@noodleseed/one 0.162.0 → 0.164.0

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-tenant-resources.js

@@ -76,95 +76,6 @@ const YES = {
     type: 'boolean',
     summary: 'Confirm non-interactively.',
 };
-const RETENTION = {
-    ...OPTIONAL_FLAG,
-    name: 'retention-days',
-    type: 'integer',
-    value: '<days>',
-    summary: 'Managed-record retention in days.',
-    constraints: { choices: [7, 30, 90], default: 30 },
-};
-const INSTALLATION_ARGUMENT = {
-    ...REQUIRED_ARGUMENT,
-    name: 'installation',
-    summary: 'Solution installation identifier.',
-};
-const COLLECTION_ARGUMENT = {
-    ...REQUIRED_ARGUMENT,
-    name: 'collection',
-    summary: 'Managed collection key.',
-};
-const RECORD_ARGUMENT = {
-    ...REQUIRED_ARGUMENT,
-    name: 'record',
-    summary: 'Managed record identifier.',
-};
-const SOLUTION_COMMON_FLAGS = [ORG, SERVICE, AUTH_TOKEN, JSON_FLAG];
-const RECORD_FLAGS = [
-    ...SOLUTION_COMMON_FLAGS,
-    {
-        ...OPTIONAL_FLAG,
-        name: 'data',
-        type: 'string',
-        value: '<json>',
-        summary: 'Structured JSON record data.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'idempotency-key',
-        type: 'string',
-        value: '<key>',
-        summary: 'Retry-safe create key.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'expected-revision',
-        type: 'integer',
-        value: '<revision>',
-        summary: 'Expected current record revision.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'status',
-        type: 'string',
-        value: '<status>',
-        summary: 'Record status or list filter.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'assignee',
-        type: 'string',
-        value: '<subject>',
-        summary: 'Assignee subject or list filter.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'note',
-        type: 'string',
-        value: '<text>',
-        summary: 'Operator note text.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'cursor',
-        type: 'string',
-        value: '<cursor>',
-        summary: 'Opaque page cursor.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'limit',
-        type: 'integer',
-        value: '<count>',
-        summary: 'Bounded page size.',
-    },
-    {
-        ...OPTIONAL_FLAG,
-        name: 'include-deleted',
-        type: 'boolean',
-        summary: 'Include payload-free tombstones.',
-    },
-];
 const WATCH_FLAGS = [
     {
         ...OPTIONAL_FLAG,
@@ -189,158 +100,6 @@ const DEPLOYMENT_BASE_FLAGS = [ORG, APP, ENV, SERVICE, AUTH_TOKEN];
 const DEPLOYMENT_INSPECT_FLAGS = [ORG, SERVICE, AUTH_TOKEN, JSON_FLAG];
 const _GITHUB_BASE_FLAGS = [ORG, APP, SERVICE, AUTH_TOKEN];
 export const CATALOG_TENANT_RESOURCES = [
-    {
-        name: 'solutions',
-        section: 'resources',
-        helpRank: 1,
-        summary: 'Install and operate data-driven business solutions.',
-        arguments: [],
-        flags: [],
-        subcommands: [
-            {
-                name: 'catalog',
-                summary: 'List centrally managed solution profiles.',
-                arguments: [],
-                flags: [SERVICE, AUTH_TOKEN, JSON_FLAG],
-                jsonOutput: { mode: 'single' },
-            },
-            {
-                name: 'list',
-                summary: 'List solution installations for an organization.',
-                arguments: [],
-                flags: SOLUTION_COMMON_FLAGS,
-                jsonOutput: { mode: 'single' },
-            },
-            {
-                name: 'install',
-                summary: 'Install one managed solution profile.',
-                arguments: [{ ...REQUIRED_ARGUMENT, name: 'profile', summary: 'Solution profile key.' }],
-                flags: [...SOLUTION_COMMON_FLAGS, APP, ENV, RETENTION],
-                jsonOutput: { mode: 'single' },
-            },
-            {
-                name: 'inspect',
-                summary: 'Inspect one solution installation.',
-                arguments: [INSTALLATION_ARGUMENT],
-                flags: SOLUTION_COMMON_FLAGS,
-                jsonOutput: { mode: 'single' },
-            },
-            {
-                name: 'grants',
-                summary: 'Manage installation-scoped business grants.',
-                arguments: [],
-                flags: [],
-                subcommands: [
-                    {
-                        name: 'list',
-                        summary: 'List live business grants.',
-                        arguments: [INSTALLATION_ARGUMENT],
-                        flags: SOLUTION_COMMON_FLAGS,
-                        jsonOutput: { mode: 'single' },
-                    },
-                    {
-                        name: 'set',
-                        summary: 'Create or update a business grant.',
-                        arguments: [INSTALLATION_ARGUMENT],
-                        flags: [
-                            ...SOLUTION_COMMON_FLAGS,
-                            {
-                                ...OPTIONAL_FLAG,
-                                name: 'subject',
-                                type: 'string',
-                                value: '<subject>',
-                                summary: 'Canonical business-user subject.',
-                                required: true,
-                            },
-                            {
-                                ...OPTIONAL_FLAG,
-                                name: 'email',
-                                type: 'string',
-                                value: '<email>',
-                                summary: 'Business-user email address.',
-                                required: true,
-                            },
-                            {
-                                ...OPTIONAL_FLAG,
-                                name: 'role',
-                                type: 'string',
-                                value: '<role>',
-                                summary: 'Business role.',
-                                required: true,
-                                constraints: { choices: ['administrator', 'manager', 'operator', 'viewer'] },
-                            },
-                            {
-                                ...OPTIONAL_FLAG,
-                                name: 'expected-revision',
-                                type: 'integer',
-                                value: '<revision>',
-                                summary: 'Expected current grant revision; 0 for a new grant.',
-                            },
-                        ],
-                        jsonOutput: { mode: 'single' },
-                    },
-                    {
-                        name: 'revoke',
-                        summary: 'Revoke a business grant using optimistic concurrency.',
-                        arguments: [INSTALLATION_ARGUMENT],
-                        flags: [
-                            ...SOLUTION_COMMON_FLAGS,
-                            {
-                                ...OPTIONAL_FLAG,
-                                name: 'subject',
-                                type: 'string',
-                                value: '<subject>',
-                                summary: 'Canonical business-user subject.',
-                                required: true,
-                            },
-                            {
-                                ...OPTIONAL_FLAG,
-                                name: 'expected-revision',
-                                type: 'integer',
-                                value: '<revision>',
-                                summary: 'Expected current grant revision.',
-                                required: true,
-                            },
-                        ],
-                        jsonOutput: { mode: 'single' },
-                    },
-                ],
-            },
-            {
-                name: 'records',
-                summary: 'Operate one installed managed collection.',
-                arguments: [],
-                flags: [],
-                usage: 'solutions records <list|create|get|update|assign|status|note|activity|delete|export> <installation> <collection> [record] [options]',
-                subcommands: [
-                    ...[
-                        'list',
-                        'create',
-                        'get',
-                        'update',
-                        'assign',
-                        'status',
-                        'note',
-                        'activity',
-                        'delete',
-                        'export',
-                    ].map((name) => ({
-                        name,
-                        summary: `${name[0]?.toUpperCase()}${name.slice(1)} managed records.`,
-                        arguments: [
-                            INSTALLATION_ARGUMENT,
-                            COLLECTION_ARGUMENT,
-                            ...(name === 'list' || name === 'create' || name === 'export'
-                                ? []
-                                : [RECORD_ARGUMENT]),
-                        ],
-                        flags: RECORD_FLAGS,
-                        jsonOutput: { mode: 'single' },
-                    })),
-                ],
-            },
-        ],
-    },
     {
         name: 'apps',
         section: 'resources',

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-types.js

@@ -0,0 +1,7 @@
+/**
+ * Types for the CLI's declarative command catalog (`catalog.ts`). Pure type definitions — no
+ * runtime code — so this module has zero import cost for anything that only needs the shapes
+ * (including the doc/skill generator scripts, which read the sibling data modules directly).
+ */
+export {};
+//# sourceMappingURL=catalog-types.js.map

package/node_modules/@noodle-borg/cli-catalog/dist/index.js

@@ -0,0 +1,20 @@
+export * from './catalog-data-account.js';
+export * from './catalog-data-assistant.js';
+export * from './catalog-data-auth-discovery.js';
+export * from './catalog-data-billing.js';
+export * from './catalog-data-bootstrap-authoring.js';
+export * from './catalog-data-bootstrap-pre-auth.js';
+export * from './catalog-data-config.js';
+export * from './catalog-data-core.js';
+export * from './catalog-data-distributions.js';
+export * from './catalog-data-hosted-deployment.js';
+export * from './catalog-data-hosted-governance.js';
+export * from './catalog-data-hosted-observability.js';
+export * from './catalog-data-local-authoring.js';
+export * from './catalog-data-platform-auth.js';
+export * from './catalog-data-policy.js';
+export * from './catalog-data-solutions.js';
+export * from './catalog-data-tenant-admin.js';
+export * from './catalog-data-tenant-resources.js';
+export * from './catalog-types.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/compiler/dist/artifact/assemble.js

@@ -1,6 +1,6 @@
 import { artifactConfig } from './config.js';
 import { ARTIFACT_SCHEMA_VERSION, } from './types.js';
-export function assembleRuntimeArtifact({ manifest, options, runtimeBranding, runtimeShell, artifactAmbientContext, state, artifactTools, allResources, artifactPrompts, packagedAssets, requirements, declared, customerEndpoints, knowledge, managedCollections, }) {
+export function assembleRuntimeArtifact({ manifest, options, runtimeBranding, runtimeShell, artifactAmbientContext, state, artifactTools, allResources, artifactPrompts, packagedAssets, requirements, declared, customerEndpoints, knowledge, managedCollections, variables, }) {
     // 4. Assemble the artifact. `resources`/`prompts` and their capability lists are emitted only when
     // present, keeping a tools-only artifact byte-identical to before this slice.
     const capabilities = {
@@ -40,6 +40,7 @@ export function assembleRuntimeArtifact({ manifest, options, runtimeBranding, ru
                 : {}),
             ...(manifest.server.auth !== undefined ? { auth: manifest.server.auth } : {}),
             ...(knowledge !== undefined && knowledge.length > 0 ? { knowledge } : {}),
+            ...(variables !== undefined && variables.length > 0 ? { variables } : {}),
             ...(managedCollections !== undefined && managedCollections.length > 0
                 ? { managedCollections }
                 : {}),

package/node_modules/@noodle-borg/compiler/dist/artifact/catalog-emission.js

@@ -5,7 +5,9 @@ import { requiresToolConfirmation } from './consent.js';
 /** Resolve connector references and emit catalog-dependent artifact surfaces. */
 export function emitCatalogArtifactSurfaces({ manifest, catalog, structuralAmbientContext, structuralTools, structuralResources, structuralPrompts, toolUiMetaByName, errors, }) {
     const declared = manifest.connectors ?? {};
-    const usedAliases = new Set();
+    const usedAliases = new Set(manifest.manifestVersion === '2'
+        ? (manifest.server.collections ?? []).flatMap((collection) => collection.source === undefined ? [] : [collection.source.connector])
+        : []);
     const customerRouting = catalog === undefined ? undefined : new CustomerRoutingCollector(manifest.server.auth, errors);
     const artifactAmbientContext = emitAmbientContext(structuralAmbientContext, catalog, declared, usedAliases, errors, customerRouting);
     const artifactTools = structuralTools.map((s) => {

package/node_modules/@noodle-borg/compiler/dist/artifact/config.js

@@ -1,5 +1,8 @@
 export function artifactConfig(manifest, tools, resources, prompts, connectorBindings, ambientFulfilment) {
     const variables = new Set();
+    if (manifest.manifestVersion === '2')
+        for (const declaration of manifest.server.variables ?? [])
+            variables.add(declaration.name);
     collectVariablesFromManagedOrigins(manifest, variables);
     for (const tool of tools)
         collectVariablesFromFulfilment(tool.fulfilment, variables);

package/node_modules/@noodle-borg/compiler/dist/artifact/types.d.ts

@@ -1,6 +1,8 @@
 import type { CapabilityRequirementName } from '@noodle-borg/capabilities';
 import type { CompiledKnowledgeComponent } from '@noodle-borg/knowledge/portable';
+import type { ArtifactVariableDeclaration } from '../business-variables.js';
 import type { CustomerEndpointPolicy } from '../customer-endpoint.js';
+import type { ManagedCollectionControls } from '../managed-collection-controls.js';
 import type { CondNode, ExprNode } from '../manifest/expression.js';
 import type { Manifest } from '../manifest/schema.js';
 import type { OperationRef } from './operation-ref.js';
@@ -165,13 +167,25 @@ export interface ArtifactServerContext {
         readonly fulfilment: ArtifactFulfilment;
     };
 }
-export interface ArtifactManagedCollection {
+export interface ArtifactManagedCollection extends ManagedCollectionControls {
     readonly name: string;
     readonly title: string;
     readonly description: string;
     readonly schemaVersion: number;
     readonly schemaDigest: string;
     readonly recordSchema: JsonSchema;
+    readonly behavior?: {
+        readonly kind: 'request';
+    };
+    readonly source: {
+        readonly authority: 'native';
+    } | {
+        readonly authority: 'external';
+        readonly connectorAlias: string;
+        readonly connectorId: string;
+        readonly connectorVersion: string;
+        readonly scan: OperationRef;
+    };
 }
 interface ArtifactOidcAuth {
     readonly kind?: 'oidc' | undefined;
@@ -237,6 +251,8 @@ export interface ArtifactServer {
     readonly knowledge?: readonly CompiledKnowledgeComponent[];
     /** Compiled managed-record schema intent; lifecycle and operator state remain outside artifacts. */
     readonly managedCollections?: readonly ArtifactManagedCollection[];
+    /** Typed reusable managed-variable declarations, never live operator values. */
+    readonly variables?: readonly ArtifactVariableDeclaration[];
     readonly assistant?: {
         readonly model: NonNullable<Manifest['server']['assistant']>['model'];
         readonly allowedOrigins: readonly string[];

package/node_modules/@noodle-borg/compiler/dist/artifact/version.d.ts

@@ -53,8 +53,13 @@
  *
  * `0.17.0` (Managed collection declaration): additive — Core v2 reusable managed-record schema intent
  * may be projected under `server.managedCollections`; lifecycle and operator state remain separate.
+ *
+ * `0.18.0` (Collection authority): additive — every newly compiled managed collection identifies native
+ * authority or exact resolved read-only connector operations for an external replica.
+ *
+ * `0.19.0` (Business settings): optional typed managed-variable declarations and definition digests.
  */
-export declare const ARTIFACT_SCHEMA_VERSION = "0.17.0";
+export declare const ARTIFACT_SCHEMA_VERSION = "0.19.0";
 /** mimeType for an MCP Apps UI resource (SEP-1865). Widgets are served under this profile. */
 export declare const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
 //# sourceMappingURL=version.d.ts.map

package/node_modules/@noodle-borg/compiler/dist/artifact/version.js

@@ -53,8 +53,13 @@
  *
  * `0.17.0` (Managed collection declaration): additive — Core v2 reusable managed-record schema intent
  * may be projected under `server.managedCollections`; lifecycle and operator state remain separate.
+ *
+ * `0.18.0` (Collection authority): additive — every newly compiled managed collection identifies native
+ * authority or exact resolved read-only connector operations for an external replica.
+ *
+ * `0.19.0` (Business settings): optional typed managed-variable declarations and definition digests.
  */
-export const ARTIFACT_SCHEMA_VERSION = '0.17.0';
+export const ARTIFACT_SCHEMA_VERSION = '0.19.0';
 /** mimeType for an MCP Apps UI resource (SEP-1865). Widgets are served under this profile. */
 export const MCP_APP_MIME_TYPE = 'text/html;profile=mcp-app';
 //# sourceMappingURL=version.js.map

package/node_modules/@noodle-borg/compiler/dist/business-variables.d.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import type { CompileError } from './errors.js';
+export declare const MAX_VARIABLE_DECLARATIONS = 64;
+export declare const MAX_VARIABLE_SCHEMA_BYTES: number;
+export declare const MAX_VARIABLE_VALUE_BYTES: number;
+export declare const MAX_VARIABLE_SCHEMA_DEPTH = 6;
+export declare const variableDeclarationManifestSchema: z.ZodObject<{
+    name: z.ZodString;
+    schemaVersion: z.ZodLiteral<1>;
+    valueSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    default: z.ZodOptional<z.ZodUnknown>;
+    portal: z.ZodOptional<z.ZodObject<{
+        label: z.ZodString;
+        help: z.ZodOptional<z.ZodString>;
+        group: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    requiredFor: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type VariableDeclarationManifest = z.infer<typeof variableDeclarationManifestSchema>;
+export interface ArtifactVariableDeclaration extends VariableDeclarationManifest {
+    /** Hash of the complete declaration; metadata, default and capability changes are revision-visible. */
+    readonly schemaDigest: string;
+}
+/** The one declaration validator used by TypeScript authoring, compilation and activation. */
+export declare function validateVariableDeclaration(declaration: VariableDeclarationManifest): readonly CompileError[];
+export declare function compileVariableDeclarations(declarations: readonly VariableDeclarationManifest[], toolNames: readonly string[], errors: CompileError[]): readonly ArtifactVariableDeclaration[];
+//# sourceMappingURL=business-variables.d.ts.map

package/node_modules/@noodle-borg/compiler/dist/business-variables.js

@@ -0,0 +1,230 @@
+import { canonicalJson, sensitiveContentFinding, sha256Canonical, validateJsonSchema, } from '@noodle-borg/app-package';
+import { z } from 'zod';
+export const MAX_VARIABLE_DECLARATIONS = 64;
+export const MAX_VARIABLE_SCHEMA_BYTES = 16 * 1024;
+export const MAX_VARIABLE_VALUE_BYTES = 16 * 1024;
+export const MAX_VARIABLE_SCHEMA_DEPTH = 6;
+const plainText = (max) => z
+    .string()
+    .trim()
+    .min(1)
+    .max(max)
+    .regex(/^[^<>\p{Cc}]+$/u, 'must be plain text without markup or control characters');
+export const variableDeclarationManifestSchema = z
+    .object({
+    name: z
+        .string()
+        .min(1)
+        .max(128)
+        .regex(/^(?!(?:__proto__|prototype|constructor)$)[A-Za-z0-9_]+$/),
+    schemaVersion: z.literal(1),
+    valueSchema: z.record(z.string(), z.unknown()),
+    default: z.unknown().optional(),
+    portal: z
+        .object({
+        label: plainText(120),
+        help: plainText(1000).optional(),
+        group: plainText(80).optional(),
+    })
+        .strict()
+        .optional(),
+    requiredFor: z.array(z.string().regex(/^[a-z][a-z0-9_]*$/)).max(128),
+})
+    .strict();
+/** The one declaration validator used by TypeScript authoring, compilation and activation. */
+export function validateVariableDeclaration(declaration) {
+    const errors = [];
+    const parsed = variableDeclarationManifestSchema.safeParse(declaration);
+    if (!parsed.success)
+        return [
+            {
+                code: 'invalid_variable_declaration',
+                path: '',
+                message: 'invalid variable declaration metadata or version',
+            },
+        ];
+    const fail = (path, message) => errors.push({ code: 'invalid_variable_declaration', path, message });
+    if (!isBoundedJson(declaration.valueSchema, MAX_VARIABLE_SCHEMA_BYTES)) {
+        fail('valueSchema', 'value schema must be bounded JSON');
+        return errors;
+    }
+    validateValueSchema(declaration.valueSchema, 'valueSchema', 0, { fields: 0 }, fail);
+    if (errors.length > 0)
+        return errors;
+    const schemaIssues = validateJsonSchema(declaration.valueSchema, undefined);
+    if (schemaIssues.some((issue) => issue.keyword === 'schema'))
+        fail('valueSchema', 'invalid JSON Schema');
+    if (Object.hasOwn(declaration, 'default')) {
+        if (!isBoundedJson(declaration.default, MAX_VARIABLE_VALUE_BYTES))
+            fail('default', 'default must be bounded JSON');
+        else if (validateJsonSchema(declaration.valueSchema, declaration.default).length > 0)
+            fail('default', 'default does not match the declared value schema');
+    }
+    if (sensitiveContentFinding({ portal: declaration.portal, default: declaration.default }) !==
+        undefined) {
+        fail('', 'variable metadata/default must not contain credentials');
+    }
+    return errors;
+}
+export function compileVariableDeclarations(declarations, toolNames, errors) {
+    const seen = new Map();
+    for (const [index, declaration] of declarations.entries()) {
+        const path = `server.variables.${index}`;
+        const issues = validateVariableDeclaration(declaration);
+        if (issues.length > 0) {
+            errors.push(...issues.map((issue) => ({ ...issue, path: issue.path ? `${path}.${issue.path}` : path })));
+            continue;
+        }
+        const normalized = {
+            ...declaration,
+            requiredFor: [...new Set(declaration.requiredFor)].sort(),
+        };
+        const schemaDigest = sha256Canonical(normalized);
+        const previous = seen.get(declaration.name);
+        if (previous !== undefined && previous.schemaDigest !== schemaDigest) {
+            errors.push({
+                code: 'invalid_variable_declaration',
+                path,
+                message: 'conflicting duplicate variable declaration',
+            });
+            continue;
+        }
+        for (const name of normalized.requiredFor) {
+            if (!toolNames.includes(name))
+                errors.push({
+                    code: 'invalid_variable_declaration',
+                    path: `${path}.requiredFor`,
+                    message: `required capability "${name}" is not a declared tool`,
+                });
+        }
+        seen.set(declaration.name, { ...normalized, schemaDigest });
+    }
+    return [...seen.values()].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+const commonKeys = ['$schema', 'type', 'title', 'description'];
+const typeKeys = {
+    string: ['minLength', 'maxLength', 'enum', 'format'],
+    boolean: [],
+    number: ['minimum', 'maximum', 'exclusiveMinimum', 'exclusiveMaximum', 'multipleOf'],
+    integer: ['minimum', 'maximum', 'exclusiveMinimum', 'exclusiveMaximum', 'multipleOf'],
+    array: ['items', 'minItems', 'maxItems', 'uniqueItems'],
+    object: ['properties', 'required', 'additionalProperties'],
+};
+function validateValueSchema(schema, path, depth, count, fail) {
+    if (depth > MAX_VARIABLE_SCHEMA_DEPTH) {
+        fail(path, 'value schema exceeds maximum nesting depth');
+        return;
+    }
+    const type = schema.type;
+    if (typeof type !== 'string' || !Object.hasOwn(typeKeys, type)) {
+        fail(path, 'unsupported setting value type');
+        return;
+    }
+    const allowed = new Set([...commonKeys, ...(typeKeys[type] ?? [])]);
+    for (const key of Object.keys(schema))
+        if (!allowed.has(key))
+            fail(`${path}.${key}`, 'unsupported setting schema keyword');
+    for (const key of ['title', 'description']) {
+        if (schema[key] !== undefined && !plainText(1000).safeParse(schema[key]).success)
+            fail(`${path}.${key}`, 'schema metadata must be bounded plain text');
+    }
+    if (schema.$schema !== undefined &&
+        schema.$schema !== 'https://json-schema.org/draft/2020-12/schema')
+        fail(`${path}.$schema`, 'unsupported JSON Schema dialect');
+    if (type === 'string')
+        validateStringSchema(schema, path, fail);
+    if (type === 'number' || type === 'integer') {
+        if (!finiteBound(schema.minimum ?? schema.exclusiveMinimum) ||
+            !finiteBound(schema.maximum ?? schema.exclusiveMaximum))
+            fail(path, 'numbers require finite minimum and maximum');
+        const lower = schema.minimum ?? schema.exclusiveMinimum;
+        const upper = schema.maximum ?? schema.exclusiveMaximum;
+        if (typeof lower === 'number' &&
+            typeof upper === 'number' &&
+            (lower > upper ||
+                (lower === upper &&
+                    (schema.exclusiveMinimum !== undefined || schema.exclusiveMaximum !== undefined))))
+            fail(path, 'numeric bounds must permit at least one value');
+    }
+    if (type === 'array') {
+        if (!boundedCount(schema.maxItems, 100))
+            fail(`${path}.maxItems`, 'arrays require maxItems between 0 and 100');
+        if (typeof schema.minItems === 'number' &&
+            typeof schema.maxItems === 'number' &&
+            schema.minItems > schema.maxItems)
+            fail(path, 'array bounds must permit at least one value');
+        if (!isObject(schema.items))
+            fail(`${path}.items`, 'arrays require one item schema');
+        else
+            validateValueSchema(schema.items, `${path}.items`, depth + 1, count, fail);
+    }
+    if (type === 'object') {
+        if (schema.additionalProperties !== false)
+            fail(`${path}.additionalProperties`, 'objects must be closed');
+        if (!isObject(schema.properties)) {
+            fail(`${path}.properties`, 'objects require explicit properties');
+            return;
+        }
+        for (const [key, child] of Object.entries(schema.properties)) {
+            count.fields++;
+            if (count.fields > 128) {
+                fail(path, 'value schema exceeds 128 total properties');
+                return;
+            }
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) ||
+                ['__proto__', 'prototype', 'constructor'].includes(key))
+                fail(`${path}.properties`, 'unsafe property name');
+            if (!isObject(child))
+                fail(`${path}.properties.${key}`, 'property requires a value schema');
+            else
+                validateValueSchema(child, `${path}.properties.${key}`, depth + 1, count, fail);
+        }
+        if (schema.required !== undefined &&
+            (!Array.isArray(schema.required) ||
+                schema.required.some((key) => typeof key !== 'string' || !Object.hasOwn(schema.properties, key))))
+            fail(`${path}.required`, 'required must name declared properties');
+    }
+}
+function validateStringSchema(schema, path, fail) {
+    if (schema.enum !== undefined) {
+        if (!Array.isArray(schema.enum) ||
+            schema.enum.length === 0 ||
+            schema.enum.length > 100 ||
+            schema.enum.some((item) => typeof item !== 'string' || item.length > 200 || /[\p{Cc}<>]/u.test(item)))
+            fail(`${path}.enum`, 'enums require 1 to 100 bounded plain string choices');
+    }
+    else if (!boundedCount(schema.maxLength, 4096))
+        fail(`${path}.maxLength`, 'strings require maxLength between 0 and 4096');
+    if (schema.format !== undefined &&
+        !['email', 'date', 'date-time', 'time', 'uuid'].includes(String(schema.format)))
+        fail(`${path}.format`, 'unsupported setting string format');
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function boundedCount(value, max) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 0 && value <= max;
+}
+function finiteBound(value) {
+    return (typeof value === 'number' &&
+        Number.isFinite(value) &&
+        Math.abs(value) <= Number.MAX_SAFE_INTEGER);
+}
+function isBoundedJson(value, maxBytes) {
+    try {
+        const rejectUndefined = (node, depth) => {
+            if (node === undefined || depth > 16)
+                return false;
+            if (Array.isArray(node))
+                return Array.from(node).every((child) => rejectUndefined(child, depth + 1));
+            if (node !== null && typeof node === 'object')
+                return Object.values(node).every((child) => rejectUndefined(child, depth + 1));
+            return true;
+        };
+        return rejectUndefined(value, 0) && Buffer.byteLength(canonicalJson(value)) <= maxBytes;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=business-variables.js.map