mythik 0.0.1 → 0.1.0

package/dist/runtime/mount-spec-runtime.js

@@ -0,0 +1,73 @@
+import { createDeriveEngine } from '../derive/evaluator.js';
+import { createDataSourcesEngine } from '../data/data-sources.js';
+import { createEditorSessionEngine } from '../editor-session/engine.js';
+import { RESERVED_PATHS } from '../state/reserved-paths.js';
+export function mountSpecRuntime(spec, deps) {
+    const { store, resolver, dispatcher, protectionRegistry, fetcher, urlGuard } = deps;
+    const cleanups = [];
+    let deriveEngine = null;
+    let dataSourcesEngine = null;
+    let editorSessionEngine = null;
+    // ── Derive ──
+    if (spec.derive && Object.keys(spec.derive).length > 0) {
+        deriveEngine = createDeriveEngine({ store, resolver, derive: spec.derive });
+        deriveEngine.mount();
+        // Subscribe to state changes for reactive recompute. Re-entrancy is
+        // allowed (and required) so chained derives can cascade — see header
+        // doc above for why this is safe.
+        const unsub = store.subscribe((_state, changedPath) => {
+            deriveEngine.onStateChange(changedPath);
+        });
+        cleanups.push(unsub);
+        // RAII contribute to protection registry
+        const release = protectionRegistry.contribute(deriveEngine.getProtectedPaths());
+        cleanups.push(release);
+    }
+    // ── Editor Sessions ──
+    if (spec.editorSessions && Object.keys(spec.editorSessions).length > 0) {
+        editorSessionEngine = createEditorSessionEngine({
+            store,
+            sessions: spec.editorSessions,
+            resolve: (expr) => resolver.resolve(expr),
+            fetcher,
+            urlGuard,
+        });
+        for (const action of editorSessionEngine.getActionDefinitions()) {
+            dispatcher.registerAction(action);
+        }
+        const release = protectionRegistry.contribute([`${RESERVED_PATHS.EDITOR_SESSIONS}/*`]);
+        cleanups.push(release);
+    }
+    // ── DataSources ──
+    if (spec.dataSources && Object.keys(spec.dataSources).length > 0) {
+        dataSourcesEngine = createDataSourcesEngine({
+            store,
+            resolver,
+            dataSources: spec.dataSources,
+            fetcher,
+        });
+        // Register refreshDataSource action with the per-renderer dispatcher
+        // (silent overwrite via Map.set — safe across re-mounts within same renderer).
+        dispatcher.registerAction(dataSourcesEngine.getActionDefinition());
+        dataSourcesEngine.mount();
+    }
+    return {
+        editorSessionEngine,
+        unmount() {
+            // Reverse order
+            dataSourcesEngine?.unmount();
+            editorSessionEngine?.unmount();
+            editorSessionEngine = null;
+            // Run cleanups in reverse order they were added (release → unsub)
+            for (let i = cleanups.length - 1; i >= 0; i--) {
+                cleanups[i]();
+            }
+            cleanups.length = 0;
+            deriveEngine?.unmount();
+            // null out refs to allow GC and to make subsequent unmount() calls safe
+            deriveEngine = null;
+            dataSourcesEngine = null;
+        },
+    };
+}
+//# sourceMappingURL=mount-spec-runtime.js.map

package/dist/runtime/mount-spec-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-spec-runtime.js","sourceRoot":"","sources":["../../src/runtime/mount-spec-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAqB,MAAM,wBAAwB,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAA0B,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAQxE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAmD5D,MAAM,UAAU,gBAAgB,CAAC,IAAU,EAAE,IAA0B;IACrE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEpF,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,YAAY,GAAwB,IAAI,CAAC;IAC7C,IAAI,iBAAiB,GAA6B,IAAI,CAAC;IACvD,IAAI,mBAAmB,GAA+B,IAAI,CAAC;IAE3D,eAAe;IACf,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,YAAY,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,YAAY,CAAC,KAAK,EAAE,CAAC;QAErB,oEAAoE;QACpE,qEAAqE;QACrE,kCAAkC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;YACpD,YAAa,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAErB,yCAAyC;QACzC,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,wBAAwB;IACxB,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,mBAAmB,GAAG,yBAAyB,CAAC;YAC9C,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,OAAO,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAClD,OAAO;YACP,QAAQ;SACT,CAAC,CAAC;QAEH,KAAK,MAAM,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAChE,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,GAAG,cAAc,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,oBAAoB;IACpB,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,iBAAiB,GAAG,uBAAuB,CAAC;YAC1C,KAAK;YACL,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,qEAAqE;QACrE,+EAA+E;QAC/E,UAAU,CAAC,cAAc,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACnE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,mBAAmB;QACnB,OAAO;YACL,gBAAgB;YAChB,iBAAiB,EAAE,OAAO,EAAE,CAAC;YAC7B,mBAAmB,EAAE,OAAO,EAAE,CAAC;YAC/B,mBAAmB,GAAG,IAAI,CAAC;YAC3B,kEAAkE;YAClE,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,CAAC;YACD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACpB,YAAY,EAAE,OAAO,EAAE,CAAC;YACxB,wEAAwE;YACxE,YAAY,GAAG,IAAI,CAAC;YACpB,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security/api-spec-validator.d.ts

@@ -0,0 +1,13 @@
+import type { ValidationError } from './spec-validator.js';
+export interface ApiSpecValidationResult {
+    valid: boolean;
+    errors: string[];
+    /**
+     * Lint warnings with structured ValidationError shape (separate from `errors: string[]`
+     * for backwards compat). Populated by lint rules with `ruleId` set. Each entry has
+     * `suggestedFixes` (RFC 6902 patches) when auto-fixable.
+     */
+    lintWarnings?: ValidationError[];
+}
+export declare function validateApiSpec(spec: unknown): ApiSpecValidationResult;
+//# sourceMappingURL=api-spec-validator.d.ts.map

package/dist/security/api-spec-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-spec-validator.d.ts","sourceRoot":"","sources":["../../src/security/api-spec-validator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;CAClC;AA0ED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,uBAAuB,CA2RtE"}

package/dist/security/api-spec-validator.js

@@ -0,0 +1,347 @@
+import { isValidIdentifier } from './identifier-guard.js';
+const DANGEROUS_SQL_KEYWORDS = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|EXEC|EXECUTE|UNION|INTO)\b/i;
+const SQL_COMMENTS = /(--|\/\*)/;
+/**
+ * Lint rule: spec-crud-id-collision — error when `endpoint.path` ends with `/:id`
+ * AND the same node has `crud: {...}` present.
+ *
+ * CRUD operations auto-append `/:id` to PUT/DELETE routes. Declaring `path: '/api/x/:id'`
+ * with `crud: {}` produces server-side URL `/api/x/:id/:id` → 404 silent.
+ *
+ * Walks the object-shaped `spec.endpoints: Record<string, EndpointConfig>`, emitting
+ * to lintWarnings with ruleId 'spec-crud-id-collision' and JSON Pointer path
+ * `/endpoints/<name>/path`.
+ */
+function validateCrudIdCollision(spec, lintWarnings) {
+    const endpoints = spec.endpoints;
+    if (!endpoints || typeof endpoints !== 'object' || Array.isArray(endpoints))
+        return;
+    for (const [name, ep] of Object.entries(endpoints)) {
+        if (!ep || typeof ep !== 'object')
+            continue;
+        const epObj = ep;
+        const path = epObj.path;
+        const hasCrud = epObj.crud && typeof epObj.crud === 'object';
+        if (typeof path === 'string' && hasCrud && /\/:id$/.test(path)) {
+            const fixed = path.replace(/\/:id$/, '');
+            lintWarnings.push({
+                message: `endpoint.path "${path}" ends with /:id and has crud — server auto-appends /:id, producing /:id/:id`,
+                path: `/endpoints/${name}/path`,
+                ruleId: 'spec-crud-id-collision',
+                suggestedFixes: [{
+                        patch: { op: 'replace', path: `/endpoints/${name}/path`, value: fixed },
+                        confidence: 'high',
+                        description: `Remove trailing /:id — CRUD auto-appends it for PUT/DELETE routes`,
+                    }],
+            });
+        }
+    }
+}
+/**
+ * Lint rule: spec-auth-domains-port — warn when an `auth.authDomains` entry contains `:port`.
+ *
+ * The auth matcher (packages/core/src/fetch/interceptors/auth.ts:matchesDomain) uses
+ * hostname-only comparison — port is silently stripped from URL.hostname. Consumer
+ * believes match works but does not, leading to apparent matches that fail at runtime.
+ *
+ * Detection: regex `^[^:]+:\d+$` matches `host:port` shape on the entry string.
+ * Walks `spec.auth.authDomains: string[]`, emitting JSON Pointer paths `/auth/authDomains/<i>`.
+ */
+function validateAuthDomainsPort(spec, lintWarnings) {
+    const auth = spec.auth;
+    if (!auth || typeof auth !== 'object')
+        return;
+    const domains = auth.authDomains;
+    if (!Array.isArray(domains))
+        return;
+    for (let i = 0; i < domains.length; i++) {
+        const entry = domains[i];
+        if (typeof entry !== 'string')
+            continue;
+        if (/^[^:]+:\d+$/.test(entry)) {
+            const fixed = entry.replace(/:\d+$/, '');
+            lintWarnings.push({
+                message: `auth.authDomains[${i}] "${entry}" contains :port — matcher uses hostname-only comparison, port silently stripped`,
+                path: `/auth/authDomains/${i}`,
+                ruleId: 'spec-auth-domains-port',
+                suggestedFixes: [{
+                        patch: { op: 'replace', path: `/auth/authDomains/${i}`, value: fixed },
+                        confidence: 'high',
+                        description: `Remove :port — matcher uses hostname-only comparison`,
+                    }],
+            });
+        }
+    }
+}
+export function validateApiSpec(spec) {
+    if (!spec || typeof spec !== 'object') {
+        return { valid: false, errors: ['spec must be an object'] };
+    }
+    const s = spec;
+    const errors = [];
+    // Catalogs
+    const catalogs = s.catalogs;
+    if (catalogs) {
+        for (const [name, catalog] of Object.entries(catalogs)) {
+            if (catalog.static)
+                continue;
+            if (catalog.from) {
+                if (!isValidIdentifier(catalog.from)) {
+                    errors.push(`catalog "${name}": invalid SQL identifier "${catalog.from}" in "from"`);
+                }
+                if (!catalog.distinct) {
+                    if (!catalog.value) {
+                        errors.push(`catalog "${name}": "value" is required when "from" is present (without "distinct")`);
+                    }
+                    if (!catalog.label) {
+                        errors.push(`catalog "${name}": "label" is required when "from" is present (without "distinct")`);
+                    }
+                }
+                if (catalog.value && !isValidIdentifier(catalog.value)) {
+                    errors.push(`catalog "${name}": invalid SQL identifier "${catalog.value}" in "value"`);
+                }
+                if (catalog.label && !isValidIdentifier(catalog.label)) {
+                    errors.push(`catalog "${name}": invalid SQL identifier "${catalog.label}" in "label"`);
+                }
+                if (catalog.distinct && !isValidIdentifier(catalog.distinct)) {
+                    errors.push(`catalog "${name}": invalid SQL identifier "${catalog.distinct}" in "distinct"`);
+                }
+                if (catalog.extra) {
+                    for (const field of catalog.extra) {
+                        if (!isValidIdentifier(field)) {
+                            errors.push(`catalog "${name}": invalid SQL identifier "${field}" in "extra"`);
+                        }
+                    }
+                }
+                // where clause hardening — concatenated directly into SQL
+                if (catalog.where) {
+                    const where = catalog.where;
+                    if (where.includes(';')) {
+                        errors.push(`catalog "${name}": "where" must not contain semicolons`);
+                    }
+                    if (SQL_COMMENTS.test(where)) {
+                        errors.push(`catalog "${name}": "where" must not contain SQL comment markers (-- or /*)`);
+                    }
+                    if (DANGEROUS_SQL_KEYWORDS.test(where)) {
+                        errors.push(`catalog "${name}": "where" contains dangerous SQL keywords`);
+                    }
+                }
+                // orderBy validation
+                if (catalog.orderBy) {
+                    const orderBy = catalog.orderBy;
+                    if (orderBy.includes(';')) {
+                        errors.push(`catalog "${name}": "orderBy" must not contain semicolons`);
+                    }
+                    if (SQL_COMMENTS.test(orderBy)) {
+                        errors.push(`catalog "${name}": "orderBy" must not contain SQL comment markers (-- or /*)`);
+                    }
+                }
+            }
+            else if (!catalog.static) {
+                errors.push(`catalog "${name}": must have "from" (database table) or "static" (inline data)`);
+            }
+        }
+    }
+    // Endpoints
+    const endpoints = s.endpoints;
+    if (endpoints) {
+        for (const [name, endpoint] of Object.entries(endpoints)) {
+            const hasQuery = !!endpoint.query;
+            const hasHandler = !!endpoint.handler;
+            const hasCrud = !!endpoint.crud;
+            const sources = [hasQuery, hasHandler, hasCrud].filter(Boolean).length;
+            if (sources === 0) {
+                errors.push(`endpoint "${name}": must have "query", "handler", or "crud"`);
+            }
+            if (hasQuery && hasHandler) {
+                errors.push(`endpoint "${name}": "query" and "handler" are mutually exclusive`);
+            }
+            if (hasQuery && hasCrud) {
+                errors.push(`endpoint "${name}": "query" and "crud" are mutually exclusive`);
+            }
+            if (endpoint.crud) {
+                const crud = endpoint.crud;
+                if (!isValidIdentifier(crud.table)) {
+                    errors.push(`endpoint "${name}": invalid SQL identifier "${crud.table}" in crud.table`);
+                }
+                if (!isValidIdentifier(crud.primaryKey)) {
+                    errors.push(`endpoint "${name}": invalid SQL identifier "${crud.primaryKey}" in crud.primaryKey`);
+                }
+                for (const field of crud.insertable ?? []) {
+                    if (!isValidIdentifier(field)) {
+                        errors.push(`endpoint "${name}": invalid SQL identifier "${field}" in crud.insertable`);
+                    }
+                }
+                for (const field of crud.updatable ?? []) {
+                    if (!isValidIdentifier(field)) {
+                        errors.push(`endpoint "${name}": invalid SQL identifier "${field}" in crud.updatable`);
+                    }
+                }
+            }
+            if (endpoint.audit) {
+                if (!endpoint.crud) {
+                    errors.push(`endpoint "${name}": "audit" requires "crud" to be configured`);
+                }
+                const audit = endpoint.audit;
+                for (const key of ['createdBy', 'createdAt', 'updatedBy', 'updatedAt']) {
+                    const col = audit[key];
+                    if (col !== undefined) {
+                        if (typeof col !== 'string') {
+                            errors.push(`endpoint "${name}": audit.${key} must be a string (column name)`);
+                        }
+                        else if (!isValidIdentifier(col)) {
+                            errors.push(`endpoint "${name}": invalid SQL identifier "${col}" in audit.${key}`);
+                        }
+                    }
+                }
+                const tz = audit.timezone;
+                if (tz !== undefined && typeof tz !== 'string') {
+                    errors.push(`endpoint "${name}": audit.timezone must be a string (IANA timezone)`);
+                }
+            }
+            // Endpoint-level scopeFilter column override validation
+            if (endpoint.scopeFilter && typeof endpoint.scopeFilter === 'object') {
+                const sf = endpoint.scopeFilter;
+                if (sf.column && !isValidIdentifier(sf.column)) {
+                    errors.push(`endpoint "${name}": invalid SQL identifier "${sf.column}" in scopeFilter.column`);
+                }
+            }
+        }
+    }
+    // Auth
+    const auth = s.auth;
+    if (auth) {
+        if (auth.strategy && auth.strategy !== 'jwt') {
+            errors.push('auth.strategy must be "jwt"');
+        }
+        // Provider validation
+        if (auth.provider) {
+            const p = auth.provider;
+            if (!p.usersTable) {
+                errors.push('auth.provider.usersTable is required');
+            }
+            else if (!isValidIdentifier(p.usersTable)) {
+                errors.push(`auth.provider: invalid SQL identifier "${p.usersTable}" in usersTable`);
+            }
+            if (!p.usernameColumn) {
+                errors.push('auth.provider.usernameColumn is required');
+            }
+            else if (!isValidIdentifier(p.usernameColumn)) {
+                errors.push(`auth.provider: invalid SQL identifier "${p.usernameColumn}" in usernameColumn`);
+            }
+            if (!p.passwordColumn) {
+                errors.push('auth.provider.passwordColumn is required');
+            }
+            else if (!isValidIdentifier(p.passwordColumn)) {
+                errors.push(`auth.provider: invalid SQL identifier "${p.passwordColumn}" in passwordColumn`);
+            }
+            // emailColumn validation (NEW hardening)
+            if (p.emailColumn) {
+                if (!isValidIdentifier(p.emailColumn)) {
+                    errors.push(`auth.provider: invalid SQL identifier "${p.emailColumn}" in emailColumn`);
+                }
+            }
+            if (!p.rolesQuery) {
+                errors.push('auth.provider.rolesQuery is required');
+            }
+            else {
+                if (!p.rolesQuery.includes('@username')) {
+                    errors.push('auth.provider.rolesQuery must contain @username parameter');
+                }
+                if (p.rolesQuery.includes(';')) {
+                    errors.push('auth.provider.rolesQuery must not contain semicolons');
+                }
+            }
+            if (!p.scopeQuery) {
+                errors.push('auth.provider.scopeQuery is required');
+            }
+            else {
+                if (!p.scopeQuery.includes('@username')) {
+                    errors.push('auth.provider.scopeQuery must contain @username parameter');
+                }
+                if (p.scopeQuery.includes(';')) {
+                    errors.push('auth.provider.scopeQuery must not contain semicolons');
+                }
+            }
+            // activeCondition hardening (NEW)
+            if (p.activeCondition) {
+                const cond = p.activeCondition;
+                if (cond.includes(';')) {
+                    errors.push('auth.provider.activeCondition must not contain semicolons');
+                }
+                if (SQL_COMMENTS.test(cond)) {
+                    errors.push('auth.provider.activeCondition must not contain SQL comment markers (-- or /*)');
+                }
+                if (DANGEROUS_SQL_KEYWORDS.test(cond)) {
+                    errors.push('auth.provider.activeCondition contains dangerous SQL keywords');
+                }
+            }
+            // displayNameQuery validation (NEW)
+            if (p.displayNameQuery) {
+                const q = p.displayNameQuery;
+                if (!q.includes('@username')) {
+                    errors.push('auth.provider.displayNameQuery must contain @username parameter');
+                }
+                if (q.includes(';')) {
+                    errors.push('auth.provider.displayNameQuery must not contain semicolons');
+                }
+            }
+            // defaultScopeQuery validation (NEW)
+            if (p.defaultScopeQuery) {
+                const q = p.defaultScopeQuery;
+                if (!q.includes('@username')) {
+                    errors.push('auth.provider.defaultScopeQuery must contain @username parameter');
+                }
+                if (q.includes(';')) {
+                    errors.push('auth.provider.defaultScopeQuery must not contain semicolons');
+                }
+            }
+        }
+        // Policies validation
+        if (auth.policies) {
+            for (const [name, policy] of Object.entries(auth.policies)) {
+                const roles = policy.roles;
+                if (!roles || !Array.isArray(roles) || roles.length === 0) {
+                    errors.push(`auth.policies.${name}: "roles" must be a non-empty array`);
+                }
+            }
+        }
+        // Scope filter validation
+        if (auth.scopeFilter) {
+            const sf = auth.scopeFilter;
+            if (!sf.claim) {
+                errors.push('auth.scopeFilter.claim is required');
+            }
+            if (!sf.column) {
+                errors.push('auth.scopeFilter.column is required');
+            }
+            else if (!isValidIdentifier(sf.column)) {
+                errors.push(`auth.scopeFilter: invalid SQL identifier "${sf.column}" in column`);
+            }
+            if (sf.mode === 'select' && !sf.header) {
+                errors.push('auth.scopeFilter.header is required when mode is "select"');
+            }
+        }
+        // Endpoint policy references
+        if (endpoints) {
+            for (const [name, endpoint] of Object.entries(endpoints)) {
+                const policy = endpoint.policy;
+                if (policy && policy !== 'public' && policy !== 'authenticated') {
+                    const policies = auth.policies;
+                    if (!policies?.[policy]) {
+                        errors.push(`endpoint "${name}": policy "${policy}" not found in auth.policies`);
+                    }
+                }
+            }
+        }
+    }
+    const lintWarnings = [];
+    validateCrudIdCollision(s, lintWarnings);
+    validateAuthDomainsPort(s, lintWarnings);
+    return {
+        valid: errors.length === 0,
+        errors,
+        lintWarnings: lintWarnings.length > 0 ? lintWarnings : undefined,
+    };
+}
+//# sourceMappingURL=api-spec-validator.js.map

package/dist/security/api-spec-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-spec-validator.js","sourceRoot":"","sources":["../../src/security/api-spec-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAc1D,MAAM,sBAAsB,GAAG,uEAAuE,CAAC;AACvG,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAAC,IAA6B,EAAE,YAA+B;IAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO;IACpF,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,EAA6B,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC7D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzC,YAAY,CAAC,IAAI,CAAC;gBAChB,OAAO,EAAE,kBAAkB,IAAI,8EAA8E;gBAC7G,IAAI,EAAE,cAAc,IAAI,OAAO;gBAC/B,MAAM,EAAE,wBAAwB;gBAChC,cAAc,EAAE,CAAC;wBACf,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,IAAI,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;wBACvE,UAAU,EAAE,MAAM;wBAClB,WAAW,EAAE,mEAAmE;qBACjF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,IAA6B,EAAE,YAA+B;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,IAA2C,CAAC;IAC9D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzC,YAAY,CAAC,IAAI,CAAC;gBAChB,OAAO,EAAE,oBAAoB,CAAC,MAAM,KAAK,kFAAkF;gBAC3H,IAAI,EAAE,qBAAqB,CAAC,EAAE;gBAC9B,MAAM,EAAE,wBAAwB;gBAChC,cAAc,EAAE,CAAC;wBACf,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;wBACtE,UAAU,EAAE,MAAM;wBAClB,WAAW,EAAE,sDAAsD;qBACpE,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,WAAW;IACX,MAAM,QAAQ,GAAG,CAAC,CAAC,QAA+D,CAAC;IACnF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM;gBAAE,SAAS;YAE7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAc,CAAC,EAAE,CAAC;oBAC/C,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,8BAA8B,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC;gBACvF,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACtB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,oEAAoE,CAAC,CAAC;oBACpG,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,oEAAoE,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAe,CAAC,EAAE,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,8BAA8B,OAAO,CAAC,KAAK,cAAc,CAAC,CAAC;gBACzF,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAe,CAAC,EAAE,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,8BAA8B,OAAO,CAAC,KAAK,cAAc,CAAC,CAAC;gBACzF,CAAC;gBACD,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAkB,CAAC,EAAE,CAAC;oBACvE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,8BAA8B,OAAO,CAAC,QAAQ,iBAAiB,CAAC,CAAC;gBAC/F,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBAClB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAiB,EAAE,CAAC;wBAC9C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC9B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,8BAA8B,KAAK,cAAc,CAAC,CAAC;wBACjF,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,0DAA0D;gBAC1D,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAe,CAAC;oBACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACxB,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,wCAAwC,CAAC,CAAC;oBACxE,CAAC;oBACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC7B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,4DAA4D,CAAC,CAAC;oBAC5F,CAAC;oBACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvC,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,4CAA4C,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBAED,qBAAqB;gBACrB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAiB,CAAC;oBAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC1B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,0CAA0C,CAAC,CAAC;oBAC1E,CAAC;oBACD,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC/B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,8DAA8D,CAAC,CAAC;oBAC9F,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,gEAAgE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,YAAY;IACZ,MAAM,SAAS,GAAG,CAAC,CAAC,SAAgE,CAAC;IACrF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAClC,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtC,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAEhC,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAEvE,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,4CAA4C,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,iDAAiD,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,8CAA8C,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;gBACtD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAe,CAAC,EAAE,CAAC;oBAC7C,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,8BAA8B,IAAI,CAAC,KAAK,iBAAiB,CAAC,CAAC;gBAC1F,CAAC;gBACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAoB,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,8BAA8B,IAAI,CAAC,UAAU,sBAAsB,CAAC,CAAC;gBACpG,CAAC;gBACD,KAAK,MAAM,KAAK,IAAK,IAAI,CAAC,UAAuB,IAAI,EAAE,EAAE,CAAC;oBACxD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,8BAA8B,KAAK,sBAAsB,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,KAAK,IAAK,IAAI,CAAC,SAAsB,IAAI,EAAE,EAAE,CAAC;oBACvD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,8BAA8B,KAAK,qBAAqB,CAAC,CAAC;oBACzF,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,6CAA6C,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAgC,CAAC;gBACxD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;oBACvE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;oBACvB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;4BAC5B,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,YAAY,GAAG,iCAAiC,CAAC,CAAC;wBACjF,CAAC;6BAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;4BACnC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,8BAA8B,GAAG,cAAc,GAAG,EAAE,CAAC,CAAC;wBACrF,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC1B,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAC/C,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,oDAAoD,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,IAAI,QAAQ,CAAC,WAAW,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAsC,CAAC;gBAC3D,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAgB,CAAC,EAAE,CAAC;oBACzD,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,8BAA8B,EAAE,CAAC,MAAM,yBAAyB,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;IACP,MAAM,IAAI,GAAG,CAAC,CAAC,IAA2C,CAAC;IAC3D,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAmC,CAAC;YACnD,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;iBAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAoB,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,UAAU,iBAAiB,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAwB,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,cAAc,qBAAqB,CAAC,CAAC;YAC/F,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAwB,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,cAAc,qBAAqB,CAAC,CAAC;YAC/F,CAAC;YAED,yCAAyC;YACzC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClB,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAqB,CAAC,EAAE,CAAC;oBAChD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,WAAW,kBAAkB,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAE,CAAC,CAAC,UAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBACpD,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAK,CAAC,CAAC,UAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAE,CAAC,CAAC,UAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBACpD,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAK,CAAC,CAAC,UAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,kCAAkC;YAClC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,CAAC,CAAC,eAAyB,CAAC;gBACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;gBAC/F,CAAC;gBACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;YAED,oCAAoC;YACpC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,CAAC,gBAA0B,CAAC;gBACvC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;gBACjF,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,CAAC,iBAA2B,CAAC;gBACxC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBAClF,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAmD,CAAC,EAAE,CAAC;gBACtG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,qCAAqC,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,IAAI,CAAC,WAAsC,CAAC;YACvD,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAgB,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,MAAM,aAAa,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA4B,CAAC;gBACrD,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;oBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+C,CAAC;oBACtE,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,cAAc,MAAM,8BAA8B,CAAC,CAAC;oBACnF,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAsB,EAAE,CAAC;IAC3C,uBAAuB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACzC,uBAAuB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KACjE,CAAC;AACJ,CAAC"}

package/dist/security/app-spec-validator.d.ts

@@ -0,0 +1,4 @@
+import type { AppSpec } from '../app/app-engine.js';
+import type { SpecValidationResult, ValidationContext } from './spec-validator.js';
+export declare function validateAppSpec(appSpec: AppSpec, context?: ValidationContext): SpecValidationResult;
+//# sourceMappingURL=app-spec-validator.d.ts.map

package/dist/security/app-spec-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-spec-validator.d.ts","sourceRoot":"","sources":["../../src/security/app-spec-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAmB,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAOpG,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,iBAAsB,GAAG,oBAAoB,CAmIvG"}