@zudojs/permissions 0.0.1

package/dist/evaluator/evaluator.pipeline.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Permission resolution and policy evaluation pipeline.
+ *
+ * @module evaluator/evaluator.pipeline
+ */
+import type { PermissionActor, PermissionContext, PermissionDecision, PermissionPolicyDefinition, AuthorizationOptions } from "../permissionTypes/index.js";
+/** Configuration for the evaluator. */
+export interface EvaluatorOptions {
+    /** Function to look up a role definition by name. */
+    readonly getRole?: (name: string) => {
+        readonly name: string;
+        readonly permissions: readonly string[];
+        readonly inherits?: readonly string[];
+    } | undefined;
+    /** Registered policies. */
+    readonly policies?: readonly PermissionPolicyDefinition[];
+    /** Default timeout for async policy evaluation (ms). */
+    readonly policyTimeout?: number;
+}
+/**
+ * Resolve all permissions for an actor (direct + role-based).
+ */
+export declare function resolveActorPermissions(actor: PermissionActor, options: EvaluatorOptions): readonly string[];
+/**
+ * Evaluate policies for a context. Returns null if no policy matched.
+ */
+export declare function evaluatePolicies(context: PermissionContext, policies: readonly PermissionPolicyDefinition[], authOptions?: AuthorizationOptions): Promise<PermissionDecision | null>;
+//# sourceMappingURL=evaluator.pipeline.d.ts.map

package/dist/evaluator/evaluator.pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.pipeline.d.ts","sourceRoot":"","sources":["../../src/evaluator/evaluator.pipeline.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAIrC,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAC5B;QACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACvC,GACD,SAAS,CAAC;IACd,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC1D,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,gBAAgB,GACxB,SAAS,MAAM,EAAE,CAenB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,SAAS,0BAA0B,EAAE,EAC/C,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAuCpC"}

package/dist/evaluator/evaluator.pipeline.js

@@ -0,0 +1,83 @@
+/**
+ * Permission resolution and policy evaluation pipeline.
+ *
+ * @module evaluator/evaluator.pipeline
+ */
+import { resolveRolePermissions } from "../role/roleHierarchy.js";
+import { AuthorizationAbortedError } from "../permissionErrors/index.js";
+/**
+ * Resolve all permissions for an actor (direct + role-based).
+ */
+export function resolveActorPermissions(actor, options) {
+    const permissions = new Set();
+    // Direct permissions
+    if (actor.permissions) {
+        for (const p of actor.permissions)
+            permissions.add(p);
+    }
+    // Role-based permissions
+    if (actor.roles && options.getRole) {
+        const rolePerms = resolveRolePermissions(actor.roles, options.getRole);
+        for (const p of rolePerms)
+            permissions.add(p);
+    }
+    return Array.from(permissions);
+}
+/**
+ * Evaluate policies for a context. Returns null if no policy matched.
+ */
+export async function evaluatePolicies(context, policies, authOptions) {
+    if (policies.length === 0)
+        return null;
+    const permissionStr = `${context.permission.resource}:${context.permission.action}`;
+    const applicable = policies.filter((p) => p.permissions.includes(permissionStr));
+    if (applicable.length === 0)
+        return null;
+    for (const policy of applicable) {
+        try {
+            const result = await withTimeout(Promise.resolve(policy.evaluate(context)), authOptions?.policyTimeout);
+            if (!result.allowed) {
+                return Object.freeze({
+                    allowed: false,
+                    reason: result.reason ?? `policy:${policy.name}`,
+                    policy: policy.name,
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof AuthorizationAbortedError)
+                throw error;
+            // Policy error — fail closed
+            return Object.freeze({
+                allowed: false,
+                reason: `policy_error:${policy.name}`,
+                policy: policy.name,
+            });
+        }
+    }
+    return Object.freeze({
+        allowed: true,
+        reason: "policy_allow",
+        policy: applicable.map((p) => p.name).join(","),
+    });
+}
+/**
+ * Run a promise with an optional timeout.
+ */
+async function withTimeout(promise, timeoutMs) {
+    if (!timeoutMs)
+        return promise;
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error("Policy timeout"));
+        }, timeoutMs);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+//# sourceMappingURL=evaluator.pipeline.js.map

package/dist/evaluator/evaluator.pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.pipeline.js","sourceRoot":"","sources":["../../src/evaluator/evaluator.pipeline.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAkBzE;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAsB,EACtB,OAAyB;IAEzB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,qBAAqB;IACrB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,yBAAyB;IACzB,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,QAA+C,EAC/C,WAAkC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;IACpF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CACtC,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EACzC,WAAW,EAAE,aAAa,CAC3B,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,UAAU,MAAM,CAAC,IAAI,EAAE;oBAChD,MAAM,EAAE,MAAM,CAAC,IAAI;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB;gBAAE,MAAM,KAAK,CAAC;YAC5D,6BAA6B;YAC7B,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,gBAAgB,MAAM,CAAC,IAAI,EAAE;gBACrC,MAAM,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CACxB,OAAmB,EACnB,SAAkB;IAElB,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAE/B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtC,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/evaluator/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Core permission evaluator — the heart of the authorization engine.
+ *
+ * @module evaluator
+ */
+export { evaluate, evaluateWithExplain } from "./evaluator.core.js";
+export type { EvaluatorOptions } from "./evaluator.pipeline.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/evaluator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evaluator/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/evaluator/index.js

@@ -0,0 +1,7 @@
+/**
+ * Core permission evaluator — the heart of the authorization engine.
+ *
+ * @module evaluator
+ */
+export { evaluate, evaluateWithExplain } from "./evaluator.core.js";
+//# sourceMappingURL=index.js.map

package/dist/evaluator/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/evaluator/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/http/httpHelpers.d.ts

@@ -0,0 +1,28 @@
+/**
+ * HTTP response helpers for permission middleware.
+ *
+ * @module http/httpHelpers
+ */
+import type { PermissionDecision } from "../permissionTypes/index.js";
+/** Options for creating denied responses. */
+export interface DeniedResponseOptions {
+    /** Custom 403 response body function. */
+    readonly deniedResponse?: (decision: PermissionDecision) => unknown;
+}
+/**
+ * Create a 403 Forbidden JSON response.
+ */
+export declare function createForbiddenResponse(reason: string, options?: DeniedResponseOptions): {
+    readonly status: 403;
+    readonly body: unknown;
+    readonly headers: Record<string, string>;
+};
+/**
+ * Create a JSON response.
+ */
+export declare function createJsonResponse(status: number, body: unknown): {
+    readonly status: number;
+    readonly body: unknown;
+    readonly headers: Record<string, string>;
+};
+//# sourceMappingURL=httpHelpers.d.ts.map

package/dist/http/httpHelpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpHelpers.d.ts","sourceRoot":"","sources":["../../src/http/httpHelpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,yCAAyC;IACzC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC;CACrE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,qBAAqB,GAC9B;IACD,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C,CAUA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ;IACD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C,CAMA"}

package/dist/http/httpHelpers.js

@@ -0,0 +1,29 @@
+/**
+ * HTTP response helpers for permission middleware.
+ *
+ * @module http/httpHelpers
+ */
+/**
+ * Create a 403 Forbidden JSON response.
+ */
+export function createForbiddenResponse(reason, options) {
+    const body = options?.deniedResponse
+        ? options.deniedResponse({ allowed: false, reason })
+        : { error: "Forbidden", message: reason };
+    return Object.freeze({
+        status: 403,
+        body,
+        headers: { "content-type": "application/json" },
+    });
+}
+/**
+ * Create a JSON response.
+ */
+export function createJsonResponse(status, body) {
+    return Object.freeze({
+        status,
+        body,
+        headers: { "content-type": "application/json" },
+    });
+}
+//# sourceMappingURL=httpHelpers.js.map

package/dist/http/httpHelpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpHelpers.js","sourceRoot":"","sources":["../../src/http/httpHelpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,OAA+B;IAM/B,MAAM,IAAI,GAAG,OAAO,EAAE,cAAc;QAClC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpD,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,GAAY;QACpB,IAAI;QACJ,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAa;IAMb,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC"}

package/dist/http/httpMiddleware.core.d.ts

@@ -0,0 +1,48 @@
+/**
+ * HTTP middleware adapter for @zudojs/permissions.
+ *
+ * Provides middleware factories that integrate the authorization engine
+ * with @zudojs/http's middleware pipeline.
+ *
+ * @module http/httpMiddleware
+ */
+import type { PermissionActor, PermissionDecision, AuthorizationOptions } from "../permissionTypes/index.js";
+import type { PermissionEngine } from "../evaluator/authorizationEngine.js";
+import type { HttpMiddleware, HttpMiddlewareContext } from "./httpTypes.js";
+/** Options for the authorize middleware. */
+export interface AuthorizeMiddlewareOptions {
+    /** Function to extract an actor from the request context. */
+    readonly extractActor: (context: HttpMiddlewareContext) => PermissionActor | Promise<PermissionActor> | undefined;
+    /** Authorization options (signal, policyTimeout). */
+    readonly authorization?: AuthorizationOptions;
+    /** Custom 403 response body. */
+    readonly deniedResponse?: (decision: PermissionDecision) => unknown;
+}
+/** Options for the requirePermission middleware. */
+export interface RequirePermissionMiddlewareOptions extends AuthorizeMiddlewareOptions {
+    /** The permission to check (e.g. "post:update"). */
+    readonly permission: string;
+    /** Function to extract the resource from the request (optional). */
+    readonly extractResource?: (context: HttpMiddlewareContext) => unknown;
+}
+/** State key for the current actor. */
+export declare const ACTOR_STATE_KEY = "permissions:actor";
+/** State key for the authorization decision. */
+export declare const DECISION_STATE_KEY = "permissions:decision";
+/**
+ * Create middleware that extracts the actor from the request and stores it in state.
+ */
+export declare function createActorMiddleware(options: AuthorizeMiddlewareOptions): HttpMiddleware;
+/**
+ * Create middleware that checks a permission and returns 403 if denied.
+ */
+export declare function createRequirePermissionMiddleware(engine: PermissionEngine, options: RequirePermissionMiddlewareOptions): HttpMiddleware;
+/**
+ * Create middleware that checks a permission and short-circuits on denial.
+ */
+export declare function authorize(engine: PermissionEngine, permission: string, options: Omit<RequirePermissionMiddlewareOptions, "permission">): HttpMiddleware;
+/**
+ * Create middleware that checks multiple permissions in batch.
+ */
+export declare function createRequirePermissionsMiddleware(engine: PermissionEngine, permissions: readonly string[], options: AuthorizeMiddlewareOptions): HttpMiddleware;
+//# sourceMappingURL=httpMiddleware.core.d.ts.map

package/dist/http/httpMiddleware.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpMiddleware.core.d.ts","sourceRoot":"","sources":["../../src/http/httpMiddleware.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5E,4CAA4C;AAC5C,MAAM,WAAW,0BAA0B;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,CACrB,OAAO,EAAE,qBAAqB,KAC3B,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC;IAC5D,qDAAqD;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,gCAAgC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC;CACrE;AAED,oDAAoD;AACpD,MAAM,WAAW,kCAAmC,SAAQ,0BAA0B;IACpF,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;CACxE;AAID,uCAAuC;AACvC,eAAO,MAAM,eAAe,sBAAsB,CAAC;AAEnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAIzD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,0BAA0B,GAClC,cAAc,CAQhB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,kCAAkC,GAC1C,cAAc,CAyBhB;AAED;;GAEG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,IAAI,CAAC,kCAAkC,EAAE,YAAY,CAAC,GAC9D,cAAc,CAQhB;AAED;;GAEG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,gBAAgB,EACxB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,OAAO,EAAE,0BAA0B,GAClC,cAAc,CA8BhB"}

package/dist/http/httpMiddleware.core.js

@@ -0,0 +1,81 @@
+/**
+ * HTTP middleware adapter for @zudojs/permissions.
+ *
+ * Provides middleware factories that integrate the authorization engine
+ * with @zudojs/http's middleware pipeline.
+ *
+ * @module http/httpMiddleware
+ */
+import { createForbiddenResponse, createJsonResponse } from "./httpHelpers.js";
+// ─── State Keys ───────────────────────────────────────────────────────────
+/** State key for the current actor. */
+export const ACTOR_STATE_KEY = "permissions:actor";
+/** State key for the authorization decision. */
+export const DECISION_STATE_KEY = "permissions:decision";
+// ─── Middleware Factories ──────────────────────────────────────────────────
+/**
+ * Create middleware that extracts the actor from the request and stores it in state.
+ */
+export function createActorMiddleware(options) {
+    return async (context, next) => {
+        const actor = await options.extractActor(context);
+        if (actor) {
+            context.state.set(ACTOR_STATE_KEY, actor);
+        }
+        return next();
+    };
+}
+/**
+ * Create middleware that checks a permission and returns 403 if denied.
+ */
+export function createRequirePermissionMiddleware(engine, options) {
+    return async (context, next) => {
+        const actor = context.state.get(ACTOR_STATE_KEY);
+        if (!actor) {
+            return createForbiddenResponse("No actor found in request context", options);
+        }
+        const resource = options.extractResource?.(context);
+        const decision = await engine.check(actor, options.permission, resource, options.authorization);
+        context.state.set(DECISION_STATE_KEY, decision);
+        if (!decision.allowed) {
+            return createForbiddenResponse(decision.reason ?? "Access denied", options);
+        }
+        return next();
+    };
+}
+/**
+ * Create middleware that checks a permission and short-circuits on denial.
+ */
+export function authorize(engine, permission, options) {
+    return createRequirePermissionMiddleware(engine, {
+        permission,
+        extractActor: options.extractActor,
+        authorization: options.authorization,
+        deniedResponse: options.deniedResponse,
+        extractResource: options.extractResource,
+    });
+}
+/**
+ * Create middleware that checks multiple permissions in batch.
+ */
+export function createRequirePermissionsMiddleware(engine, permissions, options) {
+    return async (context, next) => {
+        const actor = context.state.get(ACTOR_STATE_KEY);
+        if (!actor) {
+            return createForbiddenResponse("No actor found in request context", options);
+        }
+        const results = new Map();
+        for (const perm of permissions) {
+            const decision = await engine.check(actor, perm, undefined, options.authorization);
+            results.set(perm, decision);
+        }
+        context.state.set("permissions:decisions", results);
+        for (const [perm, decision] of results) {
+            if (!decision.allowed) {
+                return createForbiddenResponse(decision.reason ?? `Missing permission: ${perm}`, options);
+            }
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=httpMiddleware.core.js.map

package/dist/http/httpMiddleware.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpMiddleware.core.js","sourceRoot":"","sources":["../../src/http/httpMiddleware.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAwB/E,6EAA6E;AAE7E,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAmC;IAEnC,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAC/C,MAAwB,EACxB,OAA2C;IAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAkB,eAAe,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,uBAAuB,CAC5B,mCAAmC,EACnC,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,KAAK,EACL,OAAO,CAAC,UAAU,EAClB,QAAQ,EACR,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,uBAAuB,CAC5B,QAAQ,CAAC,MAAM,IAAI,eAAe,EAClC,OAAO,CACR,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,MAAwB,EACxB,UAAkB,EAClB,OAA+D;IAE/D,OAAO,iCAAiC,CAAC,MAAM,EAAE;QAC/C,UAAU;QACV,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAwB,EACxB,WAA8B,EAC9B,OAAmC;IAEnC,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAkB,eAAe,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,uBAAuB,CAC5B,mCAAmC,EACnC,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,KAAK,EACL,IAAI,EACJ,SAAS,EACT,OAAO,CAAC,aAAa,CACtB,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,uBAAuB,CAC5B,QAAQ,CAAC,MAAM,IAAI,uBAAuB,IAAI,EAAE,EAChD,OAAO,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/httpTypes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Local HTTP type definitions for the middleware adapter.
+ *
+ * These mirror the types from @zudojs/http so the permissions package
+ * can reference them without a hard dependency on the HTTP package.
+ *
+ * @module http/httpTypes
+ */
+/** HTTP middleware signature from @zudojs/http. */
+export type HttpMiddleware = (context: HttpMiddlewareContext, next: () => Promise<HttpResponseContext>) => void | Response | HttpResponseContext | Promise<void | Response | HttpResponseContext>;
+/** HTTP middleware context from @zudojs/http. */
+export interface HttpMiddlewareContext {
+    readonly request: HttpRequestContext;
+    readonly response: HttpResponseContext;
+    readonly state: HttpMiddlewareState;
+    readonly signal: AbortSignal;
+    readonly metadata: Readonly<Record<string, unknown>>;
+}
+/** HTTP request context from @zudojs/http. */
+export interface HttpRequestContext {
+    readonly id: string;
+    readonly method: string;
+    readonly url: string;
+    readonly path: string;
+    readonly headers: ReadonlyMap<string, string>;
+    readonly params: ReadonlyMap<string, string>;
+    readonly query: ReadonlyMap<string, string | readonly string[] | undefined>;
+}
+/** HTTP response context from @zudojs/http. */
+export interface HttpResponseContext {
+    readonly status: number;
+    readonly headers: Headers | Record<string, string>;
+    readonly body?: unknown;
+}
+/** HTTP middleware state from @zudojs/http. */
+export interface HttpMiddlewareState {
+    get<T = unknown>(key: string): T | undefined;
+    set<T = unknown>(key: string, value: T): void;
+}
+//# sourceMappingURL=httpTypes.d.ts.map

package/dist/http/httpTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpTypes.d.ts","sourceRoot":"","sources":["../../src/http/httpTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,mDAAmD;AACnD,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAEtC,IAAI,GACJ,QAAQ,GACR,mBAAmB,GACnB,OAAO,CAAC,IAAI,GAAG,QAAQ,GAAG,mBAAmB,CAAC,CAAC;AAEnD,iDAAiD;AACjD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CAC7E;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAC7C,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;CAC/C"}

package/dist/http/httpTypes.js

@@ -0,0 +1,10 @@
+/**
+ * Local HTTP type definitions for the middleware adapter.
+ *
+ * These mirror the types from @zudojs/http so the permissions package
+ * can reference them without a hard dependency on the HTTP package.
+ *
+ * @module http/httpTypes
+ */
+export {};
+//# sourceMappingURL=httpTypes.js.map

package/dist/http/httpTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpTypes.js","sourceRoot":"","sources":["../../src/http/httpTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/http/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * HTTP middleware adapter for @zudojs/permissions.
+ *
+ * Requires @zudojs/http as a peer dependency.
+ *
+ * @module http
+ */
+export { createActorMiddleware, createRequirePermissionMiddleware, authorize, createRequirePermissionsMiddleware, ACTOR_STATE_KEY, DECISION_STATE_KEY, type AuthorizeMiddlewareOptions, type RequirePermissionMiddlewareOptions, } from "./httpMiddleware.core.js";
+export { createForbiddenResponse, createJsonResponse, type DeniedResponseOptions, } from "./httpHelpers.js";
+export type { HttpMiddleware, HttpMiddlewareContext, HttpRequestContext, HttpResponseContext, HttpMiddlewareState, } from "./httpTypes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,qBAAqB,EACrB,iCAAiC,EACjC,SAAS,EACT,kCAAkC,EAClC,eAAe,EACf,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC"}

package/dist/http/index.js

@@ -0,0 +1,10 @@
+/**
+ * HTTP middleware adapter for @zudojs/permissions.
+ *
+ * Requires @zudojs/http as a peer dependency.
+ *
+ * @module http
+ */
+export { createActorMiddleware, createRequirePermissionMiddleware, authorize, createRequirePermissionsMiddleware, ACTOR_STATE_KEY, DECISION_STATE_KEY, } from "./httpMiddleware.core.js";
+export { createForbiddenResponse, createJsonResponse, } from "./httpHelpers.js";
+//# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,qBAAqB,EACrB,iCAAiC,EACjC,SAAS,EACT,kCAAkC,EAClC,eAAe,EACf,kBAAkB,GAGnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,GAEnB,MAAM,kBAAkB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @zudojs/permissions
+ *
+ * Authorization engine for the Zudojs framework.
+ *
+ * Supports RBAC, ABAC, resource policies, wildcards, role hierarchy,
+ * condition combinators, ability compilation, and explain mode.
+ *
+ * @module @zudojs/permissions
+ */
+export * from "./permissionTypes/index.js";
+export * from "./permissionErrors/index.js";
+export * from "./permission/index.js";
+export * from "./actor/index.js";
+export * from "./role/index.js";
+export * from "./rule/index.js";
+export * from "./conditions/index.js";
+export * from "./policy/index.js";
+export * from "./ability/index.js";
+export * from "./evaluator/index.js";
+export * from "./resolvers/index.js";
+export * from "./cache/index.js";
+export * from "./observability/index.js";
+export * from "./utils/index.js";
+export * from "./http/index.js";
+export { createPermissionEngine, type PermissionEngine, type PermissionEngineOptions, } from "./evaluator/authorizationEngine.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,GAC7B,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+/**
+ * @zudojs/permissions
+ *
+ * Authorization engine for the Zudojs framework.
+ *
+ * Supports RBAC, ABAC, resource policies, wildcards, role hierarchy,
+ * condition combinators, ability compilation, and explain mode.
+ *
+ * @module @zudojs/permissions
+ */
+export * from "./permissionTypes/index.js";
+export * from "./permissionErrors/index.js";
+export * from "./permission/index.js";
+export * from "./actor/index.js";
+export * from "./role/index.js";
+export * from "./rule/index.js";
+export * from "./conditions/index.js";
+export * from "./policy/index.js";
+export * from "./ability/index.js";
+export * from "./evaluator/index.js";
+export * from "./resolvers/index.js";
+export * from "./cache/index.js";
+export * from "./observability/index.js";
+export * from "./utils/index.js";
+export * from "./http/index.js";
+export { createPermissionEngine, } from "./evaluator/authorizationEngine.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,OAAO,EACL,sBAAsB,GAGvB,MAAM,oCAAoC,CAAC"}

package/dist/observability/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Authorization observability — events, metrics, and tracing.
+ *
+ * @module observability
+ */
+export { createPermissionEventEmitter, withObservability, type PermissionCheckEvent, type PermissionEventHandler, } from "./observability.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/observability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,GAC5B,MAAM,yBAAyB,CAAC"}

package/dist/observability/index.js

@@ -0,0 +1,7 @@
+/**
+ * Authorization observability — events, metrics, and tracing.
+ *
+ * @module observability
+ */
+export { createPermissionEventEmitter, withObservability, } from "./observability.core.js";
+//# sourceMappingURL=index.js.map

package/dist/observability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC"}

package/dist/observability/observability.core.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Observability helpers for authorization events and metrics.
+ *
+ * @module observability/observability
+ */
+import type { PermissionDecision } from "../permissionTypes/index.js";
+/** Event emitted when a permission check completes. */
+export interface PermissionCheckEvent {
+    /** Actor ID. */
+    readonly actorId: string;
+    /** Permission checked. */
+    readonly permission: string;
+    /** Resource type (if available). */
+    readonly resourceType?: string;
+    /** Whether allowed. */
+    readonly allowed: boolean;
+    /** Decision reason. */
+    readonly reason?: string;
+    /** Evaluation duration in ms. */
+    readonly durationMs: number;
+}
+/** Handler for permission events. */
+export type PermissionEventHandler = (event: PermissionCheckEvent) => void;
+/**
+ * Create a permission event emitter.
+ */
+export declare function createPermissionEventEmitter(): {
+    /** Register an event handler. */
+    on(handler: PermissionEventHandler): () => void;
+    /** Emit a permission check event. */
+    emit(event: PermissionCheckEvent): void;
+};
+/**
+ * Wrap a permission check with observability.
+ *
+ * @param emitter - The event emitter.
+ * @param fn - The permission check function.
+ * @returns Wrapped function that emits events.
+ */
+export declare function withObservability<T extends (...args: readonly unknown[]) => Promise<PermissionDecision>>(emitter: ReturnType<typeof createPermissionEventEmitter>, fn: T): T;
+//# sourceMappingURL=observability.core.d.ts.map

package/dist/observability/observability.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.core.d.ts","sourceRoot":"","sources":["../../src/observability/observability.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,gBAAgB;IAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oCAAoC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qCAAqC;AACrC,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAE3E;;GAEG;AACH,wBAAgB,4BAA4B;IAIxC,iCAAiC;IACjC,EAAE,UAAU,sBAAsB,GAAG,MAAM,IAAI;IAO/C,qCAAqC;IACrC,IAAI,QAAQ,oBAAoB,GAAG,IAAI;EAU1C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KAAK,OAAO,CAAC,kBAAkB,CAAC,EACtE,OAAO,EAAE,UAAU,CAAC,OAAO,4BAA4B,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAgBpE"}