@usehercules/convex 0.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +478 -0
- package/dist/_generated/component.d.ts +184 -0
- package/dist/_generated/component.d.ts.map +1 -0
- package/dist/_generated/component.js +11 -0
- package/dist/_generated/component.js.map +1 -0
- package/dist/checker/cli.d.ts +3 -0
- package/dist/checker/cli.d.ts.map +1 -0
- package/dist/checker/cli.js +71 -0
- package/dist/checker/cli.js.map +1 -0
- package/dist/checker/index.d.ts +28 -0
- package/dist/checker/index.d.ts.map +1 -0
- package/dist/checker/index.js +1928 -0
- package/dist/checker/index.js.map +1 -0
- package/dist/client/access-admin.d.ts +818 -0
- package/dist/client/access-admin.d.ts.map +1 -0
- package/dist/client/access-admin.js +1830 -0
- package/dist/client/access-admin.js.map +1 -0
- package/dist/client/http.d.ts +19 -0
- package/dist/client/http.d.ts.map +1 -0
- package/dist/client/http.js +76 -0
- package/dist/client/http.js.map +1 -0
- package/dist/client/index.d.ts +440 -0
- package/dist/client/index.d.ts.map +1 -0
- package/dist/client/index.js +654 -0
- package/dist/client/index.js.map +1 -0
- package/dist/component/authz.d.ts +114 -0
- package/dist/component/authz.d.ts.map +1 -0
- package/dist/component/authz.js +168 -0
- package/dist/component/authz.js.map +1 -0
- package/dist/component/checks.d.ts +86 -0
- package/dist/component/checks.d.ts.map +1 -0
- package/dist/component/checks.js +184 -0
- package/dist/component/checks.js.map +1 -0
- package/dist/component/convex.config.d.ts +3 -0
- package/dist/component/convex.config.d.ts.map +1 -0
- package/dist/component/convex.config.js +3 -0
- package/dist/component/convex.config.js.map +1 -0
- package/dist/component/effective.d.ts +82 -0
- package/dist/component/effective.d.ts.map +1 -0
- package/dist/component/effective.js +757 -0
- package/dist/component/effective.js.map +1 -0
- package/dist/component/queries.d.ts +170 -0
- package/dist/component/queries.d.ts.map +1 -0
- package/dist/component/queries.js +633 -0
- package/dist/component/queries.js.map +1 -0
- package/dist/component/schema.d.ts +258 -0
- package/dist/component/schema.d.ts.map +1 -0
- package/dist/component/schema.js +222 -0
- package/dist/component/schema.js.map +1 -0
- package/dist/component/sync.d.ts +85 -0
- package/dist/component/sync.d.ts.map +1 -0
- package/dist/component/sync.js +851 -0
- package/dist/component/sync.js.map +1 -0
- package/dist/shared/projection-protocol.d.ts +1624 -0
- package/dist/shared/projection-protocol.d.ts.map +1 -0
- package/dist/shared/projection-protocol.js +561 -0
- package/dist/shared/projection-protocol.js.map +1 -0
- package/dist/shared/sync.d.ts +24 -0
- package/dist/shared/sync.d.ts.map +1 -0
- package/dist/shared/sync.js +18 -0
- package/dist/shared/sync.js.map +1 -0
- package/dist/shared/token.d.ts +5 -0
- package/dist/shared/token.d.ts.map +1 -0
- package/dist/shared/token.js +19 -0
- package/dist/shared/token.js.map +1 -0
- package/package.json +89 -0
|
@@ -0,0 +1,440 @@
|
|
|
1
|
+
import type { ActionBuilder, ArgsArrayForOptionalValidator, ArgsArrayToObject, DefaultArgsForOptionalValidator, FunctionReference, GenericActionCtx, GenericDataModel, GenericMutationCtx, GenericQueryCtx, MutationBuilder, QueryBuilder, RegisteredAction, RegisteredMutation, RegisteredQuery, ReturnValueForOptionalValidator } from "convex/server";
|
|
2
|
+
import type { PropertyValidators, Validator } from "convex/values";
|
|
3
|
+
import type { ScopeKind } from "../shared/sync";
|
|
4
|
+
export type AuthorizationDecision = {
|
|
5
|
+
allowed: boolean;
|
|
6
|
+
reasonCode: string;
|
|
7
|
+
explicitDeny?: boolean;
|
|
8
|
+
sourceVersion?: number;
|
|
9
|
+
principalId?: string;
|
|
10
|
+
effectiveRoleIds: string[];
|
|
11
|
+
};
|
|
12
|
+
type AuthorizationArgs = {
|
|
13
|
+
tokenIdentifier?: string;
|
|
14
|
+
scopeId?: string;
|
|
15
|
+
permission?: string;
|
|
16
|
+
resourceType?: string;
|
|
17
|
+
resourceId?: string;
|
|
18
|
+
ancestors?: Array<{
|
|
19
|
+
resourceType: string;
|
|
20
|
+
resourceId: string;
|
|
21
|
+
}>;
|
|
22
|
+
};
|
|
23
|
+
type AuthorizationCheckArgs = Omit<AuthorizationArgs, "tokenIdentifier"> & {
|
|
24
|
+
permission: string;
|
|
25
|
+
};
|
|
26
|
+
type ListMyMembershipsArgs = {
|
|
27
|
+
tokenIdentifier?: string;
|
|
28
|
+
};
|
|
29
|
+
type GetDeploymentEntryStatusArgs = {
|
|
30
|
+
tokenIdentifier?: string;
|
|
31
|
+
};
|
|
32
|
+
type ListMyRolesArgs = {
|
|
33
|
+
tokenIdentifier?: string;
|
|
34
|
+
scopeId: string;
|
|
35
|
+
};
|
|
36
|
+
type GetEffectivePermissionsArgs = {
|
|
37
|
+
tokenIdentifier?: string;
|
|
38
|
+
scopeId: string;
|
|
39
|
+
resourceType?: string;
|
|
40
|
+
resourceId?: string;
|
|
41
|
+
ancestors?: Array<{
|
|
42
|
+
resourceType: string;
|
|
43
|
+
resourceId: string;
|
|
44
|
+
}>;
|
|
45
|
+
};
|
|
46
|
+
type ListScopeArgs = {
|
|
47
|
+
tokenIdentifier?: string;
|
|
48
|
+
scopeId: string;
|
|
49
|
+
};
|
|
50
|
+
type ListScopeMemberDirectoryArgs = ListScopeArgs & {
|
|
51
|
+
cursor?: string;
|
|
52
|
+
limit?: number;
|
|
53
|
+
};
|
|
54
|
+
type GetScopeMemberDirectoryEntryArgs = ListScopeArgs & {
|
|
55
|
+
principalId?: string;
|
|
56
|
+
herculesAuthUserId?: string;
|
|
57
|
+
};
|
|
58
|
+
export type RoleSummary = {
|
|
59
|
+
roleId: string;
|
|
60
|
+
roleKey: string;
|
|
61
|
+
roleName: string;
|
|
62
|
+
roleKind: "system" | "custom";
|
|
63
|
+
};
|
|
64
|
+
export type Membership = {
|
|
65
|
+
scopeId: string;
|
|
66
|
+
scopeName: string;
|
|
67
|
+
kind: ScopeKind;
|
|
68
|
+
roles: RoleSummary[];
|
|
69
|
+
joinedAt: number;
|
|
70
|
+
status: "active" | "blocked" | "suspended" | "pending_approval" | "removed";
|
|
71
|
+
};
|
|
72
|
+
export type AccessPrincipalStatus = "active" | "blocked" | "suspended" | "pending_approval" | "removed";
|
|
73
|
+
export type AccessDeploymentEntryMirrorResult = {
|
|
74
|
+
kind: "principal";
|
|
75
|
+
principalId: string;
|
|
76
|
+
status: AccessPrincipalStatus;
|
|
77
|
+
stateVersion: number;
|
|
78
|
+
} | {
|
|
79
|
+
kind: "fallback";
|
|
80
|
+
reason: "identity_missing" | "identity_invalid" | "unexpected_issuer" | "mirror_not_ready" | "default_scope_missing" | "principal_missing";
|
|
81
|
+
stateVersion?: number;
|
|
82
|
+
};
|
|
83
|
+
export type EffectivePermissionsResult = {
|
|
84
|
+
allowed: boolean;
|
|
85
|
+
reasonCode: string;
|
|
86
|
+
sourceVersion?: number;
|
|
87
|
+
scopeId?: string;
|
|
88
|
+
principalId?: string;
|
|
89
|
+
effectiveRoleIds: string[];
|
|
90
|
+
wildcard: "none" | "immutable" | "default";
|
|
91
|
+
permissions: string[];
|
|
92
|
+
};
|
|
93
|
+
export type ScopeMember = {
|
|
94
|
+
principalId: string;
|
|
95
|
+
type: "user" | "group";
|
|
96
|
+
herculesAuthUserId?: string;
|
|
97
|
+
status: "active" | "blocked" | "suspended" | "pending_approval" | "removed";
|
|
98
|
+
joinedAt: number;
|
|
99
|
+
name?: string;
|
|
100
|
+
email?: string;
|
|
101
|
+
image?: string;
|
|
102
|
+
roles: RoleSummary[];
|
|
103
|
+
};
|
|
104
|
+
export type ScopeMemberDirectoryEntry = {
|
|
105
|
+
principalId: string;
|
|
106
|
+
herculesAuthUserId: string;
|
|
107
|
+
name: string;
|
|
108
|
+
email: string;
|
|
109
|
+
image?: string;
|
|
110
|
+
roleKeys: string[];
|
|
111
|
+
};
|
|
112
|
+
export type ScopeMemberDirectoryPage = {
|
|
113
|
+
members: ScopeMemberDirectoryEntry[];
|
|
114
|
+
nextCursor?: string;
|
|
115
|
+
};
|
|
116
|
+
export type ScopeRoleSummary = RoleSummary & {
|
|
117
|
+
shared: boolean;
|
|
118
|
+
};
|
|
119
|
+
export type ScopePermissionSummary = {
|
|
120
|
+
permissionId: string;
|
|
121
|
+
key: string;
|
|
122
|
+
resourceType: string;
|
|
123
|
+
action: string;
|
|
124
|
+
classification: "delegable" | "owner_only";
|
|
125
|
+
tenantAssignable: boolean;
|
|
126
|
+
};
|
|
127
|
+
export type DirectResourceSubject = {
|
|
128
|
+
grantId: string;
|
|
129
|
+
principalId: string;
|
|
130
|
+
type: "user" | "group";
|
|
131
|
+
herculesAuthUserId?: string;
|
|
132
|
+
status: "active" | "blocked" | "suspended" | "pending_approval" | "removed";
|
|
133
|
+
name?: string;
|
|
134
|
+
email?: string;
|
|
135
|
+
image?: string;
|
|
136
|
+
effect: "allow" | "deny";
|
|
137
|
+
appliesTo: "self" | "self_and_descendants";
|
|
138
|
+
expiresAt?: number;
|
|
139
|
+
roleId?: string;
|
|
140
|
+
roleKey?: string;
|
|
141
|
+
roleName?: string;
|
|
142
|
+
permissionId?: string;
|
|
143
|
+
permissionKey?: string;
|
|
144
|
+
};
|
|
145
|
+
type ListDirectSubjectsArgs = {
|
|
146
|
+
tokenIdentifier?: string;
|
|
147
|
+
scopeId: string;
|
|
148
|
+
resourceType: string;
|
|
149
|
+
resourceId: string;
|
|
150
|
+
permission: string;
|
|
151
|
+
};
|
|
152
|
+
export type AccessContext<DataModel extends GenericDataModel = any> = Pick<GenericQueryCtx<DataModel>, "auth" | "runQuery"> | Pick<GenericMutationCtx<DataModel>, "auth" | "runQuery"> | Pick<GenericActionCtx<DataModel>, "auth" | "runQuery">;
|
|
153
|
+
export type AccessResourceRef = {
|
|
154
|
+
type: string;
|
|
155
|
+
id?: string;
|
|
156
|
+
};
|
|
157
|
+
export type AccessAuthorizationAncestor = {
|
|
158
|
+
type: string;
|
|
159
|
+
id: string;
|
|
160
|
+
};
|
|
161
|
+
export type AccessControlComponent = {
|
|
162
|
+
checks: {
|
|
163
|
+
authorize: FunctionReference<"query", "public", AuthorizationArgs, AuthorizationDecision>;
|
|
164
|
+
authorizeMany: FunctionReference<"query", "public", {
|
|
165
|
+
tokenIdentifier?: string;
|
|
166
|
+
checks: AuthorizationCheckArgs[];
|
|
167
|
+
}, AuthorizationDecision[]>;
|
|
168
|
+
};
|
|
169
|
+
queries: {
|
|
170
|
+
getDeploymentEntryStatus: FunctionReference<"query", "public", GetDeploymentEntryStatusArgs, AccessDeploymentEntryMirrorResult>;
|
|
171
|
+
listMyMemberships: FunctionReference<"query", "public", ListMyMembershipsArgs, Membership[]>;
|
|
172
|
+
listMyRoles: FunctionReference<"query", "public", ListMyRolesArgs, RoleSummary[]>;
|
|
173
|
+
getEffectivePermissions: FunctionReference<"query", "public", GetEffectivePermissionsArgs, EffectivePermissionsResult>;
|
|
174
|
+
listScopeMembers: FunctionReference<"query", "public", ListScopeArgs, ScopeMember[]>;
|
|
175
|
+
listScopeMemberDirectory: FunctionReference<"query", "public", ListScopeMemberDirectoryArgs, {
|
|
176
|
+
members: ScopeMemberDirectoryEntry[];
|
|
177
|
+
cursor?: string;
|
|
178
|
+
}>;
|
|
179
|
+
getScopeMemberDirectoryEntry: FunctionReference<"query", "public", GetScopeMemberDirectoryEntryArgs, ScopeMemberDirectoryEntry | null>;
|
|
180
|
+
listScopeRoles: FunctionReference<"query", "public", ListScopeArgs, ScopeRoleSummary[]>;
|
|
181
|
+
listScopePermissions: FunctionReference<"query", "public", ListScopeArgs, ScopePermissionSummary[]>;
|
|
182
|
+
listDirectSubjectsForResource: FunctionReference<"query", "public", ListDirectSubjectsArgs, DirectResourceSubject[]>;
|
|
183
|
+
};
|
|
184
|
+
};
|
|
185
|
+
export type CreateAccessControlOptions<DataModel extends GenericDataModel> = {
|
|
186
|
+
query: QueryBuilder<DataModel, "public">;
|
|
187
|
+
mutation: MutationBuilder<DataModel, "public">;
|
|
188
|
+
action: ActionBuilder<DataModel, "public">;
|
|
189
|
+
components?: Record<string, unknown>;
|
|
190
|
+
component?: AccessControlComponent;
|
|
191
|
+
componentName?: string;
|
|
192
|
+
};
|
|
193
|
+
export type ExtractedScope = string | {
|
|
194
|
+
scopeId: string;
|
|
195
|
+
resourceType?: string;
|
|
196
|
+
resourceId?: string;
|
|
197
|
+
ancestors?: Array<{
|
|
198
|
+
resourceType: string;
|
|
199
|
+
resourceId: string;
|
|
200
|
+
}>;
|
|
201
|
+
};
|
|
202
|
+
export type ExtractScope<Ctx, Args> = (ctx: Ctx, args: Args) => ExtractedScope | Promise<ExtractedScope>;
|
|
203
|
+
export type AccessQueryBuilder<DataModel extends GenericDataModel> = {
|
|
204
|
+
<ArgsValidator extends PropertyValidators | Validator<unknown, "required", string> | void, ReturnsValidator extends PropertyValidators | Validator<unknown, "required", string> | void, ReturnValue extends ReturnValueForOptionalValidator<ReturnsValidator> = any, OneOrZeroArgs extends ArgsArrayForOptionalValidator<ArgsValidator> = DefaultArgsForOptionalValidator<ArgsValidator>>(query: {
|
|
205
|
+
permission: string;
|
|
206
|
+
scope?: ExtractScope<GenericQueryCtx<DataModel>, OneOrZeroArgs[0]>;
|
|
207
|
+
args?: ArgsValidator;
|
|
208
|
+
returns?: ReturnsValidator;
|
|
209
|
+
handler: (ctx: GenericQueryCtx<DataModel>, ...args: OneOrZeroArgs) => ReturnValue;
|
|
210
|
+
}): RegisteredQuery<"public", ArgsArrayToObject<OneOrZeroArgs>, ReturnValue>;
|
|
211
|
+
};
|
|
212
|
+
export type AccessMutationBuilder<DataModel extends GenericDataModel> = {
|
|
213
|
+
<ArgsValidator extends PropertyValidators | Validator<unknown, "required", string> | void, ReturnsValidator extends PropertyValidators | Validator<unknown, "required", string> | void, ReturnValue extends ReturnValueForOptionalValidator<ReturnsValidator> = any, OneOrZeroArgs extends ArgsArrayForOptionalValidator<ArgsValidator> = DefaultArgsForOptionalValidator<ArgsValidator>>(mutation: {
|
|
214
|
+
permission: string;
|
|
215
|
+
scope?: ExtractScope<GenericMutationCtx<DataModel>, OneOrZeroArgs[0]>;
|
|
216
|
+
args?: ArgsValidator;
|
|
217
|
+
returns?: ReturnsValidator;
|
|
218
|
+
handler: (ctx: GenericMutationCtx<DataModel>, ...args: OneOrZeroArgs) => ReturnValue;
|
|
219
|
+
}): RegisteredMutation<"public", ArgsArrayToObject<OneOrZeroArgs>, ReturnValue>;
|
|
220
|
+
};
|
|
221
|
+
export type AccessActionBuilder<DataModel extends GenericDataModel> = {
|
|
222
|
+
<ArgsValidator extends PropertyValidators | Validator<unknown, "required", string> | void, ReturnsValidator extends PropertyValidators | Validator<unknown, "required", string> | void, ReturnValue extends ReturnValueForOptionalValidator<ReturnsValidator> = any, OneOrZeroArgs extends ArgsArrayForOptionalValidator<ArgsValidator> = DefaultArgsForOptionalValidator<ArgsValidator>>(action: {
|
|
223
|
+
permission: string;
|
|
224
|
+
scope?: ExtractScope<GenericActionCtx<DataModel>, OneOrZeroArgs[0]>;
|
|
225
|
+
args?: ArgsValidator;
|
|
226
|
+
returns?: ReturnsValidator;
|
|
227
|
+
handler: (ctx: GenericActionCtx<DataModel>, ...args: OneOrZeroArgs) => ReturnValue;
|
|
228
|
+
}): RegisteredAction<"public", ArgsArrayToObject<OneOrZeroArgs>, ReturnValue>;
|
|
229
|
+
};
|
|
230
|
+
export type AccessControlBuilders<DataModel extends GenericDataModel> = {
|
|
231
|
+
publicQuery: QueryBuilder<DataModel, "public">;
|
|
232
|
+
publicMutation: MutationBuilder<DataModel, "public">;
|
|
233
|
+
publicAction: ActionBuilder<DataModel, "public">;
|
|
234
|
+
authenticatedQuery: QueryBuilder<DataModel, "public">;
|
|
235
|
+
authenticatedMutation: MutationBuilder<DataModel, "public">;
|
|
236
|
+
authenticatedAction: ActionBuilder<DataModel, "public">;
|
|
237
|
+
accessQuery: AccessQueryBuilder<DataModel>;
|
|
238
|
+
accessMutation: AccessMutationBuilder<DataModel>;
|
|
239
|
+
accessAction: AccessActionBuilder<DataModel>;
|
|
240
|
+
hasPermission: (ctx: AccessContext<DataModel>, args: PermissionCheckArgs) => Promise<boolean>;
|
|
241
|
+
requirePermission: (ctx: AccessContext<DataModel>, args: PermissionCheckArgs) => Promise<void>;
|
|
242
|
+
requireAnyPermission: (ctx: AccessContext<DataModel>, args: AnyPermissionCheckArgs) => Promise<void>;
|
|
243
|
+
getEffectivePermissions: (ctx: AccessContext<DataModel>, args?: EffectivePermissionsArgs) => Promise<string[]>;
|
|
244
|
+
checkPermissions: (ctx: AccessContext<DataModel>, checks: Array<Exclude<PermissionCheckArgs, string>>) => Promise<AuthorizationDecision[]>;
|
|
245
|
+
/**
|
|
246
|
+
* Return the current user's canonical Hercules Auth id (`sub`) from the
|
|
247
|
+
* verified Convex identity. Use this to link app-owned profile or domain
|
|
248
|
+
* rows to the signed-in user instead of parsing `tokenIdentifier`.
|
|
249
|
+
*/
|
|
250
|
+
getCurrentHerculesAuthUserId: (ctx: AccessContext<DataModel>) => Promise<string | undefined>;
|
|
251
|
+
getDeploymentEntryStatus: (ctx: AccessContext<DataModel>) => Promise<AccessDeploymentEntryMirrorResult>;
|
|
252
|
+
filterAuthorizedResources: <T>(ctx: AccessContext<DataModel>, args: {
|
|
253
|
+
resources: T[];
|
|
254
|
+
permission: string;
|
|
255
|
+
scopeId?: string;
|
|
256
|
+
resource: (item: T) => AccessResourceRef;
|
|
257
|
+
ancestors?: (item: T) => AccessAuthorizationAncestor[];
|
|
258
|
+
}) => Promise<T[]>;
|
|
259
|
+
listMyMemberships: (ctx: AccessContext<DataModel>) => Promise<Membership[]>;
|
|
260
|
+
listMyRoles: (ctx: AccessContext<DataModel>, args?: {
|
|
261
|
+
scopeId?: string;
|
|
262
|
+
}) => Promise<RoleSummary[]>;
|
|
263
|
+
listScopeMembers: (ctx: AccessContext<DataModel>, args?: {
|
|
264
|
+
scopeId?: string;
|
|
265
|
+
}) => Promise<ScopeMember[]>;
|
|
266
|
+
listScopeMemberDirectory: (ctx: AccessContext<DataModel>, args?: {
|
|
267
|
+
scopeId?: string;
|
|
268
|
+
cursor?: string;
|
|
269
|
+
limit?: number;
|
|
270
|
+
}) => Promise<ScopeMemberDirectoryPage>;
|
|
271
|
+
getScopeMemberDirectoryEntry: (ctx: AccessContext<DataModel>, args: {
|
|
272
|
+
scopeId?: string;
|
|
273
|
+
principalId?: string;
|
|
274
|
+
herculesAuthUserId?: string;
|
|
275
|
+
}) => Promise<ScopeMemberDirectoryEntry | null>;
|
|
276
|
+
listScopeRoles: (ctx: AccessContext<DataModel>, args?: {
|
|
277
|
+
scopeId?: string;
|
|
278
|
+
}) => Promise<ScopeRoleSummary[]>;
|
|
279
|
+
listScopePermissions: (ctx: AccessContext<DataModel>, args?: {
|
|
280
|
+
scopeId?: string;
|
|
281
|
+
}) => Promise<ScopePermissionSummary[]>;
|
|
282
|
+
listDirectSubjectsForResource: (ctx: AccessContext<DataModel>, args: {
|
|
283
|
+
scopeId?: string;
|
|
284
|
+
resourceType: string;
|
|
285
|
+
resourceId: string;
|
|
286
|
+
permission: string;
|
|
287
|
+
}) => Promise<DirectResourceSubject[]>;
|
|
288
|
+
};
|
|
289
|
+
export type PermissionCheckArgs = string | {
|
|
290
|
+
scopeId?: string;
|
|
291
|
+
permission: string;
|
|
292
|
+
resource?: AccessResourceRef;
|
|
293
|
+
ancestors?: AccessAuthorizationAncestor[];
|
|
294
|
+
};
|
|
295
|
+
export type AnyPermissionCheckArgs = string[] | {
|
|
296
|
+
scopeId?: string;
|
|
297
|
+
permissions: string[];
|
|
298
|
+
resource?: AccessResourceRef;
|
|
299
|
+
ancestors?: AccessAuthorizationAncestor[];
|
|
300
|
+
};
|
|
301
|
+
export type EffectivePermissionsArgs = {
|
|
302
|
+
scopeId?: string;
|
|
303
|
+
resource?: AccessResourceRef;
|
|
304
|
+
ancestors?: AccessAuthorizationAncestor[];
|
|
305
|
+
};
|
|
306
|
+
/**
|
|
307
|
+
* Wires Hercules managed Access Control into a Convex app. Call once in
|
|
308
|
+
* `convex/hercules.ts`, passing the generated `query`/`mutation`/`action`
|
|
309
|
+
* builders and `components`, then re-export the returned builders.
|
|
310
|
+
*
|
|
311
|
+
* Returned builders:
|
|
312
|
+
* - `publicQuery`/`publicMutation`/`publicAction`: no auth.
|
|
313
|
+
* - `authenticatedQuery`/`...Mutation`/`...Action`: require sign-in only.
|
|
314
|
+
* - `accessQuery`/`accessMutation`/`accessAction`: enforce a permission in a
|
|
315
|
+
* scope. Pass `{ permission, scope }`; resolve `scope` with `scopeFromArg`
|
|
316
|
+
* or `scopeFromResource`. Use these for all org-owned reads and writes.
|
|
317
|
+
* - `hasPermission`/`requirePermission`/`requireAnyPermission`/
|
|
318
|
+
* `getEffectivePermissions`: in-handler checks. `getEffectivePermissions`
|
|
319
|
+
* and `hasPermission` accept an optional `{ resource }` ref for per-resource
|
|
320
|
+
* (e.g. per-project) checks.
|
|
321
|
+
* - `getCurrentHerculesAuthUserId`: the verified OIDC subject for linking
|
|
322
|
+
* app-owned domain rows. Do not parse `tokenIdentifier`.
|
|
323
|
+
* - `listMyMemberships`/`listMyRoles`: the caller's own scopes/roles.
|
|
324
|
+
* - `listScopeMembers`/`listScopeRoles`/`listScopePermissions`: complete
|
|
325
|
+
* mirrored admin reads for an in-app management screen. Each self-gates on
|
|
326
|
+
* the matching `system.*:read` permission and returns `[]` when the caller
|
|
327
|
+
* lacks it. Use `createAccessUserActions().listGrantableRoles` instead when
|
|
328
|
+
* choosing a role for a write at an exact target.
|
|
329
|
+
*
|
|
330
|
+
* Reads resolve against the app's local Access Control mirror, which lags the
|
|
331
|
+
* control plane by a short projection-sync window after any change.
|
|
332
|
+
*/
|
|
333
|
+
export declare function createAccessControl<DataModel extends GenericDataModel>(options: CreateAccessControlOptions<DataModel>): AccessControlBuilders<DataModel>;
|
|
334
|
+
export declare const DEFAULT_SCOPE_SENTINEL = "__hercules_default_scope__";
|
|
335
|
+
export declare const defaultScope: ExtractScope<unknown, unknown>;
|
|
336
|
+
export declare const PERMISSION_RESOURCE_TYPE_SENTINEL = "__hercules_permission_resource_type__";
|
|
337
|
+
/**
|
|
338
|
+
* Resolves the scope for an `access*` builder from a string arg the caller
|
|
339
|
+
* passes (e.g. the active org id). Use for list/create handlers where the
|
|
340
|
+
* frontend already knows the scope. Throws if the arg is missing or empty.
|
|
341
|
+
*
|
|
342
|
+
* Do not use this for an operation that receives an org-owned row id (read,
|
|
343
|
+
* update, delete): a caller could pair their own scope id with another org's
|
|
344
|
+
* row. Use `scopeFromResource` there so the scope is read from the row.
|
|
345
|
+
*/
|
|
346
|
+
export declare function scopeFromArg<K extends string>(argKey: K): (_ctx: unknown, args: Record<string, unknown>) => string;
|
|
347
|
+
type DbResourceCtx = {
|
|
348
|
+
db: {
|
|
349
|
+
get(id: unknown): Promise<unknown>;
|
|
350
|
+
};
|
|
351
|
+
};
|
|
352
|
+
/**
|
|
353
|
+
* Resolves the scope from a referenced row for an `access*` builder. Reads
|
|
354
|
+
* the row named by `argKey`, returns the row's scope plus the resource id,
|
|
355
|
+
* and lets `authorize` apply resource-level grants on top of the scope check.
|
|
356
|
+
* Use for any read/update/delete that receives an org-owned row id.
|
|
357
|
+
*
|
|
358
|
+
* Params:
|
|
359
|
+
* - `tableName`: the row's table (used in error messages only).
|
|
360
|
+
* - `argKey`: the field on `args` holding the row id.
|
|
361
|
+
* - `options.scopeField`: column carrying the org scope id (default
|
|
362
|
+
* `"orgScopeId"`).
|
|
363
|
+
*
|
|
364
|
+
* Resource type: the emitted `resourceType` defers to the checked permission's
|
|
365
|
+
* canonical catalog resource type (e.g. `app.project` for
|
|
366
|
+
* `app.project:archive`), which is also the type resource grants are pinned
|
|
367
|
+
* to, so grants on the row always match the guarded permission.
|
|
368
|
+
*
|
|
369
|
+
* Hierarchy: pass `options.authorizeAgainst` to declare ordered parent
|
|
370
|
+
* resources. The target and ancestors are evaluated atomically with the same
|
|
371
|
+
* requested permission, so any applicable deny wins. The app owns these
|
|
372
|
+
* relationships; the chain is bounded to ten ancestors.
|
|
373
|
+
*/
|
|
374
|
+
export declare function scopeFromResource<T extends string, K extends string>(tableName: T, argKey: K, options?: {
|
|
375
|
+
scopeField?: string;
|
|
376
|
+
authorizeAgainst?: (row: Record<string, unknown>) => AccessAuthorizationAncestor[];
|
|
377
|
+
}): (ctx: DbResourceCtx, args: Record<string, unknown>) => Promise<{
|
|
378
|
+
scopeId: string;
|
|
379
|
+
resourceType: string;
|
|
380
|
+
resourceId: string;
|
|
381
|
+
ancestors?: Array<{
|
|
382
|
+
resourceType: string;
|
|
383
|
+
resourceId: string;
|
|
384
|
+
}>;
|
|
385
|
+
}>;
|
|
386
|
+
/**
|
|
387
|
+
* Resolves a specific resource in the default app scope without requiring a
|
|
388
|
+
* scope id column on the row. Use this for single-scope apps that still need
|
|
389
|
+
* resource grants, denies, or per-resource UI checks.
|
|
390
|
+
*
|
|
391
|
+
* The row is loaded from `args[argKey]`, so authorization and mutation stay
|
|
392
|
+
* bound to the same resource. Pass `authorizeAgainst` for trusted parent
|
|
393
|
+
* resources exactly as with {@link scopeFromResource}.
|
|
394
|
+
*/
|
|
395
|
+
export declare function scopeFromDefaultResource<T extends string, K extends string>(tableName: T, argKey: K, options?: {
|
|
396
|
+
authorizeAgainst?: (row: Record<string, unknown>) => AccessAuthorizationAncestor[];
|
|
397
|
+
}): (ctx: DbResourceCtx, args: Record<string, unknown>) => Promise<{
|
|
398
|
+
scopeId: string;
|
|
399
|
+
resourceType: string;
|
|
400
|
+
resourceId: string;
|
|
401
|
+
ancestors?: Array<{
|
|
402
|
+
resourceType: string;
|
|
403
|
+
resourceId: string;
|
|
404
|
+
}>;
|
|
405
|
+
}>;
|
|
406
|
+
/**
|
|
407
|
+
* Resolves child-creation authorization from an existing parent row. The
|
|
408
|
+
* requested child permission stays unchanged; the parent is supplied as an
|
|
409
|
+
* explicit ancestor and only descendant-enabled bindings apply through it.
|
|
410
|
+
*/
|
|
411
|
+
export declare function scopeFromParentResource<T extends string, K extends string>(tableName: T, argKey: K, options: {
|
|
412
|
+
scopeField?: string;
|
|
413
|
+
parentResourceType: string;
|
|
414
|
+
authorizeAgainst?: (row: Record<string, unknown>) => AccessAuthorizationAncestor[];
|
|
415
|
+
}): (ctx: DbResourceCtx, args: Record<string, unknown>) => Promise<{
|
|
416
|
+
scopeId: string;
|
|
417
|
+
resourceType: string;
|
|
418
|
+
ancestors: Array<{
|
|
419
|
+
resourceType: string;
|
|
420
|
+
resourceId: string;
|
|
421
|
+
}>;
|
|
422
|
+
}>;
|
|
423
|
+
/**
|
|
424
|
+
* Resolves child creation against a parent resource in the default app scope.
|
|
425
|
+
* The parent row is loaded from `args[argKey]`; no scope id field is required
|
|
426
|
+
* on the parent or child tables.
|
|
427
|
+
*/
|
|
428
|
+
export declare function scopeFromDefaultParentResource<T extends string, K extends string>(tableName: T, argKey: K, options: {
|
|
429
|
+
parentResourceType: string;
|
|
430
|
+
authorizeAgainst?: (row: Record<string, unknown>) => AccessAuthorizationAncestor[];
|
|
431
|
+
}): (ctx: DbResourceCtx, args: Record<string, unknown>) => Promise<{
|
|
432
|
+
scopeId: string;
|
|
433
|
+
resourceType: string;
|
|
434
|
+
ancestors: Array<{
|
|
435
|
+
resourceType: string;
|
|
436
|
+
resourceId: string;
|
|
437
|
+
}>;
|
|
438
|
+
}>;
|
|
439
|
+
export {};
|
|
440
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAC7B,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,+BAA+B,EAChC,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAoB,kBAAkB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE,CAAC;AACF,KAAK,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,GAAG;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC1D,KAAK,4BAA4B,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjE,KAAK,eAAe,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AACrE,KAAK,2BAA2B,GAAG;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE,CAAC;AAEF,KAAK,aAAa,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AACnE,KAAK,4BAA4B,GAAG,aAAa,GAAG;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AACF,KAAK,gCAAgC,GAAG,aAAa,GAAG;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,GAAG,SAAS,CAAC;CAC7E,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B,QAAQ,GACR,SAAS,GACT,WAAW,GACX,kBAAkB,GAClB,SAAS,CAAC;AAEd,MAAM,MAAM,iCAAiC,GACzC;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EACF,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,uBAAuB,GACvB,mBAAmB,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEN,MAAM,MAAM,0BAA0B,GAAG;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAK3B,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC5E,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,WAAW,GAAG,YAAY,CAAC;IAC3C,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAG5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,sBAAsB,GAAG;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,SAAS,SAAS,gBAAgB,GAAG,GAAG,IAC9D,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,GACrD,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,GACxD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9D,MAAM,MAAM,2BAA2B,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE;QACN,SAAS,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAC1F,aAAa,EAAE,iBAAiB,CAC9B,OAAO,EACP,QAAQ,EACR;YAAE,eAAe,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,sBAAsB,EAAE,CAAA;SAAE,EAC9D,qBAAqB,EAAE,CACxB,CAAC;KACH,CAAC;IACF,OAAO,EAAE;QACP,wBAAwB,EAAE,iBAAiB,CACzC,OAAO,EACP,QAAQ,EACR,4BAA4B,EAC5B,iCAAiC,CAClC,CAAC;QACF,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7F,WAAW,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC;QAClF,uBAAuB,EAAE,iBAAiB,CACxC,OAAO,EACP,QAAQ,EACR,2BAA2B,EAC3B,0BAA0B,CAC3B,CAAC;QACF,gBAAgB,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,wBAAwB,EAAE,iBAAiB,CACzC,OAAO,EACP,QAAQ,EACR,4BAA4B,EAC5B;YAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAC1D,CAAC;QACF,4BAA4B,EAAE,iBAAiB,CAC7C,OAAO,EACP,QAAQ,EACR,gCAAgC,EAChC,yBAAyB,GAAG,IAAI,CACjC,CAAC;QACF,cAAc,EAAE,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxF,oBAAoB,EAAE,iBAAiB,CACrC,OAAO,EACP,QAAQ,EACR,aAAa,EACb,sBAAsB,EAAE,CACzB,CAAC;QACF,6BAA6B,EAAE,iBAAiB,CAC9C,OAAO,EACP,QAAQ,EACR,sBAAsB,EACtB,qBAAqB,EAAE,CACxB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,SAAS,SAAS,gBAAgB,IAAI;IAC3E,KAAK,EAAE,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,QAAQ,EAAE,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAMF,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE,CAAC;AAEN,MAAM,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,IAAI,CACpC,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,IAAI,KACP,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAO9C,MAAM,MAAM,kBAAkB,CAAC,SAAS,SAAS,gBAAgB,IAAI;IACnE,CACE,aAAa,SAAS,kBAAkB,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,EACxF,gBAAgB,SAAS,kBAAkB,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,EAC3F,WAAW,SAAS,+BAA+B,CAAC,gBAAgB,CAAC,GAAG,GAAG,EAC3E,aAAa,SAAS,6BAA6B,CAAC,aAAa,CAAC,GAChE,+BAA+B,CAAC,aAAa,CAAC,EAChD,KAAK,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,EAAE,aAAa,CAAC;QACrB,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,KAAK,WAAW,CAAC;KACnF,GAAG,eAAe,CAAC,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;CAC9E,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,SAAS,SAAS,gBAAgB,IAAI;IACtE,CACE,aAAa,SAAS,kBAAkB,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,EACxF,gBAAgB,SAAS,kBAAkB,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,EAC3F,WAAW,SAAS,+BAA+B,CAAC,gBAAgB,CAAC,GAAG,GAAG,EAC3E,aAAa,SAAS,6BAA6B,CAAC,aAAa,CAAC,GAChE,+BAA+B,CAAC,aAAa,CAAC,EAChD,QAAQ,EAAE;QACV,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,EAAE,aAAa,CAAC;QACrB,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,KAAK,WAAW,CAAC;KACtF,GAAG,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;CACjF,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,SAAS,SAAS,gBAAgB,IAAI;IACpE,CACE,aAAa,SAAS,kBAAkB,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,EACxF,gBAAgB,SAAS,kBAAkB,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,EAC3F,WAAW,SAAS,+BAA+B,CAAC,gBAAgB,CAAC,GAAG,GAAG,EAC3E,aAAa,SAAS,6BAA6B,CAAC,aAAa,CAAC,GAChE,+BAA+B,CAAC,aAAa,CAAC,EAChD,MAAM,EAAE;QACR,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,YAAY,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,EAAE,aAAa,CAAC;QACrB,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,KAAK,WAAW,CAAC;KACpF,GAAG,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;CAC/E,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,SAAS,SAAS,gBAAgB,IAAI;IACtE,WAAW,EAAE,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,cAAc,EAAE,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,YAAY,EAAE,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjD,kBAAkB,EAAE,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACtD,qBAAqB,EAAE,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,mBAAmB,EAAE,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACxD,WAAW,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,cAAc,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjD,YAAY,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7C,aAAa,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9F,iBAAiB,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,oBAAoB,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrG,uBAAuB,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,gBAAgB,EAAE,CAChB,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,KAChD,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACtC;;;;OAIG;IACH,4BAA4B,EAAE,CAC5B,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,KAC1B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,wBAAwB,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAMxG,yBAAyB,EAAE,CAAC,CAAC,EAC3B,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,IAAI,EAAE;QACJ,SAAS,EAAE,CAAC,EAAE,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,iBAAiB,CAAC;QACzC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,2BAA2B,EAAE,CAAC;KACxD,KACE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClB,iBAAiB,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5E,WAAW,EAAE,CACX,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAK5B,gBAAgB,EAAE,CAChB,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5B,wBAAwB,EAAE,CACxB,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KACzD,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACvC,4BAA4B,EAAE,CAC5B,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,IAAI,EAAE;QACJ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,KACE,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAC/C,cAAc,EAAE,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5G,oBAAoB,EAAE,CACpB,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KACxB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAOvC,6BAA6B,EAAE,CAC7B,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,EAC7B,IAAI,EAAE;QACJ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,KACE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN;IACE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,SAAS,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAC3C,CAAC;AAEN,MAAM,MAAM,sBAAsB,GAC9B,MAAM,EAAE,GACR;IACE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,SAAS,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAC3C,CAAC;AAEN,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,SAAS,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAC3C,CAAC;AAUF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,gBAAgB,EACpE,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,GAC7C,qBAAqB,CAAC,SAAS,CAAC,CAiClC;AAQD,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAEnE,eAAO,MAAM,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,CAAgC,CAAC;AAUzF,eAAO,MAAM,iCAAiC,0CAA0C,CAAC;AAEzF;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,IAC9C,MAAM,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAU9D;AAED,KAAK,aAAa,GAAG;IAAE,EAAE,EAAE;QAAE,GAAG,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EAClE,SAAS,EAAE,CAAC,EACZ,MAAM,EAAE,CAAC,EACT,OAAO,GAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,2BAA2B,EAAE,CAAC;CAC/E,IAIJ,KAAK,aAAa,EAClB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE,CAAC,CAiCH;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EACzE,SAAS,EAAE,CAAC,EACZ,MAAM,EAAE,CAAC,EACT,OAAO,GAAE;IACP,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,2BAA2B,EAAE,CAAC;CAC/E,IAGJ,KAAK,aAAa,EAClB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE,CAAC,CA0BH;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EACxE,SAAS,EAAE,CAAC,EACZ,MAAM,EAAE,CAAC,EACT,OAAO,EAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,2BAA2B,EAAE,CAAC;CACpF,IAIC,KAAK,aAAa,EAClB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,CAAC,CAmCH;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EAC/E,SAAS,EAAE,CAAC,EACZ,MAAM,EAAE,CAAC,EACT,OAAO,EAAE;IACP,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,2BAA2B,EAAE,CAAC;CACpF,IAGC,KAAK,aAAa,EAClB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,CAAC,CA4BH"}
|