primitive-admin 1.1.0-alpha.38 → 1.1.0-alpha.39

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (57) hide show
  1. package/README.md +16 -0
  2. package/dist/bin/primitive.js +2 -0
  3. package/dist/bin/primitive.js.map +1 -1
  4. package/dist/src/commands/blob-buckets.js +64 -0
  5. package/dist/src/commands/blob-buckets.js.map +1 -1
  6. package/dist/src/commands/collections.js +1 -9
  7. package/dist/src/commands/collections.js.map +1 -1
  8. package/dist/src/commands/group-type-configs.js +1 -9
  9. package/dist/src/commands/group-type-configs.js.map +1 -1
  10. package/dist/src/commands/guides.d.ts +75 -0
  11. package/dist/src/commands/guides.js +284 -47
  12. package/dist/src/commands/guides.js.map +1 -1
  13. package/dist/src/commands/rule-sets.d.ts +1 -0
  14. package/dist/src/commands/rule-sets.js +25 -3
  15. package/dist/src/commands/rule-sets.js.map +1 -1
  16. package/dist/src/commands/scripts.d.ts +2 -0
  17. package/dist/src/commands/scripts.js +667 -0
  18. package/dist/src/commands/scripts.js.map +1 -0
  19. package/dist/src/commands/sync.d.ts +29 -0
  20. package/dist/src/commands/sync.js +402 -97
  21. package/dist/src/commands/sync.js.map +1 -1
  22. package/dist/src/commands/webhooks.js +7 -2
  23. package/dist/src/commands/webhooks.js.map +1 -1
  24. package/dist/src/commands/workflows.js +219 -1
  25. package/dist/src/commands/workflows.js.map +1 -1
  26. package/dist/src/lib/api-client.d.ts +56 -15
  27. package/dist/src/lib/api-client.js +51 -0
  28. package/dist/src/lib/api-client.js.map +1 -1
  29. package/dist/src/lib/block-layout.d.ts +160 -0
  30. package/dist/src/lib/block-layout.js +451 -0
  31. package/dist/src/lib/block-layout.js.map +1 -0
  32. package/dist/src/lib/config.js +21 -0
  33. package/dist/src/lib/config.js.map +1 -1
  34. package/dist/src/lib/generated-allowlist.js +9 -0
  35. package/dist/src/lib/generated-allowlist.js.map +1 -1
  36. package/dist/src/lib/output.d.ts +25 -5
  37. package/dist/src/lib/output.js +32 -4
  38. package/dist/src/lib/output.js.map +1 -1
  39. package/dist/src/lib/query-operators.d.ts +43 -0
  40. package/dist/src/lib/query-operators.js +80 -0
  41. package/dist/src/lib/query-operators.js.map +1 -0
  42. package/dist/src/lib/toml-database-config.d.ts +20 -0
  43. package/dist/src/lib/toml-database-config.js +37 -2
  44. package/dist/src/lib/toml-database-config.js.map +1 -1
  45. package/dist/src/lib/toml-metadata-config.d.ts +108 -0
  46. package/dist/src/lib/toml-metadata-config.js +371 -0
  47. package/dist/src/lib/toml-metadata-config.js.map +1 -0
  48. package/dist/src/lib/toml-params-validator.d.ts +34 -0
  49. package/dist/src/lib/toml-params-validator.js +118 -3
  50. package/dist/src/lib/toml-params-validator.js.map +1 -1
  51. package/dist/src/lib/workflow-apply.d.ts +66 -0
  52. package/dist/src/lib/workflow-apply.js +117 -0
  53. package/dist/src/lib/workflow-apply.js.map +1 -0
  54. package/dist/src/lib/workflow-toml-validator.js +36 -0
  55. package/dist/src/lib/workflow-toml-validator.js.map +1 -1
  56. package/dist/src/types/index.d.ts +7 -0
  57. package/package.json +1 -1
@@ -0,0 +1,371 @@
1
+ /**
2
+ * CLI TOML parser / validator / serializer for resource-metadata config
3
+ * surfaces (issue #1304, P-B — CLI/TOML config-sync).
4
+ *
5
+ * Two surfaces, mirroring the "config change ships all three surfaces" rule
6
+ * (CLAUDE.md; same shape as the database type-config helpers in
7
+ * `toml-database-config.ts`):
8
+ *
9
+ * 1. `MetadataCategoryConfig` blocks — a per-`{resourceType, category}`
10
+ * typed-schema + read/write-rule definition. These round-trip through
11
+ * `primitive sync push` / `pull` against the P-A REST API
12
+ * (`metadata-categories` CRUD). One file = one category, using a single
13
+ * `[metadataCategoryConfig]` section so the nested `schema.fields.*`
14
+ * tables serialize cleanly and byte-stably.
15
+ *
16
+ * 2. The declared-access manifest (`[metadata]` + `secrets` blocks) that
17
+ * lives on the owning config surfaces (`CollectionTypeConfig` /
18
+ * `DatabaseTypeConfig` / `WorkflowDefinition`). This module provides the
19
+ * TOML *structure* + *validator* + byte-stable round-trip helpers for the
20
+ * manifest so a bad value is rejected with a clear error. Wiring the
21
+ * manifest onto those config models' sync push/pull (which needs a
22
+ * storage field on each model) is P-C's "persist the manifest on owning
23
+ * configs" work — this module ships the parse/validate/serialize the
24
+ * P-C eval-site folding will call, matching how earlier phases shipped a
25
+ * validated mechanism ahead of its live wiring.
26
+ *
27
+ * All functions here are pure and unit-testable (no network, no filesystem).
28
+ * `validate*` functions return an error string (or `null` when valid) rather
29
+ * than throwing, mirroring `validateCategorySchema` server-side.
30
+ */
31
+ import * as TOML from "@iarna/toml";
32
+ /** Identifier-safe name: letters, digits, underscore; not starting with a digit.
33
+ * Matches the server's `METADATA_KEY_PATTERN`. */
34
+ const IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
35
+ /** The reserved projected category (computed live from a resource's columns).
36
+ * Matches the server's `RESERVED_PROJECTED_CATEGORY`. */
37
+ export const RESERVED_CATEGORY = "attrs";
38
+ /** The subset of js-bao `FieldOptions` field types the metadata schema accepts.
39
+ * Matches the server's `MetadataFieldType`. */
40
+ const METADATA_FIELD_TYPES = new Set([
41
+ "string",
42
+ "number",
43
+ "boolean",
44
+ "date",
45
+ "id",
46
+ "stringset",
47
+ ]);
48
+ const CATEGORY_SECTION_KEYS = new Set([
49
+ "resourceType",
50
+ "category",
51
+ "schema",
52
+ "readRule",
53
+ "writeRule",
54
+ "description",
55
+ ]);
56
+ /**
57
+ * Normalize a parsed `[metadataCategoryConfig]` TOML section into the REST
58
+ * upsert body. Server-managed fields (`schemaVersion`, `generation`) are never
59
+ * emitted or read here — they'd churn a round-trip.
60
+ */
61
+ export function parseMetadataCategoryToml(tomlData) {
62
+ const section = (tomlData && tomlData.metadataCategoryConfig) || {};
63
+ return {
64
+ resourceType: section.resourceType,
65
+ category: section.category,
66
+ schema: section.schema,
67
+ readRule: section.readRule ?? null,
68
+ writeRule: section.writeRule ?? null,
69
+ description: section.description ?? null,
70
+ };
71
+ }
72
+ /**
73
+ * Validate a parsed category config (post-{@link parseMetadataCategoryToml}).
74
+ * Returns an error string, or `null` when valid. The server re-validates on
75
+ * write; this is the fast local check so `sync push` fails with a clear
76
+ * message before hitting the network.
77
+ */
78
+ export function validateMetadataCategoryConfig(input) {
79
+ if (!input.resourceType || typeof input.resourceType !== "string") {
80
+ return "metadataCategoryConfig.resourceType is required and must be a string";
81
+ }
82
+ if (!IDENTIFIER_PATTERN.test(input.resourceType)) {
83
+ return `metadataCategoryConfig.resourceType "${input.resourceType}" must be identifier-safe (letters, digits, underscore; not starting with a digit)`;
84
+ }
85
+ if (!input.category || typeof input.category !== "string") {
86
+ return "metadataCategoryConfig.category is required and must be a string";
87
+ }
88
+ if (!IDENTIFIER_PATTERN.test(input.category)) {
89
+ return `metadataCategoryConfig.category "${input.category}" must be identifier-safe (letters, digits, underscore; not starting with a digit)`;
90
+ }
91
+ if (input.category === RESERVED_CATEGORY) {
92
+ return `metadataCategoryConfig.category "${RESERVED_CATEGORY}" is reserved (a projected category computed from the resource's own columns) and cannot be defined`;
93
+ }
94
+ if (input.readRule !== null &&
95
+ input.readRule !== undefined &&
96
+ typeof input.readRule !== "string") {
97
+ return "metadataCategoryConfig.readRule must be a string (a CEL expression)";
98
+ }
99
+ if (input.writeRule !== null &&
100
+ input.writeRule !== undefined &&
101
+ typeof input.writeRule !== "string") {
102
+ return "metadataCategoryConfig.writeRule must be a string (a CEL expression)";
103
+ }
104
+ if (input.description !== null &&
105
+ input.description !== undefined &&
106
+ typeof input.description !== "string") {
107
+ return "metadataCategoryConfig.description must be a string";
108
+ }
109
+ return validateCategorySchema(input.schema);
110
+ }
111
+ /**
112
+ * Validate the `schema` block is a well-formed js-bao `FieldOptions` map:
113
+ * `{ fields: { <name>: { type, required?, maxLength?, maxCount?, enum? } } }`.
114
+ * Mirrors the server's `validateCategorySchema`.
115
+ */
116
+ export function validateCategorySchema(schema) {
117
+ if (schema === null || typeof schema !== "object" || Array.isArray(schema)) {
118
+ return "metadataCategoryConfig.schema must be a table with a 'fields' map";
119
+ }
120
+ const fields = schema.fields;
121
+ if (fields === null || typeof fields !== "object" || Array.isArray(fields)) {
122
+ return "metadataCategoryConfig.schema.fields must be a table";
123
+ }
124
+ // Reject unknown top-level keys under `schema` (only `fields` is meaningful).
125
+ for (const key of Object.keys(schema)) {
126
+ if (key !== "fields") {
127
+ return `metadataCategoryConfig.schema has an unknown key "${key}" (only "fields" is allowed)`;
128
+ }
129
+ }
130
+ for (const [name, def] of Object.entries(fields)) {
131
+ if (!IDENTIFIER_PATTERN.test(name)) {
132
+ return `schema field name "${name}" must be identifier-safe`;
133
+ }
134
+ if (def === null || typeof def !== "object" || Array.isArray(def)) {
135
+ return `schema field "${name}" must be a table with a "type"`;
136
+ }
137
+ const field = def;
138
+ if (typeof field.type !== "string" || !METADATA_FIELD_TYPES.has(field.type)) {
139
+ return `schema field "${name}" has an invalid type (allowed: ${[
140
+ ...METADATA_FIELD_TYPES,
141
+ ].join(", ")})`;
142
+ }
143
+ if (field.enum !== undefined) {
144
+ if (!Array.isArray(field.enum) ||
145
+ field.enum.some((v) => typeof v !== "string")) {
146
+ return `schema field "${name}" enum must be an array of strings`;
147
+ }
148
+ if (field.type !== "string") {
149
+ return `schema field "${name}" enum is only valid on a "string" field`;
150
+ }
151
+ }
152
+ if (field.maxLength !== undefined && typeof field.maxLength !== "number") {
153
+ return `schema field "${name}" maxLength must be a number`;
154
+ }
155
+ if (field.maxCount !== undefined && typeof field.maxCount !== "number") {
156
+ return `schema field "${name}" maxCount must be a number`;
157
+ }
158
+ if (field.required !== undefined && typeof field.required !== "boolean") {
159
+ return `schema field "${name}" required must be a boolean`;
160
+ }
161
+ }
162
+ return null;
163
+ }
164
+ /**
165
+ * Serialize a category config (as returned by the P-A REST API — `schema` is a
166
+ * parsed object) to byte-stable TOML. Only the authored fields are emitted;
167
+ * server-managed `schemaVersion` / `generation` / `appId` / `categoryKey` are
168
+ * dropped so a pull → push → pull cycle is a no-op.
169
+ *
170
+ * Scalars are inserted before `schema` so `@iarna/toml` emits them ahead of
171
+ * the nested `[metadataCategoryConfig.schema.fields.*]` tables.
172
+ */
173
+ export function serializeMetadataCategoryConfig(config) {
174
+ const section = {
175
+ resourceType: config.resourceType,
176
+ category: config.category,
177
+ };
178
+ if (config.readRule !== null && config.readRule !== undefined) {
179
+ section.readRule = config.readRule;
180
+ }
181
+ if (config.writeRule !== null && config.writeRule !== undefined) {
182
+ section.writeRule = config.writeRule;
183
+ }
184
+ if (config.description !== null &&
185
+ config.description !== undefined &&
186
+ config.description !== "") {
187
+ section.description = config.description;
188
+ }
189
+ // `schema` may arrive as a parsed object (REST) or a JSON string (defensive).
190
+ let schema = config.schema;
191
+ if (typeof schema === "string") {
192
+ try {
193
+ schema = JSON.parse(schema);
194
+ }
195
+ catch {
196
+ schema = { fields: {} };
197
+ }
198
+ }
199
+ section.schema = schema ?? { fields: {} };
200
+ return TOML.stringify({ metadataCategoryConfig: section });
201
+ }
202
+ // --- Declared-access manifest (`[metadata]` + `secrets`) -------------------
203
+ //
204
+ // The manifest that lives on an owning config surface. Shape mirrors the
205
+ // server's `MetadataDeclaration` (`src/app-api/helpers/metadata-cel-access.ts`):
206
+ // metadata.self.categories = ["profile"]
207
+ // [metadata.paths.<name>] from|rootFrom, via, type, categories
208
+ // secrets = ["STRIPE_KEY"]
209
+ /** Root contexts a `rootFrom` path may start at (subjectless contexts). */
210
+ const ROOT_CONTEXT_PREFIXES = ["input", "record", "params"];
211
+ const MANIFEST_KEYS = new Set(["self", "paths", "secrets"]);
212
+ const SELF_KEYS = new Set(["categories"]);
213
+ const PATH_KEYS = new Set(["from", "rootFrom", "via", "type", "categories"]);
214
+ /**
215
+ * Read the declared-access manifest out of a parsed config TOML: the top-level
216
+ * `[metadata]` table (self + paths) and the `secrets` array. Returns `null`
217
+ * when neither is present (the config declares no metadata/secrets access).
218
+ */
219
+ export function parseDeclaredAccessManifestToml(tomlData) {
220
+ const metadata = tomlData?.metadata;
221
+ const secrets = tomlData?.secrets;
222
+ if (metadata === undefined && secrets === undefined)
223
+ return null;
224
+ const manifest = {};
225
+ if (metadata && typeof metadata === "object") {
226
+ if (metadata.self !== undefined) {
227
+ manifest.self = { categories: metadata.self?.categories };
228
+ }
229
+ if (metadata.paths !== undefined) {
230
+ manifest.paths = metadata.paths;
231
+ }
232
+ }
233
+ if (secrets !== undefined) {
234
+ manifest.secrets = secrets;
235
+ }
236
+ return manifest;
237
+ }
238
+ /**
239
+ * Validate a declared-access manifest structurally. Returns an error string,
240
+ * or `null` when valid. This is the local surface-level check (identifier
241
+ * names, key shape, exactly-one-root per path); the server's
242
+ * `validatePathGraph` still does the deep graph validation (cycles, depth,
243
+ * schema-mismatch) at persist time.
244
+ */
245
+ export function validateDeclaredAccessManifest(manifest) {
246
+ if (manifest === null || manifest === undefined)
247
+ return null;
248
+ if (typeof manifest !== "object" || Array.isArray(manifest)) {
249
+ return "declared-access manifest must be a table";
250
+ }
251
+ // `self`
252
+ if (manifest.self !== undefined) {
253
+ const self = manifest.self;
254
+ if (self === null || typeof self !== "object" || Array.isArray(self)) {
255
+ return "metadata.self must be a table with a 'categories' array";
256
+ }
257
+ for (const key of Object.keys(self)) {
258
+ if (!SELF_KEYS.has(key)) {
259
+ return `metadata.self has an unknown key "${key}" (only "categories" is allowed)`;
260
+ }
261
+ }
262
+ const catError = validateCategoryList(self.categories, "metadata.self");
263
+ if (catError)
264
+ return catError;
265
+ }
266
+ // `paths`
267
+ if (manifest.paths !== undefined) {
268
+ const paths = manifest.paths;
269
+ if (paths === null || typeof paths !== "object" || Array.isArray(paths)) {
270
+ return "metadata.paths must be a table of named path declarations";
271
+ }
272
+ const declaredNodes = new Set(["self", ...Object.keys(paths)]);
273
+ for (const [name, raw] of Object.entries(paths)) {
274
+ if (!IDENTIFIER_PATTERN.test(name)) {
275
+ return `metadata.paths."${name}" name must be identifier-safe`;
276
+ }
277
+ if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
278
+ return `metadata.paths."${name}" must be a table`;
279
+ }
280
+ const p = raw;
281
+ for (const key of Object.keys(p)) {
282
+ if (!PATH_KEYS.has(key)) {
283
+ return `metadata.paths."${name}" has an unknown key "${key}" (allowed: ${[
284
+ ...PATH_KEYS,
285
+ ].join(", ")})`;
286
+ }
287
+ }
288
+ const hasFrom = typeof p.from === "string" && p.from !== "";
289
+ const hasRoot = typeof p.rootFrom === "string" && p.rootFrom !== "";
290
+ if (hasFrom === hasRoot) {
291
+ return `metadata.paths."${name}" must declare exactly one of "from" or "rootFrom"`;
292
+ }
293
+ if (hasFrom) {
294
+ if (!declaredNodes.has(p.from)) {
295
+ return `metadata.paths."${name}" from "${p.from}" references an undeclared node (must be "self" or another declared path)`;
296
+ }
297
+ if (typeof p.via !== "string" || !p.via.includes(".")) {
298
+ return `metadata.paths."${name}" must declare a "via" of the form "<category>.<key>"`;
299
+ }
300
+ }
301
+ else {
302
+ // rootFrom: a static context path (`input.*` / `record.*` / `params.*`).
303
+ const rootFrom = p.rootFrom;
304
+ const prefix = rootFrom.split(".")[0];
305
+ if (!ROOT_CONTEXT_PREFIXES.includes(prefix)) {
306
+ return `metadata.paths."${name}" rootFrom "${rootFrom}" must be a static context path (${ROOT_CONTEXT_PREFIXES.join(".")}.*)`;
307
+ }
308
+ if (p.via !== undefined) {
309
+ return `metadata.paths."${name}" roots at "${rootFrom}" and must not also declare "via"`;
310
+ }
311
+ }
312
+ if (typeof p.type !== "string" || p.type === "") {
313
+ return `metadata.paths."${name}" must declare a target "type" (the resource type)`;
314
+ }
315
+ const catError = validateCategoryList(p.categories, `metadata.paths."${name}"`);
316
+ if (catError)
317
+ return catError;
318
+ }
319
+ }
320
+ // `secrets`
321
+ if (manifest.secrets !== undefined) {
322
+ if (!Array.isArray(manifest.secrets) ||
323
+ manifest.secrets.some((s) => typeof s !== "string")) {
324
+ return "secrets must be an array of secret key names (strings)";
325
+ }
326
+ for (const key of manifest.secrets) {
327
+ if (!IDENTIFIER_PATTERN.test(key)) {
328
+ return `secrets key "${key}" must be identifier-safe`;
329
+ }
330
+ }
331
+ }
332
+ return null;
333
+ }
334
+ function validateCategoryList(categories, where) {
335
+ if (!Array.isArray(categories) ||
336
+ categories.some((c) => typeof c !== "string")) {
337
+ return `${where}.categories must be an array of category names (strings)`;
338
+ }
339
+ for (const cat of categories) {
340
+ if (cat !== RESERVED_CATEGORY && !IDENTIFIER_PATTERN.test(cat)) {
341
+ return `${where}.categories entry "${cat}" must be identifier-safe`;
342
+ }
343
+ }
344
+ return null;
345
+ }
346
+ /**
347
+ * Serialize a declared-access manifest into the TOML fragment object that
348
+ * merges into an owning config's TOML data (the caller spreads the returned
349
+ * keys alongside the config's own section). Returns `{}` when empty so a
350
+ * config with no declared access emits nothing (byte-stable).
351
+ */
352
+ export function serializeDeclaredAccessManifest(manifest) {
353
+ if (!manifest)
354
+ return {};
355
+ const out = {};
356
+ const metadata = {};
357
+ if (manifest.self && Array.isArray(manifest.self.categories)) {
358
+ metadata.self = { categories: manifest.self.categories };
359
+ }
360
+ if (manifest.paths && Object.keys(manifest.paths).length > 0) {
361
+ metadata.paths = manifest.paths;
362
+ }
363
+ if (Object.keys(metadata).length > 0) {
364
+ out.metadata = metadata;
365
+ }
366
+ if (Array.isArray(manifest.secrets) && manifest.secrets.length > 0) {
367
+ out.secrets = manifest.secrets;
368
+ }
369
+ return out;
370
+ }
371
+ //# sourceMappingURL=toml-metadata-config.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"toml-metadata-config.js","sourceRoot":"","sources":["../../../src/lib/toml-metadata-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAEpC;mDACmD;AACnD,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD;0DAC0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;gDACgD;AAChD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,IAAI;IACJ,WAAW;CACZ,CAAC,CAAC;AAYH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,cAAc;IACd,UAAU;IACV,QAAQ;IACR,UAAU;IACV,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAa;IAEb,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;IACpE,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;KACzC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,sEAAsE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO,wCAAwC,KAAK,CAAC,YAAY,oFAAoF,CAAC;IACxJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,oCAAoC,KAAK,CAAC,QAAQ,oFAAoF,CAAC;IAChJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACzC,OAAO,oCAAoC,iBAAiB,qGAAqG,CAAC;IACpK,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI;QACvB,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,qEAAqE,CAAC;IAC/E,CAAC;IACD,IACE,KAAK,CAAC,SAAS,KAAK,IAAI;QACxB,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;QACD,OAAO,sEAAsE,CAAC;IAChF,CAAC;IACD,IACE,KAAK,CAAC,WAAW,KAAK,IAAI;QAC1B,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EACrC,CAAC;QACD,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,8EAA8E;IAC9E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,EAAE,CAAC;QACjE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,OAAO,qDAAqD,GAAG,8BAA8B,CAAC;QAChG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CACtC,MAAiC,CAClC,EAAE,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,IAAI,2BAA2B,CAAC;QAC/D,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,iBAAiB,IAAI,iCAAiC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,OAAO,iBAAiB,IAAI,mCAAmC;gBAC7D,GAAG,oBAAoB;aACxB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC7C,CAAC;gBACD,OAAO,iBAAiB,IAAI,oCAAoC,CAAC;YACnE,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,iBAAiB,IAAI,0CAA0C,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACzE,OAAO,iBAAiB,IAAI,8BAA8B,CAAC;QAC7D,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,iBAAiB,IAAI,6BAA6B,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxE,OAAO,iBAAiB,IAAI,8BAA8B,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAAW;IACzD,MAAM,OAAO,GAAQ;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9D,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACvC,CAAC;IACD,IACE,MAAM,CAAC,WAAW,KAAK,IAAI;QAC3B,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,WAAW,KAAK,EAAE,EACzB,CAAC;QACD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,8EAA8E;IAC9E,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,iFAAiF;AACjF,2CAA2C;AAC3C,kEAAkE;AAClE,6BAA6B;AAE7B,2EAA2E;AAC3E,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE5D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAC5D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAiB7E;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAa;IAEb,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAmD;IAEnD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,0CAA0C,CAAC;IACpD,CAAC;IAED,SAAS;IACT,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;QACtD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,yDAAyD,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,qCAAqC,GAAG,kCAAkC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAED,UAAU;IACV,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAgC,CAAC;QACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,2DAA2D,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,mBAAmB,IAAI,gCAAgC,CAAC;YACjE,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,OAAO,mBAAmB,IAAI,mBAAmB,CAAC;YACpD,CAAC;YACD,MAAM,CAAC,GAAG,GAA8B,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,mBAAmB,IAAI,yBAAyB,GAAG,eAAe;wBACvE,GAAG,SAAS;qBACb,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;YACpE,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,OAAO,mBAAmB,IAAI,oDAAoD,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAc,CAAC,EAAE,CAAC;oBACzC,OAAO,mBAAmB,IAAI,WAAW,CAAC,CAAC,IAAI,2EAA2E,CAAC;gBAC7H,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAE,CAAC,CAAC,GAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClE,OAAO,mBAAmB,IAAI,uDAAuD,CAAC;gBACxF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAkB,CAAC;gBACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5C,OAAO,mBAAmB,IAAI,eAAe,QAAQ,oCAAoC,qBAAqB,CAAC,IAAI,CACjH,GAAG,CACJ,KAAK,CAAC;gBACT,CAAC;gBACD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,mBAAmB,IAAI,eAAe,QAAQ,mCAAmC,CAAC;gBAC3F,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChD,OAAO,mBAAmB,IAAI,oDAAoD,CAAC;YACrF,CAAC;YACD,MAAM,QAAQ,GAAG,oBAAoB,CACnC,CAAC,CAAC,UAAU,EACZ,mBAAmB,IAAI,GAAG,CAC3B,CAAC;YACF,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAChC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EACnD,CAAC;YACD,OAAO,wDAAwD,CAAC;QAClE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,gBAAgB,GAAG,2BAA2B,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAmB,EAAE,KAAa;IAC9D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC7C,CAAC;QACD,OAAO,GAAG,KAAK,0DAA0D,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,KAAK,iBAAiB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,GAAG,KAAK,sBAAsB,GAAG,2BAA2B,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAmD;IAEnD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
@@ -47,6 +47,33 @@ export interface ValidationResult {
47
47
  * doc-comment for the rationale.
48
48
  */
49
49
  export declare function collectParamRefs(value: any): string[];
50
+ /**
51
+ * Collect bare `params.X` references from a CEL string (issue #1239).
52
+ *
53
+ * Access rules reference operation params with the bare `params.X` form (no
54
+ * `$` prefix), unlike `definition`, which uses `$params.X` (scanned by
55
+ * {@link collectParamRefs}). This helper feeds the operation's `access` CEL
56
+ * and each per-param `access` CEL into the "referenced" set so a param used
57
+ * only by an access rule is not wrongly flagged "declared but not referenced".
58
+ *
59
+ * Supported forms, all whitespace-tolerant:
60
+ * - dot notation: `params.claimedUserId`, `params . claimedUserId`
61
+ * - dot path: `params.config.subField` → first segment `config`
62
+ * - bracket notation: `params["claimedUserId"]`, `params['claimedUserId']`
63
+ *
64
+ * Word-boundary guard: a `params` preceded by an identifier char, `$`, or `.`
65
+ * is NOT a match, so `$params.x` (definition syntax), `myparams.x`, and a
66
+ * dotted member access like `database.metadata.params.userId` are ignored —
67
+ * `params` only counts as the params root when it's a standalone root
68
+ * identifier. To avoid counting a `params.` that merely appears inside a quoted
69
+ * string literal (e.g. `note == "see params.docs"`), bracket keys are scanned
70
+ * first (they legitimately contain quotes), then string literals are stripped
71
+ * before the dot-notation scan.
72
+ *
73
+ * Purely additive: this only grows the referenced set, loosening the soft
74
+ * warning. The blocking `$params` error path is untouched.
75
+ */
76
+ export declare function collectCelParamRefs(cel: any): string[];
50
77
  /**
51
78
  * Normalize a `params` value (object, array, or JSON string) into the
52
79
  * set of declared param names.
@@ -74,6 +101,13 @@ export interface ValidateOptions {
74
101
  name: string;
75
102
  definition: any;
76
103
  params?: any;
104
+ /**
105
+ * The operation-level `access` CEL rule, if any (issue #1239). Params
106
+ * referenced here via bare `params.X` count as "referenced" so they are
107
+ * not wrongly flagged "declared but not referenced". May be null/absent
108
+ * when the operation inherits the type's `defaultAccess`.
109
+ */
110
+ access?: any;
77
111
  }>;
78
112
  }
79
113
  /**
@@ -29,6 +29,7 @@
29
29
  * `$params.config.subKey` without listing every sub-field
30
30
  * individually (review feedback r3246635661).
31
31
  */
32
+ import { collectUnknownOperators } from "./query-operators.js";
32
33
  /**
33
34
  * Walk an arbitrary JSON-ish value and collect `$params.X` references
34
35
  * found in string-valued leaves, returning only the first dotted segment
@@ -58,6 +59,88 @@ export function collectParamRefs(value) {
58
59
  }
59
60
  return refs;
60
61
  }
62
+ /**
63
+ * Collect bare `params.X` references from a CEL string (issue #1239).
64
+ *
65
+ * Access rules reference operation params with the bare `params.X` form (no
66
+ * `$` prefix), unlike `definition`, which uses `$params.X` (scanned by
67
+ * {@link collectParamRefs}). This helper feeds the operation's `access` CEL
68
+ * and each per-param `access` CEL into the "referenced" set so a param used
69
+ * only by an access rule is not wrongly flagged "declared but not referenced".
70
+ *
71
+ * Supported forms, all whitespace-tolerant:
72
+ * - dot notation: `params.claimedUserId`, `params . claimedUserId`
73
+ * - dot path: `params.config.subField` → first segment `config`
74
+ * - bracket notation: `params["claimedUserId"]`, `params['claimedUserId']`
75
+ *
76
+ * Word-boundary guard: a `params` preceded by an identifier char, `$`, or `.`
77
+ * is NOT a match, so `$params.x` (definition syntax), `myparams.x`, and a
78
+ * dotted member access like `database.metadata.params.userId` are ignored —
79
+ * `params` only counts as the params root when it's a standalone root
80
+ * identifier. To avoid counting a `params.` that merely appears inside a quoted
81
+ * string literal (e.g. `note == "see params.docs"`), bracket keys are scanned
82
+ * first (they legitimately contain quotes), then string literals are stripped
83
+ * before the dot-notation scan.
84
+ *
85
+ * Purely additive: this only grows the referenced set, loosening the soft
86
+ * warning. The blocking `$params` error path is untouched.
87
+ */
88
+ export function collectCelParamRefs(cel) {
89
+ if (typeof cel !== "string" || cel.length === 0)
90
+ return [];
91
+ const refs = [];
92
+ // Bracket notation: params["X"] / params['X']. Run before stripping string
93
+ // literals so the quoted key survives.
94
+ const bracketRe = /(?<![\w$.])params\s*\[\s*["']([^"']+)["']\s*\]/g;
95
+ let m;
96
+ while ((m = bracketRe.exec(cel)) !== null) {
97
+ const first = m[1].split(/[.\[]/)[0];
98
+ if (first)
99
+ refs.push(first);
100
+ }
101
+ // Drop string literals so `params.` inside a quoted string is not counted.
102
+ const withoutStrings = cel.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, "");
103
+ // Dot notation: params.X (first segment only, mirroring collectParamRefs).
104
+ const dotRe = /(?<![\w$.])params\s*\.\s*([A-Za-z_$][\w$]*)/g;
105
+ while ((m = dotRe.exec(withoutStrings)) !== null) {
106
+ refs.push(m[1]);
107
+ }
108
+ return refs;
109
+ }
110
+ /**
111
+ * Collect the per-param `access` CEL strings from an operation's `params`
112
+ * value (object, array, or JSON string form). Used by issue #1239 to count
113
+ * params referenced only inside another param's `access` rule.
114
+ */
115
+ function collectParamAccessCels(params) {
116
+ const cels = [];
117
+ if (params == null)
118
+ return cels;
119
+ let value = params;
120
+ if (typeof value === "string") {
121
+ try {
122
+ value = JSON.parse(value);
123
+ }
124
+ catch {
125
+ return cels;
126
+ }
127
+ }
128
+ if (Array.isArray(value)) {
129
+ for (const row of value) {
130
+ if (row && typeof row === "object" && typeof row.access === "string") {
131
+ cels.push(row.access);
132
+ }
133
+ }
134
+ }
135
+ else if (typeof value === "object" && value !== null) {
136
+ for (const entry of Object.values(value)) {
137
+ if (entry && typeof entry === "object" && typeof entry.access === "string") {
138
+ cels.push(entry.access);
139
+ }
140
+ }
141
+ }
142
+ return cels;
143
+ }
61
144
  /**
62
145
  * Normalize a `params` value (object, array, or JSON string) into the
63
146
  * set of declared param names.
@@ -146,9 +229,24 @@ export function validateOperations(opts) {
146
229
  if (!op || !op.name)
147
230
  continue;
148
231
  const declared = declaredParamNames(op.params);
149
- const refs = new Set(collectParamRefs(op.definition));
232
+ // `definitionRefs` drives the BLOCKING error loop and must stay limited to
233
+ // `$params.X` references inside `definition` — access CEL refs are NOT
234
+ // declarations, so they must never produce an "undeclared" error.
235
+ const definitionRefs = new Set(collectParamRefs(op.definition));
236
+ // Issue #1239: a param referenced only by an access CEL rule (bare
237
+ // `params.X`) is still referenced. The "declared but not referenced"
238
+ // warning uses a wider set that also counts the operation-level `access`
239
+ // and each per-param `access` CEL. Purely additive — the blocking error
240
+ // path below is built only from `definitionRefs`.
241
+ const referenced = new Set(definitionRefs);
242
+ for (const ref of collectCelParamRefs(op.access))
243
+ referenced.add(ref);
244
+ for (const cel of collectParamAccessCels(op.params)) {
245
+ for (const ref of collectCelParamRefs(cel))
246
+ referenced.add(ref);
247
+ }
150
248
  const line = locateOperationLine(opts.rawToml, op.name);
151
- for (const ref of refs) {
249
+ for (const ref of definitionRefs) {
152
250
  if (!declared.has(ref)) {
153
251
  errors.push({
154
252
  file: opts.filePath,
@@ -159,7 +257,7 @@ export function validateOperations(opts) {
159
257
  }
160
258
  }
161
259
  for (const name of declared) {
162
- if (!refs.has(name)) {
260
+ if (!referenced.has(name)) {
163
261
  warnings.push({
164
262
  file: opts.filePath,
165
263
  line,
@@ -168,6 +266,23 @@ export function validateOperations(opts) {
168
266
  });
169
267
  }
170
268
  }
269
+ // Issue #1255 (Fork 4): warn on unknown filter operators. The server only
270
+ // checks that `filter` is an object at push time, so a typo like
271
+ // `$gt` → `$gte` or an invented `$foo` slips through and throws
272
+ // `InvalidOperatorError` only at query execution. We warn (not error) to
273
+ // avoid CLI/server divergence — the operator set could drift, and the
274
+ // server stays authoritative.
275
+ const filter = op.definition && typeof op.definition === "object"
276
+ ? op.definition.filter
277
+ : undefined;
278
+ for (const badOp of collectUnknownOperators(filter)) {
279
+ warnings.push({
280
+ file: opts.filePath,
281
+ line,
282
+ op: op.name,
283
+ message: `unknown filter operator '${badOp}' in operation '${op.name}' — not a recognized query operator; it will fail at query execution`,
284
+ });
285
+ }
171
286
  }
172
287
  return { errors, warnings };
173
288
  }
@@ -1 +1 @@
1
- {"version":3,"file":"toml-params-validator.js","sourceRoot":"","sources":["../../../src/lib/toml-params-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAcH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAU;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,GAAQ,MAAM,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAc;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,mEAAmE;QACnE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5F,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACvF,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAExD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,WAAW,GAAG,yDAAyD,EAAE,CAAC,IAAI,GAAG;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,UAAU,IAAI,+CAA+C,EAAE,CAAC,IAAI,GAAG;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAsB;IAChD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC3C,CAAC"}
1
+ {"version":3,"file":"toml-params-validator.js","sourceRoot":"","sources":["../../../src/lib/toml-params-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAc/D;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAU;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,SAAS,GAAG,iDAAiD,CAAC;IACpE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;IAE/E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,8CAA8C,CAAC;IAC7D,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAW;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,GAAQ,MAAM,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAa,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpF,IAAI,CAAC,IAAI,CAAE,KAAa,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,GAAQ,MAAM,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,MAAc;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,mEAAmE;QACnE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5F,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACvF,KAAK,GAAG,KAAK,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC/C,2EAA2E;QAC3E,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,mEAAmE;QACnE,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,EAAE,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAExD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,WAAW,GAAG,yDAAyD,EAAE,CAAC,IAAI,GAAG;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,IAAI;oBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;oBACX,OAAO,EAAE,UAAU,IAAI,+CAA+C,EAAE,CAAC,IAAI,GAAG;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,gEAAgE;QAChE,yEAAyE;QACzE,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ;YAC/D,CAAC,CAAE,EAAE,CAAC,UAAkB,CAAC,MAAM;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,IAAI;gBACJ,EAAE,EAAE,EAAE,CAAC,IAAI;gBACX,OAAO,EAAE,4BAA4B,KAAK,mBAAmB,EAAE,CAAC,IAAI,sEAAsE;aAC3I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAsB;IAChD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC3C,CAAC"}