMI,YAAYC,cAAcP,OAAOK,gBAAgBP,IAAAA;AAEvD,SAAOH,MAAMrD,IAAI,CAACsD,MAAAA;AAEhB,UAAMY,UAAU;MAACZ,EAAEjG;SAAS8G,cAAcb,EAAEjG,MAAMmG,IAAAA;;AAClD,UAAMY,WAAWJ,UAAUH,IAAIP,EAAEjG,IAAI;AACrC,UAAMgH,aAAaD,YAAYF,QAAQ1B,KAAK,CAAC8B,MAAMX,mBAAmBE,IAAIS,CAAAA,CAAAA;AAC1E,UAAMC,aAAaH,YAAYF,QAAQ1B,KAAK,CAAC8B,MAAMV,mBAAmBC,IAAIS,CAAAA,CAAAA;AAC1E,UAAMpD,aAAaC,kBAAkBkD,YAAYE,YAAYzD,eAAAA;AAC7D,UAAMM,SAASF,eAAe;AAC9B,UAAMG,cAAcH,eAAe,SAASsD,sBAAsBzG,OAAOS,QAAQnB,MAAM6G,SAASnF,MAAAA,IAAU,CAAA;AAC1G,WAAO;MAAE1B,MAAMiG,EAAEjG;MAAM+D;MAAQF;MAAYG;MAAaP;IAAgB;EAC1E,CAAA;AACF;AArCSG;AAwCT,SAASuD,sBACPzG,OACA0G,aACAP,SACAnF,QAAsB;AAEtB,QAAM2F,SAAmB,CAAA;AACzB,aAAW,CAACrH,MAAMW,IAAAA,KAAST,OAAOC,QAAQO,KAAAA,GAAQ;AAChD,UAAM4G,WAAW3G,KAAKC,sBAAsBwG,WAAAA,IAAe1F,MAAAA;AAC3D,QAAI4F,YAAYT,QAAQU,MAAM,CAACN,MAAMK,SAAStG,SAASiG,CAAAA,CAAAA,EAAKI,QAAOnD,KAAKlE,IAAAA;EAC1E;AACA,SAAOqH;AACT;AAZSF;AAeT,SAASlD,sBACPvD,OACA0G,aACA1F,QAAsB;AAEtB,QAAM2F,SAAmB,CAAA;AACzB,aAAW,CAACrH,MAAMW,IAAAA,KAAST,OAAOC,QAAQO,KAAAA,GAAQ;AAChD,QAAIC,KAAKC,sBAAsBwG,WAAAA,IAAe1F,MAAAA,MAAYpB,OAAW+G,QAAOnD,KAAKlE,IAAAA;EACnF;AACA,SAAOqH;AACT;AAVSpD;AAaF,SAASuD,eAAetG,UAA2BK,cAAgC;AACxF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWX,SAASY,aAAaP,YAAAA;AACvC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,SAAO3B,OAAOkB,OAAOS,SAAS4F,iBAAiB,CAAC,CAAA;AAClD;AALgBD;;;AC9RhB,SAASE,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAMF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,aAAa,CAAC,CAAA;GAAG;AAElG,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,YAAYM,IAAAA,KAAS,CAAC;AAClC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAKA,QAAIJ,UAAUM,MAAM,CAACP,WAAWD,SAASC,MAAAA,MAAYd,MAAAA,EAAY;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA7BgBL;;;ACQhB,IAAMoB,mBAA2D;EAC/DC,KAAK;EACLC,KAAK;EACLC,SAAS;EACTC,SAAS;EACTC,MAAM;AACR;AAUA,IAAMC,cAAc;EAAEC,aAAa;EAAIC,eAAe;EAAIC,aAAa;AAAG;AAqDnE,SAASC,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,WAAWC,UAAUC,UAAUC,OAAOC,kBAAiB,IAAKR;AAItG,QAAMS,SAAyBpB,iBAAiBgB,QAAAA;AAGhD,QAAMK,eAAeC,oBAAoBX,OAAOU,YAAY,KAAK,CAAC;AAGlE,QAAME,gBAAgB,wBAACC,SACrBN,QAAQN,SAASa,WAAWC,mBAAmBF,MAAMN,KAAAA,CAAAA,IAAUS,kBAAkBf,UAAUY,IAAAA,GADvE;AAItB,QAAMI,UAAUC,iBACdjB,UACAC,cACAC,UACAC,WACAK,QACAH,UACAC,OACAC,iBAAAA;AAEF,QAAMW,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAET;IAAMS;GAAE,CAAA;AAIzD,QAAMC,gBAAgBC,OAAOC,YAC3BD,OAAOE,QAAQzB,SAAS0B,WAAWzB,YAAAA,GAAe0B,SAAS,CAAC,CAAA,EAAGP,IAAI,CAAC,CAACR,MAAMgB,IAAAA,MAAU;IACnFhB;IACA;MAAE,GAAGgB;MAAMC,qBAAqBnB,oBAAoBkB,KAAKC,mBAAmB,KAAK,CAAC;IAAE;GACrF,CAAA;AAEH,QAAMC,uBAAuB,oBAAIC,IAAAA;AACjC,MAAI7B,YAAYoB,cAAcpB,QAAAA,GAAW;AACvC,eAAW,CAAC8B,aAAaC,SAAAA,KAAcV,OAAOE,QAAQH,cAAcpB,QAAAA,EAAU2B,uBAAuB,CAAC,CAAA,GAAI;AACxG,UAAII,YAAYzB,MAAAA,MAAY0B,OAAWJ,sBAAqBK,IAAIH,WAAAA;IAClE;EACF;AACA,QAAMI,WAAW,oBAAIjB,IAAAA;AACrB,aAAW,CAACkB,SAAST,IAAAA,KAASL,OAAOE,QAAQH,aAAAA,GAAgB;AAC3D,QAAIe,YAAYnC,SAAU;AAC1B,UAAMoC,OAA8C,CAAA;AACpD,eAAW,CAACN,aAAaC,SAAAA,KAAcV,OAAOE,QAAQG,KAAKC,uBAAuB,CAAC,CAAA,GAAI;AACrF,UAAII,YAAYzB,MAAAA,MAAY0B,UAAaJ,qBAAqBS,IAAIP,WAAAA,EAAc;AAChF,YAAMQ,OAAO7B,cAAcqB,WAAAA,GAAcQ;AACzC,UAAIA,KAAMF,MAAKG,KAAK;QAAE7B,MAAMoB;QAAaQ;MAAK,CAAA;IAChD;AACAJ,aAASM,IAAIL,SAASC,IAAAA;EACxB;AAGA,QAAMK,kBAAkB,oBAAIxB,IAAAA;AAC5B,aAAW,CAACP,MAAMgC,KAAAA,KAAUrB,OAAOE,QAAQhB,gBAAgB,CAAC,CAAA,GAAI;AAE9D,UAAMoC,UAAUD,QAAQpC,MAAAA;AACxB,QAAIqC,YAAYX,OAAW;AAC3B,QAAI,CAACS,gBAAgBJ,IAAI3B,IAAAA,EAAO+B,iBAAgBD,IAAI9B,MAAM,oBAAImB,IAAAA,CAAAA;AAC9D,eAAWe,QAAQD,QAASF,iBAAgBI,IAAInC,IAAAA,GAAOuB,IAAIW,IAAAA;EAC7D;AAGA,QAAMjC,WAAgC,CAAA;AACtC,aAAW,CAACD,MAAMoC,QAAAA,KAAaL,iBAAiB;AAC9C,UAAMM,eAAe/B,WAAW6B,IAAInC,IAAAA;AACpC,QAAI,CAACqC,aAAc;AAKnB,UAAMC,QAAQC,YAAY3C,MAAAA,IAAUd,cAAc0D,qBAAqBH,cAAc7C,QAAAA;AACrF,QAAI,CAAC8C,MAAO;AAGZ,UAAMG,cAAcC,gBAAgB3C,cAAcC,IAAAA,GAAO2C,eAAe,CAAA,CAAE;AAE1E,UAAMC,aAAa,IAAIrC,KAAK8B,aAAaM,eAAe,CAAA,GAAInC,IAAI,CAACqC,MAAM;MAACA,EAAE7C;MAAM6C;KAAE,CAAA;AAClF,UAAMC,eAAe;SAAIC,oBAAoBX,UAAUK,WAAAA;;AACvD,UAAMO,oBAAwCF,aAC3CtC,IAAI,CAACyC,MAAML,WAAWT,IAAIc,CAAAA,CAAAA,EAC1BC,OAAO,CAACL,MAAkC,CAAC,CAACA,GAAGM,MAAAA,EAC/C3C,IAAI,CAACqC,OAAO;MACX7C,MAAM6C,EAAE7C;MACRoD,QAAQP,EAAEQ,cAAc;MACxBC,aAAaT,EAAES,eAAe,CAAA;MAC9BC,iBAAiBV,EAAEU,mBAAmB,CAAA;IACxC,EAAA;AAGF,UAAMC,SACJnB,aAAac,UAAUd,aAAagB,eAAe,UAC9ChB,aAAaiB,eAAe,CAAA,GAC1B9C,IAAI,CAACQ,UAAU;MACdA;MACAf,WAAWuB,SAASW,IAAInB,IAAAA,KAAS,CAAA,GAAIkC,OAAO,CAACzC,MAAMA,EAAET,SAASA,IAAAA,EAAMQ,IAAI,CAACC,MAAMA,EAAEmB,IAAI;IACvF,EAAA,EACCsB,OAAO,CAACO,UAAUA,MAAMxD,SAASyD,SAAS,CAAA,IAC7C,CAAA;AAENzD,aAAS4B,KAAK;MACZ7B;MACA4B,MAAMS,aAAaT;MACnB+B,YAAYtB,aAAasB;MACzBC,UAAUvB,aAAauB;MACvBC,gBAAgBxB,aAAawB;MAC7BlB,aAAaG;MACbK,QAAQd,aAAac,UAAU;MAC/BE,YAAYhB,aAAagB,cAAc;MACvCC,aAAajB,aAAaiB,eAAe,CAAA;MACzCC,iBAAiBlB,aAAakB,mBAAmB,CAAA;MACjDP;MACAQ;MACAlB;MACAwB,SAASzB,aAAayB;MACtBC,SAAS1B,aAAa0B;MACtBC,SAAS3B,aAAa2B;MACtBC,cAAc5B,aAAa4B;IAC7B,CAAA;EACF;AAIAhE,WAASiE,KAAK,CAACC,GAAGC,MAAMD,EAAEJ,QAAQM,cAAcD,EAAEL,OAAO,CAAA;AAEzD,SAAO9D;AACT;AA/HgBf;AAkIT,SAASsD,qBACd8B,OAaA9E,UAAwB;AAIxB,MAAIA,aAAa,aAAaA,aAAa,OAAQ,QAAO;AAC1D,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAAC8E,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLxF,aAAaS,aAAa,QAAQ8E,MAAMC,OAAOC,iBAAiBF,MAAMC,OAAOE;MAC7EzF,eAAesF,MAAMC,OAAOvF;MAC5BC,aAAaqF,MAAMC,OAAOtF;IAC5B;EACF;AAEA,MAAI,CAACqF,MAAM7F,IAAK,QAAO;AACvB,SAAO;IACLM,aAAauF,MAAM7F,IAAIM;IACvBC,eAAesF,MAAM7F,IAAIO;IACzBC,aAAaqF,MAAM7F,IAAIQ;EACzB;AACF;AAlCgBuD;;;AClKT,SAASkC,gBACdC,UACAC,cACAC,UACAC,WACAC,UAAmB;AAEnB,SAAOC,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,OAAOC,QAAAA;AACzE;AARgBL;AAWT,SAASO,gBACdN,UACAC,cACAC,UACAC,WAA4B;AAE5B,SAAOE,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,IAAA;AAClE;AAPgBG;AAUhB,SAASD,YACPL,UACAC,cACAC,UACAC,WACAI,WACAH,UAAmB;AAEnB,QAAMI,WAAWP,eAAeD,SAASS,aAAaR,YAAAA,IAAgBS;AAEtE,QAAMC,QAAQC,OAAOC,YACnBD,OAAOE,QAAQN,UAAUG,SAAS,CAAC,CAAA,EAAGI,IAAI,CAAC,CAACC,MAAMC,CAAAA,MAAO;IACvDD;IACA;MAAE,GAAGC;MAAGC,qBAAqBC,oBAAoBF,EAAEC,mBAAmB,KAAK,CAAC;IAAE;GAC/E,CAAA;AAEH,QAAME,OAAOlB,WAAWS,MAAMT,QAAAA,IAAYQ;AAC1C,QAAMW,WAAW;IAAEL,MAAMd,YAAY;IAAIoB,MAAMF,MAAME,QAAQpB,YAAY;EAAG;AAC5E,QAAMqB,kBAAkBJ,oBAAoBhB,SAAAA;AAC5C,QAAMqB,QAAQD,mBAAmB,CAAC;AAClC,MAAI,CAACf,YAAY,CAACY,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAwB,CAAA;AAC9B,aAAWC,OAAOlB,SAASiB,MAAM;AAC/B,QAAIE,gBAAgB;AACpB,QAAIC,aAAa;AACjB,UAAMC,WAAgC,CAAA;AAEtC,eAAWC,OAAOJ,IAAIG,UAAU;AAC9B,UAAI,CAACtB,aAAauB,IAAIC,UAAU,OAAQ;AACxC,YAAMf,OAAOc,IAAId;AACjB,YAAMgB,UAAUhC,SAAS6B,WAAWI,mBAAmBjB,MAAMc,IAAIC,KAAK,CAAA;AACtE,UAAI,CAACC,QAAS;AACd,UAAI5B,aAAaM,UAAa,CAACwB,qBAAqBF,QAAQG,qBAAqB/B,QAAAA,EAAW;AAK5F,YAAMgC,YAA8B;WAC/BC,aAAaC,OAAO,CAACrB,MAAM,CAAC,CAACe,QAAQO,iBAAiBtB,CAAAA,CAAE;WACxDuB,YAAYF,OACb,CAACG,MAAMT,QAAQU,gBAAgBhC,UAAasB,QAAQU,YAAYC,SAASC,kBAAkBH,CAAAA,CAAE,CAAA;;AAIjG,YAAMI,aAAazB,KAAKF,sBAAsBF,IAAAA;AAC9C,YAAM8B,gBAAgBC,aAAaF,UAAAA;AACnC,YAAMG,YAAYzB,kBAAkBP,IAAAA;AAEpC,YAAMiC,eAAuCjB,QAAQiB,eAAe,CAAA,GACjEX,OAAO,CAACrB,MAAMA,EAAEiC,YAAYjC,EAAER,WAAWkC,SAAS1C,gBAAgB,EAAA,CAAA,EAClEc,IAAI,CAACE,MAAAA;AACJ,cAAMkC,OAAO,wBAACC,SAAAA;AACZ,cAAI,CAAChB,UAAUO,SAASS,IAAAA,EAAO,QAAO;AACtC,gBAAMC,YAAYR,aAAaO,IAAAA;AAC/B,gBAAME,SAASR,iBAAiBO,cAAc3C,UAAa2C,UAAUV,SAAS1B,EAAED,IAAI;AAEpF,gBAAMuC,WAAWD,UAAU,CAACE,uBAAuBR,WAAWI,MAAMnC,EAAED,IAAI;AAC1E,gBAAMyC,cAAcH,SAAS,CAAA,IAAKI,mBAAmB/C,OAAOK,MAAMC,EAAED,MAAMoC,MAAMlD,QAAAA;AAChF0B,wBAAc;AACd,cAAI0B,OAAQ3B,kBAAiB;AAC7B,iBAAO;YAAE2B;YAAQC;YAAUE;UAAY;QACzC,GAVa;AAWb,eAAO;UACLzC,MAAMC,EAAED;UACR2C,OAAO1C,EAAE0C;UACTC,WAAW3C,EAAE2C,aAAa,CAAA;UAC1BC,KAAKV,KAAK,KAAA;UACVW,QAAQX,KAAK,QAAA;UACbY,SAASZ,KAAK,SAAA;UACda,MAAMb,KAAK,MAAA;QACb;MACF,CAAA;AAEFtB,eAASoC,KAAK;QACZjD,MAAMgB,QAAQhB;QACdM,MAAMU,QAAQV;QACd4C,MAAMlC,QAAQmC,cAAc;QAC5BpC,OAAOC,QAAQD;QACfI,qBAAqBH,QAAQG;QAC7BC;QACAkB,QAAQR;QACRW,aAAaX,gBAAgB,CAAA,IAAKsB,uBAAsBzD,OAAOK,MAAMd,QAAAA;QACrEwC,aAAaV,QAAQU;QACrBO;MACF,CAAA;IACF;AAEA,QAAIpB,SAASwC,WAAW,EAAG;AAC3B5C,SAAKwC,KAAK;MAAEjD,MAAMU,IAAIV;MAAMM,MAAMI,IAAIJ;MAAM4C,MAAMxC,IAAIwC,QAAQ;MAAMvC;MAAeC;MAAYC;IAAS,CAAA;EAC1G;AAGAJ,OAAK6C,KAAK,CAACC,GAAG9B,MAAM8B,EAAEjD,KAAKkD,cAAc/B,EAAEnB,IAAI,CAAA;AAE/C,SAAO;IAAEF,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AAhGSnB;AAmGT,SAASqD,mBACP/C,OACA8D,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAAC7D,MAAMC,CAAAA,KAAML,OAAOE,QAAQH,KAAAA,GAAQ;AAC7C,QAAIK,SAAS4D,YAAa;AAC1B,SAAK3D,EAAEC,sBAAsBuD,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAIhC,SAAS+B,QAAAA,EAAWG,OAAMZ,KAAKhD,EAAEK,IAAI;EACpG;AACA,SAAOuD;AACT;AAbSnB;AAgBT,SAASU,uBACPzD,OACA8D,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAAC7D,MAAMC,CAAAA,KAAML,OAAOE,QAAQH,KAAAA,GAAQ;AAC7C,QAAIK,SAAS4D,YAAa;AAC1B,QAAI7B,aAAa9B,EAAEC,sBAAsBuD,WAAAA,CAAY,EAAGI,OAAMZ,KAAKhD,EAAEK,IAAI;EAC3E;AACA,SAAOuD;AACT;AAXST,OAAAA,wBAAAA;","names":["buildDependsMap","permissions","present","Set","map","p","code","Map","set","dependsOn","filter","dep","has","prereqClosure","deps","out","seen","stack","length","current","pop","get","add","push","cascadeLocked","codes","directlyLocked","locked","visiting","check","viaDep","some","delete","filterGrantedByDeps","granted","ok","satisfied","every","PLATFORMS","UI_PLATFORMS","API_SURFACES","API_BUCKETS","SURFACE_BY_BUCKET","graphql","http","BUCKET_BY_SURFACE","GRAPHQL","HTTP","isApiBucket","bucket","SITE_TYPES","SERVICE_CODES","snapshotFeatureKey","code","scope","SNAPSHOT_SCHEMA_VERSION","normalizeApiBuckets","doc","changed","next","code","entry","Object","entries","legacy","app","undefined","graphql","http","normalizePlans","plans","plan","unlockedPermissions","featureAppliesAtNode","applicableSiteTypes","siteType","includes","findFeatureByCode","snapshot","feature","values","features","buildSiteCatalog","businessCode","planCode","siteLocks","bucket","scope","availableServices","business","businesses","locks","catalog","sortedApps","apps","sort","a","b","name","localeCompare","businessAppFeatures","filter","ref","map","snapshotFeatureKey","f","isApiBucket","surfaceAllows","apiSurfaces","SURFACE_BY_BUCKET","microfrontends","web","mobile","length","membership","memberOnBucket","sitePlatformLocked","missingServices","unmetServices","permissions","buildPermissions","lockReason","resolveLockReason","locked","unlockPlans","plansIncludingFeature","push","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","PLATFORMS","some","platform","surfaces","surface","planLocked","siteLocked","requiredServices","service","isSiteLockedOnPlatform","planMembership","planUnlocked","Set","lockEntry","perms","p","isGlobal","deps","buildDependsMap","codes","directlyPlanLocked","directlySiteLocked","has","add","directlyLocked","lockedSet","cascadeLocked","closure","prereqClosure","cascaded","planReason","c","siteReason","plansUnlockingClosure","featureCode","result","unlocked","every","buildSiteRoles","roleTemplates","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","every","BUCKET_BY_CLIENT","web","ios","android","graphql","http","EMPTY_ROUTE","remoteEntry","exposedModule","routePrefix","resolveUserFeatures","params","snapshot","businessCode","planCode","siteLocks","platform","siteType","scope","availableServices","bucket","roleFeatures","normalizeApiBuckets","featureByCode","code","features","snapshotFeatureKey","findFeatureByCode","catalog","buildSiteCatalog","catalogMap","Map","map","f","businessPlans","Object","fromEntries","entries","businesses","plans","plan","unlockedPermissions","currentUnlockedCodes","Set","featureCode","platforms","undefined","add","planAdds","planKey","adds","has","name","push","set","grantedFeatures","grant","granted","perm","get","permsSet","catalogEntry","route","isApiBucket","pickRouteForPlatform","featureDeps","buildDependsMap","permissions","permByCode","p","grantedPerms","filterGrantedByDeps","lockedPermissions","c","filter","locked","reason","lockReason","unlockPlans","missingServices","upsell","group","length","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","sort","a","b","localeCompare","entry","mobile","remoteEntryIos","remoteEntryAndroid","buildSiteMatrix","snapshot","businessCode","planCode","siteLocks","siteType","buildMatrix","buildPlanMatrix","allScopes","business","businesses","undefined","plans","Object","fromEntries","entries","map","code","p","unlockedPermissions","normalizeApiBuckets","plan","planMeta","name","normalizedLocks","locks","apps","app","unlockedCount","totalCount","features","ref","scope","feature","snapshotFeatureKey","featureAppliesAtNode","applicableSiteTypes","platforms","UI_PLATFORMS","filter","microfrontends","API_BUCKETS","b","apiSurfaces","includes","SURFACE_BY_BUCKET","membership","featureInPlan","isPlanMember","siteEntry","permissions","isGlobal","cell","plat","planCodes","inPlan","selected","isSiteLockedOnPlatform","availableIn","plansUnlockingPerm","label","dependsOn","web","mobile","graphql","http","push","icon","lucideIcon","plansIncludingFeature","length","sort","a","localeCompare","featureCode","permCode","platform","excludeCode","names"]}
+{"version":3,"sources":["../src/catalog-resolver/index.ts","../src/catalog-resolver/permission-deps.ts","../src/catalog-resolver/types.ts","../src/catalog-resolver/catalog.builder.ts","../src/catalog-resolver/compose-role-grants.ts","../src/catalog-resolver/resolve-user-features.ts","../src/catalog-resolver/site-matrix.builder.ts"],"sourcesContent":["// Catalog resolver — the single shared implementation of snapshot resolution (BU catalog, BU matrix, user features)\n\nexport {\n  buildSiteCatalog,\n  buildSiteRoles,\n  featureAppliesAtNode,\n  findFeatureByCode,\n  isPlanMember,\n  isSiteLockedOnPlatform,\n  surfaceAllows,\n} from './catalog.builder';\nexport { type ComposeRoleGrantsParams, composeRoleGrants, type RevokedGrants } from './compose-role-grants';\nexport {\n  buildDependsMap,\n  cascadeLocked,\n  type DependsMap,\n  filterGrantedByDeps,\n  prereqClosure,\n} from './permission-deps';\nexport {\n  type ClientPlatform,\n  type LockedPermission,\n  type PermissionFeature,\n  pickRouteForPlatform,\n  type ResolveUserFeaturesParams,\n  resolveUserFeatures,\n} from './resolve-user-features';\nexport {\n  buildPlanMatrix,\n  buildSiteMatrix,\n  type SiteMatrix,\n  type SiteMatrixApp,\n  type SiteMatrixCell,\n  type SiteMatrixFeature,\n  type SiteMatrixPermission,\n} from './site-matrix.builder';\nexport {\n  API_BUCKETS,\n  API_SURFACES,\n  type ApiBucket,\n  type ApiSurface,\n  BUCKET_BY_SURFACE,\n  type BusinessVocabulary,\n  type CatalogPermission,\n  type FeatureCatalogEntry,\n  type FeatureLocks,\n  type FeatureUnlocks,\n  isApiBucket,\n  type LockReason,\n  type PermissionGroupRef,\n  PLATFORMS,\n  type PlatformBucket,\n  type PlatformCodes,\n  type PlatformDenyCodes,\n  type RoleItem,\n  type ScopeType,\n  SERVICE_CODES,\n  type ServiceCode,\n  SITE_TYPES,\n  type SiteFeatureLocks,\n  type SiteType,\n  SNAPSHOT_SCHEMA_VERSION,\n  type SnapshotApp,\n  type SnapshotAppFeatureRef,\n  type SnapshotBusiness,\n  type SnapshotFeature,\n  type SnapshotMicrofrontendMobile,\n  type SnapshotMicrofrontends,\n  type SnapshotMicrofrontendWeb,\n  type SnapshotPermission,\n  type SnapshotPlan,\n  type SnapshotRoleTemplate,\n  SURFACE_BY_BUCKET,\n  snapshotFeatureKey,\n  UI_PLATFORMS,\n  type UiPlatformBucket,\n  type VersionSnapshot,\n  type VocabularyEntry,\n} from './types';\n","// Intra-feature permission prerequisites — only DIRECT edges are declared; the transitive closure is computed by recursion, cycle-guarded\n\nexport type DependsMap = Map<string, string[]>;\n\n// Builds a dependency map from a feature's permissions, keeping only edges to codes present in the set\nexport function buildDependsMap(permissions: Array<{ code: string; dependsOn?: string[] }>): DependsMap {\n  const present = new Set(permissions.map((p) => p.code));\n  const map: DependsMap = new Map();\n  for (const p of permissions) {\n    map.set(\n      p.code,\n      (p.dependsOn ?? []).filter((dep) => dep !== p.code && present.has(dep)),\n    );\n  }\n  return map;\n}\n\n// Transitive prerequisite closure of a code (excludes the code itself), cycle-safe\nexport function prereqClosure(code: string, deps: DependsMap): string[] {\n  const out = new Set<string>();\n  const seen = new Set<string>([code]);\n  const stack = [code];\n  while (stack.length > 0) {\n    const current = stack.pop() as string;\n    for (const dep of deps.get(current) ?? []) {\n      if (seen.has(dep)) continue;\n      seen.add(dep);\n      out.add(dep);\n      stack.push(dep);\n    }\n  }\n  return [...out];\n}\n\n// Codes locked after cascade: a code is locked if directly locked or any transitive prerequisite is (cycle-safe)\nexport function cascadeLocked(codes: string[], directlyLocked: Set<string>, deps: DependsMap): Set<string> {\n  const locked = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (locked.has(code)) return true;\n    if (directlyLocked.has(code)) {\n      locked.add(code);\n      return true;\n    }\n    if (visiting.has(code)) return false;\n    visiting.add(code);\n    const viaDep = (deps.get(code) ?? []).some(check);\n    visiting.delete(code);\n    if (viaDep) locked.add(code);\n    return viaDep;\n  };\n  for (const code of codes) check(code);\n  return locked;\n}\n\n// Keeps only codes whose FULL prerequisite closure is also present — drops a dependent missing any prerequisite (cycle-safe)\nexport function filterGrantedByDeps(granted: Set<string>, deps: DependsMap): Set<string> {\n  const ok = new Set<string>();\n  const visiting = new Set<string>();\n  const check = (code: string): boolean => {\n    if (ok.has(code)) return true;\n    if (!granted.has(code)) return false;\n    if (visiting.has(code)) return true;\n    visiting.add(code);\n    const satisfied = (deps.get(code) ?? []).every(check);\n    visiting.delete(code);\n    if (satisfied) ok.add(code);\n    return satisfied;\n  };\n  for (const code of granted) check(code);\n  return ok;\n}\n","// ——— Platform algebra — plan unlocks, role grants, and BU locks are all stored per platform bucket ———\n\n/**\n * The surfaces a permission can be granted on.\n *\n * `web` and `mobile` are UI buckets: a feature reaches them through a microfrontend, and a grant\n * there means a person can operate it on that surface. `graphql` and `http` are not UIs at all —\n * each is an API surface a credential signs its own requests against, so they have no\n * microfrontend and no route, and a feature needs neither to be reachable on one.\n *\n * Keeping the API buckets in the same algebra rather than beside it is what lets plan entitlement,\n * node feature locks and permission prerequisites bind an API client exactly as they bind a person.\n * One bucket per surface is what lets a plan entitle GraphQL and HTTP access independently.\n */\nexport type PlatformBucket = 'web' | 'mobile' | 'graphql' | 'http';\n\nexport const PLATFORMS: PlatformBucket[] = ['web', 'mobile', 'graphql', 'http'];\n\n/** Buckets that reach their feature through a microfrontend, and so require one to resolve. */\nexport type UiPlatformBucket = 'web' | 'mobile';\n\nexport const UI_PLATFORMS: UiPlatformBucket[] = ['web', 'mobile'];\n\n// The API surfaces an app credential can present — literally the values of core's `app_type` enum, so\n// enforcement is a plain lookup with no mapping. A feature declares which surfaces expose it.\nexport const API_SURFACES = ['GRAPHQL', 'HTTP'] as const;\nexport type ApiSurface = (typeof API_SURFACES)[number];\n\n/** Buckets that admit an API credential rather than a person — exactly one per surface. */\nexport type ApiBucket = Exclude<PlatformBucket, UiPlatformBucket>;\n\nexport const API_BUCKETS: ApiBucket[] = ['graphql', 'http'];\n\nexport const SURFACE_BY_BUCKET: Record<ApiBucket, ApiSurface> = { graphql: 'GRAPHQL', http: 'HTTP' };\nexport const BUCKET_BY_SURFACE: Record<ApiSurface, ApiBucket> = { GRAPHQL: 'graphql', HTTP: 'http' };\n\nexport function isApiBucket(bucket: PlatformBucket): bucket is ApiBucket {\n  return bucket === 'graphql' || bucket === 'http';\n}\n\nexport interface PlatformCodes {\n  web?: string[];\n  mobile?: string[];\n  graphql?: string[];\n  http?: string[];\n}\n\nexport interface PlatformDenyCodes {\n  web?: string[] | null;\n  mobile?: string[] | null;\n  graphql?: string[] | null;\n  http?: string[] | null;\n}\n\nexport type FeatureUnlocks = Record<string, PlatformCodes>;\n\nexport type FeatureLocks = Record<string, PlatformDenyCodes>;\nexport type SiteFeatureLocks = FeatureLocks;\n\n// ——— Snapshot document shape — what gets stored in versions.snapshot and signed into the catalog license ———\n\nexport interface PermissionGroupRef {\n  code: string;\n  label: string;\n  sortOrder: number;\n}\n\nexport interface SnapshotPermission {\n  code: string;\n  label: string;\n  isGlobal: boolean;\n  businesses: string[];\n  dependsOn: string[];\n  platforms: PlatformBucket[];\n  // Code of the group this action sits under, resolved against the feature's `permissionGroups`.\n  // Absent on a feature's own actions, which head the list under no heading.\n  group?: string;\n}\nexport interface SnapshotMicrofrontendWeb {\n  code: string;\n  name: string;\n  remoteEntry: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontendMobile {\n  code: string;\n  name: string;\n  remoteEntryAndroid: string;\n  remoteEntryIos: string;\n  exposedModule: string;\n  routePrefix: string;\n}\nexport interface SnapshotMicrofrontends {\n  web?: SnapshotMicrofrontendWeb;\n  mobile?: SnapshotMicrofrontendMobile;\n}\nexport type ScopeType = 'ORG' | 'LE' | 'SITE_GROUP' | 'SITE';\nexport type SiteType = 'OUTLET' | 'WAREHOUSE' | 'PRODUCTION';\nexport const SITE_TYPES: SiteType[] = ['OUTLET', 'WAREHOUSE', 'PRODUCTION'];\n// External services a feature can depend on — the org must have the service provisioned before the feature\n// unlocks. Add new services here and nowhere else in this package; every lock path is service-agnostic.\nexport const SERVICE_CODES = ['GITEA'] as const;\nexport type ServiceCode = (typeof SERVICE_CODES)[number];\nexport interface SnapshotFeature {\n  code: string;\n  name: string;\n  lucideIcon: string;\n  sfSymbol: string;\n  materialSymbol: string;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  permissions: SnapshotPermission[];\n  microfrontends: SnapshotMicrofrontends;\n  requiredServices: ServiceCode[];\n  // The feature's sub-resources, carried once rather than repeated on each of their permissions\n  permissionGroups: PermissionGroupRef[];\n  // Strict — it decides which of the `graphql`/`http` buckets the feature offers at all, and `[]` offers neither\n  apiSurfaces: ApiSurface[];\n}\nexport interface SnapshotAppFeatureRef {\n  code: string;\n  scope: ScopeType;\n}\nexport interface SnapshotApp {\n  code: string;\n  name: string;\n  icon: string;\n  sortOrder: number;\n  features: SnapshotAppFeatureRef[];\n}\nexport interface SnapshotRoleTemplate {\n  name: string;\n  code: string;\n  scope: ScopeType;\n  siteType: SiteType;\n  features: FeatureUnlocks;\n}\nexport interface SnapshotPlan {\n  code: string;\n  name: string;\n  isCustom: boolean;\n  maxSites: number | null;\n  unlockedPermissions: FeatureUnlocks;\n}\nexport interface VocabularyEntry {\n  singular: string;\n  plural: string;\n}\nexport interface BusinessVocabulary {\n  site?: VocabularyEntry;\n  siteGroup?: VocabularyEntry;\n  outlet?: VocabularyEntry;\n  warehouse?: VocabularyEntry;\n  production?: VocabularyEntry;\n}\nexport interface SnapshotBusiness {\n  name: string;\n  vocabulary?: BusinessVocabulary;\n  apps: SnapshotApp[];\n  roleTemplates: Record<string, SnapshotRoleTemplate>;\n  plans: Record<string, SnapshotPlan>;\n}\nexport interface VersionSnapshot {\n  schemaVersion?: number;\n  // Flat feature dictionary keyed by `${scope}.${code}` (see snapshotFeatureKey) — same-code features at different scopes stay distinct\n  features: Record<string, SnapshotFeature>;\n  businesses: Record<string, SnapshotBusiness>;\n}\n\n// Composite key for the snapshot feature dictionary — feature identity is (scope, code)\nexport function snapshotFeatureKey(code: string, scope: ScopeType): string {\n  return `${scope}.${code}`;\n}\n\nexport const SNAPSHOT_SCHEMA_VERSION = 5;\n\n// SERVICE = the org has not provisioned an external service the feature declares; the specific services are\n// reported alongside in `missingServices` so callers never branch on a service code baked into this union\nexport type LockReason = 'PLAN' | 'SITE' | 'SERVICE';\n\nexport interface CatalogPermission {\n  code: string;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface FeatureCatalogEntry {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  web: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  mobile: {\n    remoteEntryAndroid: string;\n    remoteEntryIos: string;\n    exposedModule: string;\n    routePrefix: string;\n  } | null;\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n  permissions: CatalogPermission[];\n}\n\nexport type RoleItem = SnapshotRoleTemplate;\n","import { buildDependsMap, cascadeLocked, prereqClosure } from './permission-deps';\nimport type {\n  ApiSurface,\n  CatalogPermission,\n  FeatureCatalogEntry,\n  LockReason,\n  PlatformBucket,\n  PlatformCodes,\n  RoleItem,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  SnapshotFeature,\n  SnapshotPlan,\n  VersionSnapshot,\n} from './types';\nimport { isApiBucket, PLATFORMS, SURFACE_BY_BUCKET, snapshotFeatureKey } from './types';\n\n// Whether a feature with the given site-type applicability is exposed at this site type\nexport function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean {\n  return applicableSiteTypes.includes(siteType);\n}\n\n// Scope-agnostic lookup of a feature by bare code — grants/locks key features by code alone, so the first scope-variant's shared metadata (permission graph) answers\nexport function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined {\n  for (const feature of Object.values(snapshot.features)) {\n    if (feature.code === code) return feature;\n  }\n  return undefined;\n}\n\n// Builds the per-site catalog for ONE platform bucket — plan is the ceiling, siteLocks is a deny-list within it; each permission carries locked + lockReason + unlockPlans\n// availableServices defaults to none, so a caller that doesn't know the org's provisioned services locks every service-dependent feature rather than leaking it\nexport function buildSiteCatalog(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  bucket: PlatformBucket,\n  siteType?: SiteType,\n  scope?: ScopeType,\n  availableServices: ServiceCode[] = [],\n): FeatureCatalogEntry[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses[businessCode];\n  if (!business) return [];\n  const plans = business.plans;\n  const plan = planCode ? plans[planCode] : undefined;\n  const locks = siteLocks;\n\n  const catalog: FeatureCatalogEntry[] = [];\n  // Iterate apps alphabetically by name so the resolved feature list (→ core-web sidebar) is app-alphabetical without any frontend re-sort\n  const sortedApps = [...business.apps].sort((a, b) => a.name.localeCompare(b.name));\n  for (const app of sortedApps) {\n    // The app's renderable features (each ref pins scope+code to one app), dropped when they don't belong to this workspace scope or node type (outlet vs container)\n    const businessAppFeatures = app.features\n      .filter((ref) => scope === undefined || ref.scope === scope)\n      .map((ref) => snapshot.features[snapshotFeatureKey(ref.code, ref.scope)])\n      .filter(\n        (f): f is SnapshotFeature =>\n          !!f &&\n          // A UI bucket needs something to render, so a feature shipping no microfrontend is dropped.\n          // An API bucket renders nothing — there a feature is admitted by the surfaces it declares\n          // instead, so a GRAPHQL credential never resolves an HTTP-only feature. A surface-excluded\n          // feature vanishes from the catalog entirely, which is what makes resolution fail closed.\n          (isApiBucket(bucket)\n            ? surfaceAllows(f.apiSurfaces, SURFACE_BY_BUCKET[bucket])\n            : !!(f.microfrontends?.web || f.microfrontends?.mobile)) &&\n          (siteType === undefined || featureAppliesAtNode(f.applicableSiteTypes, siteType)),\n      );\n\n    if (businessAppFeatures.length === 0) continue;\n\n    // Emit EVERY business feature so a role's grant on a plan-omitted feature still resolves as a locked tile instead of vanishing\n    for (const feature of businessAppFeatures) {\n      const membership = plan?.unlockedPermissions[feature.code];\n      // Routes are exposed wherever the feature SHIPS — membership never hides them\n      const web = feature.microfrontends?.web;\n      const mobile = feature.microfrontends?.mobile;\n\n      // Feature-level lock is EXPLICIT: plan must include the feature on this bucket, the site must not null-lock\n      // the platform, and every external service the feature declares must be provisioned for the org\n      const memberOnBucket = membership?.[bucket] !== undefined;\n      const sitePlatformLocked = locks?.[feature.code]?.[bucket] === null;\n      const missingServices = unmetServices(feature, availableServices);\n      // Unmet services lock every permission too — otherwise the feature reads locked while its actions still\n      // report as available, which is not how plan and site locks behave\n      const permissions = buildPermissions(feature, businessCode, membership, locks, plans, bucket, missingServices);\n      const lockReason = resolveLockReason(!memberOnBucket, sitePlatformLocked, missingServices);\n      const locked = lockReason !== null;\n      const unlockPlans = lockReason === 'PLAN' ? plansIncludingFeature(plans, feature.code, bucket) : [];\n\n      catalog.push({\n        code: feature.code,\n        name: feature.name,\n        lucideIcon: feature.lucideIcon ?? null,\n        sfSymbol: feature.sfSymbol ?? 'square',\n        materialSymbol: feature.materialSymbol ?? 'square',\n        web: web\n          ? {\n              remoteEntry: web.remoteEntry ?? '',\n              exposedModule: web.exposedModule ?? '',\n              routePrefix: web.routePrefix ?? '',\n            }\n          : null,\n        mobile: mobile\n          ? {\n              remoteEntryAndroid: mobile.remoteEntryAndroid ?? '',\n              remoteEntryIos: mobile.remoteEntryIos ?? '',\n              exposedModule: mobile.exposedModule ?? '',\n              routePrefix: mobile.routePrefix ?? '',\n            }\n          : null,\n        appCode: app.code,\n        appName: app.name,\n        appIcon: app.icon ?? null,\n        appSortOrder: app.sortOrder ?? 0,\n        locked,\n        lockReason,\n        unlockPlans,\n        missingServices,\n        permissions,\n      });\n    }\n  }\n  return catalog;\n}\n\n// A feature is a plan member when its unlock entry exists on at least one platform (even with zero actions)\nexport function isPlanMember(entry: PlatformCodes | undefined): boolean {\n  if (!entry) return false;\n  return PLATFORMS.some((platform) => entry[platform] !== undefined);\n}\n\n/**\n * Whether a feature's declared API surfaces admit a caller's surface.\n *\n * Lenient only about the caller: resolving without a surface (cloud's matrix builders, UI buckets)\n * filters nothing. The declared list is always strict — including `[]`, which admits no surface.\n */\nexport function surfaceAllows(surfaces: ApiSurface[], surface: ApiSurface | undefined): boolean {\n  return surface === undefined || surfaces.includes(surface);\n}\n\n// The one place lock precedence is decided, for features and permissions alike; null means nothing locks.\n// Plan is the ceiling (an unentitled feature must upsell, not send the user to provision something they still\n// couldn't use), then the site deny-list, then any unprovisioned service.\nfunction resolveLockReason(\n  planLocked: boolean,\n  siteLocked: boolean,\n  missingServices: ServiceCode[],\n): LockReason | null {\n  if (planLocked) return 'PLAN';\n  if (siteLocked) return 'SITE';\n  if (missingServices.length > 0) return 'SERVICE';\n  return null;\n}\n\n// The services a feature declares that this org has not provisioned\nfunction unmetServices(feature: SnapshotFeature, availableServices: ServiceCode[]): ServiceCode[] {\n  return feature.requiredServices.filter((service) => !availableServices.includes(service));\n}\n\n// Per-platform site-lock primitive: null locks the whole feature, string[] locks those codes, absent = not locked\nexport function isSiteLockedOnPlatform(\n  entry: SiteFeatureLocks[string] | undefined,\n  platform: PlatformBucket,\n  code: string,\n): boolean {\n  const locks = entry?.[platform];\n  return locks === null || (locks?.includes(code) ?? false);\n}\n\n// A feature's business-scoped permissions, each tagged with locked + reason against the plan and site deny-list\n// (bucket-scoped). Unmet services lock the whole set — an unprovisioned service blocks every action on the feature.\nfunction buildPermissions(\n  feature: SnapshotFeature,\n  businessCode: string,\n  planMembership: PlatformCodes | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  plans: Record<string, SnapshotPlan>,\n  bucket: PlatformBucket,\n  missingServices: ServiceCode[] = [],\n): CatalogPermission[] {\n  const planUnlocked = new Set(planMembership?.[bucket] ?? []);\n  const lockEntry = siteLocks?.[feature.code];\n\n  // Two filters, and the second is the point: a feature reaching this surface does not mean every\n  // action under it does. A code omits the bucket when no route there enforces it, so offering it\n  // would promise a capability nothing can check.\n  const perms = feature.permissions\n    .filter((p) => p.isGlobal || p.businesses.includes(businessCode))\n    .filter((p) => p.platforms.includes(bucket));\n  const deps = buildDependsMap(perms);\n  const codes = perms.map((p) => p.code);\n\n  // Direct plan/site locks, then cascade so a locked prerequisite (e.g. view) locks its dependents (add/edit/delete)\n  const directlyPlanLocked = new Set<string>();\n  const directlySiteLocked = new Set<string>();\n  for (const p of perms) {\n    if (!planUnlocked.has(p.code)) directlyPlanLocked.add(p.code);\n    if (isSiteLockedOnPlatform(lockEntry, bucket, p.code)) directlySiteLocked.add(p.code);\n  }\n  const directlyLocked = new Set<string>([...directlyPlanLocked, ...directlySiteLocked]);\n  const lockedSet = cascadeLocked(codes, directlyLocked, deps);\n\n  return perms.map((p) => {\n    // A permission is enabled only if it AND its whole prerequisite closure are unlocked — reason/upsell reflect that\n    const closure = [p.code, ...prereqClosure(p.code, deps)];\n    const cascaded = lockedSet.has(p.code);\n    const planReason = cascaded && closure.some((c) => directlyPlanLocked.has(c));\n    const siteReason = cascaded && closure.some((c) => directlySiteLocked.has(c));\n    const lockReason = resolveLockReason(planReason, siteReason, missingServices);\n    const locked = lockReason !== null;\n    const unlockPlans = lockReason === 'PLAN' ? plansUnlockingClosure(plans, feature.code, closure, bucket) : [];\n    return { code: p.code, locked, lockReason, unlockPlans, missingServices };\n  });\n}\n\n// Plan codes (in the business) whose unlocked set includes the permission AND its whole prerequisite closure — upsell targets\nfunction plansUnlockingClosure(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  closure: string[],\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    const unlocked = plan.unlockedPermissions[featureCode]?.[bucket];\n    if (unlocked && closure.every((c) => unlocked.includes(c))) result.push(code);\n  }\n  return result;\n}\n\n// Plan codes (in the business) that include this feature on the bucket — the feature-level upsell targets\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  bucket: PlatformBucket,\n): string[] {\n  const result: string[] = [];\n  for (const [code, plan] of Object.entries(plans)) {\n    if (plan.unlockedPermissions[featureCode]?.[bucket] !== undefined) result.push(code);\n  }\n  return result;\n}\n\n// The business's role templates as provisionable role items for core (identical shapes)\nexport function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[] {\n  if (!businessCode) return [];\n  const business = snapshot.businesses[businessCode];\n  if (!business) return [];\n  return Object.values(business.roleTemplates);\n}\n","import { type FeatureUnlocks, PLATFORMS, type PlatformCodes, type PlatformDenyCodes } from './types';\n\nexport type RevokedGrants = Record<string, PlatformDenyCodes>;\n\nexport interface ComposeRoleGrantsParams {\n  baseFeatures: FeatureUnlocks | undefined;\n  additions: FeatureUnlocks;\n  revoked: RevokedGrants | undefined;\n}\n\n// Deduped union of two optional code lists — undefined on both sides means no platform membership\nfunction unionBucket(base: string[] | undefined, add: string[] | undefined): string[] | undefined {\n  if (base === undefined && add === undefined) return undefined;\n  return [...new Set([...(base ?? []), ...(add ?? [])])];\n}\n\n// Composes a custom role's effective grants: merge(base ∪ additions) − revoked (design doc §10); inputs are never mutated\nexport function composeRoleGrants(params: ComposeRoleGrantsParams): FeatureUnlocks {\n  const { baseFeatures, additions, revoked } = params;\n\n  const result: FeatureUnlocks = {};\n  const featureCodes = new Set([...Object.keys(baseFeatures ?? {}), ...Object.keys(additions)]);\n\n  for (const code of featureCodes) {\n    const base = baseFeatures?.[code] ?? {};\n    const add = additions[code] ?? {};\n    const revokes = revoked?.[code];\n\n    const composed: PlatformCodes = {};\n    for (const bucket of PLATFORMS) {\n      const merged = unionBucket(base[bucket], add[bucket]);\n      if (merged === undefined) continue;\n      const revoke = revokes?.[bucket];\n      // null revokes the whole platform (membership + all codes); string[] subtracts codes but keeps membership\n      if (revoke === null) continue;\n      composed[bucket] = revoke === undefined ? merged : merged.filter((c) => !revoke.includes(c));\n    }\n\n    // A feature with no surviving platform membership disappears from the effective set.\n    // Iterates PLATFORMS rather than naming buckets — the web/mobile-only version silently\n    // dropped a grant surviving only on an API bucket.\n    if (PLATFORMS.every((bucket) => composed[bucket] === undefined)) continue;\n    result[code] = composed;\n  }\n\n  return result;\n}\n","import { buildSiteCatalog, findFeatureByCode } from './catalog.builder';\nimport { buildDependsMap, filterGrantedByDeps } from './permission-deps';\nimport type {\n  FeatureUnlocks,\n  LockReason,\n  PlatformBucket,\n  ScopeType,\n  ServiceCode,\n  SiteFeatureLocks,\n  SiteType,\n  VersionSnapshot,\n} from './types';\nimport { isApiBucket, snapshotFeatureKey } from './types';\n\n/**\n * The caller's surface, as the caller reports it.\n *\n * Finer than `PlatformBucket` on the mobile side — `ios` and `android` load different remote\n * entries but share one grant bucket. The API platforms are one-to-one with their buckets: an\n * API client has no variants because it has no UI.\n */\nexport type ClientPlatform = 'web' | 'ios' | 'android' | 'graphql' | 'http';\n\n// Exhaustive by type, so adding a ClientPlatform without deciding its bucket fails the build instead\n// of silently falling through to mobile — which is how an API caller would end up resolving a UI bucket.\nconst BUCKET_BY_CLIENT: Record<ClientPlatform, PlatformBucket> = {\n  web: 'web',\n  ios: 'mobile',\n  android: 'mobile',\n  graphql: 'graphql',\n  http: 'http',\n};\n\n/**\n * Stands in for the microfrontend an API client does not load.\n *\n * `PermissionFeature.route` is non-optional and read by the web sidebar and the mobile host to\n * mount a remote. Nothing on the API paths reads it — the permission interceptor uses `code`,\n * `permissions` and `locked` — so an empty route keeps one shape for every bucket instead of\n * widening the field to null across every consumer.\n */\nconst EMPTY_ROUTE = { remoteEntry: '', exposedModule: '', routePrefix: '' };\n\nexport interface LockedPermission {\n  code: string;\n  reason: LockReason | null;\n  unlockPlans: string[];\n  missingServices: ServiceCode[];\n}\n\nexport interface PlanUpsell {\n  plan: string;\n  features: string[];\n}\n\nexport interface PermissionFeature {\n  code: string;\n  name: string;\n  lucideIcon: string | null;\n  sfSymbol: string;\n  materialSymbol: string;\n  permissions: string[];\n  locked: boolean;\n  lockReason: LockReason | null;\n  unlockPlans: string[];\n  // Which declared services the org has not provisioned — empty unless lockReason is 'SERVICE'\n  missingServices: ServiceCode[];\n  lockedPermissions: LockedPermission[];\n  upsell: PlanUpsell[];\n  route: {\n    remoteEntry: string;\n    exposedModule: string;\n    routePrefix: string;\n  };\n  appCode: string;\n  appName: string;\n  appIcon: string | null;\n  appSortOrder: number;\n}\n\nexport interface ResolveUserFeaturesParams {\n  snapshot: VersionSnapshot;\n  businessCode: string;\n  planCode: string | undefined;\n  siteLocks: SiteFeatureLocks | undefined;\n  roleFeatures: FeatureUnlocks;\n  platform: ClientPlatform;\n  siteType?: SiteType;\n  scope?: ScopeType;\n  // External services the org has provisioned; omitting it locks every service-dependent feature\n  availableServices?: ServiceCode[];\n}\n\n// Resolves the features + MF config a user sees at a BU: plan ∧ BU catalog intersected with the role's grants, filtered to the requested platform\nexport function resolveUserFeatures(params: ResolveUserFeaturesParams): PermissionFeature[] {\n  const { snapshot, businessCode, planCode, siteLocks, platform, siteType, scope, availableServices } = params;\n\n  // Plan unlocks, BU locks, and role grants are stored per platform; resolve only the requesting\n  // surface's bucket (web → web; ios/android → mobile; graphql/http → themselves)\n  const bucket: PlatformBucket = BUCKET_BY_CLIENT[platform];\n\n  const roleFeatures = params.roleFeatures;\n\n  // Grants/plans/locks key features by bare code; resolve to the workspace scope's variant (or any variant when unscoped)\n  const featureByCode = (code: string) =>\n    scope ? snapshot.features[snapshotFeatureKey(code, scope)] : findFeatureByCode(snapshot, code);\n\n  // Plan ∧ BU overlay for this bucket, filtered to features that apply to this workspace scope and node type — emits EVERY applicable business feature (plan non-members come out fully locked)\n  const catalog = buildSiteCatalog(\n    snapshot,\n    businessCode,\n    planCode,\n    siteLocks,\n    bucket,\n    siteType,\n    scope,\n    availableServices,\n  );\n  const catalogMap = new Map(catalog.map((f) => [f.code, f]));\n\n  // Per-plan feature-name delta vs the current plan — feeds the plan-locked upsell screen\n  const businessPlans = snapshot.businesses[businessCode]?.plans ?? {};\n  const currentUnlockedCodes = new Set<string>();\n  if (planCode && businessPlans[planCode]) {\n    for (const [featureCode, platforms] of Object.entries(businessPlans[planCode].unlockedPermissions)) {\n      if (platforms[bucket] !== undefined) currentUnlockedCodes.add(featureCode);\n    }\n  }\n  const planAdds = new Map<string, Array<{ code: string; name: string }>>();\n  for (const [planKey, plan] of Object.entries(businessPlans)) {\n    if (planKey === planCode) continue;\n    const adds: Array<{ code: string; name: string }> = [];\n    for (const [featureCode, platforms] of Object.entries(plan.unlockedPermissions)) {\n      if (platforms[bucket] === undefined || currentUnlockedCodes.has(featureCode)) continue;\n      const name = featureByCode(featureCode)?.name;\n      if (name) adds.push({ code: featureCode, name });\n    }\n    planAdds.set(planKey, adds);\n  }\n\n  // Granted permission set per feature, taking only this platform's grants\n  const grantedFeatures = new Map<string, Set<string>>();\n  for (const [code, grant] of Object.entries(roleFeatures)) {\n    // Membership is the gate: undefined = not a member on this platform; [] = member with no actions (view-only)\n    const granted = grant[bucket];\n    if (granted === undefined) continue;\n    if (!grantedFeatures.has(code)) grantedFeatures.set(code, new Set());\n    for (const perm of granted) grantedFeatures.get(code)?.add(perm);\n  }\n\n  // Cross-reference the granted features with the catalog to build the response\n  const features: PermissionFeature[] = [];\n  for (const [code, permsSet] of grantedFeatures) {\n    const catalogEntry = catalogMap.get(code);\n    if (!catalogEntry) continue;\n\n    // A UI bucket reaches its feature by loading a microfrontend, so a feature not published to\n    // this platform is omitted rather than handed over as an unloadable tile. An API client loads\n    // nothing — requiring a route there would make every headless feature permanently ungrantable.\n    const route = isApiBucket(bucket) ? EMPTY_ROUTE : pickRouteForPlatform(catalogEntry, platform);\n    if (!route) continue;\n\n    // Drop granted permissions whose intra-feature prerequisites aren't also granted (e.g. add needs view)\n    const featureDeps = buildDependsMap(featureByCode(code)?.permissions ?? []);\n    // Plan/BU lock a subset of permissions; surface which GRANTED ones are locked + why + how to unlock (upsell)\n    const permByCode = new Map(catalogEntry.permissions.map((p) => [p.code, p]));\n    // Intersected with the catalog, which now omits codes this surface does not implement. Without\n    // this a grant made before the flags existed — or written straight through the API — would keep\n    // resolving on a bucket where no route enforces it. The picker filtering alone is cosmetic; this\n    // is what makes an unimplemented grant genuinely inert.\n    const grantedPerms = [...filterGrantedByDeps(permsSet, featureDeps)].filter((c) => permByCode.has(c));\n    const lockedPermissions: LockedPermission[] = grantedPerms\n      .map((c) => permByCode.get(c))\n      .filter((p): p is NonNullable<typeof p> => !!p?.locked)\n      .map((p) => ({\n        code: p.code,\n        reason: p.lockReason ?? null,\n        unlockPlans: p.unlockPlans,\n        missingServices: p.missingServices,\n      }));\n\n    // For a plan-locked feature, list the extra features each unlocking plan would add (excluding this feature)\n    const upsell: PlanUpsell[] =\n      catalogEntry.locked && catalogEntry.lockReason === 'PLAN'\n        ? catalogEntry.unlockPlans\n            .map((plan) => ({\n              plan,\n              features: (planAdds.get(plan) ?? []).filter((f) => f.code !== code).map((f) => f.name),\n            }))\n            .filter((group) => group.features.length > 0)\n        : [];\n\n    features.push({\n      code,\n      name: catalogEntry.name,\n      lucideIcon: catalogEntry.lucideIcon,\n      sfSymbol: catalogEntry.sfSymbol,\n      materialSymbol: catalogEntry.materialSymbol,\n      permissions: grantedPerms,\n      locked: catalogEntry.locked ?? false,\n      lockReason: catalogEntry.lockReason ?? null,\n      unlockPlans: catalogEntry.unlockPlans,\n      missingServices: catalogEntry.missingServices,\n      lockedPermissions,\n      upsell,\n      route,\n      appCode: catalogEntry.appCode,\n      appName: catalogEntry.appName,\n      appIcon: catalogEntry.appIcon,\n      appSortOrder: catalogEntry.appSortOrder,\n    });\n  }\n\n  // Order app-alphabetically so the core-web sidebar (groups by app) renders apps sorted without any frontend re-sort;\n  // stable sort keeps each app's features in their existing relative order\n  features.sort((a, b) => a.appName.localeCompare(b.appName));\n\n  return features;\n}\n\n// Selects the route block from a catalog entry for the requested platform, or null when it doesn't publish there\nexport function pickRouteForPlatform(\n  entry: {\n    web: {\n      remoteEntry: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n    mobile: {\n      remoteEntryAndroid: string;\n      remoteEntryIos: string;\n      exposedModule: string;\n      routePrefix: string;\n    } | null;\n  },\n  platform: ClientPlatform,\n): { remoteEntry: string; exposedModule: string; routePrefix: string } | null {\n  // API platforms load nothing — resolveUserFeatures never routes them here, and answering with the\n  // web block for an unhandled value would hand an API caller a remote it cannot mount\n  if (platform === 'graphql' || platform === 'http') return null;\n  if (platform === 'ios' || platform === 'android') {\n    if (!entry.mobile) return null;\n    return {\n      remoteEntry: platform === 'ios' ? entry.mobile.remoteEntryIos : entry.mobile.remoteEntryAndroid,\n      exposedModule: entry.mobile.exposedModule,\n      routePrefix: entry.mobile.routePrefix,\n    };\n  }\n  // Web\n  if (!entry.web) return null;\n  return {\n    remoteEntry: entry.web.remoteEntry,\n    exposedModule: entry.web.exposedModule,\n    routePrefix: entry.web.routePrefix,\n  };\n}\n","import { featureAppliesAtNode, isPlanMember, isSiteLockedOnPlatform } from './catalog.builder';\nimport {\n  API_BUCKETS,\n  type ApiSurface,\n  type PlatformBucket,\n  type ScopeType,\n  type SiteFeatureLocks,\n  type SiteType,\n  type SnapshotPlan,\n  SURFACE_BY_BUCKET,\n  snapshotFeatureKey,\n  UI_PLATFORMS,\n  type VersionSnapshot,\n} from './types';\n\nexport interface SiteMatrixCell {\n  inPlan: boolean;\n  selected: boolean;\n  availableIn: string[];\n}\n\nexport interface SiteMatrixPermission {\n  code: string;\n  label: string;\n  dependsOn: string[];\n  web: SiteMatrixCell | null;\n  mobile: SiteMatrixCell | null;\n  graphql: SiteMatrixCell | null;\n  http: SiteMatrixCell | null;\n}\n\nexport interface SiteMatrixFeature {\n  code: string;\n  name: string;\n  icon: string | null;\n  scope: ScopeType;\n  applicableSiteTypes: SiteType[];\n  platforms: PlatformBucket[];\n  inPlan: boolean;\n  availableIn: string[];\n  // The API surfaces the feature declares — what lets the app-credential editor filter by the\n  // credential's type.\n  apiSurfaces: ApiSurface[];\n  permissions: SiteMatrixPermission[];\n}\n\nexport interface MatrixCounts {\n  unlocked: number;\n  total: number;\n}\n\nexport interface SiteMatrixApp {\n  code: string;\n  name: string;\n  icon: string | null;\n  // Counted per surface, not as one total: a consumer showing a subset of the columns (the\n  // app-credential editor shows exactly one) sums the surfaces it renders. One number covering all\n  // four read as \"20/20 unlocked\" above the 5 checkboxes actually on screen.\n  counts: Record<PlatformBucket, MatrixCounts>;\n  features: SiteMatrixFeature[];\n}\n\nexport interface SiteMatrix {\n  plan: { code: string; name: string };\n  apps: SiteMatrixApp[];\n  locks: SiteFeatureLocks;\n}\n\n// Builds the SITE-only apps/features/permissions matrix — not filtered to plan members; plan-locked items carry inPlan=false + availableIn\nexport function buildSiteMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  siteType?: SiteType,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, false, siteType);\n}\n\n// Builds the all-scopes apps/features/permissions matrix — every scope's features included, each carrying its real scope; powers the Plan Overview + Create Custom Role picker\nexport function buildPlanMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks?: SiteFeatureLocks,\n): SiteMatrix {\n  return buildMatrix(snapshot, businessCode, planCode, siteLocks, true);\n}\n\n// Shared matrix builder — allScopes=false keeps only SITE refs; allScopes=true includes every scope and emits each feature's real scope\nfunction buildMatrix(\n  snapshot: VersionSnapshot,\n  businessCode: string | undefined,\n  planCode: string | undefined,\n  siteLocks: SiteFeatureLocks | undefined,\n  allScopes: boolean,\n  siteType?: SiteType,\n): SiteMatrix {\n  const business = businessCode ? snapshot.businesses[businessCode] : undefined;\n  const plans = business?.plans ?? {};\n  const plan = planCode ? plans[planCode] : undefined;\n  const planMeta = { code: planCode ?? '', name: plan?.name ?? planCode ?? '' };\n  const locks = siteLocks ?? {};\n  if (!business || !plan) return { plan: planMeta, apps: [], locks };\n\n  const apps: SiteMatrixApp[] = [];\n  for (const app of business.apps) {\n    const counts: Record<PlatformBucket, MatrixCounts> = {\n      web: { unlocked: 0, total: 0 },\n      mobile: { unlocked: 0, total: 0 },\n      graphql: { unlocked: 0, total: 0 },\n      http: { unlocked: 0, total: 0 },\n    };\n    const features: SiteMatrixFeature[] = [];\n\n    for (const ref of app.features) {\n      if (!allScopes && ref.scope !== 'SITE') continue;\n      const code = ref.code;\n      const feature = snapshot.features[snapshotFeatureKey(code, ref.scope)];\n      if (!feature) continue;\n      if (siteType !== undefined && !featureAppliesAtNode(feature.applicableSiteTypes, siteType)) continue;\n      // A UI bucket is offered only where the feature publishes a microfrontend; each API bucket is\n      // offered where the feature declares its surface. An undeclared surface shows an em dash like\n      // a missing microfrontend does.\n      const platforms: PlatformBucket[] = [\n        ...UI_PLATFORMS.filter((p) => !!feature.microfrontends?.[p]),\n        ...API_BUCKETS.filter((b) => feature.apiSurfaces.includes(SURFACE_BY_BUCKET[b])),\n      ];\n\n      const groupByCode = new Map(feature.permissionGroups.map((g) => [g.code, g]));\n      const membership = plan.unlockedPermissions[code];\n      const featureInPlan = isPlanMember(membership);\n      const siteEntry = siteLocks?.[code];\n\n      const permissions: SiteMatrixPermission[] = feature.permissions\n        .filter((p) => p.isGlobal || p.businesses.includes(businessCode ?? ''))\n        .map((p) => {\n          const cell = (plat: PlatformBucket): SiteMatrixCell | null => {\n            // The feature must reach this bucket AND this code must be implemented on it — the same\n            // two gates buildSiteCatalog applies, so the matrix and the catalog cannot disagree\n            if (!platforms.includes(plat) || !p.platforms.includes(plat)) return null;\n            const planCodes = membership?.[plat];\n            const inPlan = featureInPlan && planCodes !== undefined && planCodes.includes(p.code);\n            // Deny-list: an in-plan cell is selected unless the site locks it on this platform\n            const selected = inPlan && !isSiteLockedOnPlatform(siteEntry, plat, p.code);\n            const availableIn = inPlan ? [] : plansUnlockingPerm(plans, code, p.code, plat, planCode);\n            counts[plat].total += 1;\n            if (inPlan) counts[plat].unlocked += 1;\n            return { inPlan, selected, availableIn };\n          };\n          return {\n            code: p.code,\n            label: p.label,\n            dependsOn: p.dependsOn,\n            group: p.group ? groupByCode.get(p.group) : undefined,\n            web: cell('web'),\n            mobile: cell('mobile'),\n            graphql: cell('graphql'),\n            http: cell('http'),\n          };\n        });\n\n      features.push({\n        code: feature.code,\n        name: feature.name,\n        icon: feature.lucideIcon ?? null,\n        scope: feature.scope,\n        applicableSiteTypes: feature.applicableSiteTypes,\n        platforms,\n        inPlan: featureInPlan,\n        availableIn: featureInPlan ? [] : plansIncludingFeature(plans, code, planCode),\n        apiSurfaces: feature.apiSurfaces,\n        permissions,\n      });\n    }\n\n    if (features.length === 0) continue;\n    apps.push({ code: app.code, name: app.name, icon: app.icon ?? null, counts, features });\n  }\n\n  // Emit apps alphabetically by name so every consumer (Plan Overview, Role picker, all Locks screens) renders them sorted\n  apps.sort((a, b) => a.name.localeCompare(b.name));\n\n  return { plan: planMeta, apps, locks };\n}\n\n// Names of other plans (excluding the org's own) that unlock this feature+permission on the given platform\nfunction plansUnlockingPerm(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  permCode: string,\n  platform: PlatformBucket,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if ((p.unlockedPermissions[featureCode]?.[platform] ?? []).includes(permCode)) names.push(p.name);\n  }\n  return names;\n}\n\n// Names of other plans (excluding the org's own) that include this feature at all (membership) — feature-level upsell\nfunction plansIncludingFeature(\n  plans: Record<string, SnapshotPlan>,\n  featureCode: string,\n  excludeCode: string | undefined,\n): string[] {\n  const names: string[] = [];\n  for (const [code, p] of Object.entries(plans)) {\n    if (code === excludeCode) continue;\n    if (isPlanMember(p.unlockedPermissions[featureCode])) names.push(p.name);\n  }\n  return names;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACKO,SAASA,gBAAgBC,aAA0D;AACxF,QAAMC,UAAU,IAAIC,IAAIF,YAAYG,IAAI,CAACC,MAAMA,EAAEC,IAAI,CAAA;AACrD,QAAMF,MAAkB,oBAAIG,IAAAA;AAC5B,aAAWF,KAAKJ,aAAa;AAC3BG,QAAII,IACFH,EAAEC,OACDD,EAAEI,aAAa,CAAA,GAAIC,OAAO,CAACC,QAAQA,QAAQN,EAAEC,QAAQJ,QAAQU,IAAID,GAAAA,CAAAA,CAAAA;EAEtE;AACA,SAAOP;AACT;AAVgBJ;AAaT,SAASa,cAAcP,MAAcQ,MAAgB;AAC1D,QAAMC,MAAM,oBAAIZ,IAAAA;AAChB,QAAMa,OAAO,oBAAIb,IAAY;IAACG;GAAK;AACnC,QAAMW,QAAQ;IAACX;;AACf,SAAOW,MAAMC,SAAS,GAAG;AACvB,UAAMC,UAAUF,MAAMG,IAAG;AACzB,eAAWT,OAAOG,KAAKO,IAAIF,OAAAA,KAAY,CAAA,GAAI;AACzC,UAAIH,KAAKJ,IAAID,GAAAA,EAAM;AACnBK,WAAKM,IAAIX,GAAAA;AACTI,UAAIO,IAAIX,GAAAA;AACRM,YAAMM,KAAKZ,GAAAA;IACb;EACF;AACA,SAAO;OAAII;;AACb;AAdgBF;AAiBT,SAASW,cAAcC,OAAiBC,gBAA6BZ,MAAgB;AAC1F,QAAMa,SAAS,oBAAIxB,IAAAA;AACnB,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAIqB,OAAOf,IAAIN,IAAAA,EAAO,QAAO;AAC7B,QAAIoB,eAAed,IAAIN,IAAAA,GAAO;AAC5BqB,aAAOL,IAAIhB,IAAAA;AACX,aAAO;IACT;AACA,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAMwB,UAAUhB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAIyB,KAAKF,KAAAA;AAC3CD,aAASI,OAAO1B,IAAAA;AAChB,QAAIwB,OAAQH,QAAOL,IAAIhB,IAAAA;AACvB,WAAOwB;EACT,GAZc;AAad,aAAWxB,QAAQmB,MAAOI,OAAMvB,IAAAA;AAChC,SAAOqB;AACT;AAlBgBH;AAqBT,SAASS,oBAAoBC,SAAsBpB,MAAgB;AACxE,QAAMqB,KAAK,oBAAIhC,IAAAA;AACf,QAAMyB,WAAW,oBAAIzB,IAAAA;AACrB,QAAM0B,QAAQ,wBAACvB,SAAAA;AACb,QAAI6B,GAAGvB,IAAIN,IAAAA,EAAO,QAAO;AACzB,QAAI,CAAC4B,QAAQtB,IAAIN,IAAAA,EAAO,QAAO;AAC/B,QAAIsB,SAAShB,IAAIN,IAAAA,EAAO,QAAO;AAC/BsB,aAASN,IAAIhB,IAAAA;AACb,UAAM8B,aAAatB,KAAKO,IAAIf,IAAAA,KAAS,CAAA,GAAI+B,MAAMR,KAAAA;AAC/CD,aAASI,OAAO1B,IAAAA;AAChB,QAAI8B,UAAWD,IAAGb,IAAIhB,IAAAA;AACtB,WAAO8B;EACT,GATc;AAUd,aAAW9B,QAAQ4B,QAASL,OAAMvB,IAAAA;AAClC,SAAO6B;AACT;AAfgBF;;;ACxCT,IAAMK,YAA8B;EAAC;EAAO;EAAU;EAAW;;AAKjE,IAAMC,eAAmC;EAAC;EAAO;;AAIjD,IAAMC,eAAe;EAAC;EAAW;;AAMjC,IAAMC,cAA2B;EAAC;EAAW;;AAE7C,IAAMC,oBAAmD;EAAEC,SAAS;EAAWC,MAAM;AAAO;AAC5F,IAAMC,oBAAmD;EAAEC,SAAS;EAAWC,MAAM;AAAO;AAE5F,SAASC,YAAYC,QAAsB;AAChD,SAAOA,WAAW,aAAaA,WAAW;AAC5C;AAFgBD;AA+DT,IAAME,aAAyB;EAAC;EAAU;EAAa;;AAGvD,IAAMC,gBAAgB;EAAC;;AAqEvB,SAASC,mBAAmBC,MAAcC,OAAgB;AAC/D,SAAO,GAAGA,KAAAA,IAASD,IAAAA;AACrB;AAFgBD;AAIT,IAAMG,0BAA0B;;;AC3JhC,SAASC,qBAAqBC,qBAAiCC,UAAkB;AACtF,SAAOD,oBAAoBE,SAASD,QAAAA;AACtC;AAFgBF;AAKT,SAASI,kBAAkBC,UAA2BC,MAAY;AACvE,aAAWC,WAAWC,OAAOC,OAAOJ,SAASK,QAAQ,GAAG;AACtD,QAAIH,QAAQD,SAASA,KAAM,QAAOC;EACpC;AACA,SAAOI;AACT;AALgBP;AAST,SAASQ,iBACdP,UACAQ,cACAC,UACAC,WACAC,QACAd,UACAe,OACAC,oBAAmC,CAAA,GAAE;AAErC,MAAI,CAACL,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWd,SAASe,WAAWP,YAAAA;AACrC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,QAAME,QAAQF,SAASE;AACvB,QAAMC,OAAOR,WAAWO,MAAMP,QAAAA,IAAYH;AAC1C,QAAMY,QAAQR;AAEd,QAAMS,UAAiC,CAAA;AAEvC,QAAMC,aAAa;OAAIN,SAASO;IAAMC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,KAAKC,cAAcF,EAAEC,IAAI,CAAA;AAChF,aAAWE,OAAOP,YAAY;AAE5B,UAAMQ,sBAAsBD,IAAItB,SAC7BwB,OAAO,CAACC,QAAQlB,UAAUN,UAAawB,IAAIlB,UAAUA,KAAAA,EACrDmB,IAAI,CAACD,QAAQ9B,SAASK,SAAS2B,mBAAmBF,IAAI7B,MAAM6B,IAAIlB,KAAK,CAAA,CAAE,EACvEiB,OACC,CAACI,MACC,CAAC,CAACA;;;;KAKDC,YAAYvB,MAAAA,IACTwB,cAAcF,EAAEG,aAAaC,kBAAkB1B,MAAAA,CAAO,IACtD,CAAC,EAAEsB,EAAEK,gBAAgBC,OAAON,EAAEK,gBAAgBE,aACjD3C,aAAaS,UAAaX,qBAAqBsC,EAAErC,qBAAqBC,QAAAA,EAAQ;AAGrF,QAAI+B,oBAAoBa,WAAW,EAAG;AAGtC,eAAWvC,WAAW0B,qBAAqB;AACzC,YAAMc,aAAazB,MAAM0B,oBAAoBzC,QAAQD,IAAI;AAEzD,YAAMsC,MAAMrC,QAAQoC,gBAAgBC;AACpC,YAAMC,SAAStC,QAAQoC,gBAAgBE;AAIvC,YAAMI,iBAAiBF,aAAa/B,MAAAA,MAAYL;AAChD,YAAMuC,qBAAqB3B,QAAQhB,QAAQD,IAAI,IAAIU,MAAAA,MAAY;AAC/D,YAAMmC,kBAAkBC,cAAc7C,SAASW,iBAAAA;AAG/C,YAAMmC,cAAcC,iBAAiB/C,SAASM,cAAckC,YAAYxB,OAAOF,OAAOL,QAAQmC,eAAAA;AAC9F,YAAMI,aAAaC,kBAAkB,CAACP,gBAAgBC,oBAAoBC,eAAAA;AAC1E,YAAMM,SAASF,eAAe;AAC9B,YAAMG,cAAcH,eAAe,SAASI,sBAAsBtC,OAAOd,QAAQD,MAAMU,MAAAA,IAAU,CAAA;AAEjGQ,cAAQoC,KAAK;QACXtD,MAAMC,QAAQD;QACdwB,MAAMvB,QAAQuB;QACd+B,YAAYtD,QAAQsD,cAAc;QAClCC,UAAUvD,QAAQuD,YAAY;QAC9BC,gBAAgBxD,QAAQwD,kBAAkB;QAC1CnB,KAAKA,MACD;UACEoB,aAAapB,IAAIoB,eAAe;UAChCC,eAAerB,IAAIqB,iBAAiB;UACpCC,aAAatB,IAAIsB,eAAe;QAClC,IACA;QACJrB,QAAQA,SACJ;UACEsB,oBAAoBtB,OAAOsB,sBAAsB;UACjDC,gBAAgBvB,OAAOuB,kBAAkB;UACzCH,eAAepB,OAAOoB,iBAAiB;UACvCC,aAAarB,OAAOqB,eAAe;QACrC,IACA;QACJG,SAASrC,IAAI1B;QACbgE,SAAStC,IAAIF;QACbyC,SAASvC,IAAIwC,QAAQ;QACrBC,cAAczC,IAAI0C,aAAa;QAC/BjB;QACAF;QACAG;QACAP;QACAE;MACF,CAAA;IACF;EACF;AACA,SAAO7B;AACT;AA7FgBZ;AAgGT,SAAS+D,aAAaC,OAAgC;AAC3D,MAAI,CAACA,MAAO,QAAO;AACnB,SAAOC,UAAUC,KAAK,CAACC,aAAaH,MAAMG,QAAAA,MAAcpE,MAAAA;AAC1D;AAHgBgE;AAWT,SAASnC,cAAcwC,UAAwBC,SAA+B;AACnF,SAAOA,YAAYtE,UAAaqE,SAAS7E,SAAS8E,OAAAA;AACpD;AAFgBzC;AAOhB,SAASgB,kBACP0B,YACAC,YACAhC,iBAA8B;AAE9B,MAAI+B,WAAY,QAAO;AACvB,MAAIC,WAAY,QAAO;AACvB,MAAIhC,gBAAgBL,SAAS,EAAG,QAAO;AACvC,SAAO;AACT;AATSU;AAYT,SAASJ,cAAc7C,SAA0BW,mBAAgC;AAC/E,SAAOX,QAAQ6E,iBAAiBlD,OAAO,CAACmD,YAAY,CAACnE,kBAAkBf,SAASkF,OAAAA,CAAAA;AAClF;AAFSjC;AAKF,SAASkC,uBACdV,OACAG,UACAzE,MAAY;AAEZ,QAAMiB,QAAQqD,QAAQG,QAAAA;AACtB,SAAOxD,UAAU,SAASA,OAAOpB,SAASG,IAAAA,KAAS;AACrD;AAPgBgF;AAWhB,SAAShC,iBACP/C,SACAM,cACA0E,gBACAxE,WACAM,OACAL,QACAmC,kBAAiC,CAAA,GAAE;AAEnC,QAAMqC,eAAe,IAAIC,IAAIF,iBAAiBvE,MAAAA,KAAW,CAAA,CAAE;AAC3D,QAAM0E,YAAY3E,YAAYR,QAAQD,IAAI;AAK1C,QAAMqF,QAAQpF,QAAQ8C,YACnBnB,OAAO,CAAC0D,MAAMA,EAAEC,YAAYD,EAAExE,WAAWjB,SAASU,YAAAA,CAAAA,EAClDqB,OAAO,CAAC0D,MAAMA,EAAEE,UAAU3F,SAASa,MAAAA,CAAAA;AACtC,QAAM+E,OAAOC,gBAAgBL,KAAAA;AAC7B,QAAMM,QAAQN,MAAMvD,IAAI,CAACwD,MAAMA,EAAEtF,IAAI;AAGrC,QAAM4F,qBAAqB,oBAAIT,IAAAA;AAC/B,QAAMU,qBAAqB,oBAAIV,IAAAA;AAC/B,aAAWG,KAAKD,OAAO;AACrB,QAAI,CAACH,aAAaY,IAAIR,EAAEtF,IAAI,EAAG4F,oBAAmBG,IAAIT,EAAEtF,IAAI;AAC5D,QAAIgF,uBAAuBI,WAAW1E,QAAQ4E,EAAEtF,IAAI,EAAG6F,oBAAmBE,IAAIT,EAAEtF,IAAI;EACtF;AACA,QAAMgG,iBAAiB,oBAAIb,IAAY;OAAIS;OAAuBC;GAAmB;AACrF,QAAMI,YAAYC,cAAcP,OAAOK,gBAAgBP,IAAAA;AAEvD,SAAOJ,MAAMvD,IAAI,CAACwD,MAAAA;AAEhB,UAAMa,UAAU;MAACb,EAAEtF;SAASoG,cAAcd,EAAEtF,MAAMyF,IAAAA;;AAClD,UAAMY,WAAWJ,UAAUH,IAAIR,EAAEtF,IAAI;AACrC,UAAMsG,aAAaD,YAAYF,QAAQ3B,KAAK,CAAC+B,MAAMX,mBAAmBE,IAAIS,CAAAA,CAAAA;AAC1E,UAAMC,aAAaH,YAAYF,QAAQ3B,KAAK,CAAC+B,MAAMV,mBAAmBC,IAAIS,CAAAA,CAAAA;AAC1E,UAAMtD,aAAaC,kBAAkBoD,YAAYE,YAAY3D,eAAAA;AAC7D,UAAMM,SAASF,eAAe;AAC9B,UAAMG,cAAcH,eAAe,SAASwD,sBAAsB1F,OAAOd,QAAQD,MAAMmG,SAASzF,MAAAA,IAAU,CAAA;AAC1G,WAAO;MAAEV,MAAMsF,EAAEtF;MAAMmD;MAAQF;MAAYG;MAAaP;IAAgB;EAC1E,CAAA;AACF;AA1CSG;AA6CT,SAASyD,sBACP1F,OACA2F,aACAP,SACAzF,QAAsB;AAEtB,QAAMiG,SAAmB,CAAA;AACzB,aAAW,CAAC3G,MAAMgB,IAAAA,KAASd,OAAO0G,QAAQ7F,KAAAA,GAAQ;AAChD,UAAM8F,WAAW7F,KAAK0B,oBAAoBgE,WAAAA,IAAehG,MAAAA;AACzD,QAAImG,YAAYV,QAAQW,MAAM,CAACP,MAAMM,SAAShH,SAAS0G,CAAAA,CAAAA,EAAKI,QAAOrD,KAAKtD,IAAAA;EAC1E;AACA,SAAO2G;AACT;AAZSF;AAeT,SAASpD,sBACPtC,OACA2F,aACAhG,QAAsB;AAEtB,QAAMiG,SAAmB,CAAA;AACzB,aAAW,CAAC3G,MAAMgB,IAAAA,KAASd,OAAO0G,QAAQ7F,KAAAA,GAAQ;AAChD,QAAIC,KAAK0B,oBAAoBgE,WAAAA,IAAehG,MAAAA,MAAYL,OAAWsG,QAAOrD,KAAKtD,IAAAA;EACjF;AACA,SAAO2G;AACT;AAVStD;AAaF,SAAS0D,eAAehH,UAA2BQ,cAAgC;AACxF,MAAI,CAACA,aAAc,QAAO,CAAA;AAC1B,QAAMM,WAAWd,SAASe,WAAWP,YAAAA;AACrC,MAAI,CAACM,SAAU,QAAO,CAAA;AACtB,SAAOX,OAAOC,OAAOU,SAASmG,aAAa;AAC7C;AALgBD;;;AC9OhB,SAASE,YAAYC,MAA4BC,KAAyB;AACxE,MAAID,SAASE,UAAaD,QAAQC,OAAW,QAAOA;AACpD,SAAO;OAAI,oBAAIC,IAAI;SAAKH,QAAQ,CAAA;SAASC,OAAO,CAAA;KAAI;;AACtD;AAHSF;AAMF,SAASK,kBAAkBC,QAA+B;AAC/D,QAAM,EAAEC,cAAcC,WAAWC,QAAO,IAAKH;AAE7C,QAAMI,SAAyB,CAAC;AAChC,QAAMC,eAAe,oBAAIP,IAAI;OAAIQ,OAAOC,KAAKN,gBAAgB,CAAC,CAAA;OAAOK,OAAOC,KAAKL,SAAAA;GAAW;AAE5F,aAAWM,QAAQH,cAAc;AAC/B,UAAMV,OAAOM,eAAeO,IAAAA,KAAS,CAAC;AACtC,UAAMZ,MAAMM,UAAUM,IAAAA,KAAS,CAAC;AAChC,UAAMC,UAAUN,UAAUK,IAAAA;AAE1B,UAAME,WAA0B,CAAC;AACjC,eAAWC,UAAUC,WAAW;AAC9B,YAAMC,SAASnB,YAAYC,KAAKgB,MAAAA,GAASf,IAAIe,MAAAA,CAAO;AACpD,UAAIE,WAAWhB,OAAW;AAC1B,YAAMiB,SAASL,UAAUE,MAAAA;AAEzB,UAAIG,WAAW,KAAM;AACrBJ,eAASC,MAAAA,IAAUG,WAAWjB,SAAYgB,SAASA,OAAOE,OAAO,CAACC,MAAM,CAACF,OAAOG,SAASD,CAAAA,CAAAA;IAC3F;AAKA,QAAIJ,UAAUM,MAAM,CAACP,WAAWD,SAASC,MAAAA,MAAYd,MAAAA,EAAY;AACjEO,WAAOI,IAAAA,IAAQE;EACjB;AAEA,SAAON;AACT;AA7BgBL;;;ACQhB,IAAMoB,mBAA2D;EAC/DC,KAAK;EACLC,KAAK;EACLC,SAAS;EACTC,SAAS;EACTC,MAAM;AACR;AAUA,IAAMC,cAAc;EAAEC,aAAa;EAAIC,eAAe;EAAIC,aAAa;AAAG;AAqDnE,SAASC,oBAAoBC,QAAiC;AACnE,QAAM,EAAEC,UAAUC,cAAcC,UAAUC,WAAWC,UAAUC,UAAUC,OAAOC,kBAAiB,IAAKR;AAItG,QAAMS,SAAyBpB,iBAAiBgB,QAAAA;AAEhD,QAAMK,eAAeV,OAAOU;AAG5B,QAAMC,gBAAgB,wBAACC,SACrBL,QAAQN,SAASY,SAASC,mBAAmBF,MAAML,KAAAA,CAAAA,IAAUQ,kBAAkBd,UAAUW,IAAAA,GADrE;AAItB,QAAMI,UAAUC,iBACdhB,UACAC,cACAC,UACAC,WACAK,QACAH,UACAC,OACAC,iBAAAA;AAEF,QAAMU,aAAa,IAAIC,IAAIH,QAAQI,IAAI,CAACC,MAAM;IAACA,EAAET;IAAMS;GAAE,CAAA;AAGzD,QAAMC,gBAAgBrB,SAASsB,WAAWrB,YAAAA,GAAesB,SAAS,CAAC;AACnE,QAAMC,uBAAuB,oBAAIC,IAAAA;AACjC,MAAIvB,YAAYmB,cAAcnB,QAAAA,GAAW;AACvC,eAAW,CAACwB,aAAaC,SAAAA,KAAcC,OAAOC,QAAQR,cAAcnB,QAAAA,EAAU4B,mBAAmB,GAAG;AAClG,UAAIH,UAAUnB,MAAAA,MAAYuB,OAAWP,sBAAqBQ,IAAIN,WAAAA;IAChE;EACF;AACA,QAAMO,WAAW,oBAAIf,IAAAA;AACrB,aAAW,CAACgB,SAASC,IAAAA,KAASP,OAAOC,QAAQR,aAAAA,GAAgB;AAC3D,QAAIa,YAAYhC,SAAU;AAC1B,UAAMkC,OAA8C,CAAA;AACpD,eAAW,CAACV,aAAaC,SAAAA,KAAcC,OAAOC,QAAQM,KAAKL,mBAAmB,GAAG;AAC/E,UAAIH,UAAUnB,MAAAA,MAAYuB,UAAaP,qBAAqBa,IAAIX,WAAAA,EAAc;AAC9E,YAAMY,OAAO5B,cAAcgB,WAAAA,GAAcY;AACzC,UAAIA,KAAMF,MAAKG,KAAK;QAAE5B,MAAMe;QAAaY;MAAK,CAAA;IAChD;AACAL,aAASO,IAAIN,SAASE,IAAAA;EACxB;AAGA,QAAMK,kBAAkB,oBAAIvB,IAAAA;AAC5B,aAAW,CAACP,MAAM+B,KAAAA,KAAUd,OAAOC,QAAQpB,YAAAA,GAAe;AAExD,UAAMkC,UAAUD,MAAMlC,MAAAA;AACtB,QAAImC,YAAYZ,OAAW;AAC3B,QAAI,CAACU,gBAAgBJ,IAAI1B,IAAAA,EAAO8B,iBAAgBD,IAAI7B,MAAM,oBAAIc,IAAAA,CAAAA;AAC9D,eAAWmB,QAAQD,QAASF,iBAAgBI,IAAIlC,IAAAA,GAAOqB,IAAIY,IAAAA;EAC7D;AAGA,QAAMhC,WAAgC,CAAA;AACtC,aAAW,CAACD,MAAMmC,QAAAA,KAAaL,iBAAiB;AAC9C,UAAMM,eAAe9B,WAAW4B,IAAIlC,IAAAA;AACpC,QAAI,CAACoC,aAAc;AAKnB,UAAMC,QAAQC,YAAYzC,MAAAA,IAAUd,cAAcwD,qBAAqBH,cAAc3C,QAAAA;AACrF,QAAI,CAAC4C,MAAO;AAGZ,UAAMG,cAAcC,gBAAgB1C,cAAcC,IAAAA,GAAO0C,eAAe,CAAA,CAAE;AAE1E,UAAMC,aAAa,IAAIpC,IAAI6B,aAAaM,YAAYlC,IAAI,CAACoC,MAAM;MAACA,EAAE5C;MAAM4C;KAAE,CAAA;AAK1E,UAAMC,eAAe;SAAIC,oBAAoBX,UAAUK,WAAAA;MAAcO,OAAO,CAACC,MAAML,WAAWjB,IAAIsB,CAAAA,CAAAA;AAClG,UAAMC,oBAAwCJ,aAC3CrC,IAAI,CAACwC,MAAML,WAAWT,IAAIc,CAAAA,CAAAA,EAC1BD,OAAO,CAACH,MAAkC,CAAC,CAACA,GAAGM,MAAAA,EAC/C1C,IAAI,CAACoC,OAAO;MACX5C,MAAM4C,EAAE5C;MACRmD,QAAQP,EAAEQ,cAAc;MACxBC,aAAaT,EAAES;MACfC,iBAAiBV,EAAEU;IACrB,EAAA;AAGF,UAAMC,SACJnB,aAAac,UAAUd,aAAagB,eAAe,SAC/ChB,aAAaiB,YACV7C,IAAI,CAACgB,UAAU;MACdA;MACAvB,WAAWqB,SAASY,IAAIV,IAAAA,KAAS,CAAA,GAAIuB,OAAO,CAACtC,MAAMA,EAAET,SAASA,IAAAA,EAAMQ,IAAI,CAACC,MAAMA,EAAEkB,IAAI;IACvF,EAAA,EACCoB,OAAO,CAACS,UAAUA,MAAMvD,SAASwD,SAAS,CAAA,IAC7C,CAAA;AAENxD,aAAS2B,KAAK;MACZ5B;MACA2B,MAAMS,aAAaT;MACnB+B,YAAYtB,aAAasB;MACzBC,UAAUvB,aAAauB;MACvBC,gBAAgBxB,aAAawB;MAC7BlB,aAAaG;MACbK,QAAQd,aAAac,UAAU;MAC/BE,YAAYhB,aAAagB,cAAc;MACvCC,aAAajB,aAAaiB;MAC1BC,iBAAiBlB,aAAakB;MAC9BL;MACAM;MACAlB;MACAwB,SAASzB,aAAayB;MACtBC,SAAS1B,aAAa0B;MACtBC,SAAS3B,aAAa2B;MACtBC,cAAc5B,aAAa4B;IAC7B,CAAA;EACF;AAIA/D,WAASgE,KAAK,CAACC,GAAGC,MAAMD,EAAEJ,QAAQM,cAAcD,EAAEL,OAAO,CAAA;AAEzD,SAAO7D;AACT;AA5HgBd;AA+HT,SAASoD,qBACd8B,OAaA5E,UAAwB;AAIxB,MAAIA,aAAa,aAAaA,aAAa,OAAQ,QAAO;AAC1D,MAAIA,aAAa,SAASA,aAAa,WAAW;AAChD,QAAI,CAAC4E,MAAMC,OAAQ,QAAO;AAC1B,WAAO;MACLtF,aAAaS,aAAa,QAAQ4E,MAAMC,OAAOC,iBAAiBF,MAAMC,OAAOE;MAC7EvF,eAAeoF,MAAMC,OAAOrF;MAC5BC,aAAamF,MAAMC,OAAOpF;IAC5B;EACF;AAEA,MAAI,CAACmF,MAAM3F,IAAK,QAAO;AACvB,SAAO;IACLM,aAAaqF,MAAM3F,IAAIM;IACvBC,eAAeoF,MAAM3F,IAAIO;IACzBC,aAAamF,MAAM3F,IAAIQ;EACzB;AACF;AAlCgBqD;;;ACxJT,SAASkC,gBACdC,UACAC,cACAC,UACAC,WACAC,UAAmB;AAEnB,SAAOC,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,OAAOC,QAAAA;AACzE;AARgBL;AAWT,SAASO,gBACdN,UACAC,cACAC,UACAC,WAA4B;AAE5B,SAAOE,YAAYL,UAAUC,cAAcC,UAAUC,WAAW,IAAA;AAClE;AAPgBG;AAUhB,SAASD,YACPL,UACAC,cACAC,UACAC,WACAI,WACAH,UAAmB;AAEnB,QAAMI,WAAWP,eAAeD,SAASS,WAAWR,YAAAA,IAAgBS;AACpE,QAAMC,QAAQH,UAAUG,SAAS,CAAC;AAClC,QAAMC,OAAOV,WAAWS,MAAMT,QAAAA,IAAYQ;AAC1C,QAAMG,WAAW;IAAEC,MAAMZ,YAAY;IAAIa,MAAMH,MAAMG,QAAQb,YAAY;EAAG;AAC5E,QAAMc,QAAQb,aAAa,CAAC;AAC5B,MAAI,CAACK,YAAY,CAACI,KAAM,QAAO;IAAEA,MAAMC;IAAUI,MAAM,CAAA;IAAID;EAAM;AAEjE,QAAMC,OAAwB,CAAA;AAC9B,aAAWC,OAAOV,SAASS,MAAM;AAC/B,UAAME,SAA+C;MACnDC,KAAK;QAAEC,UAAU;QAAGC,OAAO;MAAE;MAC7BC,QAAQ;QAAEF,UAAU;QAAGC,OAAO;MAAE;MAChCE,SAAS;QAAEH,UAAU;QAAGC,OAAO;MAAE;MACjCG,MAAM;QAAEJ,UAAU;QAAGC,OAAO;MAAE;IAChC;AACA,UAAMI,WAAgC,CAAA;AAEtC,eAAWC,OAAOT,IAAIQ,UAAU;AAC9B,UAAI,CAACnB,aAAaoB,IAAIC,UAAU,OAAQ;AACxC,YAAMd,OAAOa,IAAIb;AACjB,YAAMe,UAAU7B,SAAS0B,SAASI,mBAAmBhB,MAAMa,IAAIC,KAAK,CAAA;AACpE,UAAI,CAACC,QAAS;AACd,UAAIzB,aAAaM,UAAa,CAACqB,qBAAqBF,QAAQG,qBAAqB5B,QAAAA,EAAW;AAI5F,YAAM6B,YAA8B;WAC/BC,aAAaC,OAAO,CAACC,MAAM,CAAC,CAACP,QAAQQ,iBAAiBD,CAAAA,CAAE;WACxDE,YAAYH,OAAO,CAACI,MAAMV,QAAQW,YAAYC,SAASC,kBAAkBH,CAAAA,CAAE,CAAA;;AAGhF,YAAMI,cAAc,IAAIC,IAAIf,QAAQgB,iBAAiBC,IAAI,CAACC,MAAM;QAACA,EAAEjC;QAAMiC;OAAE,CAAA;AAC3E,YAAMC,aAAapC,KAAKqC,oBAAoBnC,IAAAA;AAC5C,YAAMoC,gBAAgBC,aAAaH,UAAAA;AACnC,YAAMI,YAAYjD,YAAYW,IAAAA;AAE9B,YAAMuC,cAAsCxB,QAAQwB,YACjDlB,OAAO,CAACC,MAAMA,EAAEkB,YAAYlB,EAAE3B,WAAWgC,SAASxC,gBAAgB,EAAA,CAAA,EAClE6C,IAAI,CAACV,MAAAA;AACJ,cAAMmB,OAAO,wBAACC,SAAAA;AAGZ,cAAI,CAACvB,UAAUQ,SAASe,IAAAA,KAAS,CAACpB,EAAEH,UAAUQ,SAASe,IAAAA,EAAO,QAAO;AACrE,gBAAMC,YAAYT,aAAaQ,IAAAA;AAC/B,gBAAME,SAASR,iBAAiBO,cAAc/C,UAAa+C,UAAUhB,SAASL,EAAEtB,IAAI;AAEpF,gBAAM6C,WAAWD,UAAU,CAACE,uBAAuBR,WAAWI,MAAMpB,EAAEtB,IAAI;AAC1E,gBAAM+C,cAAcH,SAAS,CAAA,IAAKI,mBAAmBnD,OAAOG,MAAMsB,EAAEtB,MAAM0C,MAAMtD,QAAAA;AAChFiB,iBAAOqC,IAAAA,EAAMlC,SAAS;AACtB,cAAIoC,OAAQvC,QAAOqC,IAAAA,EAAMnC,YAAY;AACrC,iBAAO;YAAEqC;YAAQC;YAAUE;UAAY;QACzC,GAZa;AAab,eAAO;UACL/C,MAAMsB,EAAEtB;UACRiD,OAAO3B,EAAE2B;UACTC,WAAW5B,EAAE4B;UACbC,OAAO7B,EAAE6B,QAAQtB,YAAYuB,IAAI9B,EAAE6B,KAAK,IAAIvD;UAC5CU,KAAKmC,KAAK,KAAA;UACVhC,QAAQgC,KAAK,QAAA;UACb/B,SAAS+B,KAAK,SAAA;UACd9B,MAAM8B,KAAK,MAAA;QACb;MACF,CAAA;AAEF7B,eAASyC,KAAK;QACZrD,MAAMe,QAAQf;QACdC,MAAMc,QAAQd;QACdqD,MAAMvC,QAAQwC,cAAc;QAC5BzC,OAAOC,QAAQD;QACfI,qBAAqBH,QAAQG;QAC7BC;QACAyB,QAAQR;QACRW,aAAaX,gBAAgB,CAAA,IAAKoB,uBAAsB3D,OAAOG,MAAMZ,QAAAA;QACrEsC,aAAaX,QAAQW;QACrBa;MACF,CAAA;IACF;AAEA,QAAI3B,SAAS6C,WAAW,EAAG;AAC3BtD,SAAKkD,KAAK;MAAErD,MAAMI,IAAIJ;MAAMC,MAAMG,IAAIH;MAAMqD,MAAMlD,IAAIkD,QAAQ;MAAMjD;MAAQO;IAAS,CAAA;EACvF;AAGAT,OAAKuD,KAAK,CAACC,GAAGlC,MAAMkC,EAAE1D,KAAK2D,cAAcnC,EAAExB,IAAI,CAAA;AAE/C,SAAO;IAAEH,MAAMC;IAAUI;IAAMD;EAAM;AACvC;AA9FSX;AAiGT,SAASyD,mBACPnD,OACAgE,aACAC,UACAC,UACAC,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACjE,MAAMsB,CAAAA,KAAM4C,OAAOC,QAAQtE,KAAAA,GAAQ;AAC7C,QAAIG,SAASgE,YAAa;AAC1B,SAAK1C,EAAEa,oBAAoB0B,WAAAA,IAAeE,QAAAA,KAAa,CAAA,GAAIpC,SAASmC,QAAAA,EAAWG,OAAMZ,KAAK/B,EAAErB,IAAI;EAClG;AACA,SAAOgE;AACT;AAbSjB;AAgBT,SAASQ,uBACP3D,OACAgE,aACAG,aAA+B;AAE/B,QAAMC,QAAkB,CAAA;AACxB,aAAW,CAACjE,MAAMsB,CAAAA,KAAM4C,OAAOC,QAAQtE,KAAAA,GAAQ;AAC7C,QAAIG,SAASgE,YAAa;AAC1B,QAAI3B,aAAaf,EAAEa,oBAAoB0B,WAAAA,CAAY,EAAGI,OAAMZ,KAAK/B,EAAErB,IAAI;EACzE;AACA,SAAOgE;AACT;AAXST,OAAAA,wBAAAA;","names":["buildDependsMap","permissions","present","Set","map","p","code","Map","set","dependsOn","filter","dep","has","prereqClosure","deps","out","seen","stack","length","current","pop","get","add","push","cascadeLocked","codes","directlyLocked","locked","visiting","check","viaDep","some","delete","filterGrantedByDeps","granted","ok","satisfied","every","PLATFORMS","UI_PLATFORMS","API_SURFACES","API_BUCKETS","SURFACE_BY_BUCKET","graphql","http","BUCKET_BY_SURFACE","GRAPHQL","HTTP","isApiBucket","bucket","SITE_TYPES","SERVICE_CODES","snapshotFeatureKey","code","scope","SNAPSHOT_SCHEMA_VERSION","featureAppliesAtNode","applicableSiteTypes","siteType","includes","findFeatureByCode","snapshot","code","feature","Object","values","features","undefined","buildSiteCatalog","businessCode","planCode","siteLocks","bucket","scope","availableServices","business","businesses","plans","plan","locks","catalog","sortedApps","apps","sort","a","b","name","localeCompare","app","businessAppFeatures","filter","ref","map","snapshotFeatureKey","f","isApiBucket","surfaceAllows","apiSurfaces","SURFACE_BY_BUCKET","microfrontends","web","mobile","length","membership","unlockedPermissions","memberOnBucket","sitePlatformLocked","missingServices","unmetServices","permissions","buildPermissions","lockReason","resolveLockReason","locked","unlockPlans","plansIncludingFeature","push","lucideIcon","sfSymbol","materialSymbol","remoteEntry","exposedModule","routePrefix","remoteEntryAndroid","remoteEntryIos","appCode","appName","appIcon","icon","appSortOrder","sortOrder","isPlanMember","entry","PLATFORMS","some","platform","surfaces","surface","planLocked","siteLocked","requiredServices","service","isSiteLockedOnPlatform","planMembership","planUnlocked","Set","lockEntry","perms","p","isGlobal","platforms","deps","buildDependsMap","codes","directlyPlanLocked","directlySiteLocked","has","add","directlyLocked","lockedSet","cascadeLocked","closure","prereqClosure","cascaded","planReason","c","siteReason","plansUnlockingClosure","featureCode","result","entries","unlocked","every","buildSiteRoles","roleTemplates","unionBucket","base","add","undefined","Set","composeRoleGrants","params","baseFeatures","additions","revoked","result","featureCodes","Object","keys","code","revokes","composed","bucket","PLATFORMS","merged","revoke","filter","c","includes","every","BUCKET_BY_CLIENT","web","ios","android","graphql","http","EMPTY_ROUTE","remoteEntry","exposedModule","routePrefix","resolveUserFeatures","params","snapshot","businessCode","planCode","siteLocks","platform","siteType","scope","availableServices","bucket","roleFeatures","featureByCode","code","features","snapshotFeatureKey","findFeatureByCode","catalog","buildSiteCatalog","catalogMap","Map","map","f","businessPlans","businesses","plans","currentUnlockedCodes","Set","featureCode","platforms","Object","entries","unlockedPermissions","undefined","add","planAdds","planKey","plan","adds","has","name","push","set","grantedFeatures","grant","granted","perm","get","permsSet","catalogEntry","route","isApiBucket","pickRouteForPlatform","featureDeps","buildDependsMap","permissions","permByCode","p","grantedPerms","filterGrantedByDeps","filter","c","lockedPermissions","locked","reason","lockReason","unlockPlans","missingServices","upsell","group","length","lucideIcon","sfSymbol","materialSymbol","appCode","appName","appIcon","appSortOrder","sort","a","b","localeCompare","entry","mobile","remoteEntryIos","remoteEntryAndroid","buildSiteMatrix","snapshot","businessCode","planCode","siteLocks","siteType","buildMatrix","buildPlanMatrix","allScopes","business","businesses","undefined","plans","plan","planMeta","code","name","locks","apps","app","counts","web","unlocked","total","mobile","graphql","http","features","ref","scope","feature","snapshotFeatureKey","featureAppliesAtNode","applicableSiteTypes","platforms","UI_PLATFORMS","filter","p","microfrontends","API_BUCKETS","b","apiSurfaces","includes","SURFACE_BY_BUCKET","groupByCode","Map","permissionGroups","map","g","membership","unlockedPermissions","featureInPlan","isPlanMember","siteEntry","permissions","isGlobal","cell","plat","planCodes","inPlan","selected","isSiteLockedOnPlatform","availableIn","plansUnlockingPerm","label","dependsOn","group","get","push","icon","lucideIcon","plansIncludingFeature","length","sort","a","localeCompare","featureCode","permCode","platform","excludeCode","names","Object","entries"]}

package/dist/catalog-resolver.d.cts

@@ -1,16 +1,6 @@
-import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, f as PlatformDenyCodes, A as ApiSurface, g as FeatureUnlocks, L as LockReason } from './types-B7ArIjwo.cjs';
-export { h as API_BUCKETS, i as API_SURFACES, j as ApiBucket, B as BUCKET_BY_SURFACE, k as BusinessVocabulary, C as CatalogPermission, l as FeatureLocks, n as PLATFORMS, o as SERVICE_CODES, p as SITE_TYPES, q as SNAPSHOT_SCHEMA_VERSION, D as SURFACE_BY_BUCKET, r as SnapshotApp, s as SnapshotAppFeatureRef, t as SnapshotBusiness, u as SnapshotMicrofrontendMobile, w as SnapshotMicrofrontendWeb, v as SnapshotMicrofrontends, x as SnapshotPermission, y as SnapshotPlan, z as SnapshotRoleTemplate, U as UI_PLATFORMS, G as UiPlatformBucket, H as VocabularyEntry, m as isApiBucket, E as snapshotFeatureKey } from './types-B7ArIjwo.cjs';
+import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, A as ApiSurface, f as FeatureUnlocks, g as PlatformDenyCodes, L as LockReason } from './types-Cj6uMN5E.cjs';
+export { h as API_BUCKETS, i as API_SURFACES, j as ApiBucket, B as BUCKET_BY_SURFACE, k as BusinessVocabulary, C as CatalogPermission, l as FeatureLocks, o as PLATFORMS, n as PermissionGroupRef, p as SERVICE_CODES, q as SITE_TYPES, r as SNAPSHOT_SCHEMA_VERSION, E as SURFACE_BY_BUCKET, s as SnapshotApp, t as SnapshotAppFeatureRef, u as SnapshotBusiness, v as SnapshotMicrofrontendMobile, x as SnapshotMicrofrontendWeb, w as SnapshotMicrofrontends, y as SnapshotPermission, z as SnapshotPlan, D as SnapshotRoleTemplate, U as UI_PLATFORMS, H as UiPlatformBucket, I as VocabularyEntry, m as isApiBucket, G as snapshotFeatureKey } from './types-Cj6uMN5E.cjs';
 
-/**
- * Copies a legacy `app` bucket into whichever of `graphql`/`http` an entry lacks.
- *
- * Documents written before the API surfaces were entitled separately — old snapshots, old
- * credential grants, old deny-lists — carry one `app` bucket that meant "any API surface".
- * Normalising at read time is what lets those documents keep working without a re-key: an
- * `app` grant admits both surfaces, and an `app` lock fails closed on both. Entries already
- * carrying a surface bucket keep it — the legacy value only fills gaps.
- */
-declare function normalizeApiBuckets<T extends PlatformCodes | PlatformDenyCodes>(doc: Record<string, T> | undefined): Record<string, T> | undefined;
 declare function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean;
 declare function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined;
 declare function buildSiteCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, bucket: PlatformBucket, siteType?: SiteType, scope?: ScopeType, availableServices?: ServiceCode[]): FeatureCatalogEntry[];
@@ -18,11 +8,10 @@ declare function isPlanMember(entry: PlatformCodes | undefined): boolean;
 /**
  * Whether a feature's declared API surfaces admit a caller's surface.
  *
- * Lenient on either side being unknown: a pre-flag snapshot declares nothing (`undefined`), and a
- * caller resolving without a surface (cloud's matrix builders, UI buckets) filters nothing. Strictness
- * comes from both sides being present — including a declared `[]`, which admits no surface at all.
+ * Lenient only about the caller: resolving without a surface (cloud's matrix builders, UI buckets)
+ * filters nothing. The declared list is always strict — including `[]`, which admits no surface.
  */
-declare function surfaceAllows(surfaces: ApiSurface[] | undefined, surface: ApiSurface | undefined): boolean;
+declare function surfaceAllows(surfaces: ApiSurface[], surface: ApiSurface | undefined): boolean;
 declare function isSiteLockedOnPlatform(entry: SiteFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
 declare function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
 
@@ -137,15 +126,18 @@ interface SiteMatrixFeature {
     platforms: PlatformBucket[];
     inPlan: boolean;
     availableIn: string[];
-    apiSurfaces?: ApiSurface[];
+    apiSurfaces: ApiSurface[];
     permissions: SiteMatrixPermission[];
 }
+interface MatrixCounts {
+    unlocked: number;
+    total: number;
+}
 interface SiteMatrixApp {
     code: string;
     name: string;
     icon: string | null;
-    unlockedCount: number;
-    totalCount: number;
+    counts: Record<PlatformBucket, MatrixCounts>;
     features: SiteMatrixFeature[];
 }
 interface SiteMatrix {
@@ -159,4 +151,4 @@ interface SiteMatrix {
 declare function buildSiteMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, siteType?: SiteType): SiteMatrix;
 declare function buildPlanMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks?: SiteFeatureLocks): SiteMatrix;
 
-export { ApiSurface, type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, normalizeApiBuckets, pickRouteForPlatform, prereqClosure, resolveUserFeatures, surfaceAllows };
+export { ApiSurface, type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, pickRouteForPlatform, prereqClosure, resolveUserFeatures, surfaceAllows };

package/dist/catalog-resolver.d.ts

@@ -1,16 +1,6 @@
-import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, f as PlatformDenyCodes, A as ApiSurface, g as FeatureUnlocks, L as LockReason } from './types-B7ArIjwo.js';
-export { h as API_BUCKETS, i as API_SURFACES, j as ApiBucket, B as BUCKET_BY_SURFACE, k as BusinessVocabulary, C as CatalogPermission, l as FeatureLocks, n as PLATFORMS, o as SERVICE_CODES, p as SITE_TYPES, q as SNAPSHOT_SCHEMA_VERSION, D as SURFACE_BY_BUCKET, r as SnapshotApp, s as SnapshotAppFeatureRef, t as SnapshotBusiness, u as SnapshotMicrofrontendMobile, w as SnapshotMicrofrontendWeb, v as SnapshotMicrofrontends, x as SnapshotPermission, y as SnapshotPlan, z as SnapshotRoleTemplate, U as UI_PLATFORMS, G as UiPlatformBucket, H as VocabularyEntry, m as isApiBucket, E as snapshotFeatureKey } from './types-B7ArIjwo.js';
+import { V as VersionSnapshot, S as SiteFeatureLocks, P as PlatformBucket, a as SiteType, b as ScopeType, c as ServiceCode, F as FeatureCatalogEntry, R as RoleItem, d as SnapshotFeature, e as PlatformCodes, A as ApiSurface, f as FeatureUnlocks, g as PlatformDenyCodes, L as LockReason } from './types-Cj6uMN5E.js';
+export { h as API_BUCKETS, i as API_SURFACES, j as ApiBucket, B as BUCKET_BY_SURFACE, k as BusinessVocabulary, C as CatalogPermission, l as FeatureLocks, o as PLATFORMS, n as PermissionGroupRef, p as SERVICE_CODES, q as SITE_TYPES, r as SNAPSHOT_SCHEMA_VERSION, E as SURFACE_BY_BUCKET, s as SnapshotApp, t as SnapshotAppFeatureRef, u as SnapshotBusiness, v as SnapshotMicrofrontendMobile, x as SnapshotMicrofrontendWeb, w as SnapshotMicrofrontends, y as SnapshotPermission, z as SnapshotPlan, D as SnapshotRoleTemplate, U as UI_PLATFORMS, H as UiPlatformBucket, I as VocabularyEntry, m as isApiBucket, G as snapshotFeatureKey } from './types-Cj6uMN5E.js';
 
-/**
- * Copies a legacy `app` bucket into whichever of `graphql`/`http` an entry lacks.
- *
- * Documents written before the API surfaces were entitled separately — old snapshots, old
- * credential grants, old deny-lists — carry one `app` bucket that meant "any API surface".
- * Normalising at read time is what lets those documents keep working without a re-key: an
- * `app` grant admits both surfaces, and an `app` lock fails closed on both. Entries already
- * carrying a surface bucket keep it — the legacy value only fills gaps.
- */
-declare function normalizeApiBuckets<T extends PlatformCodes | PlatformDenyCodes>(doc: Record<string, T> | undefined): Record<string, T> | undefined;
 declare function featureAppliesAtNode(applicableSiteTypes: SiteType[], siteType: SiteType): boolean;
 declare function findFeatureByCode(snapshot: VersionSnapshot, code: string): SnapshotFeature | undefined;
 declare function buildSiteCatalog(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, bucket: PlatformBucket, siteType?: SiteType, scope?: ScopeType, availableServices?: ServiceCode[]): FeatureCatalogEntry[];
@@ -18,11 +8,10 @@ declare function isPlanMember(entry: PlatformCodes | undefined): boolean;
 /**
  * Whether a feature's declared API surfaces admit a caller's surface.
  *
- * Lenient on either side being unknown: a pre-flag snapshot declares nothing (`undefined`), and a
- * caller resolving without a surface (cloud's matrix builders, UI buckets) filters nothing. Strictness
- * comes from both sides being present — including a declared `[]`, which admits no surface at all.
+ * Lenient only about the caller: resolving without a surface (cloud's matrix builders, UI buckets)
+ * filters nothing. The declared list is always strict — including `[]`, which admits no surface.
  */
-declare function surfaceAllows(surfaces: ApiSurface[] | undefined, surface: ApiSurface | undefined): boolean;
+declare function surfaceAllows(surfaces: ApiSurface[], surface: ApiSurface | undefined): boolean;
 declare function isSiteLockedOnPlatform(entry: SiteFeatureLocks[string] | undefined, platform: PlatformBucket, code: string): boolean;
 declare function buildSiteRoles(snapshot: VersionSnapshot, businessCode: string | undefined): RoleItem[];
 
@@ -137,15 +126,18 @@ interface SiteMatrixFeature {
     platforms: PlatformBucket[];
     inPlan: boolean;
     availableIn: string[];
-    apiSurfaces?: ApiSurface[];
+    apiSurfaces: ApiSurface[];
     permissions: SiteMatrixPermission[];
 }
+interface MatrixCounts {
+    unlocked: number;
+    total: number;
+}
 interface SiteMatrixApp {
     code: string;
     name: string;
     icon: string | null;
-    unlockedCount: number;
-    totalCount: number;
+    counts: Record<PlatformBucket, MatrixCounts>;
     features: SiteMatrixFeature[];
 }
 interface SiteMatrix {
@@ -159,4 +151,4 @@ interface SiteMatrix {
 declare function buildSiteMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks: SiteFeatureLocks | undefined, siteType?: SiteType): SiteMatrix;
 declare function buildPlanMatrix(snapshot: VersionSnapshot, businessCode: string | undefined, planCode: string | undefined, siteLocks?: SiteFeatureLocks): SiteMatrix;
 
-export { ApiSurface, type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, normalizeApiBuckets, pickRouteForPlatform, prereqClosure, resolveUserFeatures, surfaceAllows };
+export { ApiSurface, type ClientPlatform, type ComposeRoleGrantsParams, type DependsMap, FeatureCatalogEntry, FeatureUnlocks, LockReason, type LockedPermission, type PermissionFeature, PlatformBucket, PlatformCodes, PlatformDenyCodes, type ResolveUserFeaturesParams, type RevokedGrants, RoleItem, ScopeType, ServiceCode, SiteFeatureLocks, type SiteMatrix, type SiteMatrixApp, type SiteMatrixCell, type SiteMatrixFeature, type SiteMatrixPermission, SiteType, SnapshotFeature, VersionSnapshot, buildDependsMap, buildPlanMatrix, buildSiteCatalog, buildSiteMatrix, buildSiteRoles, cascadeLocked, composeRoleGrants, featureAppliesAtNode, filterGrantedByDeps, findFeatureByCode, isPlanMember, isSiteLockedOnPlatform, pickRouteForPlatform, prereqClosure, resolveUserFeatures, surfaceAllows };