@classytic/arc 1.1.0 → 2.1.2

package/dist/openapi-G3Cw7XuM.mjs

@@ -0,0 +1,524 @@
+import { n as convertRouteSchema } from "./schemaConverter-BwrmWroW.mjs";
+import fp from "fastify-plugin";
+
+//#region src/docs/openapi.ts
+/**
+* OpenAPI Spec Generator
+*
+* Auto-generates OpenAPI 3.0 specification from Arc resource registry.
+*
+* @example
+* import { openApiPlugin } from '@classytic/arc/docs';
+*
+* await fastify.register(openApiPlugin, {
+*   title: 'My API',
+*   version: '1.0.0',
+* });
+*
+* // Spec available at /_docs/openapi.json
+*/
+const openApiPlugin = async (fastify, opts = {}) => {
+	const { title = "Arc API", version = "1.0.0", description, serverUrl, prefix = "/_docs", apiPrefix = "", authRoles = [] } = opts;
+	const buildSpec = () => {
+		const arc = fastify.arc;
+		const resources = arc?.registry?.getAll() ?? [];
+		const externalPaths = arc?.externalOpenApiPaths ?? [];
+		return buildOpenApiSpec(resources, {
+			title,
+			version,
+			description,
+			serverUrl,
+			apiPrefix
+		}, externalPaths.length > 0 ? externalPaths : void 0);
+	};
+	fastify.get(`${prefix}/openapi.json`, async (request, reply) => {
+		if (authRoles.length > 0) {
+			const user = request.user;
+			if (!authRoles.some((role) => user?.roles?.includes(role)) && !user?.roles?.includes("superadmin")) {
+				reply.code(403).send({ error: "Access denied" });
+				return;
+			}
+		}
+		return buildSpec();
+	});
+	fastify.log?.debug?.(`OpenAPI spec available at ${prefix}/openapi.json`);
+};
+/**
+* Build OpenAPI spec from registry resources.
+* Shared by HTTP docs endpoint and CLI export command.
+*/
+function buildOpenApiSpec(resources, options = {}, externalPaths) {
+	const { title = "Arc API", version = "1.0.0", description, serverUrl, apiPrefix = "" } = options;
+	const paths = {};
+	const tags = [];
+	const additionalSecurity = externalPaths?.flatMap((ext) => ext.resourceSecurity ?? []) ?? [];
+	for (const resource of resources) {
+		const tagDescParts = [`${resource.displayName || resource.name} operations`];
+		if (resource.presets && resource.presets.length > 0) tagDescParts.push(`Presets: ${resource.presets.join(", ")}`);
+		if (resource.pipelineSteps && resource.pipelineSteps.length > 0) {
+			const stepNames = resource.pipelineSteps.map((s) => `${s.type}(${s.name})`);
+			tagDescParts.push(`Pipeline: ${stepNames.join(" → ")}`);
+		}
+		if (resource.events && resource.events.length > 0) tagDescParts.push(`Events: ${resource.events.join(", ")}`);
+		tags.push({
+			name: resource.tag || resource.name,
+			description: tagDescParts.join(". ")
+		});
+		const resourcePaths = generateResourcePaths(resource, apiPrefix, additionalSecurity);
+		Object.assign(paths, resourcePaths);
+	}
+	if (externalPaths) for (const ext of externalPaths) {
+		for (const [path, methods] of Object.entries(ext.paths)) paths[path] = paths[path] ? {
+			...paths[path],
+			...methods
+		} : methods;
+		if (ext.tags) {
+			for (const tag of ext.tags) if (!tags.find((t) => t.name === tag.name)) tags.push(tag);
+		}
+	}
+	const externalSecuritySchemes = externalPaths?.reduce((acc, ext) => ({
+		...acc,
+		...ext.securitySchemes
+	}), {}) ?? {};
+	const externalSchemas = externalPaths?.reduce((acc, ext) => ({
+		...acc,
+		...ext.schemas
+	}), {}) ?? {};
+	return {
+		openapi: "3.0.3",
+		info: {
+			title,
+			version,
+			...description && { description }
+		},
+		...serverUrl && { servers: [{ url: serverUrl }] },
+		paths,
+		components: {
+			schemas: {
+				...generateSchemas(resources),
+				...externalSchemas
+			},
+			securitySchemes: {
+				bearerAuth: {
+					type: "http",
+					scheme: "bearer",
+					bearerFormat: "JWT"
+				},
+				orgHeader: {
+					type: "apiKey",
+					in: "header",
+					name: "x-organization-id"
+				},
+				...externalSecuritySchemes
+			}
+		},
+		tags
+	};
+}
+/**
+* Convert Fastify-style params (/:id) to OpenAPI-style params (/{id})
+*/
+function toOpenApiPath(path) {
+	return path.replace(/:([^/]+)/g, "{$1}");
+}
+/**
+* Convert OpenAPI schema to query parameters array
+* Transforms { properties: { page: { type: 'integer' } } } to [{ name: 'page', in: 'query', schema: { type: 'integer' } }]
+*/
+function convertSchemaToParameters(schema) {
+	const params = [];
+	const properties = schema.properties || {};
+	const required = schema.required || [];
+	for (const [name, prop] of Object.entries(properties)) {
+		const description = prop.description;
+		const { description: _, ...schemaProps } = prop;
+		const param = {
+			name,
+			in: "query",
+			required: required.includes(name),
+			schema: schemaProps
+		};
+		if (description) param.description = description;
+		params.push(param);
+	}
+	return params;
+}
+/**
+* Default query parameters when no listQuery schema is provided
+*/
+const DEFAULT_LIST_PARAMS = [
+	{
+		name: "page",
+		in: "query",
+		schema: { type: "integer" },
+		description: "Page number"
+	},
+	{
+		name: "limit",
+		in: "query",
+		schema: { type: "integer" },
+		description: "Items per page"
+	},
+	{
+		name: "sort",
+		in: "query",
+		schema: { type: "string" },
+		description: "Sort field (prefix with - for descending)"
+	}
+];
+/**
+* Generate paths for a resource
+*/
+function generateResourcePaths(resource, apiPrefix = "", additionalSecurity = []) {
+	const paths = {};
+	const basePath = `${apiPrefix}${resource.prefix}`;
+	if (resource.disableDefaultRoutes && (!resource.additionalRoutes || resource.additionalRoutes.length === 0)) return paths;
+	if (!resource.disableDefaultRoutes) {
+		const disabledSet = new Set(resource.disabledRoutes ?? []);
+		const updateMethod = resource.updateMethod ?? "PATCH";
+		const collectionPath = {};
+		if (!disabledSet.has("list")) collectionPath.get = createOperation(resource, "list", "List all", {
+			parameters: resource.openApiSchemas?.listQuery ? convertSchemaToParameters(resource.openApiSchemas.listQuery) : DEFAULT_LIST_PARAMS,
+			responses: { "200": {
+				description: "List of items",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						success: { type: "boolean" },
+						docs: {
+							type: "array",
+							items: { $ref: `#/components/schemas/${resource.name}` }
+						},
+						page: { type: "integer" },
+						limit: { type: "integer" },
+						total: { type: "integer" },
+						pages: { type: "integer" },
+						hasNext: { type: "boolean" },
+						hasPrev: { type: "boolean" }
+					}
+				} } }
+			} }
+		}, void 0, additionalSecurity);
+		if (!disabledSet.has("create")) collectionPath.post = createOperation(resource, "create", "Create new", {
+			requestBody: {
+				required: true,
+				content: { "application/json": { schema: { $ref: `#/components/schemas/${resource.name}Input` } } }
+			},
+			responses: { "201": {
+				description: "Created successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						success: { type: "boolean" },
+						data: { $ref: `#/components/schemas/${resource.name}` },
+						message: { type: "string" }
+					}
+				} } }
+			} }
+		}, void 0, additionalSecurity);
+		if (Object.keys(collectionPath).length > 0) paths[basePath] = collectionPath;
+		const itemPath = {};
+		if (!disabledSet.has("get")) itemPath.get = createOperation(resource, "get", "Get by ID", {
+			parameters: [{
+				name: "id",
+				in: "path",
+				required: true,
+				schema: { type: "string" }
+			}],
+			responses: {
+				"200": {
+					description: "Item found",
+					content: { "application/json": { schema: {
+						type: "object",
+						properties: {
+							success: { type: "boolean" },
+							data: { $ref: `#/components/schemas/${resource.name}` }
+						}
+					} } }
+				},
+				"404": { description: "Not found" }
+			}
+		}, void 0, additionalSecurity);
+		if (!disabledSet.has("update")) {
+			const updateOp = createOperation(resource, "update", "Update", {
+				parameters: [{
+					name: "id",
+					in: "path",
+					required: true,
+					schema: { type: "string" }
+				}],
+				requestBody: {
+					required: true,
+					content: { "application/json": { schema: { $ref: `#/components/schemas/${resource.name}Input` } } }
+				},
+				responses: { "200": {
+					description: "Updated successfully",
+					content: { "application/json": { schema: {
+						type: "object",
+						properties: {
+							success: { type: "boolean" },
+							data: { $ref: `#/components/schemas/${resource.name}` },
+							message: { type: "string" }
+						}
+					} } }
+				} }
+			}, void 0, additionalSecurity);
+			if (updateMethod === "both") {
+				itemPath.put = updateOp;
+				itemPath.patch = updateOp;
+			} else if (updateMethod === "PUT") itemPath.put = updateOp;
+			else itemPath.patch = updateOp;
+		}
+		if (!disabledSet.has("delete")) itemPath.delete = createOperation(resource, "delete", "Delete", {
+			parameters: [{
+				name: "id",
+				in: "path",
+				required: true,
+				schema: { type: "string" }
+			}],
+			responses: { "200": {
+				description: "Deleted successfully",
+				content: { "application/json": { schema: {
+					type: "object",
+					properties: {
+						success: { type: "boolean" },
+						message: { type: "string" }
+					}
+				} } }
+			} }
+		}, void 0, additionalSecurity);
+		if (Object.keys(itemPath).length > 0) paths[toOpenApiPath(`${basePath}/:id`)] = itemPath;
+	}
+	for (const route of resource.additionalRoutes || []) {
+		const fullPath = toOpenApiPath(`${basePath}${route.path}`);
+		const method = route.method.toLowerCase();
+		if (!paths[fullPath]) paths[fullPath] = {};
+		const handlerName = route.operation ?? (typeof route.handler === "string" ? route.handler : "handler");
+		const isPublicRoute = route.permissions?._isPublic === true;
+		const requiresAuthForRoute = !!route.permissions && !isPublicRoute;
+		const extras = {
+			parameters: extractPathParams(route.path),
+			responses: { "200": { description: route.description || "Success" } }
+		};
+		const rawSchema = route.schema;
+		const routeSchema = rawSchema ? convertRouteSchema(rawSchema) : void 0;
+		if (routeSchema?.body && [
+			"post",
+			"put",
+			"patch"
+		].includes(method)) extras.requestBody = {
+			required: true,
+			content: { "application/json": { schema: routeSchema.body } }
+		};
+		if (routeSchema?.querystring) {
+			const queryParams = convertSchemaToParameters(routeSchema.querystring);
+			extras.parameters = [...extras.parameters || [], ...queryParams];
+		}
+		if (routeSchema?.response) {
+			const responseSchemas = routeSchema.response;
+			for (const [statusCode, schema] of Object.entries(responseSchemas)) extras.responses[statusCode] = {
+				description: schema.description || `Response ${statusCode}`,
+				content: { "application/json": { schema } }
+			};
+		}
+		paths[fullPath][method] = createOperation(resource, handlerName, route.summary ?? handlerName, extras, requiresAuthForRoute, additionalSecurity);
+	}
+	return paths;
+}
+/**
+* Create an operation object
+* @param requiresAuthOverride - Override for whether auth is required (for additional routes)
+* @param additionalSecurity - Extra security alternatives from external integrations (OR'd with bearerAuth)
+*/
+function createOperation(resource, operation, summary, extras, requiresAuthOverride, additionalSecurity = []) {
+	const operationPermission = (resource.permissions || {})[operation];
+	const isPublic = operationPermission?._isPublic === true;
+	operationPermission?._roles;
+	const requiresAuth = requiresAuthOverride !== void 0 ? requiresAuthOverride : typeof operationPermission === "function" && !isPublic;
+	const permAnnotation = describePermissionForOpenApi(operationPermission);
+	const descParts = [];
+	if (permAnnotation) descParts.push(`**Permission**: ${permAnnotation.type === "public" ? "Public" : permAnnotation.type === "requireRoles" ? `Requires roles: ${(permAnnotation.roles ?? []).join(", ")}` : "Requires authentication"}`);
+	if (resource.presets && resource.presets.length > 0) descParts.push(`**Presets**: ${resource.presets.join(", ")}`);
+	const applicableSteps = (resource.pipelineSteps ?? []).filter((s) => {
+		if (!s.operations) return true;
+		return s.operations.includes(operation);
+	});
+	return {
+		tags: [resource.tag || "Resource"],
+		summary: `${summary} ${(resource.displayName || resource.name).toLowerCase()}`,
+		operationId: `${resource.name}_${operation}`,
+		...descParts.length > 0 && { description: descParts.join("\n\n") },
+		...requiresAuth && { security: [{ bearerAuth: [] }, ...additionalSecurity] },
+		...permAnnotation && { "x-arc-permission": permAnnotation },
+		...applicableSteps.length > 0 && { "x-arc-pipeline": applicableSteps.map((s) => ({
+			type: s.type,
+			name: s.name
+		})) },
+		responses: {
+			...requiresAuth && {
+				"401": {
+					description: "Authentication required — no valid Bearer token provided",
+					content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
+				},
+				"403": {
+					description: permAnnotation?.roles ? `Forbidden — requires one of: ${permAnnotation.roles.join(", ")}` : "Forbidden — insufficient permissions",
+					content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
+				}
+			},
+			"500": { description: "Internal server error" }
+		},
+		...extras
+	};
+}
+/**
+* Describe a permission check function for OpenAPI.
+* Extracts role, org role, and team permission metadata from permission functions.
+*/
+function describePermissionForOpenApi(check) {
+	if (!check || typeof check !== "function") return void 0;
+	const fn = check;
+	if (fn._isPublic === true) return { type: "public" };
+	const result = { type: "requireAuth" };
+	if (Array.isArray(fn._roles) && fn._roles.length > 0) {
+		result.type = "requireRoles";
+		result.roles = fn._roles;
+	}
+	if (Array.isArray(fn._orgRoles) && fn._orgRoles.length > 0) result.orgRoles = fn._orgRoles;
+	return result;
+}
+/**
+* Extract path parameters from route path
+*/
+function extractPathParams(path) {
+	const params = [];
+	const matches = path.matchAll(/:([^/]+)/g);
+	for (const match of matches) {
+		const paramName = match[1];
+		if (paramName) params.push({
+			name: paramName,
+			in: "path",
+			required: true,
+			schema: { type: "string" }
+		});
+	}
+	return params;
+}
+/**
+* Generate schema definitions from pre-stored registry schemas.
+* Schemas are generated at resource definition time and stored in the registry.
+*
+* Response schema priority:
+* 1. If resource provides explicit `openApiSchemas.response`, use it as-is
+* 2. Otherwise, auto-generate from `createBody` + _id + timestamps
+*
+* Note: This is for OpenAPI documentation only - does NOT affect Fastify serialization.
+*/
+function generateSchemas(resources) {
+	const schemas = { Error: {
+		type: "object",
+		properties: {
+			success: {
+				type: "boolean",
+				example: false
+			},
+			error: { type: "string" },
+			code: { type: "string" },
+			requestId: { type: "string" },
+			timestamp: { type: "string" }
+		}
+	} };
+	for (const resource of resources) {
+		const storedSchemas = resource.openApiSchemas;
+		const fieldPerms = resource.fieldPermissions;
+		if (storedSchemas?.response) schemas[resource.name] = {
+			type: "object",
+			description: resource.displayName,
+			...storedSchemas.response
+		};
+		else if (storedSchemas?.createBody) schemas[resource.name] = {
+			type: "object",
+			description: resource.displayName,
+			properties: {
+				_id: {
+					type: "string",
+					description: "Unique identifier"
+				},
+				...storedSchemas.createBody.properties ?? {},
+				createdAt: {
+					type: "string",
+					format: "date-time",
+					description: "Creation timestamp"
+				},
+				updatedAt: {
+					type: "string",
+					format: "date-time",
+					description: "Last update timestamp"
+				}
+			}
+		};
+		else schemas[resource.name] = {
+			type: "object",
+			description: resource.displayName,
+			properties: {
+				_id: {
+					type: "string",
+					description: "Unique identifier"
+				},
+				createdAt: {
+					type: "string",
+					format: "date-time",
+					description: "Creation timestamp"
+				},
+				updatedAt: {
+					type: "string",
+					format: "date-time",
+					description: "Last update timestamp"
+				}
+			}
+		};
+		if (fieldPerms && schemas[resource.name]?.properties) {
+			const props = schemas[resource.name].properties;
+			for (const [field, perm] of Object.entries(fieldPerms)) if (props[field]) {
+				const desc = props[field].description ?? "";
+				const permDesc = formatFieldPermDescription(perm);
+				props[field].description = desc ? `${desc} (${permDesc})` : permDesc;
+			} else if (perm.type === "hidden") {}
+		}
+		if (storedSchemas?.createBody) {
+			schemas[`${resource.name}Input`] = {
+				type: "object",
+				description: `${resource.displayName} create input`,
+				...storedSchemas.createBody
+			};
+			if (storedSchemas.updateBody) schemas[`${resource.name}Update`] = {
+				type: "object",
+				description: `${resource.displayName} update input`,
+				...storedSchemas.updateBody
+			};
+		} else schemas[`${resource.name}Input`] = {
+			type: "object",
+			description: `${resource.displayName} input`
+		};
+	}
+	return schemas;
+}
+/**
+* Format a field permission description for OpenAPI
+*/
+function formatFieldPermDescription(perm) {
+	switch (perm.type) {
+		case "hidden": return "Hidden — never returned in responses";
+		case "visibleTo": return `Visible to: ${(perm.roles ?? []).join(", ")}`;
+		case "writableBy": return `Writable by: ${(perm.roles ?? []).join(", ")}`;
+		case "redactFor": return `Redacted for: ${(perm.roles ?? []).join(", ")}`;
+		default: return perm.type;
+	}
+}
+var openapi_default = fp(openApiPlugin, {
+	name: "arc-openapi",
+	fastify: "5.x"
+});
+
+//#endregion
+export { openApiPlugin as n, openapi_default as r, buildOpenApiSpec as t };
+//# sourceMappingURL=openapi-G3Cw7XuM.mjs.map

package/dist/openapi-G3Cw7XuM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-G3Cw7XuM.mjs","names":[],"sources":["../src/docs/openapi.ts"],"sourcesContent":["/**\n * OpenAPI Spec Generator\n *\n * Auto-generates OpenAPI 3.0 specification from Arc resource registry.\n *\n * @example\n * import { openApiPlugin } from '@classytic/arc/docs';\n *\n * await fastify.register(openApiPlugin, {\n *   title: 'My API',\n *   version: '1.0.0',\n * });\n *\n * // Spec available at /_docs/openapi.json\n */\n\nimport fp from 'fastify-plugin';\nimport type { FastifyInstance, FastifyPluginAsync } from 'fastify';\nimport type { RegistryEntry, FastifyWithDecorators } from '../types/index.js';\nimport type { PermissionCheck } from '../permissions/types.js';\nimport type { ExternalOpenApiPaths } from './externalPaths.js';\nimport { convertRouteSchema } from '../utils/schemaConverter.js';\n\nexport interface OpenApiOptions {\n  /** API title */\n  title?: string;\n  /** API version */\n  version?: string;\n  /** API description */\n  description?: string;\n  /** Server URL */\n  serverUrl?: string;\n  /** Route prefix for spec endpoint (default: '/_docs') */\n  prefix?: string;\n  /** API prefix for all resource paths (e.g., '/api/v1') */\n  apiPrefix?: string;\n  /** Auth roles required to access spec (default: [] = public) */\n  authRoles?: string[];\n  /** Include internal routes (default: false) */\n  includeInternal?: boolean;\n  /** Custom OpenAPI extensions */\n  extensions?: Record<string, unknown>;\n}\n\nexport interface OpenApiSpec {\n  openapi: string;\n  info: {\n    title: string;\n    version: string;\n    description?: string;\n  };\n  servers?: Array<{ url: string; description?: string }>;\n  paths: Record<string, PathItem>;\n  components: {\n    schemas: Record<string, SchemaObject>;\n    securitySchemes?: Record<string, SecurityScheme>;\n  };\n  tags: Array<{ name: string; description?: string }>;\n  security?: Array<Record<string, string[]>>;\n}\n\nexport interface OpenApiBuildOptions {\n  title?: string;\n  version?: string;\n  description?: string;\n  serverUrl?: string;\n  apiPrefix?: string;\n}\n\ninterface PathItem {\n  get?: Operation;\n  post?: Operation;\n  put?: Operation;\n  patch?: Operation;\n  delete?: Operation;\n  options?: Operation;\n  head?: Operation;\n}\n\ninterface Operation {\n  tags: string[];\n  summary: string;\n  description?: string;\n  operationId: string;\n  parameters?: Parameter[];\n  requestBody?: RequestBody;\n  responses: Record<string, Response>;\n  security?: Array<Record<string, string[]>>;\n  /** Arc permission metadata (OpenAPI extension) */\n  'x-arc-permission'?: { type: string; roles?: readonly string[] };\n  /** Arc pipeline steps (OpenAPI extension) */\n  'x-arc-pipeline'?: Array<{ type: string; name: string }>;\n}\n\ninterface Parameter {\n  name: string;\n  in: 'path' | 'query' | 'header';\n  required?: boolean;\n  schema: SchemaObject;\n  description?: string;\n}\n\ninterface RequestBody {\n  required?: boolean;\n  content: Record<string, { schema: SchemaObject }>;\n}\n\ninterface Response {\n  description: string;\n  content?: Record<string, { schema: SchemaObject }>;\n}\n\ninterface SchemaObject {\n  type?: string;\n  format?: string;\n  properties?: Record<string, SchemaObject>;\n  items?: SchemaObject;\n  required?: string[];\n  $ref?: string;\n  description?: string;\n  example?: unknown;\n  additionalProperties?: boolean | SchemaObject;\n  enum?: string[];\n  minimum?: number;\n  maximum?: number;\n  minLength?: number;\n  maxLength?: number;\n  pattern?: string;\n}\n\ninterface SecurityScheme {\n  type: string;\n  scheme?: string;\n  bearerFormat?: string;\n  in?: string;\n  name?: string;\n}\n\nconst openApiPlugin: FastifyPluginAsync<OpenApiOptions> = async (\n  fastify: FastifyInstance,\n  opts: OpenApiOptions = {}\n) => {\n  const {\n    title = 'Arc API',\n    version = '1.0.0',\n    description,\n    serverUrl,\n    prefix = '/_docs',\n    apiPrefix = '',\n    authRoles = [],\n  } = opts;\n\n  // Build spec from instance-scoped registry\n  const buildSpec = (): OpenApiSpec => {\n    const arc = (fastify as unknown as FastifyWithDecorators).arc;\n    const resources = arc?.registry?.getAll() ?? [];\n    const externalPaths = arc?.externalOpenApiPaths ?? [];\n    return buildOpenApiSpec(resources, {\n      title,\n      version,\n      description,\n      serverUrl,\n      apiPrefix,\n    }, externalPaths.length > 0 ? externalPaths : undefined);\n  };\n\n  // Serve OpenAPI spec\n  fastify.get(`${prefix}/openapi.json`, async (request, reply) => {\n    // Check auth if required\n    if (authRoles.length > 0) {\n      const user = (request as { user?: { roles?: string[] } }).user;\n      const hasRole = authRoles.some((role) => user?.roles?.includes(role));\n      if (!hasRole && !user?.roles?.includes('superadmin')) {\n        reply.code(403).send({ error: 'Access denied' });\n        return;\n      }\n    }\n\n    const spec = buildSpec();\n    // Return object directly - let Fastify handle serialization & compression\n    return spec;\n  });\n\n  fastify.log?.debug?.(`OpenAPI spec available at ${prefix}/openapi.json`);\n};\n\n/**\n * Build OpenAPI spec from registry resources.\n * Shared by HTTP docs endpoint and CLI export command.\n */\nexport function buildOpenApiSpec(\n  resources: RegistryEntry[],\n  options: OpenApiBuildOptions = {},\n  externalPaths?: ExternalOpenApiPaths[],\n): OpenApiSpec {\n  const {\n    title = 'Arc API',\n    version = '1.0.0',\n    description,\n    serverUrl,\n    apiPrefix = '',\n  } = options;\n\n  const paths: Record<string, PathItem> = {};\n  const tags: Array<{ name: string; description?: string }> = [];\n\n  // Collect additional security alternatives from external integrations.\n  // Each item is OR'd with bearerAuth on authenticated resource operations.\n  const additionalSecurity = externalPaths\n    ?.flatMap(ext => ext.resourceSecurity ?? []) ?? [];\n\n  for (const resource of resources) {\n    // Build tag description with preset/pipeline info\n    const tagDescParts = [`${resource.displayName || resource.name} operations`];\n    if (resource.presets && resource.presets.length > 0) {\n      tagDescParts.push(`Presets: ${resource.presets.join(', ')}`);\n    }\n    if (resource.pipelineSteps && resource.pipelineSteps.length > 0) {\n      const stepNames = resource.pipelineSteps.map((s) => `${s.type}(${s.name})`);\n      tagDescParts.push(`Pipeline: ${stepNames.join(' → ')}`);\n    }\n    if (resource.events && resource.events.length > 0) {\n      tagDescParts.push(`Events: ${resource.events.join(', ')}`);\n    }\n\n    tags.push({\n      name: resource.tag || resource.name,\n      description: tagDescParts.join('. '),\n    });\n\n    const resourcePaths = generateResourcePaths(resource, apiPrefix, additionalSecurity);\n    Object.assign(paths, resourcePaths);\n  }\n\n  // Merge external paths (Better Auth, custom integrations, etc.)\n  if (externalPaths) {\n    for (const ext of externalPaths) {\n      for (const [path, methods] of Object.entries(ext.paths)) {\n        paths[path] = paths[path]\n          ? { ...paths[path], ...methods } as PathItem\n          : methods as PathItem;\n      }\n      if (ext.tags) {\n        for (const tag of ext.tags) {\n          if (!tags.find((t) => t.name === tag.name)) {\n            tags.push(tag);\n          }\n        }\n      }\n    }\n  }\n\n  // Merge external security schemes and schemas\n  const externalSecuritySchemes = externalPaths\n    ?.reduce<Record<string, Record<string, unknown>>>((acc, ext) => ({ ...acc, ...ext.securitySchemes }), {}) ?? {};\n  const externalSchemas = externalPaths\n    ?.reduce<Record<string, Record<string, unknown>>>((acc, ext) => ({ ...acc, ...ext.schemas }), {}) ?? {};\n\n  return {\n    openapi: '3.0.3',\n    info: {\n      title,\n      version,\n      ...(description && { description }),\n    },\n    ...(serverUrl && {\n      servers: [{ url: serverUrl }],\n    }),\n    paths,\n    components: {\n      schemas: {\n        ...generateSchemas(resources),\n        ...externalSchemas,\n      } as Record<string, SchemaObject>,\n      securitySchemes: {\n        bearerAuth: {\n          type: 'http',\n          scheme: 'bearer',\n          bearerFormat: 'JWT',\n        },\n        orgHeader: {\n          type: 'apiKey',\n          in: 'header',\n          name: 'x-organization-id',\n        },\n        // Plugin-specific schemes (e.g. apiKeyAuth) are auto-detected\n        // and injected via externalSecuritySchemes from the auth extractor.\n        ...externalSecuritySchemes,\n      } as Record<string, SecurityScheme>,\n    },\n    tags,\n  };\n}\n\n/**\n * Convert Fastify-style params (/:id) to OpenAPI-style params (/{id})\n */\nfunction toOpenApiPath(path: string): string {\n  return path.replace(/:([^/]+)/g, '{$1}');\n}\n\n/**\n * Convert OpenAPI schema to query parameters array\n * Transforms { properties: { page: { type: 'integer' } } } to [{ name: 'page', in: 'query', schema: { type: 'integer' } }]\n */\nfunction convertSchemaToParameters(schema: Record<string, unknown>): Parameter[] {\n  const params: Parameter[] = [];\n  const properties = (schema.properties as Record<string, Record<string, unknown>>) || {};\n  const required = (schema.required as string[]) || [];\n\n  for (const [name, prop] of Object.entries(properties)) {\n    // Extract description separately (goes to Parameter level, not schema)\n    const description = prop.description as string | undefined;\n    const { description: _, ...schemaProps } = prop;\n\n    const param: Parameter = {\n      name,\n      in: 'query',\n      required: required.includes(name),\n      schema: schemaProps as SchemaObject,\n    };\n\n    if (description) {\n      param.description = description;\n    }\n\n    params.push(param);\n  }\n  return params;\n}\n\n/**\n * Default query parameters when no listQuery schema is provided\n */\nconst DEFAULT_LIST_PARAMS: Parameter[] = [\n  { name: 'page', in: 'query', schema: { type: 'integer' }, description: 'Page number' },\n  { name: 'limit', in: 'query', schema: { type: 'integer' }, description: 'Items per page' },\n  { name: 'sort', in: 'query', schema: { type: 'string' }, description: 'Sort field (prefix with - for descending)' },\n];\n\n/**\n * Generate paths for a resource\n */\nfunction generateResourcePaths(\n  resource: RegistryEntry,\n  apiPrefix = '',\n  additionalSecurity: Array<Record<string, string[]>> = [],\n): Record<string, PathItem> {\n  const paths: Record<string, PathItem> = {};\n  const basePath = `${apiPrefix}${resource.prefix}`;\n\n  // Skip if default routes are disabled and no additional routes\n  if (resource.disableDefaultRoutes && (!resource.additionalRoutes || resource.additionalRoutes.length === 0)) {\n    return paths;\n  }\n\n  // Default CRUD routes (respects disabledRoutes + updateMethod)\n  if (!resource.disableDefaultRoutes) {\n    const disabledSet = new Set(resource.disabledRoutes ?? []);\n    const updateMethod = resource.updateMethod ?? 'PATCH';\n\n    // Collection routes: GET / (list) + POST / (create)\n    const collectionPath: PathItem = {};\n\n    if (!disabledSet.has('list')) {\n      const listParams = resource.openApiSchemas?.listQuery\n        ? convertSchemaToParameters(resource.openApiSchemas.listQuery as Record<string, unknown>)\n        : DEFAULT_LIST_PARAMS;\n\n      collectionPath.get = createOperation(resource, 'list', 'List all', {\n        parameters: listParams,\n        responses: {\n          '200': {\n            description: 'List of items',\n            content: {\n              'application/json': {\n                schema: {\n                  type: 'object',\n                  properties: {\n                    success: { type: 'boolean' },\n                    docs: { type: 'array', items: { $ref: `#/components/schemas/${resource.name}` } },\n                    page: { type: 'integer' },\n                    limit: { type: 'integer' },\n                    total: { type: 'integer' },\n                    pages: { type: 'integer' },\n                    hasNext: { type: 'boolean' },\n                    hasPrev: { type: 'boolean' },\n                  },\n                },\n              },\n            },\n          },\n        },\n      }, undefined, additionalSecurity);\n    }\n\n    if (!disabledSet.has('create')) {\n      collectionPath.post = createOperation(resource, 'create', 'Create new', {\n        requestBody: {\n          required: true,\n          content: {\n            'application/json': {\n              schema: { $ref: `#/components/schemas/${resource.name}Input` },\n            },\n          },\n        },\n        responses: {\n          '201': {\n            description: 'Created successfully',\n            content: {\n              'application/json': {\n                schema: {\n                  type: 'object',\n                  properties: {\n                    success: { type: 'boolean' },\n                    data: { $ref: `#/components/schemas/${resource.name}` },\n                    message: { type: 'string' },\n                  },\n                },\n              },\n            },\n          },\n        },\n      }, undefined, additionalSecurity);\n    }\n\n    if (Object.keys(collectionPath).length > 0) {\n      paths[basePath] = collectionPath;\n    }\n\n    // Item routes: GET /:id + UPDATE /:id + DELETE /:id\n    const itemPath: PathItem = {};\n\n    if (!disabledSet.has('get')) {\n      itemPath.get = createOperation(resource, 'get', 'Get by ID', {\n        parameters: [\n          { name: 'id', in: 'path', required: true, schema: { type: 'string' } },\n        ],\n        responses: {\n          '200': {\n            description: 'Item found',\n            content: {\n              'application/json': {\n                schema: {\n                  type: 'object',\n                  properties: {\n                    success: { type: 'boolean' },\n                    data: { $ref: `#/components/schemas/${resource.name}` },\n                  },\n                },\n              },\n            },\n          },\n          '404': { description: 'Not found' },\n        },\n      }, undefined, additionalSecurity);\n    }\n\n    if (!disabledSet.has('update')) {\n      const updateOp = createOperation(resource, 'update', 'Update', {\n        parameters: [\n          { name: 'id', in: 'path', required: true, schema: { type: 'string' } },\n        ],\n        requestBody: {\n          required: true,\n          content: {\n            'application/json': {\n              schema: { $ref: `#/components/schemas/${resource.name}Input` },\n            },\n          },\n        },\n        responses: {\n          '200': {\n            description: 'Updated successfully',\n            content: {\n              'application/json': {\n                schema: {\n                  type: 'object',\n                  properties: {\n                    success: { type: 'boolean' },\n                    data: { $ref: `#/components/schemas/${resource.name}` },\n                    message: { type: 'string' },\n                  },\n                },\n              },\n            },\n          },\n        },\n      }, undefined, additionalSecurity);\n\n      if (updateMethod === 'both') {\n        itemPath.put = updateOp;\n        itemPath.patch = updateOp;\n      } else if (updateMethod === 'PUT') {\n        itemPath.put = updateOp;\n      } else {\n        itemPath.patch = updateOp;\n      }\n    }\n\n    if (!disabledSet.has('delete')) {\n      itemPath.delete = createOperation(resource, 'delete', 'Delete', {\n        parameters: [\n          { name: 'id', in: 'path', required: true, schema: { type: 'string' } },\n        ],\n        responses: {\n          '200': {\n            description: 'Deleted successfully',\n            content: {\n              'application/json': {\n                schema: {\n                  type: 'object',\n                  properties: {\n                    success: { type: 'boolean' },\n                    message: { type: 'string' },\n                  },\n                },\n              },\n            },\n          },\n        },\n      }, undefined, additionalSecurity);\n    }\n\n    if (Object.keys(itemPath).length > 0) {\n      paths[toOpenApiPath(`${basePath}/:id`)] = itemPath;\n    }\n  }\n\n  // Additional routes from presets\n  for (const route of resource.additionalRoutes || []) {\n    const fullPath = toOpenApiPath(`${basePath}${route.path}`);\n    const method = route.method.toLowerCase() as keyof PathItem;\n\n    if (!paths[fullPath]) {\n      paths[fullPath] = {};\n    }\n\n    // Check if route requires auth (not public)\n    const handlerName = route.operation ?? (typeof route.handler === 'string' ? route.handler : 'handler');\n    const isPublicRoute = (route.permissions as PermissionCheck)?._isPublic === true;\n    const requiresAuthForRoute = !!route.permissions && !isPublicRoute;\n\n    // Build extras from route schema\n    const extras: Partial<Operation> = {\n      parameters: extractPathParams(route.path),\n      responses: {\n        '200': { description: route.description || 'Success' },\n      },\n    };\n\n    // Add request body from route.schema.body (for POST, PUT, PATCH)\n    // Auto-convert Zod schemas to JSON Schema (no-op for plain JSON Schema)\n    const rawSchema = route.schema as Record<string, unknown> | undefined;\n    const routeSchema = rawSchema ? convertRouteSchema(rawSchema) : undefined;\n    if (routeSchema?.body && ['post', 'put', 'patch'].includes(method)) {\n      extras.requestBody = {\n        required: true,\n        content: {\n          'application/json': {\n            schema: routeSchema.body as SchemaObject,\n          },\n        },\n      };\n    }\n\n    // Add query parameters from route.schema.querystring\n    if (routeSchema?.querystring) {\n      const queryParams = convertSchemaToParameters(routeSchema.querystring as Record<string, unknown>);\n      extras.parameters = [...(extras.parameters || []), ...queryParams];\n    }\n\n    // Add custom response schema if provided\n    if (routeSchema?.response) {\n      const responseSchemas = routeSchema.response as Record<string, unknown>;\n      for (const [statusCode, schema] of Object.entries(responseSchemas)) {\n        extras.responses![statusCode] = {\n          description: (schema as Record<string, unknown>).description as string || `Response ${statusCode}`,\n          content: {\n            'application/json': {\n              schema: schema as SchemaObject,\n            },\n          },\n        };\n      }\n    }\n\n    paths[fullPath][method] = createOperation(\n      resource,\n      handlerName,\n      route.summary ?? handlerName,\n      extras,\n      requiresAuthForRoute,\n      additionalSecurity,\n    );\n  }\n\n  return paths;\n}\n\n/**\n * Create an operation object\n * @param requiresAuthOverride - Override for whether auth is required (for additional routes)\n * @param additionalSecurity - Extra security alternatives from external integrations (OR'd with bearerAuth)\n */\nfunction createOperation(\n  resource: RegistryEntry,\n  operation: string,\n  summary: string,\n  extras: Partial<Operation>,\n  requiresAuthOverride?: boolean,\n  additionalSecurity: Array<Record<string, string[]>> = [],\n): Operation {\n  const permissions = resource.permissions || {};\n  // Check if permission check is defined for this operation\n  const operationPermission = (permissions as Record<string, unknown>)[operation];\n  // Check if it's marked as public (allowPublic())\n  const isPublic = (operationPermission as PermissionCheck)?._isPublic === true;\n  // Check for role requirements\n  const requiredRoles = (operationPermission as PermissionCheck)?._roles;\n  // If override is provided, use it; otherwise check if operation has a permission check that isn't public\n  const requiresAuth = requiresAuthOverride !== undefined\n    ? requiresAuthOverride\n    : typeof operationPermission === 'function' && !isPublic;\n\n  // Build permission annotation\n  const permAnnotation = describePermissionForOpenApi(operationPermission);\n\n  // Build description with permission + preset info\n  const descParts: string[] = [];\n  if (permAnnotation) {\n    descParts.push(`**Permission**: ${permAnnotation.type === 'public' ? 'Public' : permAnnotation.type === 'requireRoles' ? `Requires roles: ${(permAnnotation.roles ?? []).join(', ')}` : 'Requires authentication'}`);\n  }\n  if (resource.presets && resource.presets.length > 0) {\n    descParts.push(`**Presets**: ${resource.presets.join(', ')}`);\n  }\n  // Find pipeline steps that apply to this operation\n  const applicableSteps = (resource.pipelineSteps ?? []).filter((s) => {\n    if (!s.operations) return true; // applies to all\n    return s.operations.includes(operation);\n  });\n\n  const op: Operation = {\n    tags: [resource.tag || 'Resource'],\n    summary: `${summary} ${(resource.displayName || resource.name).toLowerCase()}`,\n    operationId: `${resource.name}_${operation}`,\n    ...(descParts.length > 0 && { description: descParts.join('\\n\\n') }),\n    // Only add security requirement if route requires auth\n    ...(requiresAuth && {\n      security: [{ bearerAuth: [] }, ...additionalSecurity],\n    }),\n    // Permission metadata extension\n    ...(permAnnotation && { 'x-arc-permission': permAnnotation }),\n    // Pipeline extension\n    ...(applicableSteps.length > 0 && {\n      'x-arc-pipeline': applicableSteps.map((s) => ({ type: s.type, name: s.name })),\n    }),\n    responses: {\n      ...(requiresAuth && {\n        '401': {\n          description: 'Authentication required — no valid Bearer token provided',\n          content: {\n            'application/json': {\n              schema: { $ref: '#/components/schemas/Error' },\n            },\n          },\n        },\n        '403': {\n          description: permAnnotation?.roles\n            ? `Forbidden — requires one of: ${(permAnnotation.roles as string[]).join(', ')}`\n            : 'Forbidden — insufficient permissions',\n          content: {\n            'application/json': {\n              schema: { $ref: '#/components/schemas/Error' },\n            },\n          },\n        },\n      }),\n      '500': { description: 'Internal server error' },\n    },\n    ...extras,\n  };\n\n  return op;\n}\n\n/**\n * Describe a permission check function for OpenAPI.\n * Extracts role, org role, and team permission metadata from permission functions.\n */\nfunction describePermissionForOpenApi(\n  check: unknown,\n): { type: string; roles?: readonly string[]; orgRoles?: readonly string[] } | undefined {\n  if (!check || typeof check !== 'function') return undefined;\n\n  const fn = check as PermissionCheck & {\n    _orgRoles?: readonly string[];\n    _orgPermission?: string;\n    _teamPermission?: string;\n  };\n\n  if (fn._isPublic === true) return { type: 'public' };\n\n  const result: { type: string; roles?: readonly string[]; orgRoles?: readonly string[] } = {\n    type: 'requireAuth',\n  };\n\n  if (Array.isArray(fn._roles) && fn._roles.length > 0) {\n    result.type = 'requireRoles';\n    result.roles = fn._roles as string[];\n  }\n  if (Array.isArray(fn._orgRoles) && fn._orgRoles.length > 0) {\n    result.orgRoles = fn._orgRoles;\n  }\n\n  return result;\n}\n\n/**\n * Extract path parameters from route path\n */\nfunction extractPathParams(path: string): Parameter[] {\n  const params: Parameter[] = [];\n  const matches = path.matchAll(/:([^/]+)/g);\n\n  for (const match of matches) {\n    const paramName = match[1];\n    if (paramName) {\n      params.push({\n        name: paramName,\n        in: 'path',\n        required: true,\n        schema: { type: 'string' },\n      });\n    }\n  }\n\n  return params;\n}\n\n/**\n * Generate schema definitions from pre-stored registry schemas.\n * Schemas are generated at resource definition time and stored in the registry.\n *\n * Response schema priority:\n * 1. If resource provides explicit `openApiSchemas.response`, use it as-is\n * 2. Otherwise, auto-generate from `createBody` + _id + timestamps\n *\n * Note: This is for OpenAPI documentation only - does NOT affect Fastify serialization.\n */\nfunction generateSchemas(resources: RegistryEntry[]): Record<string, SchemaObject> {\n  const schemas: Record<string, SchemaObject> = {\n    // Common schemas (pagination fields are inlined in list responses)\n    Error: {\n      type: 'object',\n      properties: {\n        success: { type: 'boolean', example: false },\n        error: { type: 'string' },\n        code: { type: 'string' },\n        requestId: { type: 'string' },\n        timestamp: { type: 'string' },\n      },\n    },\n  };\n\n  for (const resource of resources) {\n    const storedSchemas = resource.openApiSchemas;\n    const fieldPerms = resource.fieldPermissions;\n\n    // === RESPONSE SCHEMA (for GET responses) ===\n    // Priority 1: Explicit response schema provided by user\n    if (storedSchemas?.response) {\n      schemas[resource.name] = {\n        type: 'object',\n        description: resource.displayName,\n        ...(storedSchemas.response as SchemaObject),\n      };\n    }\n    // Priority 2: Auto-generate from createBody\n    else if (storedSchemas?.createBody) {\n      schemas[resource.name] = {\n        type: 'object',\n        description: resource.displayName,\n        properties: {\n          _id: { type: 'string', description: 'Unique identifier' },\n          ...((storedSchemas.createBody as SchemaObject).properties ?? {}),\n          createdAt: { type: 'string', format: 'date-time', description: 'Creation timestamp' },\n          updatedAt: { type: 'string', format: 'date-time', description: 'Last update timestamp' },\n        },\n      };\n    }\n    // Fallback: Placeholder schema\n    else {\n      schemas[resource.name] = {\n        type: 'object',\n        description: resource.displayName,\n        properties: {\n          _id: { type: 'string', description: 'Unique identifier' },\n          createdAt: { type: 'string', format: 'date-time', description: 'Creation timestamp' },\n          updatedAt: { type: 'string', format: 'date-time', description: 'Last update timestamp' },\n        },\n      };\n    }\n\n    // Annotate fields with permission info\n    if (fieldPerms && schemas[resource.name]?.properties) {\n      const props = schemas[resource.name]!.properties!;\n      for (const [field, perm] of Object.entries(fieldPerms)) {\n        if (props[field]) {\n          // Add permission description to existing field\n          const desc = props[field]!.description ?? '';\n          const permDesc = formatFieldPermDescription(perm);\n          props[field]!.description = desc ? `${desc} (${permDesc})` : permDesc;\n        } else if (perm.type === 'hidden') {\n          // Hidden fields won't appear in schema — note in schema description\n        }\n      }\n    }\n\n    // === INPUT SCHEMAS (for POST/PATCH requests) ===\n    if (storedSchemas?.createBody) {\n      schemas[`${resource.name}Input`] = {\n        type: 'object',\n        description: `${resource.displayName} create input`,\n        ...(storedSchemas.createBody as SchemaObject),\n      };\n\n      if (storedSchemas.updateBody) {\n        schemas[`${resource.name}Update`] = {\n          type: 'object',\n          description: `${resource.displayName} update input`,\n          ...(storedSchemas.updateBody as SchemaObject),\n        };\n      }\n    } else {\n      schemas[`${resource.name}Input`] = {\n        type: 'object',\n        description: `${resource.displayName} input`,\n      };\n    }\n  }\n\n  return schemas;\n}\n\n/**\n * Format a field permission description for OpenAPI\n */\nfunction formatFieldPermDescription(\n  perm: { type: string; roles?: readonly string[]; redactValue?: unknown },\n): string {\n  switch (perm.type) {\n    case 'hidden':\n      return 'Hidden — never returned in responses';\n    case 'visibleTo':\n      return `Visible to: ${(perm.roles ?? []).join(', ')}`;\n    case 'writableBy':\n      return `Writable by: ${(perm.roles ?? []).join(', ')}`;\n    case 'redactFor':\n      return `Redacted for: ${(perm.roles ?? []).join(', ')}`;\n    default:\n      return perm.type;\n  }\n}\n\nexport default fp(openApiPlugin, {\n  name: 'arc-openapi',\n  fastify: '5.x',\n});\n\nexport { openApiPlugin };\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA0IA,MAAM,gBAAoD,OACxD,SACA,OAAuB,EAAE,KACtB;CACH,MAAM,EACJ,QAAQ,WACR,UAAU,SACV,aACA,WACA,SAAS,UACT,YAAY,IACZ,YAAY,EAAE,KACZ;CAGJ,MAAM,kBAA+B;EACnC,MAAM,MAAO,QAA6C;EAC1D,MAAM,YAAY,KAAK,UAAU,QAAQ,IAAI,EAAE;EAC/C,MAAM,gBAAgB,KAAK,wBAAwB,EAAE;AACrD,SAAO,iBAAiB,WAAW;GACjC;GACA;GACA;GACA;GACA;GACD,EAAE,cAAc,SAAS,IAAI,gBAAgB,OAAU;;AAI1D,SAAQ,IAAI,GAAG,OAAO,gBAAgB,OAAO,SAAS,UAAU;AAE9D,MAAI,UAAU,SAAS,GAAG;GACxB,MAAM,OAAQ,QAA4C;AAE1D,OAAI,CADY,UAAU,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK,CAAC,IACrD,CAAC,MAAM,OAAO,SAAS,aAAa,EAAE;AACpD,UAAM,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAChD;;;AAMJ,SAFa,WAAW;GAGxB;AAEF,SAAQ,KAAK,QAAQ,6BAA6B,OAAO,eAAe;;;;;;AAO1E,SAAgB,iBACd,WACA,UAA+B,EAAE,EACjC,eACa;CACb,MAAM,EACJ,QAAQ,WACR,UAAU,SACV,aACA,WACA,YAAY,OACV;CAEJ,MAAM,QAAkC,EAAE;CAC1C,MAAM,OAAsD,EAAE;CAI9D,MAAM,qBAAqB,eACvB,SAAQ,QAAO,IAAI,oBAAoB,EAAE,CAAC,IAAI,EAAE;AAEpD,MAAK,MAAM,YAAY,WAAW;EAEhC,MAAM,eAAe,CAAC,GAAG,SAAS,eAAe,SAAS,KAAK,aAAa;AAC5E,MAAI,SAAS,WAAW,SAAS,QAAQ,SAAS,EAChD,cAAa,KAAK,YAAY,SAAS,QAAQ,KAAK,KAAK,GAAG;AAE9D,MAAI,SAAS,iBAAiB,SAAS,cAAc,SAAS,GAAG;GAC/D,MAAM,YAAY,SAAS,cAAc,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,KAAK,GAAG;AAC3E,gBAAa,KAAK,aAAa,UAAU,KAAK,MAAM,GAAG;;AAEzD,MAAI,SAAS,UAAU,SAAS,OAAO,SAAS,EAC9C,cAAa,KAAK,WAAW,SAAS,OAAO,KAAK,KAAK,GAAG;AAG5D,OAAK,KAAK;GACR,MAAM,SAAS,OAAO,SAAS;GAC/B,aAAa,aAAa,KAAK,KAAK;GACrC,CAAC;EAEF,MAAM,gBAAgB,sBAAsB,UAAU,WAAW,mBAAmB;AACpF,SAAO,OAAO,OAAO,cAAc;;AAIrC,KAAI,cACF,MAAK,MAAM,OAAO,eAAe;AAC/B,OAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,IAAI,MAAM,CACrD,OAAM,QAAQ,MAAM,QAChB;GAAE,GAAG,MAAM;GAAO,GAAG;GAAS,GAC9B;AAEN,MAAI,IAAI,MACN;QAAK,MAAM,OAAO,IAAI,KACpB,KAAI,CAAC,KAAK,MAAM,MAAM,EAAE,SAAS,IAAI,KAAK,CACxC,MAAK,KAAK,IAAI;;;CAQxB,MAAM,0BAA0B,eAC5B,QAAiD,KAAK,SAAS;EAAE,GAAG;EAAK,GAAG,IAAI;EAAiB,GAAG,EAAE,CAAC,IAAI,EAAE;CACjH,MAAM,kBAAkB,eACpB,QAAiD,KAAK,SAAS;EAAE,GAAG;EAAK,GAAG,IAAI;EAAS,GAAG,EAAE,CAAC,IAAI,EAAE;AAEzG,QAAO;EACL,SAAS;EACT,MAAM;GACJ;GACA;GACA,GAAI,eAAe,EAAE,aAAa;GACnC;EACD,GAAI,aAAa,EACf,SAAS,CAAC,EAAE,KAAK,WAAW,CAAC,EAC9B;EACD;EACA,YAAY;GACV,SAAS;IACP,GAAG,gBAAgB,UAAU;IAC7B,GAAG;IACJ;GACD,iBAAiB;IACf,YAAY;KACV,MAAM;KACN,QAAQ;KACR,cAAc;KACf;IACD,WAAW;KACT,MAAM;KACN,IAAI;KACJ,MAAM;KACP;IAGD,GAAG;IACJ;GACF;EACD;EACD;;;;;AAMH,SAAS,cAAc,MAAsB;AAC3C,QAAO,KAAK,QAAQ,aAAa,OAAO;;;;;;AAO1C,SAAS,0BAA0B,QAA8C;CAC/E,MAAM,SAAsB,EAAE;CAC9B,MAAM,aAAc,OAAO,cAA0D,EAAE;CACvF,MAAM,WAAY,OAAO,YAAyB,EAAE;AAEpD,MAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,WAAW,EAAE;EAErD,MAAM,cAAc,KAAK;EACzB,MAAM,EAAE,aAAa,GAAG,GAAG,gBAAgB;EAE3C,MAAM,QAAmB;GACvB;GACA,IAAI;GACJ,UAAU,SAAS,SAAS,KAAK;GACjC,QAAQ;GACT;AAED,MAAI,YACF,OAAM,cAAc;AAGtB,SAAO,KAAK,MAAM;;AAEpB,QAAO;;;;;AAMT,MAAM,sBAAmC;CACvC;EAAE,MAAM;EAAQ,IAAI;EAAS,QAAQ,EAAE,MAAM,WAAW;EAAE,aAAa;EAAe;CACtF;EAAE,MAAM;EAAS,IAAI;EAAS,QAAQ,EAAE,MAAM,WAAW;EAAE,aAAa;EAAkB;CAC1F;EAAE,MAAM;EAAQ,IAAI;EAAS,QAAQ,EAAE,MAAM,UAAU;EAAE,aAAa;EAA6C;CACpH;;;;AAKD,SAAS,sBACP,UACA,YAAY,IACZ,qBAAsD,EAAE,EAC9B;CAC1B,MAAM,QAAkC,EAAE;CAC1C,MAAM,WAAW,GAAG,YAAY,SAAS;AAGzC,KAAI,SAAS,yBAAyB,CAAC,SAAS,oBAAoB,SAAS,iBAAiB,WAAW,GACvG,QAAO;AAIT,KAAI,CAAC,SAAS,sBAAsB;EAClC,MAAM,cAAc,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAC;EAC1D,MAAM,eAAe,SAAS,gBAAgB;EAG9C,MAAM,iBAA2B,EAAE;AAEnC,MAAI,CAAC,YAAY,IAAI,OAAO,CAK1B,gBAAe,MAAM,gBAAgB,UAAU,QAAQ,YAAY;GACjE,YALiB,SAAS,gBAAgB,YACxC,0BAA0B,SAAS,eAAe,UAAqC,GACvF;GAIF,WAAW,EACT,OAAO;IACL,aAAa;IACb,SAAS,EACP,oBAAoB,EAClB,QAAQ;KACN,MAAM;KACN,YAAY;MACV,SAAS,EAAE,MAAM,WAAW;MAC5B,MAAM;OAAE,MAAM;OAAS,OAAO,EAAE,MAAM,wBAAwB,SAAS,QAAQ;OAAE;MACjF,MAAM,EAAE,MAAM,WAAW;MACzB,OAAO,EAAE,MAAM,WAAW;MAC1B,OAAO,EAAE,MAAM,WAAW;MAC1B,OAAO,EAAE,MAAM,WAAW;MAC1B,SAAS,EAAE,MAAM,WAAW;MAC5B,SAAS,EAAE,MAAM,WAAW;MAC7B;KACF,EACF,EACF;IACF,EACF;GACF,EAAE,QAAW,mBAAmB;AAGnC,MAAI,CAAC,YAAY,IAAI,SAAS,CAC5B,gBAAe,OAAO,gBAAgB,UAAU,UAAU,cAAc;GACtE,aAAa;IACX,UAAU;IACV,SAAS,EACP,oBAAoB,EAClB,QAAQ,EAAE,MAAM,wBAAwB,SAAS,KAAK,QAAQ,EAC/D,EACF;IACF;GACD,WAAW,EACT,OAAO;IACL,aAAa;IACb,SAAS,EACP,oBAAoB,EAClB,QAAQ;KACN,MAAM;KACN,YAAY;MACV,SAAS,EAAE,MAAM,WAAW;MAC5B,MAAM,EAAE,MAAM,wBAAwB,SAAS,QAAQ;MACvD,SAAS,EAAE,MAAM,UAAU;MAC5B;KACF,EACF,EACF;IACF,EACF;GACF,EAAE,QAAW,mBAAmB;AAGnC,MAAI,OAAO,KAAK,eAAe,CAAC,SAAS,EACvC,OAAM,YAAY;EAIpB,MAAM,WAAqB,EAAE;AAE7B,MAAI,CAAC,YAAY,IAAI,MAAM,CACzB,UAAS,MAAM,gBAAgB,UAAU,OAAO,aAAa;GAC3D,YAAY,CACV;IAAE,MAAM;IAAM,IAAI;IAAQ,UAAU;IAAM,QAAQ,EAAE,MAAM,UAAU;IAAE,CACvE;GACD,WAAW;IACT,OAAO;KACL,aAAa;KACb,SAAS,EACP,oBAAoB,EAClB,QAAQ;MACN,MAAM;MACN,YAAY;OACV,SAAS,EAAE,MAAM,WAAW;OAC5B,MAAM,EAAE,MAAM,wBAAwB,SAAS,QAAQ;OACxD;MACF,EACF,EACF;KACF;IACD,OAAO,EAAE,aAAa,aAAa;IACpC;GACF,EAAE,QAAW,mBAAmB;AAGnC,MAAI,CAAC,YAAY,IAAI,SAAS,EAAE;GAC9B,MAAM,WAAW,gBAAgB,UAAU,UAAU,UAAU;IAC7D,YAAY,CACV;KAAE,MAAM;KAAM,IAAI;KAAQ,UAAU;KAAM,QAAQ,EAAE,MAAM,UAAU;KAAE,CACvE;IACD,aAAa;KACX,UAAU;KACV,SAAS,EACP,oBAAoB,EAClB,QAAQ,EAAE,MAAM,wBAAwB,SAAS,KAAK,QAAQ,EAC/D,EACF;KACF;IACD,WAAW,EACT,OAAO;KACL,aAAa;KACb,SAAS,EACP,oBAAoB,EAClB,QAAQ;MACN,MAAM;MACN,YAAY;OACV,SAAS,EAAE,MAAM,WAAW;OAC5B,MAAM,EAAE,MAAM,wBAAwB,SAAS,QAAQ;OACvD,SAAS,EAAE,MAAM,UAAU;OAC5B;MACF,EACF,EACF;KACF,EACF;IACF,EAAE,QAAW,mBAAmB;AAEjC,OAAI,iBAAiB,QAAQ;AAC3B,aAAS,MAAM;AACf,aAAS,QAAQ;cACR,iBAAiB,MAC1B,UAAS,MAAM;OAEf,UAAS,QAAQ;;AAIrB,MAAI,CAAC,YAAY,IAAI,SAAS,CAC5B,UAAS,SAAS,gBAAgB,UAAU,UAAU,UAAU;GAC9D,YAAY,CACV;IAAE,MAAM;IAAM,IAAI;IAAQ,UAAU;IAAM,QAAQ,EAAE,MAAM,UAAU;IAAE,CACvE;GACD,WAAW,EACT,OAAO;IACL,aAAa;IACb,SAAS,EACP,oBAAoB,EAClB,QAAQ;KACN,MAAM;KACN,YAAY;MACV,SAAS,EAAE,MAAM,WAAW;MAC5B,SAAS,EAAE,MAAM,UAAU;MAC5B;KACF,EACF,EACF;IACF,EACF;GACF,EAAE,QAAW,mBAAmB;AAGnC,MAAI,OAAO,KAAK,SAAS,CAAC,SAAS,EACjC,OAAM,cAAc,GAAG,SAAS,MAAM,IAAI;;AAK9C,MAAK,MAAM,SAAS,SAAS,oBAAoB,EAAE,EAAE;EACnD,MAAM,WAAW,cAAc,GAAG,WAAW,MAAM,OAAO;EAC1D,MAAM,SAAS,MAAM,OAAO,aAAa;AAEzC,MAAI,CAAC,MAAM,UACT,OAAM,YAAY,EAAE;EAItB,MAAM,cAAc,MAAM,cAAc,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU;EAC5F,MAAM,gBAAiB,MAAM,aAAiC,cAAc;EAC5E,MAAM,uBAAuB,CAAC,CAAC,MAAM,eAAe,CAAC;EAGrD,MAAM,SAA6B;GACjC,YAAY,kBAAkB,MAAM,KAAK;GACzC,WAAW,EACT,OAAO,EAAE,aAAa,MAAM,eAAe,WAAW,EACvD;GACF;EAID,MAAM,YAAY,MAAM;EACxB,MAAM,cAAc,YAAY,mBAAmB,UAAU,GAAG;AAChE,MAAI,aAAa,QAAQ;GAAC;GAAQ;GAAO;GAAQ,CAAC,SAAS,OAAO,CAChE,QAAO,cAAc;GACnB,UAAU;GACV,SAAS,EACP,oBAAoB,EAClB,QAAQ,YAAY,MACrB,EACF;GACF;AAIH,MAAI,aAAa,aAAa;GAC5B,MAAM,cAAc,0BAA0B,YAAY,YAAuC;AACjG,UAAO,aAAa,CAAC,GAAI,OAAO,cAAc,EAAE,EAAG,GAAG,YAAY;;AAIpE,MAAI,aAAa,UAAU;GACzB,MAAM,kBAAkB,YAAY;AACpC,QAAK,MAAM,CAAC,YAAY,WAAW,OAAO,QAAQ,gBAAgB,CAChE,QAAO,UAAW,cAAc;IAC9B,aAAc,OAAmC,eAAyB,YAAY;IACtF,SAAS,EACP,oBAAoB,EACV,QACT,EACF;IACF;;AAIL,QAAM,UAAU,UAAU,gBACxB,UACA,aACA,MAAM,WAAW,aACjB,QACA,sBACA,mBACD;;AAGH,QAAO;;;;;;;AAQT,SAAS,gBACP,UACA,WACA,SACA,QACA,sBACA,qBAAsD,EAAE,EAC7C;CAGX,MAAM,uBAFc,SAAS,eAAe,EAAE,EAEuB;CAErE,MAAM,WAAY,qBAAyC,cAAc;AAEnD,CAAC,qBAAyC;CAEhE,MAAM,eAAe,yBAAyB,SAC1C,uBACA,OAAO,wBAAwB,cAAc,CAAC;CAGlD,MAAM,iBAAiB,6BAA6B,oBAAoB;CAGxE,MAAM,YAAsB,EAAE;AAC9B,KAAI,eACF,WAAU,KAAK,mBAAmB,eAAe,SAAS,WAAW,WAAW,eAAe,SAAS,iBAAiB,oBAAoB,eAAe,SAAS,EAAE,EAAE,KAAK,KAAK,KAAK,4BAA4B;AAEtN,KAAI,SAAS,WAAW,SAAS,QAAQ,SAAS,EAChD,WAAU,KAAK,gBAAgB,SAAS,QAAQ,KAAK,KAAK,GAAG;CAG/D,MAAM,mBAAmB,SAAS,iBAAiB,EAAE,EAAE,QAAQ,MAAM;AACnE,MAAI,CAAC,EAAE,WAAY,QAAO;AAC1B,SAAO,EAAE,WAAW,SAAS,UAAU;GACvC;AA2CF,QAzCsB;EACpB,MAAM,CAAC,SAAS,OAAO,WAAW;EAClC,SAAS,GAAG,QAAQ,IAAI,SAAS,eAAe,SAAS,MAAM,aAAa;EAC5E,aAAa,GAAG,SAAS,KAAK,GAAG;EACjC,GAAI,UAAU,SAAS,KAAK,EAAE,aAAa,UAAU,KAAK,OAAO,EAAE;EAEnE,GAAI,gBAAgB,EAClB,UAAU,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,mBAAmB,EACtD;EAED,GAAI,kBAAkB,EAAE,oBAAoB,gBAAgB;EAE5D,GAAI,gBAAgB,SAAS,KAAK,EAChC,kBAAkB,gBAAgB,KAAK,OAAO;GAAE,MAAM,EAAE;GAAM,MAAM,EAAE;GAAM,EAAE,EAC/E;EACD,WAAW;GACT,GAAI,gBAAgB;IAClB,OAAO;KACL,aAAa;KACb,SAAS,EACP,oBAAoB,EAClB,QAAQ,EAAE,MAAM,8BAA8B,EAC/C,EACF;KACF;IACD,OAAO;KACL,aAAa,gBAAgB,QACzB,gCAAiC,eAAe,MAAmB,KAAK,KAAK,KAC7E;KACJ,SAAS,EACP,oBAAoB,EAClB,QAAQ,EAAE,MAAM,8BAA8B,EAC/C,EACF;KACF;IACF;GACD,OAAO,EAAE,aAAa,yBAAyB;GAChD;EACD,GAAG;EACJ;;;;;;AASH,SAAS,6BACP,OACuF;AACvF,KAAI,CAAC,SAAS,OAAO,UAAU,WAAY,QAAO;CAElD,MAAM,KAAK;AAMX,KAAI,GAAG,cAAc,KAAM,QAAO,EAAE,MAAM,UAAU;CAEpD,MAAM,SAAoF,EACxF,MAAM,eACP;AAED,KAAI,MAAM,QAAQ,GAAG,OAAO,IAAI,GAAG,OAAO,SAAS,GAAG;AACpD,SAAO,OAAO;AACd,SAAO,QAAQ,GAAG;;AAEpB,KAAI,MAAM,QAAQ,GAAG,UAAU,IAAI,GAAG,UAAU,SAAS,EACvD,QAAO,WAAW,GAAG;AAGvB,QAAO;;;;;AAMT,SAAS,kBAAkB,MAA2B;CACpD,MAAM,SAAsB,EAAE;CAC9B,MAAM,UAAU,KAAK,SAAS,YAAY;AAE1C,MAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,YAAY,MAAM;AACxB,MAAI,UACF,QAAO,KAAK;GACV,MAAM;GACN,IAAI;GACJ,UAAU;GACV,QAAQ,EAAE,MAAM,UAAU;GAC3B,CAAC;;AAIN,QAAO;;;;;;;;;;;;AAaT,SAAS,gBAAgB,WAA0D;CACjF,MAAM,UAAwC,EAE5C,OAAO;EACL,MAAM;EACN,YAAY;GACV,SAAS;IAAE,MAAM;IAAW,SAAS;IAAO;GAC5C,OAAO,EAAE,MAAM,UAAU;GACzB,MAAM,EAAE,MAAM,UAAU;GACxB,WAAW,EAAE,MAAM,UAAU;GAC7B,WAAW,EAAE,MAAM,UAAU;GAC9B;EACF,EACF;AAED,MAAK,MAAM,YAAY,WAAW;EAChC,MAAM,gBAAgB,SAAS;EAC/B,MAAM,aAAa,SAAS;AAI5B,MAAI,eAAe,SACjB,SAAQ,SAAS,QAAQ;GACvB,MAAM;GACN,aAAa,SAAS;GACtB,GAAI,cAAc;GACnB;WAGM,eAAe,WACtB,SAAQ,SAAS,QAAQ;GACvB,MAAM;GACN,aAAa,SAAS;GACtB,YAAY;IACV,KAAK;KAAE,MAAM;KAAU,aAAa;KAAqB;IACzD,GAAK,cAAc,WAA4B,cAAc,EAAE;IAC/D,WAAW;KAAE,MAAM;KAAU,QAAQ;KAAa,aAAa;KAAsB;IACrF,WAAW;KAAE,MAAM;KAAU,QAAQ;KAAa,aAAa;KAAyB;IACzF;GACF;MAID,SAAQ,SAAS,QAAQ;GACvB,MAAM;GACN,aAAa,SAAS;GACtB,YAAY;IACV,KAAK;KAAE,MAAM;KAAU,aAAa;KAAqB;IACzD,WAAW;KAAE,MAAM;KAAU,QAAQ;KAAa,aAAa;KAAsB;IACrF,WAAW;KAAE,MAAM;KAAU,QAAQ;KAAa,aAAa;KAAyB;IACzF;GACF;AAIH,MAAI,cAAc,QAAQ,SAAS,OAAO,YAAY;GACpD,MAAM,QAAQ,QAAQ,SAAS,MAAO;AACtC,QAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,WAAW,CACpD,KAAI,MAAM,QAAQ;IAEhB,MAAM,OAAO,MAAM,OAAQ,eAAe;IAC1C,MAAM,WAAW,2BAA2B,KAAK;AACjD,UAAM,OAAQ,cAAc,OAAO,GAAG,KAAK,IAAI,SAAS,KAAK;cACpD,KAAK,SAAS,UAAU;;AAOvC,MAAI,eAAe,YAAY;AAC7B,WAAQ,GAAG,SAAS,KAAK,UAAU;IACjC,MAAM;IACN,aAAa,GAAG,SAAS,YAAY;IACrC,GAAI,cAAc;IACnB;AAED,OAAI,cAAc,WAChB,SAAQ,GAAG,SAAS,KAAK,WAAW;IAClC,MAAM;IACN,aAAa,GAAG,SAAS,YAAY;IACrC,GAAI,cAAc;IACnB;QAGH,SAAQ,GAAG,SAAS,KAAK,UAAU;GACjC,MAAM;GACN,aAAa,GAAG,SAAS,YAAY;GACtC;;AAIL,QAAO;;;;;AAMT,SAAS,2BACP,MACQ;AACR,SAAQ,KAAK,MAAb;EACE,KAAK,SACH,QAAO;EACT,KAAK,YACH,QAAO,gBAAgB,KAAK,SAAS,EAAE,EAAE,KAAK,KAAK;EACrD,KAAK,aACH,QAAO,iBAAiB,KAAK,SAAS,EAAE,EAAE,KAAK,KAAK;EACtD,KAAK,YACH,QAAO,kBAAkB,KAAK,SAAS,EAAE,EAAE,KAAK,KAAK;EACvD,QACE,QAAO,KAAK;;;AAIlB,sBAAe,GAAG,eAAe;CAC/B,MAAM;CACN,SAAS;CACV,CAAC"}