@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/pages/index.js

@@ -0,0 +1,119 @@
+/**
+ * Page-document routes (08-server-api.md §2.6, 04-widget-registry.md §6.3):
+ *
+ *   GET   /api/v1/pages/:pageId         → { data: <page envelope> }
+ *   PATCH /api/v1/pages/:pageId/layout  → write the SHARED default layout
+ *
+ * The dashboard's PageRenderer fetches the stored envelope by the id it got
+ * from the bootstrap nav tree and runs client-side config migrations
+ * (09-generated-app.md §2.3/§3). On read the server resolves `config.layout`:
+ * a per-user override (an `adminium_views` row, `kind: 'layout'`) wins over the
+ * shared `adminium_pages` default; otherwise the envelope is returned verbatim.
+ *
+ * The GET is gated on page-VIEW permission (`page:<pageId>:view`, the same
+ * grant the bootstrap nav filter applies). The PATCH writes the shared default
+ * (the layout every viewer sees) and is gated on page-EDIT permission
+ * (`page:<pageId>:edit`; super-admins bypass both) and audited. Per-user
+ * overrides live on the sibling `me/views` route — any user with page-view
+ * access may save their own without the edit grant.
+ */
+import { pagesRepo, viewsRepo } from '@adminium/meta';
+import { ForbiddenError, NotFoundError } from '../../errors.js';
+import { pageLayoutSchema } from './layout-schema.js';
+import { pageLayoutPatchBody, pageLayoutReply, pageParams, pageReply } from './schema.js';
+/** The acting session user id, or null for keyless/API-key principals. */
+function sessionUserId(request) {
+    if (request.apiKeyPrincipal !== null && request.apiKeyPrincipal !== undefined)
+        return null;
+    return request.user?.id ?? null;
+}
+export function pagesRoutes(deps) {
+    const pages = pagesRepo(deps.meta);
+    const views = viewsRepo(deps.meta);
+    return async (app) => {
+        app.get('/pages/:pageId', {
+            preHandler: app.requireAuth,
+            schema: {
+                params: pageParams,
+                response: { 200: pageReply },
+            },
+        }, async (request) => {
+            const page = await pages.findById(request.params.pageId);
+            if (page === null || !page.isEnabled) {
+                throw new NotFoundError(`page ${request.params.pageId} does not exist`);
+            }
+            // View gate (09 §2.1): the same `page:<id>:view` grant the bootstrap
+            // nav filter applies (super-admins bypass inside `request.can`). The
+            // `typeof` guard covers the rbac-less minimal read-only harness.
+            if (typeof request.can === 'function' && !(await request.can(`page:${page.id}:view`))) {
+                throw new ForbiddenError('You do not have permission to view this page.', 'PAGE_FORBIDDEN', { pageId: page.id });
+            }
+            // Per-page edit capability (§6.3): the SAME `page:<id>:edit` grant the
+            // PATCH is gated on (super-admins bypass). The dashboard builder uses
+            // this — never role slugs — to route edits to the shared default vs. a
+            // personal override, so it matches the server exactly. Guarded for the
+            // minimal read-only harness that mounts this route without rbacPlugin.
+            const canEditLayout = typeof request.can === 'function' ? await request.can(`page:${page.id}:edit`) : false;
+            // Layout resolution (§6.3): a per-user override wins over the shared
+            // default baked into the envelope's `config.layout`. Only applies when
+            // the caller is a session user and their override parses as a valid
+            // layout document; anything else falls back to the stored default.
+            const userId = sessionUserId(request);
+            if (userId !== null && typeof page.config === 'object' && page.config !== null) {
+                const override = await views.findLayoutOverride(page.id, userId);
+                if (override !== null) {
+                    const parsed = pageLayoutSchema.safeParse(override.config);
+                    if (parsed.success) {
+                        const envelope = page.config;
+                        const templateConfig = typeof envelope['config'] === 'object' && envelope['config'] !== null
+                            ? envelope['config']
+                            : {};
+                        // Staleness signal: the PUT stamped the shared document's
+                        // revision into the override; the default moving past it —
+                        // regeneration or a shared PATCH — means this caller keeps a
+                        // pre-change layout (after a schema-driven regeneration that is
+                        // per-widget WIDGET_DATA errors with no hint). Flag it so the
+                        // client can offer "Reset layout". Pre-stamp rows read as fresh.
+                        const authoredAt = override.config['pageRevision'];
+                        const layoutStale = typeof authoredAt === 'number' && authoredAt < page.revision;
+                        return {
+                            data: { ...envelope, config: { ...templateConfig, layout: parsed.data } },
+                            canEditLayout,
+                            ...(layoutStale ? { layoutStale: true } : {}),
+                        };
+                    }
+                }
+            }
+            return { data: page.config, canEditLayout };
+        });
+        app.patch('/pages/:pageId/layout', {
+            preHandler: app.requireAuth,
+            schema: {
+                params: pageParams,
+                body: pageLayoutPatchBody,
+                response: { 200: pageLayoutReply },
+            },
+        }, async (request) => {
+            const { pageId } = request.params;
+            const page = await pages.findById(pageId);
+            if (page === null || !page.isEnabled) {
+                throw new NotFoundError(`page ${pageId} does not exist`);
+            }
+            // Shared-default writes need page-EDIT (Admin+); super-admins bypass.
+            if (!(await request.can(`page:${pageId}:edit`))) {
+                throw new ForbiddenError('You do not have permission to edit this page.', 'PAGE_FORBIDDEN', { pageId });
+            }
+            const updated = await pages.setLayout(pageId, request.body, app.rbac.now());
+            if (updated === null) {
+                throw new NotFoundError(`page ${pageId} does not exist`);
+            }
+            await app.rbac.audit(request, {
+                category: 'data',
+                action: 'page.layout.update',
+                changes: { after: { pageId, items: request.body.items.length } },
+            });
+            return { data: { layout: request.body } };
+        });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/pages/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/pages/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAe,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM1F,0EAA0E;AAC1E,SAAS,aAAa,CAAC,OAAuB;IAC5C,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAQ,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CACL,gBAAgB,EAChB;YACE,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;aAC7B;SACF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,aAAa,CAAC,QAAQ,OAAO,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;YAC1E,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,cAAc,CACtB,+CAA+C,EAC/C,gBAAgB,EAChB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CACpB,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,aAAa,GACjB,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAExF,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAiC,CAAC;wBACxD,MAAM,cAAc,GAClB,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;4BACnE,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAA6B;4BACjD,CAAC,CAAC,EAAE,CAAC;wBACT,0DAA0D;wBAC1D,2DAA2D;wBAC3D,6DAA6D;wBAC7D,gEAAgE;wBAChE,8DAA8D;wBAC9D,iEAAiE;wBACjE,MAAM,UAAU,GAAI,QAAQ,CAAC,MAAkC,CAAC,cAAc,CAAC,CAAC;wBAChF,MAAM,WAAW,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC;wBACjF,OAAO;4BACL,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE;4BACzE,aAAa;4BACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC9C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,KAAK,CACP,uBAAuB,EACvB;YACE,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,MAAM,EAAE;gBACN,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;aACnC;SACF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,aAAa,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAC;YAC3D,CAAC;YAED,sEAAsE;YACtE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,cAAc,CACtB,+CAA+C,EAC/C,gBAAgB,EAChB,EAAE,MAAM,EAAE,CACX,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,aAAa,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,oBAAoB;gBAC5B,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE;aACjE,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/pages/layout-schema.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Server-side dashboard grid layout schema (04-widget-registry.md §6.1).
+ *
+ * The canonical `layoutItemSchema` / `pageLayoutSchema` Zod definitions live in
+ * the pure-Zod `@adminium/widgets/page-config` leaf (which `grid/layout-schema.ts`
+ * re-exports for the grid track). The server must NOT import the React
+ * `@adminium/widgets` package directly, so it consumes the SAME schema through
+ * the browser-safe `@adminium/engine/config` surface — which re-exports the
+ * page-config leaf verbatim (see engine `config-schema/index.ts`). Re-exporting
+ * it here keeps a stable `routes/pages/layout-schema` import point for the pages
+ * + me-views routes with ZERO second Zod definition to drift from.
+ *
+ * Half-unit height convention: an annex height of 1.5 rows persists as `h: 3`.
+ * `layoutItemSchema` = one placed widget instance; `pageLayoutSchema` = the
+ * whole `config.layout` document (max 60 items). Both the shared-default PATCH
+ * and the per-user override PUT validate their body against `pageLayoutSchema`.
+ */
+export { layoutItemSchema, pageLayoutSchema, type LayoutItem, type PageLayout, } from '@adminium/engine/config';
+//# sourceMappingURL=layout-schema.d.ts.map

package/dist/routes/pages/layout-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout-schema.d.ts","sourceRoot":"","sources":["../../../src/routes/pages/layout-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,yBAAyB,CAAC"}

package/dist/routes/pages/layout-schema.js

@@ -0,0 +1,19 @@
+/**
+ * Server-side dashboard grid layout schema (04-widget-registry.md §6.1).
+ *
+ * The canonical `layoutItemSchema` / `pageLayoutSchema` Zod definitions live in
+ * the pure-Zod `@adminium/widgets/page-config` leaf (which `grid/layout-schema.ts`
+ * re-exports for the grid track). The server must NOT import the React
+ * `@adminium/widgets` package directly, so it consumes the SAME schema through
+ * the browser-safe `@adminium/engine/config` surface — which re-exports the
+ * page-config leaf verbatim (see engine `config-schema/index.ts`). Re-exporting
+ * it here keeps a stable `routes/pages/layout-schema` import point for the pages
+ * + me-views routes with ZERO second Zod definition to drift from.
+ *
+ * Half-unit height convention: an annex height of 1.5 rows persists as `h: 3`.
+ * `layoutItemSchema` = one placed widget instance; `pageLayoutSchema` = the
+ * whole `config.layout` document (max 60 items). Both the shared-default PATCH
+ * and the per-user override PUT validate their body against `pageLayoutSchema`.
+ */
+export { layoutItemSchema, pageLayoutSchema, } from '@adminium/engine/config';
+//# sourceMappingURL=layout-schema.js.map

package/dist/routes/pages/layout-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout-schema.js","sourceRoot":"","sources":["../../../src/routes/pages/layout-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,yBAAyB,CAAC"}

package/dist/routes/pages/schema.d.ts

@@ -0,0 +1,52 @@
+/** Zod request/response schemas for `routes/pages/` (08-server-api.md §2.6). */
+import { z } from 'zod';
+export declare const pageParams: z.ZodObject<{
+    pageId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The stored envelope is returned verbatim (07-meta-store.md §3.17: the
+ * envelope persists into `adminium_pages.config` unchanged) — the client
+ * validates it against `pageEnvelopeSchema` after running config migrations,
+ * so the transport schema stays permissive by design (never-crash, 09 §3.1).
+ * On read the server resolves `config.layout` (per-user override wins over the
+ * shared default, 04-widget-registry.md §6.3) before returning it.
+ */
+export declare const pageReply: z.ZodObject<{
+    data: z.ZodUnknown;
+    canEditLayout: z.ZodBoolean;
+    layoutStale: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * `PATCH /pages/:pageId/layout` writes the SHARED default layout into
+ * `adminium_pages.config.layout`. Body is a full `pageLayout` document
+ * (04-widget-registry.md §6.1). Reply echoes the persisted layout.
+ */
+export declare const pageLayoutPatchBody: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    items: z.ZodArray<z.ZodObject<{
+        i: z.ZodString;
+        widget: z.ZodString;
+        x: z.ZodNumber;
+        y: z.ZodNumber;
+        w: z.ZodNumber;
+        h: z.ZodNumber;
+        config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const pageLayoutReply: z.ZodObject<{
+    data: z.ZodObject<{
+        layout: z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            items: z.ZodArray<z.ZodObject<{
+                i: z.ZodString;
+                widget: z.ZodString;
+                x: z.ZodNumber;
+                y: z.ZodNumber;
+                w: z.ZodNumber;
+                h: z.ZodNumber;
+                config: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/pages/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/pages/schema.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,UAAU;;iBAA0C,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS;;;;iBAcpB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAAmB,CAAC;AACpD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;iBAA6D,CAAC"}

package/dist/routes/pages/schema.js

@@ -0,0 +1,35 @@
+/** Zod request/response schemas for `routes/pages/` (08-server-api.md §2.6). */
+import { z } from 'zod';
+import { pageLayoutSchema } from './layout-schema.js';
+export const pageParams = z.object({ pageId: z.string().min(1) });
+/**
+ * The stored envelope is returned verbatim (07-meta-store.md §3.17: the
+ * envelope persists into `adminium_pages.config` unchanged) — the client
+ * validates it against `pageEnvelopeSchema` after running config migrations,
+ * so the transport schema stays permissive by design (never-crash, 09 §3.1).
+ * On read the server resolves `config.layout` (per-user override wins over the
+ * shared default, 04-widget-registry.md §6.3) before returning it.
+ */
+export const pageReply = z.object({
+    data: z.unknown(),
+    /** Whether the caller holds `page:<id>:edit` — the dashboard builder routes
+     *  edits to the shared default (true) vs. a personal override (false). */
+    canEditLayout: z.boolean(),
+    /**
+     * Present (true) only when the served layout is the caller's per-user
+     * override AND the shared document's revision moved past the one stamped on
+     * the override at PUT time — the page was regenerated (or its default
+     * re-edited) out from under the override. The client can offer "Reset
+     * layout" (DELETE /me/views/:pageId/layout) instead of leaving the user on
+     * silently dead bindings.
+     */
+    layoutStale: z.boolean().optional(),
+});
+/**
+ * `PATCH /pages/:pageId/layout` writes the SHARED default layout into
+ * `adminium_pages.config.layout`. Body is a full `pageLayout` document
+ * (04-widget-registry.md §6.1). Reply echoes the persisted layout.
+ */
+export const pageLayoutPatchBody = pageLayoutSchema;
+export const pageLayoutReply = z.object({ data: z.object({ layout: pageLayoutSchema }) });
+//# sourceMappingURL=schema.js.map

package/dist/routes/pages/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/pages/schema.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB;8EAC0E;IAC1E,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B;;;;;;;OAOG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/routes/roles/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Roles & permission-matrix routes (08-server-api.md §2.3, M2-T05/08-T08):
+ *
+ * - `GET /roles` (list + member counts), `POST /roles` (custom roles, with
+ *   optional clone), `PATCH /roles/:id`, `DELETE /roles/:id?reassignTo=`
+ * - `GET|PUT /roles/:id/permissions` — full-matrix replace in §5.1 grant
+ *   strings; the super-admin column is hard-locked (`designs/Roles
+ *   Permissions.dc.html`)
+ * - `POST /users/:id/roles`, `DELETE /users/:id/roles/:roleId` — assign /
+ *   unassign with the last-super-admin guard
+ *
+ * Built-ins cannot be renamed or deleted (409). Every mutation writes an
+ * `rbac`-category audit entry (dotted verb + resource — 07 §3.11 anatomy).
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+export declare const rolesRoutes: FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/roles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/roles/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAkDvE,eAAO,MAAM,WAAW,EAAE,qBA8QzB,CAAC"}

package/dist/routes/roles/index.js

@@ -0,0 +1,255 @@
+import { permissionsRepo, rolesRepo, usersRepo } from '@adminium/meta';
+import { ConflictError, NotFoundError, ValidationFailedError } from '../../errors.js';
+import { PERMISSIONS, grantsFromMatrixRows, matrixRowsFromGrants, } from '../../rbac/permissions.js';
+import { SUPER_ADMIN_SLUG } from '../../rbac/resolver.js';
+import { roleCreateBody, roleDeleteQuery, roleIdParams, roleListReply, roleOkReply, rolePatchBody, rolePermissionsPutBody, rolePermissionsReply, roleReply, userRoleDeleteParams, userRolesParams, userRolesPostBody, userRolesReply, } from './schema.js';
+function toDto(role) {
+    return {
+        id: role.id,
+        slug: role.slug,
+        name: role.name,
+        description: role.description,
+        isBuiltin: role.isBuiltin,
+        createdAt: role.createdAt,
+        updatedAt: role.updatedAt,
+    };
+}
+/** `Custom Support Role` → `custom-support-role` (slug column is str(40)). */
+function slugify(name) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 40)
+        .replace(/-+$/g, '');
+    return slug.length > 0 ? slug : 'role';
+}
+export const rolesRoutes = async (app) => {
+    const { meta } = app.rbac;
+    const roles = rolesRepo(meta);
+    const users = usersRepo(meta);
+    const permissions = permissionsRepo(meta);
+    async function mustFindRole(id) {
+        const role = await roles.findById(id);
+        if (role === null)
+            throw new NotFoundError('Role not found.', { roleId: id });
+        return role;
+    }
+    async function memberCountFor(roleId) {
+        const rows = await meta.db
+            .selectFrom('adminium_user_roles')
+            .select('userId')
+            .where('roleId', '=', roleId)
+            .execute();
+        return rows.length;
+    }
+    app.get('/roles', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: { response: { 200: roleListReply } },
+    }, async () => {
+        const [all, counts] = await Promise.all([
+            roles.list(),
+            meta.db
+                .selectFrom('adminium_user_roles')
+                .select(['roleId', (eb) => eb.fn.countAll().as('memberCount')])
+                .groupBy('roleId')
+                .execute(),
+        ]);
+        const countByRole = new Map(counts.map((row) => [row.roleId, Number(row.memberCount)]));
+        return {
+            roles: all.map((role) => ({ ...toDto(role), memberCount: countByRole.get(role.id) ?? 0 })),
+        };
+    });
+    app.post('/roles', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: { body: roleCreateBody, response: { 201: roleReply } },
+    }, async (request, reply) => {
+        const { name, description, cloneFromRoleId } = request.body;
+        const slug = slugify(name);
+        if ((await roles.findBySlug(slug)) !== null) {
+            throw new ConflictError(`A role with slug "${slug}" already exists.`, 'UNIQUE_VIOLATION', {
+                slug,
+            });
+        }
+        const source = cloneFromRoleId === undefined ? null : await mustFindRole(cloneFromRoleId);
+        const role = await roles.create({ slug, name, description: description ?? null }, app.rbac.now());
+        if (source !== null) {
+            for (const row of await permissions.listForRole(source.id)) {
+                await permissions.grant(role.id, row.resourceKind, row.resourceRef, row.actions);
+            }
+        }
+        await app.rbac.audit(request, {
+            category: 'rbac',
+            action: 'role.create',
+            changes: { after: { roleId: role.id, slug, name, clonedFrom: source?.id ?? null } },
+        });
+        return reply.status(201).send(toDto(role));
+    });
+    app.patch('/roles/:id', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: { params: roleIdParams, body: rolePatchBody, response: { 200: roleReply } },
+    }, async (request) => {
+        const role = await mustFindRole(request.params.id);
+        if (role.isBuiltin) {
+            throw new ConflictError('Built-in roles cannot be renamed or edited.', 'CONFLICT', {
+                slug: role.slug,
+            });
+        }
+        const patch = {};
+        if (request.body.name !== undefined)
+            patch.name = request.body.name;
+        if (request.body.description !== undefined)
+            patch.description = request.body.description;
+        await meta.db
+            .updateTable('adminium_roles')
+            .set({ ...patch, updatedAt: app.rbac.now() })
+            .where('id', '=', role.id)
+            .execute();
+        const updated = await mustFindRole(role.id);
+        await app.rbac.audit(request, {
+            category: 'rbac',
+            action: 'role.update',
+            changes: {
+                before: { name: role.name, description: role.description },
+                after: { name: updated.name, description: updated.description },
+            },
+        });
+        return toDto(updated);
+    });
+    app.delete('/roles/:id', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: { params: roleIdParams, querystring: roleDeleteQuery, response: { 200: roleOkReply } },
+    }, async (request) => {
+        const role = await mustFindRole(request.params.id);
+        if (role.isBuiltin) {
+            throw new ConflictError('Built-in roles cannot be deleted.', 'CONFLICT', { slug: role.slug });
+        }
+        const memberCount = await memberCountFor(role.id);
+        const { reassignTo } = request.query;
+        if (memberCount > 0 && reassignTo === undefined) {
+            throw new ConflictError('Role has members — pass ?reassignTo=<roleId> to move them first.', 'CONFLICT', { memberCount });
+        }
+        if (memberCount > 0 && reassignTo !== undefined) {
+            if (reassignTo === role.id) {
+                throw new ValidationFailedError('reassignTo must be a different role.', { reassignTo });
+            }
+            const target = await mustFindRole(reassignTo);
+            const members = await meta.db
+                .selectFrom('adminium_user_roles')
+                .select('userId')
+                .where('roleId', '=', role.id)
+                .execute();
+            for (const member of members) {
+                await roles.assignToUser(member.userId, target.id, null, app.rbac.now());
+            }
+            await meta.db.deleteFrom('adminium_user_roles').where('roleId', '=', role.id).execute();
+        }
+        // FK CASCADE removes the role's adminium_role_permissions rows.
+        await meta.db.deleteFrom('adminium_roles').where('id', '=', role.id).execute();
+        await app.rbac.audit(request, {
+            category: 'rbac',
+            action: 'role.delete',
+            changes: {
+                before: { roleId: role.id, slug: role.slug, name: role.name, memberCount },
+                after: { reassignedTo: memberCount > 0 ? (reassignTo ?? null) : null },
+            },
+        });
+        return { ok: true };
+    });
+    app.get('/roles/:id/permissions', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: { params: roleIdParams, response: { 200: rolePermissionsReply } },
+    }, async (request) => {
+        const role = await mustFindRole(request.params.id);
+        return { roleId: role.id, grants: grantsFromMatrixRows(await permissions.listForRole(role.id)) };
+    });
+    app.put('/roles/:id/permissions', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: {
+            params: roleIdParams,
+            body: rolePermissionsPutBody,
+            response: { 200: rolePermissionsReply },
+        },
+    }, async (request) => {
+        const role = await mustFindRole(request.params.id);
+        if (role.slug === SUPER_ADMIN_SLUG) {
+            // Hard-locked column per designs/Roles Permissions.dc.html / 07 §3.8.
+            throw new ConflictError('The Super Admin permission column is locked.', 'CONFLICT', {
+                slug: role.slug,
+            });
+        }
+        const { rows, invalid } = matrixRowsFromGrants(request.body.grants);
+        if (invalid.length > 0) {
+            throw new ValidationFailedError('One or more grants are outside the permission grammar.', {
+                invalidGrants: invalid,
+            });
+        }
+        const before = grantsFromMatrixRows(await permissions.listForRole(role.id));
+        await meta.db.deleteFrom('adminium_role_permissions').where('roleId', '=', role.id).execute();
+        for (const row of rows) {
+            await permissions.grant(role.id, row.resourceKind, row.resourceRef, row.actions);
+        }
+        const after = grantsFromMatrixRows(await permissions.listForRole(role.id));
+        await app.rbac.audit(request, {
+            category: 'rbac',
+            action: 'role.permission.change',
+            changes: { before: { grants: before }, after: { grants: after } },
+        });
+        return { roleId: role.id, grants: after };
+    });
+    // --- user-role assignment ----------------------------------------------------
+    app.post('/users/:id/roles', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: { params: userRolesParams, body: userRolesPostBody, response: { 200: userRolesReply } },
+    }, async (request) => {
+        const user = await users.findById(request.params.id);
+        if (user === null)
+            throw new NotFoundError('User not found.', { userId: request.params.id });
+        const role = await mustFindRole(request.body.roleId);
+        // granted_by is the acting *user* id when the actor is a session user.
+        const actingUserId = request.apiKeyPrincipal === null
+            ? (request.user?.id ?? null)
+            : null;
+        await roles.assignToUser(user.id, role.id, actingUserId, app.rbac.now());
+        const roleIds = (await roles.rolesForUser(user.id)).map((r) => r.id);
+        await app.rbac.audit(request, {
+            category: 'rbac',
+            action: 'user.role.assign',
+            changes: { after: { userId: user.id, roleId: role.id, roleSlug: role.slug } },
+        });
+        return { userId: user.id, roleIds };
+    });
+    app.delete('/users/:id/roles/:roleId', {
+        preHandler: app.rbac.require(PERMISSIONS.rolesManage),
+        schema: { params: userRoleDeleteParams, response: { 200: userRolesReply } },
+    }, async (request) => {
+        const user = await users.findById(request.params.id);
+        if (user === null)
+            throw new NotFoundError('User not found.', { userId: request.params.id });
+        const role = await mustFindRole(request.params.roleId);
+        if (role.slug === SUPER_ADMIN_SLUG) {
+            const holders = await memberCountFor(role.id);
+            const userHolds = (await roles.rolesForUser(user.id)).some((r) => r.id === role.id);
+            if (userHolds && holders <= 1) {
+                throw new ConflictError('Cannot remove the last Super Admin.', 'CONFLICT', {
+                    roleId: role.id,
+                });
+            }
+        }
+        const removed = await roles.removeFromUser(user.id, role.id);
+        if (!removed) {
+            throw new NotFoundError('The user does not hold this role.', {
+                userId: user.id,
+                roleId: role.id,
+            });
+        }
+        const roleIds = (await roles.rolesForUser(user.id)).map((r) => r.id);
+        await app.rbac.audit(request, {
+            category: 'rbac',
+            action: 'user.role.unassign',
+            changes: { before: { userId: user.id, roleId: role.id, roleSlug: role.slug } },
+        });
+        return { userId: user.id, roleIds };
+    });
+};
+//# sourceMappingURL=index.js.map

package/dist/routes/roles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/roles/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAa,MAAM,gBAAgB,CAAC;AAElF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,eAAe,EACf,YAAY,EACZ,aAAa,EACb,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,cAAc,GAEf,MAAM,aAAa,CAAC;AAErB,SAAS,KAAK,CAAC,IAAU;IACvB,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAA0B,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAE1C,KAAK,UAAU,YAAY,CAAC,EAAU;QACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAc;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,qBAAqB,CAAC;aACjC,MAAM,CAAC,QAAQ,CAAC;aAChB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAG,CACL,QAAQ,EACR;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE;KAC7C,EACD,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtC,KAAK,CAAC,IAAI,EAAE;YACZ,IAAI,CAAC,EAAE;iBACJ,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;iBAC9D,OAAO,CAAC,QAAQ,CAAC;iBACjB,OAAO,EAAE;SACb,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC3F,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;KAC/D,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,aAAa,CAAC,qBAAqB,IAAI,mBAAmB,EAAE,kBAAkB,EAAE;gBACxF,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAClG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,MAAM,GAAG,IAAI,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3D,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE;SACpF,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;KACpF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,6CAA6C,EAAE,UAAU,EAAE;gBACjF,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAmD,EAAE,CAAC;QACjE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACpE,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACzF,MAAM,IAAI,CAAC,EAAE;aACV,WAAW,CAAC,gBAAgB,CAAC;aAC7B,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;aACzB,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC1D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;aAChE;SACF,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,YAAY,EACZ;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE;KAC/F,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACrC,IAAI,WAAW,GAAG,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,aAAa,CACrB,kEAAkE,EAClE,UAAU,EACV,EAAE,WAAW,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,GAAG,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAChD,IAAI,UAAU,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC3B,MAAM,IAAI,qBAAqB,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC1B,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;iBAC7B,OAAO,EAAE,CAAC;YACb,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1F,CAAC;QACD,gEAAgE;QAChE,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/E,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE;gBAC1E,KAAK,EAAE,EAAE,YAAY,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;aACvE;SACF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;IAC/B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE;KAC1E,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,oBAAoB,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACnG,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE;YACN,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE;SACxC;KACF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACnC,sEAAsE;YACtE,MAAM,IAAI,aAAa,CAAC,8CAA8C,EAAE,UAAU,EAAE;gBAClF,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,qBAAqB,CAAC,wDAAwD,EAAE;gBACxF,aAAa,EAAE,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9F,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAClE,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC,CACF,CAAC;IAEF,gFAAgF;IAEhF,GAAG,CAAC,IAAI,CACN,kBAAkB,EAClB;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE;KAChG,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,uEAAuE;QACvE,MAAM,YAAY,GAChB,OAAO,CAAC,eAAe,KAAK,IAAI;YAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;YACvE,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;SAC9E,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,0BAA0B,EAC1B;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC;QACrD,MAAM,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE;KAC5E,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,IAAI,SAAS,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,UAAU,EAAE;oBACzE,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE;gBAC3D,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE;SAC/E,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC,CACF,CAAC;AACJ,CAAC,CAAC"}