@vertesia/common 1.5.0-dev.20260722.120446Z → 1.5.0-dev.20260804.124748Z

package/lib/access-control-values.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Access-control values that exist at runtime — the enums and the scope list.
+ *
+ * Split out of `access-control.ts` and `roles/types.ts` for the same reason `account-values.ts` was
+ * split out of `user.ts`: the API schemas need these values (`z.enum(Permission)`,
+ * `z.enum(AbacScopes)`) while those two modules need the types the schemas infer. Keeping them where
+ * they were would make each import a module that imports it back; here, both sides depend on this
+ * module and nothing depends on them.
+ *
+ * Everything is re-exported from its original module, so existing import paths keep working — this
+ * is a move, not a rename.
+ */
+export declare enum Permission {
+    int_read = "interaction:read",
+    int_write = "interaction:write",
+    int_delete = "interaction:delete",
+    int_execute = "interaction:execute",
+    run_read = "run:read",
+    run_write = "run:write",
+    env_admin = "environment:admin",
+    app_manage = "app:manage",
+    project_admin = "project:admin",
+    project_integration_read = "project:integration_read",
+    project_settings_write = "project:settings_write",
+    api_key_create = "api_key:create",
+    api_key_read = "api_key:read",
+    api_key_secret_read = "api_key:secret_read",
+    api_key_update = "api_key:update",
+    api_key_delete = "api_key:delete",
+    account_read = "account:read",
+    account_write = "account:write",
+    account_admin = "account:admin",
+    manage_billing = "account:billing",
+    /** View cost and usage analytics */
+    billing_read = "billing:read",
+    /** View account and project audit events. */
+    audit_read = "audit:read",
+    account_member = "account:member",
+    content_read = "content:read",
+    content_read_all = "content:read_all",
+    content_write = "content:write",
+    content_delete = "content:delete",
+    content_admin = "content:admin",//manage schemas
+    content_superadmin = "content:superadmin",// list all objects and collections
+    workflow_read = "workflow:read",
+    workflow_run = "workflow:run",
+    workflow_admin = "workflow:admin",
+    workflow_superadmin = "workflow:superadmin",
+    agent_run_read = "agent_run:read",
+    task_read = "task:read",
+    task_manage = "task:manage",
+    iam_impersonate = "iam:impersonate",
+    /** whether the user has access to Sutdio App. */
+    studio_access = "studio:access"
+}
+export declare enum AccessControlResourceType {
+    project = "project",
+    environment = "environment",
+    account = "account",
+    interaction = "interaction",
+    app = "application",
+    /**
+     * Dynamic resource matching by property conditions at query time. The role
+     * partitions (content, future tasks/etc.) determine which kind of object
+     * the conditions match — selected via `AceConditions.scope`.
+     *
+     * NOTE: the string value remains `'content_set'` for backward compatibility
+     * with stored ACEs and JWTs. The wire/DB rename to `'resource_set'` is a
+     * separate concern (deferred). Until then, code reads
+     * `AccessControlResourceType.resource_set` but the value on the wire stays
+     * `'content_set'`.
+     */
+    resource_set = "content_set"
+}
+export declare enum AccessControlPrincipalType {
+    user = "user",
+    group = "group",
+    apikey = "apikey",
+    /** Dynamic principal matching by user/group properties at token time. */
+    principal_set = "principal_set"
+}
+/**
+ * Kind of object a ResourceSet's `resource_props` matches at query time. Used
+ * in `AceConditions.scope` (validated at runtime against this list) and as
+ * the prefix in JWT `content_security` keys (e.g. `collection:read`).
+ *
+ * Each scope is owned by exactly one partition. When adding a new partition
+ * (e.g. tasks), extend this list with the new scope(s) AND extend `RoleDomain`
+ * with the new domain.
+ */
+export declare const AbacScopes: readonly ["document", "collection", "task"];
+/**
+ * Logical grouping of roles by the service area that owns them. Declared as a
+ * runtime list so the role schemas can publish it as an enum component; the
+ * `RoleDomain` type is inferred from it in `roles/types.ts`.
+ */
+export declare const RoleDomains: readonly ["system", "content", "tasks"];
+//# sourceMappingURL=access-control-values.d.ts.map

package/lib/access-control-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control-values.d.ts","sourceRoot":"","sources":["../src/access-control-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,oBAAY,UAAU;IAClB,QAAQ,qBAAqB;IAC7B,SAAS,sBAAsB;IAC/B,UAAU,uBAAuB;IAEjC,WAAW,wBAAwB;IACnC,QAAQ,aAAa;IACrB,SAAS,cAAc;IAEvB,SAAS,sBAAsB;IAE/B,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,wBAAwB,6BAA6B;IACrD,sBAAsB,2BAA2B;IAEjD,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IAEjC,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,cAAc,oBAAoB;IAClC,oCAAoC;IACpC,YAAY,iBAAiB;IAC7B,6CAA6C;IAC7C,UAAU,eAAe;IACzB,cAAc,mBAAmB;IAEjC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB,CAAE,gBAAgB;IACjD,kBAAkB,uBAAuB,CAAE,mCAAmC;IAE9E,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;IAE3C,cAAc,mBAAmB;IAEjC,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAE3B,eAAe,oBAAoB;IAEnC,iDAAiD;IACjD,aAAa,kBAAkB;CAClC;AAED,oBAAY,yBAAyB;IACjC,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,GAAG,gBAAgB;IACnB;;;;;;;;;;OAUG;IACH,YAAY,gBAAgB;CAC/B;AAED,oBAAY,0BAA0B;IAClC,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,yEAAyE;IACzE,aAAa,kBAAkB;CAClC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,6CAA8C,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,WAAW,yCAA0C,CAAC"}

package/lib/access-control-values.js

@@ -0,0 +1,101 @@
+/**
+ * Access-control values that exist at runtime — the enums and the scope list.
+ *
+ * Split out of `access-control.ts` and `roles/types.ts` for the same reason `account-values.ts` was
+ * split out of `user.ts`: the API schemas need these values (`z.enum(Permission)`,
+ * `z.enum(AbacScopes)`) while those two modules need the types the schemas infer. Keeping them where
+ * they were would make each import a module that imports it back; here, both sides depend on this
+ * module and nothing depends on them.
+ *
+ * Everything is re-exported from its original module, so existing import paths keep working — this
+ * is a move, not a rename.
+ */
+export var Permission;
+(function (Permission) {
+    Permission["int_read"] = "interaction:read";
+    Permission["int_write"] = "interaction:write";
+    Permission["int_delete"] = "interaction:delete";
+    Permission["int_execute"] = "interaction:execute";
+    Permission["run_read"] = "run:read";
+    Permission["run_write"] = "run:write";
+    Permission["env_admin"] = "environment:admin";
+    Permission["app_manage"] = "app:manage";
+    Permission["project_admin"] = "project:admin";
+    Permission["project_integration_read"] = "project:integration_read";
+    Permission["project_settings_write"] = "project:settings_write";
+    Permission["api_key_create"] = "api_key:create";
+    Permission["api_key_read"] = "api_key:read";
+    Permission["api_key_secret_read"] = "api_key:secret_read";
+    Permission["api_key_update"] = "api_key:update";
+    Permission["api_key_delete"] = "api_key:delete";
+    Permission["account_read"] = "account:read";
+    Permission["account_write"] = "account:write";
+    Permission["account_admin"] = "account:admin";
+    Permission["manage_billing"] = "account:billing";
+    /** View cost and usage analytics */
+    Permission["billing_read"] = "billing:read";
+    /** View account and project audit events. */
+    Permission["audit_read"] = "audit:read";
+    Permission["account_member"] = "account:member";
+    Permission["content_read"] = "content:read";
+    Permission["content_read_all"] = "content:read_all";
+    Permission["content_write"] = "content:write";
+    Permission["content_delete"] = "content:delete";
+    Permission["content_admin"] = "content:admin";
+    Permission["content_superadmin"] = "content:superadmin";
+    Permission["workflow_read"] = "workflow:read";
+    Permission["workflow_run"] = "workflow:run";
+    Permission["workflow_admin"] = "workflow:admin";
+    Permission["workflow_superadmin"] = "workflow:superadmin";
+    Permission["agent_run_read"] = "agent_run:read";
+    Permission["task_read"] = "task:read";
+    Permission["task_manage"] = "task:manage";
+    Permission["iam_impersonate"] = "iam:impersonate";
+    /** whether the user has access to Sutdio App. */
+    Permission["studio_access"] = "studio:access";
+})(Permission || (Permission = {}));
+export var AccessControlResourceType;
+(function (AccessControlResourceType) {
+    AccessControlResourceType["project"] = "project";
+    AccessControlResourceType["environment"] = "environment";
+    AccessControlResourceType["account"] = "account";
+    AccessControlResourceType["interaction"] = "interaction";
+    AccessControlResourceType["app"] = "application";
+    /**
+     * Dynamic resource matching by property conditions at query time. The role
+     * partitions (content, future tasks/etc.) determine which kind of object
+     * the conditions match — selected via `AceConditions.scope`.
+     *
+     * NOTE: the string value remains `'content_set'` for backward compatibility
+     * with stored ACEs and JWTs. The wire/DB rename to `'resource_set'` is a
+     * separate concern (deferred). Until then, code reads
+     * `AccessControlResourceType.resource_set` but the value on the wire stays
+     * `'content_set'`.
+     */
+    AccessControlResourceType["resource_set"] = "content_set";
+})(AccessControlResourceType || (AccessControlResourceType = {}));
+export var AccessControlPrincipalType;
+(function (AccessControlPrincipalType) {
+    AccessControlPrincipalType["user"] = "user";
+    AccessControlPrincipalType["group"] = "group";
+    AccessControlPrincipalType["apikey"] = "apikey";
+    /** Dynamic principal matching by user/group properties at token time. */
+    AccessControlPrincipalType["principal_set"] = "principal_set";
+})(AccessControlPrincipalType || (AccessControlPrincipalType = {}));
+/**
+ * Kind of object a ResourceSet's `resource_props` matches at query time. Used
+ * in `AceConditions.scope` (validated at runtime against this list) and as
+ * the prefix in JWT `content_security` keys (e.g. `collection:read`).
+ *
+ * Each scope is owned by exactly one partition. When adding a new partition
+ * (e.g. tasks), extend this list with the new scope(s) AND extend `RoleDomain`
+ * with the new domain.
+ */
+export const AbacScopes = ['document', 'collection', 'task'];
+/**
+ * Logical grouping of roles by the service area that owns them. Declared as a
+ * runtime list so the role schemas can publish it as an enum component; the
+ * `RoleDomain` type is inferred from it in `roles/types.ts`.
+ */
+export const RoleDomains = ['system', 'content', 'tasks'];
+//# sourceMappingURL=access-control-values.js.map

package/lib/access-control-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control-values.js","sourceRoot":"","sources":["../src/access-control-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAN,IAAY,UAqDX;AArDD,WAAY,UAAU;IAClB,2CAA6B,CAAA;IAC7B,6CAA+B,CAAA;IAC/B,+CAAiC,CAAA;IAEjC,iDAAmC,CAAA;IACnC,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IAEvB,6CAA+B,CAAA;IAE/B,uCAAyB,CAAA;IACzB,6CAA+B,CAAA;IAC/B,mEAAqD,CAAA;IACrD,+DAAiD,CAAA;IAEjD,+CAAiC,CAAA;IACjC,2CAA6B,CAAA;IAC7B,yDAA2C,CAAA;IAC3C,+CAAiC,CAAA;IACjC,+CAAiC,CAAA;IAEjC,2CAA6B,CAAA;IAC7B,6CAA+B,CAAA;IAC/B,6CAA+B,CAAA;IAC/B,gDAAkC,CAAA;IAClC,oCAAoC;IACpC,2CAA6B,CAAA;IAC7B,6CAA6C;IAC7C,uCAAyB,CAAA;IACzB,+CAAiC,CAAA;IAEjC,2CAA6B,CAAA;IAC7B,mDAAqC,CAAA;IACrC,6CAA+B,CAAA;IAC/B,+CAAiC,CAAA;IACjC,6CAA+B,CAAA;IAC/B,uDAAyC,CAAA;IAEzC,6CAA+B,CAAA;IAC/B,2CAA6B,CAAA;IAC7B,+CAAiC,CAAA;IACjC,yDAA2C,CAAA;IAE3C,+CAAiC,CAAA;IAEjC,qCAAuB,CAAA;IACvB,yCAA2B,CAAA;IAE3B,iDAAmC,CAAA;IAEnC,iDAAiD;IACjD,6CAA+B,CAAA;AACnC,CAAC,EArDW,UAAU,KAAV,UAAU,QAqDrB;AAED,MAAM,CAAN,IAAY,yBAkBX;AAlBD,WAAY,yBAAyB;IACjC,gDAAmB,CAAA;IACnB,wDAA2B,CAAA;IAC3B,gDAAmB,CAAA;IACnB,wDAA2B,CAAA;IAC3B,gDAAmB,CAAA;IACnB;;;;;;;;;;OAUG;IACH,yDAA4B,CAAA;AAChC,CAAC,EAlBW,yBAAyB,KAAzB,yBAAyB,QAkBpC;AAED,MAAM,CAAN,IAAY,0BAMX;AAND,WAAY,0BAA0B;IAClC,2CAAa,CAAA;IACb,6CAAe,CAAA;IACf,+CAAiB,CAAA;IACjB,yEAAyE;IACzE,6DAA+B,CAAA;AACnC,CAAC,EANW,0BAA0B,KAA1B,0BAA0B,QAMrC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAU,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC"}

package/lib/access-control.d.ts

@@ -1,78 +1,16 @@
+import type { z } from 'zod';
 /**
  * @module access-control
  * @description
  * Access control interfaces
  */
-import type { AbacScope } from './roles/types.js';
-export declare enum Permission {
-    int_read = "interaction:read",
-    int_write = "interaction:write",
-    int_delete = "interaction:delete",
-    int_execute = "interaction:execute",
-    run_read = "run:read",
-    run_write = "run:write",
-    env_admin = "environment:admin",
-    app_manage = "app:manage",
-    project_admin = "project:admin",
-    project_integration_read = "project:integration_read",
-    project_settings_write = "project:settings_write",
-    api_key_create = "api_key:create",
-    api_key_read = "api_key:read",
-    api_key_secret_read = "api_key:secret_read",
-    api_key_update = "api_key:update",
-    api_key_delete = "api_key:delete",
-    account_read = "account:read",
-    account_write = "account:write",
-    account_admin = "account:admin",
-    manage_billing = "account:billing",
-    /** View cost and usage analytics */
-    billing_read = "billing:read",
-    /** View account and project audit events. */
-    audit_read = "audit:read",
-    account_member = "account:member",
-    content_read = "content:read",
-    content_read_all = "content:read_all",
-    content_write = "content:write",
-    content_delete = "content:delete",
-    content_admin = "content:admin",//manage schemas
-    content_superadmin = "content:superadmin",// list all objects and collections
-    workflow_read = "workflow:read",
-    workflow_run = "workflow:run",
-    workflow_admin = "workflow:admin",
-    workflow_superadmin = "workflow:superadmin",
-    agent_run_read = "agent_run:read",
-    task_read = "task:read",
-    task_manage = "task:manage",
-    iam_impersonate = "iam:impersonate",
-    /** whether the user has access to Sutdio App. */
-    studio_access = "studio:access"
-}
-export declare enum AccessControlResourceType {
-    project = "project",
-    environment = "environment",
-    account = "account",
-    interaction = "interaction",
-    app = "application",
-    /**
-     * Dynamic resource matching by property conditions at query time. The role
-     * partitions (content, future tasks/etc.) determine which kind of object
-     * the conditions match — selected via `AceConditions.scope`.
-     *
-     * NOTE: the string value remains `'content_set'` for backward compatibility
-     * with stored ACEs and JWTs. The wire/DB rename to `'resource_set'` is a
-     * separate concern (deferred). Until then, code reads
-     * `AccessControlResourceType.resource_set` but the value on the wire stays
-     * `'content_set'`.
-     */
-    resource_set = "content_set"
-}
-export declare enum AccessControlPrincipalType {
-    user = "user",
-    group = "group",
-    apikey = "apikey",
-    /** Dynamic principal matching by user/group properties at token time. */
-    principal_set = "principal_set"
-}
+import type { AccessControlResourceType } from './access-control-values.js';
+import type { ACECreatePayloadSchema, ACEUpdatePayloadSchema, AccessControlEntrySchema, AceConditionsSchema, PropertyConditionsSchema, PropertyConditionValueSchema } from './api-schemas/access-control.js';
+/**
+ * The enums live in `./access-control-values.js` so the API schemas can consume them without
+ * importing this module back. Re-exported here so every existing import path keeps working.
+ */
+export * from './access-control-values.js';
 /**
  * MongoDB query syntax subset for matching properties.
  * Keys are property names, values are either direct match values or operator objects.
@@ -88,57 +26,22 @@ export declare enum AccessControlPrincipalType {
  * { region: { $in: ["us-east", "eu-west"] } }               // set membership (literal)
  * { security_level: { $lte: "$principal.access_level" } }   // cross-reference (resolved at token time)
  */
-/** A single condition value. Resolved and evaluated dynamically by token/content security code. */
-export type PropertyConditionValue = unknown;
-export type PropertyConditions = Record<string, PropertyConditionValue>;
+export type PropertyConditionValue = z.infer<typeof PropertyConditionValueSchema>;
+export type PropertyConditions = z.infer<typeof PropertyConditionsSchema>;
 /**
- * Conditions attached to an ACE for dynamic matching.
- * - `principal_props`: matched against user/group properties at token time (PrincipalSet).
- * - `resource_props`: matched against object properties at query time (ResourceSet).
+ * The access-control wire types, inferred from the schemas in `./api-schemas/access-control.js` —
+ * which are what OpenAPI publishes and AJV compiles. The field descriptions live there too, since
+ * Zod reads `.meta()` and not TSDoc.
+ *
+ * NOTE `conditions` carries ONLY the three fields it declares. The server stores two more there —
+ * `principal_name` / `resource_name`, see `IAceConditions` in `@dglabs/server-common` — and copies
+ * them into `principal` / `resource` on the way out. They are not part of this contract, and the
+ * response mappers drop them rather than serializing the sub-document.
  */
-export interface AceConditions {
-    /** Property conditions matched against user/group properties at token time (PrincipalSet). */
-    principal_props?: PropertyConditions;
-    /** Property conditions matched against object properties at query time (ResourceSet). */
-    resource_props?: PropertyConditions;
-    /**
-     * Kind of object the `resource_props` matches. Used to disambiguate which
-     * partition's roles apply (e.g. content roles vs task roles) and to form
-     * the JWT `content_security` key prefix (`{scope}:{verb}`). Absent →
-     * `'document'` (default; emits bare `read`/`write`/`delete` keys for
-     * backward compatibility).
-     */
-    scope?: AbacScope;
-}
-export interface AccessControlEntry {
-    /**
-     * Role name. Typed as `string` because role names now span multiple
-     * partitions: `SystemRoles` enum values for system-domain roles, and bare
-     * strings for ABAC-domain roles (e.g. `'content:reader'`,
-     * `'content:writer'`, `'content:manager'`). Mongoose schema validates the
-     * value against the registered role catalog via `getAllRoleNames()`.
-     */
-    role: string;
-    resource_type: AccessControlResourceType;
-    resource: string;
-    principal_type: AccessControlPrincipalType;
-    principal: string;
-    /** Account scope — required for principal_set/content_set ACEs. */
-    account?: string;
-    /** Project scope — narrows a principal_set/content_set ACE to a single project. */
-    project?: string;
-    /** Dynamic matching conditions for principal_set/content_set ACEs. */
-    conditions?: AceConditions;
-    tags?: string[];
-    expires_at?: string;
-    created_at?: string;
-    updated_at?: string;
-    id: string;
-}
-export interface ACECreatePayload extends Omit<AccessControlEntry, 'created_at' | 'updated_at' | 'id'> {
-}
-export interface ACEUpdatePayload extends Partial<ACECreatePayload> {
-}
+export type AceConditions = z.infer<typeof AceConditionsSchema>;
+export type AccessControlEntry = z.infer<typeof AccessControlEntrySchema>;
+export type ACECreatePayload = z.infer<typeof ACECreatePayloadSchema>;
+export type ACEUpdatePayload = z.infer<typeof ACEUpdatePayloadSchema>;
 /**
  * Default sensitivity/clearance levels for the Bell-LaPadula security model.
  * The numeric value is the index in the array (0 = lowest, 4 = highest).

package/lib/access-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,oBAAY,UAAU;IAClB,QAAQ,qBAAqB;IAC7B,SAAS,sBAAsB;IAC/B,UAAU,uBAAuB;IAEjC,WAAW,wBAAwB;IACnC,QAAQ,aAAa;IACrB,SAAS,cAAc;IAEvB,SAAS,sBAAsB;IAE/B,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,wBAAwB,6BAA6B;IACrD,sBAAsB,2BAA2B;IAEjD,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IAEjC,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B,cAAc,oBAAoB;IAClC,oCAAoC;IACpC,YAAY,iBAAiB;IAC7B,6CAA6C;IAC7C,UAAU,eAAe;IACzB,cAAc,mBAAmB;IAEjC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,aAAa,kBAAkB,CAAE,gBAAgB;IACjD,kBAAkB,uBAAuB,CAAE,mCAAmC;IAE9E,aAAa,kBAAkB;IAC/B,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;IAE3C,cAAc,mBAAmB;IAEjC,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAE3B,eAAe,oBAAoB;IAEnC,iDAAiD;IACjD,aAAa,kBAAkB;CAClC;AAED,oBAAY,yBAAyB;IACjC,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,WAAW,gBAAgB;IAC3B,GAAG,gBAAgB;IACnB;;;;;;;;;;OAUG;IACH,YAAY,gBAAgB;CAC/B;AAED,oBAAY,0BAA0B;IAClC,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,yEAAyE;IACzE,aAAa,kBAAkB;CAClC;AAED;;;;;;;;;;;;;;GAcG;AACH,mGAAmG;AACnG,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE7C,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC1B,8FAA8F;IAC9F,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC,yFAAyF;IACzF,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IAC/B;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,yBAAyB,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,0BAA0B,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,YAAY,GAAG,IAAI,CAAC;CAAG;AAEzG,MAAM,WAAW,gBAAiB,SAAQ,OAAO,CAAC,gBAAgB,CAAC;CAAG;AAUtE;;;;GAIG;AACH,oBAAY,aAAa;IACrB,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,UAAU,IAAI;IACd,MAAM,IAAI;CACb;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAmE,CAAC;AAErH,2FAA2F;AAC3F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,MAAM,WAAW,gBAAgB;IAC7B,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,yBAAyB,CAAC;CACpC"}
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B;;;;GAIG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,KAAK,EACR,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,4BAA4B,EAC/B,MAAM,iCAAiC,CAAC;AAEzC;;;GAGG;AACH,cAAc,4BAA4B,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAUtE;;;;GAIG;AACH,oBAAY,aAAa;IACrB,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,UAAU,IAAI;IACd,MAAM,IAAI;CACb;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAmE,CAAC;AAErH,2FAA2F;AAC3F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,MAAM,WAAW,gBAAgB;IAC7B,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,yBAAyB,CAAC;CACpC"}

package/lib/access-control.js

@@ -1,83 +1,11 @@
 /**
- * @module access-control
- * @description
- * Access control interfaces
+ * The enums live in `./access-control-values.js` so the API schemas can consume them without
+ * importing this module back. Re-exported here so every existing import path keeps working.
  */
-export var Permission;
-(function (Permission) {
-    Permission["int_read"] = "interaction:read";
-    Permission["int_write"] = "interaction:write";
-    Permission["int_delete"] = "interaction:delete";
-    Permission["int_execute"] = "interaction:execute";
-    Permission["run_read"] = "run:read";
-    Permission["run_write"] = "run:write";
-    Permission["env_admin"] = "environment:admin";
-    Permission["app_manage"] = "app:manage";
-    Permission["project_admin"] = "project:admin";
-    Permission["project_integration_read"] = "project:integration_read";
-    Permission["project_settings_write"] = "project:settings_write";
-    Permission["api_key_create"] = "api_key:create";
-    Permission["api_key_read"] = "api_key:read";
-    Permission["api_key_secret_read"] = "api_key:secret_read";
-    Permission["api_key_update"] = "api_key:update";
-    Permission["api_key_delete"] = "api_key:delete";
-    Permission["account_read"] = "account:read";
-    Permission["account_write"] = "account:write";
-    Permission["account_admin"] = "account:admin";
-    Permission["manage_billing"] = "account:billing";
-    /** View cost and usage analytics */
-    Permission["billing_read"] = "billing:read";
-    /** View account and project audit events. */
-    Permission["audit_read"] = "audit:read";
-    Permission["account_member"] = "account:member";
-    Permission["content_read"] = "content:read";
-    Permission["content_read_all"] = "content:read_all";
-    Permission["content_write"] = "content:write";
-    Permission["content_delete"] = "content:delete";
-    Permission["content_admin"] = "content:admin";
-    Permission["content_superadmin"] = "content:superadmin";
-    Permission["workflow_read"] = "workflow:read";
-    Permission["workflow_run"] = "workflow:run";
-    Permission["workflow_admin"] = "workflow:admin";
-    Permission["workflow_superadmin"] = "workflow:superadmin";
-    Permission["agent_run_read"] = "agent_run:read";
-    Permission["task_read"] = "task:read";
-    Permission["task_manage"] = "task:manage";
-    Permission["iam_impersonate"] = "iam:impersonate";
-    /** whether the user has access to Sutdio App. */
-    Permission["studio_access"] = "studio:access";
-})(Permission || (Permission = {}));
-export var AccessControlResourceType;
-(function (AccessControlResourceType) {
-    AccessControlResourceType["project"] = "project";
-    AccessControlResourceType["environment"] = "environment";
-    AccessControlResourceType["account"] = "account";
-    AccessControlResourceType["interaction"] = "interaction";
-    AccessControlResourceType["app"] = "application";
-    /**
-     * Dynamic resource matching by property conditions at query time. The role
-     * partitions (content, future tasks/etc.) determine which kind of object
-     * the conditions match — selected via `AceConditions.scope`.
-     *
-     * NOTE: the string value remains `'content_set'` for backward compatibility
-     * with stored ACEs and JWTs. The wire/DB rename to `'resource_set'` is a
-     * separate concern (deferred). Until then, code reads
-     * `AccessControlResourceType.resource_set` but the value on the wire stays
-     * `'content_set'`.
-     */
-    AccessControlResourceType["resource_set"] = "content_set";
-})(AccessControlResourceType || (AccessControlResourceType = {}));
-export var AccessControlPrincipalType;
-(function (AccessControlPrincipalType) {
-    AccessControlPrincipalType["user"] = "user";
-    AccessControlPrincipalType["group"] = "group";
-    AccessControlPrincipalType["apikey"] = "apikey";
-    /** Dynamic principal matching by user/group properties at token time. */
-    AccessControlPrincipalType["principal_set"] = "principal_set";
-})(AccessControlPrincipalType || (AccessControlPrincipalType = {}));
-// RoleDefinition + SystemRoleDefinition now live in `./roles/types.js` to
-// avoid a circular import with `RoleDomain`. They remain re-exported via
-// the package's index.ts so consumers see no path change.
+export * from './access-control-values.js';
+// RoleDefinition + SystemRoleDefinition now live in `./roles/types.js`, and are likewise inferred
+// from `./api-schemas/access-control.js`. They remain re-exported via the package's index.ts so
+// consumers see no path change.
 // ============================================================================
 // BLP Security Levels
 // ============================================================================

package/lib/access-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAN,IAAY,UAqDX;AArDD,WAAY,UAAU;IAClB,2CAA6B,CAAA;IAC7B,6CAA+B,CAAA;IAC/B,+CAAiC,CAAA;IAEjC,iDAAmC,CAAA;IACnC,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IAEvB,6CAA+B,CAAA;IAE/B,uCAAyB,CAAA;IACzB,6CAA+B,CAAA;IAC/B,mEAAqD,CAAA;IACrD,+DAAiD,CAAA;IAEjD,+CAAiC,CAAA;IACjC,2CAA6B,CAAA;IAC7B,yDAA2C,CAAA;IAC3C,+CAAiC,CAAA;IACjC,+CAAiC,CAAA;IAEjC,2CAA6B,CAAA;IAC7B,6CAA+B,CAAA;IAC/B,6CAA+B,CAAA;IAC/B,gDAAkC,CAAA;IAClC,oCAAoC;IACpC,2CAA6B,CAAA;IAC7B,6CAA6C;IAC7C,uCAAyB,CAAA;IACzB,+CAAiC,CAAA;IAEjC,2CAA6B,CAAA;IAC7B,mDAAqC,CAAA;IACrC,6CAA+B,CAAA;IAC/B,+CAAiC,CAAA;IACjC,6CAA+B,CAAA;IAC/B,uDAAyC,CAAA;IAEzC,6CAA+B,CAAA;IAC/B,2CAA6B,CAAA;IAC7B,+CAAiC,CAAA;IACjC,yDAA2C,CAAA;IAE3C,+CAAiC,CAAA;IAEjC,qCAAuB,CAAA;IACvB,yCAA2B,CAAA;IAE3B,iDAAmC,CAAA;IAEnC,iDAAiD;IACjD,6CAA+B,CAAA;AACnC,CAAC,EArDW,UAAU,KAAV,UAAU,QAqDrB;AAED,MAAM,CAAN,IAAY,yBAkBX;AAlBD,WAAY,yBAAyB;IACjC,gDAAmB,CAAA;IACnB,wDAA2B,CAAA;IAC3B,gDAAmB,CAAA;IACnB,wDAA2B,CAAA;IAC3B,gDAAmB,CAAA;IACnB;;;;;;;;;;OAUG;IACH,yDAA4B,CAAA;AAChC,CAAC,EAlBW,yBAAyB,KAAzB,yBAAyB,QAkBpC;AAED,MAAM,CAAN,IAAY,0BAMX;AAND,WAAY,0BAA0B;IAClC,2CAAa,CAAA;IACb,6CAAe,CAAA;IACf,+CAAiB,CAAA;IACjB,yEAAyE;IACzE,6DAA+B,CAAA;AACnC,CAAC,EANW,0BAA0B,KAA1B,0BAA0B,QAMrC;AAwED,0EAA0E;AAC1E,yEAAyE;AACzE,0DAA0D;AAE1D,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qDAAU,CAAA;IACV,yDAAY,CAAA;IACZ,iEAAgB,CAAA;IAChB,6DAAc,CAAA;IACd,qDAAU,CAAA;AACd,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAErH,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AACnD,CAAC"}
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,cAAc,4BAA4B,CAAC;AAmC3C,kGAAkG;AAClG,gGAAgG;AAChG,gCAAgC;AAEhC,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qDAAU,CAAA;IACV,yDAAY,CAAA;IACZ,iEAAgB,CAAA;IAChB,6DAAc,CAAA;IACd,qDAAU,CAAA;AACd,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAErH,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;AACnD,CAAC"}

package/lib/account-values.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Account values that exist at runtime — enums, constants, and the pure helpers over them.
+ *
+ * Split out of `user.ts` so the dependency direction can run one way. The API schemas need these
+ * values (`z.enum(BillingMethod)`, `.max(ACCOUNT_APP_ACCESS_MESSAGE_MAX_LENGTH)`), and `user.ts`
+ * needs the types the schemas infer. Both living in `user.ts` would make it import from a module
+ * that imports it back; here, `user.ts` and `api-schemas/account.ts` both depend on this module and
+ * nothing depends on them.
+ *
+ * Everything here is re-exported from `user.ts`, so existing import paths keep working — this is a
+ * move, not a rename.
+ */
+export declare enum Datacenters {
+    aws = "aws",
+    gcp = "gcp",
+    azure = "azure"
+}
+export declare enum BillingMethod {
+    stripe = "stripe",
+    invoice = "invoice"
+}
+export declare enum AccountType {
+    vertesia = "vertesia",
+    partner = "partner",
+    free = "free",
+    customer = "customer",
+    prospect = "prospect",
+    unknown = "unknown"
+}
+/**
+ * Quota/rate-limit tier assigned to an account. Code-defined tiers live in `@dglabs/quota`
+ * (`QUOTA_TIERS`); these names must match its keys.
+ * - `standard` — protective baseline limits (the default for most accounts).
+ * - `enterprise` — high limits for contracted customers / internal / partners.
+ *
+ * An account with no explicit `quota_tier` derives its tier from its `account_type`.
+ */
+export declare enum QuotaTier {
+    standard = "standard",
+    enterprise = "enterprise"
+}
+/**
+ * Default tier for an account that has no explicit `quota_tier`, derived from its `account_type`:
+ * contracted customers and internal Vertesia accounts get `enterprise`; everyone else (partner,
+ * free, prospect, unknown) gets the protective `standard` baseline.
+ */
+export declare function quotaTierForAccountType(accountType: AccountType | undefined | null): QuotaTier;
+export declare const ACCOUNT_NAMESPACE_MAX_LENGTH = 63;
+export declare const ACCOUNT_APP_ACCESS_MESSAGE_MAX_LENGTH = 1000;
+export declare const RESERVED_ACCOUNT_NAMESPACES: readonly ["admin", "api", "apps", "auth", "cdn", "docs", "internal-auth", "mcp", "status", "sts", "www"];
+export declare function normalizeAccountNamespace(namespace: string): string;
+export declare function getAccountNamespaceValidationError(namespace: string): string | undefined;
+//# sourceMappingURL=account-values.d.ts.map

package/lib/account-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-values.d.ts","sourceRoot":"","sources":["../src/account-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,oBAAY,WAAW;IACnB,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,KAAK,UAAU;CAClB;AAED,oBAAY,aAAa;IACrB,MAAM,WAAW;IACjB,OAAO,YAAY;CACtB;AAED,oBAAY,WAAW;IACnB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,OAAO,YAAY;CACtB;AAED;;;;;;;GAOG;AACH,oBAAY,SAAS;IACjB,QAAQ,aAAa;IACrB,UAAU,eAAe;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,CAQ9F;AAED,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,qCAAqC,OAAO,CAAC;AAC1D,eAAO,MAAM,2BAA2B,0GAY9B,CAAC;AAIX,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxF"}

package/lib/account-values.js

@@ -0,0 +1,91 @@
+/**
+ * Account values that exist at runtime — enums, constants, and the pure helpers over them.
+ *
+ * Split out of `user.ts` so the dependency direction can run one way. The API schemas need these
+ * values (`z.enum(BillingMethod)`, `.max(ACCOUNT_APP_ACCESS_MESSAGE_MAX_LENGTH)`), and `user.ts`
+ * needs the types the schemas infer. Both living in `user.ts` would make it import from a module
+ * that imports it back; here, `user.ts` and `api-schemas/account.ts` both depend on this module and
+ * nothing depends on them.
+ *
+ * Everything here is re-exported from `user.ts`, so existing import paths keep working — this is a
+ * move, not a rename.
+ */
+export var Datacenters;
+(function (Datacenters) {
+    Datacenters["aws"] = "aws";
+    Datacenters["gcp"] = "gcp";
+    Datacenters["azure"] = "azure";
+})(Datacenters || (Datacenters = {}));
+export var BillingMethod;
+(function (BillingMethod) {
+    BillingMethod["stripe"] = "stripe";
+    BillingMethod["invoice"] = "invoice";
+})(BillingMethod || (BillingMethod = {}));
+export var AccountType;
+(function (AccountType) {
+    AccountType["vertesia"] = "vertesia";
+    AccountType["partner"] = "partner";
+    AccountType["free"] = "free";
+    AccountType["customer"] = "customer";
+    AccountType["prospect"] = "prospect";
+    AccountType["unknown"] = "unknown";
+})(AccountType || (AccountType = {}));
+/**
+ * Quota/rate-limit tier assigned to an account. Code-defined tiers live in `@dglabs/quota`
+ * (`QUOTA_TIERS`); these names must match its keys.
+ * - `standard` — protective baseline limits (the default for most accounts).
+ * - `enterprise` — high limits for contracted customers / internal / partners.
+ *
+ * An account with no explicit `quota_tier` derives its tier from its `account_type`.
+ */
+export var QuotaTier;
+(function (QuotaTier) {
+    QuotaTier["standard"] = "standard";
+    QuotaTier["enterprise"] = "enterprise";
+})(QuotaTier || (QuotaTier = {}));
+/**
+ * Default tier for an account that has no explicit `quota_tier`, derived from its `account_type`:
+ * contracted customers and internal Vertesia accounts get `enterprise`; everyone else (partner,
+ * free, prospect, unknown) gets the protective `standard` baseline.
+ */
+export function quotaTierForAccountType(accountType) {
+    switch (accountType) {
+        case AccountType.customer:
+        case AccountType.vertesia:
+            return QuotaTier.enterprise;
+        default:
+            return QuotaTier.standard;
+    }
+}
+export const ACCOUNT_NAMESPACE_MAX_LENGTH = 63;
+export const ACCOUNT_APP_ACCESS_MESSAGE_MAX_LENGTH = 1000;
+export const RESERVED_ACCOUNT_NAMESPACES = [
+    'admin',
+    'api',
+    'apps',
+    'auth',
+    'cdn',
+    'docs',
+    'internal-auth',
+    'mcp',
+    'status',
+    'sts',
+    'www',
+];
+const ACCOUNT_NAMESPACE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+export function normalizeAccountNamespace(namespace) {
+    return namespace.trim().toLowerCase();
+}
+export function getAccountNamespaceValidationError(namespace) {
+    if (!namespace) {
+        return 'Account namespace is required';
+    }
+    if (namespace.length > ACCOUNT_NAMESPACE_MAX_LENGTH || !ACCOUNT_NAMESPACE_PATTERN.test(namespace)) {
+        return 'Account namespace must be a lowercase DNS label containing only letters, numbers, and hyphens';
+    }
+    if (RESERVED_ACCOUNT_NAMESPACES.includes(namespace)) {
+        return `Account namespace '${namespace}' is reserved`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=account-values.js.map

package/lib/account-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-values.js","sourceRoot":"","sources":["../src/account-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAN,IAAY,WAIX;AAJD,WAAY,WAAW;IACnB,0BAAW,CAAA;IACX,0BAAW,CAAA;IACX,8BAAe,CAAA;AACnB,CAAC,EAJW,WAAW,KAAX,WAAW,QAItB;AAED,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACrB,kCAAiB,CAAA;IACjB,oCAAmB,CAAA;AACvB,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED,MAAM,CAAN,IAAY,WAOX;AAPD,WAAY,WAAW;IACnB,oCAAqB,CAAA;IACrB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,oCAAqB,CAAA;IACrB,oCAAqB,CAAA;IACrB,kCAAmB,CAAA;AACvB,CAAC,EAPW,WAAW,KAAX,WAAW,QAOtB;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,SAGX;AAHD,WAAY,SAAS;IACjB,kCAAqB,CAAA;IACrB,sCAAyB,CAAA;AAC7B,CAAC,EAHW,SAAS,KAAT,SAAS,QAGpB;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAA2C;IAC/E,QAAQ,WAAW,EAAE,CAAC;QAClB,KAAK,WAAW,CAAC,QAAQ,CAAC;QAC1B,KAAK,WAAW,CAAC,QAAQ;YACrB,OAAO,SAAS,CAAC,UAAU,CAAC;QAChC;YACI,OAAO,SAAS,CAAC,QAAQ,CAAC;IAClC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACvC,OAAO;IACP,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,eAAe;IACf,KAAK;IACL,QAAQ;IACR,KAAK;IACL,KAAK;CACC,CAAC;AAEX,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAE3E,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACvD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,SAAiB;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO,+BAA+B,CAAC;IAC3C,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,4BAA4B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,+FAA+F,CAAC;IAC3G,CAAC;IACD,IAAK,2BAAiD,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,OAAO,sBAAsB,SAAS,eAAe,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}