@vertesia/common 1.5.0-dev.20260725.083715Z → 1.5.0-dev.20260804.124748Z

package/lib/api-schemas/tools.d.ts

@@ -0,0 +1,111 @@
+import { z } from 'zod';
+export declare const ToolSourceSchema: z.ZodEnum<{
+    interaction: "interaction";
+    app: "app";
+    builtin: "builtin";
+}>;
+export declare const ValidateToolNamesPayloadSchema: z.ZodObject<{
+    names: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const ToolValidationResultSchema: z.ZodObject<{
+    name: z.ZodString;
+    valid: z.ZodBoolean;
+    source: z.ZodOptional<z.ZodEnum<{
+        interaction: "interaction";
+        app: "app";
+        builtin: "builtin";
+    }>>;
+    app_install_id: z.ZodOptional<z.ZodString>;
+    app_name: z.ZodOptional<z.ZodString>;
+    suggestion: z.ZodOptional<z.ZodString>;
+    collisions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source: z.ZodEnum<{
+            interaction: "interaction";
+            app: "app";
+            builtin: "builtin";
+        }>;
+        app_install_id: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export declare const AggregatedToolSchema: z.ZodObject<{
+    name: z.ZodString;
+    source: z.ZodEnum<{
+        interaction: "interaction";
+        app: "app";
+        builtin: "builtin";
+    }>;
+    description: z.ZodOptional<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+    is_default: z.ZodOptional<z.ZodBoolean>;
+    annotations: z.ZodOptional<z.ZodObject<{
+        title: z.ZodOptional<z.ZodString>;
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    unlocked_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    app_install_id: z.ZodOptional<z.ZodString>;
+    app_name: z.ZodOptional<z.ZodString>;
+    interaction_id: z.ZodOptional<z.ZodString>;
+    is_agent: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const ValidateToolNamesResponseSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        valid: z.ZodBoolean;
+        source: z.ZodOptional<z.ZodEnum<{
+            interaction: "interaction";
+            app: "app";
+            builtin: "builtin";
+        }>>;
+        app_install_id: z.ZodOptional<z.ZodString>;
+        app_name: z.ZodOptional<z.ZodString>;
+        suggestion: z.ZodOptional<z.ZodString>;
+        collisions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            source: z.ZodEnum<{
+                interaction: "interaction";
+                app: "app";
+                builtin: "builtin";
+            }>;
+            app_install_id: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    invalid_count: z.ZodNumber;
+}, z.core.$strict>;
+export declare const AggregatedToolArraySchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    source: z.ZodEnum<{
+        interaction: "interaction";
+        app: "app";
+        builtin: "builtin";
+    }>;
+    description: z.ZodOptional<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+    is_default: z.ZodOptional<z.ZodBoolean>;
+    annotations: z.ZodOptional<z.ZodObject<{
+        title: z.ZodOptional<z.ZodString>;
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    unlocked_tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    app_install_id: z.ZodOptional<z.ZodString>;
+    app_name: z.ZodOptional<z.ZodString>;
+    interaction_id: z.ZodOptional<z.ZodString>;
+    is_agent: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>>;
+export declare const ListProjectToolsQuerySchema: z.ZodObject<{
+    sources: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        interaction: "interaction";
+        app: "app";
+        builtin: "builtin";
+    }>>>;
+    exclude: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        interaction: "interaction";
+        app: "app";
+        builtin: "builtin";
+    }>>>;
+}, z.core.$strict>;
+//# sourceMappingURL=tools.d.ts.map

package/lib/api-schemas/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/api-schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,gBAAgB;;;;EAI3B,CAAC;AAEH,eAAO,MAAM,8BAA8B;;kBAO8D,CAAC;AAE1G,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;kBAmCyE,CAAC;AAEjH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;kBAgD3B,CAAC;AAEP,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;kBAawD,CAAC;AAErG,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;mBAAoE,CAAC;AAG3G,eAAO,MAAM,2BAA2B;;;;;;;;;;;kBAUE,CAAC"}

package/lib/api-schemas/tools.js

@@ -0,0 +1,122 @@
+import { z } from 'zod';
+import { MCPToolAnnotationsSchema } from './apps.js';
+// The unified project-scoped tool registry as `GET /tools` and `POST /tools/validate` publish it.
+//
+// `//` rather than `/** */` throughout: a JSDoc block immediately preceding an exported declaration
+// is picked up by the OpenAPI scanner and published as that component's `description`, which would
+// double up with the `description` stated in `.meta()`.
+export const ToolSourceSchema = z.enum(['builtin', 'app', 'interaction']).meta({
+    id: 'ToolSource',
+    description: 'Origin of a tool in the unified project-scoped tool registry.\n\n- `builtin`: anything statically registered on the worker — workflow builtins, studio agent tools, and sys skills\n- `app`: tools contributed by an installed app for the project\n- `interaction`: a project interaction exposed via `tag=tool` / `is_tool=true` / `is_skill=true`\n\nSkill semantics (the tool unlocks others when invoked) are NOT part of the source. They are identified universally by the `learn_` prefix in the tool name. This matches how the runtime registry stores them and avoids splitting one logical origin into two sources.',
+});
+export const ValidateToolNamesPayloadSchema = z
+    .strictObject({
+    names: z.array(z.string()).meta({
+        description: 'Bare tool names as they appear in `agent_runner_options.tool_names`. `+`/`-` prefixes are stripped before lookup.',
+    }),
+})
+    .meta({ id: 'ValidateToolNamesPayload', description: 'Request payload for `POST /tools/validate`.' });
+export const ToolValidationResultSchema = z
+    .strictObject({
+    name: z.string().meta({ description: 'The name the caller asked about.' }),
+    valid: z
+        .boolean()
+        .meta({ description: "True if the name resolves to exactly one tool in the project's unified registry." }),
+    source: ToolSourceSchema.meta({ description: 'When `valid`: which source the tool came from.' }).optional(),
+    app_install_id: z
+        .string()
+        .meta({ description: "When `valid` and `source === 'app'`: the app installation that provides the tool." })
+        .optional(),
+    app_name: z
+        .string()
+        .meta({ description: "When `valid` and `source === 'app'`: the app's manifest name." })
+        .optional(),
+    suggestion: z
+        .string()
+        .meta({
+        description: 'When `!valid` and a close match exists: the suggested replacement name (Levenshtein-based).',
+    })
+        .optional(),
+    collisions: z
+        .array(z.strictObject({
+        source: ToolSourceSchema,
+        app_install_id: z.string().optional(),
+    }))
+        .meta({
+        description: 'Populated when a name appears in more than one source. Validation does not fail on this, but exposes the ambiguity so callers can surface a warning (last-write-wins resolution applies).',
+    })
+        .optional(),
+})
+    .meta({ id: 'ToolValidationResult', description: 'Per-name resolution result for `POST /tools/validate`.' });
+export const AggregatedToolSchema = z
+    .strictObject({
+    name: z.string().meta({
+        description: 'Name as referenced from `agent_runner_options.tool_names`. For interaction skills this is `learn_<endpoint>`.',
+    }),
+    source: ToolSourceSchema,
+    description: z.string().optional(),
+    title: z.string().optional(),
+    is_default: z
+        .boolean()
+        .meta({
+        description: 'Whether the tool is part of the default toolkit when no explicit `tool_names` is provided.',
+    })
+        .optional(),
+    annotations: MCPToolAnnotationsSchema.optional(),
+    unlocked_tools: z
+        .array(z.string())
+        .meta({ description: 'For skills (`learn_*`): tool names this skill unlocks when invoked.' })
+        .optional(),
+    app_install_id: z
+        .string()
+        .meta({ description: "Present when `source === 'app'`: the app installation that provides this tool." })
+        .optional(),
+    app_name: z
+        .string()
+        .meta({
+        description: "Present when `source === 'app'`: the app's manifest name (used for `principal.apps` filtering).",
+    })
+        .optional(),
+    interaction_id: z
+        .string()
+        .meta({ description: "Present when `source === 'interaction'`: the interaction document id." })
+        .optional(),
+    is_agent: z
+        .boolean()
+        .meta({
+        description: "Present when `source === 'interaction'`: true if the interaction has `agent_runner_options.is_agent === true`. Lets UI consumers distinguish sub-agents (autonomous, run-to-completion) from regular interaction tools.",
+    })
+        .optional(),
+})
+    .meta({
+    id: 'AggregatedTool',
+    description: 'A single tool entry in the unified registry, regardless of where it came from. Returned by `GET /tools` and the resolution map of `POST /tools/validate`.',
+});
+export const ValidateToolNamesResponseSchema = z
+    .strictObject({
+    results: z
+        .array(ToolValidationResultSchema)
+        .meta({ description: 'One entry per requested name, in the same order.' }),
+    invalid_count: z.number().min(0).meta({
+        description: 'Convenience count of `results.filter(r => !r.valid).length`.',
+        // `type`/`format` in meta rather than `z.int()`: the latter also emits Zod's
+        // safe-integer `maximum`, which the published component does not carry.
+        type: 'integer',
+        format: 'int32',
+    }),
+})
+    .meta({ id: 'ValidateToolNamesResponse', description: 'Response from `POST /tools/validate`.' });
+export const AggregatedToolArraySchema = z.array(AggregatedToolSchema).meta({ id: 'AggregatedToolArray' });
+// Query contracts are registry components even though the scanner expands them into parameters.
+export const ListProjectToolsQuerySchema = z
+    .strictObject({
+    sources: z.array(ToolSourceSchema).meta({ description: 'Include only these sources.' }).optional(),
+    exclude: z
+        .array(ToolSourceSchema)
+        .meta({
+        description: 'Drop these sources from the result (and skip their fetch). Applied after `sources`.',
+    })
+        .optional(),
+})
+    .meta({ id: 'ListProjectToolsQuery' });
+//# sourceMappingURL=tools.js.map

package/lib/api-schemas/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/api-schemas/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,kGAAkG;AAClG,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,wDAAwD;AAExD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,EAAE,EAAE,YAAY;IAChB,WAAW,EACP,imBAAimB;CACxmB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC1C,YAAY,CAAC;IACV,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QAC5B,WAAW,EACP,mHAAmH;KAC1H,CAAC;CACL,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC,CAAC;AAE1G,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACtC,YAAY,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAC1E,KAAK,EAAE,CAAC;SACH,OAAO,EAAE;SACT,IAAI,CAAC,EAAE,WAAW,EAAE,kFAAkF,EAAE,CAAC;IAC9G,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3G,cAAc,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,mFAAmF,EAAE,CAAC;SAC1G,QAAQ,EAAE;IACf,QAAQ,EAAE,CAAC;SACN,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;SACtF,QAAQ,EAAE;IACf,UAAU,EAAE,CAAC;SACR,MAAM,EAAE;SACR,IAAI,CAAC;QACF,WAAW,EACP,6FAA6F;KACpG,CAAC;SACD,QAAQ,EAAE;IACf,UAAU,EAAE,CAAC;SACR,KAAK,CACF,CAAC,CAAC,YAAY,CAAC;QACX,MAAM,EAAE,gBAAgB;QACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CACL;SACA,IAAI,CAAC;QACF,WAAW,EACP,2LAA2L;KAClM,CAAC;SACD,QAAQ,EAAE;CAClB,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC,CAAC;AAEjH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAChC,YAAY,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAClB,WAAW,EACP,+GAA+G;KACtH,CAAC;IACF,MAAM,EAAE,gBAAgB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC;SACR,OAAO,EAAE;SACT,IAAI,CAAC;QACF,WAAW,EACP,4FAA4F;KACnG,CAAC;SACD,QAAQ,EAAE;IACf,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAChD,cAAc,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,IAAI,CAAC,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;SAC5F,QAAQ,EAAE;IACf,cAAc,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;SACvG,QAAQ,EAAE;IACf,QAAQ,EAAE,CAAC;SACN,MAAM,EAAE;SACR,IAAI,CAAC;QACF,WAAW,EACP,iGAAiG;KACxG,CAAC;SACD,QAAQ,EAAE;IACf,cAAc,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,uEAAuE,EAAE,CAAC;SAC9F,QAAQ,EAAE;IACf,QAAQ,EAAE,CAAC;SACN,OAAO,EAAE;SACT,IAAI,CAAC;QACF,WAAW,EACP,yNAAyN;KAChO,CAAC;SACD,QAAQ,EAAE;CAClB,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,gBAAgB;IACpB,WAAW,EACP,2JAA2J;CAClK,CAAC,CAAC;AAEP,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC3C,YAAY,CAAC;IACV,OAAO,EAAE,CAAC;SACL,KAAK,CAAC,0BAA0B,CAAC;SACjC,IAAI,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IAC9E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE,8DAA8D;QAC3E,6EAA6E;QAC7E,wEAAwE;QACxE,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,OAAO;KAClB,CAAC;CACL,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAE3G,gGAAgG;AAChG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACvC,YAAY,CAAC;IACV,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClG,OAAO,EAAE,CAAC;SACL,KAAK,CAAC,gBAAgB,CAAC;SACvB,IAAI,CAAC;QACF,WAAW,EAAE,qFAAqF;KACrG,CAAC;SACD,QAAQ,EAAE;CAClB,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,CAAC"}

package/lib/api-schemas/user.d.ts

@@ -0,0 +1,208 @@
+import { z } from 'zod';
+/**
+ * Runtime API schemas for the IAM user endpoints.
+ *
+ * `User` is served from a Mongoose
+ * document, so the published schema and the stored document are genuinely different shapes and the
+ * server maps between them explicitly. What is declared here is the WIRE contract only.
+ */
+/**
+ * Not hoisted: no `id` in `.meta()`, so the adapter inlines it into `PrincipalIdentity` instead of
+ * emitting a `PrincipalContext` component and a `$ref` the document has never published.
+ *
+ * It still exists as a schema rather than being spelled out inside `PrincipalIdentitySchema`,
+ * because `PrincipalContext` is a public type in its own right — consumed by PrincipalSet condition
+ * evaluation and client-side ABAC tooling. Composing the two is what keeps the five inherited fields
+ * from becoming a hand-written twin of the schema that publishes them.
+ */
+export declare const PrincipalContextSchema: z.ZodObject<{
+    clearance: z.ZodNumber;
+    compartments: z.ZodArray<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    tags: z.ZodArray<z.ZodString>;
+    properties: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+/**
+ * `.extend()` rather than a fresh object literal: it appends `id` after the inherited five, which is
+ * both what `interface PrincipalIdentity extends PrincipalContext` produced and the property order
+ * the document already publishes.
+ */
+export declare const PrincipalIdentitySchema: z.ZodObject<{
+    clearance: z.ZodNumber;
+    compartments: z.ZodArray<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    tags: z.ZodArray<z.ZodString>;
+    properties: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    id: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The user as it crosses the wire.
+ *
+ * `created_at` and `updated_at` are DECLARED here but were absent from the published component,
+ * while the endpoint has always shipped them: the Mongoose model sets `timestamps`, and the handler
+ * serialized the whole document. The published `User` was closed, so every response the endpoint
+ * has ever sent violated its own schema. Declaring the two fields corrects the document to describe
+ * what actually ships; removing them from the response instead would have been a silent breaking
+ * change for anyone already reading them.
+ */
+export declare const UserSchema: z.ZodObject<{
+    id: z.ZodString;
+    externalId: z.ZodOptional<z.ZodString>;
+    email: z.ZodString;
+    name: z.ZodString;
+    username: z.ZodOptional<z.ZodString>;
+    picture: z.ZodOptional<z.ZodString>;
+    language: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodString>;
+    sign_in_provider: z.ZodOptional<z.ZodString>;
+    last_selected_account: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodEnum<{
+        firebase: "firebase";
+        scim: "scim";
+    }>>;
+    updated_by: z.ZodOptional<z.ZodString>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    clearance: z.ZodOptional<z.ZodNumber>;
+    compartments: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    annotations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The account members listing, published as its own component because the document already carries
+ * `UserArray` — an array named at the top level rather than inlined at the use site.
+ *
+ * Naming the array keeps its item contract reusable and runtime-enforced as one unit.
+ */
+export declare const UserArraySchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    externalId: z.ZodOptional<z.ZodString>;
+    email: z.ZodString;
+    name: z.ZodString;
+    username: z.ZodOptional<z.ZodString>;
+    picture: z.ZodOptional<z.ZodString>;
+    language: z.ZodOptional<z.ZodString>;
+    phone: z.ZodOptional<z.ZodString>;
+    sign_in_provider: z.ZodOptional<z.ZodString>;
+    last_selected_account: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodEnum<{
+        firebase: "firebase";
+        scim: "scim";
+    }>>;
+    updated_by: z.ZodOptional<z.ZodString>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    clearance: z.ZodOptional<z.ZodNumber>;
+    compartments: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    annotations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, z.core.$strip>>;
+/**
+ * The compact user shape embedded in other resources' responses — currently the group members
+ * listing, which populates a user document down to these four fields.
+ *
+ * A `.pick()` of {@link UserSchema}, not a parallel object: `UserRef` IS a projection of `User`, so
+ * the field definitions, their requiredness and any constraints come from one declaration. A hand
+ * written copy would be a twin that drifts the first time a field on `User` changes. `.pick()` does
+ * not carry the `id: 'User'` metadata across, so this still publishes as its own component rather
+ * than a second `$ref` to `User`.
+ *
+ * `email` is therefore required here for the same reason it is on `User`, even though the Mongoose
+ * model marks it optional. That is not an oversight to fix by loosening the schema: the component
+ * has always said required, and the server maps a missing email to `''` rather than publishing a
+ * response that violates it.
+ *
+ * Note this is the WIRE projection. `UserRefPopulate` is the Mongoose one that feeds it, and stays
+ * written out: it names database fields and carries persistence concerns this schema has no view of.
+ */
+export declare const UserRefSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    email: z.ZodString;
+    picture: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const UserRefArraySchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    email: z.ZodString;
+    picture: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+/**
+ * The writable subset of a user, picked from {@link UserSchema} rather than restated.
+ *
+ * Every field here means exactly what it means on `User` — same type, same constraints — so it comes
+ * from one declaration; `.partial()` then relaxes requiredness, which is the only thing a PUT payload
+ * genuinely changes about them. The fields NOT picked are the point of the whitelist: `email`,
+ * `externalId`, `sign_in_provider`, `source`, `annotations` and the timestamps are set by the
+ * identity provider or the server, and a picked schema makes that list impossible to widen by
+ * accident.
+ *
+ * Picking also carries the field descriptions across, so `properties`, `clearance` and `compartments`
+ * are now documented on the payload as they always were on `User`. That is additive documentation,
+ * not a contract change — the constraints are byte-identical. Use `.pick()` only where the request
+ * semantics really do match the response: a field that accepts `null` to clear a value, coerces, or
+ * carries a request-only constraint has to be overridden explicitly instead.
+ */
+export declare const UpdateUserPayloadSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    properties: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    language: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    phone: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    clearance: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+    compartments: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    username: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    picture: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    last_selected_account: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Shared by eight studio delete endpoints.
+ *
+ * The byte-identity guard in the generator does not make it safe to leave the others behind: the
+ * public `DeleteByIdResult` is now an alias inferred from this schema, so the TypeScript derivation
+ * the other slots relied on changes the moment this one does, and the generator refuses to publish
+ * a canonical and a derived component under a single name. Any future shared type has to move as a
+ * unit for the same reason.
+ */
+export declare const DeleteByIdResultSchema: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The signup request contract, shared between the sign-in UI and `POST /auth/signup`.
+ *
+ * `accountType` and `maturity` stay `z.string()`. The UI sends `personal | company` for the first and
+ * a maturity catalog of its own for the second, and neither is drawn from the persisted `AccountType`
+ * enum — so narrowing them here would not be recording what the endpoint accepts, it would be
+ * changing it, and that is a deliberate contract change rather than part of a conversion.
+ *
+ * `companySize` is a number: the form sends a headcount, not a bucket label.
+ */
+export declare const SignupDataSchema: z.ZodObject<{
+    accountType: z.ZodString;
+    companyName: z.ZodOptional<z.ZodString>;
+    companySize: z.ZodOptional<z.ZodNumber>;
+    companyWebsite: z.ZodOptional<z.ZodString>;
+    maturity: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const SignupPayloadSchema: z.ZodObject<{
+    firebaseToken: z.ZodString;
+    signupData: z.ZodObject<{
+        accountType: z.ZodString;
+        companyName: z.ZodOptional<z.ZodString>;
+        companySize: z.ZodOptional<z.ZodNumber>;
+        companyWebsite: z.ZodOptional<z.ZodString>;
+        maturity: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * The public IAM types, inferred rather than written. `../principal-context.ts`, `../user.ts` and
+ * `../common.ts` re-export these under their public names.
+ */
+export type PrincipalContextFromSchema = z.infer<typeof PrincipalContextSchema>;
+export type PrincipalIdentityFromSchema = z.infer<typeof PrincipalIdentitySchema>;
+export type UserFromSchema = z.infer<typeof UserSchema>;
+export type UserArrayFromSchema = z.infer<typeof UserArraySchema>;
+export type UserRefFromSchema = z.infer<typeof UserRefSchema>;
+export type UserRefArrayFromSchema = z.infer<typeof UserRefArraySchema>;
+export type UpdateUserPayloadFromSchema = z.infer<typeof UpdateUserPayloadSchema>;
+export type DeleteByIdResultFromSchema = z.infer<typeof DeleteByIdResultSchema>;
+//# sourceMappingURL=user.d.ts.map

package/lib/api-schemas/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/api-schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBASlC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;iBAkCE,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;kBAAgD,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa;;;;;iBAKA,CAAC;AAE3B,eAAO,MAAM,kBAAkB;;;;;kBAAsD,CAAC;AAEtF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAYE,CAAC;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB;;iBAAgE,CAAC;AAEpG;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;;;kBAQE,CAAC;AAEhC,eAAO,MAAM,mBAAmB;;;;;;;;;kBAKE,CAAC;AAEnC;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAChF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAClF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACxD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC9D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACxE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAClF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/lib/api-schemas/user.js

@@ -0,0 +1,180 @@
+import { z } from 'zod';
+/**
+ * Runtime API schemas for the IAM user endpoints.
+ *
+ * `User` is served from a Mongoose
+ * document, so the published schema and the stored document are genuinely different shapes and the
+ * server maps between them explicitly. What is declared here is the WIRE contract only.
+ */
+/**
+ * Not hoisted: no `id` in `.meta()`, so the adapter inlines it into `PrincipalIdentity` instead of
+ * emitting a `PrincipalContext` component and a `$ref` the document has never published.
+ *
+ * It still exists as a schema rather than being spelled out inside `PrincipalIdentitySchema`,
+ * because `PrincipalContext` is a public type in its own right — consumed by PrincipalSet condition
+ * evaluation and client-side ABAC tooling. Composing the two is what keeps the five inherited fields
+ * from becoming a hand-written twin of the schema that publishes them.
+ */
+export const PrincipalContextSchema = z.object({
+    clearance: z.number(),
+    compartments: z.array(z.string()),
+    email: z.string().optional(),
+    tags: z.array(z.string()),
+    properties: z.record(z.string(), z.unknown()),
+});
+/**
+ * `.extend()` rather than a fresh object literal: it appends `id` after the inherited five, which is
+ * both what `interface PrincipalIdentity extends PrincipalContext` produced and the property order
+ * the document already publishes.
+ */
+export const PrincipalIdentitySchema = PrincipalContextSchema.extend({
+    id: z.string(),
+}).meta({
+    id: 'PrincipalIdentity',
+    description: "Response shape of the `/iam/users/identity` endpoint: the current principal's  {@link  " +
+        'PrincipalContext }  plus its id. Distinct from `PrincipalContext` itself because the id is ' +
+        'identity metadata, not a merged BLP field — adding it to `PrincipalContext` would ' +
+        'unintentionally expose `$principal.id` to PrincipalSet rule evaluation.',
+});
+/**
+ * The user as it crosses the wire.
+ *
+ * `created_at` and `updated_at` are DECLARED here but were absent from the published component,
+ * while the endpoint has always shipped them: the Mongoose model sets `timestamps`, and the handler
+ * serialized the whole document. The published `User` was closed, so every response the endpoint
+ * has ever sent violated its own schema. Declaring the two fields corrects the document to describe
+ * what actually ships; removing them from the response instead would have been a silent breaking
+ * change for anyone already reading them.
+ */
+export const UserSchema = z
+    .object({
+    id: z.string(),
+    externalId: z.string().optional(),
+    email: z.string(),
+    name: z.string(),
+    username: z.string().optional(),
+    picture: z.string().optional(),
+    language: z.string().optional(),
+    phone: z.string().optional(),
+    sign_in_provider: z.string().optional(),
+    last_selected_account: z.string().optional(),
+    source: z.enum(['firebase', 'scim']).optional(),
+    updated_by: z.string().optional(),
+    properties: z
+        .record(z.string(), z.unknown())
+        .optional()
+        .meta({ description: 'Custom properties for dynamic permission matching' }),
+    clearance: z.number().optional().meta({
+        description: 'BLP clearance level — determines max document sensitivity the user can access',
+    }),
+    compartments: z.array(z.string()).optional().meta({
+        description: 'Compartments the user belongs to — restricts access to documents in matching compartments',
+    }),
+    annotations: z
+        .array(z.string())
+        .optional()
+        .meta({ description: 'Free-form user metadata - restricted to internal use' }),
+    // `format: 'date-time'` and not a bare string: the description claims ISO 8601, and AJV
+    // (with ajv-formats) enforces the claim rather than leaving it as documentation. Matches
+    // how Account publishes its timestamps.
+    created_at: z.string().meta({ format: 'date-time', description: 'ISO 8601 creation timestamp.' }),
+    updated_at: z.string().meta({ format: 'date-time', description: 'ISO 8601 timestamp of the last update.' }),
+})
+    .meta({ id: 'User' });
+/**
+ * The account members listing, published as its own component because the document already carries
+ * `UserArray` — an array named at the top level rather than inlined at the use site.
+ *
+ * Naming the array keeps its item contract reusable and runtime-enforced as one unit.
+ */
+export const UserArraySchema = z.array(UserSchema).meta({ id: 'UserArray' });
+/**
+ * The compact user shape embedded in other resources' responses — currently the group members
+ * listing, which populates a user document down to these four fields.
+ *
+ * A `.pick()` of {@link UserSchema}, not a parallel object: `UserRef` IS a projection of `User`, so
+ * the field definitions, their requiredness and any constraints come from one declaration. A hand
+ * written copy would be a twin that drifts the first time a field on `User` changes. `.pick()` does
+ * not carry the `id: 'User'` metadata across, so this still publishes as its own component rather
+ * than a second `$ref` to `User`.
+ *
+ * `email` is therefore required here for the same reason it is on `User`, even though the Mongoose
+ * model marks it optional. That is not an oversight to fix by loosening the schema: the component
+ * has always said required, and the server maps a missing email to `''` rather than publishing a
+ * response that violates it.
+ *
+ * Note this is the WIRE projection. `UserRefPopulate` is the Mongoose one that feeds it, and stays
+ * written out: it names database fields and carries persistence concerns this schema has no view of.
+ */
+export const UserRefSchema = UserSchema.pick({
+    id: true,
+    name: true,
+    email: true,
+    picture: true,
+}).meta({ id: 'UserRef' });
+export const UserRefArraySchema = z.array(UserRefSchema).meta({ id: 'UserRefArray' });
+/**
+ * The writable subset of a user, picked from {@link UserSchema} rather than restated.
+ *
+ * Every field here means exactly what it means on `User` — same type, same constraints — so it comes
+ * from one declaration; `.partial()` then relaxes requiredness, which is the only thing a PUT payload
+ * genuinely changes about them. The fields NOT picked are the point of the whitelist: `email`,
+ * `externalId`, `sign_in_provider`, `source`, `annotations` and the timestamps are set by the
+ * identity provider or the server, and a picked schema makes that list impossible to widen by
+ * accident.
+ *
+ * Picking also carries the field descriptions across, so `properties`, `clearance` and `compartments`
+ * are now documented on the payload as they always were on `User`. That is additive documentation,
+ * not a contract change — the constraints are byte-identical. Use `.pick()` only where the request
+ * semantics really do match the response: a field that accepts `null` to clear a value, coerces, or
+ * carries a request-only constraint has to be overridden explicitly instead.
+ */
+export const UpdateUserPayloadSchema = UserSchema.pick({
+    name: true,
+    username: true,
+    picture: true,
+    language: true,
+    phone: true,
+    last_selected_account: true,
+    properties: true,
+    clearance: true,
+    compartments: true,
+})
+    .partial()
+    .meta({ id: 'UpdateUserPayload' });
+/**
+ * Shared by eight studio delete endpoints.
+ *
+ * The byte-identity guard in the generator does not make it safe to leave the others behind: the
+ * public `DeleteByIdResult` is now an alias inferred from this schema, so the TypeScript derivation
+ * the other slots relied on changes the moment this one does, and the generator refuses to publish
+ * a canonical and a derived component under a single name. Any future shared type has to move as a
+ * unit for the same reason.
+ */
+export const DeleteByIdResultSchema = z.object({ id: z.string() }).meta({ id: 'DeleteByIdResult' });
+/**
+ * The signup request contract, shared between the sign-in UI and `POST /auth/signup`.
+ *
+ * `accountType` and `maturity` stay `z.string()`. The UI sends `personal | company` for the first and
+ * a maturity catalog of its own for the second, and neither is drawn from the persisted `AccountType`
+ * enum — so narrowing them here would not be recording what the endpoint accepts, it would be
+ * changing it, and that is a deliberate contract change rather than part of a conversion.
+ *
+ * `companySize` is a number: the form sends a headcount, not a bucket label.
+ */
+export const SignupDataSchema = z
+    .strictObject({
+    accountType: z.string(),
+    companyName: z.string().optional(),
+    companySize: z.number().optional(),
+    companyWebsite: z.string().optional(),
+    maturity: z.string().optional(),
+})
+    .meta({ id: 'SignupData' });
+export const SignupPayloadSchema = z
+    .strictObject({
+    firebaseToken: z.string(),
+    signupData: SignupDataSchema,
+})
+    .meta({ id: 'SignupPayload' });
+//# sourceMappingURL=user.js.map

package/lib/api-schemas/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/api-schemas/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAChD,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC,MAAM,CAAC;IACjE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC,IAAI,CAAC;IACJ,EAAE,EAAE,mBAAmB;IACvB,WAAW,EACP,yFAAyF;QACzF,6FAA6F;QAC7F,oFAAoF;QACpF,yEAAyE;CAChF,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACtB,MAAM,CAAC;IACJ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,QAAQ,EAAE;SACV,IAAI,CAAC,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE,+EAA+E;KAC/F,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAC9C,WAAW,EAAE,2FAA2F;KAC3G,CAAC;IACF,WAAW,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,IAAI,CAAC,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAClF,wFAAwF;IACxF,yFAAyF;IACzF,wCAAwC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IACjG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;CAC9G,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC;IACzC,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;CAChB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;AAE3B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC;IACnD,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,IAAI;IACX,qBAAqB,EAAE,IAAI;IAC3B,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,IAAI;IACf,YAAY,EAAE,IAAI;CACrB,CAAC;KACG,OAAO,EAAE;KACT,IAAI,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEpG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC5B,YAAY,CAAC;IACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;AAEhC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAC/B,YAAY,CAAC;IACV,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,gBAAgB;CAC/B,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC"}