ramosedb 0.0.0-stage → 0.4.0

package/dist/internal/authorization/validation/catalog.js

@@ -0,0 +1,417 @@
+import * as Result from "effect/Result";
+import { fieldKey, invalid, isBlank, mismatch, operationKey, requireNonBlank, SEPARATOR, } from "./common.js";
+import { validateInputShapeKeys } from "./descriptors.js";
+const isBlankDoc = (doc) => doc.trim().length === 0;
+const catalogOfIdentity = (identity, expected, label) => {
+    if (identity.catalog !== expected.catalog) {
+        return mismatch({
+            message: `stale identity: cross-catalog ${label}`,
+            expected: expected.catalog,
+            actual: identity.catalog,
+        });
+    }
+    return Result.succeed(undefined);
+};
+const validateTarget = (target, descriptor) => Result.gen(function* () {
+    yield* Result.all([
+        requireNonBlank(target.database, "database"),
+        requireNonBlank(target.catalog, "catalog id"),
+        requireNonBlank(target.catalogVersion, "catalog version"),
+        requireNonBlank(target.schemaFingerprint, "schema fingerprint"),
+        requireNonBlank(descriptor.database, "descriptor database"),
+        requireNonBlank(descriptor.id, "descriptor catalog id"),
+        requireNonBlank(descriptor.version, "descriptor catalog version"),
+        requireNonBlank(descriptor.fingerprint, "descriptor schema fingerprint"),
+    ]);
+    if (target.database !== descriptor.database) {
+        return yield* mismatch({
+            message: "cross-database catalog",
+            expectedDatabase: target.database,
+            actualDatabase: descriptor.database,
+        });
+    }
+    if (target.catalog !== descriptor.id) {
+        return yield* mismatch({
+            message: "cross-catalog descriptor",
+            expected: target.catalog,
+            actual: descriptor.id,
+        });
+    }
+    if (target.catalogVersion !== descriptor.version) {
+        return yield* mismatch({
+            message: "stale catalog version",
+            expected: target.catalog,
+            actual: descriptor.id,
+            expectedVersion: target.catalogVersion,
+            actualVersion: descriptor.version,
+        });
+    }
+    if (target.schemaFingerprint !== descriptor.fingerprint) {
+        return yield* mismatch({
+            message: "schema fingerprint mismatch",
+            expected: target.catalog,
+            actual: descriptor.id,
+            expectedFingerprint: target.schemaFingerprint,
+            actualFingerprint: descriptor.fingerprint,
+        });
+    }
+});
+const closeTraits = (edges) => Result.gen(function* () {
+    const closed = new Map();
+    const visit = (name, active, done) => Result.gen(function* () {
+        if (active.includes(name)) {
+            return yield* invalid(`trait composition cycle: ${[...active, name].join(" → ")}`);
+        }
+        if (done.has(name))
+            return;
+        active.push(name);
+        const nested = edges.get(name);
+        if (nested !== undefined) {
+            for (const child of nested) {
+                yield* visit(child, active, done);
+            }
+        }
+        active.pop();
+        done.add(name);
+    });
+    for (const [name, direct] of edges) {
+        const done = new Set();
+        for (const child of direct) {
+            yield* visit(child, [], done);
+        }
+        closed.set(name, done);
+    }
+    return closed;
+});
+const validateFieldRefTarget = (refTarget, target, entities, traits) => Result.gen(function* () {
+    if (refTarget._tag === "self" || refTarget._tag === "untargeted") {
+        return;
+    }
+    if (refTarget._tag === "entity") {
+        yield* catalogOfIdentity(refTarget.entity, target, "field ref target");
+        if (!entities.has(refTarget.entity.name)) {
+            return yield* invalid(`missing field ref target entity '${refTarget.entity.name}'`);
+        }
+        return;
+    }
+    yield* catalogOfIdentity(refTarget.trait, target, "field ref target");
+    if (!traits.has(refTarget.trait.name)) {
+        return yield* invalid(`missing field ref target trait '${refTarget.trait.name}'`);
+    }
+});
+const validateOperationShape = (shape, target, entities, traits, allowSelf, operationName) => Result.gen(function* () {
+    switch (shape._tag) {
+        case "scalar":
+        case "opaque":
+            return;
+        case "ref":
+            if (shape.refTarget._tag === "self" && !allowSelf) {
+                return yield* invalid(`targetless operation '${operationName}' cannot reference self`);
+            }
+            return yield* validateFieldRefTarget(shape.refTarget, target, entities, traits);
+        case "array":
+            return yield* validateOperationShape(shape.items, target, entities, traits, allowSelf, operationName);
+        case "struct":
+            yield* Result.all(shape.fields.map((field) => validateOperationShape(field.shape, target, entities, traits, allowSelf, operationName)));
+    }
+});
+export const prepareAuthorizationCatalog = (target, descriptor) => Result.gen(function* () {
+    yield* validateTarget(target, descriptor);
+    const entities = new Map();
+    const traits = new Map();
+    const fields = new Map();
+    const operations = new Map();
+    const entityTraitEdges = new Map();
+    const traitTraitEdges = new Map();
+    for (const entity of descriptor.entities) {
+        yield* catalogOfIdentity(entity.id, target, "entity");
+        if (isBlank(entity.id.name))
+            return yield* invalid("blank entity name");
+        if (entity.doc !== undefined && isBlankDoc(entity.doc)) {
+            return yield* invalid(`blank entity doc for '${entity.id.name}'`);
+        }
+        if (entities.has(entity.id.name)) {
+            return yield* invalid(`ambiguous entity '${entity.id.name}'`);
+        }
+        entities.set(entity.id.name, entity.id);
+        const composed = new Set();
+        for (const trait of entity.traits) {
+            yield* catalogOfIdentity(trait, target, "entity trait");
+            if (isBlank(trait.name))
+                return yield* invalid("blank trait name");
+            composed.add(trait.name);
+        }
+        entityTraitEdges.set(entity.id.name, composed);
+    }
+    for (const trait of descriptor.traits) {
+        yield* catalogOfIdentity(trait.id, target, "trait");
+        if (isBlank(trait.id.name))
+            return yield* invalid("blank trait name");
+        if (trait.doc !== undefined && isBlankDoc(trait.doc)) {
+            return yield* invalid(`blank trait doc for '${trait.id.name}'`);
+        }
+        if (traits.has(trait.id.name)) {
+            return yield* invalid(`ambiguous trait '${trait.id.name}'`);
+        }
+        traits.set(trait.id.name, trait.id);
+        const composed = new Set();
+        for (const nested of trait.traits) {
+            yield* catalogOfIdentity(nested, target, "trait composition");
+            if (isBlank(nested.name))
+                return yield* invalid("blank trait name");
+            composed.add(nested.name);
+        }
+        traitTraitEdges.set(trait.id.name, composed);
+    }
+    for (const field of descriptor.fields) {
+        yield* catalogOfIdentity(field.id, target, "field");
+        if (isBlank(field.id.localName))
+            return yield* invalid("blank field local name");
+        if (isBlank(field.id.owner.name))
+            return yield* invalid("blank field owner name");
+        if (field.doc !== undefined && isBlankDoc(field.doc)) {
+            return yield* invalid(`blank field doc for '${field.id.owner.name}.${field.id.localName}'`);
+        }
+        const key = fieldKey(field.id);
+        if (fields.has(key))
+            return yield* invalid(`ambiguous field '${key}'`);
+        const owner = field.id.owner;
+        if (owner.kind === "entity") {
+            if (!entities.has(owner.name)) {
+                return yield* invalid(`missing owner entity '${owner.name}' for field '${field.id.localName}'`);
+            }
+        }
+        else if (!traits.has(owner.name)) {
+            return yield* invalid(`missing owner trait '${owner.name}' for field '${field.id.localName}'`);
+        }
+        if (field.valueType === "ref") {
+            yield* validateFieldRefTarget(field.refTarget, target, entities, traits);
+        }
+        fields.set(key, field);
+    }
+    for (const operation of descriptor.operations) {
+        yield* catalogOfIdentity(operation.id, target, "operation");
+        if (isBlank(operation.id.localName))
+            return yield* invalid("blank operation local name");
+        if (isBlank(operation.id.owner.name))
+            return yield* invalid("blank operation owner name");
+        const key = operationKey(operation.id);
+        if (operations.has(key))
+            return yield* invalid(`ambiguous operation '${key}'`);
+        const owner = operation.id.owner;
+        if (owner.kind === "entity") {
+            if (!entities.has(owner.name)) {
+                return yield* invalid(`missing operation owner entity '${owner.name}'`);
+            }
+        }
+        else if (!traits.has(owner.name)) {
+            return yield* invalid(`missing operation owner trait '${owner.name}'`);
+        }
+        if (operation.doc !== undefined && isBlankDoc(operation.doc)) {
+            return yield* invalid(`blank operation doc for '${owner.name}.${operation.id.localName}'`);
+        }
+        yield* validateInputShapeKeys(operation.input);
+        yield* validateInputShapeKeys(operation.output);
+        yield* Result.all([
+            validateOperationShape(operation.input, target, entities, traits, operation.id.target === "required", `${owner.name}.${operation.id.localName}`),
+            validateOperationShape(operation.output, target, entities, traits, operation.id.target === "required", `${owner.name}.${operation.id.localName}`),
+        ]);
+        const declaredComposers = new Set();
+        for (const composer of operation.composers) {
+            yield* catalogOfIdentity(composer, target, "operation composer");
+            if (!entities.has(composer.name)) {
+                return yield* invalid(`missing operation composer entity '${composer.name}'`);
+            }
+            if (declaredComposers.has(composer.name)) {
+                return yield* invalid(`duplicate operation composer '${composer.name}'`);
+            }
+            declaredComposers.add(composer.name);
+        }
+        const declaredWrites = new Set();
+        for (const entity of operation.writes) {
+            yield* catalogOfIdentity(entity, target, "operation write dependency");
+            if (!entities.has(entity.name)) {
+                return yield* invalid(`missing operation write entity '${entity.name}'`);
+            }
+            if (declaredWrites.has(entity.name)) {
+                return yield* invalid(`duplicate operation write entity '${entity.name}'`);
+            }
+            declaredWrites.add(entity.name);
+        }
+        if (operation.id.target === "none" ||
+            operation.id.owner.kind === "entity") {
+            if (operation.composers.length !== 0) {
+                return yield* invalid(`operation '${owner.name}.${operation.id.localName}' cannot declare composers`);
+            }
+        }
+        operations.set(key, operation);
+    }
+    const traitTraits = yield* closeTraits(traitTraitEdges);
+    const entityTraits = new Map();
+    for (const [name, direct] of entityTraitEdges) {
+        const seen = new Set();
+        for (const trait of direct) {
+            seen.add(trait);
+            const nested = traitTraits.get(trait);
+            if (nested !== undefined) {
+                for (const child of nested)
+                    seen.add(child);
+            }
+        }
+        entityTraits.set(name, seen);
+    }
+    for (const operation of operations.values()) {
+        if (operation.id.owner.kind !== "trait")
+            continue;
+        const ownerName = operation.id.owner.name;
+        const expected = [...entityTraits]
+            .filter(([, composed]) => composed.has(ownerName))
+            .map(([entityName]) => entityName)
+            .sort();
+        if (expected.length === 0) {
+            return yield* invalid(`unreachable trait operation owner '${ownerName}' for '${operation.id.localName}'`);
+        }
+        if (operation.id.target === "none")
+            continue;
+        const declared = operation.composers.map((composer) => composer.name).sort();
+        if (declared.length !== expected.length ||
+            expected.some((name, index) => declared[index] !== name)) {
+            return yield* invalid(`contradictory operation composers for '${ownerName}.${operation.id.localName}'`);
+        }
+    }
+    const seenComposition = new Set();
+    for (const row of descriptor.traitComposition) {
+        yield* catalogOfIdentity(row.composer, target, "trait-composition composer");
+        yield* catalogOfIdentity(row.trait, target, "trait-composition trait");
+        if (!entities.has(row.composer.name)) {
+            return yield* invalid(`missing composer entity '${row.composer.name}'`);
+        }
+        if (!traits.has(row.trait.name)) {
+            return yield* invalid(`missing composed trait '${row.trait.name}'`);
+        }
+        const compositionKey = `${row.composer.name}${SEPARATOR}${row.trait.name}`;
+        if (seenComposition.has(compositionKey)) {
+            return yield* invalid(`duplicate trait composition '${row.composer.name}'/'${row.trait.name}'`);
+        }
+        seenComposition.add(compositionKey);
+        const computed = entityTraits.get(row.composer.name);
+        if (computed === undefined || !computed.has(row.trait.name)) {
+            return yield* invalid(`entity '${row.composer.name}' does not compose trait '${row.trait.name}'`);
+        }
+        const expected = new Set([row.trait.name]);
+        const nested = traitTraits.get(row.trait.name);
+        if (nested !== undefined) {
+            for (const child of nested)
+                expected.add(child);
+        }
+        const declared = new Set();
+        for (const transitive of row.transitive) {
+            yield* catalogOfIdentity(transitive, target, "trait-composition transitive");
+            if (!traits.has(transitive.name)) {
+                return yield* invalid(`missing transitive trait '${transitive.name}'`);
+            }
+            if (declared.has(transitive.name)) {
+                return yield* invalid(`duplicate transitive trait '${transitive.name}'`);
+            }
+            declared.add(transitive.name);
+        }
+        if (expected.size !== declared.size) {
+            return yield* invalid(`contradictory trait composition for '${row.composer.name}'/'${row.trait.name}'`);
+        }
+        for (const name of expected) {
+            if (!declared.has(name)) {
+                return yield* invalid(`contradictory trait composition for '${row.composer.name}'/'${row.trait.name}'`);
+            }
+        }
+    }
+    for (const [entityName, direct] of entityTraitEdges) {
+        for (const traitName of direct) {
+            if (!seenComposition.has(`${entityName}${SEPARATOR}${traitName}`)) {
+                return yield* invalid(`missing trait composition for '${entityName}'/'${traitName}'`);
+            }
+        }
+    }
+    return {
+        target,
+        entities,
+        traits,
+        fields,
+        operations,
+        entityTraits,
+        traitTraits,
+    };
+});
+export const requireEntity = (index, id, label) => Result.gen(function* () {
+    yield* catalogOfIdentity(id, index.target, label);
+    const found = index.entities.get(id.name);
+    if (found === undefined)
+        return yield* invalid(`stale identity: missing ${label} '${id.name}'`);
+    return found;
+});
+export const requireTrait = (index, id, label) => Result.gen(function* () {
+    yield* catalogOfIdentity(id, index.target, label);
+    const found = index.traits.get(id.name);
+    if (found === undefined)
+        return yield* invalid(`stale identity: missing ${label} '${id.name}'`);
+    return found;
+});
+export const requireField = (index, id, label) => Result.gen(function* () {
+    yield* catalogOfIdentity(id, index.target, label);
+    const found = index.fields.get(fieldKey(id));
+    if (found === undefined) {
+        return yield* invalid(`stale identity: missing ${label} '${id.owner.kind}:${id.owner.name}.${id.localName}'`);
+    }
+    return found;
+});
+export const requireOperation = (index, id, label) => Result.gen(function* () {
+    yield* catalogOfIdentity(id, index.target, label);
+    const found = index.operations.get(operationKey(id));
+    if (found === undefined) {
+        return yield* invalid(`stale identity: missing ${label} '${id.owner.kind}:${id.owner.name}.${id.localName}'`);
+    }
+    return found;
+});
+export const entityComposes = (index, entity, traitName) => index.entityTraits.get(entity.name)?.has(traitName) === true;
+export const traitComposes = (index, trait, otherName) => trait.name === otherName || index.traitTraits.get(trait.name)?.has(otherName) === true;
+export const fieldAccessibleFrom = (index, focus, field) => {
+    const owner = field.id.owner;
+    if (focus._tag === "entity") {
+        if (owner.kind === "entity")
+            return owner.name === focus.entity.name;
+        return entityComposes(index, focus.entity, owner.name);
+    }
+    if (owner.kind === "entity")
+        return false;
+    return traitComposes(index, focus.trait, owner.name);
+};
+export const ownerFocus = (index, owner) => {
+    if (owner.kind === "entity") {
+        const entity = index.entities.get(owner.name);
+        if (entity === undefined)
+            return invalid(`missing owner entity '${owner.name}'`);
+        return Result.succeed({ _tag: "entity", entity });
+    }
+    const trait = index.traits.get(owner.name);
+    if (trait === undefined)
+        return invalid(`missing owner trait '${owner.name}'`);
+    return Result.succeed({ _tag: "trait", trait });
+};
+export const sameRow = (index, left, right) => {
+    if (left._tag === "entity" && right._tag === "entity") {
+        return left.entity.catalog === right.entity.catalog && left.entity.name === right.entity.name;
+    }
+    if (left._tag === "trait" && right._tag === "trait") {
+        if (left.trait.catalog !== right.trait.catalog)
+            return false;
+        return (traitComposes(index, left.trait, right.trait.name) ||
+            traitComposes(index, right.trait, left.trait.name));
+    }
+    if (left._tag === "entity" && right._tag === "trait") {
+        return entityComposes(index, left.entity, right.trait.name);
+    }
+    if (left._tag === "trait" && right._tag === "entity") {
+        return entityComposes(index, right.entity, left.trait.name);
+    }
+    return false;
+};
+//# sourceMappingURL=catalog.js.map

package/dist/internal/authorization/validation/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAUxC,OAAO,EACL,QAAQ,EACR,OAAO,EACP,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,SAAS,GAEV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AAgBrE,MAAM,iBAAiB,GAAG,CACxB,QAAsC,EACtC,QAA8B,EAC9B,KAAa,EACyB,EAAE;IACxC,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC;YACd,OAAO,EAAE,iCAAiC,KAAK,EAAE;YACjD,QAAQ,EAAE,QAAQ,CAAC,OAAO;YAC1B,MAAM,EAAE,QAAQ,CAAC,OAAkC;SACpD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,MAA4B,EAC5B,UAA6B,EACS,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChB,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5C,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC;QAC7C,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC;QACzD,eAAe,CAAC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;QAC/D,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC3D,eAAe,CAAC,UAAU,CAAC,EAAE,EAAE,uBAAuB,CAAC;QACvD,eAAe,CAAC,UAAU,CAAC,OAAO,EAAE,4BAA4B,CAAC;QACjE,eAAe,CAAC,UAAU,CAAC,WAAW,EAAE,+BAA+B,CAAC;KACzE,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;YACrB,OAAO,EAAE,wBAAwB;YACjC,gBAAgB,EAAE,MAAM,CAAC,QAAQ;YACjC,cAAc,EAAE,UAAU,CAAC,QAAQ;SACpC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,EAAE,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;YACrB,OAAO,EAAE,0BAA0B;YACnC,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,MAAM,EAAE,UAAU,CAAC,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;YACrB,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,MAAM,EAAE,UAAU,CAAC,EAAE;YACrB,eAAe,EAAE,MAAM,CAAC,cAAc;YACtC,aAAa,EAAE,UAAU,CAAC,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC;YACrB,OAAO,EAAE,6BAA6B;YACtC,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,MAAM,EAAE,UAAU,CAAC,EAAE;YACrB,mBAAmB,EAAE,MAAM,CAAC,iBAAiB;YAC7C,iBAAiB,EAAE,UAAU,CAAC,WAAW;SAC1C,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAClB,KAA+B,EAC2B,EAAE,CAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,KAAK,GAAG,CACZ,IAAY,EACZ,MAAgB,EAChB,IAAiB,EACqB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IACL,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,CAC7B,SAAyB,EACzB,MAA4B,EAC5B,QAAuC,EACvC,MAAoC,EACE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,oCAAoC,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,mCAAmC,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;IACpF,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,CAC7B,KAA0B,EAC1B,MAA4B,EAC5B,QAAuC,EACvC,MAAoC,EACpC,SAAkB,EAClB,aAAqB,EACiB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO;QACT,KAAK,KAAK;YACR,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClD,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,yBAAyB,aAAa,yBAAyB,CAChE,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAClC,KAAK,CAAC,SAAS,EACf,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAClC,KAAK,CAAC,KAAK,EACX,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,aAAa,CACd,CAAC;QACJ,KAAK,QAAQ;YACX,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACf,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,sBAAsB,CACpB,KAAK,CAAC,KAAK,EACX,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,aAAa,CACd,CACF,CACF,CAAC;IACN,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,MAA4B,EAC5B,UAA6B,EACiC,EAAE,CAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC1D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEvD,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,yBAAyB,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YACxD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACnE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,KAAK,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,oBAAoB,KAAK,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACpE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,wBAAwB,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,yBAAyB,KAAK,CAAC,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC,SAAS,GAAG,CACzE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,wBAAwB,KAAK,CAAC,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC,SAAS,GAAG,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC9B,KAAK,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,KAAK,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,mCAAmC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kCAAkC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/C,KAAK,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChB,sBAAsB,CACpB,SAAS,CAAC,KAAK,EACf,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,CAAC,EAAE,CAAC,MAAM,KAAK,UAAU,EAClC,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,CAC1C;YACD,sBAAsB,CACpB,SAAS,CAAC,MAAM,EAChB,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,CAAC,EAAE,CAAC,MAAM,KAAK,UAAU,EAClC,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,CAC1C;SACF,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,sCAAsC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,iCAAiC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACtC,KAAK,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,4BAA4B,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,mCAAmC,MAAM,CAAC,IAAI,GAAG,CAClD,CAAC;YACJ,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,qCAAqC,MAAM,CAAC,IAAI,GAAG,CACpD,CAAC;YACJ,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,IACE,SAAS,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM;YAC9B,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EACpC,CAAC;YACD,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,cAAc,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC,SAAS,4BAA4B,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,KAAK,MAAM,KAAK,IAAI,MAAM;oBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QAClD,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1C,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,CAAC;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC;aACjC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,sCAAsC,SAAS,UAAU,SAAS,CAAC,EAAE,CAAC,SAAS,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IACE,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YACnC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EACxD,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,0CAA0C,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,SAAS,GAAG,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAC9C,KAAK,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,4BAA4B,CAAC,CAAC;QAC7E,KAAK,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,2BAA2B,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,cAAc,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,gCAAgC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,WAAW,GAAG,CAAC,QAAQ,CAAC,IAAI,6BAA6B,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACxC,KAAK,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,6BAA6B,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,+BAA+B,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,wCAAwC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CACjF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,wCAAwC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kCAAkC,UAAU,MAAM,SAAS,GAAG,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,QAAQ;QACR,MAAM;QACN,MAAM;QACN,UAAU;QACV,YAAY;QACZ,WAAW;KACZ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,KAAmC,EACnC,EAAY,EACZ,KAAa,EAC6B,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,2BAA2B,KAAK,KAAK,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,KAAmC,EACnC,EAAW,EACX,KAAa,EAC4B,EAAE,CAC3C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,2BAA2B,KAAK,KAAK,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,KAAmC,EACnC,EAAW,EACX,KAAa,EACoC,EAAE,CACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,2BAA2B,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,SAAS,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAmC,EACnC,EAAe,EACf,KAAa,EACwC,EAAE,CACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,2BAA2B,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,SAAS,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAmC,EACnC,MAAgB,EAChB,SAAiB,EACR,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;AAE3E,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,KAAmC,EACnC,KAAc,EACd,SAAiB,EACR,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;AAErG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,KAAmC,EACnC,KAAe,EACf,KAAsB,EACb,EAAE;IACX,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;IAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACrE,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAmC,EACnC,KAAe,EAC2B,EAAE;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,yBAAyB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,wBAAwB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,KAAmC,EACnC,IAAc,EACd,KAAe,EACN,EAAE;IACX,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC7D,OAAO,CACL,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YAClD,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/internal/authorization/validation/common.d.ts

@@ -0,0 +1,20 @@
+import * as Result from "effect/Result";
+import { CatalogMismatch, InvalidIR } from "../failures.ts";
+import type { EntityId, FieldId, OperationId, TraitId } from "../identities.ts";
+export type ValidateFailure = InvalidIR | CatalogMismatch;
+export type ValidationLimits = {
+    readonly maxTraversalDepth: number;
+    readonly maxStaticWork: number;
+};
+export declare const defaultValidationLimits: ValidationLimits;
+export declare const tightenValidationLimits: (overrides: Partial<ValidationLimits> | undefined) => Result.Result<ValidationLimits, ValidateFailure>;
+export declare const SEPARATOR = "\0";
+export declare const entityKey: (id: EntityId) => string;
+export declare const traitKey: (id: TraitId) => string;
+export declare const fieldKey: (id: FieldId) => string;
+export declare const operationKey: (id: OperationId) => string;
+export declare const invalid: (message: string) => Result.Result<never, ValidateFailure>;
+export declare const mismatch: (fields: ConstructorParameters<typeof CatalogMismatch>[0]) => Result.Result<never, ValidateFailure>;
+export declare const isBlank: (value: string) => boolean;
+export declare const requireNonBlank: (value: string, label: string) => Result.Result<string, ValidateFailure>;
+//# sourceMappingURL=common.d.ts.map

package/dist/internal/authorization/validation/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhF,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,eAAe,CAAC;AAE1D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAGrC,CAAC;AAKF,eAAO,MAAM,uBAAuB,cACvB,OAAO,CAAC,gBAAgB,CAAC,GAAG,SAAS,KAC/C,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAqBjD,CAAC;AAEF,eAAO,MAAM,SAAS,OAAW,CAAC;AAElC,eAAO,MAAM,SAAS,OAAQ,QAAQ,KAAG,MAA+C,CAAC;AAEzF,eAAO,MAAM,QAAQ,OAAQ,OAAO,KAAG,MAA+C,CAAC;AAEvF,eAAO,MAAM,QAAQ,OAAQ,OAAO,KAAG,MAC6D,CAAC;AAErG,eAAO,MAAM,YAAY,OAAQ,WAAW,KAAG,MAC6E,CAAC;AAE7H,eAAO,MAAM,OAAO,YAAa,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CACrC,CAAC;AAE1C,eAAO,MAAM,QAAQ,WACX,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,KACvD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAA6C,CAAC;AAErF,eAAO,MAAM,OAAO,UAAW,MAAM,KAAG,OAA6B,CAAC;AAEtE,eAAO,MAAM,eAAe,UACnB,MAAM,SACN,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAC0C,CAAC"}

package/dist/internal/authorization/validation/common.js

@@ -0,0 +1,36 @@
+import * as Result from "effect/Result";
+import { DEFAULT_AUTHORIZATION_BUDGET, MAX_TRAVERSAL_DEPTH } from "../bounds.js";
+import { CatalogMismatch, InvalidIR } from "../failures.js";
+export const defaultValidationLimits = {
+    maxTraversalDepth: MAX_TRAVERSAL_DEPTH,
+    maxStaticWork: DEFAULT_AUTHORIZATION_BUDGET,
+};
+const isFiniteNatural = (value) => Number.isFinite(value) && Number.isInteger(value) && value >= 0;
+export const tightenValidationLimits = (overrides) => {
+    if (overrides === undefined)
+        return Result.succeed(defaultValidationLimits);
+    const clamp = (key, hard) => {
+        const value = overrides[key];
+        if (value === undefined)
+            return Result.succeed(hard);
+        if (!isFiniteNatural(value)) {
+            return invalid(`invalid ${key}: must be a finite natural number`);
+        }
+        return Result.succeed(Math.min(value, hard));
+    };
+    return Result.gen(function* () {
+        const maxTraversalDepth = yield* clamp("maxTraversalDepth", defaultValidationLimits.maxTraversalDepth);
+        const maxStaticWork = yield* clamp("maxStaticWork", defaultValidationLimits.maxStaticWork);
+        return { maxTraversalDepth, maxStaticWork };
+    });
+};
+export const SEPARATOR = "\u0000";
+export const entityKey = (id) => `${id.catalog}${SEPARATOR}${id.name}`;
+export const traitKey = (id) => `${id.catalog}${SEPARATOR}${id.name}`;
+export const fieldKey = (id) => `${id.catalog}${SEPARATOR}${id.owner.kind}${SEPARATOR}${id.owner.name}${SEPARATOR}${id.localName}`;
+export const operationKey = (id) => `${id.catalog}${SEPARATOR}${id.owner.kind}${SEPARATOR}${id.owner.name}${SEPARATOR}${id.localName}${SEPARATOR}${id.target}`;
+export const invalid = (message) => Result.fail(new InvalidIR({ message }));
+export const mismatch = (fields) => Result.fail(new CatalogMismatch(fields));
+export const isBlank = (value) => value.length === 0;
+export const requireNonBlank = (value, label) => isBlank(value) ? mismatch({ message: `blank ${label}` }) : Result.succeed(value);
+//# sourceMappingURL=common.js.map

package/dist/internal/authorization/validation/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAU5D,MAAM,CAAC,MAAM,uBAAuB,GAAqB;IACvD,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,4BAA4B;CAC5C,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAW,EAAE,CACjD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,SAAgD,EACE,EAAE;IACpD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,CACZ,GAA2B,EAC3B,IAAY,EAC4B,EAAE;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,WAAW,GAAG,mCAAmC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,KAAK,CACpC,mBAAmB,EACnB,uBAAuB,CAAC,iBAAiB,CAC1C,CAAC;QACF,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,uBAAuB,CAAC,aAAa,CAAC,CAAC;QAC3F,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC;AAElC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAY,EAAU,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAEzF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAW,EAAU,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,GAAG,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAEvF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAW,EAAU,EAAE,CAC9C,GAAG,EAAE,CAAC,OAAO,GAAG,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,SAAS,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAErG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAe,EAAU,EAAE,CACtD,GAAG,EAAE,CAAC,OAAO,GAAG,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,SAAS,GAAG,EAAE,CAAC,SAAS,GAAG,SAAS,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;AAE7H,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAyC,EAAE,CAChF,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,MAAwD,EACjB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAAa,EACb,KAAa,EAC2B,EAAE,CAC1C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/internal/authorization/validation/decisions.d.ts

@@ -0,0 +1,7 @@
+import * as Result from "effect/Result";
+import type { RuleId } from "../identities.ts";
+import type { CanonicalAuthorizationDecisions, CanonicalAuthorizationRule } from "../ir.ts";
+import { type PreparedAuthorizationCatalog } from "./catalog.ts";
+import { type ValidateFailure } from "./common.ts";
+export declare const validateDecisions: (index: PreparedAuthorizationCatalog, decisions: CanonicalAuthorizationDecisions, rules: ReadonlyMap<RuleId, CanonicalAuthorizationRule>) => Result.Result<void, ValidateFailure>;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/internal/authorization/validation/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAyB,MAAM,EAAW,MAAM,kBAAkB,CAAC;AAC/E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAE3B,MAAM,UAAU,CAAC;AAClB,OAAO,EAOL,KAAK,4BAA4B,EAClC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAwD,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAsFzG,eAAO,MAAM,iBAAiB,UACrB,4BAA4B,aACxB,+BAA+B,SACnC,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,KACrD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CA2DlC,CAAC"}

package/dist/internal/authorization/validation/decisions.js

@@ -0,0 +1,107 @@
+import * as Result from "effect/Result";
+import { entityComposes, requireEntity, requireField, requireOperation, requireTrait, traitComposes, } from "./catalog.js";
+import { entityKey, fieldKey, invalid, operationKey, traitKey } from "./common.js";
+const uniqueDecisionIds = (ids, label) => {
+    const seen = new Set();
+    for (const id of ids) {
+        if (seen.has(id))
+            return invalid(`duplicate ${label} rule`);
+        seen.add(id);
+    }
+    return Result.succeed(undefined);
+};
+const ruleFitsEntity = (index, rule, target) => {
+    if (rule.focus._tag === "entity") {
+        return rule.focus.entity.catalog === target.catalog && rule.focus.entity.name === target.name;
+    }
+    if (rule.focus._tag === "trait")
+        return entityComposes(index, target, rule.focus.trait.name);
+    return false;
+};
+const ruleFitsTrait = (index, rule, target) => {
+    if (rule.focus._tag !== "trait")
+        return false;
+    return traitComposes(index, target, rule.focus.trait.name);
+};
+const ruleFitsField = (index, rule, field) => {
+    if (rule.focus._tag === "field")
+        return fieldKey(rule.focus.field) === fieldKey(field.id);
+    if (field.id.owner.kind === "entity") {
+        const owner = index.entities.get(field.id.owner.name);
+        return owner !== undefined && ruleFitsEntity(index, rule, owner);
+    }
+    const owner = index.traits.get(field.id.owner.name);
+    return owner !== undefined && ruleFitsTrait(index, rule, owner);
+};
+const ruleFitsOperation = (rule, target) => rule.focus._tag === "operation" &&
+    operationKey(rule.focus.operation) === operationKey(target);
+const lookupRule = (rules, id) => {
+    const found = rules.get(id);
+    if (found === undefined)
+        return invalid(`unknown rule '${id}'`);
+    return Result.succeed(found);
+};
+const validateDecisionRules = (decision, rules, compatible) => Result.gen(function* () {
+    yield* uniqueDecisionIds(decision.allow, "allow");
+    yield* uniqueDecisionIds(decision.deny, "deny");
+    const seen = new Set();
+    for (const id of decision.allow) {
+        seen.add(id);
+        const rule = yield* lookupRule(rules, id);
+        yield* compatible(rule);
+    }
+    for (const id of decision.deny) {
+        if (seen.has(id))
+            return yield* invalid("contradictory allow and deny rule");
+        const rule = yield* lookupRule(rules, id);
+        yield* compatible(rule);
+    }
+});
+export const validateDecisions = (index, decisions, rules) => Result.gen(function* () {
+    const seenEntities = new Set();
+    for (const entry of decisions.entities) {
+        const target = yield* requireEntity(index, entry.target, "entity decision target");
+        const key = entityKey(target);
+        if (seenEntities.has(key))
+            return yield* invalid("duplicate entity decision target");
+        seenEntities.add(key);
+        yield* validateDecisionRules(entry.decision, rules, (rule) => ruleFitsEntity(index, rule, target)
+            ? Result.succeed(undefined)
+            : invalid("rule focus is incompatible with entity decision"));
+    }
+    const seenTraits = new Set();
+    for (const entry of decisions.traits) {
+        const target = yield* requireTrait(index, entry.target, "trait decision target");
+        const key = traitKey(target);
+        if (seenTraits.has(key))
+            return yield* invalid("duplicate trait decision target");
+        seenTraits.add(key);
+        yield* validateDecisionRules(entry.decision, rules, (rule) => ruleFitsTrait(index, rule, target)
+            ? Result.succeed(undefined)
+            : invalid("rule focus is incompatible with trait decision"));
+    }
+    const seenFields = new Set();
+    for (const entry of decisions.fields) {
+        const target = yield* requireField(index, entry.target, "field decision target");
+        const key = fieldKey(target.id);
+        if (seenFields.has(key))
+            return yield* invalid("duplicate field decision target");
+        seenFields.add(key);
+        yield* validateDecisionRules(entry.decision, rules, (rule) => ruleFitsField(index, rule, target)
+            ? Result.succeed(undefined)
+            : invalid("rule focus is incompatible with field decision"));
+    }
+    const seenOperations = new Set();
+    for (const entry of decisions.operations) {
+        const target = yield* requireOperation(index, entry.target, "operation decision target");
+        const key = operationKey(target.id);
+        if (seenOperations.has(key)) {
+            return yield* invalid("duplicate operation decision target");
+        }
+        seenOperations.add(key);
+        yield* validateDecisionRules(entry.decision, rules, (rule) => ruleFitsOperation(rule, target.id)
+            ? Result.succeed(undefined)
+            : invalid("rule focus is incompatible with operation decision"));
+    }
+});
+//# sourceMappingURL=decisions.js.map