primitive-admin 1.1.0-alpha.7 → 1.1.0-alpha.71

package/dist/src/lib/toml-metadata-config.d.ts

@@ -0,0 +1,151 @@
+/**
+ * CLI TOML parser / validator / serializer for resource-metadata config
+ * surfaces (issue #1304, P-B — CLI/TOML config-sync).
+ *
+ * Two surfaces, mirroring the "config change ships all three surfaces" rule
+ * (CLAUDE.md; same shape as the database type-config helpers in
+ * `toml-database-config.ts`):
+ *
+ *   1. `MetadataCategoryConfig` blocks — a per-`{resourceType, category}`
+ *      typed-schema + read/write-rule definition. These round-trip through
+ *      `primitive config push` / `pull` against the P-A REST API
+ *      (`metadata-categories` CRUD). One file = one category, using a single
+ *      `[metadataCategoryConfig]` section so the nested `schema.fields.*`
+ *      tables serialize cleanly and byte-stably.
+ *
+ *   2. The declared-access manifest (`[metadata]` + `secrets` blocks) that
+ *      lives on the owning config surfaces (`CollectionTypeConfig` /
+ *      `DatabaseTypeConfig` / `WorkflowDefinition`). This module provides the
+ *      TOML *structure* + *validator* + byte-stable round-trip helpers for the
+ *      manifest so a bad value is rejected with a clear error. Wiring the
+ *      manifest onto those config models' config push/pull (which needs a
+ *      storage field on each model) is P-C's "persist the manifest on owning
+ *      configs" work — this module ships the parse/validate/serialize the
+ *      P-C eval-site folding will call, matching how earlier phases shipped a
+ *      validated mechanism ahead of its live wiring.
+ *
+ * All functions here are pure and unit-testable (no network, no filesystem).
+ * `validate*` functions return an error string (or `null` when valid) rather
+ * than throwing, mirroring `validateCategorySchema` server-side.
+ */
+/** The reserved projected category (computed live from a resource's columns).
+ *  Matches the server's `RESERVED_PROJECTED_CATEGORY`. */
+export declare const RESERVED_CATEGORY = "attrs";
+/** The REST body shape for a category-config upsert (P-A `metadata-categories`). */
+export interface MetadataCategoryConfigInput {
+    resourceType: string;
+    category: string;
+    schema: unknown;
+    readRule: string | null;
+    writeRule: string | null;
+    description: string | null;
+    /**
+     * Declared-access manifest (#1420 Phase 2) — the top-level `[metadata]` /
+     * `secrets` block that lets the category's `readRule`/`writeRule` reach
+     * `md.self.*` / `secrets.*`. Null when the config declares none.
+     */
+    metadataManifest: DeclaredAccessManifest | null;
+}
+/**
+ * Normalize a parsed `[metadataCategoryConfig]` TOML section into the REST
+ * upsert body. Server-managed fields (`schemaVersion`, `generation`) are never
+ * emitted or read here — they'd churn a round-trip.
+ *
+ * #2644 — the field list comes from the vendored definition (it used to be
+ * written out here, and again in `CATEGORY_SECTION_KEYS`, and again in the
+ * serializer), so a scalar added there is read off the file with no edit here.
+ */
+export declare function parseMetadataCategoryToml(tomlData: any): MetadataCategoryConfigInput;
+/**
+ * Validate a parsed category config (post-{@link parseMetadataCategoryToml}).
+ * Returns an error string, or `null` when valid. The server re-validates on
+ * write; this is the fast local check so `config push` fails with a clear
+ * message before hitting the network.
+ */
+export declare function validateMetadataCategoryConfig(input: MetadataCategoryConfigInput): string | null;
+/**
+ * Validate the `schema` block is a well-formed js-bao `FieldOptions` map:
+ * `{ fields: { <name>: { type, required?, maxLength?, maxCount?, enum? } } }`.
+ * Mirrors the server's `validateCategorySchema`.
+ */
+export declare function validateCategorySchema(schema: unknown): string | null;
+/**
+ * Serialize a category config (as returned by the P-A REST API — `schema` is a
+ * parsed object) to byte-stable TOML. Only the authored fields are emitted;
+ * server-managed `schemaVersion` / `generation` / `appId` / `categoryKey` are
+ * dropped so a pull → push → pull cycle is a no-op.
+ *
+ * Scalars are inserted before `schema` so `smol-toml` emits them ahead of
+ * the nested `[metadataCategoryConfig.schema.fields.*]` tables.
+ */
+export declare function serializeMetadataCategoryConfig(config: any, logger?: (message: string) => void): string;
+/** The one **server-authenticated** `rootFrom` root — the calling user's id
+ *  (issue #1362). Unlike the {@link ROOT_CONTEXT_PREFIXES} roots (caller-supplied),
+ *  `user.userId` binds the authenticated principal, so a rule may read the
+ *  caller's own metadata (`md.<name>`). Mirrors the server's `CALLER_ROOTFROM`. */
+export declare const CALLER_ROOTFROM = "user.userId";
+/** The target `type` a {@link CALLER_ROOTFROM} path must declare. `user.userId`
+ *  names a user, so the path must resolve `user`-typed metadata; a mismatched
+ *  type would silently query `app#<type>#<userId>` for a resource that isn't the
+ *  user. Mirrors the server's `CALLER_ROOTFROM_TYPE`. */
+export declare const CALLER_ROOTFROM_TYPE = "user";
+/**
+ * Validate a path's `rootFrom` value together with its declared target `type`
+ * (issue #1362), mirroring the server's `validateRootFromPath`
+ * (`src/app-api/helpers/metadata-cel-access.ts`). A `rootFrom` is sound when it
+ * is either:
+ *
+ *   - a static dotted **caller-supplied** context path rooted at one of
+ *     {@link ROOT_CONTEXT_PREFIXES} (`input.*`/`record.*`/`params.*`), with at
+ *     least two segments; or
+ *   - exactly {@link CALLER_ROOTFROM} (`user.userId`) — the one
+ *     **server-authenticated** root — in which case the path must also declare
+ *     `type = "user"` ({@link CALLER_ROOTFROM_TYPE}).
+ *
+ * Any other `user.*` path is rejected outright — the caller root is a single
+ * special case, not a blanket `user.*` namespace (Fork 1 = A). This is the fast
+ * local check so `config push` fails with a clear message before the network call;
+ * the server's `validateRootFromPath` re-validates at persist time. Returns a
+ * human-readable reason (worded to follow `metadata.paths."<name>" `), or null
+ * when sound.
+ */
+export declare function validateRootFromPath(root: string, type: string | undefined): string | null;
+export interface DeclaredAccessManifest {
+    self?: {
+        categories: string[];
+    };
+    paths?: Record<string, {
+        from?: string;
+        rootFrom?: string;
+        via?: string;
+        type?: string;
+        categories: string[];
+    }>;
+    secrets?: string[];
+    vars?: string[];
+}
+/**
+ * Read the declared-access manifest out of a parsed config TOML: the top-level
+ * `[metadata]` table (self + paths) and the `secrets` / `vars` arrays. Returns
+ * `null` when none is present (the config declares no metadata/scalar access).
+ */
+export declare function parseDeclaredAccessManifestToml(tomlData: any): DeclaredAccessManifest | null;
+/**
+ * Validate a declared-access manifest structurally. Returns an error string,
+ * or `null` when valid. This is the local surface-level check (identifier
+ * names, key shape, exactly-one-root per path); the server's
+ * `validatePathGraph` still does the deep graph validation (cycles, depth,
+ * schema-mismatch) at persist time.
+ */
+export declare function validateDeclaredAccessManifest(manifest: DeclaredAccessManifest | null | undefined): string | null;
+/**
+ * Serialize a declared-access manifest into the TOML fragment object that
+ * merges into an owning config's TOML data (the caller spreads the returned
+ * keys alongside the config's own section). Returns `{}` when empty so a
+ * config with no declared access emits nothing (byte-stable).
+ */
+export declare function serializeDeclaredAccessManifest(manifest: DeclaredAccessManifest | null | undefined): {
+    metadata?: any;
+    secrets?: string[];
+    vars?: string[];
+};

package/dist/src/lib/toml-metadata-config.js

@@ -0,0 +1,476 @@
+/**
+ * CLI TOML parser / validator / serializer for resource-metadata config
+ * surfaces (issue #1304, P-B — CLI/TOML config-sync).
+ *
+ * Two surfaces, mirroring the "config change ships all three surfaces" rule
+ * (CLAUDE.md; same shape as the database type-config helpers in
+ * `toml-database-config.ts`):
+ *
+ *   1. `MetadataCategoryConfig` blocks — a per-`{resourceType, category}`
+ *      typed-schema + read/write-rule definition. These round-trip through
+ *      `primitive config push` / `pull` against the P-A REST API
+ *      (`metadata-categories` CRUD). One file = one category, using a single
+ *      `[metadataCategoryConfig]` section so the nested `schema.fields.*`
+ *      tables serialize cleanly and byte-stably.
+ *
+ *   2. The declared-access manifest (`[metadata]` + `secrets` blocks) that
+ *      lives on the owning config surfaces (`CollectionTypeConfig` /
+ *      `DatabaseTypeConfig` / `WorkflowDefinition`). This module provides the
+ *      TOML *structure* + *validator* + byte-stable round-trip helpers for the
+ *      manifest so a bad value is rejected with a clear error. Wiring the
+ *      manifest onto those config models' config push/pull (which needs a
+ *      storage field on each model) is P-C's "persist the manifest on owning
+ *      configs" work — this module ships the parse/validate/serialize the
+ *      P-C eval-site folding will call, matching how earlier phases shipped a
+ *      validated mechanism ahead of its live wiring.
+ *
+ * All functions here are pure and unit-testable (no network, no filesystem).
+ * `validate*` functions return an error string (or `null` when valid) rather
+ * than throwing, mirroring `validateCategorySchema` server-side.
+ */
+import { stringifyConfigToml } from "./config-toml.js";
+// #2644 — the one definition for the metadata-category configuration object.
+import { METADATA_CATEGORY_CONFIG_TABLE, warnUnrecognizedServerKeys, } from "./config-surface.js";
+import { buildPayloadFromToml, projectRecordToToml, } from "./config-payload.js";
+/** Identifier-safe name: letters, digits, underscore; not starting with a digit.
+ *  Matches the server's `METADATA_KEY_PATTERN`. */
+const IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+/** The key format the `secrets` / `vars` services accept when a value is created
+ *  (server's `SCALAR_KEY_RE`, secrets/vars service `KEY_REGEX`). A declared
+ *  scalar-root key that is identifier-safe but does not match this (e.g.
+ *  lowercase) can never be created via the API, so reject it at manifest-parse
+ *  time on both ends (issue #1364). */
+const SCALAR_KEY_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+/** The reserved projected category (computed live from a resource's columns).
+ *  Matches the server's `RESERVED_PROJECTED_CATEGORY`. */
+export const RESERVED_CATEGORY = "attrs";
+/** The subset of js-bao `FieldOptions` field types the metadata schema accepts.
+ *  Matches the server's `MetadataFieldType`. */
+const METADATA_FIELD_TYPES = new Set([
+    "string",
+    "number",
+    "boolean",
+    "date",
+    "id",
+    "stringset",
+]);
+/**
+ * Normalize a parsed `[metadataCategoryConfig]` TOML section into the REST
+ * upsert body. Server-managed fields (`schemaVersion`, `generation`) are never
+ * emitted or read here — they'd churn a round-trip.
+ *
+ * #2644 — the field list comes from the vendored definition (it used to be
+ * written out here, and again in `CATEGORY_SECTION_KEYS`, and again in the
+ * serializer), so a scalar added there is read off the file with no edit here.
+ */
+export function parseMetadataCategoryToml(tomlData) {
+    const section = (tomlData && tomlData.metadataCategoryConfig) || {};
+    const nulled = (value) => value ?? null;
+    return {
+        ...buildPayloadFromToml(METADATA_CATEGORY_CONFIG_TABLE, section, {
+            // One upsert endpoint: every field is writable in both modes.
+            mode: "create",
+            // The file owns its rules and description — dropping a line clears the
+            // stored value rather than leaving it live.
+            values: { readRule: nulled, writeRule: nulled, description: nulled },
+        }),
+        // #1420 Phase 2: the manifest lives in the top-level `[metadata]`/`secrets`
+        // block (sibling to `[metadataCategoryConfig]`), reusing the shared parser.
+        metadataManifest: parseDeclaredAccessManifestToml(tomlData),
+    };
+}
+/**
+ * Validate a parsed category config (post-{@link parseMetadataCategoryToml}).
+ * Returns an error string, or `null` when valid. The server re-validates on
+ * write; this is the fast local check so `config push` fails with a clear
+ * message before hitting the network.
+ */
+export function validateMetadataCategoryConfig(input) {
+    if (!input.resourceType || typeof input.resourceType !== "string") {
+        return "metadataCategoryConfig.resourceType is required and must be a string";
+    }
+    if (!IDENTIFIER_PATTERN.test(input.resourceType)) {
+        return `metadataCategoryConfig.resourceType "${input.resourceType}" must be identifier-safe (letters, digits, underscore; not starting with a digit)`;
+    }
+    if (!input.category || typeof input.category !== "string") {
+        return "metadataCategoryConfig.category is required and must be a string";
+    }
+    if (!IDENTIFIER_PATTERN.test(input.category)) {
+        return `metadataCategoryConfig.category "${input.category}" must be identifier-safe (letters, digits, underscore; not starting with a digit)`;
+    }
+    if (input.category === RESERVED_CATEGORY) {
+        return `metadataCategoryConfig.category "${RESERVED_CATEGORY}" is reserved (a projected category computed from the resource's own columns) and cannot be defined`;
+    }
+    if (input.readRule !== null &&
+        input.readRule !== undefined &&
+        typeof input.readRule !== "string") {
+        return "metadataCategoryConfig.readRule must be a string (a CEL expression)";
+    }
+    if (input.writeRule !== null &&
+        input.writeRule !== undefined &&
+        typeof input.writeRule !== "string") {
+        return "metadataCategoryConfig.writeRule must be a string (a CEL expression)";
+    }
+    if (input.description !== null &&
+        input.description !== undefined &&
+        typeof input.description !== "string") {
+        return "metadataCategoryConfig.description must be a string";
+    }
+    const schemaError = validateCategorySchema(input.schema);
+    if (schemaError)
+        return schemaError;
+    // #1420 Phase 2: local surface-level check on the declared-access manifest;
+    // the server re-validates the deep path graph at persist time.
+    return validateDeclaredAccessManifest(input.metadataManifest);
+}
+/**
+ * Validate the `schema` block is a well-formed js-bao `FieldOptions` map:
+ * `{ fields: { <name>: { type, required?, maxLength?, maxCount?, enum? } } }`.
+ * Mirrors the server's `validateCategorySchema`.
+ */
+export function validateCategorySchema(schema) {
+    if (schema === null || typeof schema !== "object" || Array.isArray(schema)) {
+        return "metadataCategoryConfig.schema must be a table with a 'fields' map";
+    }
+    const fields = schema.fields;
+    if (fields === null || typeof fields !== "object" || Array.isArray(fields)) {
+        return "metadataCategoryConfig.schema.fields must be a table";
+    }
+    // Reject unknown top-level keys under `schema` (only `fields` is meaningful).
+    for (const key of Object.keys(schema)) {
+        if (key !== "fields") {
+            return `metadataCategoryConfig.schema has an unknown key "${key}" (only "fields" is allowed)`;
+        }
+    }
+    let uniqueCount = 0;
+    for (const [name, def] of Object.entries(fields)) {
+        if (!IDENTIFIER_PATTERN.test(name)) {
+            return `schema field name "${name}" must be identifier-safe`;
+        }
+        if (def === null || typeof def !== "object" || Array.isArray(def)) {
+            return `schema field "${name}" must be a table with a "type"`;
+        }
+        const field = def;
+        if (typeof field.type !== "string" || !METADATA_FIELD_TYPES.has(field.type)) {
+            return `schema field "${name}" has an invalid type (allowed: ${[
+                ...METADATA_FIELD_TYPES,
+            ].join(", ")})`;
+        }
+        if (field.enum !== undefined) {
+            if (!Array.isArray(field.enum) ||
+                field.enum.some((v) => typeof v !== "string")) {
+                return `schema field "${name}" enum must be an array of strings`;
+            }
+            if (field.type !== "string") {
+                return `schema field "${name}" enum is only valid on a "string" field`;
+            }
+        }
+        if (field.maxLength !== undefined && typeof field.maxLength !== "number") {
+            return `schema field "${name}" maxLength must be a number`;
+        }
+        if (field.maxCount !== undefined && typeof field.maxCount !== "number") {
+            return `schema field "${name}" maxCount must be a number`;
+        }
+        if (field.required !== undefined && typeof field.required !== "boolean") {
+            return `schema field "${name}" required must be a boolean`;
+        }
+        // Issue #1361 — the reverse-resolve `unique` flag. Mirrors the server's
+        // `validateCategorySchema` exactly (boolean, only on "string"/"id", at most
+        // one unique field per category). Parity is pinned by tests.
+        if (field.unique !== undefined) {
+            if (typeof field.unique !== "boolean") {
+                return `schema field "${name}" unique must be a boolean`;
+            }
+            if (field.unique) {
+                if (field.type !== "string" && field.type !== "id") {
+                    return `schema field "${name}" unique is only valid on a "string" or "id" field`;
+                }
+                uniqueCount += 1;
+                if (uniqueCount > 1) {
+                    return `a category may declare at most one unique field (found more than one)`;
+                }
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Serialize a category config (as returned by the P-A REST API — `schema` is a
+ * parsed object) to byte-stable TOML. Only the authored fields are emitted;
+ * server-managed `schemaVersion` / `generation` / `appId` / `categoryKey` are
+ * dropped so a pull → push → pull cycle is a no-op.
+ *
+ * Scalars are inserted before `schema` so `smol-toml` emits them ahead of
+ * the nested `[metadataCategoryConfig.schema.fields.*]` tables.
+ */
+export function serializeMetadataCategoryConfig(config, logger) {
+    // #2644 — name any server key this CLI version does not know rather than
+    // dropping it silently, and take the emitted key set from the definition.
+    warnUnrecognizedServerKeys(config, METADATA_CATEGORY_CONFIG_TABLE, `metadata-category-configs/${config?.resourceType}.${config?.category}.toml`, logger);
+    const section = projectRecordToToml(METADATA_CATEGORY_CONFIG_TABLE, config, {
+        // `schema` may arrive as a parsed object (REST) or a JSON string
+        // (defensive), and is always emitted — an absent one as an empty
+        // `{ fields: {} }`, so the file stays pushable.
+        schema: (record) => {
+            let schema = record?.schema;
+            if (typeof schema === "string") {
+                try {
+                    schema = JSON.parse(schema);
+                }
+                catch {
+                    schema = { fields: {} };
+                }
+            }
+            return schema ?? { fields: {} };
+        },
+    });
+    // #1420 Phase 2: emit the declared-access manifest as a top-level
+    // `[metadata]`/`secrets` block (sibling to `[metadataCategoryConfig]`),
+    // reusing the shared serializer so it round-trips byte-stable.
+    return stringifyConfigToml({
+        metadataCategoryConfig: section,
+        ...serializeDeclaredAccessManifest(config.metadataManifest),
+    });
+}
+// --- Declared-access manifest (`[metadata]` + `secrets` + `vars`) ----------
+//
+// The manifest that lives on an owning config surface. Shape mirrors the
+// server's `MetadataDeclaration` (`src/app-api/helpers/metadata-cel-access.ts`):
+//   metadata.self.categories = ["profile"]
+//   [metadata.paths.<name>]  from|rootFrom, via, type, categories
+//   secrets = ["STRIPE_KEY"]
+//   vars    = ["ADMIN_GROUP_ID"]   # non-secret twin of secrets (issue #1364)
+/** Root contexts a `rootFrom` path may start at (caller-supplied subjectless
+ *  contexts). Mirrors the server's `ROOT_CONTEXT_PREFIXES`
+ *  (`src/app-api/helpers/metadata-cel-access.ts`). */
+const ROOT_CONTEXT_PREFIXES = ["input", "record", "params"];
+/** The one **server-authenticated** `rootFrom` root — the calling user's id
+ *  (issue #1362). Unlike the {@link ROOT_CONTEXT_PREFIXES} roots (caller-supplied),
+ *  `user.userId` binds the authenticated principal, so a rule may read the
+ *  caller's own metadata (`md.<name>`). Mirrors the server's `CALLER_ROOTFROM`. */
+export const CALLER_ROOTFROM = "user.userId";
+/** The target `type` a {@link CALLER_ROOTFROM} path must declare. `user.userId`
+ *  names a user, so the path must resolve `user`-typed metadata; a mismatched
+ *  type would silently query `app#<type>#<userId>` for a resource that isn't the
+ *  user. Mirrors the server's `CALLER_ROOTFROM_TYPE`. */
+export const CALLER_ROOTFROM_TYPE = "user";
+/**
+ * Validate a path's `rootFrom` value together with its declared target `type`
+ * (issue #1362), mirroring the server's `validateRootFromPath`
+ * (`src/app-api/helpers/metadata-cel-access.ts`). A `rootFrom` is sound when it
+ * is either:
+ *
+ *   - a static dotted **caller-supplied** context path rooted at one of
+ *     {@link ROOT_CONTEXT_PREFIXES} (`input.*`/`record.*`/`params.*`), with at
+ *     least two segments; or
+ *   - exactly {@link CALLER_ROOTFROM} (`user.userId`) — the one
+ *     **server-authenticated** root — in which case the path must also declare
+ *     `type = "user"` ({@link CALLER_ROOTFROM_TYPE}).
+ *
+ * Any other `user.*` path is rejected outright — the caller root is a single
+ * special case, not a blanket `user.*` namespace (Fork 1 = A). This is the fast
+ * local check so `config push` fails with a clear message before the network call;
+ * the server's `validateRootFromPath` re-validates at persist time. Returns a
+ * human-readable reason (worded to follow `metadata.paths."<name>" `), or null
+ * when sound.
+ */
+export function validateRootFromPath(root, type) {
+    if (root === CALLER_ROOTFROM) {
+        if (type !== CALLER_ROOTFROM_TYPE) {
+            return `rootFrom "${CALLER_ROOTFROM}" requires type = "${CALLER_ROOTFROM_TYPE}" (got ${type ? `"${type}"` : "no type"})`;
+        }
+        return null;
+    }
+    const prefix = root.split(".")[0];
+    if (prefix === "user") {
+        return `rootFrom "${root}" is not allowed — the only server-authenticated root is "${CALLER_ROOTFROM}"`;
+    }
+    const segments = root.split(".");
+    const isStaticDotted = segments.length >= 1 && segments.every((s) => IDENTIFIER_PATTERN.test(s));
+    if (!isStaticDotted ||
+        segments.length < 2 ||
+        !ROOT_CONTEXT_PREFIXES.includes(prefix)) {
+        return `rootFrom "${root}" must be a static dotted context path rooted at ${ROOT_CONTEXT_PREFIXES.join("/")} or "${CALLER_ROOTFROM}"`;
+    }
+    return null;
+}
+const MANIFEST_KEYS = new Set(["self", "paths", "secrets", "vars"]);
+const SELF_KEYS = new Set(["categories"]);
+const PATH_KEYS = new Set(["from", "rootFrom", "via", "type", "categories"]);
+/** The declared scalar roots: `secrets` (masked) and `vars` (non-secret). */
+const SCALAR_ROOT_KEYS = [
+    { key: "secrets", singular: "secret" },
+    { key: "vars", singular: "var" },
+];
+/**
+ * Read the declared-access manifest out of a parsed config TOML: the top-level
+ * `[metadata]` table (self + paths) and the `secrets` / `vars` arrays. Returns
+ * `null` when none is present (the config declares no metadata/scalar access).
+ */
+export function parseDeclaredAccessManifestToml(tomlData) {
+    const metadata = tomlData?.metadata;
+    const secrets = tomlData?.secrets;
+    const vars = tomlData?.vars;
+    if (metadata === undefined && secrets === undefined && vars === undefined) {
+        return null;
+    }
+    const manifest = {};
+    if (metadata && typeof metadata === "object") {
+        if (metadata.self !== undefined) {
+            manifest.self = { categories: metadata.self?.categories };
+        }
+        if (metadata.paths !== undefined) {
+            manifest.paths = metadata.paths;
+        }
+    }
+    if (secrets !== undefined) {
+        manifest.secrets = secrets;
+    }
+    if (vars !== undefined) {
+        manifest.vars = vars;
+    }
+    return manifest;
+}
+/**
+ * Validate a declared-access manifest structurally. Returns an error string,
+ * or `null` when valid. This is the local surface-level check (identifier
+ * names, key shape, exactly-one-root per path); the server's
+ * `validatePathGraph` still does the deep graph validation (cycles, depth,
+ * schema-mismatch) at persist time.
+ */
+export function validateDeclaredAccessManifest(manifest) {
+    if (manifest === null || manifest === undefined)
+        return null;
+    if (typeof manifest !== "object" || Array.isArray(manifest)) {
+        return "declared-access manifest must be a table";
+    }
+    // `self`
+    if (manifest.self !== undefined) {
+        const self = manifest.self;
+        if (self === null || typeof self !== "object" || Array.isArray(self)) {
+            return "metadata.self must be a table with a 'categories' array";
+        }
+        for (const key of Object.keys(self)) {
+            if (!SELF_KEYS.has(key)) {
+                return `metadata.self has an unknown key "${key}" (only "categories" is allowed)`;
+            }
+        }
+        const catError = validateCategoryList(self.categories, "metadata.self");
+        if (catError)
+            return catError;
+    }
+    // `paths`
+    if (manifest.paths !== undefined) {
+        const paths = manifest.paths;
+        if (paths === null || typeof paths !== "object" || Array.isArray(paths)) {
+            return "metadata.paths must be a table of named path declarations";
+        }
+        const declaredNodes = new Set(["self", ...Object.keys(paths)]);
+        for (const [name, raw] of Object.entries(paths)) {
+            if (!IDENTIFIER_PATTERN.test(name)) {
+                return `metadata.paths."${name}" name must be identifier-safe`;
+            }
+            if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+                return `metadata.paths."${name}" must be a table`;
+            }
+            const p = raw;
+            for (const key of Object.keys(p)) {
+                if (!PATH_KEYS.has(key)) {
+                    return `metadata.paths."${name}" has an unknown key "${key}" (allowed: ${[
+                        ...PATH_KEYS,
+                    ].join(", ")})`;
+                }
+            }
+            const hasFrom = typeof p.from === "string" && p.from !== "";
+            const hasRoot = typeof p.rootFrom === "string" && p.rootFrom !== "";
+            if (hasFrom === hasRoot) {
+                return `metadata.paths."${name}" must declare exactly one of "from" or "rootFrom"`;
+            }
+            if (hasFrom) {
+                if (!declaredNodes.has(p.from)) {
+                    return `metadata.paths."${name}" from "${p.from}" references an undeclared node (must be "self" or another declared path)`;
+                }
+                if (typeof p.via !== "string" || !p.via.includes(".")) {
+                    return `metadata.paths."${name}" must declare a "via" of the form "<category>.<key>"`;
+                }
+            }
+            else {
+                // rootFrom: a caller-supplied static context path
+                // (`input.*`/`record.*`/`params.*`) OR the server-authenticated
+                // `user.userId` root (which requires `type = "user"`). Mirrors the
+                // server's `validateRootFromPath` (issue #1362).
+                const rootFrom = p.rootFrom;
+                const type = typeof p.type === "string" ? p.type : undefined;
+                const rootReason = validateRootFromPath(rootFrom, type);
+                if (rootReason) {
+                    return `metadata.paths."${name}" ${rootReason}`;
+                }
+                if (p.via !== undefined) {
+                    return `metadata.paths."${name}" roots at "${rootFrom}" and must not also declare "via"`;
+                }
+            }
+            if (typeof p.type !== "string" || p.type === "") {
+                return `metadata.paths."${name}" must declare a target "type" (the resource type)`;
+            }
+            const catError = validateCategoryList(p.categories, `metadata.paths."${name}"`);
+            if (catError)
+                return catError;
+        }
+    }
+    // `secrets` / `vars` — the declared scalar roots share one key-list shape.
+    for (const { key: rootKey, singular } of SCALAR_ROOT_KEYS) {
+        const keys = manifest[rootKey];
+        if (keys === undefined)
+            continue;
+        if (!Array.isArray(keys) || keys.some((s) => typeof s !== "string")) {
+            return `${rootKey} must be an array of ${singular} key names (strings)`;
+        }
+        for (const key of keys) {
+            if (!SCALAR_KEY_PATTERN.test(key)) {
+                return `${rootKey} key "${key}" must match ^[A-Z][A-Z0-9_]{0,63}$ (uppercase letters, digits, underscores; must start with a letter; max 64 chars)`;
+            }
+        }
+    }
+    return null;
+}
+function validateCategoryList(categories, where) {
+    if (!Array.isArray(categories) ||
+        categories.some((c) => typeof c !== "string")) {
+        return `${where}.categories must be an array of category names (strings)`;
+    }
+    for (const cat of categories) {
+        if (cat !== RESERVED_CATEGORY && !IDENTIFIER_PATTERN.test(cat)) {
+            return `${where}.categories entry "${cat}" must be identifier-safe`;
+        }
+    }
+    return null;
+}
+/**
+ * Serialize a declared-access manifest into the TOML fragment object that
+ * merges into an owning config's TOML data (the caller spreads the returned
+ * keys alongside the config's own section). Returns `{}` when empty so a
+ * config with no declared access emits nothing (byte-stable).
+ */
+export function serializeDeclaredAccessManifest(manifest) {
+    if (!manifest)
+        return {};
+    const out = {};
+    const metadata = {};
+    if (manifest.self && Array.isArray(manifest.self.categories)) {
+        metadata.self = { categories: manifest.self.categories };
+    }
+    if (manifest.paths && Object.keys(manifest.paths).length > 0) {
+        metadata.paths = manifest.paths;
+    }
+    if (Object.keys(metadata).length > 0) {
+        out.metadata = metadata;
+    }
+    if (Array.isArray(manifest.secrets) && manifest.secrets.length > 0) {
+        out.secrets = manifest.secrets;
+    }
+    if (Array.isArray(manifest.vars) && manifest.vars.length > 0) {
+        out.vars = manifest.vars;
+    }
+    return out;
+}
+//# sourceMappingURL=toml-metadata-config.js.map

package/dist/src/lib/toml-metadata-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml-metadata-config.js","sourceRoot":"","sources":["../../../src/lib/toml-metadata-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,6EAA6E;AAC7E,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAE7B;mDACmD;AACnD,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD;;;;uCAIuC;AACvC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAEpD;0DAC0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;gDACgD;AAChD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,IAAI;IACJ,WAAW;CACZ,CAAC,CAAC;AAkBH;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAa;IAEb,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,MAAM,GAAc,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;IACnD,OAAO;QACL,GAAI,oBAAoB,CAAC,8BAA8B,EAAE,OAAO,EAAE;YAChE,8DAA8D;YAC9D,IAAI,EAAE,QAAQ;YACd,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;SACrE,CAA4C;QAC7C,4EAA4E;QAC5E,4EAA4E;QAC5E,gBAAgB,EAAE,+BAA+B,CAAC,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,sEAAsE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO,wCAAwC,KAAK,CAAC,YAAY,oFAAoF,CAAC;IACxJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,kEAAkE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,oCAAoC,KAAK,CAAC,QAAQ,oFAAoF,CAAC;IAChJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACzC,OAAO,oCAAoC,iBAAiB,qGAAqG,CAAC;IACpK,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,KAAK,IAAI;QACvB,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,qEAAqE,CAAC;IAC/E,CAAC;IACD,IACE,KAAK,CAAC,SAAS,KAAK,IAAI;QACxB,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EACnC,CAAC;QACD,OAAO,sEAAsE,CAAC;IAChF,CAAC;IACD,IACE,KAAK,CAAC,WAAW,KAAK,IAAI;QAC1B,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EACrC,CAAC;QACD,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,4EAA4E;IAC5E,+DAA+D;IAC/D,OAAO,8BAA8B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,sDAAsD,CAAC;IAChE,CAAC;IACD,8EAA8E;IAC9E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,EAAE,CAAC;QACjE,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,OAAO,qDAAqD,GAAG,8BAA8B,CAAC;QAChG,CAAC;IACH,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CACtC,MAAiC,CAClC,EAAE,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,sBAAsB,IAAI,2BAA2B,CAAC;QAC/D,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,iBAAiB,IAAI,iCAAiC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,GAAG,GAA8B,CAAC;QAC7C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,OAAO,iBAAiB,IAAI,mCAAmC;gBAC7D,GAAG,oBAAoB;aACxB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC7C,CAAC;gBACD,OAAO,iBAAiB,IAAI,oCAAoC,CAAC;YACnE,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,iBAAiB,IAAI,0CAA0C,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACzE,OAAO,iBAAiB,IAAI,8BAA8B,CAAC;QAC7D,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,iBAAiB,IAAI,6BAA6B,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxE,OAAO,iBAAiB,IAAI,8BAA8B,CAAC;QAC7D,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,iBAAiB,IAAI,4BAA4B,CAAC;YAC3D,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnD,OAAO,iBAAiB,IAAI,oDAAoD,CAAC;gBACnF,CAAC;gBACD,WAAW,IAAI,CAAC,CAAC;gBACjB,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;oBACpB,OAAO,uEAAuE,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAW,EACX,MAAkC;IAElC,yEAAyE;IACzE,0EAA0E;IAC1E,0BAA0B,CACxB,MAAM,EACN,8BAA8B,EAC9B,6BAA6B,MAAM,EAAE,YAAY,IAAI,MAAM,EAAE,QAAQ,OAAO,EAC5E,MAAM,CACP,CAAC;IACF,MAAM,OAAO,GAAQ,mBAAmB,CACtC,8BAA8B,EAC9B,MAAM,EACN;QACE,iEAAiE;QACjE,iEAAiE;QACjE,gDAAgD;QAChD,MAAM,EAAE,CAAC,MAAW,EAAE,EAAE;YACtB,IAAI,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;YAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,OAAO,MAAM,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClC,CAAC;KACF,CACF,CAAC;IAEF,kEAAkE;IAClE,wEAAwE;IACxE,+DAA+D;IAC/D,OAAO,mBAAmB,CAAC;QACzB,sBAAsB,EAAE,OAAO;QAC/B,GAAG,+BAA+B,CAAC,MAAM,CAAC,gBAAgB,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,iFAAiF;AACjF,2CAA2C;AAC3C,kEAAkE;AAClE,6BAA6B;AAC7B,8EAA8E;AAE9E;;sDAEsD;AACtD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE5D;;;mFAGmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C;;;yDAGyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,IAAwB;IAExB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,aAAa,eAAe,sBAAsB,oBAAoB,UAC3E,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,SACvB,GAAG,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,aAAa,IAAI,6DAA6D,eAAe,GAAG,CAAC;IAC1G,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,cAAc,GAClB,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IACE,CAAC,cAAc;QACf,QAAQ,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EACvC,CAAC;QACD,OAAO,aAAa,IAAI,oDAAoD,qBAAqB,CAAC,IAAI,CACpG,GAAG,CACJ,QAAQ,eAAe,GAAG,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG;IACvB,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACtC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;CACxB,CAAC;AAkBX;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAa;IAEb,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC5B,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAmD;IAEnD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,0CAA0C,CAAC;IACpD,CAAC;IAED,SAAS;IACT,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;QACtD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,yDAAyD,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,qCAAqC,GAAG,kCAAkC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAED,UAAU;IACV,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAgC,CAAC;QACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,2DAA2D,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,mBAAmB,IAAI,gCAAgC,CAAC;YACjE,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,OAAO,mBAAmB,IAAI,mBAAmB,CAAC;YACpD,CAAC;YACD,MAAM,CAAC,GAAG,GAA8B,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,mBAAmB,IAAI,yBAAyB,GAAG,eAAe;wBACvE,GAAG,SAAS;qBACb,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;YACpE,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,OAAO,mBAAmB,IAAI,oDAAoD,CAAC;YACrF,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAc,CAAC,EAAE,CAAC;oBACzC,OAAO,mBAAmB,IAAI,WAAW,CAAC,CAAC,IAAI,2EAA2E,CAAC;gBAC7H,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAE,CAAC,CAAC,GAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClE,OAAO,mBAAmB,IAAI,uDAAuD,CAAC;gBACxF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kDAAkD;gBAClD,gEAAgE;gBAChE,mEAAmE;gBACnE,iDAAiD;gBACjD,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAkB,CAAC;gBACtC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,mBAAmB,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClD,CAAC;gBACD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,mBAAmB,IAAI,eAAe,QAAQ,mCAAmC,CAAC;gBAC3F,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChD,OAAO,mBAAmB,IAAI,oDAAoD,CAAC;YACrF,CAAC;YACD,MAAM,QAAQ,GAAG,oBAAoB,CACnC,CAAC,CAAC,UAAU,EACZ,mBAAmB,IAAI,GAAG,CAC3B,CAAC;YACF,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpE,OAAO,GAAG,OAAO,wBAAwB,QAAQ,sBAAsB,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,GAAG,OAAO,SAAS,GAAG,sHAAsH,CAAC;YACtJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAmB,EAAE,KAAa;IAC9D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC7C,CAAC;QACD,OAAO,GAAG,KAAK,0DAA0D,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,KAAK,iBAAiB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,GAAG,KAAK,sBAAsB,GAAG,2BAA2B,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAmD;IAEnD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,GAA4D,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAQ,EAAE,CAAC;IACzB,IAAI,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}