@fragno-dev/backoffice-api 0.0.0-stage → 0.0.0

package/LICENSE.md

@@ -0,0 +1,16 @@
+Copyright 2025 - present "ReJot Nederland B.V.", and individual contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the “Software”), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,91 @@
-# Temporary Holding Version
+# @fragno-dev/backoffice-api
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The contract for the Backoffice HTTP API: its operations, their zod input and output schemas, and an
+OpenAPI description generated from them. Backoffice implements this contract; other applications
+import it to call Backoffice with checked types.
+
+## Versions
+
+Each version is a separate module (`@fragno-dev/backoffice-api/v0`) served under `/api/<version>`.
+`v0` is unstable: its operations and schemas may change without a new version.
+
+Everything a version's requests and responses contain lives inside that version's directory, so a
+new version starts as a copy and the old one stays frozen:
+
+- `v0/<family>` (`@fragno-dev/backoffice-api/v0/organization`, …): one family's operations and the
+  records they use.
+- `v0/shared/<module>` (`@fragno-dev/backoffice-api/v0/shared/scope`, …): schemas used across
+  families, such as scopes, permissions, timestamps, and page inputs.
+
+`api`, `errors`, and `openapi` are version-independent: how any version is defined, how errors are
+reported, and how a version is described as OpenAPI.
+
+## Lazy schemas
+
+Every module-level schema except an operation's `z.void()` is a `z.lazy(() => …)`, so importing the
+contract builds no schemas until they are used. Backoffice imports it on every Durable Object
+activation, and a request uses only a few of its schemas. Parse, infer, describe, and convert them
+like any schema. For object- or enum-specific members such as `.extend`, `.shape`, `.pick`, or
+`.options`, use the built schema, `schema._zod.innerType`, which is built once and shared;
+`unwrap()` builds a new copy on every call. Keep a schema lazy when you derive from it at module
+level: `z.lazy(() => schema._zod.innerType.extend({ … }))`. Put a schema's `.meta({ id })` on the
+lazy, not inside it, so references to the schema resolve to that id.
+
+## Calling an operation
+
+Every operation is `POST /api/<version>/scopes/<scope>/<operationId>` with a bearer token and the
+operation's input as the JSON body. Operations whose input is `z.void()` take no body. The scope is
+`system`, `user:<userId>`, `org:<orgId>`, `app:<owner>:<appId>`, or `project:<owner>:<projectId>`,
+with each id URI-encoded. An app's `<owner>` is the organization or user scope that installed it; a
+project's may also be an app scope, e.g. `project:app:org:<orgId>:<appId>:<projectId>`. Owning a
+scope does not reach into owned apps: an organization's credential cannot act in its apps'
+workspaces, and an event emitted in an app's workspace only reaches that workspace's routes. An
+operation that is not available to the credential in that scope, such as an organization operation
+in a project scope, answers `404`. Each operation lists the permissions it requires in the request's
+scope (`permissions`, from `v0/shared/permissions`); the OpenAPI document repeats them as the roles
+of the operation's `bearer` security requirement. A credential lacking one answers `403`.
+
+Successful calls return `200` with the operation's output, or `204` when the output is `z.void()`.
+Bytes travel as standard base64 strings (`v0/shared/bytes`). This is temporary: dedicated file
+transfer APIs will replace it for large files. Errors return `{ error: { code, message } }`
+(`@fragno-dev/backoffice-api/errors`), where the code determines the status: `invalid_request` 400,
+`authentication_failed` 401, `forbidden` 403, `not_found` 404, `conflict` 409, and
+`operation_failed` 422. `not_found` also covers things the request names, such as an unknown id, and
+`operation_failed` is reserved for failures no other code describes.
+
+## Client
+
+```ts
+import { createBackofficeApiClient } from "@fragno-dev/backoffice-api/v0/client";
+
+const backoffice = createBackofficeApiClient({
+  origin: "https://backoffice.example",
+  accessToken,
+  fetch,
+});
+const receipt = await backoffice.call({ kind: "org", orgId }, "events.fire", {
+  eventType: "bookkeeping.connection.tested",
+  payload: { message: "Hello" },
+});
+```
+
+`call` checks the operation id and input at compile time and parses the output with the operation's
+schema. Error responses reject with `BackofficeApiRequestError`, whose `code` is the error
+envelope's code, or `null` when the response was not an API error (for example a server failure), so
+the outcome is unknown. Network failures reject with `BackofficeApiUnreachableError`, whose outcome
+is also unknown. Anything else, such as a success body that does not match the client's contract, is
+a bug and rejects unchanged.
+
+## OpenAPI
+
+```ts
+import { createOpenApiDocument } from "@fragno-dev/backoffice-api/openapi";
+import { backofficeApiV0 } from "@fragno-dev/backoffice-api/v0";
+
+const document = createOpenApiDocument(backofficeApiV0, {
+  serverUrl: "https://backoffice.example",
+});
+```
+
+`zod` is a peer dependency: schemas share one zod instance with your application so `.meta({ id })`
+names resolve consistently.

package/dist/api.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+//#region src/api.d.ts
+/** A permission named by its namespace, e.g. `{ namespace: "events", permission: "emit" }`. */
+type BackofficeApiPermission = {
+  readonly namespace: string;
+  readonly permission: string;
+};
+/**
+ * One callable operation. Its id is its key in the API's operation map. The caller names the scope
+ * it runs in in the request path; Backoffice decides per request whether the operation is
+ * available there for the credential, and requires every listed permission in that scope. Input
+ * and output are validated by the server; a `z.void()` input means the request has no body, and a
+ * `z.void()` output means the response has none.
+ */
+type BackofficeApiOperation<TInput extends z.ZodType = z.ZodType, TOutput extends z.ZodType = z.ZodType> = {
+  description: string;
+  permissions: readonly BackofficeApiPermission[];
+  input: TInput;
+  output: TOutput;
+};
+/** The first sentence of an operation's description: a one-line answer to what it does. */
+declare function backofficeApiOperationSummary(operation: BackofficeApiOperation): string;
+/** One version of the API, served under `/api/<version>`. */
+type BackofficeApi<TOperations extends Record<string, BackofficeApiOperation> = Record<string, BackofficeApiOperation>> = {
+  version: `v${number}`;
+  operations: TOperations;
+};
+/**
+ * A server's handler for every operation of an API version. Handlers receive input already
+ * validated by the operation and return a value its output schema accepts.
+ */
+type BackofficeApiImplementation<TApi extends BackofficeApi, TContext> = { [TId in keyof TApi["operations"]]: (input: z.output<TApi["operations"][TId]["input"]>, context: TContext) => Promise<z.input<TApi["operations"][TId]["output"]>>; };
+//#endregion
+export { BackofficeApi, BackofficeApiImplementation, BackofficeApiOperation, BackofficeApiPermission, backofficeApiOperationSummary };
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","names":[],"sources":["../src/api.ts"],"mappings":";;;KAGY;WAAqC;WAA4B;;;;;;;;;KASjE,uBACV,eAAe,EAAE,UAAU,EAAE,SAC7B,gBAAgB,EAAE,UAAU,EAAE;EAE9B;EACA,sBAAsB;EACtB,OAAO;EACP,QAAQ;;;iBAIM,8BAA8B,WAAW;;KAM7C,cACV,oBAAoB,eAAe,0BAA0B,eAE3D;EAGF;EACA,YAAY;;;;;;KAOF,4BAA4B,aAAa,eAAe,eACjE,aAAa,sBACZ,OAAO,EAAE,OAAO,mBAAmB,gBACnC,SAAS,aACN,QAAQ,EAAE,MAAM,mBAAmB"}

package/dist/api.js

@@ -0,0 +1,10 @@
+//#region src/api.ts
+/** The first sentence of an operation's description: a one-line answer to what it does. */
+function backofficeApiOperationSummary(operation) {
+	const [summary = operation.description] = operation.description.split(/(?<=\.)\s+(?=[A-Z])/u, 1);
+	return summary;
+}
+//#endregion
+export { backofficeApiOperationSummary };
+
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","names":[],"sources":["../src/api.ts"],"sourcesContent":["import type { z } from \"zod\";\n\n/** A permission named by its namespace, e.g. `{ namespace: \"events\", permission: \"emit\" }`. */\nexport type BackofficeApiPermission = { readonly namespace: string; readonly permission: string };\n\n/**\n * One callable operation. Its id is its key in the API's operation map. The caller names the scope\n * it runs in in the request path; Backoffice decides per request whether the operation is\n * available there for the credential, and requires every listed permission in that scope. Input\n * and output are validated by the server; a `z.void()` input means the request has no body, and a\n * `z.void()` output means the response has none.\n */\nexport type BackofficeApiOperation<\n  TInput extends z.ZodType = z.ZodType,\n  TOutput extends z.ZodType = z.ZodType,\n> = {\n  description: string;\n  permissions: readonly BackofficeApiPermission[];\n  input: TInput;\n  output: TOutput;\n};\n\n/** The first sentence of an operation's description: a one-line answer to what it does. */\nexport function backofficeApiOperationSummary(operation: BackofficeApiOperation): string {\n  const [summary = operation.description] = operation.description.split(/(?<=\\.)\\s+(?=[A-Z])/u, 1);\n  return summary;\n}\n\n/** One version of the API, served under `/api/<version>`. */\nexport type BackofficeApi<\n  TOperations extends Record<string, BackofficeApiOperation> = Record<\n    string,\n    BackofficeApiOperation\n  >,\n> = {\n  version: `v${number}`;\n  operations: TOperations;\n};\n\n/**\n * A server's handler for every operation of an API version. Handlers receive input already\n * validated by the operation and return a value its output schema accepts.\n */\nexport type BackofficeApiImplementation<TApi extends BackofficeApi, TContext> = {\n  [TId in keyof TApi[\"operations\"]]: (\n    input: z.output<TApi[\"operations\"][TId][\"input\"]>,\n    context: TContext,\n  ) => Promise<z.input<TApi[\"operations\"][TId][\"output\"]>>;\n};\n"],"mappings":";;AAuBA,SAAgB,8BAA8B,WAA2C;CACvF,MAAM,CAAC,UAAU,UAAU,eAAe,UAAU,YAAY,MAAM,wBAAwB,CAAC;CAC/F,OAAO;AACT"}

package/dist/errors.d.ts

@@ -0,0 +1,45 @@
+import { z } from "zod";
+//#region src/errors.d.ts
+declare const backofficeApiErrorCodeSchema: z.ZodLazy<z.ZodEnum<{
+  authentication_failed: "authentication_failed";
+  invalid_request: "invalid_request";
+  forbidden: "forbidden";
+  not_found: "not_found";
+  conflict: "conflict";
+  operation_failed: "operation_failed";
+}>>;
+type BackofficeApiErrorCode = z.output<typeof backofficeApiErrorCodeSchema>;
+/** Every error response carries this body; the status follows from the code alone. */
+declare const backofficeApiErrorSchema: z.ZodLazy<z.ZodObject<{
+  error: z.ZodObject<{
+    code: z.ZodLazy<z.ZodEnum<{
+      authentication_failed: "authentication_failed";
+      invalid_request: "invalid_request";
+      forbidden: "forbidden";
+      not_found: "not_found";
+      conflict: "conflict";
+      operation_failed: "operation_failed";
+    }>>;
+    message: z.ZodString;
+  }, z.core.$strict>;
+}, z.core.$strict>>;
+type BackofficeApiError = z.output<typeof backofficeApiErrorSchema>;
+declare const BACKOFFICE_API_ERROR_STATUS: {
+  readonly invalid_request: 400;
+  readonly authentication_failed: 401;
+  readonly forbidden: 403;
+  readonly not_found: 404;
+  readonly conflict: 409;
+  readonly operation_failed: 422;
+};
+declare const BACKOFFICE_API_ERROR_DESCRIPTIONS: {
+  readonly invalid_request: "The scope or the request body is invalid, including values a domain rule rejects.";
+  readonly authentication_failed: "The bearer credential is missing, invalid, or expired.";
+  readonly forbidden: "The credential may not perform this operation in this scope.";
+  readonly not_found: "The operation or something the request names does not exist, or is not available to the credential in this scope.";
+  readonly conflict: "The request conflicts with the current state, e.g. something with that name already exists.";
+  readonly operation_failed: "The operation ran and failed for a reason no other code describes.";
+};
+//#endregion
+export { BACKOFFICE_API_ERROR_DESCRIPTIONS, BACKOFFICE_API_ERROR_STATUS, BackofficeApiError, BackofficeApiErrorCode, backofficeApiErrorSchema };
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","names":[],"sources":["../src/errors.ts"],"mappings":";;cAEM,8BAA4B,EAAA,QAAA,EAAA;;;;;;;;KAUtB,yBAAyB,EAAE,cAAc;;cAGxC,0BAAwB,EAAA,QAAA,EAAA;;;;;;;;;;;;;KAUzB,qBAAqB,EAAE,cAAc;cAEpC;;;;;;;;cAUA"}

package/dist/errors.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+//#region src/errors.ts
+const backofficeApiErrorCodeSchema = z.lazy(() => z.enum([
+	"invalid_request",
+	"authentication_failed",
+	"forbidden",
+	"not_found",
+	"conflict",
+	"operation_failed"
+]));
+/** Every error response carries this body; the status follows from the code alone. */
+const backofficeApiErrorSchema = z.lazy(() => z.strictObject({ error: z.strictObject({
+	code: backofficeApiErrorCodeSchema,
+	message: z.string()
+}) })).meta({ id: "BackofficeApiError" });
+const BACKOFFICE_API_ERROR_STATUS = {
+	invalid_request: 400,
+	authentication_failed: 401,
+	forbidden: 403,
+	not_found: 404,
+	conflict: 409,
+	operation_failed: 422
+};
+const BACKOFFICE_API_ERROR_DESCRIPTIONS = {
+	invalid_request: "The scope or the request body is invalid, including values a domain rule rejects.",
+	authentication_failed: "The bearer credential is missing, invalid, or expired.",
+	forbidden: "The credential may not perform this operation in this scope.",
+	not_found: "The operation or something the request names does not exist, or is not available to the credential in this scope.",
+	conflict: "The request conflicts with the current state, e.g. something with that name already exists.",
+	operation_failed: "The operation ran and failed for a reason no other code describes."
+};
+//#endregion
+export { BACKOFFICE_API_ERROR_DESCRIPTIONS, BACKOFFICE_API_ERROR_STATUS, backofficeApiErrorSchema };
+
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["import { z } from \"zod\";\n\nconst backofficeApiErrorCodeSchema = z.lazy(() =>\n  z.enum([\n    \"invalid_request\",\n    \"authentication_failed\",\n    \"forbidden\",\n    \"not_found\",\n    \"conflict\",\n    \"operation_failed\",\n  ]),\n);\nexport type BackofficeApiErrorCode = z.output<typeof backofficeApiErrorCodeSchema>;\n\n/** Every error response carries this body; the status follows from the code alone. */\nexport const backofficeApiErrorSchema = z\n  .lazy(() =>\n    z.strictObject({\n      error: z.strictObject({\n        code: backofficeApiErrorCodeSchema,\n        message: z.string(),\n      }),\n    }),\n  )\n  .meta({ id: \"BackofficeApiError\" });\nexport type BackofficeApiError = z.output<typeof backofficeApiErrorSchema>;\n\nexport const BACKOFFICE_API_ERROR_STATUS = {\n  invalid_request: 400,\n  authentication_failed: 401,\n  forbidden: 403,\n  not_found: 404,\n  conflict: 409,\n  // The operation ran and failed for a reason no other code describes.\n  operation_failed: 422,\n} as const satisfies Record<BackofficeApiErrorCode, number>;\n\nexport const BACKOFFICE_API_ERROR_DESCRIPTIONS = {\n  invalid_request:\n    \"The scope or the request body is invalid, including values a domain rule rejects.\",\n  authentication_failed: \"The bearer credential is missing, invalid, or expired.\",\n  forbidden: \"The credential may not perform this operation in this scope.\",\n  not_found:\n    \"The operation or something the request names does not exist, or is not available to the credential in this scope.\",\n  conflict:\n    \"The request conflicts with the current state, e.g. something with that name already exists.\",\n  operation_failed: \"The operation ran and failed for a reason no other code describes.\",\n} as const satisfies Record<BackofficeApiErrorCode, string>;\n"],"mappings":";;AAEA,MAAM,+BAA+B,EAAE,WACrC,EAAE,KAAK;CACL;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CACH;;AAIA,MAAa,2BAA2B,EACrC,WACC,EAAE,aAAa,EACb,OAAO,EAAE,aAAa;CACpB,MAAM;CACN,SAAS,EAAE,OAAO;AACpB,CAAC,EACH,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAGpC,MAAa,8BAA8B;CACzC,iBAAiB;CACjB,uBAAuB;CACvB,WAAW;CACX,WAAW;CACX,UAAU;CAEV,kBAAkB;AACpB;AAEA,MAAa,oCAAoC;CAC/C,iBACE;CACF,uBAAuB;CACvB,WAAW;CACX,WACE;CACF,UACE;CACF,kBAAkB;AACpB"}

package/dist/openapi.d.ts

@@ -0,0 +1,46 @@
+import { BackofficeApi } from "./api.js";
+//#region src/openapi.d.ts
+type JsonSchema = {
+  [key: string]: unknown;
+};
+type OpenApiDocument = {
+  openapi: "3.1.0";
+  info: {
+    title: string;
+    version: string;
+    license: {
+      name: string;
+      identifier: string;
+    };
+  };
+  servers: {
+    url: string;
+  }[];
+  security: {
+    bearer: [];
+  }[];
+  paths: Record<string, {
+    post: JsonSchema;
+  }>;
+  components: {
+    schemas: Record<string, JsonSchema>;
+    securitySchemes: {
+      bearer: JsonSchema;
+    };
+  };
+};
+/**
+ * Describes an API version as OpenAPI 3.1. Every operation is `POST
+ * /api/<version>/scopes/{scope}/<operationId>` with its input as the JSON body. Void inputs take no
+ * body and void outputs answer `204`; every error response carries `BackofficeApiError`.
+ *
+ * Schemas with a zod `.meta({ id })` become shared components. A schema whose request form differs
+ * from its response form (defaults, transforms) gets a separate `<id>Input` component, but only
+ * when both forms are used.
+ */
+declare function createOpenApiDocument(api: BackofficeApi, { serverUrl }: {
+  serverUrl: string;
+}): OpenApiDocument;
+//#endregion
+export { OpenApiDocument, createOpenApiDocument };
+//# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","names":[],"sources":["../src/openapi.ts"],"mappings":";;KAaK;GAAgB;;KAGT;EACV;EACA;IAAQ;IAAe;IAAiB;MAAW;MAAc;;;EACjE;IAAW;;EACX;IAAY;;EACZ,OAAO;IAAiB,MAAM;;EAC9B;IACE,SAAS,eAAe;IACxB;MAAmB,QAAQ;;;;;;;;;;;;;iBAiCf,sBACd,KAAK,iBACH;EAAe;IAChB"}

package/dist/openapi.js

@@ -0,0 +1,205 @@
+import { backofficeApiOperationSummary } from "./api.js";
+import { BACKOFFICE_API_ERROR_DESCRIPTIONS, BACKOFFICE_API_ERROR_STATUS, backofficeApiErrorSchema } from "./errors.js";
+import { z } from "zod";
+//#region src/openapi.ts
+const SCOPE_ID_PATTERN = "[^:/]+";
+const ROOT_OWNER_PATTERN = `(?:org|user):${SCOPE_ID_PATTERN}`;
+const APP_SCOPE_PATTERN = `app:${ROOT_OWNER_PATTERN}:${SCOPE_ID_PATTERN}`;
+const SCOPE_PARAMETER = {
+	name: "scope",
+	in: "path",
+	required: true,
+	description: "Where the operation runs: `system`, `user:<userId>`, `org:<orgId>`, `app:<owner>:<appId>`, or `project:<owner>:<projectId>`. App and project scopes name their owning scope, e.g. `app:org:<orgId>:<appId>` or `project:app:user:<userId>:<appId>:<projectId>`. Operations that are not available to the credential in this scope answer `404`.",
+	schema: {
+		type: "string",
+		pattern: `^(?:system|${ROOT_OWNER_PATTERN}|${APP_SCOPE_PATTERN}|${`project:(?:${ROOT_OWNER_PATTERN}|${APP_SCOPE_PATTERN}):${SCOPE_ID_PATTERN}`})$`
+	}
+};
+const DEFINITION_REF_PREFIX = "#/$defs/";
+/**
+* Describes an API version as OpenAPI 3.1. Every operation is `POST
+* /api/<version>/scopes/{scope}/<operationId>` with its input as the JSON body. Void inputs take no
+* body and void outputs answer `204`; every error response carries `BackofficeApiError`.
+*
+* Schemas with a zod `.meta({ id })` become shared components. A schema whose request form differs
+* from its response form (defaults, transforms) gets a separate `<id>Input` component, but only
+* when both forms are used.
+*/
+function createOpenApiDocument(api, { serverUrl }) {
+	const definitions = {
+		input: /* @__PURE__ */ new Map(),
+		output: /* @__PURE__ */ new Map()
+	};
+	function convert(schema, io, conversionName) {
+		const { $defs, $schema: _dialect, ...root } = z.toJSONSchema(schema, {
+			io,
+			target: "draft-2020-12",
+			unrepresentable: "throw",
+			override: ({ jsonSchema }) => {
+				delete jsonSchema["codemodeInputId"];
+				delete jsonSchema["codemodeType"];
+			}
+		});
+		const { root: localizedRoot, definitions: localizedDefinitions } = localizeAnonymousDefinitions(root, $defs ?? {}, conversionName);
+		for (const [id, definition] of Object.entries(localizedDefinitions)) {
+			const existing = definitions[io].get(id);
+			if (existing && JSON.stringify(existing) !== JSON.stringify(simplifyCompositions(definition))) throw new Error(`Two different schemas use the OpenAPI component id '${id}'.`);
+			definitions[io].set(id, simplifyCompositions(definition));
+		}
+		return simplifyCompositions(localizedRoot);
+	}
+	const operations = Object.entries(api.operations).map(([operationId, operation]) => ({
+		operationId,
+		operation,
+		input: operation.input.def.type === "void" ? null : convert(operation.input, "input", `${operationId}.input`),
+		output: operation.output.def.type === "void" ? null : convert(operation.output, "output", `${operationId}.output`)
+	}));
+	const errorSchema = convert(backofficeApiErrorSchema, "output", "error");
+	const inputFormDiffers = /* @__PURE__ */ new Map();
+	function hasSeparateInputComponent(id) {
+		const known = inputFormDiffers.get(id);
+		if (known !== void 0) return known;
+		const input = definitions.input.get(id);
+		const output = definitions.output.get(id);
+		if (!input || !output) return false;
+		inputFormDiffers.set(id, false);
+		const differs = JSON.stringify(input) !== JSON.stringify(output) || referencedDefinitionIds(input).some(hasSeparateInputComponent);
+		inputFormDiffers.set(id, differs);
+		return differs;
+	}
+	function componentName(id, io) {
+		return io === "input" && hasSeparateInputComponent(id) ? `${id}Input` : id;
+	}
+	function toComponentRefs(schema, io) {
+		return JSON.parse(JSON.stringify(schema), (key, value) => key === "$ref" && typeof value === "string" && value.startsWith(DEFINITION_REF_PREFIX) ? `#/components/schemas/${componentName(value.slice(8), io)}` : value);
+	}
+	const schemas = {};
+	for (const io of ["output", "input"]) for (const [id, definition] of definitions[io]) schemas[componentName(id, io)] = toComponentRefs(definition, io);
+	const errorResponses = Object.fromEntries(Object.entries(BACKOFFICE_API_ERROR_STATUS).map(([code, status]) => [String(status), {
+		description: BACKOFFICE_API_ERROR_DESCRIPTIONS[code],
+		content: { "application/json": { schema: toComponentRefs(errorSchema, "output") } }
+	}]));
+	const paths = {};
+	for (const { operationId, operation, input, output } of operations) paths[`/api/${api.version}/scopes/{scope}/${operationId}`] = { post: {
+		operationId,
+		...summarize(operation),
+		tags: [operationId.split(".")[0]],
+		security: [{ bearer: operation.permissions.map(({ namespace, permission }) => `${namespace}.${permission}`) }],
+		parameters: [SCOPE_PARAMETER],
+		...input && { requestBody: {
+			required: true,
+			content: { "application/json": { schema: toComponentRefs(input, "input") } }
+		} },
+		responses: {
+			...output ? { "200": {
+				description: "The operation's result.",
+				content: { "application/json": { schema: toComponentRefs(output, "output") } }
+			} } : { "204": { description: "The operation succeeded." } },
+			...errorResponses
+		}
+	} };
+	return {
+		openapi: "3.1.0",
+		info: {
+			title: "Backoffice API",
+			version: api.version,
+			license: {
+				name: "MIT",
+				identifier: "MIT"
+			}
+		},
+		servers: [{ url: serverUrl }],
+		security: [{ bearer: [] }],
+		paths,
+		components: {
+			schemas,
+			securitySchemes: { bearer: {
+				type: "http",
+				scheme: "bearer",
+				bearerFormat: "JWT"
+			} }
+		}
+	};
+}
+/** The description repeats the summary only when there is more to say. */
+function summarize(operation) {
+	const summary = backofficeApiOperationSummary(operation);
+	return summary === operation.description ? { summary } : {
+		summary,
+		description: operation.description
+	};
+}
+/**
+* zod writes `z.unknown().nullable()` as `anyOf: [{}, { type: "null" }]` and a one-member union as a
+* one-element `oneOf`. Both are valid but illogical: an empty member already matches anything, and
+* a single member is the schema itself.
+*/
+function simplifyCompositions(schema) {
+	const simplify = (value) => {
+		if (Array.isArray(value)) return value.map(simplify);
+		if (value === null || typeof value !== "object") return value;
+		const node = Object.fromEntries(Object.entries(value).map(([key, child]) => [key, simplify(child)]));
+		for (const keyword of ["anyOf", "oneOf"]) {
+			const members = node[keyword];
+			if (!Array.isArray(members)) continue;
+			const { [keyword]: _members, ...rest } = node;
+			if (members.some((member) => isEmptySchema(member))) return rest;
+			const [only] = members;
+			if (members.length === 1 && only && Object.keys(only).every((key) => !(key in rest))) return {
+				...rest,
+				...only
+			};
+		}
+		return node;
+	};
+	return simplify(schema);
+}
+function isEmptySchema(schema) {
+	return schema !== null && typeof schema === "object" && !Array.isArray(schema) && Object.keys(schema).length === 0;
+}
+function referencedDefinitionIds(schema) {
+	const ids = [];
+	JSON.stringify(schema, (key, value) => {
+		if (key === "$ref" && typeof value === "string" && value.startsWith(DEFINITION_REF_PREFIX)) ids.push(value.slice(8));
+		return value;
+	});
+	return ids;
+}
+const ANONYMOUS_DEFINITION = /^__schema\d+$/;
+/**
+* zod names definitions it cannot identify `__schema<n>`, separately in every conversion, and
+* represents a described or re-annotated copy of a recursive schema as an alias of one. Aliases
+* collapse into their named component; other anonymous definitions get a per-conversion name so
+* conversions cannot collide.
+*/
+function localizeAnonymousDefinitions(root, definitions, conversionName) {
+	const renames = /* @__PURE__ */ new Map();
+	for (const [id, definition] of Object.entries(definitions)) {
+		const target = aliasTarget(definition);
+		if (!ANONYMOUS_DEFINITION.test(id) && target && ANONYMOUS_DEFINITION.test(target)) renames.set(target, id);
+	}
+	for (const id of Object.keys(definitions)) if (ANONYMOUS_DEFINITION.test(id) && !renames.has(id)) renames.set(id, `${conversionName}.${id.slice(2)}`);
+	const rename = (schema) => JSON.parse(JSON.stringify(schema), (key, value) => {
+		if (key !== "$ref" || typeof value !== "string" || !value.startsWith(DEFINITION_REF_PREFIX)) return value;
+		const id = value.slice(8);
+		return `${DEFINITION_REF_PREFIX}${renames.get(id) ?? id}`;
+	});
+	const localized = {};
+	for (const [id, definition] of Object.entries(definitions)) {
+		const target = aliasTarget(definition);
+		if (target && renames.get(target) === id) continue;
+		localized[renames.get(id) ?? id] = rename(definition);
+	}
+	return {
+		root: rename(root),
+		definitions: localized
+	};
+}
+function aliasTarget(definition) {
+	const ref = definition["$ref"];
+	return Object.keys(definition).length === 1 && typeof ref === "string" && ref.startsWith(DEFINITION_REF_PREFIX) ? ref.slice(8) : null;
+}
+//#endregion
+export { createOpenApiDocument };
+
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","names":[],"sources":["../src/openapi.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport {\n  type BackofficeApi,\n  type BackofficeApiOperation,\n  backofficeApiOperationSummary,\n} from \"./api\";\nimport {\n  BACKOFFICE_API_ERROR_DESCRIPTIONS,\n  BACKOFFICE_API_ERROR_STATUS,\n  backofficeApiErrorSchema,\n} from \"./errors\";\n\ntype JsonSchema = { [key: string]: unknown };\ntype SchemaIo = \"input\" | \"output\";\n\nexport type OpenApiDocument = {\n  openapi: \"3.1.0\";\n  info: { title: string; version: string; license: { name: string; identifier: string } };\n  servers: { url: string }[];\n  security: { bearer: [] }[];\n  paths: Record<string, { post: JsonSchema }>;\n  components: {\n    schemas: Record<string, JsonSchema>;\n    securitySchemes: { bearer: JsonSchema };\n  };\n};\n\n// Scope ids are URI-encoded inside the segment, so `:` only separates components.\nconst SCOPE_ID_PATTERN = \"[^:/]+\";\nconst ROOT_OWNER_PATTERN = `(?:org|user):${SCOPE_ID_PATTERN}`;\nconst APP_SCOPE_PATTERN = `app:${ROOT_OWNER_PATTERN}:${SCOPE_ID_PATTERN}`;\nconst PROJECT_SCOPE_PATTERN = `project:(?:${ROOT_OWNER_PATTERN}|${APP_SCOPE_PATTERN}):${SCOPE_ID_PATTERN}`;\n\nconst SCOPE_PARAMETER = {\n  name: \"scope\",\n  in: \"path\",\n  required: true,\n  description:\n    \"Where the operation runs: `system`, `user:<userId>`, `org:<orgId>`, `app:<owner>:<appId>`, or `project:<owner>:<projectId>`. App and project scopes name their owning scope, e.g. `app:org:<orgId>:<appId>` or `project:app:user:<userId>:<appId>:<projectId>`. Operations that are not available to the credential in this scope answer `404`.\",\n  schema: {\n    type: \"string\",\n    pattern: `^(?:system|${ROOT_OWNER_PATTERN}|${APP_SCOPE_PATTERN}|${PROJECT_SCOPE_PATTERN})$`,\n  },\n};\n\nconst DEFINITION_REF_PREFIX = \"#/$defs/\";\n\n/**\n * Describes an API version as OpenAPI 3.1. Every operation is `POST\n * /api/<version>/scopes/{scope}/<operationId>` with its input as the JSON body. Void inputs take no\n * body and void outputs answer `204`; every error response carries `BackofficeApiError`.\n *\n * Schemas with a zod `.meta({ id })` become shared components. A schema whose request form differs\n * from its response form (defaults, transforms) gets a separate `<id>Input` component, but only\n * when both forms are used.\n */\nexport function createOpenApiDocument(\n  api: BackofficeApi,\n  { serverUrl }: { serverUrl: string },\n): OpenApiDocument {\n  const definitions: Record<SchemaIo, Map<string, JsonSchema>> = {\n    input: new Map(),\n    output: new Map(),\n  };\n\n  function convert(schema: z.ZodType, io: SchemaIo, conversionName: string): JsonSchema {\n    const {\n      $defs,\n      $schema: _dialect,\n      ...root\n    } = z.toJSONSchema(schema, {\n      io,\n      target: \"draft-2020-12\",\n      unrepresentable: \"throw\",\n      // zod copies every `.meta()` field; Codemode's type-name hints are not JSON Schema.\n      override: ({ jsonSchema }) => {\n        delete jsonSchema[\"codemodeInputId\"];\n        delete jsonSchema[\"codemodeType\"];\n      },\n    });\n    const { root: localizedRoot, definitions: localizedDefinitions } = localizeAnonymousDefinitions(\n      root,\n      ($defs ?? {}) as Record<string, JsonSchema>,\n      conversionName,\n    );\n    for (const [id, definition] of Object.entries(localizedDefinitions)) {\n      const existing = definitions[io].get(id);\n      if (\n        existing &&\n        JSON.stringify(existing) !== JSON.stringify(simplifyCompositions(definition))\n      ) {\n        throw new Error(`Two different schemas use the OpenAPI component id '${id}'.`);\n      }\n      definitions[io].set(id, simplifyCompositions(definition));\n    }\n    return simplifyCompositions(localizedRoot);\n  }\n\n  const operations = Object.entries(api.operations).map(([operationId, operation]) => ({\n    operationId,\n    operation,\n    // A void input is an operation without a request body, not a JSON value.\n    input:\n      operation.input.def.type === \"void\"\n        ? null\n        : convert(operation.input, \"input\", `${operationId}.input`),\n    // A void output is a response without a body.\n    output:\n      operation.output.def.type === \"void\"\n        ? null\n        : convert(operation.output, \"output\", `${operationId}.output`),\n  }));\n  const errorSchema = convert(backofficeApiErrorSchema, \"output\", \"error\");\n\n  const inputFormDiffers = new Map<string, boolean>();\n  function hasSeparateInputComponent(id: string): boolean {\n    const known = inputFormDiffers.get(id);\n    if (known !== undefined) {\n      return known;\n    }\n    const input = definitions.input.get(id);\n    const output = definitions.output.get(id);\n    if (!input || !output) {\n      return false;\n    }\n    // Assume equal while visiting so recursive schemas terminate.\n    inputFormDiffers.set(id, false);\n    const differs =\n      JSON.stringify(input) !== JSON.stringify(output) ||\n      referencedDefinitionIds(input).some(hasSeparateInputComponent);\n    inputFormDiffers.set(id, differs);\n    return differs;\n  }\n\n  function componentName(id: string, io: SchemaIo): string {\n    return io === \"input\" && hasSeparateInputComponent(id) ? `${id}Input` : id;\n  }\n\n  function toComponentRefs(schema: JsonSchema, io: SchemaIo): JsonSchema {\n    return JSON.parse(JSON.stringify(schema), (key, value: unknown) =>\n      key === \"$ref\" && typeof value === \"string\" && value.startsWith(DEFINITION_REF_PREFIX)\n        ? `#/components/schemas/${componentName(value.slice(DEFINITION_REF_PREFIX.length), io)}`\n        : value,\n    ) as JsonSchema;\n  }\n\n  const schemas: Record<string, JsonSchema> = {};\n  for (const io of [\"output\", \"input\"] as const) {\n    for (const [id, definition] of definitions[io]) {\n      schemas[componentName(id, io)] = toComponentRefs(definition, io);\n    }\n  }\n\n  const errorResponses = Object.fromEntries(\n    Object.entries(BACKOFFICE_API_ERROR_STATUS).map(([code, status]) => [\n      String(status),\n      {\n        description:\n          BACKOFFICE_API_ERROR_DESCRIPTIONS[code as keyof typeof BACKOFFICE_API_ERROR_STATUS],\n        content: { \"application/json\": { schema: toComponentRefs(errorSchema, \"output\") } },\n      },\n    ]),\n  );\n\n  const paths: OpenApiDocument[\"paths\"] = {};\n  for (const { operationId, operation, input, output } of operations) {\n    paths[`/api/${api.version}/scopes/{scope}/${operationId}`] = {\n      post: {\n        operationId,\n        ...summarize(operation),\n        tags: [operationId.split(\".\")[0]],\n        // OpenAPI 3.1 lets non-OAuth schemes list the roles a requirement needs.\n        security: [\n          {\n            bearer: operation.permissions.map(\n              ({ namespace, permission }) => `${namespace}.${permission}`,\n            ),\n          },\n        ],\n        parameters: [SCOPE_PARAMETER],\n        ...(input && {\n          requestBody: {\n            required: true,\n            content: { \"application/json\": { schema: toComponentRefs(input, \"input\") } },\n          },\n        }),\n        responses: {\n          ...(output\n            ? {\n                \"200\": {\n                  description: \"The operation's result.\",\n                  content: { \"application/json\": { schema: toComponentRefs(output, \"output\") } },\n                },\n              }\n            : { \"204\": { description: \"The operation succeeded.\" } }),\n          ...errorResponses,\n        },\n      },\n    };\n  }\n\n  return {\n    openapi: \"3.1.0\",\n    // The repository, Backoffice included, is MIT licensed.\n    info: {\n      title: \"Backoffice API\",\n      version: api.version,\n      license: { name: \"MIT\", identifier: \"MIT\" },\n    },\n    servers: [{ url: serverUrl }],\n    security: [{ bearer: [] }],\n    paths,\n    components: {\n      schemas,\n      securitySchemes: { bearer: { type: \"http\", scheme: \"bearer\", bearerFormat: \"JWT\" } },\n    },\n  };\n}\n\n/** The description repeats the summary only when there is more to say. */\nfunction summarize(\n  operation: BackofficeApiOperation,\n): { summary: string } | { summary: string; description: string } {\n  const summary = backofficeApiOperationSummary(operation);\n  return summary === operation.description\n    ? { summary }\n    : { summary, description: operation.description };\n}\n\n/**\n * zod writes `z.unknown().nullable()` as `anyOf: [{}, { type: \"null\" }]` and a one-member union as a\n * one-element `oneOf`. Both are valid but illogical: an empty member already matches anything, and\n * a single member is the schema itself.\n */\nfunction simplifyCompositions(schema: JsonSchema): JsonSchema {\n  const simplify = (value: unknown): unknown => {\n    if (Array.isArray(value)) {\n      return value.map(simplify);\n    }\n    if (value === null || typeof value !== \"object\") {\n      return value;\n    }\n    const node = Object.fromEntries(\n      Object.entries(value).map(([key, child]) => [key, simplify(child)]),\n    ) as JsonSchema;\n    for (const keyword of [\"anyOf\", \"oneOf\"] as const) {\n      const members = node[keyword];\n      if (!Array.isArray(members)) {\n        continue;\n      }\n      const { [keyword]: _members, ...rest } = node;\n      if (members.some((member) => isEmptySchema(member))) {\n        return rest;\n      }\n      const [only] = members as JsonSchema[];\n      if (members.length === 1 && only && Object.keys(only).every((key) => !(key in rest))) {\n        return { ...rest, ...only };\n      }\n    }\n    return node;\n  };\n  return simplify(schema) as JsonSchema;\n}\n\nfunction isEmptySchema(schema: unknown): boolean {\n  return (\n    schema !== null &&\n    typeof schema === \"object\" &&\n    !Array.isArray(schema) &&\n    Object.keys(schema).length === 0\n  );\n}\n\nfunction referencedDefinitionIds(schema: JsonSchema): string[] {\n  const ids: string[] = [];\n  JSON.stringify(schema, (key, value: unknown) => {\n    if (key === \"$ref\" && typeof value === \"string\" && value.startsWith(DEFINITION_REF_PREFIX)) {\n      ids.push(value.slice(DEFINITION_REF_PREFIX.length));\n    }\n    return value;\n  });\n  return ids;\n}\n\nconst ANONYMOUS_DEFINITION = /^__schema\\d+$/;\n\n/**\n * zod names definitions it cannot identify `__schema<n>`, separately in every conversion, and\n * represents a described or re-annotated copy of a recursive schema as an alias of one. Aliases\n * collapse into their named component; other anonymous definitions get a per-conversion name so\n * conversions cannot collide.\n */\nfunction localizeAnonymousDefinitions(\n  root: JsonSchema,\n  definitions: Record<string, JsonSchema>,\n  conversionName: string,\n): { root: JsonSchema; definitions: Record<string, JsonSchema> } {\n  const renames = new Map<string, string>();\n  for (const [id, definition] of Object.entries(definitions)) {\n    const target = aliasTarget(definition);\n    if (!ANONYMOUS_DEFINITION.test(id) && target && ANONYMOUS_DEFINITION.test(target)) {\n      renames.set(target, id);\n    }\n  }\n  for (const id of Object.keys(definitions)) {\n    if (ANONYMOUS_DEFINITION.test(id) && !renames.has(id)) {\n      renames.set(id, `${conversionName}.${id.slice(\"__\".length)}`);\n    }\n  }\n  const rename = (schema: JsonSchema): JsonSchema =>\n    JSON.parse(JSON.stringify(schema), (key, value: unknown) => {\n      if (key !== \"$ref\" || typeof value !== \"string\" || !value.startsWith(DEFINITION_REF_PREFIX)) {\n        return value;\n      }\n      const id = value.slice(DEFINITION_REF_PREFIX.length);\n      return `${DEFINITION_REF_PREFIX}${renames.get(id) ?? id}`;\n    }) as JsonSchema;\n\n  const localized: Record<string, JsonSchema> = {};\n  for (const [id, definition] of Object.entries(definitions)) {\n    const target = aliasTarget(definition);\n    // An alias's body is its anonymous target's, which is stored under the alias's name instead.\n    if (target && renames.get(target) === id) {\n      continue;\n    }\n    localized[renames.get(id) ?? id] = rename(definition);\n  }\n  return { root: rename(root), definitions: localized };\n}\n\nfunction aliasTarget(definition: JsonSchema): string | null {\n  const ref = definition[\"$ref\"];\n  return Object.keys(definition).length === 1 &&\n    typeof ref === \"string\" &&\n    ref.startsWith(DEFINITION_REF_PREFIX)\n    ? ref.slice(DEFINITION_REF_PREFIX.length)\n    : null;\n}\n"],"mappings":";;;;AA6BA,MAAM,mBAAmB;AACzB,MAAM,qBAAqB,gBAAgB;AAC3C,MAAM,oBAAoB,OAAO,mBAAmB,GAAG;AAGvD,MAAM,kBAAkB;CACtB,MAAM;CACN,IAAI;CACJ,UAAU;CACV,aACE;CACF,QAAQ;EACN,MAAM;EACN,SAAS,cAAc,mBAAmB,GAAG,kBAAkB,GAAG,cAV1B,mBAAmB,GAAG,kBAAkB,IAAI,mBAUI;CAC1F;AACF;AAEA,MAAM,wBAAwB;;;;;;;;;;AAW9B,SAAgB,sBACd,KACA,EAAE,aACe;CACjB,MAAM,cAAyD;EAC7D,uBAAO,IAAI,IAAI;EACf,wBAAQ,IAAI,IAAI;CAClB;CAEA,SAAS,QAAQ,QAAmB,IAAc,gBAAoC;EACpF,MAAM,EACJ,OACA,SAAS,UACT,GAAG,SACD,EAAE,aAAa,QAAQ;GACzB;GACA,QAAQ;GACR,iBAAiB;GAEjB,WAAW,EAAE,iBAAiB;IAC5B,OAAO,WAAW;IAClB,OAAO,WAAW;GACpB;EACF,CAAC;EACD,MAAM,EAAE,MAAM,eAAe,aAAa,yBAAyB,6BACjE,MACC,SAAS,CAAC,GACX,cACF;EACA,KAAK,MAAM,CAAC,IAAI,eAAe,OAAO,QAAQ,oBAAoB,GAAG;GACnE,MAAM,WAAW,YAAY,GAAG,CAAC,IAAI,EAAE;GACvC,IACE,YACA,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,qBAAqB,UAAU,CAAC,GAE5E,MAAM,IAAI,MAAM,uDAAuD,GAAG,GAAG;GAE/E,YAAY,GAAG,CAAC,IAAI,IAAI,qBAAqB,UAAU,CAAC;EAC1D;EACA,OAAO,qBAAqB,aAAa;CAC3C;CAEA,MAAM,aAAa,OAAO,QAAQ,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,aAAa,gBAAgB;EACnF;EACA;EAEA,OACE,UAAU,MAAM,IAAI,SAAS,SACzB,OACA,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,OAAO;EAE9D,QACE,UAAU,OAAO,IAAI,SAAS,SAC1B,OACA,QAAQ,UAAU,QAAQ,UAAU,GAAG,YAAY,QAAQ;CACnE,EAAE;CACF,MAAM,cAAc,QAAQ,0BAA0B,UAAU,OAAO;CAEvE,MAAM,mCAAmB,IAAI,IAAqB;CAClD,SAAS,0BAA0B,IAAqB;EACtD,MAAM,QAAQ,iBAAiB,IAAI,EAAE;EACrC,IAAI,UAAU,KAAA,GACZ,OAAO;EAET,MAAM,QAAQ,YAAY,MAAM,IAAI,EAAE;EACtC,MAAM,SAAS,YAAY,OAAO,IAAI,EAAE;EACxC,IAAI,CAAC,SAAS,CAAC,QACb,OAAO;EAGT,iBAAiB,IAAI,IAAI,KAAK;EAC9B,MAAM,UACJ,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,MAAM,KAC/C,wBAAwB,KAAK,CAAC,CAAC,KAAK,yBAAyB;EAC/D,iBAAiB,IAAI,IAAI,OAAO;EAChC,OAAO;CACT;CAEA,SAAS,cAAc,IAAY,IAAsB;EACvD,OAAO,OAAO,WAAW,0BAA0B,EAAE,IAAI,GAAG,GAAG,SAAS;CAC1E;CAEA,SAAS,gBAAgB,QAAoB,IAA0B;EACrE,OAAO,KAAK,MAAM,KAAK,UAAU,MAAM,IAAI,KAAK,UAC9C,QAAQ,UAAU,OAAO,UAAU,YAAY,MAAM,WAAW,qBAAqB,IACjF,wBAAwB,cAAc,MAAM,MAAM,CAA4B,GAAG,EAAE,MACnF,KACN;CACF;CAEA,MAAM,UAAsC,CAAC;CAC7C,KAAK,MAAM,MAAM,CAAC,UAAU,OAAO,GACjC,KAAK,MAAM,CAAC,IAAI,eAAe,YAAY,KACzC,QAAQ,cAAc,IAAI,EAAE,KAAK,gBAAgB,YAAY,EAAE;CAInE,MAAM,iBAAiB,OAAO,YAC5B,OAAO,QAAQ,2BAA2B,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAClE,OAAO,MAAM,GACb;EACE,aACE,kCAAkC;EACpC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,aAAa,QAAQ,EAAE,EAAE;CACpF,CACF,CAAC,CACH;CAEA,MAAM,QAAkC,CAAC;CACzC,KAAK,MAAM,EAAE,aAAa,WAAW,OAAO,YAAY,YACtD,MAAM,QAAQ,IAAI,QAAQ,kBAAkB,iBAAiB,EAC3D,MAAM;EACJ;EACA,GAAG,UAAU,SAAS;EACtB,MAAM,CAAC,YAAY,MAAM,GAAG,CAAC,CAAC,EAAE;EAEhC,UAAU,CACR,EACE,QAAQ,UAAU,YAAY,KAC3B,EAAE,WAAW,iBAAiB,GAAG,UAAU,GAAG,YACjD,EACF,CACF;EACA,YAAY,CAAC,eAAe;EAC5B,GAAI,SAAS,EACX,aAAa;GACX,UAAU;GACV,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,OAAO,OAAO,EAAE,EAAE;EAC7E,EACF;EACA,WAAW;GACT,GAAI,SACA,EACE,OAAO;IACL,aAAa;IACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,gBAAgB,QAAQ,QAAQ,EAAE,EAAE;GAC/E,EACF,IACA,EAAE,OAAO,EAAE,aAAa,2BAA2B,EAAE;GACzD,GAAG;EACL;CACF,EACF;CAGF,OAAO;EACL,SAAS;EAET,MAAM;GACJ,OAAO;GACP,SAAS,IAAI;GACb,SAAS;IAAE,MAAM;IAAO,YAAY;GAAM;EAC5C;EACA,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC;EAC5B,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;EACzB;EACA,YAAY;GACV;GACA,iBAAiB,EAAE,QAAQ;IAAE,MAAM;IAAQ,QAAQ;IAAU,cAAc;GAAM,EAAE;EACrF;CACF;AACF;;AAGA,SAAS,UACP,WACgE;CAChE,MAAM,UAAU,8BAA8B,SAAS;CACvD,OAAO,YAAY,UAAU,cACzB,EAAE,QAAQ,IACV;EAAE;EAAS,aAAa,UAAU;CAAY;AACpD;;;;;;AAOA,SAAS,qBAAqB,QAAgC;CAC5D,MAAM,YAAY,UAA4B;EAC5C,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,IAAI,QAAQ;EAE3B,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO;EAET,MAAM,OAAO,OAAO,YAClB,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,CAAC,CAAC,CACpE;EACA,KAAK,MAAM,WAAW,CAAC,SAAS,OAAO,GAAY;GACjD,MAAM,UAAU,KAAK;GACrB,IAAI,CAAC,MAAM,QAAQ,OAAO,GACxB;GAEF,MAAM,GAAG,UAAU,UAAU,GAAG,SAAS;GACzC,IAAI,QAAQ,MAAM,WAAW,cAAc,MAAM,CAAC,GAChD,OAAO;GAET,MAAM,CAAC,QAAQ;GACf,IAAI,QAAQ,WAAW,KAAK,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,OAAO,QAAQ,EAAE,OAAO,KAAK,GACjF,OAAO;IAAE,GAAG;IAAM,GAAG;GAAK;EAE9B;EACA,OAAO;CACT;CACA,OAAO,SAAS,MAAM;AACxB;AAEA,SAAS,cAAc,QAA0B;CAC/C,OACE,WAAW,QACX,OAAO,WAAW,YAClB,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW;AAEnC;AAEA,SAAS,wBAAwB,QAA8B;CAC7D,MAAM,MAAgB,CAAC;CACvB,KAAK,UAAU,SAAS,KAAK,UAAmB;EAC9C,IAAI,QAAQ,UAAU,OAAO,UAAU,YAAY,MAAM,WAAW,qBAAqB,GACvF,IAAI,KAAK,MAAM,MAAM,CAA4B,CAAC;EAEpD,OAAO;CACT,CAAC;CACD,OAAO;AACT;AAEA,MAAM,uBAAuB;;;;;;;AAQ7B,SAAS,6BACP,MACA,aACA,gBAC+D;CAC/D,MAAM,0BAAU,IAAI,IAAoB;CACxC,KAAK,MAAM,CAAC,IAAI,eAAe,OAAO,QAAQ,WAAW,GAAG;EAC1D,MAAM,SAAS,YAAY,UAAU;EACrC,IAAI,CAAC,qBAAqB,KAAK,EAAE,KAAK,UAAU,qBAAqB,KAAK,MAAM,GAC9E,QAAQ,IAAI,QAAQ,EAAE;CAE1B;CACA,KAAK,MAAM,MAAM,OAAO,KAAK,WAAW,GACtC,IAAI,qBAAqB,KAAK,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE,GAClD,QAAQ,IAAI,IAAI,GAAG,eAAe,GAAG,GAAG,MAAM,CAAW,GAAG;CAGhE,MAAM,UAAU,WACd,KAAK,MAAM,KAAK,UAAU,MAAM,IAAI,KAAK,UAAmB;EAC1D,IAAI,QAAQ,UAAU,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,qBAAqB,GACxF,OAAO;EAET,MAAM,KAAK,MAAM,MAAM,CAA4B;EACnD,OAAO,GAAG,wBAAwB,QAAQ,IAAI,EAAE,KAAK;CACvD,CAAC;CAEH,MAAM,YAAwC,CAAC;CAC/C,KAAK,MAAM,CAAC,IAAI,eAAe,OAAO,QAAQ,WAAW,GAAG;EAC1D,MAAM,SAAS,YAAY,UAAU;EAErC,IAAI,UAAU,QAAQ,IAAI,MAAM,MAAM,IACpC;EAEF,UAAU,QAAQ,IAAI,EAAE,KAAK,MAAM,OAAO,UAAU;CACtD;CACA,OAAO;EAAE,MAAM,OAAO,IAAI;EAAG,aAAa;CAAU;AACtD;AAEA,SAAS,YAAY,YAAuC;CAC1D,MAAM,MAAM,WAAW;CACvB,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,WAAW,KACxC,OAAO,QAAQ,YACf,IAAI,WAAW,qBAAqB,IAClC,IAAI,MAAM,CAA4B,IACtC;AACN"}