@spinajs/authz-http-admin 0.0.0-stage → 3.0.0

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
+# `@spinajs/authz-http-admin`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Admin routes over the SpinaJS authorization management API (`AuthzAdmin`,
+design §6.6.5).
+
+## Routes
+
+| Route | Runs |
+|---|---|
+| `POST /authz/commands` `{ commands, reason?, idempotencyKey?, dryRun? }` | `execute` |
+| `GET /authz/assignments?scope=&subject=&role=&includeExpired=&limit=&offset=` | `list({ kind: 'assignments' })` |
+| `POST /authz/assignments`, `PATCH`/`DELETE /authz/assignments/:id` | `assignment.*` |
+| `GET`/`POST /authz/links`, `PATCH`/`DELETE /authz/links/:id` | `link.*` |
+| `GET /authz/rules`, `PUT`/`DELETE /authz/rules/:id` | `rule.*` |
+| `GET /authz/holders?scope=&permission=&expandSets=&limit=&offset=` | `list({ kind: 'holders' })` |
+| `GET /authz/policies`, `PUT`/`DELETE /authz/policies/:id` | `policy.*` |
+| `GET`/`PATCH`/`PUT /authz/scopes/:type/:id/attributes` | `scope.*` |
+
+- The routes check only that the caller is authenticated (401 otherwise).
+  The caller's principal is the actor; every permission, validation and
+  guard check runs inside `AuthzAdmin`, so an HTTP call and an in-process
+  call get the same answer.
+- Query encodings: `scope` is `<type>` or `<type>:<id>`; `subject` is
+  `<type>:<id>` or `set:<role>@<type>:<id>`. On the single-command routes
+  `reason`, `idempotencyKey` and `dryRun` go in the query string.
+- Writes answer `{ results }`; a failed command sets the status (403 for
+  `forbidden`, `escalation`, `last_holder`, `self_lockout`,
+  `protected_role`; 404 `not_found`; 409 `conflict`; 400 otherwise).
+  Lists answer `{ items, total }`.
+- `GET /authz/holders` lists who holds `permission` on `scope` (both
+  required; `expandSets=true` also lists set members). It answers `{ items,
+  total }`, or 400 `invalid_query` for a missing or unknown value, 401, and
+  403 `forbidden` (the caller needs `authz:holders.read` at the resource).
+  See [Holders](../../docs/authz/13-holders.md).
+- A link token is shown once: only in the answer of `POST /authz/links` or
+  of the `POST /authz/commands` batch that created it. Both routes send
+  `Cache-Control: no-store`.
+
+## Configuration
+
+- `authz.http.admin.domain` (default `root`): the authz domain whose
+  `AuthzAdmin` the routes use.
+- The package ships no `AdminGuard`; `AuthzAdmin` runs the one named in
+  `authz.admin.guard.service` (`DefaultAdminGuard` from
+  `@spinajs/authz-rbac`).
+
+## Swagger
+
+http-swagger documents the routes and their answers. It cannot see the
+request bodies and query parameters, because the routes read them from the
+request so that no http-layer check can refuse what `AuthzAdmin` would
+answer. Pass the built document through `describeAuthzAdminDocument(doc)` to
+add them.

package/lib/cjs/config/authz-http-admin.d.ts

@@ -0,0 +1,9 @@
+declare const authzHttpAdmin: {
+    system: {
+        dirs: {
+            controllers: string[];
+        };
+    };
+};
+export default authzHttpAdmin;
+//# sourceMappingURL=authz-http-admin.d.ts.map

package/lib/cjs/config/authz-http-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-http-admin.d.ts","sourceRoot":"","sources":["../../../src/config/authz-http-admin.ts"],"names":[],"mappings":"AAOA,QAAA,MAAM,cAAc;IAClB,MAAM;QACJ,IAAI;YACF,WAAW;;;CAGhB,CAAC;eAEa,cAAc"}

package/lib/cjs/config/authz-http-admin.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = require("path");
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'authz-http-admin', 'lib', inCommonJs ? 'cjs' : 'mjs', path)));
+}
+const authzHttpAdmin = {
+    system: {
+        dirs: {
+            controllers: [dir('controllers')],
+        },
+    },
+};
+exports.default = authzHttpAdmin;
+//# sourceMappingURL=authz-http-admin.js.map

package/lib/cjs/config/authz-http-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-http-admin.js","sourceRoot":"","sources":["../../../src/config/authz-http-admin.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7K,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;SAClC;KACF;CACF,CAAC;kBAEa,cAAc"}

package/lib/cjs/controllers/AuthzAdminController.d.ts

@@ -0,0 +1,249 @@
+import { AuthzDomains } from '@spinajs/authz';
+import type { AuthzAdmin, AuthzAdminQuery, AuthzCommand } from '@spinajs/authz';
+import { BaseController } from '@spinajs/http';
+import type { Request, Response } from '@spinajs/http';
+import '../schemas/provider.js';
+/**
+ * Admin routes over the management API of the configured domain (`authz.http.admin.domain`).
+ *
+ * The routes check authentication only: the actor is always the request principal, and every
+ * permission, validation and guard check runs in AuthzAdmin, as for an in-process caller (design
+ * §6.6.5). A refused request answers `{ error: { code, message, field? } }`; a write answers
+ * `{ results }`, one entry per command.
+ *
+ * @tags Authz admin
+ */
+export declare class AuthzAdminController extends BaseController {
+    protected AdminDomain: string;
+    protected Domains: AuthzDomains;
+    /** Runs a route on the domain's AuthzAdmin; an AuthzAdminFailure becomes its status with `{ error }`, anything else propagates. */
+    protected guarded(fn: (admin: AuthzAdmin) => Promise<Response>): Promise<Response>;
+    /** One batch built from the route, with the options of the query string. */
+    protected single(req: Request, build: () => AuthzCommand[]): Promise<Response<any>>;
+    protected list(req: Request, build: () => AuthzAdminQuery): Promise<Response<any>>;
+    /**
+     * Run a batch of commands
+     * Runs the commands in order in one transaction on the configured domain; the first failure rolls the batch back and its status is the answer.
+     * Body: { commands, reason?, idempotencyKey?, dryRun? } (schema AuthzAdminBatch); `commands` lists the command kinds of AuthzCommand, with dates as ISO 8601 strings. The options go in the body, not the query string.
+     * The result of a link.create carries the link token, shown once: every answer the route sends carries `Cache-Control: no-store` (the 401 of the authentication check comes before the route and holds no token), and a retried or dry-run batch answers without the token.
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    commands(req: Request): Promise<Response<any>>;
+    /**
+     * List assignments
+     * Lists assignments, filtered by the query.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `subject` (`<type>:<id>` or `set:<role>@<type>:<id>`), `role`, `includeExpired` (`true` or `false`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    listAssignments(req: Request): Promise<Response<any>>;
+    /**
+     * List holders
+     * Who holds a permission on a resource through role assignments on it, its ancestors or $global; each principal is verified by a fresh check.
+     * Query: `scope` (`<type>:<id>`), `permission`, `expandSets` (`true` or `false`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of holders
+     * @response 400 {AuthzAdminError} invalid_query: a malformed or missing query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks authz:holders.read at the resource, or the resource is unknown
+     */
+    listHolders(req: Request): Promise<Response<any>>;
+    /**
+     * Grant a role
+     * Grants a role to a subject at a scope (assignment.grant).
+     * Body: the fields of assignment.grant without `kind` (schema AuthzAssignmentGrant).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    grant(req: Request): Promise<Response<any>>;
+    /**
+     * Change an assignment
+     * Changes the tags or the expiry of an assignment.
+     * Body: { tags?, addTags?, removeTags?, expiresAt? } with at least one key (schema AuthzAssignmentPatch); the keys run as one batch.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    patchAssignment(req: Request): Promise<Response<any>>;
+    /**
+     * Revoke an assignment
+     * Revokes the assignment with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    revoke(req: Request): Promise<Response<any>>;
+    /**
+     * List share links
+     * Lists the share links, filtered by the query. A listing never carries a token or its hash: the token is shown once, when the link is created.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    listLinks(req: Request): Promise<Response<any>>;
+    /**
+     * Create a share link
+     * Creates a share link that grants a role at a scope (link.create). The result carries the link id and its token: the token is shown once, here, and every answer the route sends carries `Cache-Control: no-store` (the 401 of the authentication check comes before the route and holds no token). A dry run or a retried request (same idempotency key) answers without the token.
+     * Body: the fields of link.create without `kind` (schema AuthzLinkCreate).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} The link was created; results[0] holds its id and token
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    createLink(req: Request): Promise<Response<any>>;
+    /**
+     * Change a share link
+     * Changes the expiry, attributes, role or tags of the link with the path id (link.update). The answer never carries the token.
+     * Body: { expiresAt?, attributes?, role?, tags? } with at least one key (schema AuthzLinkPatch); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    patchLink(req: Request): Promise<Response<any>>;
+    /**
+     * Revoke a share link
+     * Revokes the link with the path id and the role it grants (link.revoke); its token opens nothing from then on.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    revokeLink(req: Request): Promise<Response<any>>;
+    /**
+     * List rules
+     * Lists the RBAC rules held as rows.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    listRules(req: Request): Promise<Response<any>>;
+    /**
+     * Put a rule
+     * Inserts or replaces the RBAC rule with the path id.
+     * Body: a rule (schema AuthzRuleBody); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    putRule(req: Request): Promise<Response<any>>;
+    /**
+     * Delete a rule
+     * Deletes the RBAC rule with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    deleteRule(req: Request): Promise<Response<any>>;
+    /**
+     * List policies
+     * Lists the ABAC policies held as rows.
+     * Query: `scope` (`<type>` or `<type>:<id>`), `limit`, `offset`.
+     * @response 200 {AuthzAdminPage} One page of rows
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    listPolicies(req: Request): Promise<Response<any>>;
+    /**
+     * Put a policy
+     * Inserts or replaces the ABAC policy with the path id.
+     * Body: a policy (schema AuthzPolicyBody); an `id` in the body must equal the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    putPolicy(req: Request): Promise<Response<any>>;
+    /**
+     * Delete a policy
+     * Deletes the ABAC policy with the path id.
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    deletePolicy(req: Request): Promise<Response<any>>;
+    /**
+     * Read scope attributes
+     * Returns the attributes of the scope node `<type>:<id>`.
+     * @response 200 {AuthzAdminPage} items holds one entry, the attributes object of the scope; total is 1
+     * @response 400 {AuthzAdminError} invalid_query: a malformed query parameter
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
+     */
+    attributes(req: Request): Promise<Response<any>>;
+    /**
+     * Merge scope attributes
+     * Deep-merges the body into the attributes of the scope node; null deletes a path.
+     * Body: an object (schema AuthzAttributesPatch).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    patchAttributes(req: Request): Promise<Response<any>>;
+    /**
+     * Replace scope attributes
+     * Replaces all attributes of the scope node with the body.
+     * Body: an object (schema AuthzAttributesBody).
+     * Query: `reason` (audit text), `idempotencyKey`, `dryRun` (`true` validates and guards, then rolls back).
+     * @response 200 {AuthzAdminResults} Every command succeeded
+     * @response 400 {AuthzAdminError} invalid_request, invalid_query (an option of the query string), invalid_batch or a validation code of the command
+     * @response 401 Unauthorized: a valid session or token is required
+     * @response 403 {AuthzAdminError} forbidden, escalation, last_holder, self_lockout or protected_role
+     * @response 404 {AuthzAdminError} not_found: a row the command names does not exist
+     * @response 409 {AuthzAdminError} conflict: the row changed or exists already
+     */
+    replaceAttributes(req: Request): Promise<Response<any>>;
+}
+//# sourceMappingURL=AuthzAdminController.d.ts.map

package/lib/cjs/controllers/AuthzAdminController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthzAdminController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AuthzAdminController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAqB,eAAe,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAC3H,OAAO,EAAsB,cAAc,EAAgG,MAAM,eAAe,CAAC;AACjK,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIvD,OAAO,wBAAwB,CAAC;AAkEhC;;;;;;;;;GASG;AACH,qBAEa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAG9B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAEhC,mIAAmI;IACnI,UAAgB,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQvF;IAED,4EAA4E;IAC5E,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,EAAE,0BAKzD;IAED,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,0BAExD;IAED;;;;;;;;;;;OAWG;IAEU,QAAQ,CAAQ,GAAG,EAAE,OAAO,0BAQxC;IAED;;;;;;;;OAQG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAQ,GAAG,EAAE,OAAO,0BAE3C;IAED;;;;;;;;;;;OAWG;IAEU,KAAK,CAAQ,GAAG,EAAE,OAAO,0BAErC;IAED;;;;;;;;;;;OAWG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAY/C;IAED;;;;;;;;;;OAUG;IAEU,MAAM,CAAQ,GAAG,EAAE,OAAO,0BAEtC;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAG1C;IAED;;;;;;;;;;;OAWG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;OAUG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,OAAO,CAAQ,GAAG,EAAE,OAAO,0BAEvC;IAED;;;;;;;;;;OAUG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;;;;;OAWG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;OAUG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;OAOG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;;;;OAWG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;;;;OAWG;IAEU,iBAAiB,CAAQ,GAAG,EAAE,OAAO,0BAEjD;CACF"}