@vertesia/common 1.5.0-dev.20260725.083715Z → 1.5.0-dev.20260806.125520Z

package/lib/account-values.js

@@ -0,0 +1,91 @@
+/**
+ * Account values that exist at runtime — enums, constants, and the pure helpers over them.
+ *
+ * Split out of `user.ts` so the dependency direction can run one way. The API schemas need these
+ * values (`z.enum(BillingMethod)`, `.max(ACCOUNT_APP_ACCESS_MESSAGE_MAX_LENGTH)`), and `user.ts`
+ * needs the types the schemas infer. Both living in `user.ts` would make it import from a module
+ * that imports it back; here, `user.ts` and `api-schemas/account.ts` both depend on this module and
+ * nothing depends on them.
+ *
+ * Everything here is re-exported from `user.ts`, so existing import paths keep working — this is a
+ * move, not a rename.
+ */
+export var Datacenters;
+(function (Datacenters) {
+    Datacenters["aws"] = "aws";
+    Datacenters["gcp"] = "gcp";
+    Datacenters["azure"] = "azure";
+})(Datacenters || (Datacenters = {}));
+export var BillingMethod;
+(function (BillingMethod) {
+    BillingMethod["stripe"] = "stripe";
+    BillingMethod["invoice"] = "invoice";
+})(BillingMethod || (BillingMethod = {}));
+export var AccountType;
+(function (AccountType) {
+    AccountType["vertesia"] = "vertesia";
+    AccountType["partner"] = "partner";
+    AccountType["free"] = "free";
+    AccountType["customer"] = "customer";
+    AccountType["prospect"] = "prospect";
+    AccountType["unknown"] = "unknown";
+})(AccountType || (AccountType = {}));
+/**
+ * Quota/rate-limit tier assigned to an account. Code-defined tiers live in `@dglabs/quota`
+ * (`QUOTA_TIERS`); these names must match its keys.
+ * - `standard` — protective baseline limits (the default for most accounts).
+ * - `enterprise` — high limits for contracted customers / internal / partners.
+ *
+ * An account with no explicit `quota_tier` derives its tier from its `account_type`.
+ */
+export var QuotaTier;
+(function (QuotaTier) {
+    QuotaTier["standard"] = "standard";
+    QuotaTier["enterprise"] = "enterprise";
+})(QuotaTier || (QuotaTier = {}));
+/**
+ * Default tier for an account that has no explicit `quota_tier`, derived from its `account_type`:
+ * contracted customers and internal Vertesia accounts get `enterprise`; everyone else (partner,
+ * free, prospect, unknown) gets the protective `standard` baseline.
+ */
+export function quotaTierForAccountType(accountType) {
+    switch (accountType) {
+        case AccountType.customer:
+        case AccountType.vertesia:
+            return QuotaTier.enterprise;
+        default:
+            return QuotaTier.standard;
+    }
+}
+export const ACCOUNT_NAMESPACE_MAX_LENGTH = 63;
+export const ACCOUNT_APP_ACCESS_MESSAGE_MAX_LENGTH = 1000;
+export const RESERVED_ACCOUNT_NAMESPACES = [
+    'admin',
+    'api',
+    'apps',
+    'auth',
+    'cdn',
+    'docs',
+    'internal-auth',
+    'mcp',
+    'status',
+    'sts',
+    'www',
+];
+const ACCOUNT_NAMESPACE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+export function normalizeAccountNamespace(namespace) {
+    return namespace.trim().toLowerCase();
+}
+export function getAccountNamespaceValidationError(namespace) {
+    if (!namespace) {
+        return 'Account namespace is required';
+    }
+    if (namespace.length > ACCOUNT_NAMESPACE_MAX_LENGTH || !ACCOUNT_NAMESPACE_PATTERN.test(namespace)) {
+        return 'Account namespace must be a lowercase DNS label containing only letters, numbers, and hyphens';
+    }
+    if (RESERVED_ACCOUNT_NAMESPACES.includes(namespace)) {
+        return `Account namespace '${namespace}' is reserved`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=account-values.js.map

package/lib/account-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-values.js","sourceRoot":"","sources":["../src/account-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAN,IAAY,WAIX;AAJD,WAAY,WAAW;IACnB,0BAAW,CAAA;IACX,0BAAW,CAAA;IACX,8BAAe,CAAA;AACnB,CAAC,EAJW,WAAW,KAAX,WAAW,QAItB;AAED,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACrB,kCAAiB,CAAA;IACjB,oCAAmB,CAAA;AACvB,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED,MAAM,CAAN,IAAY,WAOX;AAPD,WAAY,WAAW;IACnB,oCAAqB,CAAA;IACrB,kCAAmB,CAAA;IACnB,4BAAa,CAAA;IACb,oCAAqB,CAAA;IACrB,oCAAqB,CAAA;IACrB,kCAAmB,CAAA;AACvB,CAAC,EAPW,WAAW,KAAX,WAAW,QAOtB;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,SAGX;AAHD,WAAY,SAAS;IACjB,kCAAqB,CAAA;IACrB,sCAAyB,CAAA;AAC7B,CAAC,EAHW,SAAS,KAAT,SAAS,QAGpB;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAA2C;IAC/E,QAAQ,WAAW,EAAE,CAAC;QAClB,KAAK,WAAW,CAAC,QAAQ,CAAC;QAC1B,KAAK,WAAW,CAAC,QAAQ;YACrB,OAAO,SAAS,CAAC,UAAU,CAAC;QAChC;YACI,OAAO,SAAS,CAAC,QAAQ,CAAC;IAClC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACvC,OAAO;IACP,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,eAAe;IACf,KAAK;IACL,QAAQ;IACR,KAAK;IACL,KAAK;CACC,CAAC;AAEX,MAAM,yBAAyB,GAAG,wCAAwC,CAAC;AAE3E,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACvD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,SAAiB;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO,+BAA+B,CAAC;IAC3C,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,4BAA4B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,+FAA+F,CAAC;IAC3G,CAAC;IACD,IAAK,2BAAiD,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,OAAO,sBAAsB,SAAS,eAAe,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/lib/analytics.d.ts

@@ -1,41 +1,15 @@
-export interface AnalyticsAxis {
-    environment?: string;
-    project?: string;
-    interactions?: string[];
-    models?: string[];
-    status?: string[];
-    tags?: string[];
-    selectedOnly?: boolean;
-}
-export interface RunAnalyticsQuery {
-    /** filters to apply to the query */
-    filterBy: AnalyticsAxis;
-    /** The field to group by */
-    groupBy?: RunAnalyticsGroupBy;
-    /** The start date of the query in EPOCH format */
-    from?: number;
-    /** The end date of the query in EPOCH format */
-    to?: number;
-    /** The time resolution unit of the analytics query */
-    resolution?: TimeResolution;
-    /** The step size for the resolution (e.g., 4 with resolution='hour' means 4-hour intervals). Defaults to 1. */
-    resolutionStep?: number;
-    /** The field to sort by */
-    virtual?: boolean;
-}
-export type RunAnalyticsGroupBy = 'interaction' | 'modelId' | 'project' | 'status' | 'tags' | 'environment';
-export type TimeResolution = 'minute' | 'hour' | 'day' | 'week' | 'month' | 'year';
-export interface RunAnalyticsResult {
-    date: string;
-    timestamp: string;
-    group: string;
-    count: number;
-    execution_time: {
-        avg: number;
-        min: number;
-        max: number;
-    };
-}
+import type { z } from 'zod';
+import type { AnalyticsAxisSchema, RunAnalyticsGroupBySchema, RunAnalyticsQuerySchema, RunAnalyticsResultSchema, TimeResolutionSchema } from './api-schemas/analytics.js';
+/**
+ * The five run-analytics contract types, inferred from `./api-schemas/analytics.js`. Their
+ * documentation moved with them — a doc comment here would be published on TOP of the schema's
+ * `description` and the two would drift.
+ */
+export type AnalyticsAxis = z.infer<typeof AnalyticsAxisSchema>;
+export type RunAnalyticsQuery = z.infer<typeof RunAnalyticsQuerySchema>;
+export type RunAnalyticsGroupBy = z.infer<typeof RunAnalyticsGroupBySchema>;
+export type TimeResolution = z.infer<typeof TimeResolutionSchema>;
+export type RunAnalyticsResult = z.infer<typeof RunAnalyticsResultSchema>;
 /** Entity with status breakdown */
 export interface EntityStatusCounts {
     id: string;

package/lib/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAC9B,oCAAoC;IACpC,QAAQ,EAAE,aAAa,CAAC;IAExB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAE9B,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,sDAAsD;IACtD,UAAU,CAAC,EAAE,cAAc,CAAC;IAE5B,+GAA+G;IAC/G,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAC;AAE5G,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;KACf,CAAC;CACL;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IAEX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACjC,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACzC,iDAAiD;IACjD,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC3B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uHAAuH;AACvH,MAAM,WAAW,iBAAiB;IAC9B,aAAa,EAAE,uBAAuB,EAAE,CAAC;IACzC,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EACR,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACvB,MAAM,4BAA4B,CAAC;AAEpC;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IAEX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACjC,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,kDAAkD;IAClD,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACzC,iDAAiD;IACjD,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL;AAED,8CAA8C;AAC9C,MAAM,WAAW,cAAc;IAC3B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,uBAAuB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,uHAAuH;AACvH,MAAM,WAAW,iBAAiB;IAC9B,aAAa,EAAE,uBAAuB,EAAE,CAAC;IACzC,UAAU,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAClB,CAAC;CACL"}

package/lib/api-schemas/access-control.d.ts

@@ -0,0 +1,215 @@
+import { z } from 'zod';
+import { AccessControlPrincipalType, AccessControlResourceType, Permission } from '../access-control-values.js';
+/**
+ * Runtime API schemas for IAM roles and access-control entries.
+ */
+/**
+ * The permission vocabulary, hoisted so `SystemRoleDefinition` publishes one reusable enum rather
+ * than an inline copy per property.
+ */
+export declare const PermissionSchema: z.ZodEnum<typeof Permission>;
+export declare const AccessControlResourceTypeSchema: z.ZodEnum<typeof AccessControlResourceType>;
+export declare const AccessControlPrincipalTypeSchema: z.ZodEnum<typeof AccessControlPrincipalType>;
+export declare const AbacScopeSchema: z.ZodEnum<{
+    collection: "collection";
+    document: "document";
+    task: "task";
+}>;
+export declare const RoleDomainSchema: z.ZodEnum<{
+    content: "content";
+    system: "system";
+    tasks: "tasks";
+}>;
+/**
+ * Deliberately unconstrained, and hoisted so the constraint's ABSENCE is stated in one place. A
+ * condition value is compared by the token and content-security evaluators, which accept literals,
+ * operator objects (`{ $gte: 5 }`) and `$principal.` cross-references — a union no schema could
+ * usefully close without freezing that vocabulary into the public contract.
+ */
+export declare const PropertyConditionValueSchema: z.ZodUnknown;
+export declare const PropertyConditionsSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+/**
+ * Closed, and that matters here: the SERVER stores two more fields inside `conditions` —
+ * `principal_name` and `resource_name` — which this component has never declared. They are display
+ * names held there until `principal`/`resource` migrate from ObjectId to string, and the handlers
+ * copy them back into `principal`/`resource` on the way out. Every response that also serialized the
+ * raw sub-document was therefore violating its own schema; the mappers now build `conditions`
+ * explicitly, so the value still reaches the client — in the field the contract declares.
+ */
+export declare const AceConditionsSchema: z.ZodObject<{
+    principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        collection: "collection";
+        document: "document";
+        task: "task";
+    }>>;
+}, z.core.$strip>;
+/**
+ * The access control entry as it crosses the wire.
+ *
+ * `resource` and `principal` are strings here and ObjectIds in Mongo — except for the dynamic
+ * (`principal_set` / `content_set`) entries, where the stored ObjectId is meaningless and the handler
+ * substitutes the display name out of `conditions`. That substitution is the reason these endpoints
+ * need a mapper rather than a serialized document: no cast can express "this field is a different
+ * value depending on another field".
+ *
+ * The timestamps are plain strings rather than `format: date-time`, which is what the document
+ * already publishes. Unlike `User` and `UserGroup` this is NOT safe to tighten in passing: `expires_at`
+ * shares the declaration and is written from an unvalidated payload, so an existing caller could have
+ * stored a value AJV would now reject.
+ */
+export declare const AccessControlEntrySchema: z.ZodObject<{
+    role: z.ZodString;
+    resource_type: z.ZodEnum<typeof AccessControlResourceType>;
+    resource: z.ZodString;
+    principal_type: z.ZodEnum<typeof AccessControlPrincipalType>;
+    principal: z.ZodString;
+    account: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+    conditions: z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            collection: "collection";
+            document: "document";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_at: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodOptional<z.ZodString>;
+    updated_at: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const AccessControlEntryArraySchema: z.ZodArray<z.ZodObject<{
+    role: z.ZodString;
+    resource_type: z.ZodEnum<typeof AccessControlResourceType>;
+    resource: z.ZodString;
+    principal_type: z.ZodEnum<typeof AccessControlPrincipalType>;
+    principal: z.ZodString;
+    account: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+    conditions: z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            collection: "collection";
+            document: "document";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_at: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodOptional<z.ZodString>;
+    updated_at: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+}, z.core.$strip>>;
+/**
+ * Create and update payloads, picked from the entry rather than restated.
+ *
+ * `ACECreatePayload extends Omit<AccessControlEntry, 'created_at' | 'updated_at' | 'id'>` is what the
+ * hand-written types said, so `.omit()` is the literal translation — and the right operator here for
+ * the reason the guidance gives: the derived shape is almost everything. `ACEUpdatePayload` was
+ * `Partial<ACECreatePayload>`, which `.partial()` reproduces exactly.
+ */
+export declare const ACECreatePayloadSchema: z.ZodObject<{
+    role: z.ZodString;
+    resource_type: z.ZodEnum<typeof AccessControlResourceType>;
+    resource: z.ZodString;
+    principal_type: z.ZodEnum<typeof AccessControlPrincipalType>;
+    principal: z.ZodString;
+    account: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+    conditions: z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            collection: "collection";
+            document: "document";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_at: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const ACEUpdatePayloadSchema: z.ZodObject<{
+    role: z.ZodOptional<z.ZodString>;
+    resource_type: z.ZodOptional<z.ZodEnum<typeof AccessControlResourceType>>;
+    resource: z.ZodOptional<z.ZodString>;
+    principal_type: z.ZodOptional<z.ZodEnum<typeof AccessControlPrincipalType>>;
+    principal: z.ZodOptional<z.ZodString>;
+    account: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    project: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    conditions: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        principal_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resource_props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            collection: "collection";
+            document: "document";
+            task: "task";
+        }>>;
+    }, z.core.$strip>>>;
+    tags: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    expires_at: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * The role catalog. Both shapes are static — computed from the in-process role registry, never read
+ * from Mongo — so these two slots carry no persistence boundary at all.
+ */
+export declare const RoleDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+    domain: z.ZodEnum<{
+        content: "content";
+        system: "system";
+        tasks: "tasks";
+    }>;
+}, z.core.$strip>;
+export declare const RoleDefinitionArraySchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+    domain: z.ZodEnum<{
+        content: "content";
+        system: "system";
+        tasks: "tasks";
+    }>;
+}, z.core.$strip>>;
+/**
+ * `.extend()` and not a second object: `SystemRoleDefinition extends RoleDefinition` narrowing
+ * `permissions`, expressed as the override it is. Overriding a property keeps its position, so the
+ * published property order is unchanged.
+ */
+export declare const SystemRoleDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    domain: z.ZodEnum<{
+        content: "content";
+        system: "system";
+        tasks: "tasks";
+    }>;
+    permissions: z.ZodArray<z.ZodEnum<typeof Permission>>;
+}, z.core.$strip>;
+export declare const SystemRoleDefinitionArraySchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    domain: z.ZodEnum<{
+        content: "content";
+        system: "system";
+        tasks: "tasks";
+    }>;
+    permissions: z.ZodArray<z.ZodEnum<typeof Permission>>;
+}, z.core.$strip>>;
+/**
+ * The public access-control types, inferred rather than written. `../access-control.ts` and
+ * `../roles/types.ts` re-export these under their public names.
+ */
+export type PropertyConditionsFromSchema = z.infer<typeof PropertyConditionsSchema>;
+export type AceConditionsFromSchema = z.infer<typeof AceConditionsSchema>;
+export type AccessControlEntryFromSchema = z.infer<typeof AccessControlEntrySchema>;
+export type AccessControlEntryArrayFromSchema = z.infer<typeof AccessControlEntryArraySchema>;
+export type ACECreatePayloadFromSchema = z.infer<typeof ACECreatePayloadSchema>;
+export type ACEUpdatePayloadFromSchema = z.infer<typeof ACEUpdatePayloadSchema>;
+export type RoleDefinitionFromSchema = z.infer<typeof RoleDefinitionSchema>;
+export type RoleDefinitionArrayFromSchema = z.infer<typeof RoleDefinitionArraySchema>;
+export type SystemRoleDefinitionFromSchema = z.infer<typeof SystemRoleDefinitionSchema>;
+export type SystemRoleDefinitionArrayFromSchema = z.infer<typeof SystemRoleDefinitionArraySchema>;
+//# sourceMappingURL=access-control.d.ts.map

package/lib/api-schemas/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../src/api-schemas/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEH,0BAA0B,EAC1B,yBAAyB,EACzB,UAAU,EAEb,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AAEH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8BAAgD,CAAC;AAE9E,eAAO,MAAM,+BAA+B,6CAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC,8CAE3C,CAAC;AAEH,eAAO,MAAM,eAAe;;;;EAA+C,CAAC;AAE5E,eAAO,MAAM,gBAAgB;;;;EAO3B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,cAGvC,CAAC;AAEH,eAAO,MAAM,wBAAwB,wCAEE,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;iBAsB1B,CAAC;AAEP;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;iBA8BE,CAAC;AAExC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;kBAA4E,CAAC;AAEvH;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;iBAIA,CAAC;AAEpC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;iBAAoE,CAAC;AAExG;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAiB3B,CAAC;AAEP,eAAO,MAAM,yBAAyB;;;;;;;;kBAAoE,CAAC;AAE3G;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBAOrC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;kBAEE,CAAC;AAE/C;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AACpF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAC9F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAChF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAC5E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACtF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACxF,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/lib/api-schemas/access-control.js

@@ -0,0 +1,165 @@
+import { z } from 'zod';
+// From the values module, never from `../access-control.js` or `../roles/types.js`: both derive
+// their public types from the schemas below, so importing them here would invert the dependency.
+import { AbacScopes, AccessControlPrincipalType, AccessControlResourceType, Permission, RoleDomains, } from '../access-control-values.js';
+/**
+ * Runtime API schemas for IAM roles and access-control entries.
+ */
+/**
+ * The permission vocabulary, hoisted so `SystemRoleDefinition` publishes one reusable enum rather
+ * than an inline copy per property.
+ */
+export const PermissionSchema = z.enum(Permission).meta({ id: 'Permission' });
+export const AccessControlResourceTypeSchema = z.enum(AccessControlResourceType).meta({
+    id: 'AccessControlResourceType',
+});
+export const AccessControlPrincipalTypeSchema = z.enum(AccessControlPrincipalType).meta({
+    id: 'AccessControlPrincipalType',
+});
+export const AbacScopeSchema = z.enum(AbacScopes).meta({ id: 'AbacScope' });
+export const RoleDomainSchema = z.enum(RoleDomains).meta({
+    id: 'RoleDomain',
+    description: 'Logical grouping of roles by the service area that owns them. One domain may declare roles ' +
+        'applicable to multiple scopes (e.g. the `content` domain owns roles applicable to both `document` ' +
+        'and `collection` scopes). The `system` domain owns the built-in foundational roles (currently ' +
+        'exposed as `SystemRoles`) — registered first so domain partitions cannot shadow them.',
+});
+/**
+ * Deliberately unconstrained, and hoisted so the constraint's ABSENCE is stated in one place. A
+ * condition value is compared by the token and content-security evaluators, which accept literals,
+ * operator objects (`{ $gte: 5 }`) and `$principal.` cross-references — a union no schema could
+ * usefully close without freezing that vocabulary into the public contract.
+ */
+export const PropertyConditionValueSchema = z.unknown().meta({
+    id: 'PropertyConditionValue',
+    description: 'A single condition value. Resolved and evaluated dynamically by token/content security code.',
+});
+export const PropertyConditionsSchema = z
+    .record(z.string(), PropertyConditionValueSchema)
+    .meta({ id: 'PropertyConditions' });
+/**
+ * Closed, and that matters here: the SERVER stores two more fields inside `conditions` —
+ * `principal_name` and `resource_name` — which this component has never declared. They are display
+ * names held there until `principal`/`resource` migrate from ObjectId to string, and the handlers
+ * copy them back into `principal`/`resource` on the way out. Every response that also serialized the
+ * raw sub-document was therefore violating its own schema; the mappers now build `conditions`
+ * explicitly, so the value still reaches the client — in the field the contract declares.
+ */
+export const AceConditionsSchema = z
+    .object({
+    principal_props: PropertyConditionsSchema.meta({
+        description: 'Property conditions matched against user/group properties at token time (PrincipalSet).',
+    }).optional(),
+    resource_props: PropertyConditionsSchema.meta({
+        description: 'Property conditions matched against object properties at query time (ResourceSet).',
+    }).optional(),
+    scope: AbacScopeSchema.meta({
+        description: "Kind of object the `resource_props` matches. Used to disambiguate which partition's roles " +
+            'apply (e.g. content roles vs task roles) and to form the JWT `content_security` key prefix ' +
+            "(`{scope}:{verb}`). Absent → `'document'` (default; emits bare `read`/`write`/`delete` keys " +
+            'for backward compatibility).',
+    }).optional(),
+})
+    .meta({
+    id: 'AceConditions',
+    description: 'Conditions attached to an ACE for dynamic matching.\n' +
+        '- `principal_props`: matched against user/group properties at token time (PrincipalSet).\n' +
+        '- `resource_props`: matched against object properties at query time (ResourceSet).',
+});
+/**
+ * The access control entry as it crosses the wire.
+ *
+ * `resource` and `principal` are strings here and ObjectIds in Mongo — except for the dynamic
+ * (`principal_set` / `content_set`) entries, where the stored ObjectId is meaningless and the handler
+ * substitutes the display name out of `conditions`. That substitution is the reason these endpoints
+ * need a mapper rather than a serialized document: no cast can express "this field is a different
+ * value depending on another field".
+ *
+ * The timestamps are plain strings rather than `format: date-time`, which is what the document
+ * already publishes. Unlike `User` and `UserGroup` this is NOT safe to tighten in passing: `expires_at`
+ * shares the declaration and is written from an unvalidated payload, so an existing caller could have
+ * stored a value AJV would now reject.
+ */
+export const AccessControlEntrySchema = z
+    .object({
+    role: z.string().meta({
+        description: 'Role name. Typed as `string` because role names now span multiple partitions: `SystemRoles` ' +
+            "enum values for system-domain roles, and bare strings for ABAC-domain roles (e.g. `'content:reader'`, " +
+            "`'content:writer'`, `'content:manager'`). Mongoose schema validates the value against the " +
+            'registered role catalog via `getAllRoleNames()`.',
+    }),
+    resource_type: AccessControlResourceTypeSchema,
+    resource: z.string(),
+    principal_type: AccessControlPrincipalTypeSchema,
+    principal: z.string(),
+    account: z
+        .string()
+        .meta({ description: 'Account scope — required for principal_set/content_set ACEs.' })
+        .optional(),
+    project: z
+        .string()
+        .meta({ description: 'Project scope — narrows a principal_set/content_set ACE to a single project.' })
+        .optional(),
+    conditions: AceConditionsSchema.meta({
+        description: 'Dynamic matching conditions for principal_set/content_set ACEs.',
+    }).optional(),
+    tags: z.array(z.string()).optional(),
+    expires_at: z.string().optional(),
+    created_at: z.string().optional(),
+    updated_at: z.string().optional(),
+    id: z.string(),
+})
+    .meta({ id: 'AccessControlEntry' });
+export const AccessControlEntryArraySchema = z.array(AccessControlEntrySchema).meta({ id: 'AccessControlEntryArray' });
+/**
+ * Create and update payloads, picked from the entry rather than restated.
+ *
+ * `ACECreatePayload extends Omit<AccessControlEntry, 'created_at' | 'updated_at' | 'id'>` is what the
+ * hand-written types said, so `.omit()` is the literal translation — and the right operator here for
+ * the reason the guidance gives: the derived shape is almost everything. `ACEUpdatePayload` was
+ * `Partial<ACECreatePayload>`, which `.partial()` reproduces exactly.
+ */
+export const ACECreatePayloadSchema = AccessControlEntrySchema.omit({
+    created_at: true,
+    updated_at: true,
+    id: true,
+}).meta({ id: 'ACECreatePayload' });
+export const ACEUpdatePayloadSchema = ACECreatePayloadSchema.partial().meta({ id: 'ACEUpdatePayload' });
+/**
+ * The role catalog. Both shapes are static — computed from the in-process role registry, never read
+ * from Mongo — so these two slots carry no persistence boundary at all.
+ */
+export const RoleDefinitionSchema = z
+    .object({
+    name: z.string(),
+    permissions: z.array(z.string()),
+    domain: RoleDomainSchema,
+})
+    .meta({
+    id: 'RoleDefinition',
+    description: 'Wire shape of a role returned by the IAM `/roles` endpoint.\n\n' +
+        'Permissions are typed `string[]` because role names span multiple partitions (system, content, ' +
+        'future tasks/etc.) and each partition has its own vocabulary. For the tightly-typed system-only ' +
+        'view (with `permissions: Permission[]`) use `SystemRoleDefinition` and the `/roles/system` endpoint.\n\n' +
+        "NOTE: this interface is intentionally non-generic. The OpenAPI generator doesn't handle TypeScript " +
+        'generics cleanly in array response types and produces a degenerate `RoleDefinitionArray` schema. ' +
+        'Keeping the wire shapes concrete avoids that. `SystemRoleDefinition` extends and narrows ' +
+        '`permissions` to `Permission[]`.',
+});
+export const RoleDefinitionArraySchema = z.array(RoleDefinitionSchema).meta({ id: 'RoleDefinitionArray' });
+/**
+ * `.extend()` and not a second object: `SystemRoleDefinition extends RoleDefinition` narrowing
+ * `permissions`, expressed as the override it is. Overriding a property keeps its position, so the
+ * published property order is unchanged.
+ */
+export const SystemRoleDefinitionSchema = RoleDefinitionSchema.extend({
+    permissions: z.array(PermissionSchema),
+}).meta({
+    id: 'SystemRoleDefinition',
+    description: 'Tightly-typed view of a system-domain role: permissions are central `Permission` enum values. ' +
+        "Returned by `client.iam.roles.listSystem()` and by the server's `/roles/system` endpoint.",
+});
+export const SystemRoleDefinitionArraySchema = z
+    .array(SystemRoleDefinitionSchema)
+    .meta({ id: 'SystemRoleDefinitionArray' });
+//# sourceMappingURL=access-control.js.map

package/lib/api-schemas/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../src/api-schemas/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,gGAAgG;AAChG,iGAAiG;AACjG,OAAO,EACH,UAAU,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,UAAU,EACV,WAAW,GACd,MAAM,6BAA6B,CAAC;AAErC;;GAEG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC;IAClF,EAAE,EAAE,2BAA2B;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC;IACpF,EAAE,EAAE,4BAA4B;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;IACrD,EAAE,EAAE,YAAY;IAChB,WAAW,EACP,6FAA6F;QAC7F,oGAAoG;QACpG,gGAAgG;QAChG,uFAAuF;CAC9F,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC;IACzD,EAAE,EAAE,wBAAwB;IAC5B,WAAW,EAAE,8FAA8F;CAC9G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACpC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC;KAChD,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACJ,eAAe,EAAE,wBAAwB,CAAC,IAAI,CAAC;QAC3C,WAAW,EAAE,yFAAyF;KACzG,CAAC,CAAC,QAAQ,EAAE;IACb,cAAc,EAAE,wBAAwB,CAAC,IAAI,CAAC;QAC1C,WAAW,EAAE,oFAAoF;KACpG,CAAC,CAAC,QAAQ,EAAE;IACb,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC;QACxB,WAAW,EACP,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,8BAA8B;KACrC,CAAC,CAAC,QAAQ,EAAE;CAChB,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,eAAe;IACnB,WAAW,EACP,uDAAuD;QACvD,4FAA4F;QAC5F,oFAAoF;CAC3F,CAAC,CAAC;AAEP;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACpC,MAAM,CAAC;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAClB,WAAW,EACP,8FAA8F;YAC9F,wGAAwG;YACxG,4FAA4F;YAC5F,kDAAkD;KACzD,CAAC;IACF,aAAa,EAAE,+BAA+B;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,gCAAgC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC;SACL,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;SACrF,QAAQ,EAAE;IACf,OAAO,EAAE,CAAC;SACL,MAAM,EAAE;SACR,IAAI,CAAC,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;SACrG,QAAQ,EAAE;IACf,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;QACjC,WAAW,EAAE,iEAAiE;KACjF,CAAC,CAAC,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAExC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAEvH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC,IAAI,CAAC;IAChE,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;IAChB,EAAE,EAAE,IAAI;CACX,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAExG;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAChC,MAAM,CAAC;IACJ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,EAAE,gBAAgB;CAC3B,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,gBAAgB;IACpB,WAAW,EACP,iEAAiE;QACjE,iGAAiG;QACjG,kGAAkG;QAClG,0GAA0G;QAC1G,qGAAqG;QACrG,mGAAmG;QACnG,2FAA2F;QAC3F,kCAAkC;CACzC,CAAC,CAAC;AAEP,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAE3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,MAAM,CAAC;IAClE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACzC,CAAC,CAAC,IAAI,CAAC;IACJ,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EACP,gGAAgG;QAChG,2FAA2F;CAClG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC3C,KAAK,CAAC,0BAA0B,CAAC;KACjC,IAAI,CAAC,EAAE,EAAE,EAAE,2BAA2B,EAAE,CAAC,CAAC"}