@antasphere/chassis-contract 0.0.0-stage → 1.0.0

package/dist/schemas/common.d.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+/**
+ * API conventions (fixed): plain resource JSON on success — no
+ * `{ success, data }` envelope; errors are `{ error: { code, message,
+ * details? } }`; cursor pagination.
+ */
+export declare const apiErrorSchema: z.ZodObject<{
+    error: z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ApiError = z.infer<typeof apiErrorSchema>;
+export declare const workspaceRoleSchema: z.ZodEnum<{
+    owner: "owner";
+    admin: "admin";
+    member: "member";
+}>;
+export type WorkspaceRole = z.infer<typeof workspaceRoleSchema>;
+export declare const cursorPageQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+/**
+ * Free text a client may send that ends up in a Postgres `text`/`varchar`
+ * column, a filename, or a log line.
+ *
+ * Postgres cannot store a NUL byte in a text value: it raises SQLSTATE 22021
+ * from deep inside the driver, which surfaces as an unhandled 500 whose
+ * error-level log line prints the failing statement AND its bound parameters.
+ * An anonymous client can drive that on any free-text sink (`/setup`, the
+ * invitation accept, the CLI key mint). NUL is never meaningful in a name, a
+ * label, or a title, so the contract refuses it and the caller gets the
+ * ordinary 400 validation_error instead.
+ *
+ * The other C0 controls are rejected with it: they are invisible in every UI,
+ * they are the raw material of log-injection and terminal-escape tricks, and
+ * no legitimate name contains one. Newlines and tabs are ALLOWED — multi-line
+ * free text is a real thing; a sink that must stay single-line adds its own
+ * `.regex()`.
+ */
+export declare function hasControlChars(value: string): boolean;
+export declare function noControlChars<T extends z.ZodType<string>>(schema: T): T;
+/**
+ * Postgres int4 ceiling. Every integer the API accepts that lands in an
+ * `integer` column (version numbers, cursors) must be bounded by it at the
+ * contract: `Number.isInteger(1e15)` is true, so a bare `.int()` lets a value
+ * past bigint-free column range through to Postgres, which refuses it with
+ * a numeric-overflow error that would surface as a 500.
+ */
+export declare const INT4_MAX = 2147483647;
+/**
+ * True when the value graph carries a NUL character in any string — object
+ * keys included. Postgres cannot store NUL in `text` (SQLSTATE 22021) or in
+ * `jsonb` (`\u0000` raises 22P05), so any client-supplied structure bound for
+ * a jsonb column (annotation selections, form payloads, a resource's metadata) is
+ * refused at the contract instead of surfacing a driver error. Iterative walk
+ * — never recursion — so a deeply nested value cannot blow the stack in the
+ * very guard meant to protect against hostile shapes.
+ */
+export declare function hasNulDeep(value: unknown): boolean;
+/**
+ * Nesting depth of a parsed JSON value, computed iteratively (the point is to
+ * measure hostile depth without recursing over it). Scalars are depth 0; an
+ * object or array adds one level. Contracts cap opaque structures with this
+ * BEFORE any `JSON.stringify` runs on them — stringify is recursive and blows
+ * the V8 stack with a RangeError at a build-dependent depth (SL-B5), so the
+ * check must come first, and the contract must stay safe even when consumed
+ * outside the server (SDK, dashboard) where no edge middleware ran.
+ */
+export declare function jsonDepthOf(value: unknown): number;
+/**
+ * Depth cap for the opaque JSON objects the contract carries (metadata,
+ * annotation selections, form payloads). Far above any legitimate shape —
+ * the deepest real structure is a handful of levels — and far below both the
+ * server edge cap (100) and the stringify breaking depth (~5000 on
+ * node:22-alpine).
+ */
+export declare const MAX_OPAQUE_JSON_DEPTH = 32;
+/**
+ * The shared guard for an opaque client-supplied JSON object bound for a
+ * jsonb column: depth-capped first (so the later size refine may stringify
+ * safely), then NUL-free. Compose it onto a `z.record(...)` with `.check`
+ * short-circuiting: zod runs refinements in order and skips later ones once
+ * one fails only when `abort` is set, so both checks abort.
+ */
+export declare function opaqueJsonChecks<T extends z.ZodType<Record<string, unknown>>>(schema: T): T;
+/**
+ * The one free-text string builder: length-bounded and NUL-free.
+ * Every user-supplied name/label/title in this contract goes through it.
+ */
+export declare function plainText(min: number, max: number): z.ZodString;
+export declare const MEDIA_TYPE_RE: RegExp;
+export declare function isValidMediaType(value: string): boolean;
+//# sourceMappingURL=common.d.ts.map

package/dist/schemas/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/schemas/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;iBAMzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,mBAAmB;;;;EAAuC,CAAC;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQtD;AAED,wBAAgB,cAAc,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAIxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,aAAgB,CAAC;AAEtC;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAwBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAoBlD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAU3F;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,eAEjD;AAcD,eAAO,MAAM,aAAa,QAGzB,CAAC;AAoBF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/schemas/common.js

@@ -0,0 +1,205 @@
+import { z } from 'zod';
+/**
+ * API conventions (fixed): plain resource JSON on success — no
+ * `{ success, data }` envelope; errors are `{ error: { code, message,
+ * details? } }`; cursor pagination.
+ */
+export const apiErrorSchema = z.object({
+    error: z.object({
+        code: z.string(),
+        message: z.string(),
+        details: z.unknown().optional()
+    })
+});
+export const workspaceRoleSchema = z.enum(['owner', 'admin', 'member']);
+export const cursorPageQuerySchema = z.object({
+    cursor: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(50)
+});
+/**
+ * Free text a client may send that ends up in a Postgres `text`/`varchar`
+ * column, a filename, or a log line.
+ *
+ * Postgres cannot store a NUL byte in a text value: it raises SQLSTATE 22021
+ * from deep inside the driver, which surfaces as an unhandled 500 whose
+ * error-level log line prints the failing statement AND its bound parameters.
+ * An anonymous client can drive that on any free-text sink (`/setup`, the
+ * invitation accept, the CLI key mint). NUL is never meaningful in a name, a
+ * label, or a title, so the contract refuses it and the caller gets the
+ * ordinary 400 validation_error instead.
+ *
+ * The other C0 controls are rejected with it: they are invisible in every UI,
+ * they are the raw material of log-injection and terminal-escape tricks, and
+ * no legitimate name contains one. Newlines and tabs are ALLOWED — multi-line
+ * free text is a real thing; a sink that must stay single-line adds its own
+ * `.regex()`.
+ */
+export function hasControlChars(value) {
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        // Tab / LF / CR are legitimate in multi-line free text.
+        if (code === 0x09 || code === 0x0a || code === 0x0d)
+            continue;
+        if (code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+export function noControlChars(schema) {
+    return schema.refine((v) => !hasControlChars(v), {
+        error: 'must not contain NUL or other control characters'
+    });
+}
+/**
+ * Postgres int4 ceiling. Every integer the API accepts that lands in an
+ * `integer` column (version numbers, cursors) must be bounded by it at the
+ * contract: `Number.isInteger(1e15)` is true, so a bare `.int()` lets a value
+ * past bigint-free column range through to Postgres, which refuses it with
+ * a numeric-overflow error that would surface as a 500.
+ */
+export const INT4_MAX = 2_147_483_647;
+/**
+ * True when the value graph carries a NUL character in any string — object
+ * keys included. Postgres cannot store NUL in `text` (SQLSTATE 22021) or in
+ * `jsonb` (`\u0000` raises 22P05), so any client-supplied structure bound for
+ * a jsonb column (annotation selections, form payloads, a resource's metadata) is
+ * refused at the contract instead of surfacing a driver error. Iterative walk
+ * — never recursion — so a deeply nested value cannot blow the stack in the
+ * very guard meant to protect against hostile shapes.
+ */
+export function hasNulDeep(value) {
+    const stack = [value];
+    // A shared value graph (the contract is documented safe to run outside the
+    // server, where a caller may hand it a live object carrying a cycle) would
+    // spin this walk forever; the seen-set makes each container visited once.
+    const seen = new WeakSet();
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (typeof current === 'string') {
+            if (current.includes('\u0000'))
+                return true;
+        }
+        else if (Array.isArray(current)) {
+            if (seen.has(current))
+                continue;
+            seen.add(current);
+            for (const item of current)
+                stack.push(item);
+        }
+        else if (current !== null && typeof current === 'object') {
+            if (seen.has(current))
+                continue;
+            seen.add(current);
+            for (const [key, item] of Object.entries(current)) {
+                if (key.includes('\u0000'))
+                    return true;
+                stack.push(item);
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Nesting depth of a parsed JSON value, computed iteratively (the point is to
+ * measure hostile depth without recursing over it). Scalars are depth 0; an
+ * object or array adds one level. Contracts cap opaque structures with this
+ * BEFORE any `JSON.stringify` runs on them — stringify is recursive and blows
+ * the V8 stack with a RangeError at a build-dependent depth (SL-B5), so the
+ * check must come first, and the contract must stay safe even when consumed
+ * outside the server (SDK, dashboard) where no edge middleware ran.
+ */
+export function jsonDepthOf(value) {
+    let max = 0;
+    const stack = [{ node: value, depth: 0 }];
+    // Same cycle guard as hasNulDeep: a live object with a back-reference must
+    // not make the depth walk (or the caller's later stringify) run forever.
+    const seen = new WeakSet();
+    while (stack.length > 0) {
+        const { node, depth } = stack.pop();
+        if (depth > max)
+            max = depth;
+        if (node !== null && typeof node === 'object') {
+            if (seen.has(node))
+                continue;
+            seen.add(node);
+        }
+        if (Array.isArray(node)) {
+            for (const item of node)
+                stack.push({ node: item, depth: depth + 1 });
+        }
+        else if (node !== null && typeof node === 'object') {
+            for (const item of Object.values(node))
+                stack.push({ node: item, depth: depth + 1 });
+        }
+    }
+    return max;
+}
+/**
+ * Depth cap for the opaque JSON objects the contract carries (metadata,
+ * annotation selections, form payloads). Far above any legitimate shape —
+ * the deepest real structure is a handful of levels — and far below both the
+ * server edge cap (100) and the stringify breaking depth (~5000 on
+ * node:22-alpine).
+ */
+export const MAX_OPAQUE_JSON_DEPTH = 32;
+/**
+ * The shared guard for an opaque client-supplied JSON object bound for a
+ * jsonb column: depth-capped first (so the later size refine may stringify
+ * safely), then NUL-free. Compose it onto a `z.record(...)` with `.check`
+ * short-circuiting: zod runs refinements in order and skips later ones once
+ * one fails only when `abort` is set, so both checks abort.
+ */
+export function opaqueJsonChecks(schema) {
+    return schema
+        .refine((v) => jsonDepthOf(v) <= MAX_OPAQUE_JSON_DEPTH, {
+        error: `must not nest deeper than ${MAX_OPAQUE_JSON_DEPTH} levels`,
+        abort: true
+    })
+        .refine((v) => !hasNulDeep(v), {
+        error: 'must not contain NUL characters in keys or values',
+        abort: true
+    });
+}
+/**
+ * The one free-text string builder: length-bounded and NUL-free.
+ * Every user-supplied name/label/title in this contract goes through it.
+ */
+export function plainText(min, max) {
+    return noControlChars(z.string().min(min).max(max));
+}
+/**
+ * RFC 7231 media type: `token "/" token`, optionally followed by
+ * `;`-separated `token=token|quoted-string` parameters. The manifest's
+ * `contentType` is copied VERBATIM into the response `Content-Type` header
+ * when the blob is served (`files/serve.ts`), including on the anonymous
+ * viewer — and versions are immutable, so a committed value that the
+ * `Headers` constructor refuses (a non-Latin-1 character, say) was a
+ * permanent anonymous 500 on that asset (PLT-5, PRDCT-1358). The grammar
+ * check at commit is the fix; the serve-time sanitizer is the backstop for
+ * rows committed before it.
+ */
+const MEDIA_TYPE_TOKEN = "[!#$%&'*+.^_`|~0-9A-Za-z-]+";
+export const MEDIA_TYPE_RE = new RegExp(`^${MEDIA_TYPE_TOKEN}\\/${MEDIA_TYPE_TOKEN}` +
+    `(?:[ \\t]*;[ \\t]*${MEDIA_TYPE_TOKEN}=(?:${MEDIA_TYPE_TOKEN}|"[^"\\\\\\u0000-\\u001f\\u007f]*"))*$`);
+/**
+ * A response header VALUE is a ByteString: setting it converts each UTF-16
+ * code unit and throws a TypeError on any unit above 0xFF. The token grammar
+ * already excludes those in unquoted positions, but a quoted parameter value
+ * (`charset="€"`) can carry any character the regex's negated class does not
+ * name — U+20AC passes the pattern and then throws at the `Headers` set. So
+ * the Latin-1 ceiling is a SEPARATE, explicit check: every code unit ≤ 0xFF,
+ * which also rejects astral characters and lone surrogates (their code units
+ * are all ≥ 0xD800). Without it the grammar check is not the closure PLT-5
+ * needs.
+ */
+function isLatin1(value) {
+    for (let i = 0; i < value.length; i++) {
+        if (value.charCodeAt(i) > 0xff)
+            return false;
+    }
+    return true;
+}
+export function isValidMediaType(value) {
+    return value.length >= 1 && value.length <= 255 && isLatin1(value) && MEDIA_TYPE_RE.test(value);
+}
+//# sourceMappingURL=common.js.map

package/dist/schemas/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/schemas/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,wDAAwD;QACxD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC9D,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAA8B,MAAS;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QAC/C,KAAK,EAAE,kDAAkD;KAC1D,CAAiB,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,KAAK,GAAc,CAAC,KAAK,CAAC,CAAC;IACjC,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,KAAK,GAA4C,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACrC,IAAI,KAAK,GAAG,GAAG;YAAE,GAAG,GAAG,KAAK,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAA+C,MAAS;IACtF,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,qBAAqB,EAAE;QACtD,KAAK,EAAE,6BAA6B,qBAAqB,SAAS;QAClE,KAAK,EAAE,IAAI;KACZ,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QAC7B,KAAK,EAAE,mDAAmD;QAC1D,KAAK,EAAE,IAAI;KACZ,CAAiB,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,GAAW;IAChD,OAAO,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,MAAM,CACrC,IAAI,gBAAgB,MAAM,gBAAgB,EAAE;IAC1C,qBAAqB,gBAAgB,OAAO,gBAAgB,wCAAwC,CACvG,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC"}

package/dist/schemas/demo-passes.d.ts

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+/**
+ * A DEMO PASS is a link an owner mints so that one member of the workspace
+ * is signed in without a password, for a demonstration (the demo pass spec).
+ * The routes exist only while the instance's DEMO_SIGN_IN switch is on, on
+ * the self-hosted edition; `GET /instance` says so with `demoSignIn: true`.
+ * The secret is shown once, in the mint's answer, and stored nowhere.
+ */
+/** A pass's lifetime when the mint names none: one day, in minutes. */
+export declare const DEMO_PASS_DEFAULT_MINUTES = 1440;
+/** The longest lifetime a mint may ask for: one week, in minutes. */
+export declare const DEMO_PASS_MAX_MINUTES = 10080;
+export declare const demoPassSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodString;
+    targetPath: z.ZodString;
+    createdBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    useCount: z.ZodNumber;
+}, z.core.$strip>;
+export type DemoPass = z.infer<typeof demoPassSchema>;
+export declare const demoPassesListSchema: z.ZodObject<{
+    passes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodString;
+        targetPath: z.ZodString;
+        createdBy: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        useCount: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DemoPassesList = z.infer<typeof demoPassesListSchema>;
+/**
+ * The mint: a member of the caller's workspace by address, the page the link
+ * lands on (a same-origin path, checked by the server), and a lifetime.
+ */
+export declare const demoPassMintSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    path: z.ZodOptional<z.ZodString>;
+    expiresInMinutes: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type DemoPassMint = z.infer<typeof demoPassMintSchema>;
+export declare const demoPassMintedSchema: z.ZodObject<{
+    pass: z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodString;
+        targetPath: z.ZodString;
+        createdBy: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        useCount: z.ZodNumber;
+    }, z.core.$strip>;
+    secret: z.ZodString;
+    url: z.ZodString;
+}, z.core.$strip>;
+export type DemoPassMinted = z.infer<typeof demoPassMintedSchema>;
+/**
+ * `POST /api/v1/auth/demo/redeem`: served by the sign-in library itself (so
+ * its own cookie and hooks apply), hence no route contract; these two
+ * shapes are the wire the SDK's `redeemDemoPass` speaks.
+ */
+export declare const demoPassRedeemSchema: z.ZodObject<{
+    pass: z.ZodString;
+}, z.core.$strip>;
+export type DemoPassRedeem = z.infer<typeof demoPassRedeemSchema>;
+export declare const demoPassRedeemedSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    path: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type DemoPassRedeemed = z.infer<typeof demoPassRedeemedSchema>;
+//# sourceMappingURL=demo-passes.d.ts.map

package/dist/schemas/demo-passes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-passes.d.ts","sourceRoot":"","sources":["../../src/schemas/demo-passes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,eAAO,MAAM,cAAc;;;;;;;;;;;;iBAgBzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAAgD,CAAC;AAClF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBAM/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;iBAAwC,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,sBAAsB;;;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/demo-passes.js

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+/**
+ * A DEMO PASS is a link an owner mints so that one member of the workspace
+ * is signed in without a password, for a demonstration (the demo pass spec).
+ * The routes exist only while the instance's DEMO_SIGN_IN switch is on, on
+ * the self-hosted edition; `GET /instance` says so with `demoSignIn: true`.
+ * The secret is shown once, in the mint's answer, and stored nowhere.
+ */
+/** A pass's lifetime when the mint names none: one day, in minutes. */
+export const DEMO_PASS_DEFAULT_MINUTES = 1440;
+/** The longest lifetime a mint may ask for: one week, in minutes. */
+export const DEMO_PASS_MAX_MINUTES = 10080;
+export const demoPassSchema = z.object({
+    id: z.string(),
+    /** The person the pass signs in. */
+    userId: z.string(),
+    email: z.string(),
+    name: z.string(),
+    /** The page the link lands on. */
+    targetPath: z.string(),
+    /** The owner who minted it; null once that account is gone. */
+    createdBy: z.string().nullable(),
+    createdAt: z.string(),
+    expiresAt: z.string(),
+    revokedAt: z.string().nullable(),
+    lastUsedAt: z.string().nullable(),
+    /** How many sessions the pass has opened. */
+    useCount: z.number().int()
+});
+export const demoPassesListSchema = z.object({ passes: z.array(demoPassSchema) });
+/**
+ * The mint: a member of the caller's workspace by address, the page the link
+ * lands on (a same-origin path, checked by the server), and a lifetime.
+ */
+export const demoPassMintSchema = z.object({
+    email: z.email(),
+    path: z.string().optional(),
+    expiresInMinutes: z.number().int().min(1).max(DEMO_PASS_MAX_MINUTES).optional()
+});
+export const demoPassMintedSchema = z.object({
+    pass: demoPassSchema,
+    /** The secret itself: shown here once, never again. */
+    secret: z.string(),
+    /** `<PUBLIC_BASE_URL>/demo#pass=<secret>&to=<path>`: the fragment never reaches a server log. */
+    url: z.string()
+});
+/**
+ * `POST /api/v1/auth/demo/redeem`: served by the sign-in library itself (so
+ * its own cookie and hooks apply), hence no route contract; these two
+ * shapes are the wire the SDK's `redeemDemoPass` speaks.
+ */
+export const demoPassRedeemSchema = z.object({ pass: z.string().min(1) });
+export const demoPassRedeemedSchema = z.object({
+    user: z.object({ id: z.string(), email: z.string(), name: z.string() }),
+    /** The pass's page: where the dashboard goes when the link names none. */
+    path: z.string(),
+    /** When the PASS expires (the session it opened keeps its own lifetime). */
+    expiresAt: z.string()
+});
+//# sourceMappingURL=demo-passes.js.map

package/dist/schemas/demo-passes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo-passes.js","sourceRoot":"","sources":["../../src/schemas/demo-passes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,kCAAkC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAGlF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;CAChF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,cAAc;IACpB,uDAAuD;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,iGAAiG;IACjG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAG1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACvE,0EAA0E;IAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,4EAA4E;IAC5E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC"}

package/dist/schemas/files.d.ts

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+export declare const fileSchema: z.ZodObject<{
+    id: z.ZodString;
+    sha256: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    contentType: z.ZodString;
+    originalName: z.ZodString;
+    createdBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type FileInfo = z.infer<typeof fileSchema>;
+export declare const filesListSchema: z.ZodObject<{
+    files: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        sha256: z.ZodString;
+        sizeBytes: z.ZodNumber;
+        contentType: z.ZodString;
+        originalName: z.ZodString;
+        createdBy: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const fileUploadedSchema: z.ZodObject<{
+    file: z.ZodObject<{
+        id: z.ZodString;
+        sha256: z.ZodString;
+        sizeBytes: z.ZodNumber;
+        contentType: z.ZodString;
+        originalName: z.ZodString;
+        createdBy: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>;
+    deduplicated: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const fileUploadQuerySchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=files.d.ts.map

package/dist/schemas/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/schemas/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,UAAU;;;;;;;;iBASrB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAElD,eAAO,MAAM,eAAe;;;;;;;;;;;iBAG1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAI7B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAGhC,CAAC"}

package/dist/schemas/files.js

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+import { plainText } from './common.js';
+export const fileSchema = z.object({
+    id: z.string(),
+    sha256: z.string(),
+    sizeBytes: z.number(),
+    contentType: z.string(),
+    originalName: z.string(),
+    /** Null once the uploader's account was deleted (files are workspace data). */
+    createdBy: z.string().nullable(),
+    createdAt: z.string()
+});
+export const filesListSchema = z.object({
+    files: z.array(fileSchema),
+    nextCursor: z.string().nullable()
+});
+export const fileUploadedSchema = z.object({
+    file: fileSchema,
+    /** True when identical bytes already existed for this workspace. */
+    deduplicated: z.boolean()
+});
+export const fileUploadQuerySchema = z.object({
+    /** Original filename (the body is the raw bytes). */
+    name: plainText(1, 255)
+});
+//# sourceMappingURL=files.js.map

package/dist/schemas/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/schemas/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,+EAA+E;IAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,UAAU;IAChB,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,qDAAqD;IACrD,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;CACxB,CAAC,CAAC"}

package/dist/schemas/instance.d.ts

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+/**
+ * GET /api/v1/instance — unauthenticated, cacheable discovery. This is what
+ * CLIs and MCP clients read to route: which auth methods exist, whether
+ * first-boot setup is still pending, and what the instance is.
+ */
+export declare const instanceInfoSchema: z.ZodObject<{
+    name: z.ZodString;
+    instanceId: z.ZodNullable<z.ZodString>;
+    edition: z.ZodString;
+    version: z.ZodString;
+    apiVersion: z.ZodLiteral<"v1">;
+    setupRequired: z.ZodBoolean;
+    auth: z.ZodObject<{
+        methods: z.ZodArray<z.ZodUnion<[z.ZodEnum<{
+            password: "password";
+            oauth: "oauth";
+            "email-otp": "email-otp";
+            google: "google";
+            "api-key": "api-key";
+            antasphere: "antasphere";
+        }>, z.ZodString]>>;
+        passwordReset: z.ZodBoolean;
+        emailChange: z.ZodBoolean;
+        twoFactor: z.ZodBoolean;
+        sso: z.ZodOptional<z.ZodObject<{
+            hintCookieName: z.ZodString;
+            hintCookieDomain: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    features: z.ZodObject<{
+        mcp: z.ZodBoolean;
+        oauth: z.ZodBoolean;
+        files: z.ZodBoolean;
+    }, z.core.$strip>;
+    demoSignIn: z.ZodOptional<z.ZodBoolean>;
+    restricted: z.ZodOptional<z.ZodBoolean>;
+    entitlements: z.ZodOptional<z.ZodObject<{
+        actions: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            creditsPerUnit: z.ZodNumber;
+            unit: z.ZodString;
+            per: z.ZodOptional<z.ZodNumber>;
+            label: z.ZodString;
+        }, z.core.$strip>>;
+        limits: z.ZodRecord<z.ZodString, z.ZodObject<{
+            oss: z.ZodNullable<z.ZodNumber>;
+            free: z.ZodNullable<z.ZodNumber>;
+            pro: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>>;
+        features: z.ZodRecord<z.ZodString, z.ZodObject<{
+            free: z.ZodBoolean;
+            pro: z.ZodBoolean;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type InstanceInfo = z.infer<typeof instanceInfoSchema>;
+//# sourceMappingURL=instance.d.ts.map

package/dist/schemas/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/schemas/instance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4D7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}