{"version":3,"sources":["../src/prisma.ts","../src/adapters/prisma-rbac.storage.ts","../src/errors/http-error.mapper.ts","../src/errors/rbac.error.ts","../src/utils/assertions.ts","../src/utils/normalize.ts","../src/utils/canonicalization.ts","../src/adapters/prisma-rbac.mapper.ts","../src/adapters/prisma-rbac-mutation.ts","../src/adapters/prisma-rbac.query.ts"],"sourcesContent":["export * from './adapters/prisma-rbac.storage';\n","import { isDeepStrictEqual } from 'node:util';\nimport { RbacConfigError } from '../errors';\nimport { normalizePermission, normalizePermissions } from '../utils';\nimport { canonicalizeIdentifier, canonicalizeSubject } from '../utils/canonicalization';\nimport type {\n  AssignRoleStorageInput,\n  CreateRoleInput,\n  DeleteRoleInput,\n  FindRoleByIdInput,\n  FindRoleInput,\n  GrantPermissionInput,\n  ListBindingsStorageInput,\n  ListEffectivePermissionsInput,\n  ListEffectiveRolesInput,\n  ListRolePermissionsInput,\n  ListRolesInput,\n  RbacEffectivePermission,\n  RbacEffectiveRole,\n  RbacRole,\n  RbacRoleBinding,\n  RbacStorage,\n  RbacMutationResult,\n  RbacStorageMutationCapability,\n  RbacStorageRoleLookupCapability,\n  RevokePermissionInput,\n  RevokeRoleStorageInput,\n  UpdateRoleInput,\n  UpsertRoleInput,\n} from '../interfaces';\nimport {\n  cloneDate,\n  encodeMetadata,\n  toBinding,\n  toEffectiveRole,\n  toRole,\n  type PrismaBindingRecord,\n  type PrismaEffectiveBindingRecord,\n  type PrismaRoleRecord,\n} from './prisma-rbac.mapper';\nimport {\n  isActiveBinding,\n  isPrismaUniqueConstraintError,\n  mutationCount,\n  newPrismaRbacId,\n  sameDate,\n} from './prisma-rbac-mutation';\nimport {\n  canonicalizeAssignInput,\n  canonicalizeUpsertRoleInput,\n  effectiveBindingWhere,\n  normalizeTenantId,\n  roleInputChangesRecord,\n  roleWhere,\n} from './prisma-rbac.query';\n\ntype PrismaDelegate = {\n  findFirst(args?: Record<string, unknown>): Promise<unknown>;\n  findMany(args?: Record<string, unknown>): Promise<unknown[]>;\n  create(args: Record<string, unknown>): Promise<unknown>;\n  update(args: Record<string, unknown>): Promise<unknown>;\n  updateMany?(args: Record<string, unknown>): Promise<unknown>;\n  upsert(args: Record<string, unknown>): Promise<unknown>;\n  delete(args: Record<string, unknown>): Promise<unknown>;\n  deleteMany(args?: Record<string, unknown>): Promise<unknown>;\n};\n\nexport interface PrismaRbacTransactionClientLike {\n  rbacRole: PrismaDelegate;\n  rbacPermission: PrismaDelegate;\n  rbacRolePermission: PrismaDelegate;\n  rbacRoleBinding: PrismaDelegate;\n}\n\nexport interface PrismaRbacClientLike extends PrismaRbacTransactionClientLike {\n  $transaction<T>(fn: (tx: PrismaRbacTransactionClientLike) => Promise<T>): Promise<T>;\n}\n\nexport class PrismaRbacStorage implements RbacStorage, RbacStorageRoleLookupCapability {\n  constructor(private readonly prisma: PrismaRbacClientLike) {}\n\n  readonly mutationResults: RbacStorageMutationCapability = {\n    createRole: (input: CreateRoleInput) =>\n      this.upsertRoleWithRetry(canonicalizeUpsertRoleInput(input), false, true),\n    updateRole: (input: UpdateRoleInput) =>\n      this.upsertRoleWithRetry(canonicalizeUpsertRoleInput(input), false, false),\n    deleteRole: (input: DeleteRoleInput) => this.deleteRoleWithResult(input),\n    grantPermission: (input: GrantPermissionInput) => this.grantPermissionWithResult(input, false),\n    revokePermission: (input: RevokePermissionInput) => this.revokePermissionWithResult(input),\n    assignRole: (input: AssignRoleStorageInput) =>\n      this.assignRoleWithRetry(canonicalizeAssignInput(input), false),\n    revokeRole: (input: RevokeRoleStorageInput) => this.revokeRoleWithResult(input),\n  };\n\n  async findRole(input: FindRoleInput): Promise<RbacRole | null> {\n    const key = canonicalizeIdentifier(input.key, 'role key');\n    const role = (await this.prisma.rbacRole.findFirst({\n      where: roleWhere(normalizeTenantId(input.tenantId), key),\n      include: { permissions: { include: { permission: true } } },\n    })) as PrismaRoleRecord | null;\n\n    return role ? toRole(role) : null;\n  }\n\n  async findRoleById(input: FindRoleByIdInput): Promise<RbacRole | null> {\n    const roleId = canonicalizeIdentifier(input.roleId, 'roleId');\n    const role = (await this.prisma.rbacRole.findFirst({\n      where: { id: roleId },\n      include: { permissions: { include: { permission: true } } },\n    })) as PrismaRoleRecord | null;\n\n    return role ? toRole(role) : null;\n  }\n\n  async listRoles(input: ListRolesInput): Promise<RbacRole[]> {\n    const roles = (await this.prisma.rbacRole.findMany({\n      where:\n        input.tenantId === undefined ? undefined : { tenantId: normalizeTenantId(input.tenantId) },\n      include: { permissions: { include: { permission: true } } },\n      orderBy: [{ tenantId: 'asc' }, { key: 'asc' }],\n    })) as PrismaRoleRecord[];\n\n    return roles.map(toRole);\n  }\n\n  async upsertRole(input: UpsertRoleInput): Promise<RbacRole> {\n    const result = await this.upsertRoleWithRetry(canonicalizeUpsertRoleInput(input), false, true);\n    if (result.value) return result.value;\n\n    throw new RbacConfigError({\n      operation: 'upsertRole',\n      reason: result.reason ?? 'mutation_result_missing_value',\n    });\n  }\n\n  private async upsertRoleWithRetry(\n    input: UpsertRoleInput,\n    retried: boolean,\n    allowMissingExplicitRole: boolean,\n  ): Promise<RbacMutationResult<RbacRole>> {\n    try {\n      return await this.prisma.$transaction(async (tx) => {\n        const hasExplicitRoleId = 'roleId' in input;\n        const explicitRoleId = hasExplicitRoleId ? input.roleId : undefined;\n        let existing: PrismaRoleRecord | null;\n\n        if (hasExplicitRoleId) {\n          existing = (await tx.rbacRole.findFirst({\n            where: { id: explicitRoleId },\n            include: { permissions: { include: { permission: true } } },\n          })) as PrismaRoleRecord | null;\n        } else {\n          existing = (await tx.rbacRole.findFirst({\n            where: roleWhere(normalizeTenantId(input.tenantId), input.key),\n            include: { permissions: { include: { permission: true } } },\n          })) as PrismaRoleRecord | null;\n        }\n\n        if (hasExplicitRoleId && !existing && !allowMissingExplicitRole) {\n          return { outcome: 'conflict', reason: 'role_not_found' };\n        }\n\n        if (existing && !roleInputChangesRecord(existing, input)) {\n          return { outcome: 'no-op', value: toRole(existing) };\n        }\n\n        const id = existing?.id ?? explicitRoleId ?? newPrismaRbacId('role');\n        const key = input.key ?? existing?.key ?? id;\n        const tenantId =\n          input.tenantId !== undefined\n            ? normalizeTenantId(input.tenantId)\n            : (existing?.tenantId ?? null);\n\n        if (hasExplicitRoleId) {\n          await this.assertUniqueRoleKey(tx, id, tenantId, key);\n        }\n\n        const role = (await tx.rbacRole.upsert({\n          where: { id },\n          create: {\n            id,\n            key,\n            tenantId,\n            name: input.name,\n            description: input.description,\n            isSystem: input.isSystem ?? false,\n          },\n          update: {\n            key,\n            ...(input.tenantId !== undefined ? { tenantId } : {}),\n            ...(input.name !== undefined ? { name: input.name } : {}),\n            ...(input.description !== undefined ? { description: input.description } : {}),\n            ...(input.isSystem !== undefined ? { isSystem: input.isSystem } : {}),\n          },\n        })) as PrismaRoleRecord;\n\n        if (input.permissions !== undefined) {\n          await this.replaceRolePermissions(tx, role.id, input.permissions);\n        }\n\n        const reloaded = (await tx.rbacRole.findFirst({\n          where: { id: role.id },\n          include: { permissions: { include: { permission: true } } },\n        })) as PrismaRoleRecord | null;\n\n        if (!reloaded) {\n          throw new RbacConfigError({\n            operation: 'upsertRole',\n            reason: 'role_not_found_after_upsert',\n            roleId: role.id,\n          });\n        }\n\n        return { outcome: existing ? 'updated' : 'created', value: toRole(reloaded) };\n      });\n    } catch (error) {\n      if (!retried && isPrismaUniqueConstraintError(error)) {\n        return this.upsertRoleWithRetry(input, true, allowMissingExplicitRole);\n      }\n\n      throw error;\n    }\n  }\n\n  async deleteRole(input: DeleteRoleInput): Promise<void> {\n    await this.deleteRoleWithResult(input);\n  }\n\n  private async deleteRoleWithResult(input: DeleteRoleInput): Promise<RbacMutationResult> {\n    const roleId = canonicalizeIdentifier(input.roleId, 'roleId');\n    const deleted = await this.prisma.rbacRole.deleteMany({ where: { id: roleId } });\n\n    return { outcome: mutationCount(deleted) > 0 ? 'deleted' : 'no-op' };\n  }\n\n  async grantPermission(input: GrantPermissionInput): Promise<void> {\n    await this.grantPermissionWithResult(input, false);\n  }\n\n  private async grantPermissionWithResult(\n    input: GrantPermissionInput,\n    retried: boolean,\n  ): Promise<RbacMutationResult> {\n    const roleId = canonicalizeIdentifier(input.roleId, 'roleId');\n    const permission = normalizePermission(input.permission);\n\n    try {\n      return await this.prisma.$transaction(async (tx) => {\n        const role = (await tx.rbacRole.findFirst({\n          where: { id: roleId },\n        })) as PrismaRoleRecord | null;\n        if (!role) return { outcome: 'conflict', reason: 'role_not_found' };\n\n        const permissionRecord = (await tx.rbacPermission.upsert({\n          where: { key: permission },\n          create: { id: newPrismaRbacId('permission'), key: permission },\n          update: {},\n        })) as { id: string; key: string };\n        const existing = await tx.rbacRolePermission.findFirst({\n          where: { roleId, permissionId: permissionRecord.id },\n        });\n        if (existing) return { outcome: 'no-op' };\n\n        await tx.rbacRolePermission.create({\n          data: { roleId, permissionId: permissionRecord.id },\n        });\n\n        return { outcome: 'created' };\n      });\n    } catch (error) {\n      if (!retried && isPrismaUniqueConstraintError(error)) {\n        return this.grantPermissionWithResult({ roleId, permission }, true);\n      }\n\n      throw error;\n    }\n  }\n\n  async revokePermission(input: RevokePermissionInput): Promise<void> {\n    await this.revokePermissionWithResult(input);\n  }\n\n  private async revokePermissionWithResult(\n    input: RevokePermissionInput,\n  ): Promise<RbacMutationResult> {\n    const roleId = canonicalizeIdentifier(input.roleId, 'roleId');\n    const permission = normalizePermission(input.permission);\n    return this.prisma.$transaction(async (tx) => {\n      const role = await tx.rbacRole.findFirst({ where: { id: roleId } });\n      if (!role) return { outcome: 'conflict', reason: 'role_not_found' };\n\n      const permissionRecord = (await tx.rbacPermission.findFirst({\n        where: { key: permission },\n      })) as { id: string } | null;\n      if (!permissionRecord) return { outcome: 'no-op' };\n\n      const deleted = await tx.rbacRolePermission.deleteMany({\n        where: { roleId, permissionId: permissionRecord.id },\n      });\n\n      return { outcome: mutationCount(deleted) > 0 ? 'deleted' : 'no-op' };\n    });\n  }\n\n  async listRolePermissions(input: ListRolePermissionsInput): Promise<string[]> {\n    const roleId = canonicalizeIdentifier(input.roleId, 'roleId');\n    const links = (await this.prisma.rbacRolePermission.findMany({\n      where: { roleId },\n      include: { permission: true },\n      orderBy: { permission: { key: 'asc' } },\n    })) as Array<{ permission: { key: string } }>;\n\n    return links.map((link) => link.permission.key);\n  }\n\n  async assignRole(input: AssignRoleStorageInput): Promise<RbacRoleBinding> {\n    const result = await this.assignRoleWithRetry(canonicalizeAssignInput(input), false);\n    if (result.value) return result.value;\n\n    throw new RbacConfigError({\n      operation: 'assignRole',\n      reason: result.reason ?? 'mutation_result_missing_value',\n    });\n  }\n\n  private async assignRoleWithRetry(\n    input: AssignRoleStorageInput,\n    retried: boolean,\n  ): Promise<RbacMutationResult<RbacRoleBinding>> {\n    const tenantId = normalizeTenantId(input.tenantId);\n    const resourceType = input.resource?.type ?? null;\n    const resourceId = input.resource?.id ?? null;\n    const expiresAt = cloneDate(input.expiresAt);\n    const encodedMetadata = encodeMetadata(input.metadata);\n    const now = new Date();\n\n    try {\n      return await this.prisma.$transaction(async (tx) => {\n        const role = await tx.rbacRole.findFirst({ where: { id: input.roleId } });\n        if (!role) return { outcome: 'conflict', reason: 'role_not_found' };\n\n        const existing = (await tx.rbacRoleBinding.findFirst({\n          where: {\n            tenantId,\n            subjectType: input.subject.type,\n            subjectId: input.subject.id,\n            roleId: input.roleId,\n            resourceType,\n            resourceId,\n            revokedAt: null,\n          },\n        })) as PrismaBindingRecord | null;\n\n        if (existing) {\n          if (isActiveBinding(existing, now)) {\n            return { outcome: 'no-op', value: toBinding(existing) };\n          }\n          if (\n            sameDate(existing.expiresAt, expiresAt) &&\n            isDeepStrictEqual(existing.metadata, encodedMetadata ?? null)\n          ) {\n            return { outcome: 'no-op', value: toBinding(existing) };\n          }\n\n          const reactivated = (await tx.rbacRoleBinding.update({\n            where: { id: existing.id },\n            data: {\n              expiresAt,\n              revokedAt: null,\n              metadata: encodedMetadata ?? null,\n            },\n          })) as PrismaBindingRecord;\n\n          return { outcome: 'updated', value: toBinding(reactivated) };\n        }\n\n        const binding = (await tx.rbacRoleBinding.create({\n          data: {\n            id: newPrismaRbacId('binding'),\n            tenantId,\n            subjectType: input.subject.type,\n            subjectId: input.subject.id,\n            roleId: input.roleId,\n            resourceType,\n            resourceId,\n            expiresAt,\n            revokedAt: null,\n            ...(encodedMetadata !== undefined ? { metadata: encodedMetadata } : {}),\n          },\n        })) as PrismaBindingRecord;\n\n        return { outcome: 'created', value: toBinding(binding) };\n      });\n    } catch (error) {\n      if (!retried && isPrismaUniqueConstraintError(error)) {\n        return this.assignRoleWithRetry(input, true);\n      }\n\n      throw error;\n    }\n  }\n\n  async revokeRole(input: RevokeRoleStorageInput): Promise<void> {\n    await this.revokeRoleWithResult(input);\n  }\n\n  private async revokeRoleWithResult(input: RevokeRoleStorageInput): Promise<RbacMutationResult> {\n    const bindingId = canonicalizeIdentifier(input.bindingId, 'bindingId');\n    const revokedAt = cloneDate(input.revokedAt) ?? new Date();\n    if (this.prisma.rbacRoleBinding.updateMany) {\n      const updated = await this.prisma.rbacRoleBinding.updateMany({\n        where: { id: bindingId, revokedAt: null },\n        data: { revokedAt },\n      });\n\n      return { outcome: mutationCount(updated) > 0 ? 'updated' : 'no-op' };\n    }\n\n    return this.prisma.$transaction(async (tx) => {\n      const existing = (await tx.rbacRoleBinding.findFirst({\n        where: { id: bindingId },\n      })) as PrismaBindingRecord | null;\n      if (!existing || existing.revokedAt) return { outcome: 'no-op' };\n\n      await tx.rbacRoleBinding.update({ where: { id: bindingId }, data: { revokedAt } });\n\n      return { outcome: 'updated' };\n    });\n  }\n\n  async listBindings(input: ListBindingsStorageInput): Promise<RbacRoleBinding[]> {\n    const subject = canonicalizeSubject(input.subject);\n    const bindings = (await this.prisma.rbacRoleBinding.findMany({\n      where: {\n        subjectType: subject.type,\n        subjectId: subject.id,\n        ...(input.tenantId !== undefined ? { tenantId: normalizeTenantId(input.tenantId) } : {}),\n      },\n      orderBy: { id: 'asc' },\n    })) as PrismaBindingRecord[];\n\n    return bindings.map(toBinding);\n  }\n\n  async listEffectiveRoles(input: ListEffectiveRolesInput): Promise<RbacEffectiveRole[]> {\n    const now = input.now ?? new Date();\n    const bindings = (await this.prisma.rbacRoleBinding.findMany({\n      where: effectiveBindingWhere(input, now),\n      include: { role: true },\n      orderBy: { id: 'asc' },\n    })) as PrismaEffectiveBindingRecord[];\n\n    return bindings.map(toEffectiveRole);\n  }\n\n  async listEffectivePermissions(\n    input: ListEffectivePermissionsInput,\n  ): Promise<RbacEffectivePermission[]> {\n    const now = input.now ?? new Date();\n    const bindings = (await this.prisma.rbacRoleBinding.findMany({\n      where: effectiveBindingWhere(input, now),\n      include: {\n        role: {\n          include: {\n            permissions: {\n              include: { permission: true },\n            },\n          },\n        },\n      },\n      orderBy: { id: 'asc' },\n    })) as PrismaEffectiveBindingRecord[];\n\n    return bindings.flatMap((binding) =>\n      (binding.role.permissions ?? []).map((link) => ({\n        ...toEffectiveRole(binding),\n        permission: link.permission.key,\n      })),\n    );\n  }\n\n  private async replaceRolePermissions(\n    tx: PrismaRbacTransactionClientLike,\n    roleId: string,\n    permissions: string[],\n  ): Promise<void> {\n    await tx.rbacRolePermission.deleteMany({ where: { roleId } });\n\n    for (const permission of normalizePermissions(permissions)) {\n      const permissionRecord = (await tx.rbacPermission.upsert({\n        where: { key: permission },\n        create: { id: newPrismaRbacId('permission'), key: permission },\n        update: {},\n      })) as { id: string };\n\n      await tx.rbacRolePermission.upsert({\n        where: {\n          roleId_permissionId: { roleId, permissionId: permissionRecord.id },\n        },\n        create: { roleId, permissionId: permissionRecord.id },\n        update: {},\n      });\n    }\n  }\n\n  private async assertUniqueRoleKey(\n    tx: PrismaRbacTransactionClientLike,\n    roleId: string,\n    tenantId: string | null,\n    key: string,\n  ): Promise<void> {\n    const conflictingRole = (await tx.rbacRole.findFirst({\n      where: {\n        ...roleWhere(tenantId, key),\n        NOT: { id: roleId },\n      },\n    })) as PrismaRoleRecord | null;\n\n    if (!conflictingRole) return;\n\n    throw new RbacConfigError({\n      operation: 'upsertRole',\n      reason: 'duplicate_role_key',\n      tenantId,\n      key,\n      roleId,\n      conflictingRoleId: conflictingRole.id,\n    });\n  }\n}\n","import {\n  ForbiddenException,\n  InternalServerErrorException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport type { RbacError } from './rbac.error';\n\nexport function mapRbacErrorToHttpException(error: RbacError) {\n  const response = { message: error.message, code: error.code };\n\n  switch (error.code) {\n    case 'RBAC_CONFIG_ERROR':\n    case 'RBAC_STORAGE_ERROR':\n      return new InternalServerErrorException(response);\n    case 'RBAC_SUBJECT_MISSING':\n      return new UnauthorizedException(response);\n    case 'RBAC_TENANT_MISSING':\n    case 'RBAC_RESOURCE_MISSING':\n    case 'RBAC_PERMISSION_DENIED':\n    case 'RBAC_ROLE_NOT_FOUND':\n    case 'RBAC_PERMISSION_NOT_FOUND':\n    case 'RBAC_BINDING_NOT_FOUND':\n      return new ForbiddenException(response);\n    default:\n      return assertNever(error.code);\n  }\n}\n\nfunction assertNever(_code: never): never {\n  void _code;\n  throw new Error('Unhandled RBAC error code');\n}\n","export type RbacErrorCode =\n  | 'RBAC_CONFIG_ERROR'\n  | 'RBAC_SUBJECT_MISSING'\n  | 'RBAC_TENANT_MISSING'\n  | 'RBAC_RESOURCE_MISSING'\n  | 'RBAC_PERMISSION_DENIED'\n  | 'RBAC_ROLE_NOT_FOUND'\n  | 'RBAC_PERMISSION_NOT_FOUND'\n  | 'RBAC_BINDING_NOT_FOUND'\n  | 'RBAC_STORAGE_ERROR';\n\nexport interface RbacErrorOptions {\n  details?: Record<string, unknown> | undefined;\n  cause?: unknown;\n}\n\nexport interface RbacErrorCauseOptions {\n  cause?: unknown;\n}\n\nexport class RbacError extends Error {\n  constructor(\n    message: string,\n    public readonly code: RbacErrorCode,\n    public readonly status?: number,\n    options: RbacErrorOptions = {},\n  ) {\n    super(message, { cause: options.cause });\n    this.name = new.target.name;\n    if (options.details !== undefined) {\n      this.details = options.details;\n    }\n  }\n\n  public readonly details?: Record<string, unknown>;\n}\n\nexport class RbacConfigError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('RBAC configuration error', 'RBAC_CONFIG_ERROR', 500, {\n      details,\n      cause: options.cause,\n    });\n  }\n}\n\nexport class RbacSubjectMissingError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('Subject missing', 'RBAC_SUBJECT_MISSING', 401, { details, cause: options.cause });\n  }\n}\n\nexport class RbacTenantMissingError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('Tenant missing', 'RBAC_TENANT_MISSING', 403, { details, cause: options.cause });\n  }\n}\n\nexport class RbacResourceMissingError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('Resource missing', 'RBAC_RESOURCE_MISSING', 403, { details, cause: options.cause });\n  }\n}\n\nexport class RbacPermissionDeniedError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('Permission denied', 'RBAC_PERMISSION_DENIED', 403, {\n      details,\n      cause: options.cause,\n    });\n  }\n}\n\nexport class RbacRoleNotFoundError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('Role not found', 'RBAC_ROLE_NOT_FOUND', 403, { details, cause: options.cause });\n  }\n}\n\n/**\n * @deprecated No package operation throws this error. It remains constructible\n * and HTTP-mappable until a separate breaking release.\n */\nexport class RbacPermissionNotFoundError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('Permission not found', 'RBAC_PERMISSION_NOT_FOUND', 403, {\n      details,\n      cause: options.cause,\n    });\n  }\n}\n\n/**\n * @deprecated No package operation throws this error. It remains constructible\n * and HTTP-mappable until a separate breaking release.\n */\nexport class RbacBindingNotFoundError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('Binding not found', 'RBAC_BINDING_NOT_FOUND', 403, { details, cause: options.cause });\n  }\n}\n\nexport class RbacStorageError extends RbacError {\n  constructor(details?: Record<string, unknown>, options: RbacErrorCauseOptions = {}) {\n    super('RBAC storage error', 'RBAC_STORAGE_ERROR', 500, { details, cause: options.cause });\n  }\n}\n","export function assertNonEmptyString(value: string | null | undefined, name: string): string {\n  if (!value || value.trim() === '') {\n    throw new Error(`${name} must be a non-empty string`);\n  }\n  return value.trim();\n}\n","const PERMISSION_RE = /^(?:\\*|[a-zA-Z0-9_-]+(?:\\.[a-zA-Z0-9_-]+)*(?:\\.\\*)?)$/;\n\nexport function normalizePermission(permission: string): string {\n  const normalized = permission.trim();\n  if (!PERMISSION_RE.test(normalized)) {\n    throw new Error(`Invalid permission: ${permission}`);\n  }\n  return normalized;\n}\n\nexport function normalizePermissions(permissions: string[]): string[] {\n  return [...new Set(permissions.map(normalizePermission))];\n}\n","import type { RbacResourceRef, RbacSubject } from '../interfaces';\nimport { assertNonEmptyString } from './assertions';\n\nexport function canonicalizeIdentifier(value: string, name: string): string {\n  return assertNonEmptyString(value, name);\n}\n\nexport function isCanonicalIdentifier(value: unknown): value is string {\n  return typeof value === 'string' && value.trim() !== '' && value === value.trim();\n}\n\nexport function canonicalizeTenantId(\n  tenantId: string | null | undefined,\n  name = 'tenantId',\n): string | null | undefined {\n  return tenantId == null ? tenantId : canonicalizeIdentifier(tenantId, name);\n}\n\nexport function canonicalizeSubject(subject: RbacSubject): RbacSubject {\n  const isApiKey = subject.type === 'api_key';\n  const type = canonicalizeIdentifier(subject.type, 'subject.type');\n  const id = isApiKey\n    ? preserveOpaqueIdentifier(subject.id, 'subject.id')\n    : canonicalizeIdentifier(subject.id, 'subject.id');\n  const tenantId =\n    isApiKey && typeof subject.tenantId === 'string'\n      ? preserveOpaqueIdentifier(subject.tenantId, 'subject.tenantId')\n      : canonicalizeTenantId(subject.tenantId, 'subject.tenantId');\n\n  return {\n    ...subject,\n    type,\n    id,\n    ...(tenantId !== undefined ? { tenantId } : {}),\n  };\n}\n\nexport function canonicalizeResource(resource: RbacResourceRef): RbacResourceRef {\n  return {\n    type: canonicalizeIdentifier(resource.type, 'resource.type'),\n    id: canonicalizeIdentifier(resource.id, 'resource.id'),\n  };\n}\n\nfunction preserveOpaqueIdentifier(value: string, name: string): string {\n  assertNonEmptyString(value, name);\n  return value;\n}\n","import type { RbacEffectiveRole, RbacRole, RbacRoleBinding } from '../interfaces';\n\nexport interface PrismaRoleRecord {\n  id: string;\n  key: string;\n  name: string | null;\n  description: string | null;\n  tenantId: string | null;\n  isSystem: boolean;\n  permissions?: Array<{ permission: { key: string } }>;\n}\n\nexport type PrismaJson =\n  | null\n  | string\n  | number\n  | boolean\n  | PrismaJson[]\n  | { [key: string]: PrismaJson };\n\nexport interface PrismaBindingRecord {\n  id: string;\n  tenantId: string | null;\n  subjectType: string;\n  subjectId: string;\n  roleId: string;\n  resourceType: string | null;\n  resourceId: string | null;\n  expiresAt: Date | null;\n  revokedAt: Date | null;\n  metadata: PrismaJson | null;\n}\n\nexport interface PrismaEffectiveBindingRecord extends PrismaBindingRecord {\n  role: PrismaRoleRecord & {\n    permissions?: Array<{ permission: { key: string } }>;\n  };\n}\n\nconst metadataTypeKey = '__nestarcRbacJson';\nconst metadataValueKey = 'value';\n\nexport const cloneDate = (date: Date | null | undefined): Date | null =>\n  date ? new Date(date) : null;\n\nconst encodeMetadataValue = (value: unknown): PrismaJson | undefined => {\n  if (value === undefined) return undefined;\n  if (\n    value === null ||\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  ) {\n    return value;\n  }\n  if (value instanceof Date) {\n    return { [metadataTypeKey]: 'date', [metadataValueKey]: value.toISOString() };\n  }\n  if (Array.isArray(value)) {\n    return {\n      [metadataTypeKey]: 'array',\n      [metadataValueKey]: value.map((item) => encodeMetadataValue(item) ?? null),\n    };\n  }\n  if (typeof value === 'object') {\n    const entries = Object.entries(value as Record<string, unknown>)\n      .map(([key, nestedValue]) => [key, encodeMetadataValue(nestedValue)] as const)\n      .filter((entry): entry is readonly [string, PrismaJson] => entry[1] !== undefined);\n\n    return { [metadataTypeKey]: 'object', [metadataValueKey]: Object.fromEntries(entries) };\n  }\n  if (typeof value === 'bigint') return value.toString();\n  if (typeof value === 'symbol') return value.description ?? null;\n  if (typeof value === 'function') return value.name ? `[Function ${value.name}]` : '[Function]';\n\n  return null;\n};\n\nexport const encodeMetadata = (\n  metadata: Record<string, unknown> | undefined,\n): Record<string, PrismaJson> | undefined => {\n  if (metadata === undefined) return undefined;\n  return encodeMetadataValue(metadata) as Record<string, PrismaJson>;\n};\n\nconst isEncodedMetadataValue = (\n  value: unknown,\n): value is {\n  [metadataTypeKey]: 'array' | 'date' | 'object';\n  [metadataValueKey]: PrismaJson;\n} => {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;\n\n  const candidate = value as Record<string, unknown>;\n  const type = candidate[metadataTypeKey];\n\n  return (\n    Object.keys(candidate).length === 2 &&\n    (type === 'array' || type === 'date' || type === 'object') &&\n    metadataValueKey in candidate\n  );\n};\n\nconst decodeMetadataValue = (value: PrismaJson): unknown => {\n  if (isEncodedMetadataValue(value)) {\n    if (value[metadataTypeKey] === 'date') {\n      return typeof value[metadataValueKey] === 'string'\n        ? new Date(value[metadataValueKey])\n        : value[metadataValueKey];\n    }\n    if (value[metadataTypeKey] === 'array') {\n      return Array.isArray(value[metadataValueKey])\n        ? value[metadataValueKey].map(decodeMetadataValue)\n        : value[metadataValueKey];\n    }\n    if (value[metadataValueKey] && typeof value[metadataValueKey] === 'object') {\n      return Object.fromEntries(\n        Object.entries(value[metadataValueKey]).map(([key, nestedValue]) => [\n          key,\n          decodeMetadataValue(nestedValue),\n        ]),\n      );\n    }\n\n    return value[metadataValueKey];\n  }\n  if (Array.isArray(value)) return value.map(decodeMetadataValue);\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, nestedValue]) => [key, decodeMetadataValue(nestedValue)]),\n    );\n  }\n\n  return value;\n};\n\nconst decodeMetadata = (metadata: PrismaJson | null): Record<string, unknown> | undefined => {\n  if (metadata === null) return undefined;\n  return decodeMetadataValue(metadata) as Record<string, unknown>;\n};\n\nexport const toRole = (record: PrismaRoleRecord): RbacRole => ({\n  id: record.id,\n  key: record.key,\n  tenantId: record.tenantId,\n  permissions: record.permissions?.map((entry) => entry.permission.key).sort() ?? [],\n  ...(record.name !== null ? { name: record.name } : {}),\n  ...(record.description !== null ? { description: record.description } : {}),\n  isSystem: record.isSystem,\n});\n\nexport const toBinding = (record: PrismaBindingRecord): RbacRoleBinding => {\n  const binding: RbacRoleBinding = {\n    id: record.id,\n    tenantId: record.tenantId,\n    subjectType: record.subjectType,\n    subjectId: record.subjectId,\n    roleId: record.roleId,\n    resourceType: record.resourceType,\n    resourceId: record.resourceId,\n    expiresAt: cloneDate(record.expiresAt),\n    revokedAt: cloneDate(record.revokedAt),\n  };\n  const metadata = decodeMetadata(record.metadata);\n\n  if (metadata !== undefined) binding.metadata = metadata;\n  return binding;\n};\n\nexport const toEffectiveRole = (binding: PrismaEffectiveBindingRecord): RbacEffectiveRole => ({\n  roleKey: binding.role.key,\n  roleId: binding.roleId,\n  bindingId: binding.id,\n  tenantId: binding.tenantId,\n  resourceType: binding.resourceType,\n  resourceId: binding.resourceId,\n  expiresAt: cloneDate(binding.expiresAt),\n});\n","import { randomUUID } from 'node:crypto';\nimport type { PrismaBindingRecord } from './prisma-rbac.mapper';\n\nexport const newPrismaRbacId = (prefix: string): string => `${prefix}_${randomUUID()}`;\n\nexport const isActiveBinding = (binding: PrismaBindingRecord, now: Date): boolean =>\n  binding.revokedAt === null &&\n  (binding.expiresAt === null || binding.expiresAt.getTime() >= now.getTime());\n\nexport const sameDate = (left: Date | null, right: Date | null): boolean =>\n  left === null ? right === null : right !== null && left.getTime() === right.getTime();\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null;\n\nexport const isPrismaUniqueConstraintError = (error: unknown): boolean =>\n  isRecord(error) && error.code === 'P2002';\n\nexport const mutationCount = (value: unknown): number =>\n  isRecord(value) && typeof value.count === 'number' ? value.count : 0;\n","import type {\n  AssignRoleStorageInput,\n  ListEffectiveRolesInput,\n  UpsertRoleInput,\n} from '../interfaces';\nimport { normalizePermissions } from '../utils';\nimport {\n  canonicalizeIdentifier,\n  canonicalizeResource,\n  canonicalizeSubject,\n  canonicalizeTenantId,\n} from '../utils/canonicalization';\nimport type { PrismaRoleRecord } from './prisma-rbac.mapper';\n\nexport const normalizeTenantId = (tenantId: string | null | undefined): string | null =>\n  canonicalizeTenantId(tenantId) ?? null;\n\nexport const canonicalizeUpsertRoleInput = (input: UpsertRoleInput): UpsertRoleInput =>\n  'roleId' in input\n    ? {\n        ...input,\n        roleId: canonicalizeIdentifier(input.roleId, 'roleId'),\n        ...(input.tenantId !== undefined ? { tenantId: canonicalizeTenantId(input.tenantId) } : {}),\n        ...(input.key !== undefined ? { key: canonicalizeIdentifier(input.key, 'role key') } : {}),\n        ...(input.permissions !== undefined\n          ? { permissions: normalizePermissions(input.permissions) }\n          : {}),\n      }\n    : {\n        ...input,\n        tenantId: canonicalizeTenantId(input.tenantId),\n        key: canonicalizeIdentifier(input.key, 'role key'),\n        permissions: normalizePermissions(input.permissions),\n      };\n\nexport const canonicalizeAssignInput = (input: AssignRoleStorageInput): AssignRoleStorageInput => ({\n  ...input,\n  tenantId: canonicalizeTenantId(input.tenantId),\n  subject: canonicalizeSubject(input.subject),\n  roleId: canonicalizeIdentifier(input.roleId, 'roleId'),\n  ...(input.resource !== undefined ? { resource: canonicalizeResource(input.resource) } : {}),\n});\n\nexport const roleWhere = (\n  tenantId: string | null,\n  key: string,\n): { tenantId: string | null; key: string } => ({ tenantId, key });\n\nconst samePermissions = (record: PrismaRoleRecord, permissions: string[]): boolean => {\n  const stored = record.permissions?.map((entry) => entry.permission.key).sort() ?? [];\n  const requested = [...permissions].sort();\n\n  return (\n    stored.length === requested.length && stored.every((value, index) => value === requested[index])\n  );\n};\n\nexport const roleInputChangesRecord = (\n  record: PrismaRoleRecord,\n  input: UpsertRoleInput,\n): boolean => {\n  if (input.key !== undefined && input.key !== record.key) return true;\n  if (input.tenantId !== undefined && normalizeTenantId(input.tenantId) !== record.tenantId) {\n    return true;\n  }\n  if (input.name !== undefined && input.name !== record.name) return true;\n  if (input.description !== undefined && input.description !== record.description) return true;\n  if (input.isSystem !== undefined && input.isSystem !== record.isSystem) return true;\n\n  return input.permissions !== undefined && !samePermissions(record, input.permissions);\n};\n\nexport const effectiveBindingWhere = (\n  input: ListEffectiveRolesInput,\n  now: Date,\n): Record<string, unknown> => {\n  const subject = canonicalizeSubject(input.subject);\n  const tenantId = normalizeTenantId(input.tenantId);\n  const resource = input.resource ? canonicalizeResource(input.resource) : undefined;\n  const resourceFilter = resource\n    ? {\n        OR: [\n          { resourceType: null, resourceId: null },\n          { resourceType: resource.type, resourceId: resource.id },\n        ],\n      }\n    : { resourceType: null, resourceId: null };\n\n  return {\n    subjectType: subject.type,\n    subjectId: subject.id,\n    tenantId,\n    revokedAt: null,\n    role: { tenantId },\n    AND: [{ OR: [{ expiresAt: null }, { expiresAt: { gte: now } }] }, resourceFilter],\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA,uBAAkC;;;ACAlC,oBAIO;;;ACgBA,IAAMA,YAAN,cAAwBC,MAAAA;EAA/B,OAA+BA;;;;;EAC7B,YACEC,SACgBC,MACAC,QAChBC,UAA4B,CAAC,GAC7B;AACA,UAAMH,SAAS;MAAEI,OAAOD,QAAQC;IAAM,CAAA,GAAA,KAJtBH,OAAAA,MAAAA,KACAC,SAAAA;AAIhB,SAAKG,OAAO,WAAWA;AACvB,QAAIF,QAAQG,YAAYC,QAAW;AACjC,WAAKD,UAAUH,QAAQG;IACzB;EACF;EAEgBA;AAClB;AAEO,IAAME,kBAAN,cAA8BV,UAAAA;EAjBrC,OAiBqCA;;;EACnC,YAAYQ,SAAmCH,UAAiC,CAAC,GAAG;AAClF,UAAM,4BAA4B,qBAAqB,KAAK;MAC1DG;MACAF,OAAOD,QAAQC;IACjB,CAAA;EACF;AACF;;;AC5CO,SAASK,qBAAqBC,OAAkCC,MAAY;AACjF,MAAI,CAACD,SAASA,MAAME,KAAI,MAAO,IAAI;AACjC,UAAM,IAAIC,MAAM,GAAGF,IAAAA,6BAAiC;EACtD;AACA,SAAOD,MAAME,KAAI;AACnB;AALgBH;;;ACAhB,IAAMK,gBAAgB;AAEf,SAASC,oBAAoBC,YAAkB;AACpD,QAAMC,aAAaD,WAAWE,KAAI;AAClC,MAAI,CAACJ,cAAcK,KAAKF,UAAAA,GAAa;AACnC,UAAM,IAAIG,MAAM,uBAAuBJ,UAAAA,EAAY;EACrD;AACA,SAAOC;AACT;AANgBF;AAQT,SAASM,qBAAqBC,aAAqB;AACxD,SAAO;OAAI,IAAIC,IAAID,YAAYE,IAAIT,mBAAAA,CAAAA;;AACrC;AAFgBM;;;ACPT,SAASI,uBAAuBC,OAAeC,MAAY;AAChE,SAAOC,qBAAqBF,OAAOC,IAAAA;AACrC;AAFgBF;AAQT,SAASI,qBACdC,UACAC,OAAO,YAAU;AAEjB,SAAOD,YAAY,OAAOA,WAAWE,uBAAuBF,UAAUC,IAAAA;AACxE;AALgBF;AAOT,SAASI,oBAAoBC,SAAoB;AACtD,QAAMC,WAAWD,QAAQE,SAAS;AAClC,QAAMA,OAAOJ,uBAAuBE,QAAQE,MAAM,cAAA;AAClD,QAAMC,KAAKF,WACPG,yBAAyBJ,QAAQG,IAAI,YAAA,IACrCL,uBAAuBE,QAAQG,IAAI,YAAA;AACvC,QAAMP,WACJK,YAAY,OAAOD,QAAQJ,aAAa,WACpCQ,yBAAyBJ,QAAQJ,UAAU,kBAAA,IAC3CD,qBAAqBK,QAAQJ,UAAU,kBAAA;AAE7C,SAAO;IACL,GAAGI;IACHE;IACAC;IACA,GAAIP,aAAaS,SAAY;MAAET;IAAS,IAAI,CAAC;EAC/C;AACF;AAjBgBG;AAmBT,SAASO,qBAAqBC,UAAyB;AAC5D,SAAO;IACLL,MAAMJ,uBAAuBS,SAASL,MAAM,eAAA;IAC5CC,IAAIL,uBAAuBS,SAASJ,IAAI,aAAA;EAC1C;AACF;AALgBG;AAOhB,SAASF,yBAAyBI,OAAeX,MAAY;AAC3DY,uBAAqBD,OAAOX,IAAAA;AAC5B,SAAOW;AACT;AAHSJ;;;ACLT,IAAMM,kBAAkB;AACxB,IAAMC,mBAAmB;AAElB,IAAMC,YAAY,wBAACC,SACxBA,OAAO,IAAIC,KAAKD,IAAAA,IAAQ,MADD;AAGzB,IAAME,sBAAsB,wBAACC,UAAAA;AAC3B,MAAIA,UAAUC,OAAW,QAAOA;AAChC,MACED,UAAU,QACV,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU,WACjB;AACA,WAAOA;EACT;AACA,MAAIA,iBAAiBF,MAAM;AACzB,WAAO;MAAE,CAACJ,eAAAA,GAAkB;MAAQ,CAACC,gBAAAA,GAAmBK,MAAME,YAAW;IAAG;EAC9E;AACA,MAAIC,MAAMC,QAAQJ,KAAAA,GAAQ;AACxB,WAAO;MACL,CAACN,eAAAA,GAAkB;MACnB,CAACC,gBAAAA,GAAmBK,MAAMK,IAAI,CAACC,SAASP,oBAAoBO,IAAAA,KAAS,IAAA;IACvE;EACF;AACA,MAAI,OAAON,UAAU,UAAU;AAC7B,UAAMO,UAAUC,OAAOD,QAAQP,KAAAA,EAC5BK,IAAI,CAAC,CAACI,KAAKC,WAAAA,MAAiB;MAACD;MAAKV,oBAAoBW,WAAAA;KAAa,EACnEC,OAAO,CAACC,UAAkDA,MAAM,CAAA,MAAOX,MAAAA;AAE1E,WAAO;MAAE,CAACP,eAAAA,GAAkB;MAAU,CAACC,gBAAAA,GAAmBa,OAAOK,YAAYN,OAAAA;IAAS;EACxF;AACA,MAAI,OAAOP,UAAU,SAAU,QAAOA,MAAMc,SAAQ;AACpD,MAAI,OAAOd,UAAU,SAAU,QAAOA,MAAMe,eAAe;AAC3D,MAAI,OAAOf,UAAU,WAAY,QAAOA,MAAMgB,OAAO,aAAahB,MAAMgB,IAAI,MAAM;AAElF,SAAO;AACT,GA/B4B;AAiCrB,IAAMC,iBAAiB,wBAC5BC,aAAAA;AAEA,MAAIA,aAAajB,OAAW,QAAOA;AACnC,SAAOF,oBAAoBmB,QAAAA;AAC7B,GAL8B;AAO9B,IAAMC,yBAAyB,wBAC7BnB,UAAAA;AAKA,MAAI,CAACA,SAAS,OAAOA,UAAU,YAAYG,MAAMC,QAAQJ,KAAAA,EAAQ,QAAO;AAExE,QAAMoB,YAAYpB;AAClB,QAAMqB,OAAOD,UAAU1B,eAAAA;AAEvB,SACEc,OAAOc,KAAKF,SAAAA,EAAWG,WAAW,MACjCF,SAAS,WAAWA,SAAS,UAAUA,SAAS,aACjD1B,oBAAoByB;AAExB,GAhB+B;AAkB/B,IAAMI,sBAAsB,wBAACxB,UAAAA;AAC3B,MAAImB,uBAAuBnB,KAAAA,GAAQ;AACjC,QAAIA,MAAMN,eAAAA,MAAqB,QAAQ;AACrC,aAAO,OAAOM,MAAML,gBAAAA,MAAsB,WACtC,IAAIG,KAAKE,MAAML,gBAAAA,CAAiB,IAChCK,MAAML,gBAAAA;IACZ;AACA,QAAIK,MAAMN,eAAAA,MAAqB,SAAS;AACtC,aAAOS,MAAMC,QAAQJ,MAAML,gBAAAA,CAAiB,IACxCK,MAAML,gBAAAA,EAAkBU,IAAImB,mBAAAA,IAC5BxB,MAAML,gBAAAA;IACZ;AACA,QAAIK,MAAML,gBAAAA,KAAqB,OAAOK,MAAML,gBAAAA,MAAsB,UAAU;AAC1E,aAAOa,OAAOK,YACZL,OAAOD,QAAQP,MAAML,gBAAAA,CAAiB,EAAEU,IAAI,CAAC,CAACI,KAAKC,WAAAA,MAAiB;QAClED;QACAe,oBAAoBd,WAAAA;OACrB,CAAA;IAEL;AAEA,WAAOV,MAAML,gBAAAA;EACf;AACA,MAAIQ,MAAMC,QAAQJ,KAAAA,EAAQ,QAAOA,MAAMK,IAAImB,mBAAAA;AAC3C,MAAIxB,SAAS,OAAOA,UAAU,UAAU;AACtC,WAAOQ,OAAOK,YACZL,OAAOD,QAAQP,KAAAA,EAAOK,IAAI,CAAC,CAACI,KAAKC,WAAAA,MAAiB;MAACD;MAAKe,oBAAoBd,WAAAA;KAAa,CAAA;EAE7F;AAEA,SAAOV;AACT,GA/B4B;AAiC5B,IAAMyB,iBAAiB,wBAACP,aAAAA;AACtB,MAAIA,aAAa,KAAM,QAAOjB;AAC9B,SAAOuB,oBAAoBN,QAAAA;AAC7B,GAHuB;AAKhB,IAAMQ,SAAS,wBAACC,YAAwC;EAC7DC,IAAID,OAAOC;EACXnB,KAAKkB,OAAOlB;EACZoB,UAAUF,OAAOE;EACjBC,aAAaH,OAAOG,aAAazB,IAAI,CAACO,UAAUA,MAAMmB,WAAWtB,GAAG,EAAEuB,KAAAA,KAAU,CAAA;EAChF,GAAIL,OAAOX,SAAS,OAAO;IAAEA,MAAMW,OAAOX;EAAK,IAAI,CAAC;EACpD,GAAIW,OAAOZ,gBAAgB,OAAO;IAAEA,aAAaY,OAAOZ;EAAY,IAAI,CAAC;EACzEkB,UAAUN,OAAOM;AACnB,IARsB;AAUf,IAAMC,YAAY,wBAACP,WAAAA;AACxB,QAAMQ,UAA2B;IAC/BP,IAAID,OAAOC;IACXC,UAAUF,OAAOE;IACjBO,aAAaT,OAAOS;IACpBC,WAAWV,OAAOU;IAClBC,QAAQX,OAAOW;IACfC,cAAcZ,OAAOY;IACrBC,YAAYb,OAAOa;IACnBC,WAAW7C,UAAU+B,OAAOc,SAAS;IACrCC,WAAW9C,UAAU+B,OAAOe,SAAS;EACvC;AACA,QAAMxB,WAAWO,eAAeE,OAAOT,QAAQ;AAE/C,MAAIA,aAAajB,OAAWkC,SAAQjB,WAAWA;AAC/C,SAAOiB;AACT,GAhByB;AAkBlB,IAAMQ,kBAAkB,wBAACR,aAA8D;EAC5FS,SAAST,QAAQU,KAAKpC;EACtB6B,QAAQH,QAAQG;EAChBQ,WAAWX,QAAQP;EACnBC,UAAUM,QAAQN;EAClBU,cAAcJ,QAAQI;EACtBC,YAAYL,QAAQK;EACpBC,WAAW7C,UAAUuC,QAAQM,SAAS;AACxC,IAR+B;;;ACzK/B,yBAA2B;AAGpB,IAAMM,kBAAkB,wBAACC,WAA2B,GAAGA,MAAAA,QAAUC,+BAAAA,CAAAA,IAAzC;AAExB,IAAMC,kBAAkB,wBAACC,SAA8BC,QAC5DD,QAAQE,cAAc,SACrBF,QAAQG,cAAc,QAAQH,QAAQG,UAAUC,QAAO,KAAMH,IAAIG,QAAO,IAF5C;AAIxB,IAAMC,WAAW,wBAACC,MAAmBC,UAC1CD,SAAS,OAAOC,UAAU,OAAOA,UAAU,QAAQD,KAAKF,QAAO,MAAOG,MAAMH,QAAO,GAD7D;AAGxB,IAAMI,WAAW,wBAACC,UAChB,OAAOA,UAAU,YAAYA,UAAU,MADxB;AAGV,IAAMC,gCAAgC,wBAACC,UAC5CH,SAASG,KAAAA,KAAUA,MAAMC,SAAS,SADS;AAGtC,IAAMC,gBAAgB,wBAACJ,UAC5BD,SAASC,KAAAA,KAAU,OAAOA,MAAMK,UAAU,WAAWL,MAAMK,QAAQ,GADxC;;;ACJtB,IAAMC,oBAAoB,wBAACC,aAChCC,qBAAqBD,QAAAA,KAAa,MADH;AAG1B,IAAME,8BAA8B,wBAACC,UAC1C,YAAYA,QACR;EACE,GAAGA;EACHC,QAAQC,uBAAuBF,MAAMC,QAAQ,QAAA;EAC7C,GAAID,MAAMH,aAAaM,SAAY;IAAEN,UAAUC,qBAAqBE,MAAMH,QAAQ;EAAE,IAAI,CAAC;EACzF,GAAIG,MAAMI,QAAQD,SAAY;IAAEC,KAAKF,uBAAuBF,MAAMI,KAAK,UAAA;EAAY,IAAI,CAAC;EACxF,GAAIJ,MAAMK,gBAAgBF,SACtB;IAAEE,aAAaC,qBAAqBN,MAAMK,WAAW;EAAE,IACvD,CAAC;AACP,IACA;EACE,GAAGL;EACHH,UAAUC,qBAAqBE,MAAMH,QAAQ;EAC7CO,KAAKF,uBAAuBF,MAAMI,KAAK,UAAA;EACvCC,aAAaC,qBAAqBN,MAAMK,WAAW;AACrD,GAhBqC;AAkBpC,IAAME,0BAA0B,wBAACP,WAA2D;EACjG,GAAGA;EACHH,UAAUC,qBAAqBE,MAAMH,QAAQ;EAC7CW,SAASC,oBAAoBT,MAAMQ,OAAO;EAC1CP,QAAQC,uBAAuBF,MAAMC,QAAQ,QAAA;EAC7C,GAAID,MAAMU,aAAaP,SAAY;IAAEO,UAAUC,qBAAqBX,MAAMU,QAAQ;EAAE,IAAI,CAAC;AAC3F,IANuC;AAQhC,IAAME,YAAY,wBACvBf,UACAO,SAC8C;EAAEP;EAAUO;AAAI,IAHvC;AAKzB,IAAMS,kBAAkB,wBAACC,QAA0BT,gBAAAA;AACjD,QAAMU,SAASD,OAAOT,aAAaW,IAAI,CAACC,UAAUA,MAAMC,WAAWd,GAAG,EAAEe,KAAAA,KAAU,CAAA;AAClF,QAAMC,YAAY;OAAIf;IAAac,KAAI;AAEvC,SACEJ,OAAOM,WAAWD,UAAUC,UAAUN,OAAOO,MAAM,CAACC,OAAOC,UAAUD,UAAUH,UAAUI,KAAAA,CAAM;AAEnG,GAPwB;AASjB,IAAMC,yBAAyB,wBACpCX,QACAd,UAAAA;AAEA,MAAIA,MAAMI,QAAQD,UAAaH,MAAMI,QAAQU,OAAOV,IAAK,QAAO;AAChE,MAAIJ,MAAMH,aAAaM,UAAaP,kBAAkBI,MAAMH,QAAQ,MAAMiB,OAAOjB,UAAU;AACzF,WAAO;EACT;AACA,MAAIG,MAAM0B,SAASvB,UAAaH,MAAM0B,SAASZ,OAAOY,KAAM,QAAO;AACnE,MAAI1B,MAAM2B,gBAAgBxB,UAAaH,MAAM2B,gBAAgBb,OAAOa,YAAa,QAAO;AACxF,MAAI3B,MAAM4B,aAAazB,UAAaH,MAAM4B,aAAad,OAAOc,SAAU,QAAO;AAE/E,SAAO5B,MAAMK,gBAAgBF,UAAa,CAACU,gBAAgBC,QAAQd,MAAMK,WAAW;AACtF,GAbsC;AAe/B,IAAMwB,wBAAwB,wBACnC7B,OACA8B,QAAAA;AAEA,QAAMtB,UAAUC,oBAAoBT,MAAMQ,OAAO;AACjD,QAAMX,WAAWD,kBAAkBI,MAAMH,QAAQ;AACjD,QAAMa,WAAWV,MAAMU,WAAWC,qBAAqBX,MAAMU,QAAQ,IAAIP;AACzE,QAAM4B,iBAAiBrB,WACnB;IACEsB,IAAI;MACF;QAAEC,cAAc;QAAMC,YAAY;MAAK;MACvC;QAAED,cAAcvB,SAASyB;QAAMD,YAAYxB,SAAS0B;MAAG;;EAE3D,IACA;IAAEH,cAAc;IAAMC,YAAY;EAAK;AAE3C,SAAO;IACLG,aAAa7B,QAAQ2B;IACrBG,WAAW9B,QAAQ4B;IACnBvC;IACA0C,WAAW;IACXC,MAAM;MAAE3C;IAAS;IACjB4C,KAAK;MAAC;QAAET,IAAI;UAAC;YAAEU,WAAW;UAAK;UAAG;YAAEA,WAAW;cAAEC,KAAKb;YAAI;UAAE;;MAAG;MAAGC;;EACpE;AACF,GAxBqC;;;ARK9B,IAAMa,oBAAN,MAAMA;EA7Eb,OA6EaA;;;;EACX,YAA6BC,QAA8B;SAA9BA,SAAAA;EAA+B;EAEnDC,kBAAiD;IACxDC,YAAY,wBAACC,UACX,KAAKC,oBAAoBC,4BAA4BF,KAAAA,GAAQ,OAAO,IAAA,GAD1D;IAEZG,YAAY,wBAACH,UACX,KAAKC,oBAAoBC,4BAA4BF,KAAAA,GAAQ,OAAO,KAAA,GAD1D;IAEZI,YAAY,wBAACJ,UAA2B,KAAKK,qBAAqBL,KAAAA,GAAtD;IACZM,iBAAiB,wBAACN,UAAgC,KAAKO,0BAA0BP,OAAO,KAAA,GAAvE;IACjBQ,kBAAkB,wBAACR,UAAiC,KAAKS,2BAA2BT,KAAAA,GAAlE;IAClBU,YAAY,wBAACV,UACX,KAAKW,oBAAoBC,wBAAwBZ,KAAAA,GAAQ,KAAA,GAD/C;IAEZa,YAAY,wBAACb,UAAkC,KAAKc,qBAAqBd,KAAAA,GAA7D;EACd;EAEA,MAAMe,SAASf,OAAgD;AAC7D,UAAMgB,MAAMC,uBAAuBjB,MAAMgB,KAAK,UAAA;AAC9C,UAAME,OAAQ,MAAM,KAAKrB,OAAOsB,SAASC,UAAU;MACjDC,OAAOC,UAAUC,kBAAkBvB,MAAMwB,QAAQ,GAAGR,GAAAA;MACpDS,SAAS;QAAEC,aAAa;UAAED,SAAS;YAAEE,YAAY;UAAK;QAAE;MAAE;IAC5D,CAAA;AAEA,WAAOT,OAAOU,OAAOV,IAAAA,IAAQ;EAC/B;EAEA,MAAMW,aAAa7B,OAAoD;AACrE,UAAM8B,SAASb,uBAAuBjB,MAAM8B,QAAQ,QAAA;AACpD,UAAMZ,OAAQ,MAAM,KAAKrB,OAAOsB,SAASC,UAAU;MACjDC,OAAO;QAAEU,IAAID;MAAO;MACpBL,SAAS;QAAEC,aAAa;UAAED,SAAS;YAAEE,YAAY;UAAK;QAAE;MAAE;IAC5D,CAAA;AAEA,WAAOT,OAAOU,OAAOV,IAAAA,IAAQ;EAC/B;EAEA,MAAMc,UAAUhC,OAA4C;AAC1D,UAAMiC,QAAS,MAAM,KAAKpC,OAAOsB,SAASe,SAAS;MACjDb,OACErB,MAAMwB,aAAaW,SAAYA,SAAY;QAAEX,UAAUD,kBAAkBvB,MAAMwB,QAAQ;MAAE;MAC3FC,SAAS;QAAEC,aAAa;UAAED,SAAS;YAAEE,YAAY;UAAK;QAAE;MAAE;MAC1DS,SAAS;QAAC;UAAEZ,UAAU;QAAM;QAAG;UAAER,KAAK;QAAM;;IAC9C,CAAA;AAEA,WAAOiB,MAAMI,IAAIT,MAAAA;EACnB;EAEA,MAAMU,WAAWtC,OAA2C;AAC1D,UAAMuC,SAAS,MAAM,KAAKtC,oBAAoBC,4BAA4BF,KAAAA,GAAQ,OAAO,IAAA;AACzF,QAAIuC,OAAOC,MAAO,QAAOD,OAAOC;AAEhC,UAAM,IAAIC,gBAAgB;MACxBC,WAAW;MACXC,QAAQJ,OAAOI,UAAU;IAC3B,CAAA;EACF;EAEA,MAAc1C,oBACZD,OACA4C,SACAC,0BACuC;AACvC,QAAI;AACF,aAAO,MAAM,KAAKhD,OAAOiD,aAAa,OAAOC,OAAAA;AAC3C,cAAMC,oBAAoB,YAAYhD;AACtC,cAAMiD,iBAAiBD,oBAAoBhD,MAAM8B,SAASK;AAC1D,YAAIe;AAEJ,YAAIF,mBAAmB;AACrBE,qBAAY,MAAMH,GAAG5B,SAASC,UAAU;YACtCC,OAAO;cAAEU,IAAIkB;YAAe;YAC5BxB,SAAS;cAAEC,aAAa;gBAAED,SAAS;kBAAEE,YAAY;gBAAK;cAAE;YAAE;UAC5D,CAAA;QACF,OAAO;AACLuB,qBAAY,MAAMH,GAAG5B,SAASC,UAAU;YACtCC,OAAOC,UAAUC,kBAAkBvB,MAAMwB,QAAQ,GAAGxB,MAAMgB,GAAG;YAC7DS,SAAS;cAAEC,aAAa;gBAAED,SAAS;kBAAEE,YAAY;gBAAK;cAAE;YAAE;UAC5D,CAAA;QACF;AAEA,YAAIqB,qBAAqB,CAACE,YAAY,CAACL,0BAA0B;AAC/D,iBAAO;YAAEM,SAAS;YAAYR,QAAQ;UAAiB;QACzD;AAEA,YAAIO,YAAY,CAACE,uBAAuBF,UAAUlD,KAAAA,GAAQ;AACxD,iBAAO;YAAEmD,SAAS;YAASX,OAAOZ,OAAOsB,QAAAA;UAAU;QACrD;AAEA,cAAMnB,KAAKmB,UAAUnB,MAAMkB,kBAAkBI,gBAAgB,MAAA;AAC7D,cAAMrC,MAAMhB,MAAMgB,OAAOkC,UAAUlC,OAAOe;AAC1C,cAAMP,WACJxB,MAAMwB,aAAaW,SACfZ,kBAAkBvB,MAAMwB,QAAQ,IAC/B0B,UAAU1B,YAAY;AAE7B,YAAIwB,mBAAmB;AACrB,gBAAM,KAAKM,oBAAoBP,IAAIhB,IAAIP,UAAUR,GAAAA;QACnD;AAEA,cAAME,OAAQ,MAAM6B,GAAG5B,SAASoC,OAAO;UACrClC,OAAO;YAAEU;UAAG;UACZyB,QAAQ;YACNzB;YACAf;YACAQ;YACAiC,MAAMzD,MAAMyD;YACZC,aAAa1D,MAAM0D;YACnBC,UAAU3D,MAAM2D,YAAY;UAC9B;UACAC,QAAQ;YACN5C;YACA,GAAIhB,MAAMwB,aAAaW,SAAY;cAAEX;YAAS,IAAI,CAAC;YACnD,GAAIxB,MAAMyD,SAAStB,SAAY;cAAEsB,MAAMzD,MAAMyD;YAAK,IAAI,CAAC;YACvD,GAAIzD,MAAM0D,gBAAgBvB,SAAY;cAAEuB,aAAa1D,MAAM0D;YAAY,IAAI,CAAC;YAC5E,GAAI1D,MAAM2D,aAAaxB,SAAY;cAAEwB,UAAU3D,MAAM2D;YAAS,IAAI,CAAC;UACrE;QACF,CAAA;AAEA,YAAI3D,MAAM0B,gBAAgBS,QAAW;AACnC,gBAAM,KAAK0B,uBAAuBd,IAAI7B,KAAKa,IAAI/B,MAAM0B,WAAW;QAClE;AAEA,cAAMoC,WAAY,MAAMf,GAAG5B,SAASC,UAAU;UAC5CC,OAAO;YAAEU,IAAIb,KAAKa;UAAG;UACrBN,SAAS;YAAEC,aAAa;cAAED,SAAS;gBAAEE,YAAY;cAAK;YAAE;UAAE;QAC5D,CAAA;AAEA,YAAI,CAACmC,UAAU;AACb,gBAAM,IAAIrB,gBAAgB;YACxBC,WAAW;YACXC,QAAQ;YACRb,QAAQZ,KAAKa;UACf,CAAA;QACF;AAEA,eAAO;UAAEoB,SAASD,WAAW,YAAY;UAAWV,OAAOZ,OAAOkC,QAAAA;QAAU;MAC9E,CAAA;IACF,SAASC,OAAO;AACd,UAAI,CAACnB,WAAWoB,8BAA8BD,KAAAA,GAAQ;AACpD,eAAO,KAAK9D,oBAAoBD,OAAO,MAAM6C,wBAAAA;MAC/C;AAEA,YAAMkB;IACR;EACF;EAEA,MAAM3D,WAAWJ,OAAuC;AACtD,UAAM,KAAKK,qBAAqBL,KAAAA;EAClC;EAEA,MAAcK,qBAAqBL,OAAqD;AACtF,UAAM8B,SAASb,uBAAuBjB,MAAM8B,QAAQ,QAAA;AACpD,UAAMmC,UAAU,MAAM,KAAKpE,OAAOsB,SAAS+C,WAAW;MAAE7C,OAAO;QAAEU,IAAID;MAAO;IAAE,CAAA;AAE9E,WAAO;MAAEqB,SAASgB,cAAcF,OAAAA,IAAW,IAAI,YAAY;IAAQ;EACrE;EAEA,MAAM3D,gBAAgBN,OAA4C;AAChE,UAAM,KAAKO,0BAA0BP,OAAO,KAAA;EAC9C;EAEA,MAAcO,0BACZP,OACA4C,SAC6B;AAC7B,UAAMd,SAASb,uBAAuBjB,MAAM8B,QAAQ,QAAA;AACpD,UAAMH,aAAayC,oBAAoBpE,MAAM2B,UAAU;AAEvD,QAAI;AACF,aAAO,MAAM,KAAK9B,OAAOiD,aAAa,OAAOC,OAAAA;AAC3C,cAAM7B,OAAQ,MAAM6B,GAAG5B,SAASC,UAAU;UACxCC,OAAO;YAAEU,IAAID;UAAO;QACtB,CAAA;AACA,YAAI,CAACZ,KAAM,QAAO;UAAEiC,SAAS;UAAYR,QAAQ;QAAiB;AAElE,cAAM0B,mBAAoB,MAAMtB,GAAGuB,eAAef,OAAO;UACvDlC,OAAO;YAAEL,KAAKW;UAAW;UACzB6B,QAAQ;YAAEzB,IAAIsB,gBAAgB,YAAA;YAAerC,KAAKW;UAAW;UAC7DiC,QAAQ,CAAC;QACX,CAAA;AACA,cAAMV,WAAW,MAAMH,GAAGwB,mBAAmBnD,UAAU;UACrDC,OAAO;YAAES;YAAQ0C,cAAcH,iBAAiBtC;UAAG;QACrD,CAAA;AACA,YAAImB,SAAU,QAAO;UAAEC,SAAS;QAAQ;AAExC,cAAMJ,GAAGwB,mBAAmBf,OAAO;UACjCiB,MAAM;YAAE3C;YAAQ0C,cAAcH,iBAAiBtC;UAAG;QACpD,CAAA;AAEA,eAAO;UAAEoB,SAAS;QAAU;MAC9B,CAAA;IACF,SAASY,OAAO;AACd,UAAI,CAACnB,WAAWoB,8BAA8BD,KAAAA,GAAQ;AACpD,eAAO,KAAKxD,0BAA0B;UAAEuB;UAAQH;QAAW,GAAG,IAAA;MAChE;AAEA,YAAMoC;IACR;EACF;EAEA,MAAMvD,iBAAiBR,OAA6C;AAClE,UAAM,KAAKS,2BAA2BT,KAAAA;EACxC;EAEA,MAAcS,2BACZT,OAC6B;AAC7B,UAAM8B,SAASb,uBAAuBjB,MAAM8B,QAAQ,QAAA;AACpD,UAAMH,aAAayC,oBAAoBpE,MAAM2B,UAAU;AACvD,WAAO,KAAK9B,OAAOiD,aAAa,OAAOC,OAAAA;AACrC,YAAM7B,OAAO,MAAM6B,GAAG5B,SAASC,UAAU;QAAEC,OAAO;UAAEU,IAAID;QAAO;MAAE,CAAA;AACjE,UAAI,CAACZ,KAAM,QAAO;QAAEiC,SAAS;QAAYR,QAAQ;MAAiB;AAElE,YAAM0B,mBAAoB,MAAMtB,GAAGuB,eAAelD,UAAU;QAC1DC,OAAO;UAAEL,KAAKW;QAAW;MAC3B,CAAA;AACA,UAAI,CAAC0C,iBAAkB,QAAO;QAAElB,SAAS;MAAQ;AAEjD,YAAMc,UAAU,MAAMlB,GAAGwB,mBAAmBL,WAAW;QACrD7C,OAAO;UAAES;UAAQ0C,cAAcH,iBAAiBtC;QAAG;MACrD,CAAA;AAEA,aAAO;QAAEoB,SAASgB,cAAcF,OAAAA,IAAW,IAAI,YAAY;MAAQ;IACrE,CAAA;EACF;EAEA,MAAMS,oBAAoB1E,OAAoD;AAC5E,UAAM8B,SAASb,uBAAuBjB,MAAM8B,QAAQ,QAAA;AACpD,UAAM6C,QAAS,MAAM,KAAK9E,OAAO0E,mBAAmBrC,SAAS;MAC3Db,OAAO;QAAES;MAAO;MAChBL,SAAS;QAAEE,YAAY;MAAK;MAC5BS,SAAS;QAAET,YAAY;UAAEX,KAAK;QAAM;MAAE;IACxC,CAAA;AAEA,WAAO2D,MAAMtC,IAAI,CAACuC,SAASA,KAAKjD,WAAWX,GAAG;EAChD;EAEA,MAAMN,WAAWV,OAAyD;AACxE,UAAMuC,SAAS,MAAM,KAAK5B,oBAAoBC,wBAAwBZ,KAAAA,GAAQ,KAAA;AAC9E,QAAIuC,OAAOC,MAAO,QAAOD,OAAOC;AAEhC,UAAM,IAAIC,gBAAgB;MACxBC,WAAW;MACXC,QAAQJ,OAAOI,UAAU;IAC3B,CAAA;EACF;EAEA,MAAchC,oBACZX,OACA4C,SAC8C;AAC9C,UAAMpB,WAAWD,kBAAkBvB,MAAMwB,QAAQ;AACjD,UAAMqD,eAAe7E,MAAM8E,UAAUC,QAAQ;AAC7C,UAAMC,aAAahF,MAAM8E,UAAU/C,MAAM;AACzC,UAAMkD,YAAYC,UAAUlF,MAAMiF,SAAS;AAC3C,UAAME,kBAAkBC,eAAepF,MAAMqF,QAAQ;AACrD,UAAMC,MAAM,oBAAIC,KAAAA;AAEhB,QAAI;AACF,aAAO,MAAM,KAAK1F,OAAOiD,aAAa,OAAOC,OAAAA;AAC3C,cAAM7B,OAAO,MAAM6B,GAAG5B,SAASC,UAAU;UAAEC,OAAO;YAAEU,IAAI/B,MAAM8B;UAAO;QAAE,CAAA;AACvE,YAAI,CAACZ,KAAM,QAAO;UAAEiC,SAAS;UAAYR,QAAQ;QAAiB;AAElE,cAAMO,WAAY,MAAMH,GAAGyC,gBAAgBpE,UAAU;UACnDC,OAAO;YACLG;YACAiE,aAAazF,MAAM0F,QAAQX;YAC3BY,WAAW3F,MAAM0F,QAAQ3D;YACzBD,QAAQ9B,MAAM8B;YACd+C;YACAG;YACAY,WAAW;UACb;QACF,CAAA;AAEA,YAAI1C,UAAU;AACZ,cAAI2C,gBAAgB3C,UAAUoC,GAAAA,GAAM;AAClC,mBAAO;cAAEnC,SAAS;cAASX,OAAOsD,UAAU5C,QAAAA;YAAU;UACxD;AACA,cACE6C,SAAS7C,SAAS+B,WAAWA,SAAAA,SAC7Be,oCAAkB9C,SAASmC,UAAUF,mBAAmB,IAAA,GACxD;AACA,mBAAO;cAAEhC,SAAS;cAASX,OAAOsD,UAAU5C,QAAAA;YAAU;UACxD;AAEA,gBAAM+C,cAAe,MAAMlD,GAAGyC,gBAAgB5B,OAAO;YACnDvC,OAAO;cAAEU,IAAImB,SAASnB;YAAG;YACzB0C,MAAM;cACJQ;cACAW,WAAW;cACXP,UAAUF,mBAAmB;YAC/B;UACF,CAAA;AAEA,iBAAO;YAAEhC,SAAS;YAAWX,OAAOsD,UAAUG,WAAAA;UAAa;QAC7D;AAEA,cAAMC,UAAW,MAAMnD,GAAGyC,gBAAgBhC,OAAO;UAC/CiB,MAAM;YACJ1C,IAAIsB,gBAAgB,SAAA;YACpB7B;YACAiE,aAAazF,MAAM0F,QAAQX;YAC3BY,WAAW3F,MAAM0F,QAAQ3D;YACzBD,QAAQ9B,MAAM8B;YACd+C;YACAG;YACAC;YACAW,WAAW;YACX,GAAIT,oBAAoBhD,SAAY;cAAEkD,UAAUF;YAAgB,IAAI,CAAC;UACvE;QACF,CAAA;AAEA,eAAO;UAAEhC,SAAS;UAAWX,OAAOsD,UAAUI,OAAAA;QAAS;MACzD,CAAA;IACF,SAASnC,OAAO;AACd,UAAI,CAACnB,WAAWoB,8BAA8BD,KAAAA,GAAQ;AACpD,eAAO,KAAKpD,oBAAoBX,OAAO,IAAA;MACzC;AAEA,YAAM+D;IACR;EACF;EAEA,MAAMlD,WAAWb,OAA8C;AAC7D,UAAM,KAAKc,qBAAqBd,KAAAA;EAClC;EAEA,MAAcc,qBAAqBd,OAA4D;AAC7F,UAAMmG,YAAYlF,uBAAuBjB,MAAMmG,WAAW,WAAA;AAC1D,UAAMP,YAAYV,UAAUlF,MAAM4F,SAAS,KAAK,oBAAIL,KAAAA;AACpD,QAAI,KAAK1F,OAAO2F,gBAAgBY,YAAY;AAC1C,YAAMC,UAAU,MAAM,KAAKxG,OAAO2F,gBAAgBY,WAAW;QAC3D/E,OAAO;UAAEU,IAAIoE;UAAWP,WAAW;QAAK;QACxCnB,MAAM;UAAEmB;QAAU;MACpB,CAAA;AAEA,aAAO;QAAEzC,SAASgB,cAAckC,OAAAA,IAAW,IAAI,YAAY;MAAQ;IACrE;AAEA,WAAO,KAAKxG,OAAOiD,aAAa,OAAOC,OAAAA;AACrC,YAAMG,WAAY,MAAMH,GAAGyC,gBAAgBpE,UAAU;QACnDC,OAAO;UAAEU,IAAIoE;QAAU;MACzB,CAAA;AACA,UAAI,CAACjD,YAAYA,SAAS0C,UAAW,QAAO;QAAEzC,SAAS;MAAQ;AAE/D,YAAMJ,GAAGyC,gBAAgB5B,OAAO;QAAEvC,OAAO;UAAEU,IAAIoE;QAAU;QAAG1B,MAAM;UAAEmB;QAAU;MAAE,CAAA;AAEhF,aAAO;QAAEzC,SAAS;MAAU;IAC9B,CAAA;EACF;EAEA,MAAMmD,aAAatG,OAA6D;AAC9E,UAAM0F,UAAUa,oBAAoBvG,MAAM0F,OAAO;AACjD,UAAMc,WAAY,MAAM,KAAK3G,OAAO2F,gBAAgBtD,SAAS;MAC3Db,OAAO;QACLoE,aAAaC,QAAQX;QACrBY,WAAWD,QAAQ3D;QACnB,GAAI/B,MAAMwB,aAAaW,SAAY;UAAEX,UAAUD,kBAAkBvB,MAAMwB,QAAQ;QAAE,IAAI,CAAC;MACxF;MACAY,SAAS;QAAEL,IAAI;MAAM;IACvB,CAAA;AAEA,WAAOyE,SAASnE,IAAIyD,SAAAA;EACtB;EAEA,MAAMW,mBAAmBzG,OAA8D;AACrF,UAAMsF,MAAMtF,MAAMsF,OAAO,oBAAIC,KAAAA;AAC7B,UAAMiB,WAAY,MAAM,KAAK3G,OAAO2F,gBAAgBtD,SAAS;MAC3Db,OAAOqF,sBAAsB1G,OAAOsF,GAAAA;MACpC7D,SAAS;QAAEP,MAAM;MAAK;MACtBkB,SAAS;QAAEL,IAAI;MAAM;IACvB,CAAA;AAEA,WAAOyE,SAASnE,IAAIsE,eAAAA;EACtB;EAEA,MAAMC,yBACJ5G,OACoC;AACpC,UAAMsF,MAAMtF,MAAMsF,OAAO,oBAAIC,KAAAA;AAC7B,UAAMiB,WAAY,MAAM,KAAK3G,OAAO2F,gBAAgBtD,SAAS;MAC3Db,OAAOqF,sBAAsB1G,OAAOsF,GAAAA;MACpC7D,SAAS;QACPP,MAAM;UACJO,SAAS;YACPC,aAAa;cACXD,SAAS;gBAAEE,YAAY;cAAK;YAC9B;UACF;QACF;MACF;MACAS,SAAS;QAAEL,IAAI;MAAM;IACvB,CAAA;AAEA,WAAOyE,SAASK,QAAQ,CAACX,aACtBA,QAAQhF,KAAKQ,eAAe,CAAA,GAAIW,IAAI,CAACuC,UAAU;MAC9C,GAAG+B,gBAAgBT,OAAAA;MACnBvE,YAAYiD,KAAKjD,WAAWX;IAC9B,EAAA,CAAA;EAEJ;EAEA,MAAc6C,uBACZd,IACAjB,QACAJ,aACe;AACf,UAAMqB,GAAGwB,mBAAmBL,WAAW;MAAE7C,OAAO;QAAES;MAAO;IAAE,CAAA;AAE3D,eAAWH,cAAcmF,qBAAqBpF,WAAAA,GAAc;AAC1D,YAAM2C,mBAAoB,MAAMtB,GAAGuB,eAAef,OAAO;QACvDlC,OAAO;UAAEL,KAAKW;QAAW;QACzB6B,QAAQ;UAAEzB,IAAIsB,gBAAgB,YAAA;UAAerC,KAAKW;QAAW;QAC7DiC,QAAQ,CAAC;MACX,CAAA;AAEA,YAAMb,GAAGwB,mBAAmBhB,OAAO;QACjClC,OAAO;UACL0F,qBAAqB;YAAEjF;YAAQ0C,cAAcH,iBAAiBtC;UAAG;QACnE;QACAyB,QAAQ;UAAE1B;UAAQ0C,cAAcH,iBAAiBtC;QAAG;QACpD6B,QAAQ,CAAC;MACX,CAAA;IACF;EACF;EAEA,MAAcN,oBACZP,IACAjB,QACAN,UACAR,KACe;AACf,UAAMgG,kBAAmB,MAAMjE,GAAG5B,SAASC,UAAU;MACnDC,OAAO;QACL,GAAGC,UAAUE,UAAUR,GAAAA;QACvBiG,KAAK;UAAElF,IAAID;QAAO;MACpB;IACF,CAAA;AAEA,QAAI,CAACkF,gBAAiB;AAEtB,UAAM,IAAIvE,gBAAgB;MACxBC,WAAW;MACXC,QAAQ;MACRnB;MACAR;MACAc;MACAoF,mBAAmBF,gBAAgBjF;IACrC,CAAA;EACF;AACF;","names":["RbacError","Error","message","code","status","options","cause","name","details","undefined","RbacConfigError","assertNonEmptyString","value","name","trim","Error","PERMISSION_RE","normalizePermission","permission","normalized","trim","test","Error","normalizePermissions","permissions","Set","map","canonicalizeIdentifier","value","name","assertNonEmptyString","canonicalizeTenantId","tenantId","name","canonicalizeIdentifier","canonicalizeSubject","subject","isApiKey","type","id","preserveOpaqueIdentifier","undefined","canonicalizeResource","resource","value","assertNonEmptyString","metadataTypeKey","metadataValueKey","cloneDate","date","Date","encodeMetadataValue","value","undefined","toISOString","Array","isArray","map","item","entries","Object","key","nestedValue","filter","entry","fromEntries","toString","description","name","encodeMetadata","metadata","isEncodedMetadataValue","candidate","type","keys","length","decodeMetadataValue","decodeMetadata","toRole","record","id","tenantId","permissions","permission","sort","isSystem","toBinding","binding","subjectType","subjectId","roleId","resourceType","resourceId","expiresAt","revokedAt","toEffectiveRole","roleKey","role","bindingId","newPrismaRbacId","prefix","randomUUID","isActiveBinding","binding","now","revokedAt","expiresAt","getTime","sameDate","left","right","isRecord","value","isPrismaUniqueConstraintError","error","code","mutationCount","count","normalizeTenantId","tenantId","canonicalizeTenantId","canonicalizeUpsertRoleInput","input","roleId","canonicalizeIdentifier","undefined","key","permissions","normalizePermissions","canonicalizeAssignInput","subject","canonicalizeSubject","resource","canonicalizeResource","roleWhere","samePermissions","record","stored","map","entry","permission","sort","requested","length","every","value","index","roleInputChangesRecord","name","description","isSystem","effectiveBindingWhere","now","resourceFilter","OR","resourceType","resourceId","type","id","subjectType","subjectId","revokedAt","role","AND","expiresAt","gte","PrismaRbacStorage","prisma","mutationResults","createRole","input","upsertRoleWithRetry","canonicalizeUpsertRoleInput","updateRole","deleteRole","deleteRoleWithResult","grantPermission","grantPermissionWithResult","revokePermission","revokePermissionWithResult","assignRole","assignRoleWithRetry","canonicalizeAssignInput","revokeRole","revokeRoleWithResult","findRole","key","canonicalizeIdentifier","role","rbacRole","findFirst","where","roleWhere","normalizeTenantId","tenantId","include","permissions","permission","toRole","findRoleById","roleId","id","listRoles","roles","findMany","undefined","orderBy","map","upsertRole","result","value","RbacConfigError","operation","reason","retried","allowMissingExplicitRole","$transaction","tx","hasExplicitRoleId","explicitRoleId","existing","outcome","roleInputChangesRecord","newPrismaRbacId","assertUniqueRoleKey","upsert","create","name","description","isSystem","update","replaceRolePermissions","reloaded","error","isPrismaUniqueConstraintError","deleted","deleteMany","mutationCount","normalizePermission","permissionRecord","rbacPermission","rbacRolePermission","permissionId","data","listRolePermissions","links","link","resourceType","resource","type","resourceId","expiresAt","cloneDate","encodedMetadata","encodeMetadata","metadata","now","Date","rbacRoleBinding","subjectType","subject","subjectId","revokedAt","isActiveBinding","toBinding","sameDate","isDeepStrictEqual","reactivated","binding","bindingId","updateMany","updated","listBindings","canonicalizeSubject","bindings","listEffectiveRoles","effectiveBindingWhere","toEffectiveRole","listEffectivePermissions","flatMap","normalizePermissions","roleId_permissionId","conflictingRole","NOT","conflictingRoleId"]}