@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/submission-challenge/submission-challenge.shared.js

@@ -0,0 +1,123 @@
+/**
+ * The challenge a public submission answers before the backend accepts it (#1735).
+ *
+ * ## Why two kinds, and why the second one is not optional
+ *
+ * A captcha vendor that analyses visitors for its own purposes needs their consent (Google reCAPTCHA:
+ * CNIL Délibération SAN-2023-003, recorded on the frontend consent classification), so a visitor who
+ * declines must still be able to submit. If declining meant "no challenge", a bot would decline too and
+ * the captcha would protect nothing. So an application that protects a form accepts EITHER:
+ *
+ * - a vendor token (`PROVIDER_TOKEN`) — obtained by the consented vendor's browser part and verified by its
+ *   backend part (reCAPTCHA `siteverify`);
+ * - a proof of work (`PROOF_OF_WORK`) — the engine's own challenge, consent-exempt because nothing leaves
+ *   the application and nothing is stored in the visitor's browser: the backend issues a salted SHA-256
+ *   puzzle signed with an application key, the browser searches for the number, the backend re-derives it.
+ *   It makes each submission cost the sender CPU time instead of identifying anyone.
+ *
+ * A submission with neither, or with one that fails, is refused: the challenge fails CLOSED.
+ *
+ * The proof-of-work scheme is ALTCHA's: challenge = SHA-256(salt + number), the client iterates numbers until the hash
+ * matches. The signature here covers the salt as well as the hash (HMAC(salt + "\n" + challenge)): the hash input has
+ * no separator and the salt ends in its expiry digits, so a signature over the hash alone would let digits move from
+ * the number onto the salt and forge a later expiry.
+ * spec-cite: https://altcha.org/docs/proof-of-work/ (read through its search summary 2026-09-29) — the scheme
+ * is described, not quoted; the field names below are this framework's own.
+ *
+ * ## Browser-safe on purpose
+ *
+ * The website's contact form encodes and solves challenges in the visitor's browser, so this file imports
+ * nothing and uses only `globalThis.crypto.subtle`, which both browsers and Node provide.
+ */
+/** Which kind of answer a submission carries. */
+export var SubmissionChallengeResponseKind;
+(function (SubmissionChallengeResponseKind) {
+    /** A token from a consented captcha vendor's browser part, verified by the same vendor's backend part. */
+    SubmissionChallengeResponseKind["PROVIDER_TOKEN"] = "provider_token";
+    /** The engine's own consent-exempt proof of work. */
+    SubmissionChallengeResponseKind["PROOF_OF_WORK"] = "proof_of_work";
+})(SubmissionChallengeResponseKind || (SubmissionChallengeResponseKind = {}));
+/**
+ * The actions the ENGINE's own protected operations are bound to. A vendor token is minted for an action and the
+ * backend refuses one minted for another, so a token solved on one form cannot be replayed on another.
+ *
+ * This enum names the engine's actions only. An application protects its OWN anonymous operation by declaring
+ * `submissionChallenge: { action: '<its action>' }` on the operation variant (#1985), with an action it names in its
+ * own vocabulary; see {@link ResourceOperationSubmissionChallenge} for why the declaration takes a name rather than a
+ * member of this enum.
+ */
+export var SubmissionChallengeAction;
+(function (SubmissionChallengeAction) {
+    /** The public contact form (`POST /inbound-contacts`). */
+    SubmissionChallengeAction["INBOUND_CONTACT"] = "inbound_contact";
+})(SubmissionChallengeAction || (SubmissionChallengeAction = {}));
+/**
+ * The names a submission-challenge action may take: letters, digits, underscores and slashes, 1 to 100 characters.
+ *
+ * The character set is the captcha vendor's. The action is sent to Google reCAPTCHA as the `action` a token is minted
+ * for and checked against on `siteverify`, and reCAPTCHA v3 states "Actions might contain only alphanumeric
+ * characters, slashes, and underscores." A name outside it would be minted by no vendor, so every token for it would
+ * be refused. The 100-character bound is this framework's own: nothing longer is a name a person reads in a console.
+ * spec-cite: https://developers.google.com/recaptcha/docs/v3 §"Actions" (fetched 2026-09-29)
+ */
+export const SUBMISSION_CHALLENGE_ACTION_PATTERN = /^[A-Za-z0-9_/]{1,100}$/u;
+/** Whether `value` is an action name a captcha vendor can mint a token for. See {@link SUBMISSION_CHALLENGE_ACTION_PATTERN}. */
+export function isSubmissionChallengeActionName(value) {
+    return typeof value === 'string' && SUBMISSION_CHALLENGE_ACTION_PATTERN.test(value);
+}
+/** The only hash the proof of work uses. Named so the wire value has one runtime source. */
+export var ProofOfWorkAlgorithm;
+(function (ProofOfWorkAlgorithm) {
+    ProofOfWorkAlgorithm["SHA_256"] = "SHA-256";
+})(ProofOfWorkAlgorithm || (ProofOfWorkAlgorithm = {}));
+/**
+ * Where a browser asks for a proof-of-work challenge, under the API base path. The ONE source of this path: the
+ * backend's route table (`MANUAL_CONTROLLER_ROUTES_URLS`) reads it from here, so a browser form can reach it without
+ * pulling that whole table into its bundle.
+ */
+export const SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH = '/submission-challenges/proof-of-work';
+/**
+ * The stable `error.code` of a refused public submission — what a client branches on (the engine hoists an error's
+ * `context.code` to the top-level `error.code` of its response). A form answers either one again, with the proof of
+ * work.
+ */
+export var SubmissionChallengeRefusalCode;
+(function (SubmissionChallengeRefusalCode) {
+    /** No answer was sent, and the application protects this form. */
+    SubmissionChallengeRefusalCode["REQUIRED"] = "SUBMISSION_CHALLENGE_REQUIRED";
+    /** An answer was sent and not accepted. */
+    SubmissionChallengeRefusalCode["REFUSED"] = "SUBMISSION_CHALLENGE_REFUSED";
+})(SubmissionChallengeRefusalCode || (SubmissionChallengeRefusalCode = {}));
+/** The largest encoded answer the backend reads; anything longer is refused before it is parsed. */
+export const SUBMISSION_CHALLENGE_RESPONSE_MAX_LENGTH = 8192;
+/** Encode an answer for the request header. */
+export function encodeSubmissionChallengeResponse(response) {
+    return JSON.stringify(response);
+}
+function toHex(buffer) {
+    return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+/** Hex SHA-256 of `salt + number` — the one hash both the solver and the backend compute. */
+export async function hashProofOfWorkCandidate(salt, number) {
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(`${salt}${number}`));
+    return toHex(digest);
+}
+/**
+ * Find the number a challenge was built from, or `undefined` when none up to `maxNumber` matches (a
+ * challenge not issued by this scheme). Yields to the event loop every `yieldEvery` tries so a page stays
+ * responsive while it searches.
+ */
+export async function solveProofOfWorkChallenge(challenge, options = {}) {
+    const yieldEvery = options.yieldEvery ?? 1000;
+    for (let number = 0; number <= challenge.maxNumber; number += 1) {
+        if (options.signal?.aborted)
+            return undefined;
+        if (await hashProofOfWorkCandidate(challenge.salt, number) === challenge.challenge) {
+            return { kind: SubmissionChallengeResponseKind.PROOF_OF_WORK, challenge, number };
+        }
+        if (number % yieldEvery === yieldEvery - 1)
+            await new Promise((resolve) => setTimeout(resolve, 0));
+    }
+    return undefined;
+}
+//# sourceMappingURL=submission-challenge.shared.js.map

package/dist/esm/security/submission-challenge/submission-challenge.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-challenge.shared.js","sourceRoot":"","sources":["../../../../../src/security/submission-challenge/submission-challenge.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iDAAiD;AACjD,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,0GAA0G;IAC1G,oEAAiC,CAAA;IACjC,qDAAqD;IACrD,kEAA+B,CAAA;AACjC,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,yBAGX;AAHD,WAAY,yBAAyB;IACnC,0DAA0D;IAC1D,gEAAmC,CAAA;AACrC,CAAC,EAHW,yBAAyB,KAAzB,yBAAyB,QAGpC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;AAE7E,gIAAgI;AAChI,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAsBD,4FAA4F;AAC5F,MAAM,CAAN,IAAY,oBAEX;AAFD,WAAY,oBAAoB;IAC9B,2CAAmB,CAAA;AACrB,CAAC,EAFW,oBAAoB,KAApB,oBAAoB,QAE/B;AA8BD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,sCAAsC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,CAAN,IAAY,8BAKX;AALD,WAAY,8BAA8B;IACxC,kEAAkE;IAClE,4EAA0C,CAAA;IAC1C,2CAA2C;IAC3C,0EAAwC,CAAA;AAC1C,CAAC,EALW,8BAA8B,KAA9B,8BAA8B,QAKzC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,wCAAwC,GAAG,IAAI,CAAC;AAE7D,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,QAAqC;IACrF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,KAAK,CAAC,MAAmB;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAc;IACzE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAA+B,EAC/B,UAA2E,EAAE;IAE7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,MAAM,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS,CAAC,SAAS,EAAE,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,+BAA+B,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,GAAG,UAAU,KAAK,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * The challenge a public submission answers before the backend accepts it (#1735).\n *\n * ## Why two kinds, and why the second one is not optional\n *\n * A captcha vendor that analyses visitors for its own purposes needs their consent (Google reCAPTCHA:\n * CNIL Délibération SAN-2023-003, recorded on the frontend consent classification), so a visitor who\n * declines must still be able to submit. If declining meant \"no challenge\", a bot would decline too and\n * the captcha would protect nothing. So an application that protects a form accepts EITHER:\n *\n * - a vendor token (`PROVIDER_TOKEN`) — obtained by the consented vendor's browser part and verified by its\n *   backend part (reCAPTCHA `siteverify`);\n * - a proof of work (`PROOF_OF_WORK`) — the engine's own challenge, consent-exempt because nothing leaves\n *   the application and nothing is stored in the visitor's browser: the backend issues a salted SHA-256\n *   puzzle signed with an application key, the browser searches for the number, the backend re-derives it.\n *   It makes each submission cost the sender CPU time instead of identifying anyone.\n *\n * A submission with neither, or with one that fails, is refused: the challenge fails CLOSED.\n *\n * The proof-of-work scheme is ALTCHA's: challenge = SHA-256(salt + number), the client iterates numbers until the hash\n * matches. The signature here covers the salt as well as the hash (HMAC(salt + \"\\n\" + challenge)): the hash input has\n * no separator and the salt ends in its expiry digits, so a signature over the hash alone would let digits move from\n * the number onto the salt and forge a later expiry.\n * spec-cite: https://altcha.org/docs/proof-of-work/ (read through its search summary 2026-09-29) — the scheme\n * is described, not quoted; the field names below are this framework's own.\n *\n * ## Browser-safe on purpose\n *\n * The website's contact form encodes and solves challenges in the visitor's browser, so this file imports\n * nothing and uses only `globalThis.crypto.subtle`, which both browsers and Node provide.\n */\n\n/** Which kind of answer a submission carries. */\nexport enum SubmissionChallengeResponseKind {\n  /** A token from a consented captcha vendor's browser part, verified by the same vendor's backend part. */\n  PROVIDER_TOKEN = 'provider_token',\n  /** The engine's own consent-exempt proof of work. */\n  PROOF_OF_WORK = 'proof_of_work',\n}\n\n/**\n * The actions the ENGINE's own protected operations are bound to. A vendor token is minted for an action and the\n * backend refuses one minted for another, so a token solved on one form cannot be replayed on another.\n *\n * This enum names the engine's actions only. An application protects its OWN anonymous operation by declaring\n * `submissionChallenge: { action: '<its action>' }` on the operation variant (#1985), with an action it names in its\n * own vocabulary; see {@link ResourceOperationSubmissionChallenge} for why the declaration takes a name rather than a\n * member of this enum.\n */\nexport enum SubmissionChallengeAction {\n  /** The public contact form (`POST /inbound-contacts`). */\n  INBOUND_CONTACT = 'inbound_contact',\n}\n\n/**\n * The names a submission-challenge action may take: letters, digits, underscores and slashes, 1 to 100 characters.\n *\n * The character set is the captcha vendor's. The action is sent to Google reCAPTCHA as the `action` a token is minted\n * for and checked against on `siteverify`, and reCAPTCHA v3 states \"Actions might contain only alphanumeric\n * characters, slashes, and underscores.\" A name outside it would be minted by no vendor, so every token for it would\n * be refused. The 100-character bound is this framework's own: nothing longer is a name a person reads in a console.\n * spec-cite: https://developers.google.com/recaptcha/docs/v3 §\"Actions\" (fetched 2026-09-29)\n */\nexport const SUBMISSION_CHALLENGE_ACTION_PATTERN = /^[A-Za-z0-9_/]{1,100}$/u;\n\n/** Whether `value` is an action name a captcha vendor can mint a token for. See {@link SUBMISSION_CHALLENGE_ACTION_PATTERN}. */\nexport function isSubmissionChallengeActionName(value: unknown): value is string {\n  return typeof value === 'string' && SUBMISSION_CHALLENGE_ACTION_PATTERN.test(value);\n}\n\n/**\n * An operation variant's declaration that an UNAUTHENTICATED caller answers a submission challenge (#1985).\n *\n * `action` is a NAME (an open identifier), not a member of {@link SubmissionChallengeAction}, so an application can\n * protect its own anonymous create (a waitlist, a quote request) without the engine growing a member for it. The\n * engine's own operations pass their enum member; an application passes a member of its own enum. What keeps the name\n * honest is the grammar ({@link SUBMISSION_CHALLENGE_ACTION_PATTERN}), which the resource factory enforces.\n *\n * Rejected alternatives, recorded because each was on the table:\n * - A closed engine enum grown one member per protected operation. The engine cannot know an application's forms, so\n *   an application's own create could never be protected: exactly the gap this declaration closes.\n * - Deriving the action from the operation (`<resource>/<operation>`). It needs no authoring, but a resource or variant\n *   identifier may carry characters the vendor refuses (a hyphen), so the derivation would have to rewrite them, and two\n *   operations could then collide on one action with nothing saying so. A declared name is visible, reviewable and fixed.\n */\nexport interface ResourceOperationSubmissionChallenge {\n  /** The action a vendor token must have been minted for. Name one per form: sharing it lets a token move between them. */\n  readonly action: string;\n}\n\n/** The only hash the proof of work uses. Named so the wire value has one runtime source. */\nexport enum ProofOfWorkAlgorithm {\n  SHA_256 = 'SHA-256',\n}\n\n/** A proof-of-work challenge as the backend issues it. Every field is echoed back unchanged in the answer. */\nexport interface ProofOfWorkChallenge {\n  readonly algorithm: ProofOfWorkAlgorithm;\n  /** Random, and carries the expiry (`<hex>?expires=<unix seconds>`) so the signature covers it. */\n  readonly salt: string;\n  /** Hex SHA-256 of `salt + number` for the secret number. */\n  readonly challenge: string;\n  /** The largest number the search has to try. */\n  readonly maxNumber: number;\n  /** Hex HMAC-SHA-256 of `salt`, a newline and `challenge`, under the application's challenge key — so the salt and its expiry cannot be edited. */\n  readonly signature: string;\n}\n\n/** What a submission sends, in the `WildoHeaderKeys.SUBMISSION_CHALLENGE_RESPONSE` header, JSON-encoded. */\nexport type SubmissionChallengeResponse =\n  | {\n    readonly kind: SubmissionChallengeResponseKind.PROVIDER_TOKEN;\n    /** The captcha provider whose browser part minted the token (`recaptcha`). */\n    readonly providerRef: string;\n    readonly token: string;\n  }\n  | {\n    readonly kind: SubmissionChallengeResponseKind.PROOF_OF_WORK;\n    readonly challenge: ProofOfWorkChallenge;\n    /** The number the browser found. */\n    readonly number: number;\n  };\n\n/**\n * Where a browser asks for a proof-of-work challenge, under the API base path. The ONE source of this path: the\n * backend's route table (`MANUAL_CONTROLLER_ROUTES_URLS`) reads it from here, so a browser form can reach it without\n * pulling that whole table into its bundle.\n */\nexport const SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH = '/submission-challenges/proof-of-work';\n\n/**\n * The stable `error.code` of a refused public submission — what a client branches on (the engine hoists an error's\n * `context.code` to the top-level `error.code` of its response). A form answers either one again, with the proof of\n * work.\n */\nexport enum SubmissionChallengeRefusalCode {\n  /** No answer was sent, and the application protects this form. */\n  REQUIRED = 'SUBMISSION_CHALLENGE_REQUIRED',\n  /** An answer was sent and not accepted. */\n  REFUSED = 'SUBMISSION_CHALLENGE_REFUSED',\n}\n\n/** The largest encoded answer the backend reads; anything longer is refused before it is parsed. */\nexport const SUBMISSION_CHALLENGE_RESPONSE_MAX_LENGTH = 8192;\n\n/** Encode an answer for the request header. */\nexport function encodeSubmissionChallengeResponse(response: SubmissionChallengeResponse): string {\n  return JSON.stringify(response);\n}\n\nfunction toHex(buffer: ArrayBuffer): string {\n  return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/** Hex SHA-256 of `salt + number` — the one hash both the solver and the backend compute. */\nexport async function hashProofOfWorkCandidate(salt: string, number: number): Promise<string> {\n  const digest = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(`${salt}${number}`));\n  return toHex(digest);\n}\n\n/**\n * Find the number a challenge was built from, or `undefined` when none up to `maxNumber` matches (a\n * challenge not issued by this scheme). Yields to the event loop every `yieldEvery` tries so a page stays\n * responsive while it searches.\n */\nexport async function solveProofOfWorkChallenge(\n  challenge: ProofOfWorkChallenge,\n  options: { readonly yieldEvery?: number; readonly signal?: AbortSignal } = {},\n): Promise<SubmissionChallengeResponse | undefined> {\n  const yieldEvery = options.yieldEvery ?? 1000;\n  for (let number = 0; number <= challenge.maxNumber; number += 1) {\n    if (options.signal?.aborted) return undefined;\n    if (await hashProofOfWorkCandidate(challenge.salt, number) === challenge.challenge) {\n      return { kind: SubmissionChallengeResponseKind.PROOF_OF_WORK, challenge, number };\n    }\n    if (number % yieldEvery === yieldEvery - 1) await new Promise((resolve) => setTimeout(resolve, 0));\n  }\n  return undefined;\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-actions.shared.schemas.d.ts

@@ -0,0 +1,384 @@
+/**
+ * Declared ACTIONS of a system of record (#1678) — the named vendor operations an application may run against the
+ * ERP it reads, beside the row reads and row writes its read-through bindings already open.
+ *
+ * Posting an invoice (Odoo `account.move` `action_post`), confirming a sales order, an OData bound or unbound action:
+ * none of them is a row write, and before this nothing declared one and nothing executed one. The only thing that
+ * could run one was the systems-of-record registry's raw access hand-out, which returns an instance's credentials and
+ * records nothing (#1738 withdrew it from every application-facing door).
+ *
+ * ## The decision these declarations implement (Paul, 2026-09-25, on #1677/#1678)
+ *
+ * One vendor may serve two roles through two SEPARATE lanes. The system-of-record lane declares named actions and runs
+ * them under the INSTANCE's service identity, confined to the owner organization and to the member's partition, with
+ * its own audit event. The same vendor may also be a classical provider with its own user or organization connections.
+ * The two share a vendor identity for display and compliance, and never a credential or a runtime object (#1049 D10).
+ * There is no Odoo provider package, and a provider operation can never name a system-of-record instance.
+ *
+ * ## WHERE an action is declared, and the placement that was rejected
+ *
+ * On a read-through BINDING (`httpApiBinding.actions`), both kinds:
+ *
+ * - a RECORD-targeted action on the binding of the entity it acts on, which supplies the key codec that decodes the
+ *   target id and the resource whose read gates decide whether the caller may reach that record;
+ * - a RECORD-FREE action on the binding of the entity whose model (Odoo) or service (OData) the call is made against.
+ *
+ * Rejected: record-free actions on the INSTANCE (`systemsOfRecord.<name>.actions` in `wildo.saas.config.ts`). Three
+ * reasons, any one sufficient. An action declares a Zod INPUT schema, and the saas configuration is parsed by the CLI
+ * and the companion as data, where a schema object is not representable. An action declares the ROLES admitted to it,
+ * which are the same role keys the resource's operations declare in `shared-lib`, and a second home for them would
+ * drift. And the HTTP exposure of an action is a custom operation on a read-through resource, which lives in the
+ * resource configuration anyway; the instance declaration is not in scope there (it lives in the application root, not
+ * in `shared-lib`). What the instance keeps is what only the instance knows: whether its data is partitioned, which is
+ * why a record-free action's partition stance is checked at boot, where both are visible.
+ *
+ * ## What is checked where
+ *
+ * - HERE, at authoring (the resource factory, through `assertHttpApiBindingDialectCoherence`): the call shape against
+ *   the binding's dialect, the target against the call shape, the refused vendor methods, the stance's placement.
+ * - At BOOT (the resources registry, where the instance and the vendor facet are visible): the facet declares the call
+ *   shape, a record-free action on a PARTITIONED instance states its partition stance, and action names are unique per
+ *   instance.
+ * - Per REQUEST (the system-of-record action executor): who may run it, on which record, and what it sends.
+ */
+import { z } from 'zod';
+import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';
+/** @wildo_source:part:start saas.models.system-of-record-actions facet:layer:shared facet:audience:app-developer */
+/**
+ * The wire SHAPE of a vendor action — how the engine calls it. Declared by the VENDOR FACET (which shapes its product
+ * supports, `actionCallShapes`) and chosen per action by its declaration.
+ *
+ * REST_JSON has no member: an arbitrary REST surface has no action convention to compile against, and a declared method
+ * plus path template is a design of its own. A REST_JSON binding declaring an action is refused by name. (REST_JSON
+ * ROW writes are declared per verb since #1728 — `operations.create` / `update` / `delete` — because a row write has a
+ * fixed meaning a method and a path can carry; an action's meaning is the vendor's, and has no such shape.)
+ */
+export declare enum SystemOfRecordActionCallShape {
+    /**
+     * Odoo's `object.execute_kw(db, uid, key, model, method, positional, keyword)` — any public model method, the
+     * credential inside the RPC arguments. A record-targeted call passes the record ids as its first positional
+     * argument, which is how Odoo addresses a recordset method such as `action_post`.
+     *
+     * spec-cite: Odoo 18.0 developer documentation, External API — "Calling methods" (the execute_kw argument layout).
+     */
+    ODOO_EXECUTE_KW = "odoo-execute-kw",
+    /**
+     * An OData v4 BOUND action: `POST <EntitySet>(<key>)/<Namespace>.<Action>`, parameters in the JSON body.
+     *
+     * spec-cite: OData Version 4.01 Part 1: Protocol §11.5.5 (Actions) and §11.5.5.1 (Invoking an Action).
+     */
+    ODATA_BOUND_ACTION = "odata-bound-action",
+    /**
+     * An OData v4 UNBOUND action reached through its action import: `POST /<ActionImport>`, parameters in the JSON body.
+     *
+     * spec-cite: OData Version 4.01 Part 1: Protocol §11.5.5.1 (Invoking an Action).
+     */
+    ODATA_UNBOUND_ACTION = "odata-unbound-action"
+}
+/**
+ * The dialect each call shape is spoken over. Total over {@link SystemOfRecordActionCallShape}, so a new shape is a
+ * compile error here until somebody says which dialect it belongs to.
+ */
+export declare const SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT: Readonly<Record<SystemOfRecordActionCallShape, HttpApiTransportDialect>>;
+/** What an action acts ON. */
+export declare enum SystemOfRecordActionTarget {
+    /**
+     * ONE record of the binding's entity, addressed by its synthesized id. The record is READ FIRST through the binding's
+     * read gates (owner organization, partition), so a caller can act only on a record it could see — and a record
+     * outside its partition answers as absent, exactly as a read answers.
+     */
+    RECORD = "record",
+    /** No record: a model-level Odoo method (`create`) or an OData unbound action. */
+    NONE = "none"
+}
+/** Where an Odoo action's validated input goes in the `execute_kw` call. */
+export declare enum SystemOfRecordOdooActionInputPlacement {
+    /** The input object is the keyword-argument dict. The default: most recordset methods take options by keyword. */
+    KEYWORD_ARGUMENTS = "keyword-arguments",
+    /**
+     * The input object is the (next) POSITIONAL argument — after the id list on a record-targeted action, first on a
+     * record-free one. `create(vals)` is the canonical case.
+     */
+    POSITIONAL = "positional",
+    /** The method takes nothing beyond its records (`action_post`). The declared input must then be empty. */
+    NONE = "none"
+}
+/**
+ * How a RECORD-FREE action relates to the instance's partitions (#1058), required at boot when the instance is
+ * partitioned. A record-targeted action needs none: the record it reads first carries its partition.
+ */
+export declare enum SystemOfRecordActionPartitionStanceKind {
+    /**
+     * The action touches no partitioned data — a lookup of a vendor setting, an action whose effect no partition owns.
+     * The declaration must say WHY in `reason`, because a claim nothing checks has to be one a reviewer can read.
+     */
+    PARTITION_NEUTRAL = "partition-neutral",
+    /**
+     * The action CARRIES the partition as one of its inputs, and the engine derives it from the caller's organization
+     * unit exactly as a read-through create is placed (#1679): a member of one unit lands in its partition, a member of
+     * several names the unit, and a caller may never supply the partition value itself.
+     */
+    MEMBER_UNIT_PARTITION = "member-unit-partition"
+}
+export declare const SystemOfRecordActionPartitionStanceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL>;
+    /** Why no partition is reached. Read by a reviewer; nothing can verify it, which is why it is required. */
+    reason: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION>;
+    /**
+     * The REMOTE parameter the placed partition value is written into (`company_id`): a key of the Odoo keyword
+     * arguments or of the positional input object, or a member of the OData body. The caller's input may not carry it.
+     */
+    parameter: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type SystemOfRecordActionPartitionStance = z.infer<typeof SystemOfRecordActionPartitionStanceSchema>;
+export declare const SystemOfRecordActionCallSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODOO_EXECUTE_KW>;
+    /** The model method, in Odoo's own spelling (`action_post`, `create`). */
+    method: z.ZodString;
+    /**
+     * The model the call is made on, for a RECORD-FREE action only. A record-targeted action acts on the binding's own
+     * model — the one its key codec and read gates describe — so naming another would decode the id against the wrong
+     * entity. Absent means the binding's `entityRef`.
+     */
+    model: z.ZodOptional<z.ZodString>;
+    inputPlacement: z.ZodDefault<z.ZodEnum<typeof SystemOfRecordOdooActionInputPlacement>>;
+}, z.core.$strict>, z.ZodObject<{
+    shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODATA_BOUND_ACTION>;
+    /** The namespace-qualified action name (`Microsoft.Dynamics.CRM.WinOpportunity`). */
+    qualifiedName: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION>;
+    /** The action import's name, as the service root exposes it. */
+    actionImport: z.ZodString;
+}, z.core.$strict>], "shape">;
+export type SystemOfRecordActionCall = z.infer<typeof SystemOfRecordActionCallSchema>;
+/**
+ * The application's NAME for an action — lowerCamelCase, and distinct from the vendor's method name on purpose: the
+ * name is what code, roles and audit rows speak (`postInvoice`), the call is what the vendor understands
+ * (`account.move` `action_post`). Unique per INSTANCE across every binding, checked at boot, because callers address an
+ * action by `(system, action)`.
+ */
+export declare const SYSTEM_OF_RECORD_ACTION_NAME_PATTERN: RegExp;
+export declare const SystemOfRecordActionNameSchema: z.ZodString;
+/** ONE declared action. */
+export declare const SystemOfRecordActionDeclarationSchema: z.ZodObject<{
+    target: z.ZodEnum<typeof SystemOfRecordActionTarget>;
+    call: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODOO_EXECUTE_KW>;
+        /** The model method, in Odoo's own spelling (`action_post`, `create`). */
+        method: z.ZodString;
+        /**
+         * The model the call is made on, for a RECORD-FREE action only. A record-targeted action acts on the binding's own
+         * model — the one its key codec and read gates describe — so naming another would decode the id against the wrong
+         * entity. Absent means the binding's `entityRef`.
+         */
+        model: z.ZodOptional<z.ZodString>;
+        inputPlacement: z.ZodDefault<z.ZodEnum<typeof SystemOfRecordOdooActionInputPlacement>>;
+    }, z.core.$strict>, z.ZodObject<{
+        shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODATA_BOUND_ACTION>;
+        /** The namespace-qualified action name (`Microsoft.Dynamics.CRM.WinOpportunity`). */
+        qualifiedName: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION>;
+        /** The action import's name, as the service root exposes it. */
+        actionImport: z.ZodString;
+    }, z.core.$strict>], "shape">;
+    /**
+     * The input contract, validated BEFORE anything is sent. Strict parsing is the caller's contract: a key the schema
+     * does not declare is refused rather than forwarded, so nothing reaches the vendor that the author did not name.
+     */
+    input: z.ZodCustom<z.ZodObject<Readonly<{
+        [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    }>, z.core.$strip>, z.ZodObject<Readonly<{
+        [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    }>, z.core.$strip>>;
+    /**
+     * The result contract. When declared, the vendor's answer is parsed through it and only the parsed value is returned;
+     * an answer it rejects after the vendor APPLIED the action is reported as an unknown outcome, never as "not done".
+     * Absent means the result is returned as the vendor sent it.
+     */
+    output: z.ZodOptional<z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+    /**
+     * Whether the action CHANGES remote state. A writing action must carry an Idempotency-Key from EVERY caller, because a
+     * remote change cannot be rolled back, and its interrupted attempts are reported as an unknown outcome rather than as
+     * a failure. A non-writing action (a vendor computation that changes nothing) needs neither.
+     */
+    writes: z.ZodBoolean;
+    /**
+     * Whether the VENDOR makes a repeated call harmless, so the transport may re-send it after a timeout or a 5xx. False
+     * unless the vendor offers an idempotency mechanism for this call; Odoo offers none, so no Odoo action is retry-safe.
+     * A writing action is never re-sent without an Idempotency-Key, whatever this says.
+     */
+    retrySafe: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * The role keys admitted to run it, held in the OWNER organization (an organization role) or at application scope. A
+     * role held only inside an organization UNIT admits the action on that unit's partition alone.
+     */
+    roles: z.ZodArray<z.ZodString>;
+    /**
+     * Whether a context with NO user and no machine principal — the engine's own batch, cron and queue work, a webhook, an
+     * autonomous agent with nobody behind it — may run it. Such a context then acts ORGANIZATION-WIDE on the owner
+     * organization's behalf, which is exactly why it is off unless declared.
+     */
+    admitsSystemInitiation: z.ZodDefault<z.ZodBoolean>;
+    /** A record-free action's relation to the instance's partitions; see {@link SystemOfRecordActionPartitionStanceKind}. */
+    partitionStance: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL>;
+        /** Why no partition is reached. Read by a reviewer; nothing can verify it, which is why it is required. */
+        reason: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION>;
+        /**
+         * The REMOTE parameter the placed partition value is written into (`company_id`): a key of the Odoo keyword
+         * arguments or of the positional input object, or a member of the OData body. The caller's input may not carry it.
+         */
+        parameter: z.ZodString;
+    }, z.core.$strict>], "kind">>;
+    /**
+     * The resource operation that is this action's HTTP door, when it has one: a custom operation of the SAME resource
+     * whose implementation hands the request to the system-of-record action executor. Absent means the action is reached
+     * from code only.
+     *
+     * Naming the door HERE is what lets the resource factory tell an action from a row write. Without it, the only thing the
+     * factory can see is the verb the operation borrows, and both available borrows were wrong (#1678 review, F1):
+     *
+     * - borrowing READ made a state-changing route a GET, and its required Idempotency-Key was refused at boot, because a
+     *   read-shaped operation claims its repeat changes nothing — Wonder Todos' backend could not start;
+     * - borrowing UPDATE read as a ROW write, so the factory demanded `writableVerbs: [update]` — a door onto the bound
+     *   entity's rows that nobody asked for.
+     *
+     * A named door is exempt from the row-write rules and held to the action's own instead: a WRITING action's door borrows
+     * a single-row mutation verb (so its route is not a GET and a retry is keyed), requires the key on every variant, and
+     * runs INLINE. See `assertHttpApiWriteDeclarationCoherence`.
+     */
+    operation: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type SystemOfRecordActionDeclaration = z.infer<typeof SystemOfRecordActionDeclarationSchema>;
+/** What an author writes — defaulted fields optional. */
+export type SystemOfRecordActionDeclarationAuthored = z.input<typeof SystemOfRecordActionDeclarationSchema>;
+/** Every action a binding declares, keyed by the application's action name. */
+export declare const SystemOfRecordActionDeclarationsSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    target: z.ZodEnum<typeof SystemOfRecordActionTarget>;
+    call: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODOO_EXECUTE_KW>;
+        /** The model method, in Odoo's own spelling (`action_post`, `create`). */
+        method: z.ZodString;
+        /**
+         * The model the call is made on, for a RECORD-FREE action only. A record-targeted action acts on the binding's own
+         * model — the one its key codec and read gates describe — so naming another would decode the id against the wrong
+         * entity. Absent means the binding's `entityRef`.
+         */
+        model: z.ZodOptional<z.ZodString>;
+        inputPlacement: z.ZodDefault<z.ZodEnum<typeof SystemOfRecordOdooActionInputPlacement>>;
+    }, z.core.$strict>, z.ZodObject<{
+        shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODATA_BOUND_ACTION>;
+        /** The namespace-qualified action name (`Microsoft.Dynamics.CRM.WinOpportunity`). */
+        qualifiedName: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        shape: z.ZodLiteral<SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION>;
+        /** The action import's name, as the service root exposes it. */
+        actionImport: z.ZodString;
+    }, z.core.$strict>], "shape">;
+    /**
+     * The input contract, validated BEFORE anything is sent. Strict parsing is the caller's contract: a key the schema
+     * does not declare is refused rather than forwarded, so nothing reaches the vendor that the author did not name.
+     */
+    input: z.ZodCustom<z.ZodObject<Readonly<{
+        [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    }>, z.core.$strip>, z.ZodObject<Readonly<{
+        [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    }>, z.core.$strip>>;
+    /**
+     * The result contract. When declared, the vendor's answer is parsed through it and only the parsed value is returned;
+     * an answer it rejects after the vendor APPLIED the action is reported as an unknown outcome, never as "not done".
+     * Absent means the result is returned as the vendor sent it.
+     */
+    output: z.ZodOptional<z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+    /**
+     * Whether the action CHANGES remote state. A writing action must carry an Idempotency-Key from EVERY caller, because a
+     * remote change cannot be rolled back, and its interrupted attempts are reported as an unknown outcome rather than as
+     * a failure. A non-writing action (a vendor computation that changes nothing) needs neither.
+     */
+    writes: z.ZodBoolean;
+    /**
+     * Whether the VENDOR makes a repeated call harmless, so the transport may re-send it after a timeout or a 5xx. False
+     * unless the vendor offers an idempotency mechanism for this call; Odoo offers none, so no Odoo action is retry-safe.
+     * A writing action is never re-sent without an Idempotency-Key, whatever this says.
+     */
+    retrySafe: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * The role keys admitted to run it, held in the OWNER organization (an organization role) or at application scope. A
+     * role held only inside an organization UNIT admits the action on that unit's partition alone.
+     */
+    roles: z.ZodArray<z.ZodString>;
+    /**
+     * Whether a context with NO user and no machine principal — the engine's own batch, cron and queue work, a webhook, an
+     * autonomous agent with nobody behind it — may run it. Such a context then acts ORGANIZATION-WIDE on the owner
+     * organization's behalf, which is exactly why it is off unless declared.
+     */
+    admitsSystemInitiation: z.ZodDefault<z.ZodBoolean>;
+    /** A record-free action's relation to the instance's partitions; see {@link SystemOfRecordActionPartitionStanceKind}. */
+    partitionStance: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL>;
+        /** Why no partition is reached. Read by a reviewer; nothing can verify it, which is why it is required. */
+        reason: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION>;
+        /**
+         * The REMOTE parameter the placed partition value is written into (`company_id`): a key of the Odoo keyword
+         * arguments or of the positional input object, or a member of the OData body. The caller's input may not carry it.
+         */
+        parameter: z.ZodString;
+    }, z.core.$strict>], "kind">>;
+    /**
+     * The resource operation that is this action's HTTP door, when it has one: a custom operation of the SAME resource
+     * whose implementation hands the request to the system-of-record action executor. Absent means the action is reached
+     * from code only.
+     *
+     * Naming the door HERE is what lets the resource factory tell an action from a row write. Without it, the only thing the
+     * factory can see is the verb the operation borrows, and both available borrows were wrong (#1678 review, F1):
+     *
+     * - borrowing READ made a state-changing route a GET, and its required Idempotency-Key was refused at boot, because a
+     *   read-shaped operation claims its repeat changes nothing — Wonder Todos' backend could not start;
+     * - borrowing UPDATE read as a ROW write, so the factory demanded `writableVerbs: [update]` — a door onto the bound
+     *   entity's rows that nobody asked for.
+     *
+     * A named door is exempt from the row-write rules and held to the action's own instead: a WRITING action's door borrows
+     * a single-row mutation verb (so its route is not a GET and a retry is keyed), requires the key on every variant, and
+     * runs INLINE. See `assertHttpApiWriteDeclarationCoherence`.
+     */
+    operation: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>>;
+export type SystemOfRecordActionDeclarations = z.infer<typeof SystemOfRecordActionDeclarationsSchema>;
+/** @wildo_source:part:end saas.models.system-of-record-actions */
+/**
+ * Odoo methods that READ, refused as actions.
+ *
+ * An action's answer is returned to its caller, and it is not confined the way the read lane confines rows: a
+ * `search_read` declared as an action would hand a unit-confined member every company's rows. Reads go through the
+ * read-through resource, whose pushdown and key-addressed admission are the confinement. A deny-list cannot be
+ * complete — Odoo lets any public method be called — so an author reviews what a declared method returns; these are the
+ * methods whose whole purpose is to return rows.
+ */
+export declare const ODOO_READ_METHODS_REFUSED_AS_ACTIONS: ReadonlySet<string>;
+/**
+ * Odoo methods that are ROW WRITES of the binding's own entity, refused as record-targeted actions: `write` and
+ * `unlink` on the bound model are exactly what `writableVerbs` opens (#1679), with its payload rules and its field-level
+ * trail. Declaring them as actions would open a second door onto the same change, one that skips both.
+ */
+export declare const ODOO_ROW_WRITE_METHODS_REFUSED_AS_RECORD_ACTIONS: ReadonlySet<string>;
+/**
+ * Refuse every action declaration the engine could not honour, at AUTHORING (#1678). Throws a plain `Error` naming the
+ * action and the fix; the resource factory wraps it with the resource identifier.
+ *
+ * What is NOT decidable here, and why: whether the vendor's facet supports the call shape and whether the instance is
+ * partitioned both need the saas configuration and the facet map, which `shared-lib` does not see. Those are the boot
+ * checks (`collectSystemOfRecordActionDeclarationViolations` in the backend).
+ */
+export declare function assertSystemOfRecordActionDeclarationsCoherence(params: {
+    readonly dialect: HttpApiTransportDialect;
+    readonly actions: SystemOfRecordActionDeclarations | undefined;
+}): void;
+//# sourceMappingURL=system-of-record-actions.shared.schemas.d.ts.map

package/dist/esm/systems-of-record/system-of-record-actions.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-actions.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-actions.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG,oHAAoH;AAEpH;;;;;;;;GAQG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;GAGG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,6BAA6B,EAAE,uBAAuB,CAAC,CAI9H,CAAC;AAEH,8BAA8B;AAC9B,oBAAY,0BAA0B;IACpC;;;;OAIG;IACH,MAAM,WAAW;IACjB,kFAAkF;IAClF,IAAI,SAAS;CACd;AAED,4EAA4E;AAC5E,oBAAY,sCAAsC;IAChD,kHAAkH;IAClH,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,UAAU,eAAe;IACzB,0GAA0G;IAC1G,IAAI,SAAS;CACd;AAED;;;GAGG;AACH,oBAAY,uCAAuC;IACjD;;;OAGG;IACH,iBAAiB,sBAAsB;IACvC;;;;OAIG;IACH,qBAAqB,0BAA0B;CAChD;AAED,eAAO,MAAM,yCAAyC;;IAGlD,2GAA2G;;;;IAK3G;;;OAGG;;4BAGL,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,eAAO,MAAM,8BAA8B;;IAGvC,0EAA0E;;IAE1E;;;;OAIG;;;;;IAMH,qFAAqF;;;;IAKrF,gEAAgE;;6BAGlE,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,QAAwB,CAAC;AAC1E,eAAO,MAAM,8BAA8B,aAAsG,CAAC;AAalJ,2BAA2B;AAC3B,eAAO,MAAM,qCAAqC;;;;QA5C9C,0EAA0E;;QAE1E;;;;WAIG;;;;;QAMH,qFAAqF;;;;QAKrF,gEAAgE;;;IA8BlE;;;OAGG;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH,yHAAyH;;;QAlGvH,2GAA2G;;;;QAK3G;;;WAGG;;;IA4FL;;;;;;;;;;;;;;;;OAgBG;;kBAEH,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACpG,yDAAyD;AACzD,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAE5G,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC;;;;QA3G/C,0EAA0E;;QAE1E;;;;WAIG;;;;;QAMH,qFAAqF;;;;QAKrF,gEAAgE;;;IA8BlE;;;OAGG;;;;;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH;;;;OAIG;;IAEH,yHAAyH;;;QAlGvH,2GAA2G;;;;QAK3G;;;WAGG;;;IA4FL;;;;;;;;;;;;;;;;OAgBG;;mBAQgI,CAAC;AACtI,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,kEAAkE;AAElE;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,WAAW,CAAC,MAAM,CAGnE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gDAAgD,EAAE,WAAW,CAAC,MAAM,CAAgC,CAAC;AAElH;;;;;;;GAOG;AACH,wBAAgB,+CAA+C,CAAC,MAAM,EAAE;IACtE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAChE,GAAG,IAAI,CAkEP"}