tempest-react-sdk 0.78.0 → 0.80.0

package/bin/lib/openapi/generate.test.mjs

@@ -1,4 +1,12 @@
-import { describe, it, expect } from "vitest";
+// @vitest-environment node
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { ESLint } from "eslint";
+import ts from "typescript";
+import { describe, expect, it } from "vitest";
+
+import { encodeIdSegment } from "../../../src/data";
 import { generate } from "./generate.mjs";
 
 const SPEC = {
@@ -132,3 +140,456 @@ describe("generate — FastAPI-style spec", () => {
         expect(svc).toContain('import { encodeIdSegment } from "tempest-react-sdk";');
     });
 });
+
+const TEMPLATE = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "template");
+const OUT = join(TEMPLATE, "src", "__generated_api__");
+
+/**
+ * The `create-tempest-app` template's own compiler options, read from
+ * `template/tsconfig.json` so the check follows the template when it changes:
+ * `strict`, `noUnusedLocals`, `noUnusedParameters`, `verbatimModuleSyntax`.
+ * `types` is dropped because `vite/client` is not installed at the repo root, and
+ * `paths` because nothing generated uses the alias.
+ *
+ * @returns {import("typescript").CompilerOptions}
+ */
+function templateCompilerOptions() {
+    const { config } = ts.readConfigFile(join(TEMPLATE, "tsconfig.json"), ts.sys.readFile);
+    const { types: _types, paths: _paths, ...json } = config.compilerOptions;
+    const { options, errors } = ts.convertCompilerOptionsFromJson(json, TEMPLATE);
+    expect(errors).toEqual([]);
+    return options;
+}
+
+/**
+ * Type-check the whole generator output as an app scaffolded by
+ * `create-tempest-app` would: every group and the root barrel, under the
+ * template's compiler options. Files live in a virtual `template/src/` folder so
+ * `zod` resolves from the repository's `node_modules`; `tempest-react-sdk` is a
+ * stub with the types and the `encodeIdSegment` value the generator imports.
+ *
+ * @param {Record<string, string>} files - The generator output.
+ * @returns {string[]} `file: TSxxxx message` for every diagnostic.
+ */
+function templateTsc(files) {
+    const virtual = new Map(Object.entries(files).map(([f, text]) => [join(OUT, f), text]));
+    virtual.set(
+        join(OUT, "node_modules", "tempest-react-sdk", "index.d.ts"),
+        [
+            "type Call = <T = unknown>(url: string, opts?: { body?: unknown; params?: Record<string, string | number | boolean | undefined | null>; headers?: Record<string, string> }) => Promise<T>;",
+            "export type ApiClient = { get: Call; post: Call; put: Call; patch: Call; delete: Call };",
+            "export type OffsetPage<T> = { items: T[]; total: number };",
+            "export type CursorPage<T> = { items: T[]; next_cursor: string | null };",
+            "export declare function encodeIdSegment(id: string | number): string;",
+        ].join("\n"),
+    );
+    const options = templateCompilerOptions();
+    const host = ts.createCompilerHost(options);
+    const readFile = host.readFile.bind(host);
+    const fileExists = host.fileExists.bind(host);
+    const directoryExists = host.directoryExists?.bind(host);
+    const getSourceFile = host.getSourceFile.bind(host);
+    host.readFile = (f) => virtual.get(f) ?? readFile(f);
+    host.fileExists = (f) => virtual.has(f) || fileExists(f);
+    host.directoryExists = (d) => d.startsWith(OUT) || (directoryExists?.(d) ?? true);
+    host.getSourceFile = (f, lang) =>
+        virtual.has(f) ? ts.createSourceFile(f, virtual.get(f), lang) : getSourceFile(f, lang);
+    const roots = Object.keys(files).map((f) => join(OUT, f));
+    return ts
+        .getPreEmitDiagnostics(ts.createProgram(roots, options, host))
+        .map(
+            (d) =>
+                `${d.file ? d.file.fileName.slice(OUT.length + 1) : "(global)"}: TS${d.code} ${ts.flattenDiagnosticMessageText(d.messageText, " ")}`,
+        );
+}
+
+let eslint;
+
+/**
+ * Lint the generator output with the template's `eslint.config.js`, as `npm run
+ * lint` in a scaffolded app would. Warnings count too: a scaffolded app should
+ * not open on a yellow lint run because of a generated file.
+ *
+ * @param {Record<string, string>} files - The generator output.
+ * @returns {Promise<string[]>} `file line:col rule` for every message.
+ */
+async function templateLint(files) {
+    eslint ??= new ESLint({
+        cwd: TEMPLATE,
+        overrideConfigFile: join(TEMPLATE, "eslint.config.js"),
+    });
+    const out = [];
+    for (const [file, text] of Object.entries(files)) {
+        const [result] = await eslint.lintText(text, { filePath: join(OUT, file) });
+        for (const m of result.messages) out.push(`${file} ${m.line}:${m.column} ${m.ruleId}`);
+    }
+    return out;
+}
+
+const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+const json = (schema) => ({ content: { "application/json": { schema } } });
+
+/**
+ * One spec that puts a `$ref` in every position the generator reads, plus a group
+ * with no schema at all. Measured on `main` before #504/#505 under the template's
+ * `tsc` and ESLint, it produced:
+ *
+ * | Position | Failure before the fix |
+ * | --- | --- |
+ * | path param `$ref` reached by nothing else (the #504 repro, own test below) | TS2304 `Cannot find name 'Kind'` — the type was neither imported nor emitted into `types.ts` |
+ * | query param `$ref` (`sort`) | no error, but typed `string`: the enum name was narrowed away |
+ * | response-only group | `S` imported unused — TS6133 and `unused-imports/no-unused-imports` |
+ * | page envelope / nested schema | `ItemPage` and `Owner` imported unused into `service.ts` |
+ * | `OffsetPage` + `CursorPage` together | `simple-import-sort/imports` (pushed in that order) |
+ * | group without schema | `z` / `S` unused in `schemas.ts`/`types.ts`, double blank line in `service.ts`, extra blank lines at EOF (`no-multiple-empty-lines`) |
+ * | every `types.ts` | `import * as S` used only in `typeof` — `@typescript-eslint/consistent-type-imports` |
+ * | every `index.ts` + root barrel | `simple-import-sort/exports` |
+ *
+ * The `X-Trace` header parameter was not read at all then; since #509 it is, and
+ * its `Code` type is imported like any other signature type.
+ */
+const EVERY_POSITION = {
+    openapi: "3.1.0",
+    components: {
+        schemas: {
+            Kind: { type: "string", enum: ["a", "b"] },
+            Sort: { type: "string", enum: ["asc", "desc"] },
+            Code: { type: "integer" },
+            Owner: { type: "object", properties: { name: { type: "string" } } },
+            Item: {
+                type: "object",
+                required: ["id"],
+                properties: { id: { type: "integer" }, owner: ref("Owner") },
+            },
+            ItemCreate: { type: "object", properties: { kind: ref("Kind") } },
+            ItemPage: {
+                type: "object",
+                properties: {
+                    items: { type: "array", items: ref("Item") },
+                    total: { type: "integer" },
+                    pages: { type: "integer" },
+                    size: { type: "integer" },
+                },
+            },
+            ItemFeed: {
+                type: "object",
+                properties: {
+                    items: { type: "array", items: ref("Item") },
+                    next_cursor: { type: "string", nullable: true },
+                    has_more: { type: "boolean" },
+                },
+            },
+        },
+    },
+    paths: {
+        "/items/{kind}": {
+            get: {
+                tags: ["items"],
+                operationId: "list_by_kind",
+                parameters: [
+                    { name: "kind", in: "path", required: true, schema: ref("Kind") },
+                    { name: "sort", in: "query", schema: ref("Sort") },
+                    { name: "codes", in: "query", schema: { type: "array", items: ref("Code") } },
+                    { name: "X-Trace", in: "header", schema: ref("Code") },
+                ],
+                responses: { 200: json({ type: "array", items: ref("Item") }) },
+            },
+        },
+        "/items": {
+            get: {
+                tags: ["items"],
+                operationId: "page",
+                responses: { 200: json(ref("ItemPage")) },
+            },
+            post: {
+                tags: ["items"],
+                operationId: "create_many",
+                requestBody: json({ type: "array", items: ref("ItemCreate") }),
+                responses: { 201: json(ref("Item")) },
+            },
+        },
+        "/feed": {
+            get: {
+                tags: ["items"],
+                operationId: "feed",
+                responses: { 200: json(ref("ItemFeed")) },
+            },
+        },
+        "/reports": {
+            get: {
+                tags: ["reports"],
+                responses: { 200: json({ type: "array", items: ref("Item") }) },
+            },
+        },
+        "/ping": { get: { tags: ["health"], responses: { 200: { description: "ok" } } } },
+    },
+};
+
+describe("generate — output passes the create-tempest-app template's tsc and ESLint (#504, #505)", () => {
+    const { files } = generate(EVERY_POSITION);
+
+    it("a path parameter typed by a $ref imports and declares the type it names (#504)", () => {
+        const minimal = generate({
+            openapi: "3.1.0",
+            components: { schemas: { Kind: { type: "string", enum: ["a", "b"] } } },
+            paths: {
+                "/items/{kind}": {
+                    get: {
+                        tags: ["items"],
+                        operationId: "get_item",
+                        parameters: [
+                            { name: "kind", in: "path", required: true, schema: ref("Kind") },
+                        ],
+                        responses: { 200: { description: "ok" } },
+                    },
+                },
+            },
+        }).files;
+        expect(minimal["items/service.ts"]).toContain("async getItem(kind: Kind): Promise<void>");
+        expect(minimal["items/service.ts"]).toContain('import type { Kind } from "./types";');
+        expect(minimal["items/types.ts"]).toContain("export type Kind = ");
+        expect(minimal["items/schemas.ts"]).toContain(
+            'export const KindSchema = z.enum(["a", "b"]);',
+        );
+        expect(templateTsc(minimal)).toEqual([]);
+    });
+
+    it("a query parameter typed by a scalar $ref keeps its name instead of being narrowed to string", () => {
+        const svc = files["items/service.ts"];
+        expect(svc).toContain('params: { "sort"?: Sort; "codes"?: string }');
+        expect(svc).toMatch(/import type \{[^}]*\bSort\b[^}]*\} from "\.\/types";/);
+    });
+
+    it("service.ts imports only the types its signatures name, and S only when a body is validated", () => {
+        expect(files["items/service.ts"]).toContain(
+            'import type { Code, Item, ItemCreate, Kind, Sort } from "./types";',
+        );
+        expect(files["items/service.ts"]).not.toContain('import * as S from "./schemas";');
+        expect(files["reports/service.ts"]).not.toContain("./schemas");
+        expect(files["items/service.ts"]).toContain(
+            'import type { ApiClient, CursorPage, OffsetPage } from "tempest-react-sdk";',
+        );
+    });
+
+    it("a group without any schema imports neither z nor S and has no double blank line (#505)", () => {
+        expect(files["health/schemas.ts"]).toBe("export {};\n");
+        expect(files["health/types.ts"]).toBe("export {};\n");
+        expect(files["health/service.ts"]).not.toMatch(/\n\n\n/);
+        expect(files["health/service.ts"]).toMatch(
+            /^import type \{ ApiClient \} from "tempest-react-sdk";\n\n\/\*\*/,
+        );
+    });
+
+    it("type-checks under the template's tsconfig (strict, noUnusedLocals, verbatimModuleSyntax)", () => {
+        expect(templateTsc(files)).toEqual([]);
+    });
+
+    it("lints clean under the template's eslint.config.js, warnings included", async () => {
+        expect(await templateLint(files)).toEqual([]);
+    });
+
+    it("the FastAPI-style spec above passes both too", async () => {
+        const out = generate(SPEC).files;
+        expect(out["users/service.ts"]).toContain('import * as S from "./schemas";');
+        expect(templateTsc(out)).toEqual([]);
+        expect(await templateLint(out)).toEqual([]);
+    });
+});
+
+/**
+ * Transpile a generated `service.ts` and instantiate its class with a recording
+ * `ApiClient`, to read back the URL and options each call actually sends.
+ * `encodeIdSegment` is the SDK's real one.
+ *
+ * @param {string} source - The generated `service.ts`.
+ * @returns {{ service: object, calls: Array<[string, object | undefined]> }}
+ */
+function instantiate(source) {
+    const { outputText } = ts.transpileModule(source, {
+        compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
+    });
+    const module = { exports: {} };
+    const requireStub = (id) => {
+        if (id === "tempest-react-sdk") return { encodeIdSegment };
+        throw new Error(`unexpected import ${id}`);
+    };
+    new Function("exports", "require", "module", outputText)(module.exports, requireStub, module);
+    const calls = [];
+    const api = new Proxy(
+        {},
+        {
+            get: () => async (url, opts) => {
+                calls.push([url, opts]);
+            },
+        },
+    );
+    const Class = Object.values(module.exports).find((v) => typeof v === "function");
+    return { service: new Class(api), calls };
+}
+
+/**
+ * Measured on `main` before #509 with minimal specs run through `generate`:
+ *
+ * | Spec | Output before the fix |
+ * | --- | --- |
+ * | `{id}` declared only on the path item | `getItem(): Promise<void>` calling `"/items/{id}"` — placeholder sent literally |
+ * | path item declares `{x}`, operation declares `{y}` | refused: `placeholder "x" is not a declared path parameter` |
+ * | required `in: "header"` | `list()` — no argument, nothing sent |
+ * | `in: "cookie"` | ignored (stays ignored, on purpose: `fetch` cannot set `Cookie`) |
+ * | path-item query + operation override | the path item's `q` lost; the override only looked right because the path item was never read |
+ * | parameter `$ref` into `components.parameters` | dropped like the path-item case: `"/items/{id}"` literal |
+ */
+const PARAMS = {
+    openapi: "3.1.0",
+    components: {
+        schemas: { Region: { type: "string", enum: ["br", "us"] } },
+        parameters: {
+            Version: { name: "v", in: "path", required: true, schema: { type: "integer" } },
+        },
+    },
+    paths: {
+        "/items/{id}": {
+            parameters: [
+                { name: "id", in: "path", required: true, schema: { type: "string" } },
+                { name: "X-Tenant-Id", in: "header", required: true, schema: { type: "string" } },
+                { name: "limit", in: "query", schema: { type: "string" } },
+            ],
+            get: {
+                tags: ["items"],
+                operationId: "get_item",
+                parameters: [
+                    { name: "limit", in: "query", required: true, schema: { type: "integer" } },
+                    { name: "X-Region", in: "header", schema: ref("Region") },
+                    { name: "Retry-Count", in: "header", schema: { type: "integer" } },
+                    { name: "session", in: "cookie", schema: { type: "string" } },
+                    { name: "Authorization", in: "header", schema: { type: "string" } },
+                ],
+                responses: { 200: { description: "ok" } },
+            },
+            delete: {
+                tags: ["items"],
+                operationId: "delete_item",
+                parameters: [
+                    {
+                        name: "X-Tenant-Id",
+                        in: "header",
+                        required: false,
+                        schema: { type: "string" },
+                    },
+                ],
+                responses: { 204: { description: "gone" } },
+            },
+        },
+        "/v{v}/items": {
+            post: {
+                tags: ["items"],
+                operationId: "create_item",
+                parameters: [
+                    { $ref: "#/components/parameters/Version" },
+                    { name: "Idempotency-Key", in: "header", schema: { type: "string" } },
+                ],
+                responses: { 201: { description: "ok" } },
+            },
+        },
+    },
+};
+
+describe("generate — path-item, header and $ref parameters (#509)", () => {
+    const { files } = generate(PARAMS);
+    const svc = files["items/service.ts"];
+
+    it("a path parameter declared only on the path item is an argument and goes through encodeIdSegment", () => {
+        expect(svc).not.toContain('"/items/{id}"');
+        expect(svc).toContain("`/items/${encodeIdSegment(id)}`");
+    });
+
+    it("path-item and operation parameters merge, the operation winning on the same (name, in)", () => {
+        expect(svc).toContain(
+            'async getItem(id: string, params: { "limit": number }, headers: { "X-Tenant-Id": string; "X-Region"?: Region; "Retry-Count"?: number }): Promise<void>',
+        );
+        expect(svc).toContain(
+            'async deleteItem(id: string, params: { "limit"?: string }, headers: { "X-Tenant-Id"?: string } = {}): Promise<void>',
+        );
+    });
+
+    it("a parameter $ref into components.parameters is resolved", () => {
+        expect(svc).toContain("async createItem(v: number, headers: ");
+        expect(svc).toContain("`/v${encodeIdSegment(v)}/items`");
+    });
+
+    it("cookie parameters and the Accept/Content-Type/Authorization headers are not emitted", () => {
+        expect(svc).not.toContain("session");
+        expect(svc).not.toContain("Authorization");
+    });
+
+    it("header values are sent as strings, and an optional header left out is not sent as 'undefined'", async () => {
+        const { service, calls } = instantiate(svc);
+        await service.getItem("a/b", { limit: 5 }, { "X-Tenant-Id": "t1", "Retry-Count": 3 });
+        await service.deleteItem("7", {});
+        await service.createItem(2);
+        expect(calls).toEqual([
+            [
+                "/items/a%2Fb",
+                { params: { limit: 5 }, headers: { "X-Tenant-Id": "t1", "Retry-Count": "3" } },
+            ],
+            ["/items/7", { params: {}, headers: {} }],
+            ["/v2/items", { headers: {} }],
+        ]);
+    });
+
+    it("type-checks and lints clean under the create-tempest-app template", async () => {
+        expect(templateTsc(files)).toEqual([]);
+        expect(await templateLint(files)).toEqual([]);
+    });
+});
+
+/**
+ * FastAPI publishes a component for every `Enum`-annotated field even when the
+ * field's own schema carries a narrower inline enum, so `ImageMediaType` appears
+ * with no `$ref` pointing at it. Measured on `main` before #516: it was already
+ * left out of every group, because a group only emits the schemas its routes
+ * reach. What did break was the name check, which ran over every
+ * `components.schemas` entry — an orphan whose name collided with another
+ * (`ImageMediaType` / `Image-Media-Type`) aborted the whole run.
+ */
+const ORPHAN_ENUM = {
+    openapi: "3.1.0",
+    components: {
+        schemas: {
+            ImageMediaType: { type: "string", enum: ["image/png", "image/jpeg", "image/webp"] },
+            "Image-Media-Type": { type: "string", enum: ["image/gif"] },
+            Kind: { type: "string", enum: ["photo", "avatar"] },
+            Upload: {
+                type: "object",
+                properties: {
+                    kind: ref("Kind"),
+                    media_type: { type: "string", enum: ["image/png", "image/jpeg"] },
+                },
+            },
+        },
+    },
+    paths: {
+        "/uploads": {
+            post: {
+                tags: ["uploads"],
+                operationId: "create_upload",
+                requestBody: json(ref("Upload")),
+                responses: { 201: json(ref("Upload")) },
+            },
+        },
+    },
+};
+
+describe("generate — enum schemas no $ref reaches (#516)", () => {
+    it("keeps an enum reached transitively and drops the orphan, even when the orphan's name collides", async () => {
+        const { files } = generate(ORPHAN_ENUM);
+        expect(files["uploads/types.ts"]).toContain("export type Kind = ");
+        expect(files["uploads/schemas.ts"]).toContain(
+            'export const KindSchema = z.enum(["photo", "avatar"]);',
+        );
+        expect(Object.values(files).join("\n")).not.toContain("ImageMediaType");
+        expect(Object.values(files).join("\n")).not.toContain("image/webp");
+        expect(templateTsc(files)).toEqual([]);
+        expect(await templateLint(files)).toEqual([]);
+    });
+});

package/bin/lib/openapi/schema-to-zod.mjs

@@ -15,9 +15,9 @@ export function refName(ref) {
 /**
  * Names the generated files declare, import or rely on as globals next to the
  * schema types: the SDK types and the `encodeIdSegment` value `service.ts`
- * imports, the `z` and `S` imports, and the `Promise` / `Record` globals the
- * emitted signatures use. A schema with one of these names would collide with
- * the import or shadow the global.
+ * imports, the `headerRecord` helper it declares, the `z` and `S` imports, and
+ * the `Promise` / `Record` globals the emitted signatures use. A schema with one
+ * of these names would collide with the import or shadow the global.
  */
 export const GENERATED_NAMES = new Set([
     "ApiClient",
@@ -27,6 +27,7 @@ export const GENERATED_NAMES = new Set([
     "Record",
     "S",
     "encodeIdSegment",
+    "headerRecord",
     "z",
 ]);
 

package/dist/access/Can.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"Can.cjs","names":[],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":"oEA6CA,SAAgB,EAAI,CAAE,SAAQ,WAAU,SAAQ,WAAU,WAAU,WAAqB,CACrF,GAAM,CAAE,UAAS,aAAc,EAAA,OAAO,CAAE,SAAQ,WAAU,QAAO,CAAC,EAElE,OADI,GAAkB,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,IAAY,IAAA,GAAa,GAAY,KAAQ,CAAU,CAAA,GACzE,EAAA,EAAA,IAAA,CAAA,EAAA,SAAA,CAAA,SAAG,EAAU,EAAY,GAAY,IAAQ,CAAA,CACxD"}
+{"version":3,"file":"Can.cjs","names":["useCan","_Fragment","require_use_can","react_jsx_runtime","Can","isLoading","pending","fallback","allowed","children"],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":"A,oEA6CA,SAAgBI,EAAI,CAAE,SAAQ,WAAU,SAAQ,WAAU,WAAU,WAAqB,CACrF,GAAM,CAAE,UAAS,aAAcJ,EAAAA,OAAO,CAAE,SAAQ,WAAU,QAAO,CAAC,EAElE,OADIK,GAAkB,EAAAF,EAAA,IAAA,CAAAF,EAAAA,SAAA,CAAA,SAAGK,IAAY,IAAA,GAAaC,GAAY,KAAQD,CAAU,CAAA,GACzE,EAAAH,EAAA,IAAA,CAAAF,EAAAA,SAAA,CAAA,SAAGO,EAAUC,EAAYF,GAAY,IAAQ,CAAA,CACxD,C"}

package/dist/access/Can.js.map

@@ -1 +1 @@
-{"version":3,"file":"Can.js","names":[],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":";;;AA6CA,SAAgB,EAAI,EAAE,WAAQ,aAAU,WAAQ,aAAU,aAAU,cAAqB;CACrF,IAAM,EAAE,YAAS,iBAAc,EAAO;EAAE;EAAQ;EAAU;CAAO,CAAC;CAElE,OADI,IAAkB,kBAAA,GAAA,EAAA,UAAG,MAAY,KAAA,IAAa,KAAY,OAAQ,EAAU,CAAA,IACzE,kBAAA,GAAA,EAAA,UAAG,IAAU,IAAY,KAAY,KAAQ,CAAA;AACxD"}
+{"version":3,"file":"Can.js","names":["_Fragment","Can","useCan","isLoading","Fragment","pending","fallback","allowed","children"],"sources":["../../src/access/Can.tsx"],"sourcesContent":["import type { ReactNode } from \"react\";\nimport { useCan } from \"./use-can\";\nimport type { CanParams } from \"./types\";\n\nexport interface CanProps extends CanParams {\n    /** Rendered when the action is allowed. */\n    children: ReactNode;\n    /** Rendered when the action is denied. Defaults to nothing. */\n    fallback?: ReactNode;\n    /**\n     * Rendered while an async check is still in flight. Defaults to\n     * {@link fallback}, which keeps the pre-existing behaviour.\n     *\n     * Worth setting whenever `fallback` says something denial-shaped: without\n     * it, a permission that resolves over the network flashes \"no access\" to\n     * someone who has it. `pending={null}` renders nothing until the answer\n     * lands; `pending={<Spinner />}` says why the screen is waiting.\n     */\n    pending?: ReactNode;\n}\n\n/**\n * Conditionally render based on an access check. Renders `children` when the\n * action is allowed and `fallback` when it is denied. While an async check is\n * pending it renders `pending`, which defaults to `fallback`.\n *\n * @example\n * ```tsx\n * <Can action=\"create\" resource=\"posts\" fallback={<p>No access</p>}>\n *   <NewPostButton />\n * </Can>\n * ```\n *\n * @example\n * ```tsx\n * <Can\n *   action=\"read\"\n *   resource=\"finance\"\n *   fallback={<p>No access</p>}\n *   pending={<Spinner />}\n * >\n *   <FinancePanel />\n * </Can>\n * ```\n */\nexport function Can({ action, resource, params, children, fallback, pending }: CanProps) {\n    const { allowed, isLoading } = useCan({ action, resource, params });\n    if (isLoading) return <>{pending === undefined ? (fallback ?? null) : pending}</>;\n    return <>{allowed ? children : (fallback ?? null)}</>;\n}\n"],"mappings":";;;AA6CA,SAAgBC,EAAI,EAAE,WAAQ,aAAU,WAAQ,aAAU,aAAU,cAAqB;CACrF,IAAM,EAAE,YAAS,iBAAcC,EAAO;EAAE;EAAQ;EAAU;CAAO,CAAC;CAElE,OADIC,IAAkB,kBAAAH,GAAA,EAAA,UAAGK,MAAY,KAAA,IAAaC,KAAY,OAAQD,EAAU,CAAA,IACzE,kBAAAL,GAAA,EAAA,UAAGO,IAAUC,IAAYF,KAAY,KAAQ,CAAA;AACxD"}

package/dist/access/access-control-context.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-control-context.cjs","names":[],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":"sDAIA,IAAM,GAAA,EAAuB,EAAA,cAAA,CAAoC,IAAI,EAmBrE,SAAgB,EAAsB,CAAE,UAAS,YAAwC,CACrF,OACI,EAAA,EAAA,IAAA,CAAC,EAAqB,SAAtB,CAA+B,MAAO,EAAU,UAAwC,CAAA,CAEhG,CAUA,SAAgB,GAAyC,CACrD,OAAA,EAAO,EAAA,WAAA,CAAW,CAAoB,CAC1C"}
+{"version":3,"file":"access-control-context.cjs","names":["createContext","useContext","react","react_jsx_runtime","AccessControlContext","AccessControlProvider","control","useAccessControl"],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":"A,sDAIA,IAAMI,GAAA,EAAuBJ,EAAAA,cAAAA,CAAoC,IAAI,EAmBrE,SAAgBK,EAAsB,CAAE,UAAS,YAAwC,CACrF,OACI,EAAAF,EAAA,IAAA,CAACC,EAAqB,SAAtB,CAA+B,MAAOE,EAAU,UAAwC,CAAA,CAEhG,CAUA,SAAgBC,GAAyC,CACrD,OAAA,EAAON,EAAAA,WAAAA,CAAWG,CAAoB,CAC1C,C"}

package/dist/access/access-control-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-control-context.js","names":[],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":";;;AAIA,IAAM,IAAuB,EAAoC,IAAI;AAmBrE,SAAgB,EAAsB,EAAE,YAAS,eAAwC;CACrF,OACI,kBAAC,EAAqB,UAAtB;EAA+B,OAAO;EAAU;CAAwC,CAAA;AAEhG;AAUA,SAAgB,IAAyC;CACrD,OAAO,EAAW,CAAoB;AAC1C"}
+{"version":3,"file":"access-control-context.js","names":["AccessControlContext","createContext","AccessControlProvider","control","useAccessControl","useContext"],"sources":["../../src/access/access-control-context.tsx"],"sourcesContent":["import { createContext, useContext } from \"react\";\nimport type { ReactNode } from \"react\";\nimport type { AccessControl } from \"./types\";\n\nconst AccessControlContext = createContext<AccessControl | null>(null);\n\nexport interface AccessControlProviderProps {\n    /** The access-control strategy made available to descendants. */\n    control: AccessControl;\n    children: ReactNode;\n}\n\n/**\n * Provide an {@link AccessControl} strategy to the React tree. Components such\n * as `<Can>` and the `useCan` hook read it from context.\n *\n * @example\n * ```tsx\n * <AccessControlProvider control={createRoleAccessControl({ role: \"admin\", roles: { admin: [\"*\"] } })}>\n *   <App />\n * </AccessControlProvider>\n * ```\n */\nexport function AccessControlProvider({ control, children }: AccessControlProviderProps) {\n    return (\n        <AccessControlContext.Provider value={control}>{children}</AccessControlContext.Provider>\n    );\n}\n\n/**\n * Read the current {@link AccessControl} from context.\n *\n * Returns `null` when no {@link AccessControlProvider} is present. Callers MUST\n * treat the absence of a provider as **\"allow all\"** — i.e. when this returns\n * `null`, access checks should default to permitted. This keeps the SDK\n * opt-in: dropping in a provider adds enforcement, removing it disables it.\n */\nexport function useAccessControl(): AccessControl | null {\n    return useContext(AccessControlContext);\n}\n"],"mappings":";;;AAIA,IAAMA,IAAuBC,EAAoC,IAAI;AAmBrE,SAAgBC,EAAsB,EAAE,YAAS,eAAwC;CACrF,OACI,kBAACF,EAAqB,UAAtB;EAA+B,OAAOG;EAAU;CAAwC,CAAA;AAEhG;AAUA,SAAgBC,IAAyC;CACrD,OAAOC,EAAWL,CAAoB;AAC1C"}

package/dist/access/create-role-access-control.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-role-access-control.cjs","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":"AAWA,SAAS,EAAmB,EAA8C,CACtE,IAAM,EAAM,IAAI,IAAY,EAAO,aAAe,CAAC,CAAC,EAC9C,EAAQ,EAAO,KAAQ,MAAM,QAAQ,EAAO,IAAI,EAAI,EAAO,KAAO,CAAC,EAAO,IAAI,EAAK,CAAC,EAC1F,IAAK,IAAM,KAAQ,EACf,IAAK,IAAM,KAAQ,EAAO,QAAQ,IAAS,CAAC,EACxC,EAAI,IAAI,CAAI,EAGpB,OAAO,CACX,CAwBA,SAAgB,EAAwB,EAAgD,CACpF,IAAM,EAAU,EAAmB,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,SAAQ,YAAkC,CAO5C,OALI,EAAQ,IAAI,GAAG,GACd,IAAa,IAAA,KACT,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,IACvE,IAAa,IAAA,IAAa,EAAQ,IAAI,CAAM,EAEhC,CAAE,IAAK,EAAK,EAAI,CAAE,IAAK,GAAO,OAAQ,oBAAqB,CAChF,CACJ,CACJ"}
+{"version":3,"file":"create-role-access-control.cjs","names":["resolvePermissions","set","config","roles","role","perm","createRoleAccessControl","granted","resource","action"],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":"AAWA,SAASA,EAAmB,EAA8C,CACtE,IAAMC,EAAM,IAAI,IAAYC,EAAO,aAAe,CAAC,CAAC,EAC9CC,EAAQD,EAAO,KAAQ,MAAM,QAAQA,EAAO,IAAI,EAAIA,EAAO,KAAO,CAACA,EAAO,IAAI,EAAK,CAAC,EAC1F,IAAK,IAAME,KAAQD,EACf,IAAK,IAAME,KAAQH,EAAO,QAAQE,IAAS,CAAC,EACxCH,EAAI,IAAII,CAAI,EAGpB,OAAOJ,CACX,CAwBA,SAAgBK,EAAwB,EAAgD,CACpF,IAAMC,EAAUP,EAAmBE,CAAM,EAEzC,MAAO,CACH,IAAI,CAAE,SAAQ,YAAkC,CAO5C,OALIK,EAAQ,IAAI,GAAG,GACdC,IAAa,IAAA,KACTD,EAAQ,IAAI,GAAGC,EAAS,GAAG,GAAKD,EAAQ,IAAI,GAAGC,EAAS,GAAGC,GAAQ,IACvED,IAAa,IAAA,IAAaD,EAAQ,IAAIE,CAAM,EAEhC,CAAE,IAAK,EAAK,EAAI,CAAE,IAAK,GAAO,OAAQ,oBAAqB,CAChF,CACJ,CACJ,C"}

package/dist/access/create-role-access-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-role-access-control.js","names":[],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":";AAWA,SAAS,EAAmB,GAA8C;CACtE,IAAM,IAAM,IAAI,IAAY,EAAO,eAAe,CAAC,CAAC,GAC9C,IAAQ,EAAO,OAAQ,MAAM,QAAQ,EAAO,IAAI,IAAI,EAAO,OAAO,CAAC,EAAO,IAAI,IAAK,CAAC;CAC1F,KAAK,IAAM,KAAQ,GACf,KAAK,IAAM,KAAQ,EAAO,QAAQ,MAAS,CAAC,GACxC,EAAI,IAAI,CAAI;CAGpB,OAAO;AACX;AAwBA,SAAgB,EAAwB,GAAgD;CACpF,IAAM,IAAU,EAAmB,CAAM;CAEzC,OAAO,EACH,IAAI,EAAE,WAAQ,eAAkC;EAO5C,OALI,EAAQ,IAAI,GAAG,KACd,MAAa,KAAA,MACT,EAAQ,IAAI,GAAG,EAAS,GAAG,KAAK,EAAQ,IAAI,GAAG,EAAS,GAAG,GAAQ,MACvE,MAAa,KAAA,KAAa,EAAQ,IAAI,CAAM,IAEhC,EAAE,KAAK,GAAK,IAAI;GAAE,KAAK;GAAO,QAAQ;EAAqB;CAChF,EACJ;AACJ"}
+{"version":3,"file":"create-role-access-control.js","names":["resolvePermissions","set","config","roles","role","perm","createRoleAccessControl","granted","resource","action"],"sources":["../../src/access/create-role-access-control.ts"],"sourcesContent":["import type { AccessControl, CanParams, CanResult } from \"./types\";\n\nexport interface RoleAccessControlConfig {\n    /** Permission strings granted directly, regardless of role. */\n    permissions?: string[];\n    /** Map of role name → permission strings granted by that role. */\n    roles?: Record<string, string[]>;\n    /** The active role(s). Their permissions (from `roles`) are merged in. */\n    role?: string | string[];\n}\n\nfunction resolvePermissions(config: RoleAccessControlConfig): Set<string> {\n    const set = new Set<string>(config.permissions ?? []);\n    const roles = config.role ? (Array.isArray(config.role) ? config.role : [config.role]) : [];\n    for (const role of roles) {\n        for (const perm of config.roles?.[role] ?? []) {\n            set.add(perm);\n        }\n    }\n    return set;\n}\n\n/**\n * Build a simple RBAC {@link AccessControl} from a static permission set.\n *\n * Permission strings are `\"<resource>:<action>\"` (e.g. `\"posts:create\"`) or a\n * bare `\"<action>\"`. Wildcards are supported: `\"*\"` grants everything and\n * `\"<resource>:*\"` grants every action on a resource.\n *\n * The effective set is `config.permissions` plus, for each active role in\n * `config.role`, the permissions listed in `config.roles[role]`.\n *\n * @param config - Permissions, role map, and active role(s).\n * @returns An access-control strategy backed by the resolved permission set.\n *\n * @example\n * ```ts\n * const ac = createRoleAccessControl({\n *   role: \"editor\",\n *   roles: { editor: [\"posts:*\", \"comments:read\"] },\n * });\n * ac.can({ action: \"create\", resource: \"posts\" }); // true\n * ```\n */\nexport function createRoleAccessControl(config: RoleAccessControlConfig): AccessControl {\n    const granted = resolvePermissions(config);\n\n    return {\n        can({ action, resource }: CanParams): CanResult {\n            const allowed =\n                granted.has(\"*\") ||\n                (resource !== undefined &&\n                    (granted.has(`${resource}:*`) || granted.has(`${resource}:${action}`))) ||\n                (resource === undefined && granted.has(action));\n\n            return allowed ? { can: true } : { can: false, reason: \"missing permission\" };\n        },\n    };\n}\n"],"mappings":";AAWA,SAASA,EAAmB,GAA8C;CACtE,IAAMC,IAAM,IAAI,IAAYC,EAAO,eAAe,CAAC,CAAC,GAC9CC,IAAQD,EAAO,OAAQ,MAAM,QAAQA,EAAO,IAAI,IAAIA,EAAO,OAAO,CAACA,EAAO,IAAI,IAAK,CAAC;CAC1F,KAAK,IAAME,KAAQD,GACf,KAAK,IAAME,KAAQH,EAAO,QAAQE,MAAS,CAAC,GACxC,EAAI,IAAIC,CAAI;CAGpB,OAAOJ;AACX;AAwBA,SAAgBK,EAAwB,GAAgD;CACpF,IAAMC,IAAUP,EAAmBE,CAAM;CAEzC,OAAO,EACH,IAAI,EAAE,WAAQ,eAAkC;EAO5C,OALIK,EAAQ,IAAI,GAAG,KACdC,MAAa,KAAA,MACTD,EAAQ,IAAI,GAAGC,EAAS,GAAG,KAAKD,EAAQ,IAAI,GAAGC,EAAS,GAAGC,GAAQ,MACvED,MAAa,KAAA,KAAaD,EAAQ,IAAIE,CAAM,IAEhC,EAAE,KAAK,GAAK,IAAI;GAAE,KAAK;GAAO,QAAQ;EAAqB;CAChF,EACJ;AACJ"}

package/dist/access/permissions-from-token.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-from-token.cjs","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":"mCAOA,SAAS,EAAiB,EAA0B,CAQhD,OAPI,MAAM,QAAQ,CAAK,EACZ,EAAM,OAAQ,GAAyB,OAAO,GAAS,QAAQ,EAEtE,OAAO,GAAU,SAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EAErC,CAAC,CACZ,CAcA,SAAgB,EACZ,EACA,EACQ,CACR,GAAI,CACA,GAAM,CAAE,WAAY,EAAA,UAAU,CAAK,EAE7B,EAAU,EAAiB,EADnB,GAAS,OAAS,cACe,EAC/C,GAAI,EAAQ,OAAS,EAAG,OAAO,EAE/B,GAAI,GAAS,QAAU,IAAA,GAAW,CAC9B,IAAM,EAAS,EAAiB,EAAQ,MAAS,EAEjD,OADI,EAAO,OAAS,EAAU,EACvB,EAAiB,EAAQ,KAAQ,CAC5C,CACA,OAAO,CACX,MAAQ,CACJ,MAAO,CAAC,CACZ,CACJ"}
+{"version":3,"file":"permissions-from-token.cjs","names":["decodeJWT","require_jwt","toPermissionList","value","item","permissionsFromToken","token","primary","payload","options","scopes","\"scopes\"","\"scope\""],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":"A,mCAOA,SAASE,EAAiB,EAA0B,CAQhD,OAPI,MAAM,QAAQC,CAAK,EACZA,EAAM,OAAQ,GAAyB,OAAOC,GAAS,QAAQ,EAEtE,OAAOD,GAAU,SAEVA,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EAErC,CAAC,CACZ,CAcA,SAAgBE,EACZ,EACA,EACQ,CACR,GAAI,CACA,GAAM,CAAE,WAAYL,EAAAA,UAAUM,CAAK,EAE7BC,EAAUL,EAAiBM,EADnBC,GAAS,OAAS,cACe,EAC/C,GAAIF,EAAQ,OAAS,EAAG,OAAOA,EAE/B,GAAIE,GAAS,QAAU,IAAA,GAAW,CAC9B,IAAMC,EAASR,EAAiBM,EAAQG,MAAS,EAEjD,OADID,EAAO,OAAS,EAAUA,EACvBR,EAAiBM,EAAQI,KAAQ,CAC5C,CACA,OAAOL,CACX,MAAQ,CACJ,MAAO,CAAC,CACZ,CACJ,C"}

package/dist/access/permissions-from-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-from-token.js","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":";;AAOA,SAAS,EAAiB,GAA0B;CAQhD,OAPI,MAAM,QAAQ,CAAK,IACZ,EAAM,QAAQ,MAAyB,OAAO,KAAS,QAAQ,IAEtE,OAAO,KAAU,WAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,IAErC,CAAC;AACZ;AAcA,SAAgB,EACZ,GACA,GACQ;CACR,IAAI;EACA,IAAM,EAAE,eAAY,EAAU,CAAK,GAE7B,IAAU,EAAiB,EADnB,GAAS,SAAS,cACe;EAC/C,IAAI,EAAQ,SAAS,GAAG,OAAO;EAE/B,IAAI,GAAS,UAAU,KAAA,GAAW;GAC9B,IAAM,IAAS,EAAiB,EAAQ,MAAS;GAEjD,OADI,EAAO,SAAS,IAAU,IACvB,EAAiB,EAAQ,KAAQ;EAC5C;EACA,OAAO;CACX,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}
+{"version":3,"file":"permissions-from-token.js","names":["toPermissionList","value","item","permissionsFromToken","decodeJWT","token","primary","payload","options","scopes","\"scopes\"","\"scope\""],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":";;AAOA,SAASA,EAAiB,GAA0B;CAQhD,OAPI,MAAM,QAAQC,CAAK,IACZA,EAAM,QAAQ,MAAyB,OAAOC,KAAS,QAAQ,IAEtE,OAAOD,KAAU,WAEVA,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,IAErC,CAAC;AACZ;AAcA,SAAgBE,EACZ,GACA,GACQ;CACR,IAAI;EACA,IAAM,EAAE,eAAYC,EAAUC,CAAK,GAE7BC,IAAUN,EAAiBO,EADnBC,GAAS,SAAS,cACe;EAC/C,IAAIF,EAAQ,SAAS,GAAG,OAAOA;EAE/B,IAAIE,GAAS,UAAU,KAAA,GAAW;GAC9B,IAAMC,IAAST,EAAiBO,EAAQG,MAAS;GAEjD,OADID,EAAO,SAAS,IAAUA,IACvBT,EAAiBO,EAAQI,KAAQ;EAC5C;EACA,OAAOL;CACX,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ"}

package/dist/access/use-can.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-can.cjs","names":[],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":"uEAaA,SAAS,EAAU,EAAwC,CACvD,OAAO,OAAO,GAAW,UAAY,CAAE,IAAK,CAAO,EAAI,CAC3D,CAWA,SAAgB,EAAO,EAAiC,CACpD,IAAM,EAAU,EAAA,iBAAiB,EAC3B,EAAY,KAAK,UAAU,CAAM,EAEjC,CAAC,EAAO,IAAA,EAAY,EAAA,SAAA,KACtB,EAAU,CAAE,QAAS,GAAO,UAAW,EAAK,EAAI,CAAE,QAAS,GAAM,UAAW,EAAM,CACtF,EAiCA,OA/BA,EAAA,EAAA,UAAA,KAAgB,CACZ,GAAI,CAAC,EAAS,CACV,EAAS,CAAE,QAAS,GAAM,UAAW,EAAM,CAAC,EAC5C,MACJ,CAEA,IAAI,EAAY,GAkBhB,OAjBA,EAAU,IAAU,CAAE,GAAG,EAAM,UAAW,EAAK,EAAE,EAEjD,QAAQ,QAAQ,EAAQ,IAAI,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,GAAI,EAAW,OACf,IAAM,EAAS,EAAU,CAAG,EAC5B,EAAS,CAAE,QAAS,EAAO,IAAK,UAAW,GAAO,OAAQ,EAAO,MAAO,CAAC,CAC7E,CAAC,CAAC,CACD,MAAO,GAAmB,CACnB,GACJ,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQ,aAAiB,MAAQ,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAGJ,EAAG,CAAC,EAAS,CAAS,CAAC,EAEhB,CACX"}
+{"version":3,"file":"use-can.cjs","names":["useAccessControl","useState","require_access_control_context","react","normalize","result","useCan","control","paramsKey","params","state","setState","cancelled","prev","raw","error"],"sources":["../../src/access/use-can.ts"],"sourcesContent":["import { useEffect, useState } from \"react\";\nimport { useAccessControl } from \"./access-control-context\";\nimport type { CanParams, CanResult } from \"./types\";\n\nexport interface UseCanResult {\n    /** Whether the action is permitted. Defaults to `true` while loading is not the concern of the caller. */\n    allowed: boolean;\n    /** `true` while an async `can` check is pending. */\n    isLoading: boolean;\n    /** Optional explanation, typically present when `allowed` is `false`. */\n    reason?: string;\n}\n\nfunction normalize(result: boolean | CanResult): CanResult {\n    return typeof result === \"boolean\" ? { can: result } : result;\n}\n\n/**\n * Resolve an access check against the {@link AccessControl} in context.\n *\n * Handles sync booleans, sync {@link CanResult}, and promises of either. When\n * no provider is present, access is allowed (see `useAccessControl`). The check\n * re-runs whenever the params change.\n *\n * @param params - The action/resource being checked.\n */\nexport function useCan(params: CanParams): UseCanResult {\n    const control = useAccessControl();\n    const paramsKey = JSON.stringify(params);\n\n    const [state, setState] = useState<UseCanResult>(() =>\n        control ? { allowed: false, isLoading: true } : { allowed: true, isLoading: false },\n    );\n\n    useEffect(() => {\n        if (!control) {\n            setState({ allowed: true, isLoading: false });\n            return;\n        }\n\n        let cancelled = false;\n        setState((prev) => ({ ...prev, isLoading: true }));\n\n        Promise.resolve(control.can(params))\n            .then((raw) => {\n                if (cancelled) return;\n                const result = normalize(raw);\n                setState({ allowed: result.can, isLoading: false, reason: result.reason });\n            })\n            .catch((error: unknown) => {\n                if (cancelled) return;\n                setState({\n                    allowed: false,\n                    isLoading: false,\n                    reason: error instanceof Error ? error.message : \"access check failed\",\n                });\n            });\n\n        return () => {\n            cancelled = true;\n        };\n        // `paramsKey` is the stable stringified form of `params`.\n        // eslint-disable-next-line react-hooks/exhaustive-deps\n    }, [control, paramsKey]);\n\n    return state;\n}\n"],"mappings":"A,uEAaA,SAASI,EAAU,EAAwC,CACvD,OAAO,OAAOC,GAAW,UAAY,CAAE,IAAKA,CAAO,EAAIA,CAC3D,CAWA,SAAgBC,EAAO,EAAiC,CACpD,IAAMC,EAAUP,EAAAA,iBAAiB,EAC3BQ,EAAY,KAAK,UAAUC,CAAM,EAEjC,CAACC,EAAOC,IAAA,EAAYV,EAAAA,SAAAA,KACtBM,EAAU,CAAE,QAAS,GAAO,UAAW,EAAK,EAAI,CAAE,QAAS,GAAM,UAAW,EAAM,CACtF,EAiCA,OA/BA,EAAAJ,EAAA,UAAA,KAAgB,CACZ,GAAI,CAACI,EAAS,CACVI,EAAS,CAAE,QAAS,GAAM,UAAW,EAAM,CAAC,EAC5C,MACJ,CAEA,IAAIC,EAAY,GAkBhB,OAjBAD,EAAU,IAAU,CAAE,GAAGE,EAAM,UAAW,EAAK,EAAE,EAEjD,QAAQ,QAAQN,EAAQ,IAAIE,CAAM,CAAC,CAAC,CAC/B,KAAM,GAAQ,CACX,GAAIG,EAAW,OACf,IAAMP,EAASD,EAAUU,CAAG,EAC5BH,EAAS,CAAE,QAASN,EAAO,IAAK,UAAW,GAAO,OAAQA,EAAO,MAAO,CAAC,CAC7E,CAAC,CAAC,CACD,MAAO,GAAmB,CACnBO,GACJD,EAAS,CACL,QAAS,GACT,UAAW,GACX,OAAQI,aAAiB,MAAQA,EAAM,QAAU,qBACrD,CAAC,CACL,CAAC,MAEQ,CACT,EAAY,EAChB,CAGJ,EAAG,CAACR,EAASC,CAAS,CAAC,EAEhBE,CACX,C"}