@vertesia/common 1.5.0-dev.20260725.083715Z → 1.5.0-dev.20260806.125520Z

package/lib/api-schemas/oauth.d.ts

@@ -0,0 +1,150 @@
+import { z } from 'zod';
+/**
+ * The OAuth *provider* contracts: Vertesia acting as an OAuth CLIENT against a third-party
+ * authorization server.
+ *
+ * The other direction — clients registered against Vertesia's own OAuth server, and the grants they
+ * hold — is `./oauth-server.js`. The split mirrors the one the TypeScript declarations already had,
+ * so each schema sits in the module its type came from and the canonical-alias map stays readable.
+ */
+/**
+ * The success acknowledgement four provider endpoints and the client delete return.
+ *
+ * Here rather than in a module of its own because these five slots are its only callers, which is
+ * the same reason `DeleteOperationResult` lives in `./apikey.js`. `common.ts` aliases the type so
+ * `SuccessResponse` keeps being imported from where it always was.
+ *
+ * `z.boolean()`, not `z.literal(true)`, and that is what the document has always published: the
+ * scanner widened the declared `success: true` to `type: boolean` on the way out. Publishing the
+ * literal would newly forbid `{ success: false }` for every existing client, while the handlers
+ * return `true` either way.
+ */
+export declare const SuccessResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+}, z.core.$strict>;
+/**
+ * A provider's stored configuration, without its id.
+ *
+ * Split from {@link OAuthProviderSchema} because `OAuthProvider extends OAuthProviderData` in the
+ * published types and both names are exported from the package. It carries no `id` in its meta, so
+ * it is never a component of its own: the document has only ever published `OAuthProvider`, with
+ * these properties inline and `id` last.
+ */
+export declare const OAuthProviderDataSchema: z.ZodObject<{
+    name: z.ZodString;
+    display_name: z.ZodString;
+    project: z.ZodString;
+    grant_type: z.ZodOptional<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        client_credentials: "client_credentials";
+    }>>;
+    authorization_endpoint: z.ZodOptional<z.ZodString>;
+    token_endpoint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    has_client_secret: z.ZodOptional<z.ZodBoolean>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    use_pkce: z.ZodBoolean;
+    revocation_endpoint: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, z.core.$strict>;
+export declare const OAuthProviderSchema: z.ZodObject<{
+    name: z.ZodString;
+    display_name: z.ZodString;
+    project: z.ZodString;
+    grant_type: z.ZodOptional<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        client_credentials: "client_credentials";
+    }>>;
+    authorization_endpoint: z.ZodOptional<z.ZodString>;
+    token_endpoint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    has_client_secret: z.ZodOptional<z.ZodBoolean>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    use_pkce: z.ZodBoolean;
+    revocation_endpoint: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strict>;
+export declare const OAuthProviderArraySchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    display_name: z.ZodString;
+    project: z.ZodString;
+    grant_type: z.ZodOptional<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        client_credentials: "client_credentials";
+    }>>;
+    authorization_endpoint: z.ZodOptional<z.ZodString>;
+    token_endpoint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    has_client_secret: z.ZodOptional<z.ZodBoolean>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    use_pkce: z.ZodBoolean;
+    revocation_endpoint: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+    id: z.ZodString;
+}, z.core.$strict>>;
+/**
+ * What a create accepts, which is deliberately not what a read returns.
+ *
+ * `client_secret` goes IN and never comes back out: the read shape carries `has_client_secret`
+ * instead. That request/response split is the rule for any component holding a credential, and
+ * keeping the two schemas separate is what makes it structural rather than a convention the next
+ * handler has to remember.
+ */
+export declare const CreateOAuthProviderPayloadSchema: z.ZodObject<{
+    name: z.ZodString;
+    display_name: z.ZodString;
+    grant_type: z.ZodOptional<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        client_credentials: "client_credentials";
+    }>>;
+    authorization_endpoint: z.ZodOptional<z.ZodString>;
+    token_endpoint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    default_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    use_pkce: z.ZodOptional<z.ZodBoolean>;
+    revocation_endpoint: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * The update contract shares the create fields but makes each optional; the handler writes only the
+ * fields present in the request.
+ */
+export declare const UpdateOAuthProviderPayloadSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    display_name: z.ZodOptional<z.ZodString>;
+    grant_type: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
+        authorization_code: "authorization_code";
+        client_credentials: "client_credentials";
+    }>>>;
+    authorization_endpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    token_endpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    client_id: z.ZodOptional<z.ZodString>;
+    client_secret: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    default_scopes: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    use_pkce: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+    revocation_endpoint: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+}, z.core.$strict>;
+export declare const OAuthProviderAuthStatusSchema: z.ZodObject<{
+    oauth_provider_id: z.ZodString;
+    oauth_provider_name: z.ZodString;
+    authenticated: z.ZodBoolean;
+    expires_at: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const OAuthProviderAuthorizeResponseSchema: z.ZodObject<{
+    authorization_url: z.ZodOptional<z.ZodString>;
+    state: z.ZodOptional<z.ZodString>;
+    connected: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const OAuthProviderAccessTokenResponseSchema: z.ZodObject<{
+    access_token: z.ZodString;
+}, z.core.$strict>;
+export declare const OAuthProviderExchangePayloadSchema: z.ZodObject<{
+    code: z.ZodString;
+    state: z.ZodString;
+}, z.core.$strict>;
+//# sourceMappingURL=oauth.d.ts.map

package/lib/api-schemas/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/api-schemas/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;kBAIE,CAAC;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;kBAyClC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;kBAEiE,CAAC;AAElG,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;mBAAkE,CAAC;AAExG;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;kBAuBvC,CAAC;AAEP;;;GAGG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;kBAI3C,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;kBAWpC,CAAC;AAEP,eAAO,MAAM,oCAAoC;;;;kBAU3C,CAAC;AAEP,eAAO,MAAM,sCAAsC;;kBAIE,CAAC;AAEtD,eAAO,MAAM,kCAAkC;;;kBAKE,CAAC"}

package/lib/api-schemas/oauth.js

@@ -0,0 +1,148 @@
+import { z } from 'zod';
+/**
+ * The OAuth *provider* contracts: Vertesia acting as an OAuth CLIENT against a third-party
+ * authorization server.
+ *
+ * The other direction — clients registered against Vertesia's own OAuth server, and the grants they
+ * hold — is `./oauth-server.js`. The split mirrors the one the TypeScript declarations already had,
+ * so each schema sits in the module its type came from and the canonical-alias map stays readable.
+ */
+/**
+ * The success acknowledgement four provider endpoints and the client delete return.
+ *
+ * Here rather than in a module of its own because these five slots are its only callers, which is
+ * the same reason `DeleteOperationResult` lives in `./apikey.js`. `common.ts` aliases the type so
+ * `SuccessResponse` keeps being imported from where it always was.
+ *
+ * `z.boolean()`, not `z.literal(true)`, and that is what the document has always published: the
+ * scanner widened the declared `success: true` to `type: boolean` on the way out. Publishing the
+ * literal would newly forbid `{ success: false }` for every existing client, while the handlers
+ * return `true` either way.
+ */
+export const SuccessResponseSchema = z
+    .strictObject({
+    success: z.boolean(),
+})
+    .meta({ id: 'SuccessResponse' });
+/**
+ * A provider's stored configuration, without its id.
+ *
+ * Split from {@link OAuthProviderSchema} because `OAuthProvider extends OAuthProviderData` in the
+ * published types and both names are exported from the package. It carries no `id` in its meta, so
+ * it is never a component of its own: the document has only ever published `OAuthProvider`, with
+ * these properties inline and `id` last.
+ */
+export const OAuthProviderDataSchema = z.strictObject({
+    name: z.string().meta({ description: 'Unique name within the project (kebab-case identifier).' }),
+    display_name: z.string().meta({ description: 'Human-readable display name.' }),
+    project: z.string().meta({ description: 'The project this OAuth provider belongs to.' }),
+    grant_type: z
+        .enum(['authorization_code', 'client_credentials'])
+        .meta({
+        description: "The OAuth 2.0 grant type to use.\n- 'authorization_code': 3-legged flow requiring user authorization (default).\n- 'client_credentials': 2-legged server-to-server flow using client_id + client_secret.",
+    })
+        .optional(),
+    authorization_endpoint: z
+        .string()
+        .meta({
+        description: 'The OAuth 2.0 authorization endpoint URL. Only used for authorization_code flow. Optional when endpoints are discovered via .well-known (e.g. MCP servers).',
+    })
+        .optional(),
+    token_endpoint: z
+        .string()
+        .meta({
+        description: 'The OAuth 2.0 token endpoint URL. Optional when endpoints are discovered via .well-known (e.g. MCP servers).',
+    })
+        .optional(),
+    client_id: z.string().meta({ description: 'The OAuth client ID (always required).' }),
+    has_client_secret: z
+        .boolean()
+        .meta({ description: 'Whether a client_secret is configured (never exposes the actual secret).' })
+        .optional(),
+    default_scopes: z
+        .array(z.string())
+        .meta({ description: 'Default scopes to request during authorization.' })
+        .optional(),
+    use_pkce: z.boolean().meta({
+        description: 'Whether to use PKCE (Proof Key for Code Exchange) in the authorization flow. Only applies to authorization_code flow. Defaults to true.',
+    }),
+    revocation_endpoint: z.string().meta({ description: 'Optional OAuth 2.0 revocation endpoint URL.' }).optional(),
+    created_at: z.string(),
+    updated_at: z.string(),
+});
+export const OAuthProviderSchema = OAuthProviderDataSchema.extend({
+    id: z.string(),
+}).meta({ id: 'OAuthProvider', description: 'OAuth Provider as returned by the API (with id).' });
+export const OAuthProviderArraySchema = z.array(OAuthProviderSchema).meta({ id: 'OAuthProviderArray' });
+/**
+ * What a create accepts, which is deliberately not what a read returns.
+ *
+ * `client_secret` goes IN and never comes back out: the read shape carries `has_client_secret`
+ * instead. That request/response split is the rule for any component holding a credential, and
+ * keeping the two schemas separate is what makes it structural rather than a convention the next
+ * handler has to remember.
+ */
+export const CreateOAuthProviderPayloadSchema = z
+    .strictObject({
+    name: z.string(),
+    display_name: z.string(),
+    grant_type: z.enum(['authorization_code', 'client_credentials']).optional(),
+    authorization_endpoint: z.string().optional(),
+    token_endpoint: z.string().optional(),
+    client_id: z.string(),
+    client_secret: z
+        .string()
+        .meta({
+        description: 'Optional client secret for confidential clients. Will be encrypted at rest and never returned in API responses.',
+    })
+        .optional(),
+    default_scopes: z.array(z.string()).optional(),
+    use_pkce: z.boolean().optional(),
+    revocation_endpoint: z.string().optional(),
+})
+    .meta({
+    id: 'CreateOAuthProviderPayload',
+    description: 'Payload for creating an OAuth Provider. The client_secret is accepted as plaintext on create and stored encrypted.',
+});
+/**
+ * The update contract shares the create fields but makes each optional; the handler writes only the
+ * fields present in the request.
+ */
+export const UpdateOAuthProviderPayloadSchema = CreateOAuthProviderPayloadSchema.partial().meta({
+    id: 'UpdateOAuthProviderPayload',
+    description: 'Payload for updating an OAuth Provider. All fields are optional — only provided fields are updated. To clear the client_secret, set it to an empty string.',
+});
+export const OAuthProviderAuthStatusSchema = z
+    .strictObject({
+    oauth_provider_id: z.string(),
+    oauth_provider_name: z.string(),
+    authenticated: z.boolean(),
+    expires_at: z.string().optional(),
+    scope: z.string().optional(),
+})
+    .meta({
+    id: 'OAuthProviderAuthStatus',
+    description: 'OAuth authentication status for a user against an OAuth Provider.',
+});
+export const OAuthProviderAuthorizeResponseSchema = z
+    .strictObject({
+    authorization_url: z.string().optional(),
+    state: z.string().optional(),
+    connected: z.boolean().optional(),
+})
+    .meta({
+    id: 'OAuthProviderAuthorizeResponse',
+    description: 'Response from the OAuth authorize endpoint. For authorization_code flow: contains authorization_url and state for browser redirect. For client_credentials flow: contains connected=true (token was fetched server-side, no redirect needed).',
+});
+export const OAuthProviderAccessTokenResponseSchema = z
+    .strictObject({
+    access_token: z.string(),
+})
+    .meta({ id: 'OAuthProviderAccessTokenResponse' });
+export const OAuthProviderExchangePayloadSchema = z
+    .strictObject({
+    code: z.string(),
+    state: z.string(),
+})
+    .meta({ id: 'OAuthProviderExchangePayload' });
+//# sourceMappingURL=oauth.js.map

package/lib/api-schemas/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/api-schemas/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACjC,YAAY,CAAC;IACV,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IACjG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC9E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IACxF,UAAU,EAAE,CAAC;SACR,IAAI,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;SAClD,IAAI,CAAC;QACF,WAAW,EACP,0MAA0M;KACjN,CAAC;SACD,QAAQ,EAAE;IACf,sBAAsB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,IAAI,CAAC;QACF,WAAW,EACP,6JAA6J;KACpK,CAAC;SACD,QAAQ,EAAE;IACf,cAAc,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,IAAI,CAAC;QACF,WAAW,EACP,8GAA8G;KACrH,CAAC;SACD,QAAQ,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACrF,iBAAiB,EAAE,CAAC;SACf,OAAO,EAAE;SACT,IAAI,CAAC,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;SACjG,QAAQ,EAAE;IACf,cAAc,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,IAAI,CAAC,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;SACxE,QAAQ,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC;QACvB,WAAW,EACP,yIAAyI;KAChJ,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9D,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC5C,YAAY,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC;SACX,MAAM,EAAE;SACR,IAAI,CAAC;QACF,WAAW,EACP,iHAAiH;KACxH,CAAC;SACD,QAAQ,EAAE;IACf,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,4BAA4B;IAChC,WAAW,EACP,oHAAoH;CAC3H,CAAC,CAAC;AAEP;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC;IAC5F,EAAE,EAAE,4BAA4B;IAChC,WAAW,EACP,4JAA4J;CACnK,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KACzC,YAAY,CAAC;IACV,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,mEAAmE;CACnF,CAAC,CAAC;AAEP,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC;KAChD,YAAY,CAAC;IACV,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,IAAI,CAAC;IACF,EAAE,EAAE,gCAAgC;IACpC,WAAW,EACP,+OAA+O;CACtP,CAAC,CAAC;AAEP,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KAClD,YAAY,CAAC;IACV,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,kCAAkC,EAAE,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAC9C,YAAY,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,IAAI,CAAC,EAAE,EAAE,EAAE,8BAA8B,EAAE,CAAC,CAAC"}

package/lib/api-schemas/parameters.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Query and header normalization, driven by the same component the spec publishes.
+ *
+ * Bodies arrive as JSON, so a body validates against its component directly and coercion is
+ * forbidden — the server must not accept a payload its own schema calls invalid. Parameters have no
+ * such luxury: a query string carries only text, so `?limit=25` is the string `'25'` where the
+ * published parameter says `type: integer`. Something has to map one to the other, and the only
+ * honest source for that mapping is the schema being published.
+ *
+ * So this module reads the component, decides what each declared parameter should become, and builds
+ * a NEW object. Two properties follow from that and both matter:
+ *
+ * - The request is never mutated. Koa memoizes `ctx.query` per query string and hands every later
+ *   reader the same object, so coercing in place would silently retype values for middleware and
+ *   handlers that never opted in — and `ctx.headers` is Node's own object.
+ * - Coercion is explicit rather than AJV's `coerceTypes`. The registry compiles one AJV
+ *   configuration for bodies and parameters alike, so turning coercion on for parameters would have
+ *   changed body policy too; and `coerceTypes` has its own rules (`''` becomes 0, `[]` becomes
+ *   `null`) that are neither published nor easy to predict. Everything below is a stated rule with a
+ *   test.
+ *
+ * What is NOT done here is validation. This produces a value; the caller validates it against the
+ * same component with the same validator a body uses, so a value that cannot be coerced is reported
+ * by the component's own schema rather than by a second error message that could disagree with it.
+ */
+import { type JsonObject } from './adapter.js';
+/** Where a parameter arrives. Decides name matching, and nothing else. */
+export type ApiParameterLocation = 'query' | 'header';
+/**
+ * Parameters as the transport presents them: text, possibly repeated, possibly absent.
+ *
+ * Matches both `ctx.query` (Koa parses with `URLSearchParams`, so a repeated key is an array and a
+ * single one is a string) and `ctx.headers` (Node lowercases names, joins most duplicates with
+ * `, `, and arrays only `set-cookie`).
+ */
+export interface RawApiParameters {
+    readonly [name: string]: string | string[] | undefined;
+}
+export interface NormalizedApiParameters {
+    /**
+     * The copy to validate: declared parameters only, coerced towards their published types, with
+     * absent ones omitted so the component's own `required` decides whether that is allowed.
+     */
+    value: Record<string, unknown>;
+    /**
+     * Query keys the component does not declare, in arrival order.
+     *
+     * Always empty for headers, structurally rather than by convention: every request carries headers
+     * no endpoint declares — `accept`, `user-agent`, tracing — so "undeclared" describes nothing
+     * there, and a caller that rejected on this list could never reject a standard header by mistake.
+     */
+    undeclared: string[];
+}
+/**
+ * Builds the value to validate for one parameter slot.
+ *
+ * Header names match case-insensitively, which is not a nicety: HTTP field names are
+ * case-insensitive by RFC 9110 and Node has already lowercased everything on the way in, so a
+ * component declaring `X-Request-Id` would never match a real request without this. The output is
+ * keyed by the DECLARED spelling, because that is the name the component validates and the spec
+ * publishes.
+ */
+export declare function normalizeParameters(component: string, raw: RawApiParameters, location: ApiParameterLocation, schema: JsonObject | undefined, components: Readonly<Record<string, JsonObject>>): NormalizedApiParameters;
+//# sourceMappingURL=parameters.d.ts.map

package/lib/api-schemas/parameters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parameters.d.ts","sourceRoot":"","sources":["../../src/api-schemas/parameters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,cAAc,CAAC;AAEjE,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1D;AAED,MAAM,WAAW,uBAAuB;IACpC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;CACxB;AAqND;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAC/B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GACjD,uBAAuB,CAyBzB"}

package/lib/api-schemas/parameters.js

@@ -0,0 +1,246 @@
+/**
+ * Query and header normalization, driven by the same component the spec publishes.
+ *
+ * Bodies arrive as JSON, so a body validates against its component directly and coercion is
+ * forbidden — the server must not accept a payload its own schema calls invalid. Parameters have no
+ * such luxury: a query string carries only text, so `?limit=25` is the string `'25'` where the
+ * published parameter says `type: integer`. Something has to map one to the other, and the only
+ * honest source for that mapping is the schema being published.
+ *
+ * So this module reads the component, decides what each declared parameter should become, and builds
+ * a NEW object. Two properties follow from that and both matter:
+ *
+ * - The request is never mutated. Koa memoizes `ctx.query` per query string and hands every later
+ *   reader the same object, so coercing in place would silently retype values for middleware and
+ *   handlers that never opted in — and `ctx.headers` is Node's own object.
+ * - Coercion is explicit rather than AJV's `coerceTypes`. The registry compiles one AJV
+ *   configuration for bodies and parameters alike, so turning coercion on for parameters would have
+ *   changed body policy too; and `coerceTypes` has its own rules (`''` becomes 0, `[]` becomes
+ *   `null`) that are neither published nor easy to predict. Everything below is a stated rule with a
+ *   test.
+ *
+ * What is NOT done here is validation. This produces a value; the caller validates it against the
+ * same component with the same validator a body uses, so a value that cannot be coerced is reported
+ * by the component's own schema rather than by a second error message that could disagree with it.
+ */
+import { resolveSchemaRef } from './adapter.js';
+/**
+ * Depth cap for target resolution.
+ *
+ * `resolveSchemaRef` detects a cycle within one chain, but `items` starts a fresh chain each time, so
+ * a component whose array items reference it back would recurse forever. Parameters are flat text;
+ * anything approaching this depth is a declaration mistake, and stopping at `opaque` leaves the value
+ * untouched for the component to reject.
+ */
+const MAX_TARGET_DEPTH = 8;
+/**
+ * Text this module maps to a JSON number.
+ *
+ * Deliberately narrower than `Number()`, which accepts several strings that are not numbers in any
+ * useful sense: `''` becomes 0, `' 1'` and `'\n1'` become 1, `'0x10'` becomes 16, `'Infinity'`
+ * becomes a value no JSON Schema `number` can hold. Each of those would let the server read a
+ * parameter as a value the published schema never describes.
+ *
+ * Deliberately WIDER than JSON's own number grammar, which rejects `'01'`, `'+1'`, `'1.'` and
+ * `'.5'`. Those denote one number unambiguously and match the handlers' existing `parseInt`/`Number`
+ * behavior; the remaining strictness applies only where the text is genuinely not a number.
+ *
+ * Anything rejected here is left as the original string, which the component then reports as a type
+ * error naming the parameter.
+ */
+const NUMERIC_TEXT = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * The declared type of a schema node, ignoring `null`.
+ *
+ * `type` may be a list — zod emits `['string', 'null']` for some nullable shapes — and nullability is
+ * not a coercion target: what a nullable string parameter needs is the string mapping, with the
+ * component deciding whether `null` is also allowed.
+ */
+function declaredType(schema) {
+    const type = schema.type;
+    if (typeof type === 'string')
+        return type;
+    if (Array.isArray(type)) {
+        return type.find((entry) => typeof entry === 'string' && entry !== 'null');
+    }
+    return undefined;
+}
+function unionVariants(schema) {
+    for (const keyword of ['anyOf', 'oneOf']) {
+        const variants = schema[keyword];
+        if (Array.isArray(variants)) {
+            const objects = variants.filter(isPlainObject);
+            if (objects.length > 0)
+                return objects;
+        }
+    }
+    return undefined;
+}
+/**
+ * What one declared parameter's text should be coerced to.
+ *
+ * The union rule is the one worth explaining. A `string | string[]` parameter — which this API has 29
+ * of — is published by the scanner as a single `type: array` parameter with `explode: true`, because
+ * that is the only serialization OpenAPI has for repeated values. Preferring the array variant here
+ * makes the runtime agree with that published shape: one occurrence normalizes to a one-element
+ * array, exactly as `explode: true` describes. Reading the scalar variant instead would mean the spec
+ * promised an array and the handler received a bare string.
+ */
+function parameterTarget(schema, components, depth = 0) {
+    if (!isPlainObject(schema) || depth >= MAX_TARGET_DEPTH)
+        return { kind: 'opaque' };
+    const resolved = resolveSchemaRef(schema, components) ?? schema;
+    const variants = unionVariants(resolved);
+    if (variants) {
+        const arrayVariant = variants.find((variant) => {
+            const target = parameterTarget(variant, components, depth + 1);
+            return target.kind === 'array';
+        });
+        if (arrayVariant)
+            return parameterTarget(arrayVariant, components, depth + 1);
+        // No array variant, so the parameter carries a single value. `null` is not a coercion target,
+        // so the first variant that names a real type decides — a nullable enum coerces as its enum.
+        for (const variant of variants) {
+            const target = parameterTarget(variant, components, depth + 1);
+            if (target.kind !== 'opaque')
+                return target;
+        }
+        return { kind: 'opaque' };
+    }
+    const type = declaredType(resolved);
+    if (type === 'array') {
+        return {
+            kind: 'array',
+            items: parameterTarget(resolved.items, components, depth + 1),
+            commaDelimited: true,
+        };
+    }
+    if (type === 'number' || type === 'integer' || type === 'boolean' || type === 'string') {
+        return { kind: type };
+    }
+    // An enum with no `type`, a bare `{}`, an unresolvable `$ref`: nothing to coerce towards, so the
+    // text passes through and the component decides.
+    return { kind: 'opaque' };
+}
+function coerceScalar(text, target) {
+    switch (target.kind) {
+        case 'number':
+        case 'integer': {
+            // `integer` coerces to a number and stops. AJV then reports a non-integral value against
+            // the published `type: integer`, so `?limit=1.5` is rejected by the schema rather than
+            // silently truncated to 1 the way `parseInt` would.
+            if (!NUMERIC_TEXT.test(text))
+                return text;
+            const value = Number(text);
+            return Number.isFinite(value) ? value : text;
+        }
+        case 'boolean':
+            // The two spellings a JSON Schema `boolean` can hold, plus the numeric pair. `'1'` is not
+            // an invention: the client SDK emits it (`getArtifactUrl` sends `url=1`) and the endpoint
+            // descriptions document it, so rejecting it would reject our own published usage. `'yes'`
+            // and a bare `?flag=` stay text and are rejected by the component — those really would be
+            // guesses about what the caller meant.
+            if (text === 'true' || text === '1')
+                return true;
+            if (text === 'false' || text === '0')
+                return false;
+            return text;
+        default:
+            return text;
+    }
+}
+/**
+ * Maps one parameter's raw text to the value its published schema describes.
+ *
+ * The scalar-with-repeats case is a deliberate rejection rather than a pick. `?level=account&level=project`
+ * on a parameter published as a single string arrives as an array, and it is handed on as an array so
+ * the component reports a type error. Choosing last-wins — what several ad-hoc handlers do today —
+ * would make the server accept a request its own contract does not describe, and nothing published
+ * says which occurrence wins.
+ */
+function coerceParameter(raw, target) {
+    if (target.kind === 'array') {
+        // `explode: true`: one occurrence is a one-element array.
+        const occurrences = Array.isArray(raw) ? raw : [raw];
+        // An occurrence carrying commas is several values. The document publishes `explode: true`,
+        // which describes repeated keys and says nothing about commas, so this is something the
+        // server accepts BEYOND what it promises — deliberately, because `@vertesia/client` joins
+        // every array parameter with `,`. Every SDK in the field therefore sends the comma form, and
+        // every hand-written reader this layer replaced read it: `readArray`, `parseTagsFilter` and
+        // `parseSourcesQuery` all spelled it `Array.isArray(v) ? v : String(v).split(',')`, and the
+        // agent-run search split `sort`, `tags` and `categories` the same way.
+        //
+        // The cost is that a value containing a literal comma cannot be expressed, with no escape.
+        // That is not a new limit — it is what every one of those readers already did — and it is
+        // why a parameter whose values may legitimately contain commas must not be published as an
+        // array of plain strings.
+        //
+        // Split per occurrence rather than after joining, so the two spellings compose:
+        // `?status=pending,completed&status=cancelled` is the same three values as three keys.
+        const items = target.commaDelimited ? occurrences.flatMap((item) => item.split(',')) : occurrences;
+        return items.map((item) => coerceScalar(item, target.items));
+    }
+    if (Array.isArray(raw))
+        return raw;
+    return coerceScalar(raw, target);
+}
+/**
+ * The object schema a parameter component must be, resolved through any reference chain.
+ *
+ * A component that is not an object cannot be expanded into named parameters — the scanner would not
+ * publish one either — so this is a declaration bug, and it throws rather than degrading to "validate
+ * nothing". Reaching the handler with an unchecked query while the spec advertised a checked one is
+ * the failure the whole arrangement exists to prevent.
+ */
+function parameterObjectSchema(component, schema, components) {
+    const resolved = schema ? resolveSchemaRef(schema, components) : undefined;
+    const properties = resolved?.properties;
+    if (!resolved || declaredType(resolved) !== 'object' || !isPlainObject(properties)) {
+        throw new Error(`Component '${component}' is declared as a query or header contract, but it is not an object ` +
+            'schema with properties, so it cannot be expanded into named parameters. Declare it as an ' +
+            'object whose properties are the parameters.');
+    }
+    const required = new Set(Array.isArray(resolved.required)
+        ? resolved.required.filter((name) => typeof name === 'string')
+        : []);
+    return { properties, required };
+}
+/**
+ * Builds the value to validate for one parameter slot.
+ *
+ * Header names match case-insensitively, which is not a nicety: HTTP field names are
+ * case-insensitive by RFC 9110 and Node has already lowercased everything on the way in, so a
+ * component declaring `X-Request-Id` would never match a real request without this. The output is
+ * keyed by the DECLARED spelling, because that is the name the component validates and the spec
+ * publishes.
+ */
+export function normalizeParameters(component, raw, location, schema, components) {
+    const { properties } = parameterObjectSchema(component, schema, components);
+    const caseInsensitive = location === 'header';
+    const entries = [];
+    const matched = new Set();
+    for (const [name, propertySchema] of Object.entries(properties)) {
+        const key = caseInsensitive ? name.toLowerCase() : name;
+        // `hasOwn` rather than a truthiness check: an inherited member would otherwise be read as a
+        // parameter, so a component declaring `constructor` or `toString` would receive a function.
+        if (!Object.hasOwn(raw, key))
+            continue;
+        const value = raw[key];
+        matched.add(key);
+        // An explicitly `undefined` value is the transport saying the parameter never arrived. Omitting
+        // it leaves requiredness to the component instead of validating `undefined` against a type.
+        if (value === undefined)
+            continue;
+        entries.push([name, coerceParameter(value, parameterTarget(propertySchema, components))]);
+    }
+    return {
+        // `fromEntries` rather than assignment, so a component that declares `__proto__` gets an own
+        // property instead of reassigning the copy's prototype.
+        value: Object.fromEntries(entries),
+        undeclared: caseInsensitive ? [] : Object.keys(raw).filter((key) => !matched.has(key)),
+    };
+}
+//# sourceMappingURL=parameters.js.map

package/lib/api-schemas/parameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parameters.js","sourceRoot":"","sources":["../../src/api-schemas/parameters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAmB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AA6CjE;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;;;;;;;;;;;;GAcG;AACH,MAAM,YAAY,GAAG,iDAAiD,CAAC;AAEvE,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAkB;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,MAAkB;IACrC,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAC;QAC3C,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CACpB,MAAe,EACf,UAAgD,EAChD,KAAK,GAAG,CAAC;IAET,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,gBAAgB;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC;IAEhE,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAI,YAAY;YAAE,OAAO,eAAe,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9E,8FAA8F;QAC9F,6FAA6F;QAC7F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACnB,OAAO;YACH,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC;YAC7D,cAAc,EAAE,IAAI;SACvB,CAAC;IACN,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,iGAAiG;IACjG,iDAAiD;IACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAuB;IACvD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,EAAE,CAAC;YACb,yFAAyF;YACzF,uFAAuF;YACvF,oDAAoD;YACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,SAAS;YACV,0FAA0F;YAC1F,0FAA0F;YAC1F,0FAA0F;YAC1F,0FAA0F;YAC1F,uCAAuC;YACvC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACnD,OAAO,IAAI,CAAC;QAChB;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAsB,EAAE,MAAuB;IACpE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,0DAA0D;QAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,2FAA2F;QAC3F,wFAAwF;QACxF,0FAA0F;QAC1F,6FAA6F;QAC7F,4FAA4F;QAC5F,4FAA4F;QAC5F,uEAAuE;QACvE,EAAE;QACF,2FAA2F;QAC3F,0FAA0F;QAC1F,2FAA2F;QAC3F,0BAA0B;QAC1B,EAAE;QACF,gFAAgF;QAChF,uFAAuF;QACvF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACnG,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAC1B,SAAiB,EACjB,MAA8B,EAC9B,UAAgD;IAEhD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACX,cAAc,SAAS,uEAAuE;YAC1F,2FAA2F;YAC3F,6CAA6C,CACpD,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACpB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5B,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC9E,CAAC,CAAC,EAAE,CACX,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAC/B,SAAiB,EACjB,GAAqB,EACrB,QAA8B,EAC9B,MAA8B,EAC9B,UAAgD;IAEhD,MAAM,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,QAAQ,KAAK,QAAQ,CAAC;IAE9C,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,4FAA4F;QAC5F,4FAA4F;QAC5F,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,gGAAgG;QAChG,4FAA4F;QAC5F,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO;QACH,6FAA6F;QAC7F,wDAAwD;QACxD,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;QAClC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KACzF,CAAC;AACN,CAAC"}