@spinajs/rbac-http 2.0.491 → 2.0.494

package/README.md

@@ -1,11 +1,11 @@
-# `rbac-http`
-
-> TODO: description
-
-## Usage
-
-```
-const rbacHttp = require('rbac-http');
-
-// TODO: DEMONSTRATE API
-```
+# `rbac-http`
+
+> TODO: description
+
+## Usage
+
+```
+const rbacHttp = require('rbac-http');
+
+// TODO: DEMONSTRATE API
+```

package/lib/cjs/dto/auth-responses.d.ts

@@ -0,0 +1,374 @@
+/**
+ * One metadata row as dehydrated onto the wire.
+ *
+ * `Value` is a string regardless of `Type`: the column stores text and `Type`
+ * says how to read it. A client that wants the decoded value decodes it itself.
+ */
+export declare const UserMetadataEntrySchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        Id: {
+            type: string;
+        };
+        Key: {
+            type: string;
+        };
+        Type: {
+            type: string;
+            enum: string[];
+        };
+        Value: {
+            type: string;
+            nullable: boolean;
+        };
+    };
+};
+/** `IUserWithGrants` — the payload a completed login or 2FA verification returns. */
+export declare const UserWithGrantsSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        ActiveRole: {
+            type: string;
+            description: string;
+        };
+        Grants: {
+            readonly type: "object";
+            readonly description: string;
+            readonly properties: {
+                readonly $extend: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Roles this one inherits from. Sits alongside the resources, and is not one.";
+                };
+            };
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')";
+                readonly additionalProperties: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+            };
+        };
+        Uuid: {
+            readonly type: "string";
+        };
+        Email: {
+            readonly type: "string";
+            readonly format: "email";
+        };
+        Login: {
+            readonly type: "string";
+        };
+        Role: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly description: "Every role assigned to the user — the set /auth/active-role may switch between";
+        };
+        IsActive: {
+            readonly type: "integer";
+            readonly description: "1 when the account is active";
+        };
+        CreatedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+        };
+        RegisteredAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        DeletedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        LastLoginAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        Metadata: {
+            readonly type: "array";
+            readonly items: {
+                readonly description: "IUserMetadataEntry";
+            };
+        };
+    };
+    required: string[];
+};
+/**
+ * `ITwoFactorAuthRequired` — password accepted, TOTP still owed.
+ *
+ * The flag is a plain boolean, not `const: true`. A single-value const becomes a
+ * one-member enum in the emitted spec, and an enum inside a `oneOf` arm is what
+ * makes generators reach for `Union["TheKey"]` — a key only one arm has. The
+ * discriminator is which key is PRESENT, which `required` already states.
+ */
+export declare const TwoFactorAuthRequiredSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        TwoFactorAuthRequired: {
+            type: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/** `ITwoFactorInitRequired` — password accepted, enrolment owed before TOTP. */
+export declare const TwoFactorInitRequiredSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        TwoFactorInitRequired: {
+            type: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/**
+ * `ILoginResponse` — the three shapes `/auth/login` can answer with.
+ *
+ * A discriminated union rather than one object with everything optional: the
+ * caller branches on which key is present, and a schema that makes all of them
+ * optional would validate a response carrying none.
+ */
+export declare const LoginResponseSchema: {
+    $schema: string;
+    title: string;
+    oneOf: ({
+        $schema: string;
+        title: string;
+        type: string;
+        properties: {
+            ActiveRole: {
+                type: string;
+                description: string;
+            };
+            Grants: {
+                readonly type: "object";
+                readonly description: string;
+                readonly properties: {
+                    readonly $extend: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Roles this one inherits from. Sits alongside the resources, and is not one.";
+                    };
+                };
+                readonly additionalProperties: {
+                    readonly type: "object";
+                    readonly description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')";
+                    readonly additionalProperties: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                    };
+                };
+            };
+            Uuid: {
+                readonly type: "string";
+            };
+            Email: {
+                readonly type: "string";
+                readonly format: "email";
+            };
+            Login: {
+                readonly type: "string";
+            };
+            Role: {
+                readonly type: "array";
+                readonly items: {
+                    readonly type: "string";
+                };
+                readonly description: "Every role assigned to the user — the set /auth/active-role may switch between";
+            };
+            IsActive: {
+                readonly type: "integer";
+                readonly description: "1 when the account is active";
+            };
+            CreatedAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+            };
+            RegisteredAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly nullable: true;
+            };
+            DeletedAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly nullable: true;
+            };
+            LastLoginAt: {
+                readonly type: "string";
+                readonly format: "date-time";
+                readonly nullable: true;
+            };
+            Metadata: {
+                readonly type: "array";
+                readonly items: {
+                    readonly description: "IUserMetadataEntry";
+                };
+            };
+        };
+        required: string[];
+    } | {
+        $schema: string;
+        title: string;
+        type: string;
+        properties: {
+            TwoFactorAuthRequired: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    } | {
+        $schema: string;
+        title: string;
+        type: string;
+        properties: {
+            TwoFactorInitRequired: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+    })[];
+};
+/** `IActiveRoleResponse` — what both `/auth/active-role` operations answer with. */
+export declare const ActiveRoleResponseSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        ActiveRole: {
+            type: string;
+            description: string;
+        };
+        Grants: {
+            readonly type: "object";
+            readonly description: string;
+            readonly properties: {
+                readonly $extend: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "Roles this one inherits from. Sits alongside the resources, and is not one.";
+                };
+            };
+            readonly additionalProperties: {
+                readonly type: "object";
+                readonly description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')";
+                readonly additionalProperties: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+            };
+        };
+    };
+};
+/**
+ * `IWhoamiResponse` — `/auth/whoami`.
+ *
+ * The user's own columns plus the two fields the session contributes. It is NOT
+ * the `User` ORM model, which is what this endpoint used to be documented as:
+ * that model knows nothing of `ActiveRole` or `Authorized` — the two fields a
+ * client needs most here — and does carry `Password`.
+ */
+export declare const WhoamiResponseSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        ActiveRole: {
+            type: string;
+            description: string;
+        };
+        Authorized: {
+            type: string;
+            description: string;
+        };
+        Uuid: {
+            readonly type: "string";
+        };
+        Email: {
+            readonly type: "string";
+            readonly format: "email";
+        };
+        Login: {
+            readonly type: "string";
+        };
+        Role: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+            };
+            readonly description: "Every role assigned to the user — the set /auth/active-role may switch between";
+        };
+        IsActive: {
+            readonly type: "integer";
+            readonly description: "1 when the account is active";
+        };
+        CreatedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+        };
+        RegisteredAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        DeletedAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        LastLoginAt: {
+            readonly type: "string";
+            readonly format: "date-time";
+            readonly nullable: true;
+        };
+        Metadata: {
+            readonly type: "array";
+            readonly items: {
+                readonly description: "IUserMetadataEntry";
+            };
+        };
+    };
+    required: string[];
+};
+/** `IEnable2faResponse` — the OTP provisioning URI from `/auth/2fa/setup`. */
+export declare const Enable2faResponseSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        otp: {
+            type: string;
+            description: string;
+        };
+    };
+};
+//# sourceMappingURL=auth-responses.d.ts.map

package/lib/cjs/dto/auth-responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-responses.d.ts","sourceRoot":"","sources":["../../../src/dto/auth-responses.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;CAanC,CAAC;AA0FF,qFAAqF;AACrF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAahC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;CAWvC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,2BAA2B;;;;;;;;;;;CAWvC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAO/B,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQpC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBhC,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;;;;;;;CAUnC,CAAC"}

package/lib/cjs/dto/auth-responses.js

@@ -0,0 +1,279 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Enable2faResponseSchema = exports.WhoamiResponseSchema = exports.ActiveRoleResponseSchema = exports.LoginResponseSchema = exports.TwoFactorInitRequiredSchema = exports.TwoFactorAuthRequiredSchema = exports.UserWithGrantsSchema = exports.UserMetadataEntrySchema = void 0;
+const di_1 = require("@spinajs/di");
+/**
+ * JSON schemas for the auth endpoints' RESPONSE bodies.
+ *
+ * ---------------------------------------------------------------------------
+ * Why this file exists
+ * ---------------------------------------------------------------------------
+ * The auth controllers already annotate their returns with the interface names
+ * from `interfaces.ts` (`@returns {ILoginResponse}`, `{IActiveRoleResponse}`,
+ * …). Those annotations resolved to nothing: the swagger builder asks its
+ * `SchemaProvider`s for a schema by name, no provider knows a plain TypeScript
+ * interface, and `inferSchemaFromString` then falls back to
+ * `{ type: 'object', description: '<name>' }` — an object with no properties.
+ *
+ * The published spec therefore described `/auth/login`, `/auth/2fa/verify` and
+ * both `/auth/active-role` operations as returning an empty object. Generated
+ * clients believed it: every one of those responses typed as `object`, and
+ * codegen that builds models from response schemas had nothing to build from.
+ *
+ * Registering the schemas under the SAME names the annotations already use is
+ * what makes them resolve — no controller annotation changes, and the component
+ * names in the spec are the ones the code has always claimed.
+ *
+ * ---------------------------------------------------------------------------
+ * Why raw registration and not `@Schema`
+ * ---------------------------------------------------------------------------
+ * `@Schema` is sugar for exactly the call below, keyed on the decorated class's
+ * name. Using it here would mean declaring classes called `ILoginResponse` and
+ * friends purely to carry a name — and they would collide with the interfaces of
+ * that name this package already exports. These describe responses; there is
+ * nothing to construct.
+ *
+ * ---------------------------------------------------------------------------
+ * Keep in sync with `interfaces.ts`
+ * ---------------------------------------------------------------------------
+ * The schemas below describe what the endpoints really put on the wire, which is
+ * what a client validator has to accept. Where that differs from the interface,
+ * the wire wins and the difference is called out in a comment.
+ */
+/** `format: date-time` as the backend emits it — `dateTimeFormat: 'iso'`, offset included. */
+const dateTime = { type: 'string', format: 'date-time' };
+const nullableDateTime = { type: 'string', format: 'date-time', nullable: true };
+/**
+ * One metadata row as dehydrated onto the wire.
+ *
+ * `Value` is a string regardless of `Type`: the column stores text and `Type`
+ * says how to read it. A client that wants the decoded value decodes it itself.
+ */
+exports.UserMetadataEntrySchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'User metadata entry',
+    type: 'object',
+    properties: {
+        Id: { type: 'integer' },
+        Key: { type: 'string' },
+        Type: {
+            type: 'string',
+            enum: ['number', 'float', 'string', 'json', 'boolean', 'datetime'],
+        },
+        Value: { type: 'string', nullable: true },
+    },
+};
+/**
+ * A reference to the entry schema above, by the tag the builder resolves.
+ *
+ * `expandNamedSchemas` turns any node whose `description` names a registered
+ * schema into a `$ref` to that component — this is how the builder expresses a
+ * reference, and it is worth using rather than inlining the object three times.
+ *
+ * Not merely tidier: the metadata entry carries an enum, and an enum inline
+ * inside a `oneOf` arm (which `ILoginResponse` is) makes generators emit type
+ * references that index the union by a key only one arm has. Giving the entry
+ * its own component takes the enum out of the union entirely.
+ */
+const userMetadataEntryRef = { description: 'IUserMetadataEntry' };
+/**
+ * The user's own columns, as `dehydrateWithRelations({ dateTimeFormat: 'iso' })`
+ * produces them.
+ *
+ * `Password` is deliberately absent. It is a column on the ORM model, so any
+ * endpoint documented as returning the model advertises it as part of the
+ * response — it is never actually sent, and a spec must not say otherwise.
+ *
+ * `IsActive` is an integer, not a boolean: the column is a tinyint and the
+ * driver hands back 0/1.
+ */
+const userProperties = {
+    Uuid: { type: 'string' },
+    Email: { type: 'string', format: 'email' },
+    Login: { type: 'string' },
+    Role: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'Every role assigned to the user — the set /auth/active-role may switch between',
+    },
+    IsActive: { type: 'integer', description: '1 when the account is active' },
+    CreatedAt: dateTime,
+    RegisteredAt: nullableDateTime,
+    DeletedAt: nullableDateTime,
+    LastLoginAt: nullableDateTime,
+    Metadata: { type: 'array', items: userMetadataEntryRef },
+};
+/**
+ * `required` on a RESPONSE, kept to the bare minimum on purpose.
+ *
+ * A response schema describes what a client must ACCEPT, not what it may send,
+ * and `required` there is a promise a client validator will enforce — one this
+ * codebase has already been bitten by, when response components were built from
+ * the write contract and `User.Password` came out `required`. Every ordinary row
+ * then failed validation. Response components are built without `required` for
+ * that reason, and hand-written ones have no business reinstating it.
+ *
+ * The practical edge: a client generated from this spec and deployed before the
+ * backend that fills a new field would reject every response outright, instead of
+ * seeing the field missing and saying so.
+ *
+ * `Uuid` is the one exception, and it is structural rather than a data guarantee:
+ * `ILoginResponse` is a union, and an arm with nothing required matches any
+ * object at all — including the two-factor replies, which would then never reach
+ * their own arms.
+ */
+const USER_REQUIRED = ['Uuid'];
+/**
+ * Flattened RBAC grants: resource → action → permission descriptor.
+ *
+ * The resource and action keys are data, so the schema can only describe the
+ * shape two levels down. `additionalProperties` carries it.
+ */
+const grantsMap = {
+    type: 'object',
+    description: "Resolved grants for the active role, in accesscontrol's own format: " +
+        "resource → 'action:possession' → attributes. Feed it back into new AccessControl().",
+    properties: {
+        $extend: {
+            type: 'array',
+            items: { type: 'string' },
+            description: 'Roles this one inherits from. Sits alongside the resources, and is not one.',
+        },
+    },
+    additionalProperties: {
+        type: 'object',
+        description: "One resource's permissions, keyed 'action:possession' (e.g. 'read:any')",
+        additionalProperties: { type: 'array', items: { type: 'string' } },
+    },
+};
+/** `IUserWithGrants` — the payload a completed login or 2FA verification returns. */
+exports.UserWithGrantsSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'User with grants',
+    type: 'object',
+    properties: {
+        ...userProperties,
+        ActiveRole: {
+            type: 'string',
+            description: 'Role whose grants are in effect; defaults to Role[0] at login',
+        },
+        Grants: grantsMap,
+    },
+    required: USER_REQUIRED,
+};
+/**
+ * `ITwoFactorAuthRequired` — password accepted, TOTP still owed.
+ *
+ * The flag is a plain boolean, not `const: true`. A single-value const becomes a
+ * one-member enum in the emitted spec, and an enum inside a `oneOf` arm is what
+ * makes generators reach for `Union["TheKey"]` — a key only one arm has. The
+ * discriminator is which key is PRESENT, which `required` already states.
+ */
+exports.TwoFactorAuthRequiredSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Two-factor verification required',
+    type: 'object',
+    properties: {
+        TwoFactorAuthRequired: {
+            type: 'boolean',
+            description: 'Always true; the session is parked awaiting a TOTP code',
+        },
+    },
+    required: ['TwoFactorAuthRequired'],
+};
+/** `ITwoFactorInitRequired` — password accepted, enrolment owed before TOTP. */
+exports.TwoFactorInitRequiredSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Two-factor enrolment required',
+    type: 'object',
+    properties: {
+        TwoFactorInitRequired: {
+            type: 'boolean',
+            description: 'Always true; the user must enrol a TOTP device before continuing',
+        },
+    },
+    required: ['TwoFactorInitRequired'],
+};
+/**
+ * `ILoginResponse` — the three shapes `/auth/login` can answer with.
+ *
+ * A discriminated union rather than one object with everything optional: the
+ * caller branches on which key is present, and a schema that makes all of them
+ * optional would validate a response carrying none.
+ */
+exports.LoginResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Login response',
+    // Two-factor arms first. A validator walks the arms in order and takes the
+    // first that matches; the user arm requires only `Uuid` (see USER_REQUIRED),
+    // so putting it first would let it swallow a two-factor reply.
+    oneOf: [exports.TwoFactorAuthRequiredSchema, exports.TwoFactorInitRequiredSchema, exports.UserWithGrantsSchema],
+};
+/** `IActiveRoleResponse` — what both `/auth/active-role` operations answer with. */
+exports.ActiveRoleResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Active role',
+    type: 'object',
+    properties: {
+        ActiveRole: { type: 'string', description: 'Role whose grants are now in effect' },
+        Grants: grantsMap,
+    },
+};
+/**
+ * `IWhoamiResponse` — `/auth/whoami`.
+ *
+ * The user's own columns plus the two fields the session contributes. It is NOT
+ * the `User` ORM model, which is what this endpoint used to be documented as:
+ * that model knows nothing of `ActiveRole` or `Authorized` — the two fields a
+ * client needs most here — and does carry `Password`.
+ */
+exports.WhoamiResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Current session user',
+    type: 'object',
+    properties: {
+        ...userProperties,
+        ActiveRole: {
+            type: 'string',
+            description: 'Role whose grants are in effect for this session',
+        },
+        Authorized: {
+            type: 'boolean',
+            description: 'False while the session has passed the password step but still owes 2FA. ' +
+                'Absent on sessions minted before this field existed, which were fully authorized.',
+        },
+    },
+    required: USER_REQUIRED,
+};
+/** `IEnable2faResponse` — the OTP provisioning URI from `/auth/2fa/setup`. */
+exports.Enable2faResponseSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Two-factor enrolment',
+    type: 'object',
+    properties: {
+        otp: {
+            type: 'string',
+            description: 'OTP provisioning URI to scan with an authenticator app',
+        },
+    },
+};
+/**
+ * Registers a schema under the name controllers reference it by.
+ *
+ * Same registry and same call `@Schema` makes, so `DtoSchemaProvider` resolves
+ * these exactly as it resolves a decorated DTO.
+ */
+function registerResponseSchema(name, schema) {
+    di_1.DI.register(schema).asMapValue('__schemas__', name);
+}
+registerResponseSchema('IUserMetadataEntry', exports.UserMetadataEntrySchema);
+// `/user/grants` and `/grants` answer with the map on its own.
+registerResponseSchema('IGrantsMap', { $schema: 'http://json-schema.org/draft-07/schema#', title: 'Grants map', ...grantsMap });
+registerResponseSchema('IUserWithGrants', exports.UserWithGrantsSchema);
+registerResponseSchema('ITwoFactorAuthRequired', exports.TwoFactorAuthRequiredSchema);
+registerResponseSchema('ITwoFactorInitRequired', exports.TwoFactorInitRequiredSchema);
+registerResponseSchema('ILoginResponse', exports.LoginResponseSchema);
+registerResponseSchema('IActiveRoleResponse', exports.ActiveRoleResponseSchema);
+registerResponseSchema('IWhoamiResponse', exports.WhoamiResponseSchema);
+registerResponseSchema('IEnable2faResponse', exports.Enable2faResponseSchema);
+//# sourceMappingURL=auth-responses.js.map

package/lib/cjs/dto/auth-responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-responses.js","sourceRoot":"","sources":["../../../src/dto/auth-responses.ts"],"names":[],"mappings":";;;AAAA,oCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,8FAA8F;AAC9F,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAW,CAAC;AAClE,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAW,CAAC;AAE1F;;;;;GAKG;AACU,QAAA,uBAAuB,GAAG;IACrC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,qBAAqB;IAC5B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACvB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;SACnE;QACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC1C;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAW,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;IAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,IAAI,EAAE;QACJ,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACzB,WAAW,EAAE,gFAAgF;KAC9F;IACD,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,8BAA8B,EAAE;IAC1E,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,gBAAgB;IAC9B,SAAS,EAAE,gBAAgB;IAC3B,WAAW,EAAE,gBAAgB;IAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE;CAChD,CAAC;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,SAAS,GAAG;IAChB,IAAI,EAAE,QAAQ;IACd,WAAW,EACT,sEAAsE;QACtE,qFAAqF;IACvF,UAAU,EAAE;QACV,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,yEAAyE;QACtF,oBAAoB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;KACnE;CACO,CAAC;AAEX,qFAAqF;AACxE,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,cAAc;QACjB,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,+DAA+D;SAC7E;QACD,MAAM,EAAE,SAAS;KAClB;IACD,QAAQ,EAAE,aAAa;CACxB,CAAC;AAEF;;;;;;;GAOG;AACU,QAAA,2BAA2B,GAAG;IACzC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,kCAAkC;IACzC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,qBAAqB,EAAE;YACrB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD,QAAQ,EAAE,CAAC,uBAAuB,CAAC;CACpC,CAAC;AAEF,gFAAgF;AACnE,QAAA,2BAA2B,GAAG;IACzC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,+BAA+B;IACtC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,qBAAqB,EAAE;YACrB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD,QAAQ,EAAE,CAAC,uBAAuB,CAAC;CACpC,CAAC;AAEF;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG;IACjC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,gBAAgB;IACvB,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,KAAK,EAAE,CAAC,mCAA2B,EAAE,mCAA2B,EAAE,4BAAoB,CAAC;CACxF,CAAC;AAEF,oFAAoF;AACvE,QAAA,wBAAwB,GAAG;IACtC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;QAClF,MAAM,EAAE,SAAS;KAClB;CACF,CAAC;AAEF;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,cAAc;QACjB,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,kDAAkD;SAChE;QACD,UAAU,EAAE;YACV,IAAI,EAAE,SAAS;YACf,WAAW,EACT,2EAA2E;gBAC3E,mFAAmF;SACtF;KACF;IACD,QAAQ,EAAE,aAAa;CACxB,CAAC;AAEF,8EAA8E;AACjE,QAAA,uBAAuB,GAAG;IACrC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,sBAAsB;IAC7B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,wDAAwD;SACtE;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,MAAc;IAC1D,OAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,sBAAsB,CAAC,oBAAoB,EAAE,+BAAuB,CAAC,CAAC;AACtE,+DAA+D;AAC/D,sBAAsB,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAChI,sBAAsB,CAAC,iBAAiB,EAAE,4BAAoB,CAAC,CAAC;AAChE,sBAAsB,CAAC,wBAAwB,EAAE,mCAA2B,CAAC,CAAC;AAC9E,sBAAsB,CAAC,wBAAwB,EAAE,mCAA2B,CAAC,CAAC;AAC9E,sBAAsB,CAAC,gBAAgB,EAAE,2BAAmB,CAAC,CAAC;AAC9D,sBAAsB,CAAC,qBAAqB,EAAE,gCAAwB,CAAC,CAAC;AACxE,sBAAsB,CAAC,iBAAiB,EAAE,4BAAoB,CAAC,CAAC;AAChE,sBAAsB,CAAC,oBAAoB,EAAE,+BAAuB,CAAC,CAAC"}