@seifer-webapp-factory/authorization 0.1.0

package/dist/backend/src/services.js

@@ -0,0 +1,234 @@
+/**
+ * Backend mechanisme (pinned dependency) — flow-services die de `access-control`-kit orkestreren.
+ * Puur: geen HTTP, geen SQL van zichzelf; poorten via injectie; events geëmit. Ze voegen GEEN nieuw
+ * mechanisme toe — RBAC-resolutie/cyclusdetectie/ReBAC/PDP komen uit de kit.
+ *
+ * Stories: US-Z0201/0202/0203 (rollen), US-Z0301/0302/0303 (toewijzing), US-Z0401/0402 (resolutie),
+ * US-Z0403 (PDP), US-Z0501/0502 (ReBAC).
+ */
+import { RebacChecker } from '@seifer-webapp-factory/kits/backend/access-control';
+import { AuthzError, AUTHZ_MANAGE, } from '../../contract/index.js';
+import { effectivePermissions } from './policy.js';
+const toRole = (r) => ({
+    id: r.id, key: r.key, name: r.name, permissions: r.permissions, parentRoleId: r.parentRoleId,
+});
+/** US-Z0201/0202/0203 — rollenbeheer (CRUD + hiërarchie + catalogus-sync). */
+export class RoleService {
+    #store;
+    #catalogKeys;
+    #events;
+    #clock;
+    constructor(deps) {
+        this.#store = deps.store;
+        this.#catalogKeys = new Set(deps.catalog.map((p) => p.key));
+        this.#events = deps.events;
+        this.#clock = deps.clock;
+    }
+    async list() {
+        return (await this.#store.listRoles()).map(toRole);
+    }
+    async create(actor, input) {
+        this.#assertKnownPermissions(input.permissions);
+        this.#assertNoEscalation(actor, input.permissions);
+        if (input.parentRoleId !== null && (await this.#store.getRole(input.parentRoleId)) === null) {
+            throw new AuthzError('role_not_found', 'onbekende bovenliggende rol');
+        }
+        const created = await this.#store.createRole(input);
+        // Rebuild om een cyclus (via de nieuwe rol) fail-fast te detecteren; rollback bij een cyclus.
+        try {
+            effectivePermissions(await this.#store.listRoles(), [created.key]);
+        }
+        catch (error) {
+            await this.#store.deleteRole(created.id);
+            throw error;
+        }
+        this.#events.emit({
+            name: 'role.created', occurredAt: this.#iso(), actorId: actor.id, roleId: created.id, roleKey: created.key,
+        });
+        return toRole(created);
+    }
+    async update(actor, id, patch) {
+        const existing = await this.#store.getRole(id);
+        if (existing === null)
+            throw new AuthzError('role_not_found');
+        if (patch.permissions !== undefined) {
+            this.#assertKnownPermissions(patch.permissions);
+            this.#assertNoEscalation(actor, patch.permissions);
+        }
+        // Valideer de kandidaat-hiërarchie in-memory vóór persisteren (cyclus → role_cycle).
+        const candidate = (await this.#store.listRoles()).map((r) => r.id === id ? { ...r, ...this.#applied(r, patch) } : r);
+        effectivePermissions(candidate, [existing.key]);
+        const updated = await this.#store.updateRole(id, patch);
+        this.#events.emit({ name: 'role.updated', occurredAt: this.#iso(), actorId: actor.id, roleId: id });
+        return toRole(updated);
+    }
+    async remove(actor, id) {
+        if ((await this.#store.getRole(id)) === null)
+            throw new AuthzError('role_not_found');
+        await this.#store.deleteRole(id);
+        this.#events.emit({ name: 'role.deleted', occurredAt: this.#iso(), actorId: actor.id, roleId: id });
+    }
+    /** US-Z0203 — de code-declared catalogus is de bron; management vereist `authz.manage` (surface-guard). */
+    permissions() {
+        return [...this.#catalogKeys].map((key) => ({ key, description: key }));
+    }
+    #applied(role, patch) {
+        return {
+            name: patch.name ?? role.name,
+            permissions: patch.permissions ?? role.permissions,
+            parentRoleId: patch.parentRoleId === undefined ? role.parentRoleId : patch.parentRoleId,
+        };
+    }
+    #assertKnownPermissions(permissions) {
+        for (const p of permissions) {
+            if (!this.#catalogKeys.has(p))
+                throw new AuthzError('permission_unknown', 'onbekende permissie', { permissions: [p] });
+        }
+    }
+    /** US-Z0302 — een actor kan geen permissie toekennen die zij zelf niet bezit. */
+    #assertNoEscalation(actor, permissions) {
+        for (const p of permissions) {
+            if (!actor.permissions.has(p))
+                throw new AuthzError('escalation_denied', 'permissie boven eigen niveau');
+        }
+    }
+    #iso() {
+        return this.#clock.now().toISOString();
+    }
+}
+/** US-Z0301/0302/0303 — rol-toewijzing met escalation- en self-lockout-guards. */
+export class AssignmentService {
+    #store;
+    #cache;
+    #events;
+    #clock;
+    constructor(deps) {
+        this.#store = deps.store;
+        this.#cache = deps.cache;
+        this.#events = deps.events;
+        this.#clock = deps.clock;
+    }
+    async subjectRoles(subjectId) {
+        return (await this.#store.rolesForSubject(subjectId)).map(toRole);
+    }
+    async assign(actor, subjectId, roleId) {
+        const role = await this.#store.getRole(roleId);
+        if (role === null)
+            throw new AuthzError('role_not_found');
+        // US-Z0302: geen rol toekennen waarvan de effectieve permissies het eigen niveau overstijgen.
+        const rolePerms = effectivePermissions(await this.#store.listRoles(), [role.key]);
+        for (const p of rolePerms) {
+            if (!actor.permissions.has(p))
+                throw new AuthzError('escalation_denied', 'rol boven eigen niveau');
+        }
+        const assigned = await this.#store.assignRole(subjectId, roleId);
+        if (!assigned)
+            throw new AuthzError('assignment_exists');
+        await this.#cache.invalidate(subjectId);
+        this.#events.emit({ name: 'role.assigned', occurredAt: this.#iso(), actorId: actor.id, subjectId, roleId });
+    }
+    async revoke(actor, subjectId, roleId) {
+        const role = await this.#store.getRole(roleId);
+        if (role === null)
+            throw new AuthzError('role_not_found');
+        await this.#assertNoSelfLockout(actor, subjectId, role);
+        await this.#store.revokeRole(subjectId, roleId); // idempotent: geen fout als er niets was
+        await this.#cache.invalidate(subjectId);
+        this.#events.emit({ name: 'role.revoked', occurredAt: this.#iso(), actorId: actor.id, subjectId, roleId });
+    }
+    /** US-Z0303 — een actor mag zichzelf niet de laatste `authz.manage`-rol ontnemen. */
+    async #assertNoSelfLockout(actor, subjectId, role) {
+        if (subjectId !== actor.id)
+            return;
+        const allRoles = await this.#store.listRoles();
+        if (!effectivePermissions(allRoles, [role.key]).has(AUTHZ_MANAGE))
+            return;
+        const remaining = (await this.#store.rolesForSubject(subjectId)).filter((r) => r.id !== role.id);
+        const stillManages = effectivePermissions(allRoles, remaining.map((r) => r.key)).has(AUTHZ_MANAGE);
+        if (!stillManages)
+            throw new AuthzError('self_lockout', 'laatste beheer-rol niet intrekbaar');
+    }
+    #iso() {
+        return this.#clock.now().toISOString();
+    }
+}
+/** US-Z0401/0402 — resolveert een subject naar effectieve permissies, met cache + invalidatie. */
+export class PermissionResolver {
+    #store;
+    #cache;
+    constructor(deps) {
+        this.#store = deps.store;
+        this.#cache = deps.cache;
+    }
+    async resolve(subjectId) {
+        const cached = await this.#cache.get(subjectId);
+        if (cached !== null)
+            return cached;
+        const [roles, allRoles] = await Promise.all([this.#store.rolesForSubject(subjectId), this.#store.listRoles()]);
+        const roleKeys = roles.map((r) => r.key);
+        const permissions = [...effectivePermissions(allRoles, roleKeys)];
+        const result = { subjectId, roleKeys, permissions };
+        await this.#cache.set(subjectId, result);
+        return result;
+    }
+    async has(subjectId, permission) {
+        return (await this.resolve(subjectId)).permissions.includes(permission);
+    }
+}
+/** Adapter: overbrugt de PolicyStore-relaties naar de kit-`RelationResolver` (US-Z0502). */
+class StoreRelationResolver {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    relationsFrom(node) {
+        return this.store.relationsFrom(node);
+    }
+}
+/** US-Z0403 — Policy Decision Point: default-deny beslissing + veilige reden voor /authz/check. */
+export class AuthorizationPdp {
+    #resolver;
+    #rebac;
+    constructor(deps) {
+        this.#resolver = deps.resolver;
+        this.#rebac = deps.rebacEnabled ? new RebacChecker(new StoreRelationResolver(deps.store)) : null;
+    }
+    async check(subjectId, request) {
+        // RBAC-vorm: heeft het subject de permissie? Default-deny.
+        if (request.permission !== undefined) {
+            const allowed = await this.#resolver.has(subjectId, request.permission);
+            return { allowed, reason: allowed ? 'toegestaan' : 'geweigerd' };
+        }
+        // PDP/ReBAC-vorm: ownership tegen een resource (alleen als ReBAC aan staat).
+        if (request.action !== undefined) {
+            if (this.#rebac === null || request.resource === undefined) {
+                return { allowed: false, reason: 'geweigerd' };
+            }
+            const result = await this.#rebac.check(subjectId, request.resource.id, { relations: ['owner'] });
+            return { allowed: result.allowed, reason: result.allowed ? 'toegestaan' : 'geweigerd' };
+        }
+        return { allowed: false, reason: 'geweigerd' };
+    }
+}
+/** US-Z0501 — ReBAC-relatietuples schrijven/verwijderen (achter config-toggle). */
+export class RelationService {
+    #store;
+    #enabled;
+    constructor(deps) {
+        this.#store = deps.store;
+        this.#enabled = deps.rebacEnabled;
+    }
+    async write(relation) {
+        this.#assertEnabled();
+        await this.#store.writeRelation(relation);
+    }
+    async remove(relation) {
+        this.#assertEnabled();
+        await this.#store.removeRelation(relation);
+    }
+    #assertEnabled() {
+        if (!this.#enabled)
+            throw new AuthzError('invalid_relation', 'ReBAC staat uit');
+    }
+}
+//# sourceMappingURL=services.js.map

package/dist/backend/src/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../backend/src/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oDAAoD,CAAC;AAElF,OAAO,EACL,UAAU,EACV,YAAY,GAMb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAWnD,MAAM,MAAM,GAAG,CAAC,CAAa,EAAQ,EAAE,CAAC,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY;CAC7F,CAAC,CAAC;AAeH,8EAA8E;AAC9E,MAAM,OAAO,WAAW;IACb,MAAM,CAAc;IACpB,YAAY,CAAc;IAC1B,OAAO,CAAiB;IACxB,MAAM,CAAQ;IAEvB,YAAY,IAAc;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,KAAsB;QAC/C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5F,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACpD,8FAA8F;QAC9F,IAAI,CAAC;YACH,oBAAoB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG;SAC3G,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,EAAU,EAAE,KAAsB;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAChD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;QACD,qFAAqF;QACrF,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1D,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,EAAU;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,2GAA2G;IAC3G,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,QAAQ,CAAC,IAAgB,EAAE,KAAsB;QAC/C,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;YAC7B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;YAClD,YAAY,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY;SACxF,CAAC;IACJ,CAAC;IAED,uBAAuB,CAAC,WAAqB;QAC3C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,mBAAmB,CAAC,KAAY,EAAE,WAAqB;QACrD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;CACF;AASD,kFAAkF;AAClF,MAAM,OAAO,iBAAiB;IACnB,MAAM,CAAc;IACpB,MAAM,CAAkB;IACxB,OAAO,CAAiB;IACxB,MAAM,CAAQ;IAEvB,YAAY,IAAgB;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,SAAiB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC1D,8FAA8F;QAC9F,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,SAAiB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,yCAAyC;QAC1F,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,oBAAoB,CAAC,KAAY,EAAE,SAAiB,EAAE,IAAgB;QAC1E,IAAI,SAAS,KAAK,KAAK,CAAC,EAAE;YAAE,OAAO;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO;QAC1E,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnG,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,oCAAoC,CAAC,CAAC;IAChG,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAc;IACpB,MAAM,CAAkB;IAEjC,YAAY,IAAoD;QAC9D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACnC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,CAAC,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,UAAkB;QAC7C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,4FAA4F;AAC5F,MAAM,qBAAqB;IACI;IAA7B,YAA6B,KAAkB;QAAlB,UAAK,GAAL,KAAK,CAAa;IAAG,CAAC;IACnD,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,OAAO,gBAAgB;IAClB,SAAS,CAAqB;IAC9B,MAAM,CAAsB;IAErC,YAAY,IAAiF;QAC3F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,OAAqB;QAClD,2DAA2D;QAC3D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YACxE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnE,CAAC;QACD,6EAA6E;QAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACjD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;CACF;AAOD,mFAAmF;AACnF,MAAM,OAAO,eAAe;IACjB,MAAM,CAAc;IACpB,QAAQ,CAAU;IAE3B,YAAY,IAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAuF;QACjG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAuF;QAClG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;IAClF,CAAC;CACF"}

package/dist/contract/endpoints.d.ts

@@ -0,0 +1,433 @@
+import type { z } from 'zod';
+import type { AuthzErrorCode } from './errors.js';
+/**
+ * US-Z0101/Z0104/Z0105 — de machine-leesbare endpoint-catalogus (12 endpoints). Backend leidt hier
+ * route + validatie + vereiste permissie uit af; frontend leidt hier zijn getypte client uit af. Eén
+ * bron, geen drift. `backendRoutes` in de manifest wordt hieruit afgeleid (US-Z0801).
+ */
+export interface EndpointDescriptor<Req extends z.ZodTypeAny | null, Res extends z.ZodTypeAny> {
+    readonly method: 'POST' | 'GET' | 'PATCH' | 'DELETE';
+    readonly path: string;
+    readonly request: Req;
+    readonly response: Res;
+    /** Foutcodes die dit endpoint kan retourneren (uit de gedeelde taxonomie). */
+    readonly errors: readonly AuthzErrorCode[];
+    /** Vereist een geauthenticeerde sessie (het `Subject` uit de authentication-module). */
+    readonly auth: boolean;
+    /**
+     * Permissie die het huidige subject moet bezitten om dit endpoint aan te roepen. Beheer-endpoints
+     * vereisen `authz.manage` (no-catalog-leak, US-Z0703); `null` = geen extra permissie boven `auth`.
+     */
+    readonly requiredPermission: string | null;
+}
+export declare const AUTHZ_ENDPOINTS: {
+    readonly listRoles: {
+        readonly method: "GET";
+        readonly path: "/authz/roles";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            roles: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                key: z.ZodString;
+                name: z.ZodString;
+                permissions: z.ZodArray<z.ZodString, "many">;
+                parentRoleId: z.ZodNullable<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }, {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            roles: {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }[];
+        }, {
+            roles: {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }[];
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly createRole: {
+        readonly method: "POST";
+        readonly path: "/authz/roles";
+        readonly request: z.ZodObject<{
+            key: z.ZodString;
+            name: z.ZodString;
+            permissions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            parentRoleId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            key: string;
+            name: string;
+            permissions: string[];
+            parentRoleId: string | null;
+        }, {
+            key: string;
+            name: string;
+            permissions?: string[] | undefined;
+            parentRoleId?: string | null | undefined;
+        }>;
+        readonly response: z.ZodObject<{
+            id: z.ZodString;
+            key: z.ZodString;
+            name: z.ZodString;
+            permissions: z.ZodArray<z.ZodString, "many">;
+            parentRoleId: z.ZodNullable<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            key: string;
+            name: string;
+            permissions: string[];
+            parentRoleId: string | null;
+        }, {
+            id: string;
+            key: string;
+            name: string;
+            permissions: string[];
+            parentRoleId: string | null;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated", "permission_unknown", "role_cycle", "escalation_denied", "validation_failed"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly updateRole: {
+        readonly method: "PATCH";
+        readonly path: "/authz/roles/:id";
+        readonly request: z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            parentRoleId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            name?: string | undefined;
+            permissions?: string[] | undefined;
+            parentRoleId?: string | null | undefined;
+        }, {
+            name?: string | undefined;
+            permissions?: string[] | undefined;
+            parentRoleId?: string | null | undefined;
+        }>;
+        readonly response: z.ZodObject<{
+            id: z.ZodString;
+            key: z.ZodString;
+            name: z.ZodString;
+            permissions: z.ZodArray<z.ZodString, "many">;
+            parentRoleId: z.ZodNullable<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            key: string;
+            name: string;
+            permissions: string[];
+            parentRoleId: string | null;
+        }, {
+            id: string;
+            key: string;
+            name: string;
+            permissions: string[];
+            parentRoleId: string | null;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated", "role_not_found", "permission_unknown", "role_cycle", "escalation_denied", "validation_failed"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly deleteRole: {
+        readonly method: "DELETE";
+        readonly path: "/authz/roles/:id";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated", "role_not_found"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly listPermissions: {
+        readonly method: "GET";
+        readonly path: "/authz/permissions";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            permissions: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                description: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                key: string;
+                description: string;
+            }, {
+                key: string;
+                description: string;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            permissions: {
+                key: string;
+                description: string;
+            }[];
+        }, {
+            permissions: {
+                key: string;
+                description: string;
+            }[];
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly subjectRoles: {
+        readonly method: "GET";
+        readonly path: "/authz/subjects/:id/roles";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            subjectId: z.ZodString;
+            roles: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                key: z.ZodString;
+                name: z.ZodString;
+                permissions: z.ZodArray<z.ZodString, "many">;
+                parentRoleId: z.ZodNullable<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }, {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            roles: {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }[];
+            subjectId: string;
+        }, {
+            roles: {
+                id: string;
+                key: string;
+                name: string;
+                permissions: string[];
+                parentRoleId: string | null;
+            }[];
+            subjectId: string;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly assignRole: {
+        readonly method: "POST";
+        readonly path: "/authz/assignments";
+        readonly request: z.ZodObject<{
+            subjectId: z.ZodString;
+            roleId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            subjectId: string;
+            roleId: string;
+        }, {
+            subjectId: string;
+            roleId: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated", "role_not_found", "assignment_exists", "escalation_denied"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly revokeRole: {
+        readonly method: "DELETE";
+        readonly path: "/authz/assignments";
+        readonly request: z.ZodObject<{
+            subjectId: z.ZodString;
+            roleId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            subjectId: string;
+            roleId: string;
+        }, {
+            subjectId: string;
+            roleId: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated", "role_not_found", "self_lockout"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly mePermissions: {
+        readonly method: "GET";
+        readonly path: "/authz/me/permissions";
+        readonly request: null;
+        readonly response: z.ZodObject<{
+            subjectId: z.ZodString;
+            roles: z.ZodArray<z.ZodString, "many">;
+            permissions: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            permissions: string[];
+            roles: string[];
+            subjectId: string;
+        }, {
+            permissions: string[];
+            roles: string[];
+            subjectId: string;
+        }>;
+        readonly errors: readonly ["unauthenticated"];
+        readonly auth: true;
+        readonly requiredPermission: null;
+    };
+    readonly check: {
+        readonly method: "POST";
+        readonly path: "/authz/check";
+        readonly request: z.ZodEffects<z.ZodObject<{
+            permission: z.ZodOptional<z.ZodString>;
+            action: z.ZodOptional<z.ZodString>;
+            resource: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+                type: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                id: string;
+                type?: string | undefined;
+            }, {
+                id: string;
+                type?: string | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            permission?: string | undefined;
+            action?: string | undefined;
+            resource?: {
+                id: string;
+                type?: string | undefined;
+            } | undefined;
+        }, {
+            permission?: string | undefined;
+            action?: string | undefined;
+            resource?: {
+                id: string;
+                type?: string | undefined;
+            } | undefined;
+        }>, {
+            permission?: string | undefined;
+            action?: string | undefined;
+            resource?: {
+                id: string;
+                type?: string | undefined;
+            } | undefined;
+        }, {
+            permission?: string | undefined;
+            action?: string | undefined;
+            resource?: {
+                id: string;
+                type?: string | undefined;
+            } | undefined;
+        }>;
+        readonly response: z.ZodObject<{
+            allowed: z.ZodBoolean;
+            reason: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            allowed: boolean;
+            reason: string;
+        }, {
+            allowed: boolean;
+            reason: string;
+        }>;
+        readonly errors: readonly ["unauthenticated", "validation_failed"];
+        readonly auth: true;
+        readonly requiredPermission: null;
+    };
+    readonly writeRelation: {
+        readonly method: "POST";
+        readonly path: "/authz/relations";
+        readonly request: z.ZodObject<{
+            subjectId: z.ZodString;
+            relation: z.ZodString;
+            objectType: z.ZodString;
+            objectId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            subjectId: string;
+            relation: string;
+            objectType: string;
+            objectId: string;
+        }, {
+            subjectId: string;
+            relation: string;
+            objectType: string;
+            objectId: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated", "invalid_relation"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+    readonly removeRelation: {
+        readonly method: "DELETE";
+        readonly path: "/authz/relations";
+        readonly request: z.ZodObject<{
+            subjectId: z.ZodString;
+            relation: z.ZodString;
+            objectType: z.ZodString;
+            objectId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            subjectId: string;
+            relation: string;
+            objectType: string;
+            objectId: string;
+        }, {
+            subjectId: string;
+            relation: string;
+            objectType: string;
+            objectId: string;
+        }>;
+        readonly response: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            ok: true;
+        }, {
+            ok: true;
+        }>;
+        readonly errors: readonly ["forbidden", "unauthenticated", "invalid_relation"];
+        readonly auth: true;
+        readonly requiredPermission: "authz.manage";
+    };
+};
+export type AuthzEndpointName = keyof typeof AUTHZ_ENDPOINTS;
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/contract/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../contract/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAe7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CACjC,GAAG,SAAS,CAAC,CAAC,UAAU,GAAG,IAAI,EAC/B,GAAG,SAAS,CAAC,CAAC,UAAU;IAExB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqD8D,CAAC;AAE3F,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,eAAe,CAAC"}