@willyim/idp 0.1.1 → 0.3.0

package/dist/src/schemas/operations.d.ts

@@ -0,0 +1,502 @@
+/**
+ * Every operation the management API exposes, in one table.
+ *
+ * Three things read it: `buildOpenApiDocument` (in `./openapi.ts`) turns it
+ * into the published document, `api.ts` uses it to type its `request()` and to
+ * parse what comes back, and `apps/idp` validates request bodies with the same
+ * `input` schemas. Adding an endpoint means adding a row here; nothing else
+ * needs to learn about it.
+ */
+import { z } from "zod";
+export type HttpMethod = "get" | "post" | "patch" | "delete" | "put";
+/** A query parameter, as the document describes it. Path params are inferred. */
+export type QueryParam = {
+    name: string;
+    description?: string;
+    required?: boolean;
+};
+export type OperationDef = {
+    summary: string;
+    /**
+     * The scoped-key permission this operation needs. Absent means superadmin
+     * only — the cross-app list endpoints.
+     */
+    permission?: string;
+    description?: string;
+    query?: readonly QueryParam[];
+    /** Path-parameter descriptions, keyed by name. Purely documentation. */
+    params?: Readonly<Record<string, string>>;
+    /** Set when the operation addresses a single row that may not exist. */
+    notFound?: string;
+    input?: z.ZodType;
+    successCode: "200" | "201";
+    success: z.ZodType;
+};
+export declare const operations: {
+    readonly "get /api/v1/applications": {
+        readonly summary: "List registered applications";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            applications: z.ZodArray<z.ZodObject<{
+                clientId: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                app: z.ZodNullable<z.ZodString>;
+                allowSignup: z.ZodBoolean;
+                permissions: z.ZodArray<z.ZodString>;
+                redirectUris: z.ZodArray<z.ZodString>;
+                disabled: z.ZodBoolean;
+                createdAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/applications": {
+        readonly summary: "Register an application (client secret returned once)";
+        readonly description: "Requires the superadmin token. Creating an application is an IdP-level act — there is no app to scope a permission to yet.";
+        readonly input: z.ZodObject<{
+            name: z.ZodString;
+            app: z.ZodString;
+            redirectUris: z.ZodArray<z.ZodString>;
+            firstAdminUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+            app: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/applications/{clientId}": {
+        readonly summary: "Get one application";
+        readonly permission: "app:read";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            clientId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            app: z.ZodNullable<z.ZodString>;
+            allowSignup: z.ZodBoolean;
+            permissions: z.ZodArray<z.ZodString>;
+            redirectUris: z.ZodArray<z.ZodString>;
+            disabled: z.ZodBoolean;
+            createdAt: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "patch /api/v1/applications/{clientId}": {
+        readonly summary: "Update an application";
+        readonly permission: "app:update";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly input: z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            redirectUris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            allowSignup: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>;
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            clientId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            app: z.ZodNullable<z.ZodString>;
+            allowSignup: z.ZodBoolean;
+            permissions: z.ZodArray<z.ZodString>;
+            redirectUris: z.ZodArray<z.ZodString>;
+            disabled: z.ZodBoolean;
+            createdAt: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "delete /api/v1/applications/{clientId}": {
+        readonly summary: "Deregister an application";
+        readonly permission: "app:delete";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/applications/{clientId}/rotate-secret": {
+        readonly summary: "Rotate the client secret (returned once; the old one stops working)";
+        readonly permission: "app:update";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            clientSecret: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "put /api/v1/apps/{app}/permissions": {
+        readonly summary: "Replace the app's product-permission catalog";
+        readonly permission: "app:update";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly notFound: "No application with that app key";
+        readonly input: z.ZodObject<{
+            permissions: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            permissions: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/apps/{app}/keys": {
+        readonly summary: "List scoped management API keys (never the hashes)";
+        readonly permission: "apikey:read";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                prefix: z.ZodString;
+                permissions: z.ZodArray<z.ZodString>;
+                status: z.ZodEnum<{
+                    active: "active";
+                    expired: "expired";
+                    revoked: "revoked";
+                }>;
+                createdAt: z.ZodString;
+                lastUsedAt: z.ZodNullable<z.ZodString>;
+                expiresAt: z.ZodNullable<z.ZodString>;
+                revokedAt: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/apps/{app}/keys": {
+        readonly summary: "Mint a scoped management API key (plaintext returned once)";
+        readonly description: "Requires `apikey:create` on the path app (or the superadmin token). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.";
+        readonly permission: "apikey:create";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly input: z.ZodObject<{
+            name: z.ZodString;
+            permissions: z.ZodArray<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            id: z.ZodString;
+            token: z.ZodString;
+            prefix: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "delete /api/v1/apps/{app}/keys/{id}": {
+        readonly summary: "Revoke a scoped management API key (idempotent)";
+        readonly permission: "apikey:revoke";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly notFound: "No key with that id on this app";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/admin-keys": {
+        readonly summary: "List IdP-level admin keys (never the hashes)";
+        readonly description: "Requires the superadmin token or an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                prefix: z.ZodString;
+                status: z.ZodEnum<{
+                    active: "active";
+                    expired: "expired";
+                    revoked: "revoked";
+                }>;
+                createdAt: z.ZodString;
+                lastUsedAt: z.ZodNullable<z.ZodString>;
+                expiresAt: z.ZodNullable<z.ZodString>;
+                revokedAt: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/admin-keys": {
+        readonly summary: "Mint an IdP-level admin key (plaintext returned once)";
+        readonly description: "Requires the superadmin token or an admin key. Mint one per agent: unlike the static ADMIN_API_TOKEN, an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log.";
+        readonly input: z.ZodObject<{
+            name: z.ZodString;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            id: z.ZodString;
+            token: z.ZodString;
+            prefix: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "delete /api/v1/admin-keys/{id}": {
+        readonly summary: "Revoke an IdP-level admin key (idempotent)";
+        readonly description: "A key may revoke itself — an agent cleaning up after itself is legitimate — after which its next request is simply unauthorized.";
+        readonly params: {
+            readonly id: "Admin key id.";
+        };
+        readonly notFound: "No admin key with that id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/users": {
+        readonly summary: "List users";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            users: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                email: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                emailVerified: z.ZodBoolean;
+                createdAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/workspaces": {
+        readonly summary: "List workspaces";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            workspaces: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                slug: z.ZodString;
+                applicationId: z.ZodNullable<z.ZodString>;
+                createdAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/apps/{app}/members": {
+        readonly summary: "List app members";
+        readonly permission: "member:read";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            members: z.ZodArray<z.ZodObject<{
+                userId: z.ZodString;
+                email: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                role: z.ZodEnum<{
+                    admin: "admin";
+                    member: "member";
+                }>;
+                permissions: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/apps/{app}/members": {
+        readonly summary: "Add or invite a member";
+        readonly permission: "member:invite";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly input: z.ZodObject<{
+            email: z.ZodString;
+            role: z.ZodDefault<z.ZodEnum<{
+                admin: "admin";
+                member: "member";
+            }>>;
+            permissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            result: z.ZodEnum<{
+                added: "added";
+                invited: "invited";
+            }>;
+        }, z.core.$strip>;
+    };
+    readonly "patch /api/v1/apps/{app}/members/{userId}": {
+        readonly summary: "Update a member's role + permissions";
+        readonly permission: "member:manage";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly input: z.ZodObject<{
+            role: z.ZodEnum<{
+                admin: "admin";
+                member: "member";
+            }>;
+            permissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>;
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "delete /api/v1/apps/{app}/members/{userId}": {
+        readonly summary: "Remove a member";
+        readonly permission: "member:manage";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/apps/{app}/workspaces": {
+        readonly summary: "List app workspaces";
+        readonly permission: "workspace:read";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            workspaces: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                slug: z.ZodString;
+                applicationId: z.ZodNullable<z.ZodString>;
+                createdAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/apps/{app}/workspaces": {
+        readonly summary: "Create a workspace";
+        readonly permission: "workspace:create";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly input: z.ZodObject<{
+            name: z.ZodString;
+            slug: z.ZodString;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            slug: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/apps/{app}/user-keys": {
+        readonly summary: "List end-user API keys";
+        readonly permission: "userkey:read";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly query: readonly [{
+            readonly name: "userId";
+            readonly description: "Only keys owned by this user.";
+        }, {
+            readonly name: "workspaceId";
+            readonly description: "Only keys bound to this workspace.";
+        }];
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                userId: z.ZodString;
+                workspaceId: z.ZodNullable<z.ZodString>;
+                name: z.ZodString;
+                prefix: z.ZodString;
+                scopes: z.ZodArray<z.ZodString>;
+                status: z.ZodEnum<{
+                    active: "active";
+                    expired: "expired";
+                    revoked: "revoked";
+                }>;
+                createdAt: z.ZodString;
+                lastUsedAt: z.ZodNullable<z.ZodString>;
+                expiresAt: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/apps/{app}/user-keys": {
+        readonly summary: "Mint an end-user API key (plaintext returned once)";
+        readonly permission: "userkey:create";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly input: z.ZodObject<{
+            userId: z.ZodString;
+            name: z.ZodString;
+            scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            workspaceId: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            id: z.ZodString;
+            token: z.ZodString;
+            prefix: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/apps/{app}/user-keys/validate": {
+        readonly summary: "Validate a presented end-user key (200 + valid discriminator)";
+        readonly permission: "userkey:validate";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly input: z.ZodObject<{
+            token: z.ZodString;
+        }, z.core.$strip>;
+        readonly successCode: "200";
+        readonly success: z.ZodUnion<readonly [z.ZodObject<{
+            valid: z.ZodLiteral<true>;
+            keyId: z.ZodString;
+            userId: z.ZodString;
+            workspaceId: z.ZodNullable<z.ZodString>;
+            scopes: z.ZodArray<z.ZodString>;
+            name: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            valid: z.ZodLiteral<false>;
+            reason: z.ZodEnum<{
+                expired: "expired";
+                revoked: "revoked";
+                not_found: "not_found";
+            }>;
+        }, z.core.$strip>]>;
+    };
+    readonly "delete /api/v1/apps/{app}/user-keys/{id}": {
+        readonly summary: "Revoke an end-user API key (idempotent)";
+        readonly permission: "userkey:revoke";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/apps/{app}/audit": {
+        readonly summary: "List recent audit entries";
+        readonly permission: "audit:read";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            entries: z.ZodArray<z.ZodObject<{
+                id: z.ZodNumber;
+                tableName: z.ZodString;
+                operation: z.ZodString;
+                rowId: z.ZodNullable<z.ZodString>;
+                userId: z.ZodNullable<z.ZodString>;
+                actor: z.ZodNullable<z.ZodString>;
+                createdAt: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+};
+export type Operations = typeof operations;
+export type OperationKey = keyof Operations;
+/** `"get /api/v1/users"` -> the paths that declare that method. */
+export type PathsFor<M extends HttpMethod> = OperationKey extends infer K ? K extends `${M} ${infer P}` ? P : never : never;
+export type OperationFor<M extends HttpMethod, P extends string> = `${M} ${P}` extends OperationKey ? Operations[`${M} ${P}`] : never;
+/** Path parameters read straight off the path template — `{app}`, `{userId}`. */
+export type PathParamNames<P extends string> = P extends `${string}{${infer Name}}${infer Rest}` ? Name | PathParamNames<Rest> : never;
+export declare function lookup(method: string, path: string): OperationDef | undefined;
+//# sourceMappingURL=operations.d.ts.map

package/dist/src/schemas/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../src/schemas/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAkCvB,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpE,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEnF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;IACjB,WAAW,EAAE,KAAK,GAAG,KAAK,CAAA;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAA;CACnB,CAAA;AAKD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6M0B,CAAA;AAEjD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAA;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,UAAU,CAAA;AAE3C,mEAAmE;AACnE,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,UAAU,IAAI,YAAY,SAAS,MAAM,CAAC,GACrE,CAAC,SAAS,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,GACzB,CAAC,GACD,KAAK,GACP,KAAK,CAAA;AAET,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,YAAY,GAC/F,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GACvB,KAAK,CAAA;AAET,iFAAiF;AACjF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GAC5F,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAC3B,KAAK,CAAA;AAET,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE7E"}