@spinajs/authz-http-admin 3.0.13 → 3.0.15

package/lib/cjs/schemas/primitives.d.ts

@@ -3,12 +3,19 @@ export declare const text: JsonSchema;
 export declare const nullableDateTime: JsonSchema;
 export declare const tags: JsonSchema;
 export declare const anyObject: JsonSchema;
+export declare const rowId: JsonSchema;
+export declare const roleName: JsonSchema;
 export declare const resourceRef: JsonSchema;
 export declare const principalRef: JsonSchema;
+export declare function obj(required: readonly string[], properties: Record<string, JsonSchema>, description?: string): JsonSchema;
+/** An object that refuses keys it does not list. */
+export declare function closed(required: readonly string[], properties: Record<string, JsonSchema>, description?: string): JsonSchema;
 export declare const roleSet: JsonSchema;
 export declare const subjectSet: JsonSchema;
 export declare const assignmentSubject: JsonSchema;
-export declare function obj(required: readonly string[], properties: Record<string, JsonSchema>, description?: string): JsonSchema;
+export declare const writeOptions: Record<string, JsonSchema>;
+/** The body of POST /authz/commands with `items` as the schema of one command. */
+export declare function batchOf(items: JsonSchema): JsonSchema;
 /** The body of POST /authz/commands over the given command schemas. */
 export declare function commandBatch(commands: readonly JsonSchema[]): JsonSchema;
 export declare function command(kind: string, required: readonly string[], properties: Record<string, JsonSchema>, description: string): JsonSchema;

package/lib/cjs/schemas/primitives.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../../../src/schemas/primitives.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,eAAO,MAAM,IAAI,EAAE,UAA+B,CAAC;AACnD,eAAO,MAAM,gBAAgB,EAAE,UAAmK,CAAC;AACnM,eAAO,MAAM,IAAI,EAAE,UAA2C,CAAC;AAC/D,eAAO,MAAM,SAAS,EAAE,UAA2D,CAAC;AAEpF,eAAO,MAAM,WAAW,EAAE,UAIzB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,UAI1B,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,UAA4G,CAAC;AAEnI,eAAO,MAAM,UAAU,EAAE,UAAgF,CAAC;AAE1G,eAAO,MAAM,iBAAiB,EAAE,UAAmH,CAAC;AAEpJ,wBAAgB,GAAG,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAEzH;AAQD,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAExE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAE1I"}
+{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../../../src/schemas/primitives.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,eAAO,MAAM,IAAI,EAAE,UAA+B,CAAC;AACnD,eAAO,MAAM,gBAAgB,EAAE,UAAmK,CAAC;AACnM,eAAO,MAAM,IAAI,EAAE,UAA2C,CAAC;AAC/D,eAAO,MAAM,SAAS,EAAE,UAA2D,CAAC;AACpF,eAAO,MAAM,KAAK,EAAE,UAA2B,CAAC;AAChD,eAAO,MAAM,QAAQ,EAAE,UAA6B,CAAC;AAErD,eAAO,MAAM,WAAW,EAAE,UAKzB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,UAAsF,CAAC;AAElH,wBAAgB,GAAG,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAEzH;AAED,oDAAoD;AACpD,wBAAgB,MAAM,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,CAE5H;AAED,eAAO,MAAM,OAAO,EAAE,UAA8E,CAAC;AAErG,eAAO,MAAM,UAAU,EAAE,UAA8C,CAAC;AAExE,eAAO,MAAM,iBAAiB,EAAE,UAAmH,CAAC;AAEpJ,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAInD,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAErD;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAExE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAE1I"}

package/lib/cjs/schemas/primitives.js

@@ -1,39 +1,49 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.assignmentSubject = exports.subjectSet = exports.roleSet = exports.principalRef = exports.resourceRef = exports.anyObject = exports.tags = exports.nullableDateTime = exports.text = void 0;
+exports.writeOptions = exports.assignmentSubject = exports.subjectSet = exports.roleSet = exports.principalRef = exports.resourceRef = exports.roleName = exports.rowId = exports.anyObject = exports.tags = exports.nullableDateTime = exports.text = void 0;
 exports.obj = obj;
+exports.closed = closed;
+exports.batchOf = batchOf;
 exports.commandBatch = commandBatch;
 exports.command = command;
+const authz_1 = require("@spinajs/authz");
 exports.text = { type: 'string' };
 exports.nullableDateTime = { type: 'string', format: 'date-time', nullable: true, description: 'ISO 8601 date-time with Z or an offset, read as a Date; null clears the expiry' };
 exports.tags = { type: 'array', items: exports.text };
 exports.anyObject = { type: 'object', additionalProperties: true };
+exports.rowId = { ...authz_1.idField };
+exports.roleName = { ...authz_1.nameField };
 exports.resourceRef = {
     type: 'object',
+    additionalProperties: false,
     required: ['type'],
-    properties: { type: exports.text, id: { ...exports.text, description: 'absent for a type-level scope' } },
+    properties: { type: { ...authz_1.typeField }, id: { ...authz_1.idField, description: 'absent for a type-level scope' } },
 };
-exports.principalRef = {
-    type: 'object',
-    required: ['type', 'id'],
-    properties: { type: exports.text, id: exports.text },
-};
-exports.roleSet = { type: 'object', required: ['role', 'scope'], properties: { role: exports.text, scope: exports.resourceRef } };
-exports.subjectSet = { type: 'object', required: ['set'], properties: { set: exports.roleSet } };
-exports.assignmentSubject = { description: 'A principal, or the holders of a role at a scope', oneOf: [exports.principalRef, exports.subjectSet] };
+exports.principalRef = { ...authz_1.principalRefField, properties: { ...authz_1.principalRefField.properties } };
 function obj(required, properties, description) {
     return { type: 'object', ...(description ? { description } : {}), ...(required.length ? { required } : {}), properties };
 }
-const writeOptions = {
-    reason: { ...exports.text, description: 'goes to the audit trail' },
-    idempotencyKey: { ...exports.text, description: 'a retried batch with the same key returns the first result' },
+/** An object that refuses keys it does not list. */
+function closed(required, properties, description) {
+    return { ...obj(required, properties, description), additionalProperties: false };
+}
+exports.roleSet = closed(['role', 'scope'], { role: exports.roleName, scope: exports.resourceRef });
+exports.subjectSet = closed(['set'], { set: exports.roleSet });
+exports.assignmentSubject = { description: 'A principal, or the holders of a role at a scope', oneOf: [exports.principalRef, exports.subjectSet] };
+exports.writeOptions = {
+    reason: { ...authz_1.reasonField, description: 'goes to the audit trail' },
+    idempotencyKey: { ...authz_1.idempotencyKeyField, description: 'a retried request with the same key returns the first result' },
     dryRun: { type: 'boolean', description: 'validate and guard, then roll back' },
 };
+/** The body of POST /authz/commands with `items` as the schema of one command. */
+function batchOf(items) {
+    return closed(['commands'], { commands: { type: 'array', items }, ...exports.writeOptions }, 'POST /authz/commands: the commands run in one transaction, in order; the first failure rolls the batch back');
+}
 /** The body of POST /authz/commands over the given command schemas. */
 function commandBatch(commands) {
-    return obj(['commands'], { commands: { type: 'array', items: { oneOf: commands } }, ...writeOptions }, 'POST /authz/commands: the commands run in one transaction, in order; the first failure rolls the batch back');
+    return batchOf({ oneOf: commands });
 }
 function command(kind, required, properties, description) {
-    return obj(['kind', ...required], { kind: { type: 'string', enum: [kind] }, ...properties }, description);
+    return closed(['kind', ...required], { kind: { type: 'string', enum: [kind] }, ...properties }, description);
 }
 //# sourceMappingURL=primitives.js.map

package/lib/cjs/schemas/primitives.js.map

@@ -1 +1 @@
-{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../../../src/schemas/primitives.ts"],"names":[],"mappings":";;;;;;AAEa,QAAA,IAAI,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtC,QAAA,gBAAgB,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;AACtL,QAAA,IAAI,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAA,IAAI,EAAE,CAAC;AAClD,QAAA,SAAS,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AAEvE,QAAA,WAAW,GAAe;IACrC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAA,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,QAAA,IAAI,EAAE,WAAW,EAAE,+BAA+B,EAAE,EAAE;CAC1F,CAAC;AAEW,QAAA,YAAY,GAAe;IACtC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC;IACxB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAA,IAAI,EAAE,EAAE,EAAE,QAAA,IAAI,EAAE;CACrC,CAAC;AAEW,QAAA,OAAO,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAA,IAAI,EAAE,KAAK,EAAE,QAAA,WAAW,EAAE,EAAE,CAAC;AAEtH,QAAA,UAAU,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,QAAA,OAAO,EAAE,EAAE,CAAC;AAE7F,QAAA,iBAAiB,GAAe,EAAE,WAAW,EAAE,kDAAkD,EAAE,KAAK,EAAE,CAAC,QAAA,YAAY,EAAE,QAAA,UAAU,CAAC,EAAE,CAAC;AAEpJ,aAAoB,QAA2B,EAAE,UAAsC,EAAE,WAAoB;IAC3G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;AAC3H,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,EAAE,GAAG,QAAA,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC3D,cAAc,EAAE,EAAE,GAAG,QAAA,IAAI,EAAE,WAAW,EAAE,4DAA4D,EAAE;IACtG,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE;CAC/E,CAAC;AAEF,uEAAuE;AACvE,sBAA6B,QAA+B;IAC1D,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,6GAA6G,CAAC,CAAC;AACxN,CAAC;AAED,iBAAwB,IAAY,EAAE,QAA2B,EAAE,UAAsC,EAAE,WAAmB;IAC5H,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAC5G,CAAC"}
+{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../../../src/schemas/primitives.ts"],"names":[],"mappings":";;;;;;;;AAAA,0CAAoH;AAIvG,QAAA,IAAI,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtC,QAAA,gBAAgB,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;AACtL,QAAA,IAAI,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAA,IAAI,EAAE,CAAC;AAClD,QAAA,SAAS,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACvE,QAAA,KAAK,GAAe,EAAE,GAAG,eAAO,EAAE,CAAC;AACnC,QAAA,QAAQ,GAAe,EAAE,GAAG,iBAAS,EAAE,CAAC;AAExC,QAAA,WAAW,GAAe;IACrC,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,iBAAS,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,eAAO,EAAE,WAAW,EAAE,+BAA+B,EAAE,EAAE;CACzG,CAAC;AAEW,QAAA,YAAY,GAAe,EAAE,GAAG,yBAAiB,EAAE,UAAU,EAAE,EAAE,GAAG,yBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC;AAElH,aAAoB,QAA2B,EAAE,UAAsC,EAAE,WAAoB;IAC3G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;AAC3H,CAAC;AAED,oDAAoD;AACpD,gBAAuB,QAA2B,EAAE,UAAsC,EAAE,WAAoB;IAC9G,OAAO,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC;AAEY,QAAA,OAAO,GAAe,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,QAAA,QAAQ,EAAE,KAAK,EAAE,QAAA,WAAW,EAAE,CAAC,CAAC;AAExF,QAAA,UAAU,GAAe,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,QAAA,OAAO,EAAE,CAAC,CAAC;AAE3D,QAAA,iBAAiB,GAAe,EAAE,WAAW,EAAE,kDAAkD,EAAE,KAAK,EAAE,CAAC,QAAA,YAAY,EAAE,QAAA,UAAU,CAAC,EAAE,CAAC;AAEvI,QAAA,YAAY,GAA+B;IACtD,MAAM,EAAE,EAAE,GAAG,mBAAW,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAClE,cAAc,EAAE,EAAE,GAAG,2BAAmB,EAAE,WAAW,EAAE,8DAA8D,EAAE;IACvH,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oCAAoC,EAAE;CAC/E,CAAC;AAEF,kFAAkF;AAClF,iBAAwB,KAAiB;IACvC,OAAO,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,QAAA,YAAY,EAAE,EAAE,6GAA6G,CAAC,CAAC;AACtM,CAAC;AAED,uEAAuE;AACvE,sBAA6B,QAA+B;IAC1D,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,iBAAwB,IAAY,EAAE,QAA2B,EAAE,UAAsC,EAAE,WAAmB;IAC5H,OAAO,MAAM,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;AAC/G,CAAC"}

package/lib/cjs/schemas/provider.d.ts

@@ -1,12 +1,12 @@
 import { SchemaProvider } from '@spinajs/validation';
 import type { JsonSchema } from './primitives.js';
 import { AuthzCommandSchemaRegistry } from './registry.js';
-/** Every schema of the admin routes by name, as the swagger document names them, over the built-in commands. */
+/** The answer and error schemas of the admin routes by name, as the swagger document names them. Request schemas live on the DTOs. */
 export declare const AUTHZ_ADMIN_SCHEMAS: Readonly<Record<string, JsonSchema>>;
 /**
- * Serves the schemas to http-swagger by the type names the controller's `@response` tags use.
- * Nothing but the swagger builder asks a SchemaProvider: request validation reads `@Schema`
- * metadata and route argument schemas, neither of which these routes carry.
+ * Serves the answer schemas and the batch body to http-swagger by the type names the controller's
+ * `@response` tags and `describeAuthzAdminDocument` use. The batch body is built from the registered
+ * AuthzCommandSchemaSources on every call, as the batch route validates against it.
  */
 export declare class AuthzAdminSchemaProvider extends SchemaProvider {
     protected Registry: AuthzCommandSchemaRegistry;

package/lib/cjs/schemas/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/schemas/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAE3D,gHAAgH;AAChH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAiB,CAAC;AAEvF;;;;GAIG;AACH,qBACa,wBAAyB,SAAQ,cAAc;IAE1D,SAAS,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAE/C,2GAA2G;IACpG,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAErD;IAEM,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAGtE;CACF"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/schemas/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAE3D,sIAAsI;AACtI,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAkB,CAAC;AAExF;;;;GAIG;AACH,qBACa,wBAAyB,SAAQ,cAAc;IAE1D,SAAS,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAE/C,2GAA2G;IACpG,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAErD;IAEM,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAGtE;CACF"}

package/lib/cjs/schemas/provider.js

@@ -45,14 +45,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthzAdminSchemaProvider = exports.AUTHZ_ADMIN_SCHEMAS = void 0;
 const di_1 = require("@spinajs/di");
 const validation_1 = require("@spinajs/validation");
-const bodies = __importStar(require("./bodies.js"));
+const answers = __importStar(require("./answers.js"));
 const registry_js_1 = require("./registry.js");
-/** Every schema of the admin routes by name, as the swagger document names them, over the built-in commands. */
-exports.AUTHZ_ADMIN_SCHEMAS = { ...bodies };
+/** The answer and error schemas of the admin routes by name, as the swagger document names them. Request schemas live on the DTOs. */
+exports.AUTHZ_ADMIN_SCHEMAS = { ...answers };
 /**
- * Serves the schemas to http-swagger by the type names the controller's `@response` tags use.
- * Nothing but the swagger builder asks a SchemaProvider: request validation reads `@Schema`
- * metadata and route argument schemas, neither of which these routes carry.
+ * Serves the answer schemas and the batch body to http-swagger by the type names the controller's
+ * `@response` tags and `describeAuthzAdminDocument` use. The batch body is built from the registered
+ * AuthzCommandSchemaSources on every call, as the batch route validates against it.
  */
 let AuthzAdminSchemaProvider = class AuthzAdminSchemaProvider extends validation_1.SchemaProvider {
     /** Every schema of the admin routes by name, with AuthzAdminBatch listing the registered command kinds. */

package/lib/cjs/schemas/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/schemas/provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAqD;AACrD,oDAAqD;AAErD,MAAY,MAAM,wCAAoB;AAEtC,+CAA2D;AAE3D,gHAAgH;AACnG,QAAA,mBAAmB,GAAyC,EAAE,GAAG,MAAM,EAAE,CAAC;AAEvF;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,2BAAc;IAI1D,2GAA2G;IACpG,OAAO;QACZ,OAAO,EAAE,GAAG,QAAA,mBAAmB,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5E,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAA,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAA,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,CAAC;CACF,CAAA;;AAXW;IADT,IAAA,eAAU,EAAC,wCAA0B,CAAC;8BACnB,wCAA0B;0DAAC;mCAFpC,wBAAwB;IADpC,IAAA,eAAU,EAAC,2BAAc,CAAC;GACd,wBAAwB,CAapC"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/schemas/provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAqD;AACrD,oDAAqD;AAErD,MAAY,OAAO,yCAAqB;AAExC,+CAA2D;AAE3D,sIAAsI;AACzH,QAAA,mBAAmB,GAAyC,EAAE,GAAG,OAAO,EAAE,CAAC;AAExF;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAyB,SAAQ,2BAAc;IAI1D,2GAA2G;IACpG,OAAO;QACZ,OAAO,EAAE,GAAG,QAAA,mBAAmB,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5E,CAAC;IAEM,SAAS,CAAC,QAAgB;QAC/B,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAA,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAA,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,CAAC;CACF,CAAA;;AAXW;IADT,IAAA,eAAU,EAAC,wCAA0B,CAAC;8BACnB,wCAA0B;0DAAC;mCAFpC,wBAAwB;IADpC,IAAA,eAAU,EAAC,2BAAc,CAAC;GACd,wBAAwB,CAapC"}

package/lib/mjs/controllers/AuthzAdminController.d.ts

@@ -1,15 +1,21 @@
 import { AuthzDomains } from '@spinajs/authz';
-import type { AuthzAdmin, AuthzAdminQuery, AuthzCommand } from '@spinajs/authz';
+import type { AuthzAdmin, AuthzAdminQuery, AuthzCommand, Principal } from '@spinajs/authz';
 import { BaseController } from '@spinajs/http';
-import type { Request, Response } from '@spinajs/http';
+import type { Response } from '@spinajs/http';
 import '../schemas/provider.js';
+import { AuthzAssignmentGrant, AuthzAssignmentPatch } from '../dto/assignments.js';
+import { AuthzAttributesBody, AuthzAttributesPatch } from '../dto/attributes.js';
+import type { AuthzAdminCommandBatch } from '../dto/batch.js';
+import { AuthzLinkCreate, AuthzLinkPatch } from '../dto/links.js';
+import { AuthzAssignmentsQuery, AuthzHoldersQuery, AuthzListQuery, AuthzOffsetListQuery, AuthzWriteOptionsQuery } from '../dto/queries.js';
+import { AuthzPolicyBody, AuthzRuleBody } from '../dto/rules.js';
 /**
  * Admin routes over the management API of the configured domain (`authz.http.admin.domain`).
  *
  * The routes check authentication only: the actor is always the request principal, and every
- * permission, validation and guard check runs in AuthzAdmin, as for an in-process caller (design
- * §6.6.5). A refused request answers `{ error: { code, message, field? } }`; a write answers
- * `{ results }`, one entry per command.
+ * permission and guard check runs in AuthzAdmin, as for an in-process caller (design §6.6.5). The
+ * inputs are DTOs checked against their schemas first; a refused request answers
+ * `{ error: { code, message, field? } }`, a write `{ results }`, one entry per command.
  *
  * @tags Authz admin
  */
@@ -17,13 +23,13 @@ export declare class AuthzAdminController extends BaseController {
     protected AdminDomain: string;
     protected Domains: AuthzDomains;
     /**
-     * Runs a route on the AuthzAdmin of the domain the AuthzDomainResolver names for `req`, `authz.http.admin.domain` being its fallback and the domain without a request.
-     * An AuthzAdminFailure becomes its status with `{ error }`, a domain no live domain bears 403 `unknown_domain`, anything else propagates.
+     * Runs a route on the AuthzAdmin of `domain` (the one `@AdminDomain()` resolved), `authz.http.admin.domain` without one.
+     * An AuthzAdminFailure becomes its status with `{ error }`, anything else propagates.
      */
-    protected guarded(fn: (admin: AuthzAdmin) => Promise<Response>, req?: Request): Promise<Response>;
+    protected guarded(fn: (admin: AuthzAdmin) => Promise<Response>, domain?: string): Promise<Response>;
     /** One batch built from the route, with the options of the query string. */
-    protected single(req: Request, build: () => AuthzCommand[]): Promise<Response<any>>;
-    protected list(req: Request, build: () => AuthzAdminQuery): Promise<Response<any>>;
+    protected single(domain: string, actor: Principal, options: AuthzWriteOptionsQuery, build: () => AuthzCommand[]): Promise<Response<any>>;
+    protected list(domain: string, actor: Principal, build: () => AuthzAdminQuery): Promise<Response<any>>;
     /**
      * Run a batch of commands
      * Runs the commands in order in one transaction on the configured domain; the first failure rolls the batch back and its status is the answer.
@@ -37,7 +43,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    commands(req: Request): Promise<Response<any>>;
+    commands(domain: string, actor: Principal, batch: AuthzAdminCommandBatch): Promise<Response<any>>;
     /**
      * List assignments
      * Lists assignments, filtered by the query.
@@ -47,7 +53,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    listAssignments(req: Request): Promise<Response<any>>;
+    listAssignments(domain: string, actor: Principal, query: AuthzAssignmentsQuery): Promise<Response<any>>;
     /**
      * List holders
      * Who holds a permission on a resource through role assignments on it, its ancestors or $global; each principal is verified by a fresh check.
@@ -57,7 +63,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks authz:holders.read at the resource, or the resource is unknown
      */
-    listHolders(req: Request): Promise<Response<any>>;
+    listHolders(domain: string, actor: Principal, query: AuthzHoldersQuery): Promise<Response<any>>;
     /**
      * Grant a role
      * Grants a role to a subject at a scope (assignment.grant).
@@ -71,7 +77,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    grant(req: Request): Promise<Response<any>>;
+    grant(domain: string, actor: Principal, body: AuthzAssignmentGrant, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Change an assignment
      * Changes the tags or the expiry of an assignment.
@@ -85,7 +91,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    patchAssignment(req: Request): Promise<Response<any>>;
+    patchAssignment(domain: string, actor: Principal, id: string, body: AuthzAssignmentPatch, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Revoke an assignment
      * Revokes the assignment with the path id.
@@ -98,7 +104,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    revoke(req: Request): Promise<Response<any>>;
+    revoke(domain: string, actor: Principal, id: string, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * List share links
      * Lists the share links, filtered by the query. A listing never carries a token or its hash: the token is shown once, when the link is created.
@@ -108,7 +114,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    listLinks(req: Request): Promise<Response<any>>;
+    listLinks(domain: string, actor: Principal, query: AuthzListQuery): Promise<Response<any>>;
     /**
      * Create a share link
      * Creates a share link that grants a role at a scope (link.create). The result carries the link id and its token: the token is shown once, here, and every answer the route sends carries `Cache-Control: no-store` (the 401 of the authentication check comes before the route and holds no token). A dry run or a retried request (same idempotency key) answers without the token.
@@ -122,7 +128,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    createLink(req: Request): Promise<Response<any>>;
+    createLink(domain: string, actor: Principal, body: AuthzLinkCreate, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Change a share link
      * Changes the expiry, attributes, role or tags of the link with the path id (link.update). The answer never carries the token.
@@ -136,7 +142,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    patchLink(req: Request): Promise<Response<any>>;
+    patchLink(domain: string, actor: Principal, id: string, body: AuthzLinkPatch, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Revoke a share link
      * Revokes the link with the path id and the role it grants (link.revoke); its token opens nothing from then on.
@@ -149,7 +155,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    revokeLink(req: Request): Promise<Response<any>>;
+    revokeLink(domain: string, actor: Principal, id: string, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * List rules
      * Lists the RBAC rules held as rows.
@@ -159,7 +165,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    listRules(req: Request): Promise<Response<any>>;
+    listRules(domain: string, actor: Principal, query: AuthzListQuery): Promise<Response<any>>;
     /**
      * Put a rule
      * Inserts or replaces the RBAC rule with the path id.
@@ -173,7 +179,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    putRule(req: Request): Promise<Response<any>>;
+    putRule(domain: string, actor: Principal, id: string, body: AuthzRuleBody, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Delete a rule
      * Deletes the RBAC rule with the path id.
@@ -186,7 +192,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    deleteRule(req: Request): Promise<Response<any>>;
+    deleteRule(domain: string, actor: Principal, id: string, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * List policies
      * Lists the ABAC policies held as rows.
@@ -196,7 +202,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    listPolicies(req: Request): Promise<Response<any>>;
+    listPolicies(domain: string, actor: Principal, query: AuthzOffsetListQuery): Promise<Response<any>>;
     /**
      * Put a policy
      * Inserts or replaces the ABAC policy with the path id.
@@ -210,7 +216,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    putPolicy(req: Request): Promise<Response<any>>;
+    putPolicy(domain: string, actor: Principal, id: string, body: AuthzPolicyBody, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Delete a policy
      * Deletes the ABAC policy with the path id.
@@ -223,7 +229,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    deletePolicy(req: Request): Promise<Response<any>>;
+    deletePolicy(domain: string, actor: Principal, id: string, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Read scope attributes
      * Returns the attributes of the scope node `<type>:<id>`.
@@ -232,7 +238,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 401 Unauthorized: a valid session or token is required
      * @response 403 {AuthzAdminError} forbidden: the caller lacks the read permission at the scope
      */
-    attributes(req: Request): Promise<Response<any>>;
+    attributes(domain: string, actor: Principal, type: string, id: string): Promise<Response<any>>;
     /**
      * Merge scope attributes
      * Deep-merges the body into the attributes of the scope node; null deletes a path.
@@ -246,7 +252,7 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    patchAttributes(req: Request): Promise<Response<any>>;
+    patchAttributes(domain: string, actor: Principal, type: string, id: string, body: AuthzAttributesPatch, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
     /**
      * Replace scope attributes
      * Replaces all attributes of the scope node with the body.
@@ -260,6 +266,6 @@ export declare class AuthzAdminController extends BaseController {
      * @response 409 {AuthzAdminError} conflict: the row changed or exists already
      * @response 500 {AuthzAdminError} hook_error: an action hook threw or timed out
      */
-    replaceAttributes(req: Request): Promise<Response<any>>;
+    replaceAttributes(domain: string, actor: Principal, type: string, id: string, body: AuthzAttributesBody, options: AuthzWriteOptionsQuery): Promise<Response<any>>;
 }
 //# sourceMappingURL=AuthzAdminController.d.ts.map

package/lib/mjs/controllers/AuthzAdminController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthzAdminController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AuthzAdminController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAqB,eAAe,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAC3H,OAAO,EAAsB,cAAc,EAA6G,MAAM,eAAe,CAAC;AAC9K,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIvD,OAAO,wBAAwB,CAAC;AAuEhC;;;;;;;;;GASG;AACH,qBAEa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAG9B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAEhC;;;OAGG;IACH,UAAgB,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CActG;IAED,4EAA4E;IAC5E,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,EAAE,0BAKzD;IAED,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,0BAExD;IAED;;;;;;;;;;;;OAYG;IAEU,QAAQ,CAAQ,GAAG,EAAE,OAAO,0BAQxC;IAED;;;;;;;;OAQG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAQ,GAAG,EAAE,OAAO,0BAE3C;IAED;;;;;;;;;;;;OAYG;IAEU,KAAK,CAAQ,GAAG,EAAE,OAAO,0BAErC;IAED;;;;;;;;;;;;OAYG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAY/C;IAED;;;;;;;;;;;OAWG;IAEU,MAAM,CAAQ,GAAG,EAAE,OAAO,0BAEtC;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;;OAYG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAG1C;IAED;;;;;;;;;;;;OAYG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;;OAYG;IAEU,OAAO,CAAQ,GAAG,EAAE,OAAO,0BAEvC;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;OAQG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;;;;;;OAYG;IAEU,SAAS,CAAQ,GAAG,EAAE,OAAO,0BAEzC;IAED;;;;;;;;;;;OAWG;IAEU,YAAY,CAAQ,GAAG,EAAE,OAAO,0BAE5C;IAED;;;;;;;OAOG;IAEU,UAAU,CAAQ,GAAG,EAAE,OAAO,0BAE1C;IAED;;;;;;;;;;;;OAYG;IAEU,eAAe,CAAQ,GAAG,EAAE,OAAO,0BAE/C;IAED;;;;;;;;;;;;OAYG;IAEU,iBAAiB,CAAQ,GAAG,EAAE,OAAO,0BAEjD;CACF"}
+{"version":3,"file":"AuthzAdminController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AuthzAdminController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAkF,MAAM,eAAe,CAAC;AAC/H,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAK9C,OAAO,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3I,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAoBjE;;;;;;;;;GASG;AACH,qBAGa,oBAAqB,SAAQ,cAAc;IAEtD,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAG9B,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAEhC;;;OAGG;IACH,UAAgB,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAQxG;IAED,4EAA4E;IAC5E,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,YAAY,EAAE,0BAE9G;IAED,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,eAAe,0BAE5E;IAED;;;;;;;;;;;;OAYG;IAGU,QAAQ,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAgB,KAAK,EAAE,sBAAsB,0BAErI;IAED;;;;;;;;OAQG;IAEU,eAAe,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAgB,KAAK,EAAE,qBAAqB,0BAE3I;IAED;;;;;;;;OAQG;IAEU,WAAW,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAgB,KAAK,EAAE,iBAAiB,0BAEnI;IAED;;;;;;;;;;;;OAYG;IAEU,KAAK,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAA4B,IAAI,EAAE,oBAAoB,EAAgB,OAAO,EAAE,sBAAsB,0BAE1L;IAED;;;;;;;;;;;;OAYG;IAEU,eAAe,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAA4B,IAAI,EAAE,oBAAoB,EAAgB,OAAO,EAAE,sBAAsB,0BAOjO;IAED;;;;;;;;;;;OAWG;IAEU,MAAM,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAAgB,OAAO,EAAE,sBAAsB,0BAElK;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAgB,KAAK,EAAE,cAAc,0BAE9H;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAA4B,IAAI,EAAE,eAAe,EAAgB,OAAO,EAAE,sBAAsB,0BAE1L;IAED;;;;;;;;;;;;OAYG;IAEU,SAAS,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAA4B,IAAI,EAAE,cAAc,EAAgB,OAAO,EAAE,sBAAsB,0BAErN;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAAgB,OAAO,EAAE,sBAAsB,0BAEtK;IAED;;;;;;;;OAQG;IAEU,SAAS,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAgB,KAAK,EAAE,cAAc,0BAE9H;IAED;;;;;;;;;;;;OAYG;IAEU,OAAO,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAA4B,IAAI,EAAE,aAAa,EAAgB,OAAO,EAAE,sBAAsB,0BAElN;IAED;;;;;;;;;;;OAWG;IAEU,UAAU,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAAgB,OAAO,EAAE,sBAAsB,0BAEtK;IAED;;;;;;;;OAQG;IAEU,YAAY,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAgB,KAAK,EAAE,oBAAoB,0BAEvI;IAED;;;;;;;;;;;;OAYG;IAEU,SAAS,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAA4B,IAAI,EAAE,eAAe,EAAgB,OAAO,EAAE,sBAAsB,0BAEtN;IAED;;;;;;;;;;;OAWG;IAEU,YAAY,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAmB,EAAE,EAAE,MAAM,EAAgB,OAAO,EAAE,sBAAsB,0BAExK;IAED;;;;;;;OAOG;IAEU,UAAU,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAqB,IAAI,EAAE,MAAM,EAAmB,EAAE,EAAE,MAAM,0BAExJ;IAED;;;;;;;;;;;;OAYG;IAEU,eAAe,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAqB,IAAI,EAAE,MAAM,EAAmB,EAAE,EAAE,MAAM,EAAe,IAAI,EAAE,oBAAoB,EAAgB,OAAO,EAAE,sBAAsB,0BAErP;IAED;;;;;;;;;;;;OAYG;IAEU,iBAAiB,CAAgB,MAAM,EAAE,MAAM,EAAsB,KAAK,EAAE,SAAS,EAAqB,IAAI,EAAE,MAAM,EAAmB,EAAE,EAAE,MAAM,EAAe,IAAI,EAAE,mBAAmB,EAAgB,OAAO,EAAE,sBAAsB,0BAEtP;CACF"}