@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/api-contract/model.js

@@ -0,0 +1,993 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiContractModelError = exports.API_CONTRACT_JSON_TYPES = exports.API_CONTRACT_HTTP_METHODS = exports.API_CONTRACT_AUTHENTICATION_MODES = exports.API_CONTRACT_HTTP_HEADER_VALUE_PATTERN = exports.API_CONTRACT_HTTP_HEADER_VALUE_MAX_LENGTH = exports.API_CONTRACT_HTTP_HEADER_VALUE_FORMAT = exports.API_CONTRACT_RESPONSE_PROFILE = exports.API_CONTRACT_JSON_SCHEMA_DIALECT = exports.API_CONTRACT_BASELINE_KIND = exports.API_CONTRACT_BASELINE_SCHEMA_VERSION = void 0;
+exports.normalizeApiContractBaseline = normalizeApiContractBaseline;
+exports.createApiContractBaseline = createApiContractBaseline;
+exports.canonicalApiContractBaselineJson = canonicalApiContractBaselineJson;
+exports.digestApiContractBaseline = digestApiContractBaseline;
+const node_crypto_1 = require("node:crypto");
+exports.API_CONTRACT_BASELINE_SCHEMA_VERSION = 1;
+exports.API_CONTRACT_BASELINE_KIND = 'api-contract-baseline';
+exports.API_CONTRACT_JSON_SCHEMA_DIALECT = 'https://json-schema.org/draft/2020-12/schema';
+exports.API_CONTRACT_RESPONSE_PROFILE = 'ebk-app-v1';
+exports.API_CONTRACT_HTTP_HEADER_VALUE_FORMAT = 'ebk-http-header-value';
+exports.API_CONTRACT_HTTP_HEADER_VALUE_MAX_LENGTH = 8 * 1024;
+exports.API_CONTRACT_HTTP_HEADER_VALUE_PATTERN = '^[!-~](?:[ -~]*[!-~])?(?![\\s\\S])';
+exports.API_CONTRACT_AUTHENTICATION_MODES = [
+    'anonymous',
+    'customer',
+    'internal',
+    'operator',
+    'product-agent',
+];
+exports.API_CONTRACT_HTTP_METHODS = [
+    'DELETE',
+    'GET',
+    'PATCH',
+    'POST',
+    'PUT',
+];
+exports.API_CONTRACT_JSON_TYPES = [
+    'array',
+    'boolean',
+    'integer',
+    'null',
+    'number',
+    'object',
+    'string',
+];
+class ApiContractModelError extends Error {
+    classification;
+    pointer;
+    constructor(classification, pointer, message) {
+        super(`${pointer}: ${message}`);
+        this.classification = classification;
+        this.pointer = pointer;
+        this.name = 'ApiContractModelError';
+    }
+}
+exports.ApiContractModelError = ApiContractModelError;
+const EXACT_SEMANTIC_VERSION_PATTERN = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
+const SLICE_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
+const OPERATION_ID_PATTERN = /^[a-z][a-z0-9-]*\.[a-z][a-z0-9.-]*$/;
+const FEATURE_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
+const ACTION_PATTERN = /^[a-z][a-z0-9-]{0,62}:[a-z][a-z0-9-]{0,62}$/;
+const PROBLEM_CODE_PATTERN = /^[a-z][a-z0-9_]{2,63}$/;
+const FRAMEWORK_PROBLEM_CODES = new Set([
+    'internal_error',
+    'invalid_request',
+    'method_not_allowed',
+]);
+const SCHEMA_PROPERTY_PATTERN = /^[A-Za-z_][A-Za-z0-9_.-]{0,127}$/;
+const RESERVED_SCHEMA_PROPERTY_NAMES = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+]);
+const RESERVED_REQUEST_HEADERS = new Set([
+    'authorization',
+    'content-length',
+    'content-type',
+    'cookie',
+    'host',
+    'idempotency-key',
+    'if-match',
+    'proxy-authorization',
+    'set-cookie',
+    'traceparent',
+    'tracestate',
+    'x-api-key',
+    'x-causation-id',
+    'x-correlation-id',
+    'x-request-id',
+]);
+const MAXIMUM_PAGINATION_CURSOR_LENGTH = 4096;
+const BOUNDED_TOKEN_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,255}$/;
+const ROUTE_PATTERN = /^\/(?:[A-Za-z0-9._~-]+|\{[a-z][A-Za-z0-9]*\})(?:\/(?:[A-Za-z0-9._~-]+|\{[a-z][A-Za-z0-9]*\}))*$/;
+const HTTP_HEADER_STRING_SCHEMA_KEYS = new Set([
+    '$schema',
+    'enum',
+    'format',
+    'maxLength',
+    'minLength',
+    'pattern',
+    'type',
+]);
+function isCanonicalHttpHeaderValue(value) {
+    if (value.length < 1 ||
+        value.length > exports.API_CONTRACT_HTTP_HEADER_VALUE_MAX_LENGTH) {
+        return false;
+    }
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code < (index === 0 || index === value.length - 1 ? 0x21 : 0x20) ||
+            code > 0x7e) {
+            return false;
+        }
+    }
+    return true;
+}
+const ALLOWED_SCHEMA_KEYS = new Set([
+    '$schema',
+    'additionalProperties',
+    'const',
+    'description',
+    'enum',
+    'format',
+    'items',
+    'maxItems',
+    'maxLength',
+    'maximum',
+    'minItems',
+    'minLength',
+    'minimum',
+    'oneOf',
+    'properties',
+    'required',
+    'type',
+]);
+const ALLOWED_ONE_OF_SIBLING_KEYS = new Set([
+    '$schema',
+    'description',
+    'oneOf',
+]);
+function fail(pointer, message, classification = 'api-contract-baseline-invalid') {
+    throw new ApiContractModelError(classification, pointer, message);
+}
+function isRecord(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function pointerToken(value) {
+    return value.replace(/~/g, '~0').replace(/\//g, '~1');
+}
+function ownKeyPointerToken(value) {
+    return pointerToken(typeof value === 'symbol' ? value.toString() : String(value));
+}
+function requireRecord(value, pointer) {
+    if (!isRecord(value)) {
+        fail(pointer, 'must be a plain or null-prototype object');
+    }
+    return value;
+}
+function rejectUnknown(value, allowed, pointer, optional = []) {
+    const allowedSet = new Set(allowed);
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== 'string' || !allowedSet.has(key)) {
+            fail(`${pointer}/${ownKeyPointerToken(key)}`, 'is not a supported property');
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable ||
+            !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+            fail(`${pointer}/${ownKeyPointerToken(key)}`, 'must be an enumerable data property');
+        }
+    }
+    const optionalSet = new Set(optional);
+    for (const key of allowed) {
+        if (!Object.prototype.hasOwnProperty.call(value, key) && key in value) {
+            fail(`${pointer}/${pointerToken(key)}`, 'must not be inherited');
+        }
+        if (!optionalSet.has(key) &&
+            !Object.prototype.hasOwnProperty.call(value, key)) {
+            fail(`${pointer}/${pointerToken(key)}`, 'is required');
+        }
+    }
+}
+function requireString(value, pointer, options = {}) {
+    if (typeof value !== 'string' ||
+        value.length === 0 ||
+        value !== value.trim() ||
+        value.length > (options.maxLength ?? 256) ||
+        (options.pattern && !options.pattern.test(value))) {
+        fail(pointer, 'must be a bounded non-empty string in the required format');
+    }
+    return value;
+}
+function requireInteger(value, pointer, minimum, maximum) {
+    if (!Number.isSafeInteger(value) ||
+        value < minimum ||
+        value > maximum) {
+        fail(pointer, `must be an integer from ${minimum} through ${maximum}`);
+    }
+    return value;
+}
+function requireFiniteNumber(value, pointer) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        fail(pointer, 'must be a finite number');
+    }
+    return value;
+}
+function requireUniqueStrings(value, pointer, pattern) {
+    if (!Array.isArray(value))
+        fail(pointer, 'must be an array');
+    const result = value.map((entry, index) => requireString(entry, `${pointer}/${index}`, { pattern }));
+    if (new Set(result).size !== result.length) {
+        fail(pointer, 'must not contain duplicate values');
+    }
+    return result.sort(compareStrings);
+}
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function containsAsciiControlOrSpace(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint !== undefined && (codePoint <= 0x20 || codePoint === 0x7f)) {
+            return true;
+        }
+    }
+    return false;
+}
+function safeObjectFromEntries(entries) {
+    return Object.assign(Object.create(null), Object.fromEntries(entries));
+}
+function compareJsonPrimitives(left, right) {
+    return compareStrings(JSON.stringify(left), JSON.stringify(right));
+}
+function normalizeSchemaType(value, pointer) {
+    if (typeof value === 'string') {
+        if (!exports.API_CONTRACT_JSON_TYPES.includes(value)) {
+            fail(pointer, 'contains an unsupported JSON Schema type');
+        }
+        return value;
+    }
+    if (!Array.isArray(value) || value.length < 2) {
+        fail(pointer, 'must be a supported type or a union of at least two types');
+    }
+    const result = value.map((entry, index) => {
+        if (typeof entry !== 'string' ||
+            !exports.API_CONTRACT_JSON_TYPES.includes(entry)) {
+            fail(`${pointer}/${index}`, 'contains an unsupported JSON Schema type');
+        }
+        return entry;
+    });
+    if (new Set(result).size !== result.length) {
+        fail(pointer, 'must not repeat a JSON Schema type');
+    }
+    return result.sort(compareStrings);
+}
+function normalizeSchema(value, pointer, options = {}) {
+    const input = requireRecord(value, pointer);
+    for (const key of Reflect.ownKeys(input)) {
+        if (typeof key !== 'string' ||
+            (!ALLOWED_SCHEMA_KEYS.has(key) &&
+                !(key === 'pattern' && options.allowCanonicalHeaderPattern))) {
+            fail(`${pointer}/${ownKeyPointerToken(key)}`, 'is outside the supported compatibility profile', 'api-contract-schema-unsupported');
+        }
+    }
+    if (input.oneOf !== undefined) {
+        for (const key of Reflect.ownKeys(input)) {
+            if (typeof key !== 'string' || !ALLOWED_ONE_OF_SIBLING_KEYS.has(key)) {
+                fail(`${pointer}/${ownKeyPointerToken(key)}`, 'cannot combine oneOf with sibling validation semantics in the supported profile', 'api-contract-schema-unsupported');
+            }
+        }
+    }
+    const type = input.type === undefined
+        ? undefined
+        : normalizeSchemaType(input.type, `${pointer}/type`);
+    const types = new Set(type === undefined ? [] : Array.isArray(type) ? type : [type]);
+    const result = {
+        ...(type === undefined ? {} : { type }),
+    };
+    if (input.$schema !== undefined) {
+        if (input.$schema !== exports.API_CONTRACT_JSON_SCHEMA_DIALECT) {
+            fail(`${pointer}/$schema`, `must equal ${exports.API_CONTRACT_JSON_SCHEMA_DIALECT}`);
+        }
+        result.$schema = exports.API_CONTRACT_JSON_SCHEMA_DIALECT;
+    }
+    if (input.additionalProperties !== undefined) {
+        if (typeof input.additionalProperties !== 'boolean' &&
+            !isRecord(input.additionalProperties)) {
+            fail(`${pointer}/additionalProperties`, 'must be a boolean or supported schema');
+        }
+        result.additionalProperties =
+            typeof input.additionalProperties === 'boolean'
+                ? input.additionalProperties
+                : normalizeSchema(input.additionalProperties, `${pointer}/additionalProperties`, options);
+    }
+    if (input.const !== undefined) {
+        if (input.const !== null &&
+            typeof input.const !== 'string' &&
+            typeof input.const !== 'boolean' &&
+            (typeof input.const !== 'number' || !Number.isFinite(input.const))) {
+            fail(`${pointer}/const`, 'must be a JSON primitive');
+        }
+        result.const = input.const;
+    }
+    if (input.description !== undefined) {
+        result.description = requireString(input.description, `${pointer}/description`, { maxLength: 1024 });
+    }
+    if (input.enum !== undefined) {
+        if (!Array.isArray(input.enum) || input.enum.length === 0) {
+            fail(`${pointer}/enum`, 'must be a non-empty array');
+        }
+        const values = input.enum.map((entry, index) => {
+            if (entry !== null &&
+                typeof entry !== 'string' &&
+                typeof entry !== 'boolean' &&
+                (typeof entry !== 'number' || !Number.isFinite(entry))) {
+                fail(`${pointer}/enum/${index}`, 'must be a JSON primitive');
+            }
+            return entry;
+        });
+        const serialized = values.map((entry) => JSON.stringify(entry));
+        if (new Set(serialized).size !== values.length) {
+            fail(`${pointer}/enum`, 'must not contain duplicate values');
+        }
+        result.enum = values.sort(compareJsonPrimitives);
+    }
+    if (input.format !== undefined) {
+        result.format = requireString(input.format, `${pointer}/format`, {
+            maxLength: 256,
+        });
+    }
+    if (input.pattern !== undefined) {
+        if (!options.allowCanonicalHeaderPattern ||
+            input.pattern !== exports.API_CONTRACT_HTTP_HEADER_VALUE_PATTERN) {
+            fail(`${pointer}/pattern`, 'is outside the supported compatibility profile', 'api-contract-schema-unsupported');
+        }
+        result.pattern = exports.API_CONTRACT_HTTP_HEADER_VALUE_PATTERN;
+    }
+    for (const member of [
+        'maxItems',
+        'maxLength',
+        'minItems',
+        'minLength',
+    ]) {
+        if (input[member] !== undefined) {
+            result[member] = requireInteger(input[member], `${pointer}/${member}`, 0, Number.MAX_SAFE_INTEGER);
+        }
+    }
+    for (const member of ['maximum', 'minimum']) {
+        if (input[member] !== undefined) {
+            result[member] = requireFiniteNumber(input[member], `${pointer}/${member}`);
+        }
+    }
+    if (result.minimum !== undefined &&
+        result.maximum !== undefined &&
+        result.minimum > result.maximum) {
+        fail(pointer, 'minimum must not exceed maximum');
+    }
+    if (result.minLength !== undefined &&
+        result.maxLength !== undefined &&
+        result.minLength > result.maxLength) {
+        fail(pointer, 'minLength must not exceed maxLength');
+    }
+    if (result.minItems !== undefined &&
+        result.maxItems !== undefined &&
+        result.minItems > result.maxItems) {
+        fail(pointer, 'minItems must not exceed maxItems');
+    }
+    if (input.items !== undefined) {
+        if (!types.has('array')) {
+            fail(`${pointer}/items`, 'requires the array type');
+        }
+        result.items = normalizeSchema(input.items, `${pointer}/items`, options);
+    }
+    if (input.oneOf !== undefined) {
+        if (!Array.isArray(input.oneOf) || input.oneOf.length < 2) {
+            fail(`${pointer}/oneOf`, 'must contain at least two schemas');
+        }
+        result.oneOf = input.oneOf
+            .map((entry, index) => normalizeSchema(entry, `${pointer}/oneOf/${index}`, options))
+            .sort((left, right) => compareStrings(JSON.stringify(left), JSON.stringify(right)));
+    }
+    if (input.properties !== undefined) {
+        if (!types.has('object')) {
+            fail(`${pointer}/properties`, 'requires the object type');
+        }
+        const properties = requireRecord(input.properties, `${pointer}/properties`);
+        const propertyNames = Reflect.ownKeys(properties).map((name) => {
+            if (typeof name !== 'string') {
+                fail(`${pointer}/properties/${ownKeyPointerToken(name)}`, 'must use a string property name');
+            }
+            return name;
+        });
+        result.properties = safeObjectFromEntries(propertyNames.sort(compareStrings).map((name) => {
+            requireString(name, `${pointer}/properties/${pointerToken(name)}`, {
+                pattern: SCHEMA_PROPERTY_PATTERN,
+            });
+            if (RESERVED_SCHEMA_PROPERTY_NAMES.has(name)) {
+                fail(`${pointer}/properties/${pointerToken(name)}`, 'uses a reserved object property name');
+            }
+            return [
+                name,
+                normalizeSchema(properties[name], `${pointer}/properties/${pointerToken(name)}`, options),
+            ];
+        }));
+    }
+    if (input.required !== undefined) {
+        if (!types.has('object')) {
+            fail(`${pointer}/required`, 'requires the object type');
+        }
+        const required = requireUniqueStrings(input.required, `${pointer}/required`, SCHEMA_PROPERTY_PATTERN);
+        const properties = new Set(Object.keys(result.properties ?? {}));
+        for (const member of required) {
+            if (!properties.has(member)) {
+                fail(`${pointer}/required`, `references undeclared property ${member}`);
+            }
+        }
+        result.required = required;
+    }
+    if (types.has('object') && result.additionalProperties === undefined) {
+        fail(`${pointer}/additionalProperties`, 'must explicitly declare object additional-property behavior');
+    }
+    if (result.const === undefined &&
+        result.oneOf === undefined &&
+        result.type === undefined) {
+        fail(pointer, 'must declare type, const, or oneOf in the supported profile');
+    }
+    return result;
+}
+function normalizeRequest(value, pointer) {
+    const input = requireRecord(value, pointer);
+    rejectUnknown(input, ['body', 'headers', 'maxBodyBytes', 'path', 'query'], pointer, ['body', 'headers', 'maxBodyBytes', 'path', 'query']);
+    const schemas = safeObjectFromEntries(['body', 'headers', 'path', 'query'].flatMap((member) => input[member] === undefined
+        ? []
+        : [
+            [
+                member,
+                normalizeSchema(input[member], `${pointer}/${member}`, {
+                    allowCanonicalHeaderPattern: member === 'headers',
+                }),
+            ],
+        ]));
+    return {
+        ...schemas,
+        ...(input.maxBodyBytes === undefined
+            ? {}
+            : {
+                maxBodyBytes: requireInteger(input.maxBodyBytes, `${pointer}/maxBodyBytes`, 1, 256 * 1024),
+            }),
+    };
+}
+function validateTransportRequestSchema(schema, pointer, options) {
+    if (!schema)
+        return;
+    if (schema.type !== 'object' ||
+        schema.additionalProperties !== false ||
+        !schema.properties) {
+        fail(pointer, 'must be a closed object schema');
+    }
+    for (const [name, property] of Object.entries(schema.properties)) {
+        const scalar = ['boolean', 'integer', 'number', 'string'].includes(String(property.type));
+        const repeatedScalar = options.arrays &&
+            property.type === 'array' &&
+            property.items !== undefined &&
+            ['boolean', 'integer', 'number', 'string'].includes(String(property.items.type));
+        if (!scalar && !repeatedScalar) {
+            fail(`${pointer}/properties/${pointerToken(name)}`, `must use a transport scalar${options.arrays ? ' or an array of transport scalars' : ''}`);
+        }
+        if (property.type === 'string' &&
+            options.canonicalHeaderStrings &&
+            (property.format !== exports.API_CONTRACT_HTTP_HEADER_VALUE_FORMAT ||
+                property.pattern !== exports.API_CONTRACT_HTTP_HEADER_VALUE_PATTERN ||
+                Object.keys(property).some((key) => !HTTP_HEADER_STRING_SCHEMA_KEYS.has(key)) ||
+                property.enum?.some((value) => typeof value !== 'string' || !isCanonicalHttpHeaderValue(value)) ||
+                !Number.isSafeInteger(property.minLength) ||
+                property.minLength < 1 ||
+                !Number.isSafeInteger(property.maxLength) ||
+                property.maxLength >
+                    exports.API_CONTRACT_HTTP_HEADER_VALUE_MAX_LENGTH)) {
+            fail(`${pointer}/properties/${pointerToken(name)}`, 'must use the canonical EBK HTTP-header string profile');
+        }
+        if (property.type === 'string' &&
+            options.nonEmptyStrings &&
+            !((Number.isSafeInteger(property.minLength) &&
+                property.minLength >= 1) ||
+                property.format === 'uuid' ||
+                (typeof property.const === 'string' && property.const.length > 0) ||
+                (Array.isArray(property.enum) &&
+                    property.enum.length > 0 &&
+                    property.enum.every((member) => typeof member === 'string' && member.length > 0)))) {
+            fail(`${pointer}/properties/${pointerToken(name)}`, 'must exclude an empty path string');
+        }
+        if (repeatedScalar &&
+            options.nonEmptyArrays &&
+            (!Number.isSafeInteger(property.minItems) ||
+                property.minItems < 1)) {
+            fail(`${pointer}/properties/${pointerToken(name)}/minItems`, 'must require at least one query-array item');
+        }
+    }
+}
+function schemaProperties(schema, pointer) {
+    if (!schema)
+        return undefined;
+    if (schema.type !== 'object' ||
+        schema.additionalProperties !== false ||
+        !schema.properties) {
+        fail(pointer, 'must be a closed object schema');
+    }
+    return schema.properties;
+}
+function sameStrings(left, right) {
+    return ([...left].sort(compareStrings).join('\u0000') ===
+        [...right].sort(compareStrings).join('\u0000'));
+}
+function validateCursorSchema(schema, pointer) {
+    if (schema?.type !== 'string' ||
+        !Number.isSafeInteger(schema.maxLength) ||
+        schema.maxLength < 1 ||
+        schema.maxLength > MAXIMUM_PAGINATION_CURSOR_LENGTH) {
+        fail(pointer, `must be a string schema with maxLength from 1 through ${MAXIMUM_PAGINATION_CURSOR_LENGTH}`);
+    }
+}
+function validatePaginationSchemas(pagination, request, response, pointer) {
+    const queryProperties = schemaProperties(request?.query, `${pointer}/request/query`);
+    if (!queryProperties) {
+        fail(`${pointer}/request/query`, 'is required for a paginated operation');
+    }
+    const cursorPointer = `${pointer}/request/query/properties/${pointerToken(pagination.cursorQueryParameter)}`;
+    validateCursorSchema(queryProperties[pagination.cursorQueryParameter], cursorPointer);
+    const cursorQuerySchema = queryProperties[pagination.cursorQueryParameter];
+    const limitPointer = `${pointer}/request/query/properties/${pointerToken(pagination.limitQueryParameter)}`;
+    const limitSchema = queryProperties[pagination.limitQueryParameter];
+    if (limitSchema?.type !== 'integer') {
+        fail(limitPointer, 'must be an integer schema');
+    }
+    if (limitSchema.minimum !== pagination.minimumLimit ||
+        limitSchema.maximum !== pagination.maximumLimit) {
+        fail(limitPointer, 'minimum and maximum must equal the pagination limit bounds');
+    }
+    const responseProperties = schemaProperties(response.body, `${pointer}/response/body`);
+    const responseCursorPointer = `${pointer}/response/body/properties/${pointerToken(pagination.cursorResponseField)}`;
+    const cursorResponseSchema = responseProperties?.[pagination.cursorResponseField];
+    validateCursorSchema(cursorResponseSchema, responseCursorPointer);
+    if (JSON.stringify(cursorQuerySchema) !== JSON.stringify(cursorResponseSchema)) {
+        fail(responseCursorPointer, 'must use the same bounded string schema as the request cursor');
+    }
+    const requestRequired = new Set(request?.query?.required ?? []);
+    if (requestRequired.has(pagination.cursorQueryParameter)) {
+        fail(cursorPointer, 'must be optional at the transport boundary');
+    }
+    if (requestRequired.has(pagination.limitQueryParameter)) {
+        fail(limitPointer, 'must be optional at the transport boundary');
+    }
+    if (new Set(response.body.required ?? []).has(pagination.cursorResponseField)) {
+        fail(responseCursorPointer, 'must be optional at the transport boundary');
+    }
+}
+function normalizeResponse(value, pointer) {
+    const input = requireRecord(value, pointer);
+    rejectUnknown(input, ['body', 'status'], pointer);
+    const status = requireInteger(input.status, `${pointer}/status`, 200, 299);
+    if (status === 204 || status === 205) {
+        fail(`${pointer}/status`, 'must declare a JSON-bearing success status other than 204 or 205');
+    }
+    return {
+        body: normalizeSchema(input.body, `${pointer}/body`),
+        status,
+    };
+}
+function normalizeProblems(value, pointer) {
+    if (!Array.isArray(value))
+        fail(pointer, 'must be an array');
+    const codes = new Set();
+    const types = new Set();
+    const problems = value.map((entry, index) => {
+        const itemPointer = `${pointer}/${index}`;
+        const input = requireRecord(entry, itemPointer);
+        rejectUnknown(input, ['code', 'details', 'message', 'retryable', 'status', 'type'], itemPointer, ['details']);
+        const code = requireString(input.code, `${itemPointer}/code`, {
+            pattern: PROBLEM_CODE_PATTERN,
+        });
+        if (FRAMEWORK_PROBLEM_CODES.has(code)) {
+            fail(`${itemPointer}/code`, 'is reserved by the framework');
+        }
+        const type = requireString(input.type, `${itemPointer}/type`);
+        if (containsAsciiControlOrSpace(type)) {
+            fail(`${itemPointer}/type`, 'must be an HTTPS problem type URL');
+        }
+        try {
+            const parsed = new URL(type);
+            if (parsed.protocol !== 'https:' ||
+                parsed.username !== '' ||
+                parsed.password !== '' ||
+                parsed.hash !== '') {
+                fail(`${itemPointer}/type`, 'must be an HTTPS problem type URL');
+            }
+        }
+        catch {
+            fail(`${itemPointer}/type`, 'must be an HTTPS problem type URL');
+        }
+        if (codes.has(code) || types.has(type)) {
+            fail(itemPointer, 'must not duplicate a problem code or type');
+        }
+        codes.add(code);
+        types.add(type);
+        if (typeof input.retryable !== 'boolean') {
+            fail(`${itemPointer}/retryable`, 'must be a boolean');
+        }
+        const details = input.details === undefined
+            ? undefined
+            : normalizeSchema(input.details, `${itemPointer}/details`);
+        if (details &&
+            (details.type !== 'object' || details.additionalProperties !== false)) {
+            fail(`${itemPointer}/details`, 'must be a closed object schema when declared');
+        }
+        return {
+            code,
+            ...(details === undefined ? {} : { details }),
+            message: requireString(input.message, `${itemPointer}/message`, {
+                maxLength: 256,
+            }),
+            retryable: input.retryable,
+            status: requireInteger(input.status, `${itemPointer}/status`, 400, 599),
+            type,
+        };
+    });
+    return problems.sort((left, right) => compareStrings(left.code, right.code));
+}
+function normalizeIdempotency(value, pointer) {
+    const input = requireRecord(value, pointer);
+    rejectUnknown(input, [
+        'concurrentDuplicate',
+        'keyHeader',
+        'maxKeyLength',
+        'mismatch',
+        'replay',
+        'required',
+        'requestFingerprint',
+        'retentionSeconds',
+        'scope',
+    ], pointer);
+    for (const [member, expected] of [
+        ['keyHeader', 'idempotency-key'],
+        ['mismatch', 'conflict'],
+        ['replay', 'same-response'],
+        ['requestFingerprint', 'canonical-json'],
+        ['scope', 'principal-operation'],
+    ]) {
+        if (input[member] !== expected) {
+            fail(`${pointer}/${member}`, `must equal ${expected}`);
+        }
+    }
+    if (!['conflict', 'wait'].includes(input.concurrentDuplicate)) {
+        fail(`${pointer}/concurrentDuplicate`, 'must equal conflict or wait');
+    }
+    if (typeof input.required !== 'boolean') {
+        fail(`${pointer}/required`, 'must be a boolean');
+    }
+    return {
+        concurrentDuplicate: input.concurrentDuplicate,
+        keyHeader: 'idempotency-key',
+        maxKeyLength: requireInteger(input.maxKeyLength, `${pointer}/maxKeyLength`, 1, 512),
+        mismatch: 'conflict',
+        replay: 'same-response',
+        required: input.required,
+        requestFingerprint: 'canonical-json',
+        retentionSeconds: requireInteger(input.retentionSeconds, `${pointer}/retentionSeconds`, 1, Number.MAX_SAFE_INTEGER),
+        scope: 'principal-operation',
+    };
+}
+function normalizePagination(value, pointer) {
+    const input = requireRecord(value, pointer);
+    rejectUnknown(input, [
+        'cursorQueryParameter',
+        'cursorResponseField',
+        'defaultLimit',
+        'expirySeconds',
+        'limitQueryParameter',
+        'maximumLimit',
+        'minimumLimit',
+        'stability',
+    ], pointer, ['expirySeconds']);
+    if (!['eventual', 'snapshot'].includes(input.stability)) {
+        fail(`${pointer}/stability`, 'must equal eventual or snapshot');
+    }
+    const cursorQueryParameter = requireString(input.cursorQueryParameter, `${pointer}/cursorQueryParameter`, { pattern: BOUNDED_TOKEN_PATTERN });
+    const limitQueryParameter = requireString(input.limitQueryParameter, `${pointer}/limitQueryParameter`, { pattern: BOUNDED_TOKEN_PATTERN });
+    if (cursorQueryParameter === limitQueryParameter) {
+        fail(`${pointer}/limitQueryParameter`, 'must differ from cursorQueryParameter');
+    }
+    const minimumLimit = requireInteger(input.minimumLimit, `${pointer}/minimumLimit`, 1, Number.MAX_SAFE_INTEGER);
+    const defaultLimit = requireInteger(input.defaultLimit, `${pointer}/defaultLimit`, 1, Number.MAX_SAFE_INTEGER);
+    const maximumLimit = requireInteger(input.maximumLimit, `${pointer}/maximumLimit`, 1, Number.MAX_SAFE_INTEGER);
+    if (minimumLimit > defaultLimit || defaultLimit > maximumLimit) {
+        fail(pointer, 'minimumLimit, defaultLimit, and maximumLimit must be ordered');
+    }
+    return {
+        cursorQueryParameter,
+        cursorResponseField: requireString(input.cursorResponseField, `${pointer}/cursorResponseField`, { pattern: BOUNDED_TOKEN_PATTERN }),
+        defaultLimit,
+        ...(input.expirySeconds === undefined
+            ? {}
+            : {
+                expirySeconds: requireInteger(input.expirySeconds, `${pointer}/expirySeconds`, 1, Number.MAX_SAFE_INTEGER),
+            }),
+        limitQueryParameter,
+        maximumLimit,
+        minimumLimit,
+        stability: input.stability,
+    };
+}
+function normalizeConditionalWrite(value, pointer) {
+    const input = requireRecord(value, pointer);
+    rejectUnknown(input, ['kind', 'requestHeader', 'required', 'responseHeader'], pointer);
+    if (input.kind !== 'etag')
+        fail(`${pointer}/kind`, 'must equal etag');
+    if (input.requestHeader !== 'if-match') {
+        fail(`${pointer}/requestHeader`, 'must equal if-match');
+    }
+    if (input.responseHeader !== 'etag') {
+        fail(`${pointer}/responseHeader`, 'must equal etag');
+    }
+    if (typeof input.required !== 'boolean') {
+        fail(`${pointer}/required`, 'must be a boolean');
+    }
+    return {
+        kind: 'etag',
+        requestHeader: 'if-match',
+        required: input.required,
+        responseHeader: 'etag',
+    };
+}
+function normalizeLifecycle(value, pointer) {
+    const input = requireRecord(value, pointer);
+    if (input.status === 'active') {
+        rejectUnknown(input, ['status'], pointer);
+        return { status: 'active' };
+    }
+    if (input.status !== 'deprecated') {
+        fail(`${pointer}/status`, 'must equal active or deprecated');
+    }
+    rejectUnknown(input, ['deprecation', 'status'], pointer);
+    const deprecation = requireRecord(input.deprecation, `${pointer}/deprecation`);
+    rejectUnknown(deprecation, [
+        'earliestRemovalDate',
+        'earliestRemovalVersion',
+        'evidence',
+        'firstDeprecatedVersion',
+        'knownConsumers',
+        'migration',
+        'owner',
+        'replacement',
+    ], `${pointer}/deprecation`, ['earliestRemovalDate', 'earliestRemovalVersion']);
+    const earliestRemovalDate = deprecation.earliestRemovalDate === undefined
+        ? undefined
+        : requireString(deprecation.earliestRemovalDate, `${pointer}/deprecation/earliestRemovalDate`, { pattern: /^\d{4}-\d{2}-\d{2}$/ });
+    if (earliestRemovalDate !== undefined &&
+        (!Number.isFinite(Date.parse(earliestRemovalDate)) ||
+            new Date(Date.parse(earliestRemovalDate)).toISOString().slice(0, 10) !==
+                earliestRemovalDate)) {
+        fail(`${pointer}/deprecation/earliestRemovalDate`, 'must be a valid YYYY-MM-DD date');
+    }
+    const earliestRemovalVersion = deprecation.earliestRemovalVersion === undefined
+        ? undefined
+        : requireString(deprecation.earliestRemovalVersion, `${pointer}/deprecation/earliestRemovalVersion`, { pattern: EXACT_SEMANTIC_VERSION_PATTERN });
+    if (earliestRemovalDate === undefined &&
+        earliestRemovalVersion === undefined) {
+        fail(`${pointer}/deprecation`, 'must declare earliestRemovalDate or earliestRemovalVersion');
+    }
+    const token = (member) => requireString(deprecation[member], `${pointer}/deprecation/${member}`, {
+        pattern: BOUNDED_TOKEN_PATTERN,
+    });
+    return {
+        deprecation: {
+            ...(earliestRemovalDate === undefined ? {} : { earliestRemovalDate }),
+            ...(earliestRemovalVersion === undefined
+                ? {}
+                : { earliestRemovalVersion }),
+            evidence: token('evidence'),
+            firstDeprecatedVersion: requireString(deprecation.firstDeprecatedVersion, `${pointer}/deprecation/firstDeprecatedVersion`, { pattern: EXACT_SEMANTIC_VERSION_PATTERN }),
+            knownConsumers: requireUniqueStrings(deprecation.knownConsumers, `${pointer}/deprecation/knownConsumers`, BOUNDED_TOKEN_PATTERN),
+            migration: token('migration'),
+            owner: token('owner'),
+            replacement: token('replacement'),
+        },
+        status: 'deprecated',
+    };
+}
+function normalizeOperation(value, pointer, slice) {
+    const input = requireRecord(value, pointer);
+    rejectUnknown(input, [
+        'authentication',
+        'authorizationActions',
+        'conditionalWrite',
+        'contractVersion',
+        'feature',
+        'idempotency',
+        'lifecycle',
+        'method',
+        'operationId',
+        'pagination',
+        'path',
+        'problems',
+        'request',
+        'response',
+        'responseProfile',
+        'slice',
+        'summary',
+    ], pointer, ['conditionalWrite', 'idempotency', 'pagination', 'request']);
+    if (!exports.API_CONTRACT_AUTHENTICATION_MODES.includes(input.authentication)) {
+        fail(`${pointer}/authentication`, `must equal one of ${exports.API_CONTRACT_AUTHENTICATION_MODES.join(', ')}`);
+    }
+    if (!exports.API_CONTRACT_HTTP_METHODS.includes(input.method)) {
+        fail(`${pointer}/method`, `must equal one of ${exports.API_CONTRACT_HTTP_METHODS.join(', ')}`);
+    }
+    const operationId = requireString(input.operationId, `${pointer}/operationId`, { pattern: OPERATION_ID_PATTERN });
+    if (!operationId.startsWith(`${slice}.`)) {
+        fail(`${pointer}/operationId`, 'must be scoped to the owning Slice');
+    }
+    const path = requireString(input.path, `${pointer}/path`, {
+        maxLength: 512,
+    });
+    if (!ROUTE_PATTERN.test(path)) {
+        fail(`${pointer}/path`, 'must be an absolute route template without query or fragment text');
+    }
+    if (path.split('/').some((segment) => segment === '.' || segment === '..')) {
+        fail(`${pointer}/path`, 'must not contain URL dot segments');
+    }
+    const contractVersion = requireString(input.contractVersion, `${pointer}/contractVersion`, { pattern: EXACT_SEMANTIC_VERSION_PATTERN });
+    if (input.responseProfile !== exports.API_CONTRACT_RESPONSE_PROFILE) {
+        fail(`${pointer}/responseProfile`, `must equal ${exports.API_CONTRACT_RESPONSE_PROFILE}`);
+    }
+    const operationSlice = requireString(input.slice, `${pointer}/slice`, {
+        pattern: SLICE_PATTERN,
+    });
+    if (operationSlice !== slice) {
+        fail(`${pointer}/slice`, 'must equal the containing baseline Slice');
+    }
+    const authorizationActions = requireUniqueStrings(input.authorizationActions, `${pointer}/authorizationActions`, ACTION_PATTERN);
+    if (authorizationActions.some((action) => !action.startsWith(`${slice}:`))) {
+        fail(`${pointer}/authorizationActions`, 'must contain only actions owned by the containing Slice');
+    }
+    if (input.authentication === 'anonymous' && authorizationActions.length > 0) {
+        fail(`${pointer}/authorizationActions`, 'must be empty for anonymous operations');
+    }
+    if (input.authentication !== 'anonymous' &&
+        authorizationActions.length === 0) {
+        fail(`${pointer}/authorizationActions`, 'must contain at least one Slice-owned action for protected operations');
+    }
+    if (input.idempotency !== undefined &&
+        !['POST', 'PATCH'].includes(input.method)) {
+        fail(`${pointer}/idempotency`, 'is valid only for POST or PATCH operations');
+    }
+    if (input.conditionalWrite !== undefined &&
+        !['DELETE', 'PATCH', 'PUT'].includes(input.method)) {
+        fail(`${pointer}/conditionalWrite`, 'is valid only for DELETE, PATCH, or PUT operations');
+    }
+    const request = input.request === undefined
+        ? undefined
+        : normalizeRequest(input.request, `${pointer}/request`);
+    validateTransportRequestSchema(request?.path, `${pointer}/request/path`, {
+        arrays: false,
+        nonEmptyStrings: true,
+    });
+    validateTransportRequestSchema(request?.query, `${pointer}/request/query`, {
+        arrays: true,
+        nonEmptyArrays: true,
+    });
+    validateTransportRequestSchema(request?.headers, `${pointer}/request/headers`, { arrays: false, canonicalHeaderStrings: true });
+    const routeParameters = [...path.matchAll(/\{([^}]+)\}/g)].map((match) => match[1] ?? '');
+    const pathProperties = Object.keys(request?.path?.properties ?? {});
+    if (!sameStrings(routeParameters, pathProperties) ||
+        !sameStrings(routeParameters, request?.path?.required ?? [])) {
+        fail(`${pointer}/request/path`, 'must declare every route template parameter as required');
+    }
+    for (const name of Object.keys(request?.headers?.properties ?? {})) {
+        if (name !== name.toLowerCase() ||
+            RESERVED_REQUEST_HEADERS.has(name.toLowerCase()) ||
+            name.toLowerCase().startsWith('x-amz-')) {
+            fail(`${pointer}/request/headers/properties/${pointerToken(name)}`, 'must be lowercase and must not replace a framework-owned header');
+        }
+    }
+    if (request?.maxBodyBytes !== undefined && request.body === undefined) {
+        fail(`${pointer}/request/maxBodyBytes`, 'is valid only when a request body schema exists');
+    }
+    if (input.method === 'GET' && request?.body !== undefined) {
+        fail(`${pointer}/request/body`, 'is not valid for GET operations');
+    }
+    const pagination = input.pagination === undefined
+        ? undefined
+        : normalizePagination(input.pagination, `${pointer}/pagination`);
+    const response = normalizeResponse(input.response, `${pointer}/response`);
+    if (pagination) {
+        validatePaginationSchemas(pagination, request, response, pointer);
+    }
+    return {
+        authentication: input.authentication,
+        authorizationActions,
+        ...(input.conditionalWrite === undefined
+            ? {}
+            : {
+                conditionalWrite: normalizeConditionalWrite(input.conditionalWrite, `${pointer}/conditionalWrite`),
+            }),
+        contractVersion,
+        feature: requireString(input.feature, `${pointer}/feature`, {
+            pattern: FEATURE_PATTERN,
+        }),
+        ...(input.idempotency === undefined
+            ? {}
+            : {
+                idempotency: normalizeIdempotency(input.idempotency, `${pointer}/idempotency`),
+            }),
+        lifecycle: normalizeLifecycle(input.lifecycle, `${pointer}/lifecycle`),
+        method: input.method,
+        operationId,
+        ...(pagination === undefined ? {} : { pagination }),
+        path,
+        problems: normalizeProblems(input.problems, `${pointer}/problems`),
+        ...(request === undefined ? {} : { request }),
+        response,
+        responseProfile: exports.API_CONTRACT_RESPONSE_PROFILE,
+        slice,
+        summary: requireString(input.summary, `${pointer}/summary`, {
+            maxLength: 256,
+        }),
+    };
+}
+function normalizeApiContractBaseline(value) {
+    const input = requireRecord(value, '');
+    rejectUnknown(input, ['kind', 'operations', 'schemaVersion', 'slice', 'title', 'version'], '');
+    if (input.kind !== exports.API_CONTRACT_BASELINE_KIND) {
+        fail('/kind', `must equal ${exports.API_CONTRACT_BASELINE_KIND}`);
+    }
+    if (input.schemaVersion !== exports.API_CONTRACT_BASELINE_SCHEMA_VERSION) {
+        fail('/schemaVersion', `must equal ${exports.API_CONTRACT_BASELINE_SCHEMA_VERSION}`);
+    }
+    const slice = requireString(input.slice, '/slice', {
+        pattern: SLICE_PATTERN,
+    });
+    const version = requireString(input.version, '/version', {
+        pattern: EXACT_SEMANTIC_VERSION_PATTERN,
+    });
+    const title = requireString(input.title, '/title');
+    if (!Array.isArray(input.operations) || input.operations.length === 0) {
+        fail('/operations', 'must contain at least one operation');
+    }
+    const operationIds = new Set();
+    const routes = new Set();
+    const operations = input.operations.map((operation, index) => {
+        const normalized = normalizeOperation(operation, `/operations/${index}`, slice);
+        if (normalized.contractVersion !== version) {
+            fail(`/operations/${index}/contractVersion`, 'must equal the containing baseline version');
+        }
+        const route = `${normalized.method}\0${normalized.path}`;
+        if (operationIds.has(normalized.operationId)) {
+            fail(`/operations/${index}/operationId`, 'must not be reused');
+        }
+        if (routes.has(route)) {
+            fail(`/operations/${index}/path`, 'must not duplicate a method and route template');
+        }
+        operationIds.add(normalized.operationId);
+        routes.add(route);
+        return normalized;
+    });
+    operations.sort((left, right) => compareStrings(left.operationId, right.operationId));
+    return {
+        kind: exports.API_CONTRACT_BASELINE_KIND,
+        operations,
+        schemaVersion: exports.API_CONTRACT_BASELINE_SCHEMA_VERSION,
+        slice,
+        title,
+        version,
+    };
+}
+/**
+ * Wraps a normalized runtime artifact in the persisted baseline envelope.
+ * This conversion is explicit so generating artifacts never silently updates
+ * the reviewed baseline.
+ */
+function createApiContractBaseline(normalized) {
+    const input = requireRecord(normalized, '');
+    if (input.kind !== undefined) {
+        return normalizeApiContractBaseline(input);
+    }
+    return normalizeApiContractBaseline({
+        ...input,
+        kind: exports.API_CONTRACT_BASELINE_KIND,
+    });
+}
+function canonicalApiContractBaselineJson(value) {
+    return `${JSON.stringify(normalizeApiContractBaseline(value), null, 2)}\n`;
+}
+function digestApiContractBaseline(value) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(canonicalApiContractBaselineJson(value), 'utf8')
+        .digest('hex');
+}
+//# sourceMappingURL=model.js.map