@openbrf/plugin-sdk 1.0.0 → 1.2.0

package/dist/require-capability.js

@@ -0,0 +1,88 @@
+/**
+ * Raising a plugin route above the capability floor the host gives it.
+ *
+ * The host reads one metadata key off a controller and off each of its routes,
+ * and answers a request only for a person who holds every capability listed
+ * there. A plugin's controllers get a floor from the plugin's own permissions
+ * (see "Routes" in the plugin contract); `RequireCapability` is how a route
+ * asks for more.
+ *
+ * Written without `@nestjs/common` on purpose, for the reason `definePlugin` is
+ * an identity function: the SDK is bundled into the plugin, and an import of
+ * its own would have to be resolved from the data volume. NestJS's
+ * `SetMetadata` does no more than this, on the same global `Reflect` the host's
+ * copy of NestJS writes to.
+ */
+/** The metadata key the host reads a route's or a controller's capabilities from. */
+export const REQUIRED_CAPABILITIES_KEY = "openbrf:required-capabilities";
+/**
+ * Every capability name the host knows, which is what a route may require.
+ *
+ * Listed here, not derived, because the SDK cannot import the host. The host
+ * checks the list against its own capabilities in a test, so a capability
+ * added there is not missing here for long; until the SDK is released with it,
+ * a plugin that needs the new name is a type error rather than a typo caught
+ * at request time.
+ */
+export const PLUGIN_ROUTE_CAPABILITIES = [
+    "association:manage",
+    "association:read",
+    "addressBook:read",
+    "addressBook:write",
+    "memberRegister:read",
+    "apartmentRegister:read",
+    "protectedData:reveal",
+    "registerReport:export",
+    "invitation:send",
+    "signupRequest:decide",
+    "self:manage",
+    "residentDirectory:read",
+    "issues:handle",
+    "issues:report",
+    "issues:configure",
+    "documents:manage",
+    "site:manage",
+    "news:comment",
+    "boardPosition:manage",
+    "bookings:book",
+    "bookings:manage",
+    "bookings:configure",
+    "events:manage",
+    "events:attend",
+    "systemRole:manage",
+    "motions:submit",
+    "motions:handle",
+    "meetings:manage",
+    "memberCharges:manage",
+    "fees:manage",
+    "dataProtection:manage",
+    "boardMailbox:handle",
+    "sublets:apply",
+    "sublets:handle",
+    "keyOrders:place",
+    "keyOrders:handle",
+    "chat:participate",
+    "chat:moderate",
+    "apartmentBinder:manage",
+];
+/**
+ * Declares the capabilities a route requires. Several are combined with AND.
+ *
+ * Applied to a controller it covers every route in it. It can only add to the
+ * floor the host gives the plugin: a route cannot require less.
+ */
+export function RequireCapability(...capabilities) {
+    return ((target, _key, descriptor) => {
+        const define = Reflect.defineMetadata;
+        if (define === undefined) {
+            throw new Error("RequireCapability needs reflect-metadata, which @nestjs/common loads: import it before the controller.");
+        }
+        if (descriptor !== undefined) {
+            define(REQUIRED_CAPABILITIES_KEY, capabilities, descriptor.value);
+            return descriptor;
+        }
+        define(REQUIRED_CAPABILITIES_KEY, capabilities, target);
+        return target;
+    });
+}
+//# sourceMappingURL=require-capability.js.map

package/dist/require-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-capability.js","sourceRoot":"","sources":["../src/require-capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,wBAAwB;IACxB,sBAAsB;IACtB,uBAAuB;IACvB,iBAAiB;IACjB,sBAAsB;IACtB,aAAa;IACb,wBAAwB;IACxB,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,aAAa;IACb,cAAc;IACd,sBAAsB;IACtB,eAAe;IACf,iBAAiB;IACjB,oBAAoB;IACpB,eAAe;IACf,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,aAAa;IACb,uBAAuB;IACvB,qBAAqB;IACrB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,wBAAwB;CAChB,CAAC;AAUX;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAG,YAAqC;IAExC,OAAO,CAAC,CACN,MAAc,EACd,IAAsB,EACtB,UAA+B,EAC/B,EAAE;QACF,MAAM,MAAM,GAAI,OAAsC,CAAC,cAAc,CAAC;QACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YAClE,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,CAAC,yBAAyB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAqC,CAAC;AACzC,CAAC"}

package/dist/settings-schema.d.ts

@@ -36,6 +36,14 @@ export declare const pluginSettingsFieldSchema: z.ZodDiscriminatedUnion<[z.ZodOb
         value: z.ZodString;
         labelKey: z.ZodString;
     }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    key: z.ZodString;
+    labelKey: z.ZodString;
+    hintKey: z.ZodOptional<z.ZodString>;
+    required: z.ZodDefault<z.ZodBoolean>;
+    type: z.ZodLiteral<"secret">;
+    minLength: z.ZodOptional<z.ZodInt>;
+    maxLength: z.ZodOptional<z.ZodInt>;
 }, z.core.$strip>], "type">;
 export type PluginSettingsField = z.infer<typeof pluginSettingsFieldSchema>;
 export declare const pluginSettingsSchema: z.ZodObject<{
@@ -76,10 +84,33 @@ export declare const pluginSettingsSchema: z.ZodObject<{
             value: z.ZodString;
             labelKey: z.ZodString;
         }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        key: z.ZodString;
+        labelKey: z.ZodString;
+        hintKey: z.ZodOptional<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+        type: z.ZodLiteral<"secret">;
+        minLength: z.ZodOptional<z.ZodInt>;
+        maxLength: z.ZodOptional<z.ZodInt>;
     }, z.core.$strip>], "type">>;
 }, z.core.$strip>;
 export type PluginSettingsSchema = z.infer<typeof pluginSettingsSchema>;
 export type PluginSettingsValues = Record<string, string | number | boolean>;
+/**
+ * The declaration without its secret fields: what the admin screen is given
+ * values for, and what the host validates the stored plain values against.
+ */
+export declare function withoutSecretFields(schema: PluginSettingsSchema): PluginSettingsSchema;
+/**
+ * The validator for one secret value, as it is written.
+ *
+ * The bounds the field declares, and never the empty string: a secret is
+ * cleared by saying so rather than by storing nothing as a value, so a
+ * plugin reading it is never handed "" where it expects a key.
+ */
+export declare function secretValueValidator(field: Extract<PluginSettingsField, {
+    type: "secret";
+}>): z.ZodString;
 /**
  * Builds the validator for one settings declaration.
  *
@@ -88,6 +119,10 @@ export type PluginSettingsValues = Record<string, string | number | boolean>;
  * about what is acceptable. Unknown keys are stripped: a plugin that drops a
  * setting in a new version must not leave the old value behind to be handed
  * back to it as something it no longer understands.
+ *
+ * A secret field reads as a string, which is how `host.settings.read()` hands
+ * it to the plugin. What the admin screen writes it with is the host's own
+ * rule, since the screen never holds the value it would be validating.
  */
 export declare function settingsValidator(schema: PluginSettingsSchema): z.ZodType<PluginSettingsValues>;
 /** The values a fresh installation starts with, from the declared defaults. */

package/dist/settings-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-schema.d.ts","sourceRoot":"","sources":["../src/settings-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsExB,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAKpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AA0F5E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAe7B,CAAC;AAEL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,oBAAoB,GAC3B,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAQjC;AAqDD,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAQtB"}
+{"version":3,"file":"settings-schema.d.ts","sourceRoot":"","sources":["../src/settings-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsFxB,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAMpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAoG5E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAe7B,CAAC;AAEL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE7E;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAItB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,CAAC,mBAAmB,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GACtD,CAAC,CAAC,SAAS,CAMb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,oBAAoB,GAC3B,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAQjC;AAuDD,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAQtB"}

package/dist/settings-schema.js

@@ -57,11 +57,27 @@ const selectFieldSchema = baseFieldSchema.extend({
         .min(1)
         .max(50),
 });
+/**
+ * A credential: an API key, a token, a customer number the plugin signs in
+ * with (ADR 0037).
+ *
+ * Write-only from the admin screen: the host never returns the value to the
+ * browser, only whether one is set, and the board replaces or clears it. It is
+ * stored encrypted, apart from the other values, and handed back in clear only
+ * by `host.settings.read()` on the server. No default, because a credential
+ * written in a published manifest is not a secret.
+ */
+const secretFieldSchema = baseFieldSchema.extend({
+    type: z.literal("secret"),
+    minLength: z.int().min(1).optional(),
+    maxLength: z.int().min(1).max(10_000).optional(),
+});
 export const pluginSettingsFieldSchema = z.discriminatedUnion("type", [
     textFieldSchema,
     numberFieldSchema,
     booleanFieldSchema,
     selectFieldSchema,
+    secretFieldSchema,
 ]);
 /**
  * Checks a field's bounds against each other and against its default.
@@ -131,6 +147,14 @@ function checkFieldConstraints(field, index, ctx) {
             }
             return;
         }
+        case "secret": {
+            if (field.minLength !== undefined &&
+                field.maxLength !== undefined &&
+                field.minLength > field.maxLength) {
+                reject("minLength must not be greater than maxLength", "minLength");
+            }
+            return;
+        }
         case "boolean":
             return;
     }
@@ -147,6 +171,29 @@ export const pluginSettingsSchema = z
         checkFieldConstraints(field, index, ctx);
     });
 });
+/**
+ * The declaration without its secret fields: what the admin screen is given
+ * values for, and what the host validates the stored plain values against.
+ */
+export function withoutSecretFields(schema) {
+    return {
+        fields: schema.fields.filter((field) => field.type !== "secret"),
+    };
+}
+/**
+ * The validator for one secret value, as it is written.
+ *
+ * The bounds the field declares, and never the empty string: a secret is
+ * cleared by saying so rather than by storing nothing as a value, so a
+ * plugin reading it is never handed "" where it expects a key.
+ */
+export function secretValueValidator(field) {
+    let secret = z.string().min(Math.max(1, field.minLength ?? 1));
+    if (field.maxLength !== undefined) {
+        secret = secret.max(field.maxLength);
+    }
+    return secret;
+}
 /**
  * Builds the validator for one settings declaration.
  *
@@ -155,6 +202,10 @@ export const pluginSettingsSchema = z
  * about what is acceptable. Unknown keys are stripped: a plugin that drops a
  * setting in a new version must not leave the old value behind to be handed
  * back to it as something it no longer understands.
+ *
+ * A secret field reads as a string, which is how `host.settings.read()` hands
+ * it to the plugin. What the admin screen writes it with is the host's own
+ * rule, since the screen never holds the value it would be validating.
  */
 export function settingsValidator(schema) {
     const shape = {};
@@ -192,6 +243,8 @@ function fieldValidator(field) {
             return optionality(z.boolean(), field);
         case "select":
             return optionality(z.enum(field.options.map((option) => option.value)), field);
+        case "secret":
+            return optionality(secretValueValidator(field), field);
     }
 }
 /**
@@ -201,7 +254,7 @@ function fieldValidator(field) {
  * is why it is applied before the optional wrapper rather than after.
  */
 function optionality(validator, field) {
-    if (field.default !== undefined) {
+    if ("default" in field && field.default !== undefined) {
         return validator.default(field.default);
     }
     return field.required ? validator : validator.optional();
@@ -210,7 +263,7 @@ function optionality(validator, field) {
 export function defaultSettings(schema) {
     const values = {};
     for (const field of schema.fields) {
-        if (field.default !== undefined) {
+        if ("default" in field && field.default !== undefined) {
             values[field.key] = field.default;
         }
     }

package/dist/settings-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-schema.js","sourceRoot":"","sources":["../src/settings-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AAEH,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;IACR,6EAA6E;IAC7E,uEAAuE;IACvE,qDAAqD;KACpD,KAAK,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;AAExE,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAExD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,GAAG,EAAE,iBAAiB;IACtB,QAAQ,EAAE,oBAAoB;IAC9B,0EAA0E;IAC1E,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,eAAe,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACjC,QAAQ,EAAE,oBAAoB;KAC/B,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpE,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;CAClB,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,KAA0B,EAC1B,KAAa,EACb,GAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,GAAW,EAAQ,EAAE;QACpD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO;YACP,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,EAAE,CAAC;YACZ,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,EACjC,CAAC;gBACD,MAAM,CAAC,8CAA8C,EAAE,WAAW,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,EACtC,CAAC;gBACD,MAAM,CAAC,uCAAuC,EAAE,SAAS,CAAC,CAAC;YAC7D,CAAC;YACD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,EACtC,CAAC;gBACD,MAAM,CAAC,sCAAsC,EAAE,SAAS,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,IACE,KAAK,CAAC,GAAG,KAAK,SAAS;gBACvB,KAAK,CAAC,GAAG,KAAK,SAAS;gBACvB,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,EACrB,CAAC;gBACD,MAAM,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;gBACzD,MAAM,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;gBACzD,MAAM,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;gBAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,EAC/D,CAAC;gBACD,MAAM,CAAC,gDAAgD,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,SAAS;YACZ,OAAO;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,yBAAyB,CAAC;SAChC,GAAG,CAAC,EAAE,CAAC;SACP,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAClE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CACzC;CACJ,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE;IAChC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1C,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAML;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA4B;IAE5B,MAAM,KAAK,GAAiC,EAAE,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAgD,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,KAA0B;IAChD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,EAAE,CAAC;YACZ,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,sEAAsE;YACtE,qEAAqE;YACrE,mDAAmD;YACnD,OAAO,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QACzC,KAAK,QAAQ;YACX,OAAO,WAAW,CAChB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACnD,KAAK,CACN,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAAuB,EACvB,KAA0B;IAE1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAC7B,MAA4B;IAE5B,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"settings-schema.js","sourceRoot":"","sources":["../src/settings-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AAEH,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;IACR,6EAA6E;IAC7E,uEAAuE;IACvE,qDAAqD;KACpD,KAAK,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;AAExE,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAExD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,GAAG,EAAE,iBAAiB;IACtB,QAAQ,EAAE,oBAAoB;IAC9B,0EAA0E;IAC1E,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,eAAe,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACjC,QAAQ,EAAE,oBAAoB;KAC/B,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpE,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAC5B,KAA0B,EAC1B,KAAa,EACb,GAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,GAAW,EAAQ,EAAE;QACpD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO;YACP,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,EAAE,CAAC;YACZ,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,EACjC,CAAC;gBACD,MAAM,CAAC,8CAA8C,EAAE,WAAW,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,EACtC,CAAC;gBACD,MAAM,CAAC,uCAAuC,EAAE,SAAS,CAAC,CAAC;YAC7D,CAAC;YACD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,EACtC,CAAC;gBACD,MAAM,CAAC,sCAAsC,EAAE,SAAS,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,IACE,KAAK,CAAC,GAAG,KAAK,SAAS;gBACvB,KAAK,CAAC,GAAG,KAAK,SAAS;gBACvB,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,EACrB,CAAC;gBACD,MAAM,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;gBACzD,MAAM,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;gBACzD,MAAM,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;YAChD,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;gBAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,EAC/D,CAAC;gBACD,MAAM,CAAC,gDAAgD,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,IACE,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC7B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,EACjC,CAAC;gBACD,MAAM,CAAC,8CAA8C,EAAE,WAAW,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,SAAS;YACZ,OAAO;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,yBAAyB,CAAC;SAChC,GAAG,CAAC,EAAE,CAAC;SACP,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAClE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CACzC;CACJ,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE;IAChC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1C,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAML;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA4B;IAE5B,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAuD;IAEvD,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA4B;IAE5B,MAAM,KAAK,GAAiC,EAAE,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAgD,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,KAA0B;IAChD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM,EAAE,CAAC;YACZ,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,sEAAsE;YACtE,qEAAqE;YACrE,mDAAmD;YACnD,OAAO,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QACzC,KAAK,QAAQ;YACX,OAAO,WAAW,CAChB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACnD,KAAK,CACN,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,SAAuB,EACvB,KAA0B;IAE1B,IAAI,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAC7B,MAA4B;IAE5B,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openbrf/plugin-sdk",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "The public plugin contract for Open BRF: manifest schema, permission set and host service interfaces.",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -11,9 +11,9 @@
     }
   },
   "devDependencies": {
-    "@nestjs/common": "^12.1.3",
+    "@nestjs/common": "^12.2.0",
     "typescript": "^7.0.2",
-    "vite-plus": "1.2.0",
+    "vite-plus": "1.3.0",
     "zod": "^4.6.7"
   },
   "main": "./dist/index.js",
@@ -52,7 +52,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "lint": "vp lint .",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p type-tests/tsconfig.dom.json && tsc -p type-tests/tsconfig.language.json",
     "test": "vp test run"
   }
 }

package/src/abort-signal.ts

@@ -0,0 +1,22 @@
+/**
+ * The `AbortSignal` the host hands a plugin, and takes from one.
+ *
+ * The host passes a real `AbortSignal`. This package compiles against the
+ * language alone and cannot name the platform's type, so it is looked up in
+ * the plugin's own program: where that has an `AbortSignal`, from the DOM
+ * library or from Node's types, this is it, and the signal can be passed on to
+ * `fetch` and to anything else that takes one. Where it has none, this is the
+ * part of one a plugin can use without them.
+ */
+export type PluginAbortSignal = typeof globalThis extends {
+  readonly AbortSignal: { readonly prototype: infer Signal };
+}
+  ? Signal
+  : PluginAbortSignalShape;
+
+/** What every `AbortSignal` has, for a program without the platform's types. */
+interface PluginAbortSignalShape {
+  readonly aborted: boolean;
+  addEventListener(type: "abort", listener: () => void): void;
+  removeEventListener(type: "abort", listener: () => void): void;
+}

package/src/action-refusal.ts

@@ -0,0 +1,178 @@
+import type { ActionRetry } from "./actions.ts";
+
+/**
+ * Why the registry refused a call, in a form a caller can act on.
+ *
+ * A caller here is often a model rather than a person, which changes what a
+ * refusal has to carry. A person reads a sentence and decides what to do; a
+ * model needs to know whether trying again could ever work, and what to change
+ * if it could. So every refusal has a code, a status, and a published rule for
+ * how a connector should render it.
+ *
+ * The vocabulary lives here rather than in the API because a plugin dispatching
+ * through `host.actions.invoke` has no other way to read it: the catalogue
+ * endpoint serves the same table over HTTP, and a plugin in the same process
+ * has no route to that. The API imports it back, so there is one list.
+ */
+
+export const ACTION_ERROR_REASONS = [
+  "unknown-action",
+  "forbidden-capability",
+  "forbidden-surface",
+  "insufficient-scope",
+  "not-serving",
+  "read-only",
+  "confirmation-required",
+  "output-invalid",
+  "rate-limited",
+  "internal",
+] as const;
+
+export type ActionErrorReason = (typeof ACTION_ERROR_REASONS)[number];
+
+/**
+ * How a connector should tell its caller about a refusal.
+ *
+ * A protocol error means the call never happened; a tool result means it
+ * happened and was refused, and only the second is something to tell the
+ * person about.
+ */
+export type ActionRefusalTransport = "protocol" | "tool-result";
+
+/**
+ * How a connector should render each refusal, published as data.
+ *
+ * Served on the catalogue endpoint as well, so that two connectors - one
+ * reading it over HTTP, one in process - cannot disagree about whether a 403
+ * is worth retrying. Keyed by the registry's reasons and by the two refusals
+ * that are not the registry's own: a body the action's input schema refuses,
+ * and a refusal raised by the service behind the action.
+ */
+export const ACTION_ERROR_MCP: Readonly<
+  Record<
+    ActionErrorReason | "invalid-body" | "domain",
+    {
+      readonly transport: ActionRefusalTransport;
+      readonly retry: ActionRetry;
+    }
+  >
+> = {
+  "unknown-action": { transport: "protocol", retry: "never" },
+  "invalid-body": { transport: "tool-result", retry: "after-edit" },
+  "forbidden-capability": { transport: "tool-result", retry: "never" },
+  "forbidden-surface": { transport: "tool-result", retry: "never" },
+  "insufficient-scope": { transport: "tool-result", retry: "never" },
+  "not-serving": { transport: "tool-result", retry: "never" },
+  "read-only": { transport: "tool-result", retry: "after-backoff" },
+  "confirmation-required": { transport: "tool-result", retry: "never" },
+  "output-invalid": { transport: "protocol", retry: "never" },
+  "rate-limited": { transport: "tool-result", retry: "after-backoff" },
+  internal: { transport: "protocol", retry: "after-backoff" },
+  domain: { transport: "tool-result", retry: "never" },
+};
+
+/**
+ * Which of the three ways a call was refused.
+ *
+ * "registry" is the registry's own refusal, and `reason` is then one of
+ * ACTION_ERROR_REASONS. "invalid-body" is an input the action's schema
+ * refused, and `reason` is "invalid-body". "domain" is the service behind the
+ * action refusing on the merits, and `reason` is one the action declared in
+ * its `errors`.
+ */
+export type ActionRefusalKind = "registry" | "invalid-body" | "domain";
+
+/**
+ * What `host.actions.invoke` rejects with when the call was refused.
+ *
+ * One shape for all three kinds, so that a connector renders a refusal from
+ * the fields it carries rather than by recognising the host's classes, which a
+ * plugin cannot import. Recognise one with `isActionRefusal`, not with
+ * `instanceof`: the host builds it, and a plugin's bundled copy of this
+ * package is not the host's.
+ *
+ * A plugin route that rethrows one answers its caller with the same status,
+ * body and headers the registry would have.
+ */
+export interface ActionRefusal extends Error {
+  readonly name: "ActionRefusal";
+  readonly kind: ActionRefusalKind;
+  readonly reason: string;
+  /** The HTTP status the refusal answers with. */
+  readonly status: number;
+  readonly transport: ActionRefusalTransport;
+  /**
+   * From ACTION_ERROR_MCP for the registry's refusals and an invalid body. For
+   * a domain refusal, the verdict the action declared for that reason in its
+   * `errors`, or "never" for a reason it did not declare.
+   */
+  readonly retry: ActionRetry;
+  /**
+   * The particulars the refusal publishes, keyed by the field they travel in.
+   *
+   * `scopes` on an insufficient-scope refusal names the scope the call needed.
+   * `issues` on an invalid body lists `{ path, message }` for each failing
+   * field, and never the submitted value.
+   */
+  details(): Record<string, readonly unknown[]>;
+  /**
+   * The bearer challenge to answer a connected app with, as the value of a
+   * `WWW-Authenticate` header (RFC 6750, ADR 0009).
+   *
+   * Set on an insufficient-scope refusal, where it names every scope the
+   * instance issues so the client can ask for what it is missing in one round
+   * trip. Absent wherever no challenge would help.
+   */
+  readonly challenge?: string;
+}
+
+const KINDS: readonly unknown[] = [
+  "registry",
+  "invalid-body",
+  "domain",
+] satisfies ActionRefusalKind[];
+const TRANSPORTS: readonly unknown[] = [
+  "protocol",
+  "tool-result",
+] satisfies ActionRefusalTransport[];
+const RETRIES: readonly unknown[] = [
+  "never",
+  "after-edit",
+  "after-backoff",
+] satisfies ActionRetry[];
+const REGISTRY_REASONS: readonly unknown[] = ACTION_ERROR_REASONS;
+
+/**
+ * Whether a value `host.actions.invoke` rejected with is a refusal.
+ *
+ * Structural rather than `instanceof`, for the reason on ActionRefusal. False
+ * means the call failed rather than being refused - the host could not be
+ * reached, or something broke - and a connector answers that as an internal
+ * error without inspecting it.
+ */
+export function isActionRefusal(value: unknown): value is ActionRefusal {
+  if (!(value instanceof Error) || value.name !== "ActionRefusal") {
+    return false;
+  }
+  const refusal = value as Error &
+    Partial<Record<keyof ActionRefusal, unknown>>;
+  if (
+    typeof refusal.reason !== "string" ||
+    typeof refusal.status !== "number" ||
+    typeof refusal.details !== "function" ||
+    !KINDS.includes(refusal.kind) ||
+    !TRANSPORTS.includes(refusal.transport) ||
+    !RETRIES.includes(refusal.retry) ||
+    (refusal.challenge !== undefined && typeof refusal.challenge !== "string")
+  ) {
+    return false;
+  }
+  switch (refusal.kind) {
+    case "registry":
+      return REGISTRY_REASONS.includes(refusal.reason);
+    case "invalid-body":
+      return refusal.reason === "invalid-body";
+    default:
+      return true;
+  }
+}

package/src/action-schema.ts

@@ -58,7 +58,7 @@ function convert(
       `${actionName}: an action schema must be built with the host's zod.`,
     );
   }
-  return z.toJSONSchema(schema, {
+  const document = z.toJSONSchema(schema, {
     target: "draft-2020-12",
     io,
     cycles: "throw",
@@ -69,6 +69,9 @@ function convert(
       );
     },
   }) as Record<string, unknown>;
+  // zod hangs a non-enumerable `~standard` on the root. A shallow copy leaves
+  // it behind, so what a caller is handed is a plain JSON document.
+  return { ...document };
 }
 
 export function actionInputJsonSchema(