@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.186

package/dist/lib/api/auth/permissions.js

@@ -9,8 +9,8 @@ function hasAdminPermission(authResult, requiredScope) {
   if (!isSuperAdmin(authResult)) {
     return false;
   }
-  if (authResult.type === "api-key" && requiredScope) {
-    return hasRequiredScope(authResult, requiredScope);
+  if (authResult.type === "api-key") {
+    return requiredScope !== void 0 && hasRequiredScope(authResult, requiredScope);
   }
   return true;
 }

package/dist/lib/api/auth/scope-policy.d.ts

@@ -0,0 +1,71 @@
+/**
+ * API-key scope policy (#93)
+ *
+ * Shared by both auth entry points — `authenticateRequest` (dual-auth.ts) and
+ * `validateAndAuthenticateRequest` (helpers.ts) — so the rule cannot drift
+ * between them. Pure: no I/O, no framework imports.
+ *
+ * The rule, applied only to API-key authentication (sessions carry no scopes
+ * and are never gated here):
+ *
+ *   1. The route declared `{ requiredScope }` → the key must hold one of the
+ *      listed scopes (or the wildcard `*`). Otherwise `INSUFFICIENT_SCOPE`.
+ *   2. The route declared `{ allowAnyScope: true }` → any valid key passes.
+ *      This is the explicit, self-documenting opt-out for routes that are
+ *      genuinely scope-agnostic (a public route that only *enriches* its
+ *      answer for authenticated callers, an MCP transport whose tools enforce
+ *      scopes themselves, ...).
+ *   3. The route declared nothing → the key is rejected with
+ *      `SCOPE_NOT_DECLARED` and the route is named in the server log.
+ *
+ * Rule 3 is the point of the change: forgetting a declaration now produces a
+ * visible 403 on an integration instead of a silently over-privileged
+ * credential. Before, `scopes` were populated and nobody was obliged to look.
+ */
+export type DualAuthFailureCode = 'AUTHENTICATION_FAILED' | 'INSUFFICIENT_SCOPE' | 'SCOPE_NOT_DECLARED';
+export interface DualAuthFailure {
+    code: DualAuthFailureCode;
+    /** 401 when no usable credential was presented, 403 when a valid key was rejected on scope. */
+    status: 401 | 403;
+    message: string;
+}
+export interface AuthenticateOptions {
+    /**
+     * Scope(s) an API key must hold to use this route. A string requires that
+     * scope; an array is satisfied by any one of its entries. Ignored for
+     * session auth. An empty array counts as "nothing declared".
+     */
+    requiredScope?: string | string[];
+    /**
+     * Accept any valid API key regardless of its scopes. Explicit opt-out of
+     * fail-closed enforcement — say why in a comment at the call site.
+     * A declared `requiredScope` still wins if both are set.
+     */
+    allowAnyScope?: boolean;
+}
+/** Failure attached to a result that carried no usable credential at all. */
+export declare function authenticationFailed(): DualAuthFailure;
+export declare function normalizeRequiredScopes(requiredScope: AuthenticateOptions['requiredScope']): string[];
+/**
+ * True when `scopes` (an API key's stored scopes) satisfy `requiredScope`:
+ * holds one of the required scopes, or the wildcard `*`. An empty requirement
+ * is never satisfied — "no scope needed" must be said with `allowAnyScope`,
+ * not with an empty list.
+ */
+export declare function scopesSatisfy(scopes: readonly string[] | undefined, requiredScope: string | string[]): boolean;
+/** Minimal request shape needed to name a route in logs (works for mocks too). */
+export interface RouteDescribable {
+    method?: string;
+    url?: string;
+    nextUrl?: {
+        pathname: string;
+    };
+}
+export declare function describeRoute(request: RouteDescribable): string;
+/**
+ * Apply the policy to an already-authenticated API key.
+ *
+ * @returns null when the key may proceed, otherwise the failure to report.
+ */
+export declare function resolveApiKeyScopeFailure(scopes: readonly string[] | undefined, options: AuthenticateOptions, route: string): DualAuthFailure | null;
+//# sourceMappingURL=scope-policy.d.ts.map

package/dist/lib/api/auth/scope-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-policy.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/auth/scope-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,oBAAoB,CAAA;AAExB,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,+FAA+F;IAC/F,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,eAAe,CAEtD;AAED,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,mBAAmB,CAAC,eAAe,CAAC,GAAG,MAAM,EAAE,CAKrG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,OAAO,CAIT;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,IAAI,CAuBxB"}

package/dist/lib/api/auth/scope-policy.js

@@ -0,0 +1,53 @@
+function authenticationFailed() {
+  return { code: "AUTHENTICATION_FAILED", status: 401, message: "Authentication required" };
+}
+function normalizeRequiredScopes(requiredScope) {
+  if (requiredScope === void 0) return [];
+  return (Array.isArray(requiredScope) ? requiredScope : [requiredScope]).filter(
+    (scope) => typeof scope === "string" && scope.length > 0
+  );
+}
+function scopesSatisfy(scopes, requiredScope) {
+  const required = normalizeRequiredScopes(requiredScope);
+  if (required.length === 0 || !scopes) return false;
+  return scopes.includes("*") || required.some((scope) => scopes.includes(scope));
+}
+function describeRoute(request) {
+  var _a;
+  let pathname = (_a = request.nextUrl) == null ? void 0 : _a.pathname;
+  if (!pathname && request.url) {
+    try {
+      pathname = new URL(request.url).pathname;
+    } catch {
+      pathname = request.url;
+    }
+  }
+  return `${request.method ?? "GET"} ${pathname ?? "<unknown route>"}`;
+}
+function resolveApiKeyScopeFailure(scopes, options, route) {
+  const required = normalizeRequiredScopes(options.requiredScope);
+  if (required.length > 0) {
+    if (scopesSatisfy(scopes, required)) return null;
+    return {
+      code: "INSUFFICIENT_SCOPE",
+      status: 403,
+      message: `API key lacks required scope '${required.join("' or '")}'`
+    };
+  }
+  if (options.allowAnyScope) return null;
+  console.error(
+    `[auth] ${route} did not declare a required API key scope; rejecting the API-key request (fail closed). Pass { requiredScope } \u2014 or { allowAnyScope: true } if any valid key is really acceptable \u2014 to the auth entry point.`
+  );
+  return {
+    code: "SCOPE_NOT_DECLARED",
+    status: 403,
+    message: "API key access is not enabled for this route: it declares no required scope"
+  };
+}
+export {
+  authenticationFailed,
+  describeRoute,
+  normalizeRequiredScopes,
+  resolveApiKeyScopeFailure,
+  scopesSatisfy
+};

package/dist/lib/api/auth.d.ts

@@ -25,6 +25,21 @@ export interface ApiKeyValidationResult {
  * Valida una API Key desde el header Authorization o x-api-key
  */
 export declare function validateApiKey(request: NextRequest): Promise<ApiKeyAuth | null>;
+/**
+ * Elimina del cache la entrada de una API key (indexada por keyHash).
+ *
+ * Debe llamarse cada vez que cambia el `status` de una key (revocación,
+ * desactivación, expiración): validateApiKey() consulta el cache ANTES que la
+ * base de datos, así que sin esta invalidación una key revocada sigue
+ * autenticando hasta que vence el TTL (5 min). Ver #92.
+ */
+export declare function invalidateApiKeyCache(keyHash: string): void;
+/**
+ * Variante por id para los call sites que no tienen el hash a mano.
+ * Hace una lectura extra; preferí invalidateApiKeyCache(keyHash) cuando el
+ * hash ya viene en la fila (por ejemplo vía RETURNING "keyHash").
+ */
+export declare function invalidateApiKeyCacheById(keyId: string): Promise<void>;
 /**
  * Verifica si una autenticación tiene alguno de los scopes requeridos
  */

package/dist/lib/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoHrF;AAiDD;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoHrF;AA8CD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5E;AAID;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAM/E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAMhF;AAiBD;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU;QAG1C,MAAM;WACH,MAAM;eACF,MAAM,GAAG,IAAI;cACd,MAAM,GAAG,IAAI;UACjB,MAAM;GAWjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyED"}

package/dist/lib/api/auth.js

@@ -62,7 +62,7 @@ async function validateApiKey(request) {
       return null;
     }
     if (keyData.expiresAt && new Date(keyData.expiresAt) < /* @__PURE__ */ new Date()) {
-      markAsExpired(keyData.id).catch(console.error);
+      markAsExpired(keyData.id, keyHash).catch(console.error);
       await constantTimeDelay(startTime);
       return null;
     }
@@ -101,18 +101,29 @@ async function resetFailedAttempts(keyId) {
     console.error("Failed to reset failed attempts:", error);
   }
 }
-async function markAsExpired(keyId) {
+async function markAsExpired(keyId, keyHash) {
   try {
     await queryOne(
       'UPDATE "api_key" SET status = $1 WHERE id = $2',
       ["expired", keyId]
     );
-    const cacheKey = getCacheKey("api_key", keyId);
-    apiKeyCache.delete(cacheKey);
+    invalidateApiKeyCache(keyHash);
   } catch (error) {
     console.error("Failed to mark API key as expired:", error);
   }
 }
+function invalidateApiKeyCache(keyHash) {
+  apiKeyCache.delete(getCacheKey("api_key", keyHash));
+}
+async function invalidateApiKeyCacheById(keyId) {
+  const row = await queryOne(
+    'SELECT "keyHash" FROM "api_key" WHERE id = $1',
+    [keyId]
+  );
+  if (row == null ? void 0 : row.keyHash) {
+    invalidateApiKeyCache(row.keyHash);
+  }
+}
 function hasAnyScope(auth, requiredScopes) {
   if (auth.scopes.includes("*")) {
     return true;
@@ -237,6 +248,8 @@ export {
   hasAllScopes,
   hasAnyScope,
   hasScope,
+  invalidateApiKeyCache,
+  invalidateApiKeyCacheById,
   validateApiKey,
   validateScopesForUser
 };

package/dist/lib/api/entity/audit-log.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Audit logging for the generic entity routes (#105).
+ *
+ * `logApiUsage` (lib/api/helpers.ts) is hard-typed to `ApiKeyAuth` and is
+ * only triggered by the legacy `withApiLogging` wrapper, whose header-based
+ * `getApiAuth` never sees the dual-auth flow the generic handlers use — so
+ * neither session nor API-key activity on `/api/v1/[entity]` was ever
+ * written to `api_audit_log`.
+ *
+ * This module accepts the real `DualAuthResult` the handlers already hold and
+ * writes one row per REQUEST WITH AN IDENTIFIABLE PRINCIPAL (`apiKeyId` is
+ * NULL for sessions; migration 025 dropped the NOT NULL) — a real session or
+ * a real API key, whether the request was ultimately allowed or denied for
+ * scope/permission reasons (#128). A request with no usable credential at all
+ * (anonymous, missing, or invalid) is still never logged: there is no "who"
+ * to attribute it to, and logging it would mostly capture bot/scanner noise
+ * rather than anything actionable. It is invoked fire-and-forget from
+ * `runWithAuditLog` in generic-handler.ts, so a logging failure can never turn
+ * a successful response into an error.
+ *
+ * The request body is deliberately NOT stored: entity payloads routinely
+ * carry personal data, and endpoint + method + status already identify what
+ * was touched (the record id is part of the path for read/update/delete).
+ */
+import type { NextRequest } from 'next/server';
+import type { DualAuthResult } from '../auth/dual-auth';
+/**
+ * Mutable slot a handler fills in once it has authenticated the request, so
+ * the wrapper can attribute the response to a user / API key.
+ */
+export interface AuditContext {
+    auth: DualAuthResult | null;
+}
+export declare function logGenericHandlerUsage(auth: DualAuthResult | null, request: NextRequest, statusCode: number, responseTime?: number): Promise<void>;
+//# sourceMappingURL=audit-log.d.ts.map

package/dist/lib/api/entity/audit-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;CAC5B;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,EAC3B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAuCf"}

package/dist/lib/api/entity/audit-log.js

@@ -0,0 +1,35 @@
+import { mutateWithRLS } from "../../db.js";
+async function logGenericHandlerUsage(auth, request, statusCode, responseTime) {
+  var _a;
+  const userId = (_a = auth == null ? void 0 : auth.user) == null ? void 0 : _a.id;
+  if (!userId) return;
+  const apiKeyId = (auth == null ? void 0 : auth.type) === "api-key" ? auth.keyId ?? null : null;
+  try {
+    const endpoint = request.nextUrl.pathname;
+    const method = request.method;
+    const ipAddress = request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown";
+    const userAgent = request.headers.get("user-agent");
+    await mutateWithRLS(
+      `INSERT INTO "api_audit_log"
+       ("apiKeyId", "userId", endpoint, method, "statusCode", "ipAddress", "userAgent", "requestBody", "responseTime")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+      [
+        apiKeyId,
+        userId,
+        endpoint,
+        method,
+        statusCode,
+        ipAddress,
+        userAgent,
+        null,
+        typeof responseTime === "number" ? Math.round(responseTime) : null
+      ],
+      userId
+    );
+  } catch (error) {
+    console.error("[generic-handler:audit] failed to write api_audit_log entry:", error);
+  }
+}
+export {
+  logGenericHandlerUsage
+};

package/dist/lib/api/entity/generic-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAmjBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAwgBnF;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAoZrF;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA0MpJ;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA2XtJ;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAyJtJ;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}
+{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA4wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA4kBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAyaD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAgND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA+YD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}