@researchdatabox/redbox-core 5.0.4 → 5.1.0-beta.12568

package/dist/policies/contentSecurityPolicy.js

@@ -38,6 +38,81 @@ const crypto = __importStar(require("node:crypto"));
 function isAdminApiDocsPath(pathname) {
     return /\/admin\/api-docs(?:\/|$)/.test(pathname);
 }
+function isHttpAppUrl() {
+    if (process.env.NODE_ENV === 'production') {
+        return false;
+    }
+    const appUrl = String(sails.config?.appUrl ?? '').trim();
+    if (!appUrl) {
+        return false;
+    }
+    try {
+        return new URL(appUrl).protocol === 'http:';
+    }
+    catch (_error) {
+        return false;
+    }
+}
+/**
+ * Additional CSP directive sources required by each supported web analytics
+ * provider. Kept as a small map so adding a provider later is a single edit
+ * (see also views/default/default/analytics.ejs and the WebAnalytics config
+ * model). Domains are only merged when analytics is enabled for the request's
+ * branding, so brandings without analytics get no extra allow-listing.
+ */
+const WEB_ANALYTICS_CSP_SOURCES = {
+    googleAnalytics: {
+        'script-src': ['https://www.googletagmanager.com'],
+        'img-src': ['https://*.google-analytics.com', 'https://*.googletagmanager.com'],
+        'connect-src': ['https://*.google-analytics.com', 'https://*.analytics.google.com', 'https://*.googletagmanager.com'],
+    },
+    googleTagManager: {
+        // Keep the explicit GTM origin without strict-dynamic. The latter
+        // disables host allow-listing in supported browsers and would also
+        // block ReDBox's same-origin bundles when they do not carry a nonce.
+        'script-src': ['https://www.googletagmanager.com'],
+        'img-src': ['https://www.googletagmanager.com', 'https://*.google-analytics.com'],
+        'connect-src': ['https://www.googletagmanager.com', 'https://*.google-analytics.com', 'https://*.analytics.google.com'],
+        'frame-src': ['https://www.googletagmanager.com'],
+    },
+};
+/**
+ * If web analytics is enabled for the request's branding, merge the provider's
+ * required sources into the CSP directives (Set-union, mirroring the
+ * admin-api-docs handling). Best-effort and fully guarded: any resolution
+ * failure leaves the directives untouched.
+ */
+function applyWebAnalyticsCsp(req, directives) {
+    try {
+        if (!sails || !sails.config || typeof sails.config.brandingAware !== 'function') {
+            return;
+        }
+        if (typeof BrandingService === 'undefined' || typeof BrandingService.getBrandNameFromReq !== 'function') {
+            return;
+        }
+        const brandName = BrandingService.getBrandNameFromReq(req);
+        const analytics = (sails.config.brandingAware(brandName) || {}).webAnalytics;
+        if (!analytics || analytics.enabled !== true) {
+            return;
+        }
+        const trackingId = typeof analytics.trackingId === 'string' ? analytics.trackingId.trim() : '';
+        if (!/^[A-Za-z0-9\-_]+$/.test(trackingId)) {
+            return;
+        }
+        const sources = WEB_ANALYTICS_CSP_SOURCES[analytics.provider];
+        if (!sources) {
+            return;
+        }
+        Object.keys(sources).forEach((directive) => {
+            const merged = new Set([...(directives[directive] ?? [])]);
+            sources[directive].forEach((src) => merged.add(src));
+            directives[directive] = Array.from(merged);
+        });
+    }
+    catch (err) {
+        sails.log.warn(`Failed to apply web analytics CSP sources: ${err?.message}`);
+    }
+}
 /**
  * ContentSecurityPolicy Policy
  *
@@ -85,7 +160,13 @@ function contentSecurityPolicy(req, res, next) {
     const enabled = cfg.enabled != null ? !!cfg.enabled : defaults.enabled;
     const reportOnly = cfg.reportOnly != null ? !!cfg.reportOnly : defaults.reportOnly;
     let addNonceTo = Array.isArray(cfg.addNonceTo) ? cfg.addNonceTo : defaults.addNonceTo;
-    const extras = Array.isArray(cfg.extras) ? cfg.extras : defaults.extras;
+    // Browsers upgrade every HTTP request when this directive is present.
+    // That makes an HTTP appUrl unusable during LAN development, so retain
+    // the directive for HTTPS deployments but omit it for HTTP app URLs.
+    const configuredExtras = Array.isArray(cfg.extras) ? cfg.extras : defaults.extras;
+    const extras = isHttpAppUrl()
+        ? configuredExtras.filter((directive) => directive.trim().toLowerCase() !== 'upgrade-insecure-requests')
+        : configuredExtras;
     const directives = Object.assign({}, defaults.directives, cfg.directives || {});
     if (isAdminApiDocsPath(req.path)) {
         addNonceTo = [];
@@ -105,6 +186,8 @@ function contentSecurityPolicy(req, res, next) {
         connectSrc.add('blob:');
         directives['connect-src'] = Array.from(connectSrc);
     }
+    // Allow-list the branding's configured web analytics provider (if enabled).
+    applyWebAnalyticsCsp(req, directives);
     if (!enabled) {
         return next();
     }
@@ -153,4 +236,4 @@ function contentSecurityPolicy(req, res, next) {
     return next();
 }
 exports.default = contentSecurityPolicy;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGVudFNlY3VyaXR5UG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3BvbGljaWVzL2NvbnRlbnRTZWN1cml0eVBvbGljeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQWtDQSxzREE2R0M7QUEvSUQsb0RBQXNDO0FBVXRDLFNBQVMsa0JBQWtCLENBQUMsUUFBZ0I7SUFDeEMsT0FBTywyQkFBMkIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDdEQsQ0FBQztBQUVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBbUJHO0FBQ0gsU0FBZ0IscUJBQXFCLENBQUMsR0FBYyxFQUFFLEdBQWMsRUFBRSxJQUF3QjtJQUMxRixLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxvRUFBb0UsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFFbEcsMEVBQTBFO0lBQzFFLE1BQU0sR0FBRyxHQUFjLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBZ0IsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBUSxJQUFLLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBK0MsQ0FBQyxHQUE0QixDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUV4TSx3REFBd0Q7SUFDeEQsTUFBTSxRQUFRLEdBQXdCO1FBQ2xDLE9BQU8sRUFBRSxJQUFJO1FBQ2IsVUFBVSxFQUFFLEtBQUs7UUFDakIsVUFBVSxFQUFFLENBQUMsWUFBWSxFQUFFLFdBQVcsQ0FBQztRQUN2QyxVQUFVLEVBQUU7WUFDUixhQUFhLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDekIsWUFBWSxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQ3hCLFlBQVksRUFBRSxDQUFDLFFBQVEsQ0FBQztZQUN4QixZQUFZLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDeEIsY0FBYyxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQzFCLFdBQVcsRUFBRSxDQUFDLFFBQVEsRUFBRSw4QkFBOEIsRUFBRSwyQkFBMkIsQ0FBQztZQUNwRixVQUFVLEVBQUUsQ0FBQyxRQUFRLEVBQUUsOEJBQThCLEVBQUUsMkJBQTJCLENBQUM7WUFDbkYsaUJBQWlCLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDN0IsYUFBYSxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQ3pCLFVBQVUsRUFBRSxDQUFDLFFBQVEsQ0FBQztTQUN6QjtRQUNELE1BQU0sRUFBRSxDQUFDLDJCQUEyQixDQUFDO0tBQ3hDLENBQUM7SUFFRix3RkFBd0Y7SUFDeEYsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLE9BQU8sSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO0lBQ3ZFLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxVQUFVLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztJQUNuRixJQUFJLFVBQVUsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztJQUN0RixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztJQUN4RSxNQUFNLFVBQVUsR0FBNkIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsVUFBVSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBRTFHLElBQUksa0JBQWtCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDL0IsVUFBVSxHQUFHLEVBQUUsQ0FBQztRQUVoQixNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQy9ELFFBQVEsQ0FBQyxHQUFHLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNoQyxRQUFRLENBQUMsR0FBRyxDQUFDLDhCQUE4QixDQUFDLENBQUM7UUFDN0MsUUFBUSxDQUFDLEdBQUcsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1FBQzFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRS9DLE1BQU0sTUFBTSxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDM0QsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNwQixNQUFNLENBQUMsR0FBRyxDQUFDLHNCQUFzQixDQUFDLENBQUM7UUFDbkMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFM0MsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNqRSxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3ZCLFVBQVUsQ0FBQyxZQUFZLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBRWpELE1BQU0sVUFBVSxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbkUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QixVQUFVLENBQUMsYUFBYSxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBRUQsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ1gsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBRUQsK0RBQStEO0lBQy9ELDJDQUEyQztJQUMzQyxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUVqRSxrRkFBa0Y7SUFDbEYsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFO1FBQ3hCLE1BQU0sR0FBRyxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyQixNQUFNLEtBQUssR0FBRyxVQUFVLGNBQWMsR0FBRyxDQUFDO1lBQzFDLHVEQUF1RDtZQUN2RCxNQUFNLFFBQVEsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxRQUFRLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDdEYsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsUUFBUSxDQUFDLENBQUM7UUFDNUMsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUFDO0lBRUgseUJBQXlCO0lBQ3pCLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUMzQixNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFO1FBQ3BDLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMvQixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUM3QyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLENBQUM7UUFDRCxpRkFBaUY7SUFDckYsQ0FBQyxDQUFDLENBQUM7SUFDSCxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRTtRQUN6QixJQUFJLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQy9DLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDekIsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUFDO0lBRUgsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JCLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7UUFDbEcsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUVyQyx3R0FBd0c7SUFDeEcsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLENBQUMsQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDLENBQUMseUJBQXlCLENBQUM7SUFDbEcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsR0FBRyxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBRXZDLGlGQUFpRjtJQUNqRixJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU87UUFBRSxHQUFHLENBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztJQUNuQyxNQUFNLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBNEIsQ0FBQztJQUNyRSxHQUFHLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7SUFDNUIsTUFBTSxDQUFDLDBCQUEwQixHQUFHLGNBQWMsQ0FBQztJQUVuRCw2QkFBNkI7SUFDN0IsT0FBTyxJQUFJLEVBQUUsQ0FBQztBQUNsQixDQUFDO0FBRUQsa0JBQWUscUJBQXFCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGVudFNlY3VyaXR5UG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3BvbGljaWVzL2NvbnRlbnRTZWN1cml0eVBvbGljeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQW1IQSxzREFzSEM7QUF6T0Qsb0RBQXNDO0FBYXRDLFNBQVMsa0JBQWtCLENBQUMsUUFBZ0I7SUFDeEMsT0FBTywyQkFBMkIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDdEQsQ0FBQztBQUVELFNBQVMsWUFBWTtJQUNqQixJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQ3hDLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUUsS0FBSyxDQUFDLE1BQTJDLEVBQUUsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQy9GLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNWLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxJQUFJLENBQUM7UUFDRCxPQUFPLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsS0FBSyxPQUFPLENBQUM7SUFDaEQsQ0FBQztJQUFDLE9BQU8sTUFBTSxFQUFFLENBQUM7UUFDZCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0FBQ0wsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0seUJBQXlCLEdBQTZDO0lBQ3hFLGVBQWUsRUFBRTtRQUNiLFlBQVksRUFBRSxDQUFDLGtDQUFrQyxDQUFDO1FBQ2xELFNBQVMsRUFBRSxDQUFDLGdDQUFnQyxFQUFFLGdDQUFnQyxDQUFDO1FBQy9FLGFBQWEsRUFBRSxDQUFDLGdDQUFnQyxFQUFFLGdDQUFnQyxFQUFFLGdDQUFnQyxDQUFDO0tBQ3hIO0lBQ0QsZ0JBQWdCLEVBQUU7UUFDZCxrRUFBa0U7UUFDbEUsbUVBQW1FO1FBQ25FLHFFQUFxRTtRQUNyRSxZQUFZLEVBQUUsQ0FBQyxrQ0FBa0MsQ0FBQztRQUNsRCxTQUFTLEVBQUUsQ0FBQyxrQ0FBa0MsRUFBRSxnQ0FBZ0MsQ0FBQztRQUNqRixhQUFhLEVBQUUsQ0FBQyxrQ0FBa0MsRUFBRSxnQ0FBZ0MsRUFBRSxnQ0FBZ0MsQ0FBQztRQUN2SCxXQUFXLEVBQUUsQ0FBQyxrQ0FBa0MsQ0FBQztLQUNwRDtDQUNKLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILFNBQVMsb0JBQW9CLENBQUMsR0FBYyxFQUFFLFVBQW9DO0lBQzlFLElBQUksQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxJQUFJLE9BQU8sS0FBSyxDQUFDLE1BQU0sQ0FBQyxhQUFhLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDOUUsT0FBTztRQUNYLENBQUM7UUFDRCxJQUFJLE9BQU8sZUFBZSxLQUFLLFdBQVcsSUFBSSxPQUFPLGVBQWUsQ0FBQyxtQkFBbUIsS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUN0RyxPQUFPO1FBQ1gsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMzRCxNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLFlBQVksQ0FBQztRQUM3RSxJQUFJLENBQUMsU0FBUyxJQUFJLFNBQVMsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDM0MsT0FBTztRQUNYLENBQUM7UUFDRCxNQUFNLFVBQVUsR0FBRyxPQUFPLFNBQVMsQ0FBQyxVQUFVLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDL0YsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE9BQU87UUFDWCxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcseUJBQXlCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzlELElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNYLE9BQU87UUFDWCxDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRTtZQUN2QyxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzNELE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUNyRCxVQUFVLENBQUMsU0FBUyxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMvQyxDQUFDLENBQUMsQ0FBQztJQUNQLENBQUM7SUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1FBQ1gsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsOENBQStDLEdBQWEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQzVGLENBQUM7QUFDTCxDQUFDO0FBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFDSCxTQUFnQixxQkFBcUIsQ0FBQyxHQUFjLEVBQUUsR0FBYyxFQUFFLElBQXdCO0lBQzFGLEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLG9FQUFvRSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUVsRywwRUFBMEU7SUFDMUUsTUFBTSxHQUFHLEdBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFnQixJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUFRLElBQUssS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUErQyxDQUFDLEdBQTRCLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBRXhNLHdEQUF3RDtJQUN4RCxNQUFNLFFBQVEsR0FBd0I7UUFDbEMsT0FBTyxFQUFFLElBQUk7UUFDYixVQUFVLEVBQUUsS0FBSztRQUNqQixVQUFVLEVBQUUsQ0FBQyxZQUFZLEVBQUUsV0FBVyxDQUFDO1FBQ3ZDLFVBQVUsRUFBRTtZQUNSLGFBQWEsRUFBRSxDQUFDLFFBQVEsQ0FBQztZQUN6QixZQUFZLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDeEIsWUFBWSxFQUFFLENBQUMsUUFBUSxDQUFDO1lBQ3hCLFlBQVksRUFBRSxDQUFDLFFBQVEsQ0FBQztZQUN4QixjQUFjLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDMUIsV0FBVyxFQUFFLENBQUMsUUFBUSxFQUFFLDhCQUE4QixFQUFFLDJCQUEyQixDQUFDO1lBQ3BGLFVBQVUsRUFBRSxDQUFDLFFBQVEsRUFBRSw4QkFBOEIsRUFBRSwyQkFBMkIsQ0FBQztZQUNuRixpQkFBaUIsRUFBRSxDQUFDLFFBQVEsQ0FBQztZQUM3QixhQUFhLEVBQUUsQ0FBQyxRQUFRLENBQUM7WUFDekIsVUFBVSxFQUFFLENBQUMsUUFBUSxDQUFDO1NBQ3pCO1FBQ0QsTUFBTSxFQUFFLENBQUMsMkJBQTJCLENBQUM7S0FDeEMsQ0FBQztJQUVGLHdGQUF3RjtJQUN4RixNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7SUFDdkUsTUFBTSxVQUFVLEdBQUcsR0FBRyxDQUFDLFVBQVUsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO0lBQ25GLElBQUksVUFBVSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO0lBQ3RGLHNFQUFzRTtJQUN0RSx1RUFBdUU7SUFDdkUscUVBQXFFO0lBQ3JFLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7SUFDbEYsTUFBTSxNQUFNLEdBQUcsWUFBWSxFQUFFO1FBQ3pCLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsS0FBSywyQkFBMkIsQ0FBQztRQUN4RyxDQUFDLENBQUMsZ0JBQWdCLENBQUM7SUFDdkIsTUFBTSxVQUFVLEdBQTZCLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLFFBQVEsQ0FBQyxVQUFVLEVBQUUsR0FBRyxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUUxRyxJQUFJLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQy9CLFVBQVUsR0FBRyxFQUFFLENBQUM7UUFFaEIsTUFBTSxRQUFRLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMvRCxRQUFRLENBQUMsR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDaEMsUUFBUSxDQUFDLEdBQUcsQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO1FBQzdDLFFBQVEsQ0FBQyxHQUFHLENBQUMsMkJBQTJCLENBQUMsQ0FBQztRQUMxQyxVQUFVLENBQUMsV0FBVyxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUUvQyxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzNELE1BQU0sQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDcEIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1FBQ25DLFVBQVUsQ0FBQyxTQUFTLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRTNDLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDakUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN2QixVQUFVLENBQUMsWUFBWSxDQUFDLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUVqRCxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ25FLFVBQVUsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDeEIsVUFBVSxDQUFDLGFBQWEsQ0FBQyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELDRFQUE0RTtJQUM1RSxvQkFBb0IsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFFdEMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ1gsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBRUQsK0RBQStEO0lBQy9ELDJDQUEyQztJQUMzQyxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUVqRSxrRkFBa0Y7SUFDbEYsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFO1FBQ3hCLE1BQU0sR0FBRyxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyQixNQUFNLEtBQUssR0FBRyxVQUFVLGNBQWMsR0FBRyxDQUFDO1lBQzFDLHVEQUF1RDtZQUN2RCxNQUFNLFFBQVEsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxRQUFRLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDdEYsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsUUFBUSxDQUFDLENBQUM7UUFDNUMsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUFDO0lBRUgseUJBQXlCO0lBQ3pCLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUMzQixNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFO1FBQ3BDLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMvQixJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUM3QyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLENBQUM7UUFDRCxpRkFBaUY7SUFDckYsQ0FBQyxDQUFDLENBQUM7SUFDSCxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRTtRQUN6QixJQUFJLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQy9DLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDekIsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUFDO0lBRUgsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JCLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7UUFDbEcsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUVyQyx3R0FBd0c7SUFDeEcsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLENBQUMsQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDLENBQUMseUJBQXlCLENBQUM7SUFDbEcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsR0FBRyxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBRXZDLGlGQUFpRjtJQUNqRixJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU87UUFBRSxHQUFHLENBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztJQUNuQyxNQUFNLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBNEIsQ0FBQztJQUNyRSxHQUFHLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7SUFDNUIsTUFBTSxDQUFDLDBCQUEwQixHQUFHLGNBQWMsQ0FBQztJQUVuRCw2QkFBNkI7SUFDN0IsT0FBTyxJQUFJLEVBQUUsQ0FBQztBQUNsQixDQUFDO0FBRUQsa0JBQWUscUJBQXFCLENBQUMifQ==

package/dist/policies/index.d.ts

@@ -5,7 +5,7 @@
  * These policies are middleware functions that run before controller actions.
  */
 export { brandingAndPortal } from './brandingAndPortal';
-export { checkAuth } from './checkAuth';
+export { checkAuth, checkRecordSchemaAuth } from './checkAuth';
 export { checkBrandingValid } from './checkBrandingValid';
 export { companionAttachmentUploadAuth } from './companionAttachmentUploadAuth';
 export { contentSecurityPolicy } from './contentSecurityPolicy';
@@ -20,7 +20,7 @@ export { sessionAuth } from './sessionAuth';
 export { setLang } from './setLang';
 export { validateApiContractRequest } from './validateApiContractRequest';
 import { brandingAndPortal } from './brandingAndPortal';
-import { checkAuth } from './checkAuth';
+import { checkAuth, checkRecordSchemaAuth } from './checkAuth';
 import { checkBrandingValid } from './checkBrandingValid';
 import { companionAttachmentUploadAuth } from './companionAttachmentUploadAuth';
 import { contentSecurityPolicy } from './contentSecurityPolicy';
@@ -37,6 +37,7 @@ import { validateApiContractRequest } from './validateApiContractRequest';
 export declare const Policies: {
     brandingAndPortal: typeof brandingAndPortal;
     checkAuth: typeof checkAuth;
+    checkRecordSchemaAuth: typeof checkRecordSchemaAuth;
     checkBrandingValid: typeof checkBrandingValid;
     companionAttachmentUploadAuth: typeof companionAttachmentUploadAuth;
     contentSecurityPolicy: typeof contentSecurityPolicy;

package/dist/policies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;CAgBpB,CAAC;AAEF,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAG1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;CAiBpB,CAAC;AAEF,eAAe,QAAQ,CAAC"}

package/dist/policies/index.js

@@ -6,11 +6,12 @@
  * These policies are middleware functions that run before controller actions.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Policies = exports.validateApiContractRequest = exports.setLang = exports.sessionAuth = exports.prepWs = exports.noCache = exports.menuResolver = exports.isWebServiceAuthenticated = exports.isAuthenticated = exports.i18nLanguages = exports.disallowedHeadRequestHandler = exports.contentSecurityPolicy = exports.companionAttachmentUploadAuth = exports.checkBrandingValid = exports.checkAuth = exports.brandingAndPortal = void 0;
+exports.Policies = exports.validateApiContractRequest = exports.setLang = exports.sessionAuth = exports.prepWs = exports.noCache = exports.menuResolver = exports.isWebServiceAuthenticated = exports.isAuthenticated = exports.i18nLanguages = exports.disallowedHeadRequestHandler = exports.contentSecurityPolicy = exports.companionAttachmentUploadAuth = exports.checkBrandingValid = exports.checkRecordSchemaAuth = exports.checkAuth = exports.brandingAndPortal = void 0;
 var brandingAndPortal_1 = require("./brandingAndPortal");
 Object.defineProperty(exports, "brandingAndPortal", { enumerable: true, get: function () { return brandingAndPortal_1.brandingAndPortal; } });
 var checkAuth_1 = require("./checkAuth");
 Object.defineProperty(exports, "checkAuth", { enumerable: true, get: function () { return checkAuth_1.checkAuth; } });
+Object.defineProperty(exports, "checkRecordSchemaAuth", { enumerable: true, get: function () { return checkAuth_1.checkRecordSchemaAuth; } });
 var checkBrandingValid_1 = require("./checkBrandingValid");
 Object.defineProperty(exports, "checkBrandingValid", { enumerable: true, get: function () { return checkBrandingValid_1.checkBrandingValid; } });
 var companionAttachmentUploadAuth_1 = require("./companionAttachmentUploadAuth");
@@ -56,6 +57,7 @@ const validateApiContractRequest_2 = require("./validateApiContractRequest");
 exports.Policies = {
     brandingAndPortal: brandingAndPortal_2.brandingAndPortal,
     checkAuth: checkAuth_2.checkAuth,
+    checkRecordSchemaAuth: checkAuth_2.checkRecordSchemaAuth,
     checkBrandingValid: checkBrandingValid_2.checkBrandingValid,
     companionAttachmentUploadAuth: companionAttachmentUploadAuth_2.companionAttachmentUploadAuth,
     contentSecurityPolicy: contentSecurityPolicy_2.contentSecurityPolicy,
@@ -71,4 +73,4 @@ exports.Policies = {
     validateApiContractRequest: validateApiContractRequest_2.validateApiContractRequest,
 };
 exports.default = exports.Policies;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcG9saWNpZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBOzs7OztHQUtHOzs7QUFFSCx5REFBd0Q7QUFBL0Msc0hBQUEsaUJBQWlCLE9BQUE7QUFDMUIseUNBQXdDO0FBQS9CLHNHQUFBLFNBQVMsT0FBQTtBQUNsQiwyREFBMEQ7QUFBakQsd0hBQUEsa0JBQWtCLE9BQUE7QUFDM0IsaUZBQWdGO0FBQXZFLDhJQUFBLDZCQUE2QixPQUFBO0FBQ3RDLGlFQUFnRTtBQUF2RCw4SEFBQSxxQkFBcUIsT0FBQTtBQUM5QiwrRUFBOEU7QUFBckUsNElBQUEsNEJBQTRCLE9BQUE7QUFDckMsaURBQWdEO0FBQXZDLDhHQUFBLGFBQWEsT0FBQTtBQUN0QixxREFBb0Q7QUFBM0Msa0hBQUEsZUFBZSxPQUFBO0FBQ3hCLHlFQUF3RTtBQUEvRCxzSUFBQSx5QkFBeUIsT0FBQTtBQUNsQywrQ0FBOEM7QUFBckMsNEdBQUEsWUFBWSxPQUFBO0FBQ3JCLHFDQUFvQztBQUEzQixrR0FBQSxPQUFPLE9BQUE7QUFDaEIsbUNBQWtDO0FBQXpCLGdHQUFBLE1BQU0sT0FBQTtBQUNmLDZDQUE0QztBQUFuQywwR0FBQSxXQUFXLE9BQUE7QUFDcEIscUNBQW9DO0FBQTNCLGtHQUFBLE9BQU8sT0FBQTtBQUNoQiwyRUFBMEU7QUFBakUsd0lBQUEsMEJBQTBCLE9BQUE7QUFFbkMsaURBQWlEO0FBQ2pELDJEQUF3RDtBQUN4RCwyQ0FBd0M7QUFDeEMsNkRBQTBEO0FBQzFELG1GQUFnRjtBQUNoRixtRUFBZ0U7QUFDaEUsaUZBQThFO0FBQzlFLG1EQUFnRDtBQUNoRCx1REFBb0Q7QUFDcEQsMkVBQXdFO0FBQ3hFLGlEQUE4QztBQUM5Qyx1Q0FBb0M7QUFDcEMscUNBQWtDO0FBQ2xDLCtDQUE0QztBQUM1Qyx1Q0FBb0M7QUFDcEMsNkVBQTBFO0FBRTdELFFBQUEsUUFBUSxHQUFHO0lBQ3BCLGlCQUFpQixFQUFqQixxQ0FBaUI7SUFDakIsU0FBUyxFQUFULHFCQUFTO0lBQ1Qsa0JBQWtCLEVBQWxCLHVDQUFrQjtJQUNsQiw2QkFBNkIsRUFBN0IsNkRBQTZCO0lBQzdCLHFCQUFxQixFQUFyQiw2Q0FBcUI7SUFDckIsNEJBQTRCLEVBQTVCLDJEQUE0QjtJQUM1QixhQUFhLEVBQWIsNkJBQWE7SUFDYixlQUFlLEVBQWYsaUNBQWU7SUFDZix5QkFBeUIsRUFBekIscURBQXlCO0lBQ3pCLFlBQVksRUFBWiwyQkFBWTtJQUNaLE9BQU8sRUFBUCxpQkFBTztJQUNQLE1BQU0sRUFBTixlQUFNO0lBQ04sV0FBVyxFQUFYLHlCQUFXO0lBQ1gsT0FBTyxFQUFQLGlCQUFPO0lBQ1AsMEJBQTBCLEVBQTFCLHVEQUEwQjtDQUM3QixDQUFDO0FBRUYsa0JBQWUsZ0JBQVEsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcG9saWNpZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBOzs7OztHQUtHOzs7QUFFSCx5REFBd0Q7QUFBL0Msc0hBQUEsaUJBQWlCLE9BQUE7QUFDMUIseUNBQStEO0FBQXRELHNHQUFBLFNBQVMsT0FBQTtBQUFFLGtIQUFBLHFCQUFxQixPQUFBO0FBQ3pDLDJEQUEwRDtBQUFqRCx3SEFBQSxrQkFBa0IsT0FBQTtBQUMzQixpRkFBZ0Y7QUFBdkUsOElBQUEsNkJBQTZCLE9BQUE7QUFDdEMsaUVBQWdFO0FBQXZELDhIQUFBLHFCQUFxQixPQUFBO0FBQzlCLCtFQUE4RTtBQUFyRSw0SUFBQSw0QkFBNEIsT0FBQTtBQUNyQyxpREFBZ0Q7QUFBdkMsOEdBQUEsYUFBYSxPQUFBO0FBQ3RCLHFEQUFvRDtBQUEzQyxrSEFBQSxlQUFlLE9BQUE7QUFDeEIseUVBQXdFO0FBQS9ELHNJQUFBLHlCQUF5QixPQUFBO0FBQ2xDLCtDQUE4QztBQUFyQyw0R0FBQSxZQUFZLE9BQUE7QUFDckIscUNBQW9DO0FBQTNCLGtHQUFBLE9BQU8sT0FBQTtBQUNoQixtQ0FBa0M7QUFBekIsZ0dBQUEsTUFBTSxPQUFBO0FBQ2YsNkNBQTRDO0FBQW5DLDBHQUFBLFdBQVcsT0FBQTtBQUNwQixxQ0FBb0M7QUFBM0Isa0dBQUEsT0FBTyxPQUFBO0FBQ2hCLDJFQUEwRTtBQUFqRSx3SUFBQSwwQkFBMEIsT0FBQTtBQUVuQyxpREFBaUQ7QUFDakQsMkRBQXdEO0FBQ3hELDJDQUErRDtBQUMvRCw2REFBMEQ7QUFDMUQsbUZBQWdGO0FBQ2hGLG1FQUFnRTtBQUNoRSxpRkFBOEU7QUFDOUUsbURBQWdEO0FBQ2hELHVEQUFvRDtBQUNwRCwyRUFBd0U7QUFDeEUsaURBQThDO0FBQzlDLHVDQUFvQztBQUNwQyxxQ0FBa0M7QUFDbEMsK0NBQTRDO0FBQzVDLHVDQUFvQztBQUNwQyw2RUFBMEU7QUFFN0QsUUFBQSxRQUFRLEdBQUc7SUFDdEIsaUJBQWlCLEVBQWpCLHFDQUFpQjtJQUNqQixTQUFTLEVBQVQscUJBQVM7SUFDVCxxQkFBcUIsRUFBckIsaUNBQXFCO0lBQ3JCLGtCQUFrQixFQUFsQix1Q0FBa0I7SUFDbEIsNkJBQTZCLEVBQTdCLDZEQUE2QjtJQUM3QixxQkFBcUIsRUFBckIsNkNBQXFCO0lBQ3JCLDRCQUE0QixFQUE1QiwyREFBNEI7SUFDNUIsYUFBYSxFQUFiLDZCQUFhO0lBQ2IsZUFBZSxFQUFmLGlDQUFlO0lBQ2YseUJBQXlCLEVBQXpCLHFEQUF5QjtJQUN6QixZQUFZLEVBQVosMkJBQVk7SUFDWixPQUFPLEVBQVAsaUJBQU87SUFDUCxNQUFNLEVBQU4sZUFBTTtJQUNOLFdBQVcsRUFBWCx5QkFBVztJQUNYLE9BQU8sRUFBUCxpQkFBTztJQUNQLDBCQUEwQixFQUExQix1REFBMEI7Q0FDM0IsQ0FBQztBQUVGLGtCQUFlLGdCQUFRLENBQUMifQ==

package/dist/policies/validateApiContractRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateApiContractRequest.d.ts","sourceRoot":"","sources":["../../src/policies/validateApiContractRequest.ts"],"names":[],"mappings":"AAsDA,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CA2BzG;AACD,eAAe,0BAA0B,CAAC"}
+{"version":3,"file":"validateApiContractRequest.d.ts","sourceRoot":"","sources":["../../src/policies/validateApiContractRequest.ts"],"names":[],"mappings":"AA0FA,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CA4CzG;AACD,eAAe,0BAA0B,CAAC"}

package/dist/policies/validateApiContractRequest.js

@@ -2,9 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateApiContractRequest = validateApiContractRequest;
 const api_routes_1 = require("../api-routes");
+const record_schema_response_1 = require("../api-routes/record-schema-response");
+const RECORD_SCHEMA_CONTROLLER = 'webservice/RecordSchemaController';
 function getNoCacheHeaders() {
     return {
-        'Cache-control': 'no-cache, private',
+        'Cache-Control': 'no-cache, private',
         Pragma: 'no-cache',
         Expires: '0',
     };
@@ -36,39 +38,75 @@ function buildV1ErrorResponse(displayErrors) {
 function sendPolicyResponse(req, res, status, displayErrors) {
     res.set(getNoCacheHeaders());
     res.status(status);
-    return res.json(getApiVersion(req) === '2.0'
-        ? { errors: displayErrors, meta: {} }
-        : buildV1ErrorResponse(displayErrors));
+    return res.json(getApiVersion(req) === '2.0' ? { errors: displayErrors, meta: {} } : buildV1ErrorResponse(displayErrors));
 }
-function describeRequest(req) {
-    return `${String(req.method).toUpperCase()} ${req.path ?? req.originalUrl}`;
+function isRecordSchemaRoute(route) {
+    return route.controller === RECORD_SCHEMA_CONTROLLER;
+}
+function sendRecordSchemaInvalidRequest(req, res) {
+    const instance = req.path ?? req.originalUrl ?? '/api/records/schemas';
+    res.set({
+        ...getNoCacheHeaders(),
+        'Cache-Control': record_schema_response_1.RECORD_SCHEMA_RESPONSE_CACHE_CONTROL,
+        Vary: record_schema_response_1.RECORD_SCHEMA_RESPONSE_VARY,
+    });
+    res.set('Content-Type', record_schema_response_1.RECORD_SCHEMA_PROBLEM_MEDIA_TYPE);
+    res.status(400);
+    return res.json((0, record_schema_response_1.buildRecordSchemaInvalidRequestProblem)(instance));
+}
+function describeRequest(req, route) {
+    const rawMethod = typeof req.method === 'string' ? req.method.toUpperCase() : '';
+    const method = ['DELETE', 'GET', 'HEAD', 'OPTIONS', 'PATCH', 'POST', 'PUT'].includes(rawMethod) ? rawMethod : 'OTHER';
+    const routeIdentifier = route ? `${route.controller}.${route.action}` : 'unresolved-api-route';
+    return `${method} ${routeIdentifier}`;
+}
+function stableErrorType(error) {
+    if (error instanceof TypeError)
+        return 'type-error';
+    if (error instanceof RangeError)
+        return 'range-error';
+    if (error instanceof SyntaxError)
+        return 'syntax-error';
+    if (error instanceof Error)
+        return 'error';
+    return 'non-error';
 }
 function validateApiContractRequest(req, res, next) {
+    let route;
     try {
-        const route = (0, api_routes_1.resolveApiRouteForRequest)(req);
+        route = (0, api_routes_1.resolveApiRouteForRequest)(req);
         if (!route) {
-            sails.log.error(`Failed to resolve contract-first API route for ${describeRequest(req)}`);
+            sails.log.error(`Failed to resolve contract-first API route for ${describeRequest(req, route)}`);
             sendPolicyResponse(req, res, 500, [{ detail: 'Internal server error' }]);
             return;
         }
         const validated = (0, api_routes_1.validateApiRouteRequest)(req, route);
         if (!validated.valid) {
-            sendPolicyResponse(req, res, 400, validated.issues.map(issue => ({ title: issue.path, detail: issue.message })));
+            if (isRecordSchemaRoute(route)) {
+                sendRecordSchemaInvalidRequest(req, res);
+            }
+            else {
+                sendPolicyResponse(req, res, 400, validated.issues.map(issue => ({ title: issue.path, detail: issue.message })));
+            }
             return;
         }
         req.apiRoute = route;
         req.apiRequest = {
             params: validated.params,
             query: validated.query,
+            headers: validated.headers,
             body: validated.body,
             files: validated.files,
         };
         next();
     }
     catch (error) {
-        sails.log.error(`Contract-first API validation failed for ${describeRequest(req)}`, error);
+        sails.log.error('Contract-first API validation failed', Object.freeze({
+            route: describeRequest(req, route),
+            error_type: stableErrorType(error),
+        }));
         sendPolicyResponse(req, res, 500, [{ detail: 'Internal server error' }]);
     }
 }
 exports.default = validateApiContractRequest;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGVBcGlDb250cmFjdFJlcXVlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcG9saWNpZXMvdmFsaWRhdGVBcGlDb250cmFjdFJlcXVlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFzREEsZ0VBMkJDO0FBakZELDhDQUFtRjtBQUVuRixTQUFTLGlCQUFpQjtJQUN4QixPQUFPO1FBQ0wsZUFBZSxFQUFFLG1CQUFtQjtRQUNwQyxNQUFNLEVBQUUsVUFBVTtRQUNsQixPQUFPLEVBQUUsR0FBRztLQUNiLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsR0FBYztJQUNuQyxNQUFNLFlBQVksR0FBRyxPQUFPLEdBQUcsQ0FBQyxLQUFLLEVBQUUsVUFBVSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNoSCxNQUFNLGFBQWEsR0FBRyxPQUFPLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLFFBQVE7UUFDN0UsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUU7UUFDMUQsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLE9BQU8sYUFBYSxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUM7QUFDaEQsQ0FBQztBQUVELFNBQVMsb0JBQW9CLENBQUMsYUFBd0U7SUFDcEcsSUFBSSxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQy9CLE1BQU0sWUFBWSxHQUFHLGFBQWEsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDNUMsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLEtBQUssRUFBRSxRQUFRLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxZQUFZLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQztRQUNwRyxNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQztRQUM3RCxJQUFJLEtBQUssSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUNwQixPQUFPO2dCQUNMLE9BQU8sRUFBRSxLQUFLLElBQUksTUFBTSxJQUFJLG1CQUFtQjtnQkFDL0MsT0FBTyxFQUFFLEtBQUssSUFBSSxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRTthQUN2QyxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPO1FBQ0wsT0FBTyxFQUFFLGFBQWEsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksSUFBSSxtQkFBbUIsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUM7UUFDakgsT0FBTyxFQUFFLEVBQUU7S0FDWixDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsa0JBQWtCLENBQ3pCLEdBQWMsRUFDZCxHQUFjLEVBQ2QsTUFBYyxFQUNkLGFBQXdFO0lBRXhFLEdBQUcsQ0FBQyxHQUFHLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxDQUFDO0lBQzdCLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDbkIsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsS0FBSyxLQUFLO1FBQzFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRTtRQUNyQyxDQUFDLENBQUMsb0JBQW9CLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztBQUMzQyxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsR0FBYztJQUNyQyxPQUFPLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxXQUFXLEVBQUUsSUFBSSxHQUFHLENBQUMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztBQUM5RSxDQUFDO0FBRUQsU0FBZ0IsMEJBQTBCLENBQUMsR0FBYyxFQUFFLEdBQWMsRUFBRSxJQUF3QjtJQUNqRyxJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxJQUFBLHNDQUF5QixFQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzdDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNYLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLGtEQUFrRCxlQUFlLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQzFGLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDekUsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxJQUFBLG9DQUF1QixFQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN0RCxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3JCLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLFNBQVMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDakgsT0FBTztRQUNULENBQUM7UUFFRCxHQUFHLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQztRQUNyQixHQUFHLENBQUMsVUFBVSxHQUFHO1lBQ2YsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNO1lBQ3hCLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSztZQUN0QixJQUFJLEVBQUUsU0FBUyxDQUFDLElBQUk7WUFDcEIsS0FBSyxFQUFFLFNBQVMsQ0FBQyxLQUFLO1NBQ3ZCLENBQUM7UUFDRixJQUFJLEVBQUUsQ0FBQztJQUNULENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsNENBQTRDLGVBQWUsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzNGLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDM0UsQ0FBQztBQUNILENBQUM7QUFDRCxrQkFBZSwwQkFBMEIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGVBcGlDb250cmFjdFJlcXVlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcG9saWNpZXMvdmFsaWRhdGVBcGlDb250cmFjdFJlcXVlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUEwRkEsZ0VBNENDO0FBdElELDhDQUE0RztBQUM1RyxpRkFLOEM7QUFFOUMsTUFBTSx3QkFBd0IsR0FBRyxtQ0FBbUMsQ0FBQztBQUVyRSxTQUFTLGlCQUFpQjtJQUN4QixPQUFPO1FBQ0wsZUFBZSxFQUFFLG1CQUFtQjtRQUNwQyxNQUFNLEVBQUUsVUFBVTtRQUNsQixPQUFPLEVBQUUsR0FBRztLQUNiLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsR0FBYztJQUNuQyxNQUFNLFlBQVksR0FBRyxPQUFPLEdBQUcsQ0FBQyxLQUFLLEVBQUUsVUFBVSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNoSCxNQUFNLGFBQWEsR0FDakIsT0FBTyxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUMsc0JBQXNCLENBQUMsS0FBSyxRQUFRO1FBQ3ZELENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLHNCQUFzQixDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFO1FBQzFELENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDVCxPQUFPLGFBQWEsSUFBSSxZQUFZLElBQUksS0FBSyxDQUFDO0FBQ2hELENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUFDLGFBQXdFO0lBQ3BHLElBQUksYUFBYSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMvQixNQUFNLFlBQVksR0FBRyxhQUFhLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQzVDLE1BQU0sS0FBSyxHQUFHLFlBQVksQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksWUFBWSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDcEcsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDN0QsSUFBSSxLQUFLLElBQUksTUFBTSxFQUFFLENBQUM7WUFDcEIsT0FBTztnQkFDTCxPQUFPLEVBQUUsS0FBSyxJQUFJLE1BQU0sSUFBSSxtQkFBbUI7Z0JBQy9DLE9BQU8sRUFBRSxLQUFLLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUU7YUFDdkMsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBRUQsT0FBTztRQUNMLE9BQU8sRUFBRSxhQUFhLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxJQUFJLElBQUksbUJBQW1CLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO1FBQ2pILE9BQU8sRUFBRSxFQUFFO0tBQ1osQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGtCQUFrQixDQUN6QixHQUFjLEVBQ2QsR0FBYyxFQUNkLE1BQWMsRUFDZCxhQUF3RTtJQUV4RSxHQUFHLENBQUMsR0FBRyxDQUFDLGlCQUFpQixFQUFFLENBQUMsQ0FBQztJQUM3QixHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ25CLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FDYixhQUFhLENBQUMsR0FBRyxDQUFDLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxhQUFhLENBQUMsQ0FDekcsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLG1CQUFtQixDQUFDLEtBQXlCO0lBQ3BELE9BQU8sS0FBSyxDQUFDLFVBQVUsS0FBSyx3QkFBd0IsQ0FBQztBQUN2RCxDQUFDO0FBRUQsU0FBUyw4QkFBOEIsQ0FBQyxHQUFjLEVBQUUsR0FBYztJQUNwRSxNQUFNLFFBQVEsR0FBRyxHQUFHLENBQUMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxXQUFXLElBQUksc0JBQXNCLENBQUM7SUFDdkUsR0FBRyxDQUFDLEdBQUcsQ0FBQztRQUNOLEdBQUcsaUJBQWlCLEVBQUU7UUFDdEIsZUFBZSxFQUFFLDZEQUFvQztRQUNyRCxJQUFJLEVBQUUsb0RBQTJCO0tBQ2xDLENBQUMsQ0FBQztJQUNILEdBQUcsQ0FBQyxHQUFHLENBQUMsY0FBYyxFQUFFLHlEQUFnQyxDQUFDLENBQUM7SUFDMUQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNoQixPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBQSwrREFBc0MsRUFBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0FBQ3BFLENBQUM7QUFFRCxTQUFTLGVBQWUsQ0FBQyxHQUFjLEVBQUUsS0FBMEI7SUFDakUsTUFBTSxTQUFTLEdBQUcsT0FBTyxHQUFHLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ2pGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBUSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztJQUN0SCxNQUFNLGVBQWUsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsS0FBSyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLHNCQUFzQixDQUFDO0lBQy9GLE9BQU8sR0FBRyxNQUFNLElBQUksZUFBZSxFQUFFLENBQUM7QUFDeEMsQ0FBQztBQUVELFNBQVMsZUFBZSxDQUFDLEtBQWM7SUFDckMsSUFBSSxLQUFLLFlBQVksU0FBUztRQUFFLE9BQU8sWUFBWSxDQUFDO0lBQ3BELElBQUksS0FBSyxZQUFZLFVBQVU7UUFBRSxPQUFPLGFBQWEsQ0FBQztJQUN0RCxJQUFJLEtBQUssWUFBWSxXQUFXO1FBQUUsT0FBTyxjQUFjLENBQUM7SUFDeEQsSUFBSSxLQUFLLFlBQVksS0FBSztRQUFFLE9BQU8sT0FBTyxDQUFDO0lBQzNDLE9BQU8sV0FBVyxDQUFDO0FBQ3JCLENBQUM7QUFFRCxTQUFnQiwwQkFBMEIsQ0FBQyxHQUFjLEVBQUUsR0FBYyxFQUFFLElBQXdCO0lBQ2pHLElBQUksS0FBcUMsQ0FBQztJQUMxQyxJQUFJLENBQUM7UUFDSCxLQUFLLEdBQUcsSUFBQSxzQ0FBeUIsRUFBQyxHQUFHLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWCxLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxrREFBa0QsZUFBZSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDakcsa0JBQWtCLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxFQUFFLE1BQU0sRUFBRSx1QkFBdUIsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUN6RSxPQUFPO1FBQ1QsQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLElBQUEsb0NBQXVCLEVBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3RELElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDckIsSUFBSSxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUMvQiw4QkFBOEIsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDM0MsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGtCQUFrQixDQUNoQixHQUFHLEVBQ0gsR0FBRyxFQUNILEdBQUcsRUFDSCxTQUFTLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FDOUUsQ0FBQztZQUNKLENBQUM7WUFDRCxPQUFPO1FBQ1QsQ0FBQztRQUVELEdBQUcsQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDO1FBQ3JCLEdBQUcsQ0FBQyxVQUFVLEdBQUc7WUFDZixNQUFNLEVBQUUsU0FBUyxDQUFDLE1BQU07WUFDeEIsS0FBSyxFQUFFLFNBQVMsQ0FBQyxLQUFLO1lBQ3RCLE9BQU8sRUFBRSxTQUFTLENBQUMsT0FBTztZQUMxQixJQUFJLEVBQUUsU0FBUyxDQUFDLElBQUk7WUFDcEIsS0FBSyxFQUFFLFNBQVMsQ0FBQyxLQUFLO1NBQ3ZCLENBQUM7UUFDRixJQUFJLEVBQUUsQ0FBQztJQUNULENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQ2Isc0NBQXNDLEVBQ3RDLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDWixLQUFLLEVBQUUsZUFBZSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUM7WUFDbEMsVUFBVSxFQUFFLGVBQWUsQ0FBQyxLQUFLLENBQUM7U0FDbkMsQ0FBQyxDQUNILENBQUM7UUFDRixrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDLEVBQUUsTUFBTSxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzNFLENBQUM7QUFDSCxDQUFDO0FBQ0Qsa0JBQWUsMEJBQTBCLENBQUMifQ==

package/dist/record-contract/ajv-error-mapper.d.ts

@@ -0,0 +1,34 @@
+import type { ErrorObject } from 'ajv';
+import { RECORD_SCHEMA_PROBLEM_CODES } from './codes';
+import type { RecordContractPointer } from './types';
+type AjvValidationError = Omit<ErrorObject, 'schemaPath'> & {
+    readonly schemaPath?: string;
+};
+export type RecordSchemaExpectedJsonType = 'array' | 'boolean' | 'integer' | 'null' | 'number' | 'object' | 'string';
+export interface RecordSchemaValidationExpectedShape {
+    readonly type: RecordSchemaExpectedJsonType;
+}
+export type RecordSchemaValidationProblemCode = typeof RECORD_SCHEMA_PROBLEM_CODES.TYPE | typeof RECORD_SCHEMA_PROBLEM_CODES.ARRAY_ITEM | typeof RECORD_SCHEMA_PROBLEM_CODES.ENUM | typeof RECORD_SCHEMA_PROBLEM_CODES.ADDITIONAL_PROPERTY | typeof RECORD_SCHEMA_PROBLEM_CODES.REQUIRED | typeof RECORD_SCHEMA_PROBLEM_CODES.VALIDATION_GENERIC;
+/** Safe structural problem suitable for later adaptation to a record-save issue. */
+export interface RecordSchemaValidationProblem {
+    readonly code: RecordSchemaValidationProblemCode;
+    readonly pointer: RecordContractPointer;
+    readonly expected?: RecordSchemaValidationExpectedShape;
+}
+export type RecordSchemaValidationProblemMappingResult = {
+    readonly problems: readonly RecordSchemaValidationProblem[];
+    readonly truncated: false;
+} | {
+    readonly problems: readonly RecordSchemaValidationProblem[];
+    readonly truncated: true;
+};
+export declare class RecordSchemaValidationProblemMapperConfigurationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Map AJV errors without exposing messages, schema fragments, submitted values,
+ * or arbitrary parameter bags. Input order is retained.
+ */
+export declare function mapAjvErrorsToRecordSchemaProblems(errors: readonly AjvValidationError[] | null | undefined, maxDiagnostics: number): RecordSchemaValidationProblemMappingResult;
+export {};
+//# sourceMappingURL=ajv-error-mapper.d.ts.map

package/dist/record-contract/ajv-error-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ajv-error-mapper.d.ts","sourceRoot":"","sources":["../../src/record-contract/ajv-error-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AACvC,OAAO,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAMrD,KAAK,kBAAkB,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;CAC7C;AAED,MAAM,MAAM,iCAAiC,GACzC,OAAO,2BAA2B,CAAC,IAAI,GACvC,OAAO,2BAA2B,CAAC,UAAU,GAC7C,OAAO,2BAA2B,CAAC,IAAI,GACvC,OAAO,2BAA2B,CAAC,mBAAmB,GACtD,OAAO,2BAA2B,CAAC,QAAQ,GAC3C,OAAO,2BAA2B,CAAC,kBAAkB,CAAC;AAE1D,oFAAoF;AACpF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mCAAmC,CAAC;CACzD;AAED,MAAM,MAAM,0CAA0C,GAClD;IACE,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B,CAAC;AAEN,qBAAa,qDAAsD,SAAQ,KAAK;gBAC3D,OAAO,EAAE,MAAM;CAInC;AAmJD;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,SAAS,kBAAkB,EAAE,GAAG,IAAI,GAAG,SAAS,EACxD,cAAc,EAAE,MAAM,GACrB,0CAA0C,CAS5C"}

package/dist/record-contract/ajv-error-mapper.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecordSchemaValidationProblemMapperConfigurationError = void 0;
+exports.mapAjvErrorsToRecordSchemaProblems = mapAjvErrorsToRecordSchemaProblems;
+const codes_1 = require("./codes");
+const json_pointer_1 = require("./json-pointer");
+const MAX_PUBLIC_POINTER_LENGTH = 2_048;
+const MAX_PUBLIC_POINTER_TOKEN_LENGTH = 256;
+const MAX_KEYWORD_LENGTH = 64;
+class RecordSchemaValidationProblemMapperConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RecordSchemaValidationProblemMapperConfigurationError';
+    }
+}
+exports.RecordSchemaValidationProblemMapperConfigurationError = RecordSchemaValidationProblemMapperConfigurationError;
+const ROOT_POINTER = (0, json_pointer_1.recordContractPointer)('');
+const EXPECTED_JSON_TYPES = new Set([
+    'array',
+    'boolean',
+    'integer',
+    'null',
+    'number',
+    'object',
+    'string',
+]);
+function assertMaxDiagnostics(maxDiagnostics) {
+    if (!Number.isFinite(maxDiagnostics) || !Number.isInteger(maxDiagnostics) || maxDiagnostics <= 0) {
+        throw new RecordSchemaValidationProblemMapperConfigurationError('maxDiagnostics must be a finite positive integer.');
+    }
+}
+function safeKeyword(error) {
+    const keyword = error.keyword;
+    return typeof keyword === 'string' && keyword.length <= MAX_KEYWORD_LENGTH ? keyword : undefined;
+}
+function safeInstancePointer(error) {
+    const instancePath = error.instancePath;
+    if (typeof instancePath !== 'string' ||
+        instancePath.length > MAX_PUBLIC_POINTER_LENGTH ||
+        containsUnsafePointerText(instancePath) ||
+        !(0, json_pointer_1.isRecordContractPointer)(instancePath)) {
+        return ROOT_POINTER;
+    }
+    return (0, json_pointer_1.recordContractPointer)(instancePath);
+}
+function containsUnsafePointerText(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f) {
+            return true;
+        }
+    }
+    return false;
+}
+function safePointerToken(value) {
+    return typeof value === 'string' &&
+        value.length <= MAX_PUBLIC_POINTER_TOKEN_LENGTH &&
+        !containsUnsafePointerText(value)
+        ? value
+        : undefined;
+}
+function safeParameter(error, name) {
+    return error.params[name];
+}
+function appendSafeParameterPointer(pointer, error, parameterName) {
+    const token = safePointerToken(safeParameter(error, parameterName));
+    if (token === undefined) {
+        return pointer;
+    }
+    const candidate = (0, json_pointer_1.joinRecordContractPointer)(pointer, token);
+    return candidate.length <= MAX_PUBLIC_POINTER_LENGTH ? candidate : pointer;
+}
+function isExpectedJsonType(value) {
+    return typeof value === 'string' && EXPECTED_JSON_TYPES.has(value);
+}
+function expectedType(error) {
+    const type = safeParameter(error, 'type');
+    if (!isExpectedJsonType(type)) {
+        return undefined;
+    }
+    return Object.freeze({ type });
+}
+function isItemsFalseSchemaError(error, keyword) {
+    if (keyword !== 'false schema') {
+        return false;
+    }
+    const schemaPath = error.schemaPath;
+    return (typeof schemaPath === 'string' &&
+        schemaPath.length <= MAX_PUBLIC_POINTER_LENGTH &&
+        /\/(?:items|prefixItems)(?:\/|$)/.test(schemaPath));
+}
+function mappedProblem(error) {
+    const keyword = safeKeyword(error);
+    const instancePointer = safeInstancePointer(error);
+    switch (keyword) {
+        case 'type': {
+            const expected = expectedType(error);
+            return Object.freeze({
+                code: codes_1.RECORD_SCHEMA_PROBLEM_CODES.TYPE,
+                pointer: instancePointer,
+                ...(expected ? { expected } : {}),
+            });
+        }
+        case 'items':
+        case 'prefixItems':
+            return Object.freeze({
+                code: codes_1.RECORD_SCHEMA_PROBLEM_CODES.ARRAY_ITEM,
+                pointer: instancePointer,
+            });
+        case 'enum':
+            return Object.freeze({
+                code: codes_1.RECORD_SCHEMA_PROBLEM_CODES.ENUM,
+                pointer: instancePointer,
+            });
+        case 'additionalProperties':
+            return Object.freeze({
+                code: codes_1.RECORD_SCHEMA_PROBLEM_CODES.ADDITIONAL_PROPERTY,
+                pointer: appendSafeParameterPointer(instancePointer, error, 'additionalProperty'),
+            });
+        case 'unevaluatedProperties':
+            return Object.freeze({
+                code: codes_1.RECORD_SCHEMA_PROBLEM_CODES.ADDITIONAL_PROPERTY,
+                pointer: appendSafeParameterPointer(instancePointer, error, 'unevaluatedProperty'),
+            });
+        case 'required':
+            return Object.freeze({
+                code: codes_1.RECORD_SCHEMA_PROBLEM_CODES.REQUIRED,
+                pointer: appendSafeParameterPointer(instancePointer, error, 'missingProperty'),
+            });
+        default:
+            return Object.freeze({
+                code: isItemsFalseSchemaError(error, keyword)
+                    ? codes_1.RECORD_SCHEMA_PROBLEM_CODES.ARRAY_ITEM
+                    : codes_1.RECORD_SCHEMA_PROBLEM_CODES.VALIDATION_GENERIC,
+                pointer: instancePointer,
+            });
+    }
+}
+/**
+ * Map AJV errors without exposing messages, schema fragments, submitted values,
+ * or arbitrary parameter bags. Input order is retained.
+ */
+function mapAjvErrorsToRecordSchemaProblems(errors, maxDiagnostics) {
+    assertMaxDiagnostics(maxDiagnostics);
+    const source = errors ?? [];
+    const problems = source.slice(0, maxDiagnostics).map(mappedProblem);
+    const frozenProblems = Object.freeze(problems);
+    if (source.length > maxDiagnostics) {
+        return Object.freeze({ problems: frozenProblems, truncated: true });
+    }
+    return Object.freeze({ problems: frozenProblems, truncated: false });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWp2LWVycm9yLW1hcHBlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9yZWNvcmQtY29udHJhY3QvYWp2LWVycm9yLW1hcHBlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFzTUEsZ0ZBWUM7QUFqTkQsbUNBQXNEO0FBQ3RELGlEQUEyRztBQUczRyxNQUFNLHlCQUF5QixHQUFHLEtBQUssQ0FBQztBQUN4QyxNQUFNLCtCQUErQixHQUFHLEdBQUcsQ0FBQztBQUM1QyxNQUFNLGtCQUFrQixHQUFHLEVBQUUsQ0FBQztBQW1DOUIsTUFBYSxxREFBc0QsU0FBUSxLQUFLO0lBQzlFLFlBQW1CLE9BQWU7UUFDaEMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyx1REFBdUQsQ0FBQztJQUN0RSxDQUFDO0NBQ0Y7QUFMRCxzSEFLQztBQUVELE1BQU0sWUFBWSxHQUFHLElBQUEsb0NBQXFCLEVBQUMsRUFBRSxDQUFDLENBQUM7QUFDL0MsTUFBTSxtQkFBbUIsR0FBd0IsSUFBSSxHQUFHLENBQUM7SUFDdkQsT0FBTztJQUNQLFNBQVM7SUFDVCxTQUFTO0lBQ1QsTUFBTTtJQUNOLFFBQVE7SUFDUixRQUFRO0lBQ1IsUUFBUTtDQUNULENBQUMsQ0FBQztBQUVILFNBQVMsb0JBQW9CLENBQUMsY0FBc0I7SUFDbEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxJQUFJLGNBQWMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNqRyxNQUFNLElBQUkscURBQXFELENBQzdELG1EQUFtRCxDQUNwRCxDQUFDO0lBQ0osQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxLQUF5QjtJQUM1QyxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDO0lBQzlCLE9BQU8sT0FBTyxPQUFPLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxNQUFNLElBQUksa0JBQWtCLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQ25HLENBQUM7QUFFRCxTQUFTLG1CQUFtQixDQUFDLEtBQXlCO0lBQ3BELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUM7SUFDeEMsSUFDRSxPQUFPLFlBQVksS0FBSyxRQUFRO1FBQ2hDLFlBQVksQ0FBQyxNQUFNLEdBQUcseUJBQXlCO1FBQy9DLHlCQUF5QixDQUFDLFlBQVksQ0FBQztRQUN2QyxDQUFDLElBQUEsc0NBQXVCLEVBQUMsWUFBWSxDQUFDLEVBQ3RDLENBQUM7UUFDRCxPQUFPLFlBQVksQ0FBQztJQUN0QixDQUFDO0lBQ0QsT0FBTyxJQUFBLG9DQUFxQixFQUFDLFlBQVksQ0FBQyxDQUFDO0FBQzdDLENBQUM7QUFFRCxTQUFTLHlCQUF5QixDQUFDLEtBQWE7SUFDOUMsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ3JELE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDekMsSUFBSSxRQUFRLElBQUksSUFBSSxJQUFJLFFBQVEsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUMxQyxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsU0FBUyxnQkFBZ0IsQ0FBQyxLQUFjO0lBQ3RDLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUTtRQUM5QixLQUFLLENBQUMsTUFBTSxJQUFJLCtCQUErQjtRQUMvQyxDQUFDLHlCQUF5QixDQUFDLEtBQUssQ0FBQztRQUNqQyxDQUFDLENBQUMsS0FBSztRQUNQLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDaEIsQ0FBQztBQUVELFNBQVMsYUFBYSxDQUFDLEtBQXlCLEVBQUUsSUFBWTtJQUM1RCxPQUFPLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDNUIsQ0FBQztBQUVELFNBQVMsMEJBQTBCLENBQ2pDLE9BQThCLEVBQzlCLEtBQXlCLEVBQ3pCLGFBQStFO0lBRS9FLE1BQU0sS0FBSyxHQUFHLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUNwRSxJQUFJLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN4QixPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsSUFBQSx3Q0FBeUIsRUFBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDNUQsT0FBTyxTQUFTLENBQUMsTUFBTSxJQUFJLHlCQUF5QixDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztBQUM3RSxDQUFDO0FBRUQsU0FBUyxrQkFBa0IsQ0FBQyxLQUFjO0lBQ3hDLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNyRSxDQUFDO0FBRUQsU0FBUyxZQUFZLENBQUMsS0FBeUI7SUFDN0MsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUMxQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUM5QixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztBQUNqQyxDQUFDO0FBRUQsU0FBUyx1QkFBdUIsQ0FBQyxLQUF5QixFQUFFLE9BQTJCO0lBQ3JGLElBQUksT0FBTyxLQUFLLGNBQWMsRUFBRSxDQUFDO1FBQy9CLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7SUFDcEMsT0FBTyxDQUNMLE9BQU8sVUFBVSxLQUFLLFFBQVE7UUFDOUIsVUFBVSxDQUFDLE1BQU0sSUFBSSx5QkFBeUI7UUFDOUMsaUNBQWlDLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUNuRCxDQUFDO0FBQ0osQ0FBQztBQUVELFNBQVMsYUFBYSxDQUFDLEtBQXlCO0lBQzlDLE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNuQyxNQUFNLGVBQWUsR0FBRyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUVuRCxRQUFRLE9BQU8sRUFBRSxDQUFDO1FBQ2hCLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQztZQUNaLE1BQU0sUUFBUSxHQUFHLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNyQyxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQ25CLElBQUksRUFBRSxtQ0FBMkIsQ0FBQyxJQUFJO2dCQUN0QyxPQUFPLEVBQUUsZUFBZTtnQkFDeEIsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQ2xDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxLQUFLLE9BQU8sQ0FBQztRQUNiLEtBQUssYUFBYTtZQUNoQixPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQ25CLElBQUksRUFBRSxtQ0FBMkIsQ0FBQyxVQUFVO2dCQUM1QyxPQUFPLEVBQUUsZUFBZTthQUN6QixDQUFDLENBQUM7UUFDTCxLQUFLLE1BQU07WUFDVCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQ25CLElBQUksRUFBRSxtQ0FBMkIsQ0FBQyxJQUFJO2dCQUN0QyxPQUFPLEVBQUUsZUFBZTthQUN6QixDQUFDLENBQUM7UUFDTCxLQUFLLHNCQUFzQjtZQUN6QixPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQ25CLElBQUksRUFBRSxtQ0FBMkIsQ0FBQyxtQkFBbUI7Z0JBQ3JELE9BQU8sRUFBRSwwQkFBMEIsQ0FBQyxlQUFlLEVBQUUsS0FBSyxFQUFFLG9CQUFvQixDQUFDO2FBQ2xGLENBQUMsQ0FBQztRQUNMLEtBQUssdUJBQXVCO1lBQzFCLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQztnQkFDbkIsSUFBSSxFQUFFLG1DQUEyQixDQUFDLG1CQUFtQjtnQkFDckQsT0FBTyxFQUFFLDBCQUEwQixDQUFDLGVBQWUsRUFBRSxLQUFLLEVBQUUscUJBQXFCLENBQUM7YUFDbkYsQ0FBQyxDQUFDO1FBQ0wsS0FBSyxVQUFVO1lBQ2IsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO2dCQUNuQixJQUFJLEVBQUUsbUNBQTJCLENBQUMsUUFBUTtnQkFDMUMsT0FBTyxFQUFFLDBCQUEwQixDQUFDLGVBQWUsRUFBRSxLQUFLLEVBQUUsaUJBQWlCLENBQUM7YUFDL0UsQ0FBQyxDQUFDO1FBQ0w7WUFDRSxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQ25CLElBQUksRUFBRSx1QkFBdUIsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDO29CQUMzQyxDQUFDLENBQUMsbUNBQTJCLENBQUMsVUFBVTtvQkFDeEMsQ0FBQyxDQUFDLG1DQUEyQixDQUFDLGtCQUFrQjtnQkFDbEQsT0FBTyxFQUFFLGVBQWU7YUFDekIsQ0FBQyxDQUFDO0lBQ1AsQ0FBQztBQUNILENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQixrQ0FBa0MsQ0FDaEQsTUFBd0QsRUFDeEQsY0FBc0I7SUFFdEIsb0JBQW9CLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDckMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUM1QixNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxjQUFjLENBQUMsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDcEUsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMvQyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsY0FBYyxFQUFFLENBQUM7UUFDbkMsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztBQUN2RSxDQUFDIn0=

package/dist/record-contract/canonical-json.d.ts

@@ -0,0 +1,20 @@
+import type { ContractJsonValue } from './types';
+export type RedboxCanonicalJsonErrorReason = 'accessor-property' | 'cycle' | 'non-enumerable-property' | 'non-finite-number' | 'non-json-type' | 'non-plain-object' | 'sparse-or-extended-array' | 'symbol-property';
+/** A value Redbox Canonical JSON v1 cannot represent without silently changing it. */
+export declare class RedboxCanonicalJsonError extends Error {
+    readonly reason: RedboxCanonicalJsonErrorReason;
+    readonly path: string;
+    constructor(reason: RedboxCanonicalJsonErrorReason, path: string, message: string);
+}
+/**
+ * Clone and validate a value using Redbox Canonical JSON format v1 rules.
+ *
+ * V1 accepts only ordinary JSON values, preserves array order, converts -0 to
+ * JSON's ordinary `0`, and orders object keys lexicographically by UTF-16 code
+ * units. It deliberately rejects every value JSON.stringify would omit or
+ * silently rewrite, as well as cycles, accessors, and non-plain objects.
+ */
+export declare function normalizeRedboxCanonicalJsonV1(value: unknown): ContractJsonValue;
+/** Serialize a value as Redbox Canonical JSON format v1. */
+export declare function serializeRedboxCanonicalJsonV1(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/record-contract/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../src/record-contract/canonical-json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGrE,MAAM,MAAM,8BAA8B,GACtC,mBAAmB,GACnB,OAAO,GACP,yBAAyB,GACzB,mBAAmB,GACnB,eAAe,GACf,kBAAkB,GAClB,0BAA0B,GAC1B,iBAAiB,CAAC;AAEtB,sFAAsF;AACtF,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,MAAM,EAAE,8BAA8B;aACtC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,8BAA8B,EACtC,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAwJD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAEhF;AAED,4DAA4D;AAC5D,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAErE"}