@noodleseed/one 0.161.1 → 0.162.0

package/node_modules/@noodle-borg/service/dist/business-information/model.js

@@ -0,0 +1,292 @@
+import { createHash } from 'node:crypto';
+import { builtInCollection, builtInProfile, validateProfilePayload } from './profiles.js';
+import { validateEmail, validateManagedPayload, validateRetentionDays, validateRevision, validateScalar, validateScope, } from './validation.js';
+const ROLE_PERMISSIONS = {
+    administrator: [
+        'installation:administer',
+        'grants:manage',
+        'records:create',
+        'records:read',
+        'records:update',
+        'records:assign',
+        'records:status',
+        'records:note',
+        'records:delete',
+        'records:export',
+    ],
+    manager: [
+        'records:create',
+        'records:read',
+        'records:update',
+        'records:assign',
+        'records:status',
+        'records:note',
+        'records:export',
+    ],
+    operator: [
+        'records:create',
+        'records:read',
+        'records:update',
+        'records:assign',
+        'records:status',
+        'records:note',
+    ],
+    viewer: ['records:read'],
+};
+export function permissionsForBusinessRole(role) {
+    const permissions = ROLE_PERMISSIONS[role];
+    if (permissions === undefined)
+        throw new Error(`unknown business role "${String(role)}"`);
+    return permissions;
+}
+export function businessGrantAllows(grant, permission) {
+    return (grant !== undefined &&
+        grant.revokedAt === undefined &&
+        permissionsForBusinessRole(grant.role).includes(permission));
+}
+export function normalizeInstallationInput(input) {
+    const scope = { ...validateScope(input.scope) };
+    const profile = builtInProfile(input.profileKey);
+    const managedCollections = [...new Set(input.managedCollections)].sort();
+    if (managedCollections.length === 0)
+        throw new Error('at least one managed collection must be enabled');
+    for (const collectionKey of managedCollections)
+        builtInCollection(profile.key, collectionKey);
+    return {
+        scope,
+        profileKey: profile.key,
+        profileVersion: profile.version,
+        managedCollections,
+        retentionDays: validateRetentionDays(input.retentionDays),
+        actorSubject: validateScalar('actor subject', input.actorSubject, 256),
+        ...(input.actorEmail === undefined ? {} : { actorEmail: validateEmail(input.actorEmail) }),
+    };
+}
+export function installationFingerprint(input) {
+    return digest({
+        scope: input.scope,
+        profileKey: input.profileKey,
+        profileVersion: input.profileVersion,
+        managedCollections: input.managedCollections,
+        retentionDays: input.retentionDays,
+        actorSubject: input.actorSubject,
+        actorEmail: input.actorEmail,
+    });
+}
+export function requestFingerprint(input) {
+    return digest(input);
+}
+export function idempotencyDigest(value) {
+    return digest(validateScalar('idempotency key', value, 128));
+}
+export function validateCollectionEnabled(installation, collectionKey) {
+    const normalized = validateScalar('collection key', collectionKey, 64);
+    if (!installation.managedCollections.includes(normalized)) {
+        throw new Error(`managed collection "${normalized}" is not enabled for this installation`);
+    }
+    return builtInCollection(installation.profileKey, normalized);
+}
+export function initialRecord(input) {
+    const profile = validateCollectionEnabled(input.installation, input.collectionKey);
+    const payload = validateProfilePayload(input.installation.profileKey, input.collectionKey, input.payload);
+    const actor = validateScalar('actor subject', input.actorSubject, 256);
+    const id = validateScalar('record id', input.id, 128);
+    const createdAt = input.now.toISOString();
+    return {
+        scope: { ...input.installation.scope },
+        collectionKey: profile.key,
+        id,
+        profileKey: input.installation.profileKey,
+        profileVersion: input.installation.profileVersion,
+        schemaVersion: profile.schemaVersion,
+        schemaDigest: profile.schemaDigest,
+        status: 'new',
+        origin: normalizeOrigin(input.origin),
+        revision: 1,
+        retentionExpiresAt: new Date(input.now.getTime() + input.installation.retentionDays * 24 * 60 * 60 * 1000).toISOString(),
+        createdAt,
+        createdBySubject: actor,
+        updatedAt: createdAt,
+        updatedBySubject: actor,
+        content: { payload, notes: [] },
+    };
+}
+export function applyRequestOperation(current, operation, actorSubject, now, noteId) {
+    if (current.deletedAt !== undefined || current.content === undefined)
+        return undefined;
+    const actor = validateScalar('actor subject', actorSubject, 256);
+    const revision = current.revision + 1;
+    const updatedAt = now.toISOString();
+    if (operation.kind === 'update') {
+        const payload = validateProfilePayload(current.profileKey, current.collectionKey, operation.payload);
+        return {
+            record: cloneRecord({
+                ...current,
+                revision,
+                updatedAt,
+                updatedBySubject: actor,
+                content: { payload, notes: current.content.notes },
+            }),
+            activityKind: 'updated',
+        };
+    }
+    if (operation.kind === 'assign') {
+        const assignee = operation.assigneeSubject === undefined
+            ? undefined
+            : validateScalar('assignee subject', operation.assigneeSubject, 256);
+        const { assigneeSubject: ignoredAssignee, ...withoutAssignee } = current;
+        void ignoredAssignee;
+        return {
+            record: cloneRecord({
+                ...withoutAssignee,
+                ...(assignee === undefined ? {} : { assigneeSubject: assignee }),
+                revision,
+                updatedAt,
+                updatedBySubject: actor,
+            }),
+            activityKind: 'assigned',
+        };
+    }
+    if (operation.kind === 'set_status') {
+        if (!validStatusTransition(current.status, operation.status))
+            return undefined;
+        return {
+            record: cloneRecord({
+                ...current,
+                status: operation.status,
+                revision,
+                updatedAt,
+                updatedBySubject: actor,
+            }),
+            activityKind: 'status_changed',
+        };
+    }
+    const note = validateNote(operation.note);
+    if (current.content.notes.length >= 50)
+        throw new Error('managed request cannot exceed 50 notes');
+    return {
+        record: cloneRecord({
+            ...current,
+            revision,
+            updatedAt,
+            updatedBySubject: actor,
+            content: {
+                payload: current.content.payload,
+                notes: [
+                    ...current.content.notes,
+                    {
+                        id: validateScalar('note id', noteId(), 128),
+                        text: note,
+                        createdAt: updatedAt,
+                        createdBySubject: actor,
+                    },
+                ],
+            },
+        }),
+        activityKind: 'note_added',
+    };
+}
+export function deletedRecord(current, actorSubject, now, reason) {
+    const actor = validateScalar('actor subject', actorSubject, 256);
+    const deletedAt = now.toISOString();
+    const { content: ignoredContent, ...metadata } = current;
+    void ignoredContent;
+    return cloneRecord({
+        ...metadata,
+        origin: { kind: current.origin.kind },
+        revision: current.revision + 1,
+        updatedAt: deletedAt,
+        updatedBySubject: actor,
+        deletedAt,
+        deletionReason: reason,
+    });
+}
+export function activityFromRecord(record, kind) {
+    return {
+        scope: { ...record.scope },
+        collectionKey: record.collectionKey,
+        recordId: record.id,
+        revision: record.revision,
+        kind,
+        status: record.status,
+        ...(record.assigneeSubject === undefined ? {} : { assigneeSubject: record.assigneeSubject }),
+        occurredAt: record.updatedAt,
+        actorSubject: record.updatedBySubject,
+        ...(record.content === undefined ? {} : { content: cloneContent(record.content) }),
+    };
+}
+export function cloneRecord(record) {
+    return {
+        ...record,
+        scope: { ...record.scope },
+        origin: { ...record.origin },
+        ...(record.content === undefined ? {} : { content: cloneContent(record.content) }),
+    };
+}
+export function cloneContent(content) {
+    return {
+        payload: structuredClone(content.payload),
+        notes: content.notes.map((note) => ({ ...note })),
+    };
+}
+export function cloneInstallation(installation) {
+    return {
+        ...installation,
+        scope: { ...installation.scope },
+        managedCollections: [...installation.managedCollections],
+    };
+}
+export function cloneGrant(grant) {
+    return { ...grant, scope: { ...grant.scope } };
+}
+export function cloneActivity(activity) {
+    return {
+        ...activity,
+        scope: { ...activity.scope },
+        ...(activity.content === undefined ? {} : { content: cloneContent(activity.content) }),
+    };
+}
+export function validateExpectedRevision(value) {
+    return validateRevision(value);
+}
+function normalizeOrigin(origin) {
+    const kinds = ['embedded', 'mcp', 'portal', 'api', 'import'];
+    if (!kinds.includes(origin.kind))
+        throw new Error('unsupported managed request origin');
+    return {
+        kind: origin.kind,
+        ...(origin.reference === undefined
+            ? {}
+            : { reference: validateScalar('origin reference', origin.reference, 256) }),
+    };
+}
+function validateNote(note) {
+    const normalized = validateScalar('note', note, 4096);
+    validateManagedPayload({ note: normalized });
+    return normalized;
+}
+function validStatusTransition(from, to) {
+    if (from === to)
+        return true;
+    if (from === 'closed')
+        return false;
+    if (from === 'resolved')
+        return to === 'in_progress' || to === 'closed';
+    return to === 'new' || to === 'in_progress' || to === 'resolved' || to === 'closed';
+}
+function digest(value) {
+    return createHash('sha256').update(stableJson(value)).digest('hex');
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .filter(([, entry]) => entry !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=model.js.map

package/node_modules/@noodle-borg/service/dist/business-information/pagination.js

@@ -0,0 +1,50 @@
+import { CursorValidationError, validateScalar } from './validation.js';
+export function scopeKey(scope) {
+    return `${scope.org}\0${scope.app}\0${scope.env}\0${scope.installationId}`;
+}
+export function recordKey(scope, collectionKey, id) {
+    return `${scopeKey(scope)}\0${collectionKey}\0${id}`;
+}
+export function encodeCursor(value) {
+    return Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+}
+export function decodeCursor(cursor, expected) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(validateScalar('cursor', cursor, 2048), 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new CursorValidationError();
+    }
+    if (!isCursor(parsed))
+        throw new CursorValidationError();
+    if (parsed.kind !== expected.kind ||
+        parsed.scope !== scopeKey(expected.scope) ||
+        parsed.collectionKey !== expected.collectionKey) {
+        throw new CursorValidationError('cursor does not belong to this request scope');
+    }
+    return parsed;
+}
+export function afterCursor(record, cursor) {
+    return (record.createdAt > cursor.lastCreatedAt ||
+        (record.createdAt === cursor.lastCreatedAt && record.id > cursor.lastId));
+}
+export function compareRecords(left, right) {
+    return left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id);
+}
+function isCursor(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const input = value;
+    return (input.version === 1 &&
+        (input.kind === 'list' || input.kind === 'export') &&
+        typeof input.scope === 'string' &&
+        typeof input.collectionKey === 'string' &&
+        validTimestamp(input.lastCreatedAt) &&
+        typeof input.lastId === 'string' &&
+        (input.snapshotAt === undefined || validTimestamp(input.snapshotAt)));
+}
+function validTimestamp(value) {
+    return typeof value === 'string' && Number.isFinite(Date.parse(value));
+}
+//# sourceMappingURL=pagination.js.map

package/node_modules/@noodle-borg/service/dist/business-information/portable.js

@@ -0,0 +1,6 @@
+export * from './contracts.js';
+export * from './in-memory-store.js';
+export * from './model.js';
+export * from './profiles.js';
+export * from './validation.js';
+//# sourceMappingURL=portable.js.map

package/node_modules/@noodle-borg/service/dist/business-information/profiles.js

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { PayloadValidationError, validateManagedPayload, validateScalar } from './validation.js';
+const requestSchema = (required, properties) => ({
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    type: 'object',
+    additionalProperties: false,
+    required,
+    properties,
+});
+function collection(key, labels, schema) {
+    return {
+        key,
+        schemaVersion: 1,
+        schemaDigest: createHash('sha256').update(stableJson(schema)).digest('hex'),
+        labels,
+        schema,
+    };
+}
+const travel = collection('travel_requests', { singular: 'Travel request', plural: 'Travel requests', navigation: 'Requests' }, requestSchema(['request_type', 'summary'], {
+    request_type: {
+        type: 'string',
+        enum: ['service', 'cancellation', 'refund', 'recovery'],
+        maxLength: 32,
+    },
+    summary: { type: 'string', minLength: 1, maxLength: 2000 },
+    booking_reference: { type: 'string', maxLength: 128 },
+    traveler_reference: { type: 'string', maxLength: 128 },
+}));
+const service = collection('service_requests', { singular: 'Service request', plural: 'Service requests', navigation: 'Requests' }, requestSchema(['request_type', 'summary'], {
+    request_type: {
+        type: 'string',
+        enum: ['support', 'access', 'configuration', 'recovery'],
+        maxLength: 32,
+    },
+    summary: { type: 'string', minLength: 1, maxLength: 2000 },
+    account_reference: { type: 'string', maxLength: 128 },
+    workspace_reference: { type: 'string', maxLength: 128 },
+}));
+const ecommerce = collection('return_requests', { singular: 'Return request', plural: 'Return requests', navigation: 'Returns' }, requestSchema(['order_reference', 'reason'], {
+    order_reference: { type: 'string', minLength: 1, maxLength: 128 },
+    reason: { type: 'string', minLength: 1, maxLength: 2000 },
+    item_reference: { type: 'string', maxLength: 128 },
+    requested_resolution: {
+        type: 'string',
+        enum: ['refund', 'exchange', 'store_credit', 'support'],
+        maxLength: 32,
+    },
+}));
+const restaurant = collection('guest_requests', { singular: 'Guest request', plural: 'Guest requests', navigation: 'Guest requests' }, requestSchema(['request_type', 'summary'], {
+    request_type: {
+        type: 'string',
+        enum: ['reservation_help', 'order_help', 'feedback', 'recovery'],
+        maxLength: 32,
+    },
+    summary: { type: 'string', minLength: 1, maxLength: 2000 },
+    location_reference: { type: 'string', maxLength: 128 },
+    reservation_reference: { type: 'string', maxLength: 128 },
+}));
+export const BUILT_IN_SOLUTION_PROFILES = {
+    travel: { key: 'travel', version: 1, label: 'Travel', collections: [travel] },
+    b2b_saas: { key: 'b2b_saas', version: 1, label: 'B2B SaaS', collections: [service] },
+    ecommerce: { key: 'ecommerce', version: 1, label: 'Ecommerce', collections: [ecommerce] },
+    restaurant: { key: 'restaurant', version: 1, label: 'Restaurant', collections: [restaurant] },
+};
+export function builtInProfile(key) {
+    const profile = BUILT_IN_SOLUTION_PROFILES[key];
+    if (profile === undefined)
+        throw new Error(`unknown built-in solution profile "${String(key)}"`);
+    return profile;
+}
+export function builtInCollection(profileKey, collectionKey) {
+    const normalized = validateScalar('collection key', collectionKey, 64);
+    const found = builtInProfile(profileKey).collections.find((candidate) => candidate.key === normalized);
+    if (found === undefined) {
+        throw new Error(`collection "${normalized}" is not declared by profile "${profileKey}"`);
+    }
+    return found;
+}
+export function validateProfilePayload(profileKey, collectionKey, value) {
+    const payload = validateManagedPayload(value);
+    const collectionProfile = builtInCollection(profileKey, collectionKey);
+    validateJsonSchema(collectionProfile.schema, payload);
+    return payload;
+}
+function validateJsonSchema(schema, payload) {
+    for (const required of schema.required) {
+        if (!(required in payload)) {
+            throw new PayloadValidationError('invalid_json', `managed payload requires "${required}"`);
+        }
+    }
+    for (const [key, value] of Object.entries(payload)) {
+        const property = schema.properties[key];
+        if (property === undefined) {
+            throw new PayloadValidationError('invalid_json', `managed payload field "${key}" is undeclared`);
+        }
+        if (typeof value !== 'string') {
+            throw new PayloadValidationError('invalid_json', `managed payload field "${key}" must be a string`);
+        }
+        if (property.minLength !== undefined && value.length < property.minLength) {
+            throw new PayloadValidationError('invalid_json', `managed payload field "${key}" is too short`);
+        }
+        if (value.length > property.maxLength) {
+            throw new PayloadValidationError('invalid_json', `managed payload field "${key}" is too long`);
+        }
+        if (property.enum !== undefined && !property.enum.includes(value)) {
+            throw new PayloadValidationError('invalid_json', `managed payload field "${key}" has an unsupported value`);
+        }
+    }
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=profiles.js.map

package/node_modules/@noodle-borg/service/dist/business-information/validation.js

@@ -0,0 +1,200 @@
+import { MANAGED_RETENTION_DAYS } from './contracts.js';
+export const MAX_PAYLOAD_BYTES = 32 * 1024;
+export const MAX_PAYLOAD_DEPTH = 6;
+export const MAX_PAYLOAD_PROPERTIES = 128;
+export const MAX_PAYLOAD_STRING_LENGTH = 4096;
+export const MAX_PAYLOAD_ARRAY_ITEMS = 50;
+export const MAX_PAGE_SIZE = 100;
+export const MAX_EXPORT_PAGE_SIZE = 500;
+export const DEFAULT_PAGE_SIZE = 50;
+export const DEFAULT_RETENTION_DAYS = 30;
+export class PayloadValidationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'PayloadValidationError';
+    }
+}
+export class CursorValidationError extends Error {
+    constructor(message = 'cursor is invalid') {
+        super(message);
+        this.name = 'CursorValidationError';
+    }
+}
+const PROHIBITED_FIELD_PATTERNS = [
+    /^(?:card_?number|credit_?card|debit_?card|pan|cvv|cvc|card_?expiry)$/i,
+    /(?:password|passwd|passcode|secret|api_?key|access_?token|refresh_?token|authorization)/i,
+    /(?:ssn|social_?security|national_?id|government_?id|passport|driver.?s?_?licen[cs]e)/i,
+    /(?:health|medical|diagnosis|patient|biometric|fingerprint|faceprint|voiceprint)/i,
+];
+const CREDENTIAL_VALUE_PATTERNS = [
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/i,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    /\b(?:sk|ghp|github_pat|xox[baprs])-[_A-Za-z0-9-]{8,}\b/,
+    /\b(?:password|passwd|api[_-]?key|access[_-]?token|refresh[_-]?token)\s*[:=]\s*\S+/i,
+];
+const GOVERNMENT_ID_VALUE_PATTERNS = [
+    /\b\d{3}-\d{2}-\d{4}\b/,
+    /\b(?:SSN|social security|national ID|passport number|driver'?s? licen[cs]e)\s*[:#-]\s*\S+/i,
+];
+const HEALTH_BIOMETRIC_VALUE_PATTERNS = [
+    /\b(?:medical record|patient record|diagnosis|biometric template|fingerprint template|faceprint|voiceprint)\s*[:#-]/i,
+];
+export function validateManagedPayload(value) {
+    if (!isPlainObject(value)) {
+        throw new PayloadValidationError('invalid_json', 'managed payload must be a JSON object');
+    }
+    let properties = 0;
+    const validated = validateValue(value, '$', 1, () => {
+        properties += 1;
+        if (properties > MAX_PAYLOAD_PROPERTIES) {
+            throw new PayloadValidationError('too_many_properties', `managed payload exceeds ${MAX_PAYLOAD_PROPERTIES} properties`);
+        }
+    });
+    const encoded = Buffer.byteLength(JSON.stringify(validated), 'utf8');
+    if (encoded > MAX_PAYLOAD_BYTES) {
+        throw new PayloadValidationError('payload_too_large', `managed payload exceeds ${MAX_PAYLOAD_BYTES} bytes`);
+    }
+    return structuredClone(validated);
+}
+function validateValue(value, path, depth, countProperty) {
+    if (depth > MAX_PAYLOAD_DEPTH) {
+        throw new PayloadValidationError('payload_too_deep', `managed payload exceeds depth ${MAX_PAYLOAD_DEPTH}`);
+    }
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new PayloadValidationError('invalid_json', `${path} must be a finite JSON number`);
+        }
+        return value;
+    }
+    if (typeof value === 'string') {
+        validateString(value, path);
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (value.length > MAX_PAYLOAD_ARRAY_ITEMS) {
+            throw new PayloadValidationError('array_too_large', `${path} exceeds ${MAX_PAYLOAD_ARRAY_ITEMS} array items`);
+        }
+        return value.map((entry, index) => validateValue(entry, `${path}[${index}]`, depth + 1, countProperty));
+    }
+    if (!isPlainObject(value)) {
+        throw new PayloadValidationError('invalid_json', `${path} contains a non-JSON value`);
+    }
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        countProperty();
+        if (key.length === 0 || key.length > 64) {
+            throw new PayloadValidationError('invalid_json', `${path} contains an invalid property name`);
+        }
+        if (PROHIBITED_FIELD_PATTERNS.some((pattern) => pattern.test(key))) {
+            throw new PayloadValidationError('prohibited_field', `${path}.${key} is a prohibited field`);
+        }
+        result[key] = validateValue(entry, `${path}.${key}`, depth + 1, countProperty);
+    }
+    return result;
+}
+function validateString(value, path) {
+    if (value.length > MAX_PAYLOAD_STRING_LENGTH) {
+        throw new PayloadValidationError('string_too_long', `${path} exceeds ${MAX_PAYLOAD_STRING_LENGTH} string characters`);
+    }
+    if (looksLikePaymentCard(value)) {
+        throw new PayloadValidationError('payment_card_value', `${path} contains payment card data`);
+    }
+    if (CREDENTIAL_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+        throw new PayloadValidationError('credential_value', `${path} contains credential data`);
+    }
+    if (GOVERNMENT_ID_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+        throw new PayloadValidationError('government_id_value', `${path} contains government ID data`);
+    }
+    if (HEALTH_BIOMETRIC_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+        throw new PayloadValidationError('health_biometric_value', `${path} contains health or biometric data`);
+    }
+}
+function looksLikePaymentCard(value) {
+    const candidates = value.match(/(?:\d[ -]?){13,19}/g) ?? [];
+    return candidates.some((candidate) => {
+        const digits = candidate.replace(/\D/g, '');
+        return digits.length >= 13 && digits.length <= 19 && luhnValid(digits);
+    });
+}
+function luhnValid(digits) {
+    let sum = 0;
+    let double = false;
+    for (let index = digits.length - 1; index >= 0; index -= 1) {
+        let digit = Number(digits[index]);
+        if (double) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+export function validateScalar(label, value, maximum = 128) {
+    const normalized = value.trim();
+    if (normalized.length === 0 || normalized.length > maximum || /[\0\r\n]/.test(normalized)) {
+        throw new Error(`${label} must be between 1 and ${maximum} single-line characters`);
+    }
+    return normalized;
+}
+export function validateEmail(value) {
+    const normalized = validateScalar('business grant email', value, 320).toLowerCase();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
+        throw new Error('business grant email is invalid');
+    }
+    return normalized;
+}
+export function validateScope(scope) {
+    validateSlug('organization', scope.org);
+    validateSlug('app', scope.app);
+    validateSlug('environment', scope.env);
+    validateSlug('installation', scope.installationId);
+    return scope;
+}
+export function validateSlug(label, value) {
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value)) {
+        throw new Error(`${label} must be a lowercase slug`);
+    }
+    return value;
+}
+export function validateRetentionDays(value) {
+    const resolved = value ?? DEFAULT_RETENTION_DAYS;
+    if (!MANAGED_RETENTION_DAYS.includes(resolved)) {
+        throw new Error('retentionDays must be 7, 30, or 90');
+    }
+    return resolved;
+}
+export function boundedPageSize(value) {
+    if (value === undefined)
+        return DEFAULT_PAGE_SIZE;
+    if (!Number.isInteger(value) || value < 1 || value > MAX_PAGE_SIZE) {
+        throw new Error(`limit must be an integer between 1 and ${MAX_PAGE_SIZE}`);
+    }
+    return value;
+}
+export function boundedExportPageSize(value) {
+    if (value === undefined)
+        return DEFAULT_PAGE_SIZE;
+    if (!Number.isInteger(value) || value < 1 || value > MAX_EXPORT_PAGE_SIZE) {
+        throw new Error(`limit must be an integer between 1 and ${MAX_EXPORT_PAGE_SIZE}`);
+    }
+    return value;
+}
+export function validateRevision(value) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error('expectedRevision must be a non-negative safe integer');
+    }
+    return value;
+}
+//# sourceMappingURL=validation.js.map