@seifer-webapp-factory/authorization 0.1.0

package/dist/contract/endpoints.js

@@ -0,0 +1,57 @@
+import { createRoleRequestSchema, updateRoleRequestSchema, roleSchema, roleListResponseSchema, permissionListResponseSchema, assignmentRequestSchema, subjectRolesResponseSchema, mePermissionsResponseSchema, checkRequestSchema, checkResponseSchema, relationRequestSchema, acknowledgementSchema, } from './schemas.js';
+import { AUTHZ_MANAGE } from './permissions.js';
+export const AUTHZ_ENDPOINTS = {
+    listRoles: {
+        method: 'GET', path: '/authz/roles', request: null, response: roleListResponseSchema,
+        errors: ['forbidden', 'unauthenticated'], auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    createRole: {
+        method: 'POST', path: '/authz/roles', request: createRoleRequestSchema, response: roleSchema,
+        errors: ['forbidden', 'unauthenticated', 'permission_unknown', 'role_cycle', 'escalation_denied', 'validation_failed'],
+        auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    updateRole: {
+        method: 'PATCH', path: '/authz/roles/:id', request: updateRoleRequestSchema, response: roleSchema,
+        errors: ['forbidden', 'unauthenticated', 'role_not_found', 'permission_unknown', 'role_cycle', 'escalation_denied', 'validation_failed'],
+        auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    deleteRole: {
+        method: 'DELETE', path: '/authz/roles/:id', request: null, response: acknowledgementSchema,
+        errors: ['forbidden', 'unauthenticated', 'role_not_found'], auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    listPermissions: {
+        method: 'GET', path: '/authz/permissions', request: null, response: permissionListResponseSchema,
+        errors: ['forbidden', 'unauthenticated'], auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    subjectRoles: {
+        method: 'GET', path: '/authz/subjects/:id/roles', request: null, response: subjectRolesResponseSchema,
+        errors: ['forbidden', 'unauthenticated'], auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    assignRole: {
+        method: 'POST', path: '/authz/assignments', request: assignmentRequestSchema, response: acknowledgementSchema,
+        errors: ['forbidden', 'unauthenticated', 'role_not_found', 'assignment_exists', 'escalation_denied'],
+        auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    revokeRole: {
+        method: 'DELETE', path: '/authz/assignments', request: assignmentRequestSchema, response: acknowledgementSchema,
+        errors: ['forbidden', 'unauthenticated', 'role_not_found', 'self_lockout'],
+        auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    mePermissions: {
+        method: 'GET', path: '/authz/me/permissions', request: null, response: mePermissionsResponseSchema,
+        errors: ['unauthenticated'], auth: true, requiredPermission: null,
+    },
+    check: {
+        method: 'POST', path: '/authz/check', request: checkRequestSchema, response: checkResponseSchema,
+        errors: ['unauthenticated', 'validation_failed'], auth: true, requiredPermission: null,
+    },
+    writeRelation: {
+        method: 'POST', path: '/authz/relations', request: relationRequestSchema, response: acknowledgementSchema,
+        errors: ['forbidden', 'unauthenticated', 'invalid_relation'], auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+    removeRelation: {
+        method: 'DELETE', path: '/authz/relations', request: relationRequestSchema, response: acknowledgementSchema,
+        errors: ['forbidden', 'unauthenticated', 'invalid_relation'], auth: true, requiredPermission: AUTHZ_MANAGE,
+    },
+};
+//# sourceMappingURL=endpoints.js.map

package/dist/contract/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../contract/endpoints.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0BhD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAE;QACT,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB;QACpF,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KACvF;IACD,UAAU,EAAE;QACV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU;QAC5F,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACtH,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KAC7C;IACD,UAAU,EAAE;QACV,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU;QACjG,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACxI,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KAC7C;IACD,UAAU,EAAE;QACV,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB;QAC1F,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KACzG;IACD,eAAe,EAAE;QACf,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,4BAA4B;QAChG,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KACvF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,0BAA0B;QACrG,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KACvF;IACD,UAAU,EAAE;QACV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,qBAAqB;QAC7G,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACpG,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KAC7C;IACD,UAAU,EAAE;QACV,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,qBAAqB;QAC/G,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,CAAC;QAC1E,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KAC7C;IACD,aAAa,EAAE;QACb,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,2BAA2B;QAClG,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;KAClE;IACD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,mBAAmB;QAChG,MAAM,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI;KACvF;IACD,aAAa,EAAE;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,qBAAqB;QACzG,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KAC3G;IACD,cAAc,EAAE;QACd,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,qBAAqB;QAC3G,MAAM,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,YAAY;KAC3G;CACuF,CAAC"}

package/dist/contract/errors.d.ts

@@ -0,0 +1,33 @@
+/**
+ * US-Z0102 — Error-taxonomie + i18n-sleutels. Eén gedeelde foutcodelijst die beide helften (backend
+ * mapping → HTTP, frontend weergave → i18n) uit het contract afleiden. Denial-reasons zijn veilig:
+ * ze lekken nooit de interne policy of welke permissie precies ontbrak (no-catalog-leak, US-Z0703).
+ */
+export declare const AUTHZ_ERROR_CODES: readonly ["forbidden", "role_not_found", "permission_unknown", "role_cycle", "assignment_exists", "self_lockout", "escalation_denied", "invalid_relation", "unauthenticated", "validation_failed"];
+export type AuthzErrorCode = (typeof AUTHZ_ERROR_CODES)[number];
+export interface AuthzErrorDescriptor {
+    /** HTTP-status waarnaar de backend deze fout mapt. */
+    readonly httpStatus: number;
+    /** i18n-sleutel die de frontend toont (nooit rauwe details). */
+    readonly i18nKey: string;
+}
+/** Enige bron van de code→HTTP + code→i18n-mapping. Bewust generiek gehouden (geen policy-lek). */
+export declare const AUTHZ_ERROR_TAXONOMY: Readonly<Record<AuthzErrorCode, AuthzErrorDescriptor>>;
+/** Contract-vorm van een foutrespons (body). Bevat nooit stacktraces of policy-interne details. */
+export interface AuthzErrorBody {
+    readonly code: AuthzErrorCode;
+    readonly message: string;
+    /** Optioneel: veld-gebonden validatiefouten (paden), zonder ingevoerde waarden. */
+    readonly fields?: Readonly<Record<string, string[]>>;
+}
+/**
+ * Domein-fout die de backend-services gooien; de HTTP-laag (surface) mapt `code` via de taxonomie naar
+ * status. Draagt nooit gevoelige context mee.
+ */
+export declare class AuthzError extends Error {
+    readonly code: AuthzErrorCode;
+    readonly fields: Readonly<Record<string, string[]>> | undefined;
+    constructor(code: AuthzErrorCode, message?: string, fields?: Record<string, string[]>);
+    toBody(): AuthzErrorBody;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/contract/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../contract/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,iBAAiB,oMAWpB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAWtF,CAAC;AAEH,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAOrF,MAAM,IAAI,cAAc;CAKzB"}

package/dist/contract/errors.js

@@ -0,0 +1,51 @@
+/**
+ * US-Z0102 — Error-taxonomie + i18n-sleutels. Eén gedeelde foutcodelijst die beide helften (backend
+ * mapping → HTTP, frontend weergave → i18n) uit het contract afleiden. Denial-reasons zijn veilig:
+ * ze lekken nooit de interne policy of welke permissie precies ontbrak (no-catalog-leak, US-Z0703).
+ */
+export const AUTHZ_ERROR_CODES = [
+    'forbidden',
+    'role_not_found',
+    'permission_unknown',
+    'role_cycle',
+    'assignment_exists',
+    'self_lockout',
+    'escalation_denied',
+    'invalid_relation',
+    'unauthenticated',
+    'validation_failed',
+];
+/** Enige bron van de code→HTTP + code→i18n-mapping. Bewust generiek gehouden (geen policy-lek). */
+export const AUTHZ_ERROR_TAXONOMY = Object.freeze({
+    forbidden: { httpStatus: 403, i18nKey: 'authz.error.forbidden' },
+    role_not_found: { httpStatus: 404, i18nKey: 'authz.error.role_not_found' },
+    permission_unknown: { httpStatus: 422, i18nKey: 'authz.error.permission_unknown' },
+    role_cycle: { httpStatus: 409, i18nKey: 'authz.error.role_cycle' },
+    assignment_exists: { httpStatus: 409, i18nKey: 'authz.error.assignment_exists' },
+    self_lockout: { httpStatus: 409, i18nKey: 'authz.error.self_lockout' },
+    escalation_denied: { httpStatus: 403, i18nKey: 'authz.error.escalation_denied' },
+    invalid_relation: { httpStatus: 422, i18nKey: 'authz.error.invalid_relation' },
+    unauthenticated: { httpStatus: 401, i18nKey: 'authz.error.unauthenticated' },
+    validation_failed: { httpStatus: 422, i18nKey: 'authz.error.validation_failed' },
+});
+/**
+ * Domein-fout die de backend-services gooien; de HTTP-laag (surface) mapt `code` via de taxonomie naar
+ * status. Draagt nooit gevoelige context mee.
+ */
+export class AuthzError extends Error {
+    code;
+    fields;
+    constructor(code, message, fields) {
+        super(message ?? code);
+        this.name = 'AuthzError';
+        this.code = code;
+        this.fields = fields;
+        Object.setPrototypeOf(this, AuthzError.prototype);
+    }
+    toBody() {
+        return this.fields
+            ? { code: this.code, message: this.message, fields: this.fields }
+            : { code: this.code, message: this.message };
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/contract/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../contract/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW;IACX,gBAAgB;IAChB,oBAAoB;IACpB,YAAY;IACZ,mBAAmB;IACnB,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;CACX,CAAC;AAWX,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAA2D,MAAM,CAAC,MAAM,CAAC;IACxG,SAAS,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAChE,cAAc,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC1E,kBAAkB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAClF,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAClE,iBAAiB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAChF,YAAY,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE;IACtE,iBAAiB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,+BAA+B,EAAE;IAChF,gBAAgB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE;IAC9E,eAAe,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAC5E,iBAAiB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,+BAA+B,EAAE;CACjF,CAAC,CAAC;AAUH;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAiB;IACrB,MAAM,CAAiD;IAChE,YAAY,IAAoB,EAAE,OAAgB,EAAE,MAAiC;QACnF,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IACD,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACjE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC;CACF"}

package/dist/contract/events.d.ts

@@ -0,0 +1,50 @@
+/**
+ * US-Z0103 — Domein-events. De module publiceert deze events (bv. voor audit-log US-Z0705 of
+ * host-hooks). Payloads bevatten identificatie, nooit policy-interne details of secret-materiaal.
+ */
+export declare const AUTHZ_EVENTS: readonly ["role.created", "role.updated", "role.deleted", "role.assigned", "role.revoked", "access.denied"];
+export type AuthzEventName = (typeof AUTHZ_EVENTS)[number];
+export interface AuthzEventBase {
+    readonly name: AuthzEventName;
+    /** ISO-8601 timestamp — door de host/klok geïnjecteerd, niet hier gegenereerd. */
+    readonly occurredAt: string;
+    /** Het subject dat de mutatie uitvoerde (de actor), voor audit-attributie. */
+    readonly actorId: string;
+}
+export interface RoleCreatedEvent extends AuthzEventBase {
+    readonly name: 'role.created';
+    readonly roleId: string;
+    readonly roleKey: string;
+}
+export interface RoleUpdatedEvent extends AuthzEventBase {
+    readonly name: 'role.updated';
+    readonly roleId: string;
+}
+export interface RoleDeletedEvent extends AuthzEventBase {
+    readonly name: 'role.deleted';
+    readonly roleId: string;
+}
+export interface RoleAssignedEvent extends AuthzEventBase {
+    readonly name: 'role.assigned';
+    readonly subjectId: string;
+    readonly roleId: string;
+}
+export interface RoleRevokedEvent extends AuthzEventBase {
+    readonly name: 'role.revoked';
+    readonly subjectId: string;
+    readonly roleId: string;
+}
+export interface AccessDeniedEvent extends AuthzEventBase {
+    readonly name: 'access.denied';
+    /** De gevraagde permissie of action (geen policy-interne details). */
+    readonly requested: string;
+    /** Optioneel resource-type/-id waartegen werd gecheckt. */
+    readonly resourceType?: string;
+    readonly resourceId?: string;
+}
+export type AuthzEvent = RoleCreatedEvent | RoleUpdatedEvent | RoleDeletedEvent | RoleAssignedEvent | RoleRevokedEvent | AccessDeniedEvent;
+/** Poort die de host levert om events te consumeren (audit-log/analytics/…). */
+export interface AuthzEventSink {
+    emit(event: AuthzEvent): void;
+}
+//# sourceMappingURL=events.d.ts.map

package/dist/contract/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../contract/events.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,YAAY,6GAOf,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AACD,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,UAAU,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC/B"}

package/dist/contract/events.js

@@ -0,0 +1,13 @@
+/**
+ * US-Z0103 — Domein-events. De module publiceert deze events (bv. voor audit-log US-Z0705 of
+ * host-hooks). Payloads bevatten identificatie, nooit policy-interne details of secret-materiaal.
+ */
+export const AUTHZ_EVENTS = [
+    'role.created',
+    'role.updated',
+    'role.deleted',
+    'role.assigned',
+    'role.revoked',
+    'access.denied',
+];
+//# sourceMappingURL=events.js.map

package/dist/contract/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../contract/events.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc;IACd,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,eAAe;CACP,CAAC"}

package/dist/contract/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * authorization — het contract (de seam). Eén bron waaruit backend-validatie én frontend-client hun
+ * types afleiden. Bevat geen mechanisme, alleen schema's/typen/taxonomie/events/permissie-catalogus.
+ */
+export * from './permissions.js';
+export * from './schemas.js';
+export * from './errors.js';
+export * from './events.js';
+export * from './endpoints.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/contract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../contract/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/contract/index.js

@@ -0,0 +1,10 @@
+/**
+ * authorization — het contract (de seam). Eén bron waaruit backend-validatie én frontend-client hun
+ * types afleiden. Bevat geen mechanisme, alleen schema's/typen/taxonomie/events/permissie-catalogus.
+ */
+export * from './permissions.js';
+export * from './schemas.js';
+export * from './errors.js';
+export * from './events.js';
+export * from './endpoints.js';
+//# sourceMappingURL=index.js.map

package/dist/contract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../contract/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/contract/permissions.d.ts

@@ -0,0 +1,35 @@
+/**
+ * US-Z0104 — Het permissie-catalogus-format (de seam voor "welke permissies bestaan").
+ *
+ * Permissies zijn **enforcement-punten in code**: de catalogus is code-declared en getypt, zodat een
+ * typefout een compile-fout wordt in plaats van een stille runtime-grant. Wélke subjects welke rollen
+ * hebben is daarentegen data (DB, US-Z0604). De host breidt de catalogus additief uit (US-Z1002); de
+ * backend synchroniseert de catalogus-rijen naar de DB (US-Z0203).
+ */
+/** Eén permissie in de catalogus: een stabiele sleutel + een i18n-bare omschrijving. */
+export interface PermissionDescriptor {
+    /** Stabiele, code-gerefereerde sleutel, bv. `authz.manage`. Puntgescheiden namespace-conventie. */
+    readonly key: string;
+    /** Menselijke omschrijving (of i18n-sleutel) — puur informatief, nooit een autorisatie-conditie. */
+    readonly description: string;
+}
+export type PermissionCatalog = readonly PermissionDescriptor[];
+/**
+ * De bootstrap-permissie waarmee de module zijn eigen beheer-endpoints bewaakt. De seed (US-Z0604)
+ * kent deze aan precies één first-admin toe; zonder deze permissie is geen enkele mutatie mogelijk.
+ */
+export declare const AUTHZ_MANAGE = "authz.manage";
+/**
+ * De permissies die de module zélf meebrengt. Een host voegt hier zijn eigen app-permissies aan toe
+ * (US-Z1002) door de catalogus samen te voegen; dubbele sleutels zijn een fout (zie {@link mergeCatalog}).
+ */
+export declare const AUTHZ_PERMISSIONS: readonly [{
+    readonly key: "authz.manage";
+    readonly description: "Beheer rollen, permissies en rol-toewijzingen";
+}];
+/**
+ * Voegt catalogi samen en weigert dubbele sleutels fail-fast — zo kan een host-uitbreiding nooit
+ * stilzwijgend een bestaande permissie-betekenis overschrijven.
+ */
+export declare function mergeCatalog(...catalogs: PermissionCatalog[]): PermissionCatalog;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/contract/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../contract/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,mGAAmG;IACnG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,oBAAoB,EAAE,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;EAEQ,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,QAAQ,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAWhF"}

package/dist/contract/permissions.js

@@ -0,0 +1,37 @@
+/**
+ * US-Z0104 — Het permissie-catalogus-format (de seam voor "welke permissies bestaan").
+ *
+ * Permissies zijn **enforcement-punten in code**: de catalogus is code-declared en getypt, zodat een
+ * typefout een compile-fout wordt in plaats van een stille runtime-grant. Wélke subjects welke rollen
+ * hebben is daarentegen data (DB, US-Z0604). De host breidt de catalogus additief uit (US-Z1002); de
+ * backend synchroniseert de catalogus-rijen naar de DB (US-Z0203).
+ */
+/**
+ * De bootstrap-permissie waarmee de module zijn eigen beheer-endpoints bewaakt. De seed (US-Z0604)
+ * kent deze aan precies één first-admin toe; zonder deze permissie is geen enkele mutatie mogelijk.
+ */
+export const AUTHZ_MANAGE = 'authz.manage';
+/**
+ * De permissies die de module zélf meebrengt. Een host voegt hier zijn eigen app-permissies aan toe
+ * (US-Z1002) door de catalogus samen te voegen; dubbele sleutels zijn een fout (zie {@link mergeCatalog}).
+ */
+export const AUTHZ_PERMISSIONS = [
+    { key: AUTHZ_MANAGE, description: 'Beheer rollen, permissies en rol-toewijzingen' },
+];
+/**
+ * Voegt catalogi samen en weigert dubbele sleutels fail-fast — zo kan een host-uitbreiding nooit
+ * stilzwijgend een bestaande permissie-betekenis overschrijven.
+ */
+export function mergeCatalog(...catalogs) {
+    const byKey = new Map();
+    for (const catalog of catalogs) {
+        for (const descriptor of catalog) {
+            if (byKey.has(descriptor.key)) {
+                throw new Error(`Dubbele permissie-sleutel in catalogus: "${descriptor.key}"`);
+            }
+            byKey.set(descriptor.key, descriptor);
+        }
+    }
+    return [...byKey.values()];
+}
+//# sourceMappingURL=permissions.js.map

package/dist/contract/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../contract/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,+CAA+C,EAAE;CAC/C,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAG,QAA6B;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,4CAA4C,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;YACjF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC"}

package/dist/contract/schemas.d.ts

@@ -0,0 +1,288 @@
+import { z } from 'zod';
+/**
+ * US-Z0101 — DTO-schema's (de seam). Eén set Zod-schema's waaruit de backend valideert én de frontend
+ * zijn getypte client afleidt (`z.infer`). Rol-/permissie-namen zijn data; de vorm + minimale
+ * invarianten staan hier. Geen policy-logica — die zit in de `access-control`-kit.
+ */
+/** Puntgescheiden sleutel-conventie (`authz.manage`, `article.write`), geen spaties. */
+export declare const permissionKeySchema: z.ZodString;
+/** Rol-sleutel: kleine letters/cijfers + scheidingstekens (`admin`, `content-editor`). */
+export declare const roleKeySchema: z.ZodString;
+export declare const subjectIdSchema: z.ZodString;
+export declare const roleIdSchema: z.ZodString;
+export declare const roleSchema: z.ZodObject<{
+    id: z.ZodString;
+    key: z.ZodString;
+    name: z.ZodString;
+    permissions: z.ZodArray<z.ZodString, "many">;
+    /** Rol-hiërarchie: de bovenliggende rol waarvan deze rol de permissies erft; `null` = geen ouder. */
+    parentRoleId: z.ZodNullable<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    key: string;
+    name: string;
+    permissions: string[];
+    parentRoleId: string | null;
+}, {
+    id: string;
+    key: string;
+    name: string;
+    permissions: string[];
+    parentRoleId: string | null;
+}>;
+export declare const roleListResponseSchema: z.ZodObject<{
+    roles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        key: z.ZodString;
+        name: z.ZodString;
+        permissions: z.ZodArray<z.ZodString, "many">;
+        /** Rol-hiërarchie: de bovenliggende rol waarvan deze rol de permissies erft; `null` = geen ouder. */
+        parentRoleId: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }, {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    roles: {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }[];
+}, {
+    roles: {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }[];
+}>;
+export declare const createRoleRequestSchema: z.ZodObject<{
+    key: z.ZodString;
+    name: z.ZodString;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    parentRoleId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    name: string;
+    permissions: string[];
+    parentRoleId: string | null;
+}, {
+    key: string;
+    name: string;
+    permissions?: string[] | undefined;
+    parentRoleId?: string | null | undefined;
+}>;
+/** Alle velden optioneel: een PATCH die alleen de aangeleverde velden wijzigt. */
+export declare const updateRoleRequestSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    parentRoleId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    name?: string | undefined;
+    permissions?: string[] | undefined;
+    parentRoleId?: string | null | undefined;
+}, {
+    name?: string | undefined;
+    permissions?: string[] | undefined;
+    parentRoleId?: string | null | undefined;
+}>;
+export declare const permissionSchema: z.ZodObject<{
+    key: z.ZodString;
+    description: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    key: string;
+    description: string;
+}, {
+    key: string;
+    description: string;
+}>;
+export declare const permissionListResponseSchema: z.ZodObject<{
+    permissions: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        description: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        key: string;
+        description: string;
+    }, {
+        key: string;
+        description: string;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    permissions: {
+        key: string;
+        description: string;
+    }[];
+}, {
+    permissions: {
+        key: string;
+        description: string;
+    }[];
+}>;
+export declare const assignmentRequestSchema: z.ZodObject<{
+    subjectId: z.ZodString;
+    roleId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    subjectId: string;
+    roleId: string;
+}, {
+    subjectId: string;
+    roleId: string;
+}>;
+export declare const subjectRolesResponseSchema: z.ZodObject<{
+    subjectId: z.ZodString;
+    roles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        key: z.ZodString;
+        name: z.ZodString;
+        permissions: z.ZodArray<z.ZodString, "many">;
+        /** Rol-hiërarchie: de bovenliggende rol waarvan deze rol de permissies erft; `null` = geen ouder. */
+        parentRoleId: z.ZodNullable<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }, {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    roles: {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }[];
+    subjectId: string;
+}, {
+    roles: {
+        id: string;
+        key: string;
+        name: string;
+        permissions: string[];
+        parentRoleId: string | null;
+    }[];
+    subjectId: string;
+}>;
+export declare const mePermissionsResponseSchema: z.ZodObject<{
+    subjectId: z.ZodString;
+    roles: z.ZodArray<z.ZodString, "many">;
+    permissions: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    permissions: string[];
+    roles: string[];
+    subjectId: string;
+}, {
+    permissions: string[];
+    roles: string[];
+    subjectId: string;
+}>;
+export declare const checkRequestSchema: z.ZodEffects<z.ZodObject<{
+    /** RBAC-vorm: heeft het huidige subject deze permissie? */
+    permission: z.ZodOptional<z.ZodString>;
+    /** PDP-vorm: is deze action toegestaan (evt. tegen een resource, voor ReBAC/ownership)? */
+    action: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        type?: string | undefined;
+    }, {
+        id: string;
+        type?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    permission?: string | undefined;
+    action?: string | undefined;
+    resource?: {
+        id: string;
+        type?: string | undefined;
+    } | undefined;
+}, {
+    permission?: string | undefined;
+    action?: string | undefined;
+    resource?: {
+        id: string;
+        type?: string | undefined;
+    } | undefined;
+}>, {
+    permission?: string | undefined;
+    action?: string | undefined;
+    resource?: {
+        id: string;
+        type?: string | undefined;
+    } | undefined;
+}, {
+    permission?: string | undefined;
+    action?: string | undefined;
+    resource?: {
+        id: string;
+        type?: string | undefined;
+    } | undefined;
+}>;
+export declare const checkResponseSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+    /** Veilige, niet-lekkende reden (geen policy-interne details). */
+    reason: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    allowed: boolean;
+    reason: string;
+}, {
+    allowed: boolean;
+    reason: string;
+}>;
+export declare const relationRequestSchema: z.ZodObject<{
+    subjectId: z.ZodString;
+    relation: z.ZodString;
+    objectType: z.ZodString;
+    objectId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    subjectId: string;
+    relation: string;
+    objectType: string;
+    objectId: string;
+}, {
+    subjectId: string;
+    relation: string;
+    objectType: string;
+    objectId: string;
+}>;
+export declare const acknowledgementSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, "strip", z.ZodTypeAny, {
+    ok: true;
+}, {
+    ok: true;
+}>;
+export type Role = z.infer<typeof roleSchema>;
+export type RoleListResponse = z.infer<typeof roleListResponseSchema>;
+export type CreateRoleRequest = z.infer<typeof createRoleRequestSchema>;
+export type UpdateRoleRequest = z.infer<typeof updateRoleRequestSchema>;
+export type Permission = z.infer<typeof permissionSchema>;
+export type PermissionListResponse = z.infer<typeof permissionListResponseSchema>;
+export type AssignmentRequest = z.infer<typeof assignmentRequestSchema>;
+export type SubjectRolesResponse = z.infer<typeof subjectRolesResponseSchema>;
+export type MePermissionsResponse = z.infer<typeof mePermissionsResponseSchema>;
+export type CheckRequest = z.infer<typeof checkRequestSchema>;
+export type CheckResponse = z.infer<typeof checkResponseSchema>;
+export type RelationRequest = z.infer<typeof relationRequestSchema>;
+export type Acknowledgement = z.infer<typeof acknowledgementSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/contract/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../contract/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAGH,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,aAIyC,CAAC;AAC1E,0FAA0F;AAC1F,eAAO,MAAM,aAAa,aAIwC,CAAC;AACnE,eAAO,MAAM,eAAe,aAAoB,CAAC;AACjD,eAAO,MAAM,YAAY,aAAoB,CAAC;AAG9C,eAAO,MAAM,UAAU;;;;;IAKrB,qGAAqG;;;;;;;;;;;;;;EAErG,CAAC;AACH,eAAO,MAAM,sBAAsB;;;;;;QAHjC,qGAAqG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGzB,CAAC;AAE/E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAC;AACH,kFAAkF;AAClF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;EAIlC,CAAC;AAGH,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAC;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;EAAuD,CAAC;AAGjG,eAAO,MAAM,uBAAuB;;;;;;;;;EAGlC,CAAC;AACH,eAAO,MAAM,0BAA0B;;;;;;;QA9BrC,qGAAqG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCrG,CAAC;AAGH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;EAItC,CAAC;AAGH,eAAO,MAAM,kBAAkB;IAE3B,2DAA2D;;IAE3D,2FAA2F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM3F,CAAC;AACL,eAAO,MAAM,mBAAmB;;IAE9B,kEAAkE;;;;;;;;EAElE,CAAC;AAGH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAKhC,CAAC;AAGH,eAAO,MAAM,qBAAqB;;;;;;EAAoC,CAAC;AAGvE,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAC9C,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}