@stackonward/cli 0.0.1 → 1.0.1

package/dist/resources/templates/go-backend/internal/common/principal/principal.go

@@ -0,0 +1,49 @@
+// Package principal 提供 request-scoped 的用户解析上下文。
+//
+// Principal 是单一权益解析事实源（对齐 Stripe Entitlements / GitHub Permissions 模式）：
+// middleware.PrincipalContext 在 auth middleware 之后注入 Principal，handler 通过
+// principal.MustGet(c) / principal.Get(c) 读取，避免 5+ 个独立 read 路径不一致。
+package principal
+
+import (
+	"{{module}}/internal/common/types"
+)
+
+// Principal 当前请求解析后的用户主体投影。
+//
+// 设计原则：
+//   - 仅承载 backend 已 resolve 的 identity + 决策结果，不携带 entitlement bag
+//   - entitlement limits（如 credit_discount_rate）按需懒加载，由各 service 自己调
+//     EntitlementService.GetLimit / DiscountResolver，避免 middleware 冷启 RPC 风暴
+//   - UserID == 0 表示匿名，ContentAccess 仍由公开策略链按请求上下文解析
+type Principal struct {
+	// UserID 当前请求用户 ID，0 表示匿名
+	UserID int64
+	// ProductCode 当前请求产品标识，来源 X-Product-Code
+	ProductCode types.Product
+	// ContentAccess 用户当前内容访问决策快照
+	ContentAccess ContentAccess
+}
+
+// ContentAccess 用户当前内容访问决策（来自 accessPolicy.ResolveContentAccess）。
+//
+// 仅保留 backend 业务实际消费的内容访问决策字段。
+type ContentAccess struct {
+	// Level 有效访问等级（0=合规, 50=mature, 80=sensitive, 100=unrestricted）
+	Level int64
+	// Rating 派生评级（compliant / mature / sensitive / unrestricted）
+	Rating string
+	// Decision 决策（allow / deny / cap）
+	Decision string
+	// Source 来源（default / lifetime_purchase / subscription / policy / ...）
+	Source string
+	// RuleCode 命中的策略 rule code（可空）
+	RuleCode string
+	// ReasonCode 原因码（可空，违规时填 prompt_policy_violation 等）
+	ReasonCode string
+}
+
+// IsAuthenticated 判断 Principal 是否对应已登录用户。
+func (p *Principal) IsAuthenticated() bool {
+	return p != nil && p.UserID > 0
+}

package/dist/resources/templates/go-backend/internal/common/productcode/code.go

@@ -0,0 +1,24 @@
+package productcode
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+var pattern = regexp.MustCompile(`^[a-z][a-z0-9_-]{0,49}$`)
+
+// Normalize 校验并返回跨模块稳定的 Product 编码。
+func Normalize(value string) (string, error) {
+	normalized := strings.TrimSpace(value)
+	if !pattern.MatchString(normalized) {
+		return "", fmt.Errorf("product code must match %s", pattern.String())
+	}
+	return normalized, nil
+}
+
+// Validate 校验跨模块稳定的 Product 编码。
+func Validate(value string) error {
+	_, err := Normalize(value)
+	return err
+}

package/dist/resources/templates/go-backend/internal/common/productcode/code_test.go

@@ -0,0 +1,35 @@
+package productcode
+
+import "testing"
+
+func TestNormalize(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		value   string
+		want    string
+		wantErr bool
+	}{
+		{name: "single character", value: "a", want: "a"},
+		{name: "underscore and hyphen", value: " product_alpha-v2 ", want: "product_alpha-v2"},
+		{name: "uppercase", value: "Product", wantErr: true},
+		{name: "leading digit", value: "1product", wantErr: true},
+		{name: "too long", value: "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxy", wantErr: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := Normalize(test.value)
+			if test.wantErr {
+				if err == nil {
+					t.Fatalf("Normalize(%q) expected error", test.value)
+				}
+				return
+			}
+			if err != nil || got != test.want {
+				t.Fatalf("Normalize(%q) = %q, %v; want %q", test.value, got, err, test.want)
+			}
+		})
+	}
+}

package/dist/resources/templates/go-backend/internal/common/providerconfig/schema.go

@@ -0,0 +1,577 @@
+package providerconfig
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	corecrypto "{{module}}/internal/core/crypto"
+)
+
+// ValueType 描述 provider 配置字段的 JSON 值类型。
+type ValueType string
+
+const (
+	ValueTypeString  ValueType = "string"
+	ValueTypeBoolean ValueType = "boolean"
+	ValueTypeInteger ValueType = "integer"
+	ValueTypeJSON    ValueType = "json"
+)
+
+// ValueTypes 返回 provider 配置字段类型 canonical 集合。
+func ValueTypes() []string {
+	return []string{
+		string(ValueTypeString),
+		string(ValueTypeBoolean),
+		string(ValueTypeInteger),
+		string(ValueTypeJSON),
+	}
+}
+
+// ValidationFormat 描述 provider 配置字段的标准格式约束。
+type ValidationFormat string
+
+const (
+	ValidationFormatURL      ValidationFormat = "url"
+	ValidationFormatDuration ValidationFormat = "duration"
+	ValidationFormatPEM      ValidationFormat = "pem"
+	ValidationFormatBase64   ValidationFormat = "base64"
+	ValidationFormatE164     ValidationFormat = "e164"
+)
+
+// ValidationFormats 返回非空格式约束的 canonical 集合。
+func ValidationFormats() []string {
+	return []string{
+		string(ValidationFormatURL),
+		string(ValidationFormatDuration),
+		string(ValidationFormatPEM),
+		string(ValidationFormatBase64),
+		string(ValidationFormatE164),
+	}
+}
+
+// FieldValidation 描述 provider 配置字段的机器可读约束。
+type FieldValidation struct {
+	Format           ValidationFormat `json:"format,omitempty"`
+	Pattern          string           `json:"pattern,omitempty"`
+	MinLength        *int             `json:"min_length,omitempty"`
+	MaxLength        *int             `json:"max_length,omitempty"`
+	MinValue         *int64           `json:"min_value,omitempty"`
+	MaxValue         *int64           `json:"max_value,omitempty"`
+	AllowedValues    []string         `json:"allowed_values,omitempty"`
+	RequiredJSONKeys []string         `json:"required_json_keys,omitempty"`
+}
+
+// Field 描述 provider 配置中的单个字段。
+type Field struct {
+	Key         string          `json:"key"`
+	Label       string          `json:"label"`
+	ValueType   ValueType       `json:"value_type"`
+	Required    bool            `json:"required"`
+	Secret      bool            `json:"secret"`
+	Sensitive   bool            `json:"sensitive"`
+	Multiline   bool            `json:"multiline,omitempty"`
+	Placeholder string          `json:"placeholder,omitempty"`
+	Description string          `json:"description,omitempty"`
+	Validation  FieldValidation `json:"validation,omitempty"`
+}
+
+// InputSource 标识配置错误来自公开配置或加密密钥输入。
+type InputSource string
+
+const (
+	InputSourceConfig  InputSource = "config"
+	InputSourceSecrets InputSource = "secrets"
+)
+
+// InputSources 返回配置输入来源的 canonical 集合。
+func InputSources() []string {
+	return []string{
+		string(InputSourceConfig),
+		string(InputSourceSecrets),
+	}
+}
+
+// InputError 描述可由领域层映射的字段输入错误。
+type InputError struct {
+	Source  InputSource
+	Field   string
+	Problem string
+}
+
+// Error 返回不包含字段值的稳定错误描述。
+func (e *InputError) Error() string {
+	if e.Field == "" {
+		return fmt.Sprintf("%s %s", e.Source, e.Problem)
+	}
+	return fmt.Sprintf("%s field %q %s", e.Source, e.Field, e.Problem)
+}
+
+// ValidationOptions 控制完整配置和局部配置的必填语义。
+type ValidationOptions struct {
+	RequireRequired           bool
+	RejectEmptyOptionalSecret bool
+}
+
+// ValidatedConfiguration 保存校验并归一化后的配置输入。
+type ValidatedConfiguration struct {
+	Config  json.RawMessage
+	Secrets map[string]string
+}
+
+// ValidateDefinition 校验字段 schema 的业务无关约束。
+func ValidateDefinition(fields []Field) error {
+	seenFields := make(map[string]struct{}, len(fields))
+	for _, field := range fields {
+		if strings.TrimSpace(field.Key) == "" {
+			return fmt.Errorf("schema contains empty field key")
+		}
+		if field.Key != strings.TrimSpace(field.Key) {
+			return fmt.Errorf("schema contains non-canonical field key %q", field.Key)
+		}
+		if _, exists := seenFields[field.Key]; exists {
+			return fmt.Errorf("schema contains duplicate field %q", field.Key)
+		}
+		seenFields[field.Key] = struct{}{}
+		if strings.TrimSpace(field.Label) == "" {
+			return fmt.Errorf("field %q requires label", field.Key)
+		}
+		if err := validateFieldDefinition(field); err != nil {
+			return fmt.Errorf("field %q definition is invalid: %w", field.Key, err)
+		}
+	}
+	return nil
+}
+
+// ValidateConfiguration 校验并归一化公开配置与加密密钥输入。
+func ValidateConfiguration(
+	fields []Field,
+	secrets map[string]string,
+	config json.RawMessage,
+	options ValidationOptions,
+) (*ValidatedConfiguration, error) {
+	if err := ValidateDefinition(fields); err != nil {
+		return nil, err
+	}
+	configValues, _, err := DecodeObject(config)
+	if err != nil {
+		return nil, inputError(InputSourceConfig, "", fmt.Sprintf("must be a JSON object: %v", err))
+	}
+
+	fieldsByKey := make(map[string]Field, len(fields))
+	for _, field := range fields {
+		fieldsByKey[field.Key] = field
+	}
+	for _, key := range sortedMapKeys(configValues) {
+		field, ok := fieldsByKey[key]
+		if !ok {
+			return nil, inputError(InputSourceConfig, key, "is not defined")
+		}
+		if field.Secret {
+			return nil, inputError(InputSourceConfig, key, "must be supplied through secrets")
+		}
+	}
+	for _, key := range sortedMapKeys(secrets) {
+		field, ok := fieldsByKey[key]
+		if !ok {
+			return nil, inputError(InputSourceSecrets, key, "is not defined")
+		}
+		if !field.Secret {
+			return nil, inputError(InputSourceSecrets, key, "must be supplied through config")
+		}
+		if options.RejectEmptyOptionalSecret && !field.Required && strings.TrimSpace(secrets[key]) == "" {
+			return nil, inputError(InputSourceSecrets, key, "must not be empty")
+		}
+	}
+	if options.RequireRequired {
+		for _, field := range fields {
+			if !field.Required {
+				continue
+			}
+			if field.Secret {
+				value, present := secrets[field.Key]
+				if !present || strings.TrimSpace(value) == "" {
+					return nil, inputError(InputSourceSecrets, field.Key, "is required")
+				}
+				continue
+			}
+			value, present := configValues[field.Key]
+			if !present || IsEmptyValue(value) {
+				return nil, inputError(InputSourceConfig, field.Key, "is required")
+			}
+		}
+	}
+
+	normalizedSecrets := make(map[string]string, len(secrets))
+	for _, field := range fields {
+		if field.Secret {
+			value, present := secrets[field.Key]
+			if !present || strings.TrimSpace(value) == "" {
+				continue
+			}
+			normalizedValue, normalizeErr := normalizeSecretValue(field, value)
+			if normalizeErr != nil {
+				return nil, inputError(InputSourceSecrets, field.Key, fmt.Sprintf("is invalid: %v", normalizeErr))
+			}
+			validationValue := any(normalizedValue)
+			if field.ValueType == ValueTypeJSON {
+				validationValue, normalizeErr = decodeJSONValue(normalizedValue)
+				if normalizeErr != nil {
+					return nil, inputError(InputSourceSecrets, field.Key, fmt.Sprintf("is invalid: %v", normalizeErr))
+				}
+			}
+			if err := validateFieldValue(field, validationValue); err != nil {
+				return nil, inputError(InputSourceSecrets, field.Key, fmt.Sprintf("is invalid: %v", err))
+			}
+			normalizedSecrets[field.Key] = normalizedValue
+			continue
+		}
+
+		value, present := configValues[field.Key]
+		if !present {
+			continue
+		}
+		normalizedValue, normalizeErr := normalizeConfigurationValue(field, value)
+		if normalizeErr != nil {
+			return nil, inputError(InputSourceConfig, field.Key, fmt.Sprintf("is invalid: %v", normalizeErr))
+		}
+		if err := validateFieldValue(field, normalizedValue); err != nil {
+			return nil, inputError(InputSourceConfig, field.Key, fmt.Sprintf("is invalid: %v", err))
+		}
+		configValues[field.Key] = normalizedValue
+	}
+
+	normalizedConfig := json.RawMessage{}
+	if len(configValues) > 0 {
+		normalizedConfig, err = json.Marshal(configValues)
+		if err != nil {
+			return nil, fmt.Errorf("normalize provider config: %w", err)
+		}
+	}
+	return &ValidatedConfiguration{Config: normalizedConfig, Secrets: normalizedSecrets}, nil
+}
+
+// DecodeObject 把单个 JSON 对象解码为可归一化字段映射。
+func DecodeObject(raw json.RawMessage) (map[string]any, json.RawMessage, error) {
+	trimmed := bytes.TrimSpace(raw)
+	if len(trimmed) == 0 {
+		return map[string]any{}, json.RawMessage{}, nil
+	}
+	if bytes.Equal(trimmed, []byte("null")) {
+		return nil, nil, fmt.Errorf("config must be a JSON object")
+	}
+	decoder := json.NewDecoder(bytes.NewReader(trimmed))
+	decoder.UseNumber()
+	var value map[string]any
+	if err := decoder.Decode(&value); err != nil {
+		return nil, nil, err
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		if err == nil {
+			return nil, nil, fmt.Errorf("config must contain one JSON object")
+		}
+		return nil, nil, err
+	}
+	if value == nil {
+		return map[string]any{}, json.RawMessage{}, nil
+	}
+	normalized, err := json.Marshal(value)
+	if err != nil {
+		return nil, nil, err
+	}
+	return value, normalized, nil
+}
+
+// CloneFields 返回不共享 slice 或指针约束的字段副本。
+func CloneFields(fields []Field) []Field {
+	cloned := make([]Field, len(fields))
+	for i := range fields {
+		cloned[i] = fields[i]
+		validation := fields[i].Validation
+		if validation.MinLength != nil {
+			value := *validation.MinLength
+			cloned[i].Validation.MinLength = &value
+		}
+		if validation.MaxLength != nil {
+			value := *validation.MaxLength
+			cloned[i].Validation.MaxLength = &value
+		}
+		if validation.MinValue != nil {
+			value := *validation.MinValue
+			cloned[i].Validation.MinValue = &value
+		}
+		if validation.MaxValue != nil {
+			value := *validation.MaxValue
+			cloned[i].Validation.MaxValue = &value
+		}
+		cloned[i].Validation.AllowedValues = append([]string(nil), validation.AllowedValues...)
+		cloned[i].Validation.RequiredJSONKeys = append([]string(nil), validation.RequiredJSONKeys...)
+	}
+	return cloned
+}
+
+// IsEmptyValue 判断必填字段是否为空。
+func IsEmptyValue(value any) bool {
+	if value == nil {
+		return true
+	}
+	text, ok := value.(string)
+	return ok && strings.TrimSpace(text) == ""
+}
+
+func validateFieldDefinition(field Field) error {
+	switch field.ValueType {
+	case ValueTypeString, ValueTypeBoolean, ValueTypeInteger, ValueTypeJSON:
+	default:
+		return fmt.Errorf("unsupported value type %q", field.ValueType)
+	}
+	if field.Validation.MinLength != nil && *field.Validation.MinLength < 0 {
+		return fmt.Errorf("min_length must be non-negative")
+	}
+	if field.Validation.MaxLength != nil && *field.Validation.MaxLength < 0 {
+		return fmt.Errorf("max_length must be non-negative")
+	}
+	if field.Validation.MinLength != nil && field.Validation.MaxLength != nil && *field.Validation.MinLength > *field.Validation.MaxLength {
+		return fmt.Errorf("min_length must not exceed max_length")
+	}
+	if field.Validation.MinValue != nil && field.Validation.MaxValue != nil && *field.Validation.MinValue > *field.Validation.MaxValue {
+		return fmt.Errorf("min_value must not exceed max_value")
+	}
+	if field.Validation.Pattern != "" {
+		if _, err := regexp.Compile(field.Validation.Pattern); err != nil {
+			return fmt.Errorf("compile pattern: %w", err)
+		}
+	}
+	switch field.Validation.Format {
+	case "", ValidationFormatURL, ValidationFormatDuration, ValidationFormatPEM, ValidationFormatBase64, ValidationFormatE164:
+	default:
+		return fmt.Errorf("unsupported validation format %q", field.Validation.Format)
+	}
+	if field.ValueType != ValueTypeString &&
+		(field.Validation.Format != "" || field.Validation.Pattern != "" || field.Validation.MinLength != nil || field.Validation.MaxLength != nil || len(field.Validation.AllowedValues) > 0) {
+		return fmt.Errorf("string validation requires string value type")
+	}
+	if field.ValueType != ValueTypeInteger && (field.Validation.MinValue != nil || field.Validation.MaxValue != nil) {
+		return fmt.Errorf("numeric validation requires integer value type")
+	}
+	if field.Secret && field.ValueType != ValueTypeString && field.ValueType != ValueTypeJSON {
+		return fmt.Errorf("secret fields require string or json value type")
+	}
+	if len(field.Validation.RequiredJSONKeys) > 0 && field.ValueType != ValueTypeJSON {
+		return fmt.Errorf("required_json_keys requires json value type")
+	}
+	if err := validateUniqueStrings(field.Validation.AllowedValues, "allowed value"); err != nil {
+		return err
+	}
+	if err := validateUniqueStrings(field.Validation.RequiredJSONKeys, "required JSON key"); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateFieldValue(field Field, value any) error {
+	var text string
+	switch field.ValueType {
+	case ValueTypeString:
+		typed, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("must be a string")
+		}
+		text = strings.TrimSpace(typed)
+	case ValueTypeBoolean:
+		if _, ok := value.(bool); !ok {
+			return fmt.Errorf("must be a boolean")
+		}
+		return nil
+	case ValueTypeInteger:
+		number, err := integerValue(value)
+		if err != nil {
+			return err
+		}
+		if field.Validation.MinValue != nil && number < *field.Validation.MinValue {
+			return fmt.Errorf("must be at least %d", *field.Validation.MinValue)
+		}
+		if field.Validation.MaxValue != nil && number > *field.Validation.MaxValue {
+			return fmt.Errorf("must be at most %d", *field.Validation.MaxValue)
+		}
+		return nil
+	case ValueTypeJSON:
+		if value == nil {
+			return fmt.Errorf("must contain valid JSON")
+		}
+		if len(field.Validation.RequiredJSONKeys) > 0 {
+			object, ok := value.(map[string]any)
+			if !ok {
+				return fmt.Errorf("must contain a JSON object")
+			}
+			for _, key := range field.Validation.RequiredJSONKeys {
+				nested, exists := object[key]
+				if !exists || IsEmptyValue(nested) {
+					return fmt.Errorf("must contain required JSON key %q", key)
+				}
+			}
+		}
+		return nil
+	default:
+		return fmt.Errorf("uses unsupported value type %q", field.ValueType)
+	}
+
+	length := utf8.RuneCountInString(text)
+	if field.Validation.MinLength != nil && length < *field.Validation.MinLength {
+		return fmt.Errorf("length must be at least %d", *field.Validation.MinLength)
+	}
+	if field.Validation.MaxLength != nil && length > *field.Validation.MaxLength {
+		return fmt.Errorf("length must be at most %d", *field.Validation.MaxLength)
+	}
+	if len(field.Validation.AllowedValues) > 0 && !containsString(field.Validation.AllowedValues, text) {
+		return fmt.Errorf("must be one of the allowed values")
+	}
+	if field.Validation.Pattern != "" && !regexp.MustCompile(field.Validation.Pattern).MatchString(text) {
+		return fmt.Errorf("does not match the required pattern")
+	}
+	switch field.Validation.Format {
+	case "":
+		return nil
+	case ValidationFormatURL:
+		parsed, err := url.ParseRequestURI(text)
+		if err != nil || parsed.Host == "" || (parsed.Scheme != "http" && parsed.Scheme != "https") {
+			return fmt.Errorf("must be an absolute HTTP URL")
+		}
+	case ValidationFormatDuration:
+		duration, err := time.ParseDuration(text)
+		if err != nil || duration <= 0 {
+			return fmt.Errorf("must be a positive Go duration")
+		}
+	case ValidationFormatPEM:
+		if _, err := corecrypto.NormalizePEM(text); err != nil {
+			return err
+		}
+	case ValidationFormatBase64:
+		if _, err := base64.StdEncoding.DecodeString(text); err != nil {
+			return fmt.Errorf("must be standard base64")
+		}
+	case ValidationFormatE164:
+		if !regexp.MustCompile(`^\+[1-9][0-9]{7,14}$`).MatchString(text) {
+			return fmt.Errorf("must be an E.164 phone number")
+		}
+	}
+	return nil
+}
+
+func integerValue(value any) (int64, error) {
+	switch typed := value.(type) {
+	case json.Number:
+		parsed, err := typed.Int64()
+		if err != nil {
+			return 0, fmt.Errorf("must be an integer")
+		}
+		return parsed, nil
+	case float64:
+		if typed != float64(int64(typed)) {
+			return 0, fmt.Errorf("must be an integer")
+		}
+		return int64(typed), nil
+	default:
+		return 0, fmt.Errorf("must be an integer")
+	}
+}
+
+func normalizeConfigurationValue(field Field, value any) (any, error) {
+	switch field.ValueType {
+	case ValueTypeString:
+		text, ok := value.(string)
+		if !ok {
+			return value, nil
+		}
+		if field.Validation.Format == ValidationFormatPEM {
+			return corecrypto.NormalizePEM(text)
+		}
+		return strings.TrimSpace(text), nil
+	case ValueTypeJSON:
+		text, ok := value.(string)
+		if !ok {
+			return value, nil
+		}
+		return decodeJSONValue(text)
+	default:
+		return value, nil
+	}
+}
+
+func normalizeSecretValue(field Field, value string) (string, error) {
+	if field.ValueType != ValueTypeJSON {
+		if field.Validation.Format == ValidationFormatPEM {
+			return corecrypto.NormalizePEM(value)
+		}
+		return strings.TrimSpace(value), nil
+	}
+	parsed, err := decodeJSONValue(value)
+	if err != nil {
+		return "", err
+	}
+	encoded, err := json.Marshal(parsed)
+	if err != nil {
+		return "", fmt.Errorf("must contain valid JSON")
+	}
+	return string(encoded), nil
+}
+
+func decodeJSONValue(value string) (any, error) {
+	decoder := json.NewDecoder(strings.NewReader(value))
+	decoder.UseNumber()
+	var parsed any
+	if err := decoder.Decode(&parsed); err != nil {
+		return nil, fmt.Errorf("must contain valid JSON")
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		return nil, fmt.Errorf("must contain one JSON value")
+	}
+	return parsed, nil
+}
+
+func inputError(source InputSource, field, problem string) error {
+	return &InputError{Source: source, Field: field, Problem: problem}
+}
+
+func containsString(values []string, target string) bool {
+	for _, value := range values {
+		if value == target {
+			return true
+		}
+	}
+	return false
+}
+
+func validateUniqueStrings(values []string, label string) error {
+	seen := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		if strings.TrimSpace(value) == "" {
+			return fmt.Errorf("%s must not be empty", label)
+		}
+		if value != strings.TrimSpace(value) {
+			return fmt.Errorf("%s %q must be canonical", label, value)
+		}
+		if _, exists := seen[value]; exists {
+			return fmt.Errorf("duplicate %s %q", label, value)
+		}
+		seen[value] = struct{}{}
+	}
+	return nil
+}
+
+func sortedMapKeys[V any](values map[string]V) []string {
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}