@actuate-media/cms-core 0.57.0 → 0.58.0

package/dist/api/routes/media.js

@@ -0,0 +1,521 @@
+import { optimizeImage, formatBytes } from '../../media/optimize.js';
+import { logEvent } from '../../security/audit.js';
+import { validateMimeType, checkMagicBytes } from '../../security/upload.js';
+import { sanitizeHtml } from '../../security/sanitize.js';
+import { guardedDb } from '../guarded-db.js';
+import { importBlobStorage, json, errorResponse, internalError, clampPageSize, normalizeMediaItem, buildMediaUsedOn, isAllowedStorageUrl, requireAuth, requireMediaScope, WRITE_ROLES, requireRole, uploadLimiter, checkRateLimitAsync, } from '../route-helpers.js';
+export function registerMediaRoutes(router) {
+    const db = guardedDb;
+    // ---------------------------------------------------------------------------
+    // Media routes
+    // ---------------------------------------------------------------------------
+    router.get('/media', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const url = new URL(request.url);
+            const page = Number(url.searchParams.get('page')) || 1;
+            const pageSize = clampPageSize(url.searchParams.get('pageSize'));
+            const skip = (page - 1) * pageSize;
+            const folderParam = url.searchParams.get('folderId');
+            const where = {};
+            if (folderParam === 'none') {
+                where.folderId = null;
+            }
+            else if (folderParam) {
+                where.folderId = folderParam;
+            }
+            const [items, total] = await Promise.all([
+                db().media.findMany({
+                    where,
+                    skip,
+                    take: pageSize,
+                    orderBy: { createdAt: 'desc' },
+                    include: {
+                        mediaUsages: {
+                            include: {
+                                document: { select: { id: true, collection: true, title: true, deletedAt: true } },
+                            },
+                        },
+                    },
+                }),
+                db().media.count({ where }),
+            ]);
+            const normalized = items.map((item) => {
+                const { mediaUsages, ...rest } = normalizeMediaItem(item);
+                return { ...rest, usedOn: buildMediaUsedOn(mediaUsages) };
+            });
+            return json({
+                data: {
+                    data: normalized,
+                    items: normalized,
+                    total,
+                    page,
+                    pageSize,
+                    totalPages: Math.ceil(total / pageSize),
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // The /media/presign endpoint returns advisory upload metadata; the actual
+    // upload still goes through /media/upload (which performs validation).
+    // Returning a presigned URL pointing at our own non-presigned endpoint was
+    // misleading, so we deprecated this in favour of just using /media/upload
+    // directly. We keep the route for backward compatibility but it now just
+    // returns a hint to use the upload endpoint.
+    router.post('/media/presign', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const scopeErr = requireMediaScope(auth.session);
+            if (scopeErr)
+                return scopeErr;
+            const body = (await request.json());
+            if (!body.filename || !body.contentType) {
+                return errorResponse('filename and contentType are required', 400);
+            }
+            return json({
+                data: {
+                    uploadUrl: '/api/cms/media/upload',
+                    method: 'POST',
+                    field: 'file',
+                    deprecated: true,
+                    message: 'Direct multipart upload to /media/upload is preferred; this endpoint will be removed in a future release.',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    const MAX_UPLOAD_BYTES = 50 * 1024 * 1024; // 50 MB
+    /**
+     * Allowlist of accepted upload mime types. Storing a file outside this set
+     * would let an attacker upload e.g. `.html`/`.js` and serve it from the same
+     * origin as the admin (cookie-leaking XSS), or `.svg` with embedded
+     * `<script>` (also XSS). Add to this list deliberately.
+     */
+    const ALLOWED_UPLOAD_MIME_TYPES = [
+        'image/jpeg',
+        'image/png',
+        'image/gif',
+        'image/webp',
+        'image/avif',
+        'image/svg+xml',
+        'application/pdf',
+        'video/mp4',
+        'video/webm',
+        'audio/mpeg',
+        'audio/ogg',
+        'audio/wav',
+    ];
+    router.post('/media/upload', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const scopeErr = requireMediaScope(auth.session);
+            if (scopeErr)
+                return scopeErr;
+            if (!(await checkRateLimitAsync(uploadLimiter, `upload:${auth.session.userId}`))) {
+                return errorResponse('Upload rate limit reached (20/hour). Try again later.', 429);
+            }
+            // Reject *before* buffering the body. We require a valid content-length
+            // header so that chunked / no-length requests (which would otherwise
+            // bypass this gate and allow `request.formData()` to buffer unbounded
+            // memory) are rejected up front. The multipart envelope is always
+            // larger than the underlying file, so checking against MAX_UPLOAD_BYTES
+            // here is a safe upper bound — a 50 MB file cannot fit inside a 50 MB
+            // request body.
+            const contentLengthHeader = request.headers.get('content-length');
+            if (!contentLengthHeader) {
+                return errorResponse('Content-Length header is required for uploads (chunked encoding is not supported)', 411);
+            }
+            const contentLength = parseInt(contentLengthHeader, 10);
+            if (!Number.isFinite(contentLength) || contentLength <= 0) {
+                return errorResponse('Invalid Content-Length header', 400);
+            }
+            if (contentLength > MAX_UPLOAD_BYTES) {
+                return errorResponse('File exceeds maximum size of 50MB', 413);
+            }
+            const formData = await request.formData();
+            const file = formData.get('file');
+            const skipOptimize = formData.get('skipOptimize') === 'true';
+            if (!file) {
+                return errorResponse('No file provided', 400);
+            }
+            const originalFilename = file.name;
+            const contentType = file.type;
+            const originalSize = file.size;
+            // Belt-and-braces: even with the header check above, re-validate the
+            // *actual* file size after parsing in case the multipart envelope
+            // disagreed with the header. This must come BEFORE any further
+            // processing (magic byte read, SVG sanitization, blob upload).
+            if (originalSize > MAX_UPLOAD_BYTES) {
+                return errorResponse('File exceeds maximum size of 50MB', 413);
+            }
+            // 1. Block file types that aren't on our allowlist outright.
+            if (!validateMimeType(contentType, ALLOWED_UPLOAD_MIME_TYPES)) {
+                return errorResponse(`Unsupported file type "${contentType || 'unknown'}". Allowed types: ${ALLOWED_UPLOAD_MIME_TYPES.join(', ')}`, 415);
+            }
+            const arrayBuffer = await file.arrayBuffer();
+            // 2. Verify the file's actual bytes match the claimed mime type. Without
+            // this, an attacker can upload a `.exe` with `Content-Type: image/png`
+            // and have it served from our origin.
+            const magicCheck = checkMagicBytes(arrayBuffer, contentType);
+            if (!magicCheck.valid) {
+                return errorResponse(`File contents do not match declared type "${contentType}".`, 415);
+            }
+            // 3. SVGs need an extra pass — even when the mime type is correct, the
+            // XML body can contain `<script>` or event-handler attributes that
+            // execute when an admin previews the file. Sanitize before storing.
+            let uploadBuffer;
+            let finalFilename = originalFilename;
+            let finalMimeType = contentType;
+            let finalSize = originalSize;
+            let width = null;
+            let height = null;
+            let blurHash = null;
+            let savings = 0;
+            if (contentType === 'image/svg+xml') {
+                // Strip <script>, on*, javascript: URLs, foreignObject, etc.
+                const xml = new TextDecoder('utf-8', { fatal: false }).decode(arrayBuffer);
+                const sanitized = sanitizeHtml(xml, {
+                    allowedTags: [
+                        'svg',
+                        'g',
+                        'path',
+                        'circle',
+                        'ellipse',
+                        'line',
+                        'polygon',
+                        'polyline',
+                        'rect',
+                        'text',
+                        'tspan',
+                        'defs',
+                        'use',
+                        'symbol',
+                        'title',
+                        'desc',
+                        'style',
+                        'linearGradient',
+                        'radialGradient',
+                        'stop',
+                        'mask',
+                        'clipPath',
+                        'pattern',
+                        'filter',
+                        'feGaussianBlur',
+                        'feColorMatrix',
+                        'feOffset',
+                        'feBlend',
+                        'feFlood',
+                        'feComposite',
+                        'feMerge',
+                        'feMergeNode',
+                    ],
+                    allowedAttributes: {
+                        '*': [
+                            'id',
+                            'class',
+                            'fill',
+                            'stroke',
+                            'stroke-width',
+                            'stroke-linecap',
+                            'stroke-linejoin',
+                            'opacity',
+                            'transform',
+                            'd',
+                            'cx',
+                            'cy',
+                            'r',
+                            'rx',
+                            'ry',
+                            'x',
+                            'y',
+                            'x1',
+                            'y1',
+                            'x2',
+                            'y2',
+                            'width',
+                            'height',
+                            'viewBox',
+                            'xmlns',
+                            'xmlns:xlink',
+                            'preserveAspectRatio',
+                            'points',
+                            'points',
+                            'offset',
+                            'stop-color',
+                            'stop-opacity',
+                            'gradientUnits',
+                            'gradientTransform',
+                            'href',
+                            'xlink:href',
+                            'fill-rule',
+                            'clip-rule',
+                            'mask',
+                            'clip-path',
+                            'filter',
+                            'patternUnits',
+                            'patternContentUnits',
+                            'in',
+                            'in2',
+                            'result',
+                            'mode',
+                            'values',
+                            'type',
+                            'stdDeviation',
+                            'dx',
+                            'dy',
+                        ],
+                    },
+                });
+                uploadBuffer = Buffer.from(sanitized, 'utf-8');
+                finalSize = uploadBuffer.byteLength;
+            }
+            else if (!skipOptimize && contentType.startsWith('image/')) {
+                const result = await optimizeImage(arrayBuffer, originalFilename, contentType);
+                uploadBuffer = result.buffer;
+                finalFilename = result.filename;
+                finalMimeType = result.mimeType;
+                finalSize = result.optimizedSize;
+                width = result.width || null;
+                height = result.height || null;
+                blurHash = result.blurHash ?? null;
+                savings = result.savings;
+            }
+            else {
+                uploadBuffer = Buffer.from(arrayBuffer);
+            }
+            const sanitizedName = finalFilename.replace(/[^a-zA-Z0-9._-]/g, '_');
+            const storageKey = `actuate/media/${Date.now()}-${sanitizedName}`;
+            let publicUrl = '';
+            // Prefer the configured platform storage adapter (e.g. platform-vercel,
+            // platform-aws, or a consumer-provided one). Falling through to
+            // @vercel/blob via dynamic import preserves the legacy behavior for
+            // installs that haven't wired up a platform package yet.
+            const { getStorageAdapter } = await import('../../storage/index.js');
+            const storage = getStorageAdapter();
+            if (storage) {
+                try {
+                    publicUrl = await storage.upload(storageKey, uploadBuffer, finalMimeType);
+                }
+                catch (err) {
+                    if (process.env.NODE_ENV !== 'test') {
+                        console.error('[Actuate CMS] Storage adapter upload failed:', err);
+                    }
+                    return errorResponse('Storage upload failed', 500);
+                }
+            }
+            else {
+                try {
+                    const blob = await importBlobStorage();
+                    const result = await blob.put(storageKey, uploadBuffer, {
+                        access: 'public',
+                        contentType: finalMimeType,
+                    });
+                    publicUrl = result.url;
+                }
+                catch {
+                    publicUrl = `/api/cms/media/file/${storageKey}`;
+                }
+            }
+            const media = await db().media.create({
+                data: {
+                    filename: finalFilename,
+                    storageKey: publicUrl || storageKey,
+                    mimeType: finalMimeType,
+                    fileSize: finalSize,
+                    width,
+                    height,
+                    blurHash,
+                    uploadedById: auth.session.userId,
+                },
+            });
+            await logEvent({
+                event: 'media_uploaded',
+                userId: auth.session.userId,
+                details: { mediaId: media.id, filename: finalFilename },
+            });
+            return json({
+                data: {
+                    ...media,
+                    optimization: {
+                        originalSize,
+                        optimizedSize: finalSize,
+                        savings,
+                        originalFormat: contentType,
+                        outputFormat: finalMimeType,
+                        originalSizeFormatted: formatBytes(originalSize),
+                        optimizedSizeFormatted: formatBytes(finalSize),
+                    },
+                },
+            }, 201);
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.post('/media/:id/optimize', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const media = await db().media.findUnique({ where: { id: params.id } });
+            if (!media)
+                return errorResponse('Media not found', 404);
+            if (!media.mimeType.startsWith('image/')) {
+                return errorResponse('Only images can be optimized', 400);
+            }
+            if (media.mimeType === 'image/webp') {
+                return json({
+                    data: { ...media, optimization: { alreadyOptimized: true, savings: 0 } },
+                });
+            }
+            if (!isAllowedStorageUrl(media.storageKey)) {
+                return errorResponse('Invalid media storage URL', 400);
+            }
+            let fileBuffer;
+            try {
+                const response = await fetch(media.storageKey);
+                if (!response.ok)
+                    throw new Error('Failed to fetch media file');
+                fileBuffer = Buffer.from(await response.arrayBuffer());
+            }
+            catch {
+                return errorResponse('Could not retrieve the original file for optimization', 500);
+            }
+            const result = await optimizeImage(fileBuffer, media.filename, media.mimeType);
+            if (result.savings <= 0) {
+                return json({
+                    data: { ...media, optimization: { alreadyOptimized: true, savings: 0 } },
+                });
+            }
+            // Upload the optimized version
+            const sanitizedName = result.filename.replace(/[^a-zA-Z0-9._-]/g, '_');
+            const newStorageKey = `actuate/media/${Date.now()}-${sanitizedName}`;
+            let newPublicUrl = '';
+            try {
+                const blob = await importBlobStorage();
+                const uploadResult = await blob.put(newStorageKey, result.buffer, {
+                    access: 'public',
+                    contentType: result.mimeType,
+                });
+                newPublicUrl = uploadResult.url;
+                // Delete the old blob
+                try {
+                    await blob.del(media.storageKey);
+                }
+                catch {
+                    /* best-effort */
+                }
+            }
+            catch {
+                newPublicUrl = `/api/cms/media/file/${newStorageKey}`;
+            }
+            const updated = await db().media.update({
+                where: { id: params.id },
+                data: {
+                    filename: result.filename,
+                    storageKey: newPublicUrl || newStorageKey,
+                    mimeType: result.mimeType,
+                    fileSize: result.optimizedSize,
+                    width: result.width || undefined,
+                    height: result.height || undefined,
+                    blurHash: result.blurHash ?? undefined,
+                },
+            });
+            return json({
+                data: {
+                    ...updated,
+                    optimization: {
+                        originalSize: result.originalSize,
+                        optimizedSize: result.optimizedSize,
+                        savings: result.savings,
+                        originalFormat: media.mimeType,
+                        outputFormat: result.mimeType,
+                        originalSizeFormatted: formatBytes(result.originalSize),
+                        optimizedSizeFormatted: formatBytes(result.optimizedSize),
+                    },
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.put('/media/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const scopeErr = requireMediaScope(auth.session);
+            if (scopeErr)
+                return scopeErr;
+            if (!auth.session.apiKey) {
+                const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+                if (roleErr)
+                    return roleErr;
+            }
+            const body = (await request.json());
+            const updated = await db().media.update({
+                where: { id: params.id },
+                data: {
+                    ...(body.alt !== undefined ? { altText: body.alt } : {}),
+                    ...(body.title !== undefined ? { title: body.title } : {}),
+                    ...(body.filename !== undefined ? { filename: body.filename } : {}),
+                    ...(body.focalX !== undefined ? { focalPointX: body.focalX } : {}),
+                    ...(body.focalY !== undefined ? { focalPointY: body.focalY } : {}),
+                },
+            });
+            return json({ data: updated });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    router.delete('/media/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const scopeErr = requireMediaScope(auth.session);
+            if (scopeErr)
+                return scopeErr;
+            if (!auth.session.apiKey) {
+                const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+                if (roleErr)
+                    return roleErr;
+            }
+            const media = await db().media.findUnique({ where: { id: params.id } });
+            if (!media) {
+                return errorResponse('Media not found', 404);
+            }
+            try {
+                const blob = await importBlobStorage();
+                await blob.del(media.storageKey);
+            }
+            catch {
+                // Storage delete failed or not available
+            }
+            await db().media.delete({ where: { id: params.id } });
+            await logEvent({
+                event: 'media_deleted',
+                userId: auth.session.userId,
+                details: { mediaId: params.id, filename: media.filename },
+            });
+            return json({ data: { success: true } });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+}
+//# sourceMappingURL=media.js.map

package/dist/api/routes/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../../../src/api/routes/media.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EACL,iBAAiB,EACjB,IAAI,EACJ,aAAa,EACb,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,aAAa,EACb,mBAAmB,GACpB,MAAM,qBAAqB,CAAA;AAE5B,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,EAAE,GAAG,SAAS,CAAA;IACpB,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YAEjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAA;YACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;YAChE,MAAM,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAA;YAClC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAEpD,MAAM,KAAK,GAA4B,EAAE,CAAA;YACzC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACvB,CAAC;iBAAM,IAAI,WAAW,EAAE,CAAC;gBACvB,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAA;YAC9B,CAAC;YAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACvC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAClB,KAAK;oBACL,IAAI;oBACJ,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;oBAC9B,OAAO,EAAE;wBACP,WAAW,EAAE;4BACX,OAAO,EAAE;gCACP,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;6BACnF;yBACF;qBACF;iBACF,CAAC;gBACF,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;aAC5B,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;gBACzC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAA4B,CAAA;gBACpF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAA;YAC3D,CAAC,CAAC,CAAA;YACF,OAAO,IAAI,CAAC;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,UAAU;oBACjB,KAAK;oBACL,IAAI;oBACJ,QAAQ;oBACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;iBACxC;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAgD,CAAA;YAClF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACxC,OAAO,aAAa,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAA;YACpE,CAAC;YACD,OAAO,IAAI,CAAC;gBACV,IAAI,EAAE;oBACJ,SAAS,EAAE,uBAAuB;oBAClC,MAAM,EAAE,MAAM;oBACd,KAAK,EAAE,MAAM;oBACb,UAAU,EAAE,IAAI;oBAChB,OAAO,EACL,2GAA2G;iBAC9G;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,QAAQ;IAElD;;;;;OAKG;IACH,MAAM,yBAAyB,GAAG;QAChC,YAAY;QACZ,WAAW;QACX,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,eAAe;QACf,iBAAiB;QACjB,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,WAAW;KACZ,CAAA;IAED,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAE7B,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;gBACjF,OAAO,aAAa,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAA;YACpF,CAAC;YAED,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,wEAAwE;YACxE,sEAAsE;YACtE,gBAAgB;YAChB,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACjE,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,OAAO,aAAa,CAClB,mFAAmF,EACnF,GAAG,CACJ,CAAA;YACH,CAAC;YACD,MAAM,aAAa,GAAG,QAAQ,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;gBAC1D,OAAO,aAAa,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAA;YAC5D,CAAC;YACD,IAAI,aAAa,GAAG,gBAAgB,EAAE,CAAC;gBACrC,OAAO,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAgB,CAAA;YAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM,CAAA;YAE5D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,aAAa,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAA;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAA;YAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAA;YAE9B,qEAAqE;YACrE,kEAAkE;YAClE,+DAA+D;YAC/D,+DAA+D;YAC/D,IAAI,YAAY,GAAG,gBAAgB,EAAE,CAAC;gBACpC,OAAO,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;YAChE,CAAC;YAED,6DAA6D;YAC7D,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,CAAC;gBAC9D,OAAO,aAAa,CAClB,0BAA0B,WAAW,IAAI,SAAS,qBAAqB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7G,GAAG,CACJ,CAAA;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;YAE5C,yEAAyE;YACzE,uEAAuE;YACvE,sCAAsC;YACtC,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;YAC5D,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,aAAa,CAAC,6CAA6C,WAAW,IAAI,EAAE,GAAG,CAAC,CAAA;YACzF,CAAC;YAED,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,IAAI,YAAoB,CAAA;YACxB,IAAI,aAAa,GAAG,gBAAgB,CAAA;YACpC,IAAI,aAAa,GAAG,WAAW,CAAA;YAC/B,IAAI,SAAS,GAAG,YAAY,CAAA;YAC5B,IAAI,KAAK,GAAkB,IAAI,CAAA;YAC/B,IAAI,MAAM,GAAkB,IAAI,CAAA;YAChC,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,OAAO,GAAG,CAAC,CAAA;YAEf,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;gBACpC,6DAA6D;gBAC7D,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;gBAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE;oBAClC,WAAW,EAAE;wBACX,KAAK;wBACL,GAAG;wBACH,MAAM;wBACN,QAAQ;wBACR,SAAS;wBACT,MAAM;wBACN,SAAS;wBACT,UAAU;wBACV,MAAM;wBACN,MAAM;wBACN,OAAO;wBACP,MAAM;wBACN,KAAK;wBACL,QAAQ;wBACR,OAAO;wBACP,MAAM;wBACN,OAAO;wBACP,gBAAgB;wBAChB,gBAAgB;wBAChB,MAAM;wBACN,MAAM;wBACN,UAAU;wBACV,SAAS;wBACT,QAAQ;wBACR,gBAAgB;wBAChB,eAAe;wBACf,UAAU;wBACV,SAAS;wBACT,SAAS;wBACT,aAAa;wBACb,SAAS;wBACT,aAAa;qBACd;oBACD,iBAAiB,EAAE;wBACjB,GAAG,EAAE;4BACH,IAAI;4BACJ,OAAO;4BACP,MAAM;4BACN,QAAQ;4BACR,cAAc;4BACd,gBAAgB;4BAChB,iBAAiB;4BACjB,SAAS;4BACT,WAAW;4BACX,GAAG;4BACH,IAAI;4BACJ,IAAI;4BACJ,GAAG;4BACH,IAAI;4BACJ,IAAI;4BACJ,GAAG;4BACH,GAAG;4BACH,IAAI;4BACJ,IAAI;4BACJ,IAAI;4BACJ,IAAI;4BACJ,OAAO;4BACP,QAAQ;4BACR,SAAS;4BACT,OAAO;4BACP,aAAa;4BACb,qBAAqB;4BACrB,QAAQ;4BACR,QAAQ;4BACR,QAAQ;4BACR,YAAY;4BACZ,cAAc;4BACd,eAAe;4BACf,mBAAmB;4BACnB,MAAM;4BACN,YAAY;4BACZ,WAAW;4BACX,WAAW;4BACX,MAAM;4BACN,WAAW;4BACX,QAAQ;4BACR,cAAc;4BACd,qBAAqB;4BACrB,IAAI;4BACJ,KAAK;4BACL,QAAQ;4BACR,MAAM;4BACN,QAAQ;4BACR,MAAM;4BACN,cAAc;4BACd,IAAI;4BACJ,IAAI;yBACL;qBACF;iBACF,CAAC,CAAA;gBACF,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;gBAC9C,SAAS,GAAG,YAAY,CAAC,UAAU,CAAA;YACrC,CAAC;iBAAM,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAA;gBAC9E,YAAY,GAAG,MAAM,CAAC,MAAM,CAAA;gBAC5B,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAA;gBAC/B,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAA;gBAC/B,SAAS,GAAG,MAAM,CAAC,aAAa,CAAA;gBAChC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAA;gBAC5B,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAA;gBAC9B,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAA;gBAClC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;YAC1B,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACzC,CAAC;YAED,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;YACpE,MAAM,UAAU,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,IAAI,aAAa,EAAE,CAAA;YAEjE,IAAI,SAAS,GAAG,EAAE,CAAA;YAClB,wEAAwE;YACxE,gEAAgE;YAChE,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAA;YACpE,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAA;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;gBAC3E,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;wBACpC,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAA;oBACpE,CAAC;oBACD,OAAO,aAAa,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;gBACpD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;oBACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE;wBACtD,MAAM,EAAE,QAAQ;wBAChB,WAAW,EAAE,aAAa;qBAC3B,CAAC,CAAA;oBACF,SAAS,GAAG,MAAM,CAAC,GAAG,CAAA;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,GAAG,uBAAuB,UAAU,EAAE,CAAA;gBACjD,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpC,IAAI,EAAE;oBACJ,QAAQ,EAAE,aAAa;oBACvB,UAAU,EAAE,SAAS,IAAI,UAAU;oBACnC,QAAQ,EAAE,aAAa;oBACvB,QAAQ,EAAE,SAAS;oBACnB,KAAK;oBACL,MAAM;oBACN,QAAQ;oBACR,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;iBAClC;aACF,CAAC,CAAA;YAEF,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,gBAAgB;gBACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;aACxD,CAAC,CAAA;YAEF,OAAO,IAAI,CACT;gBACE,IAAI,EAAE;oBACJ,GAAG,KAAK;oBACR,YAAY,EAAE;wBACZ,YAAY;wBACZ,aAAa,EAAE,SAAS;wBACxB,OAAO;wBACP,cAAc,EAAE,WAAW;wBAC3B,YAAY,EAAE,aAAa;wBAC3B,qBAAqB,EAAE,WAAW,CAAC,YAAY,CAAC;wBAChD,sBAAsB,EAAE,WAAW,CAAC,SAAS,CAAC;qBAC/C;iBACF;aACF,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YAEjC,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC,KAAK;gBAAE,OAAO,aAAa,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAExD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO,aAAa,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC3D,CAAC;YAED,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;oBACV,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;iBACzE,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3C,OAAO,aAAa,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;gBAC/D,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,aAAa,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAA;YACpF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;YAE9E,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;oBACV,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;iBACzE,CAAC,CAAA;YACJ,CAAC;YAED,+BAA+B;YAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;YACtE,MAAM,aAAa,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,IAAI,aAAa,EAAE,CAAA;YACpE,IAAI,YAAY,GAAG,EAAE,CAAA;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;gBACtC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE;oBAChE,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,MAAM,CAAC,QAAQ;iBAC7B,CAAC,CAAA;gBACF,YAAY,GAAG,YAAY,CAAC,GAAG,CAAA;gBAE/B,sBAAsB;gBACtB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,GAAG,uBAAuB,aAAa,EAAE,CAAA;YACvD,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBACtC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE;gBACzB,IAAI,EAAE;oBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,YAAY,IAAI,aAAa;oBACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,aAAa;oBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;oBAChC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;oBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;iBACvC;aACF,CAAC,CAAA;YAEF,OAAO,IAAI,CAAC;gBACV,IAAI,EAAE;oBACJ,GAAG,OAAO;oBACV,YAAY,EAAE;wBACZ,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;wBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,cAAc,EAAE,KAAK,CAAC,QAAQ;wBAC9B,YAAY,EAAE,MAAM,CAAC,QAAQ;wBAC7B,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC;wBACvD,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC;qBAC1D;iBACF;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;gBAC3D,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAA;YAC7B,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAMjC,CAAA;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBACtC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE;gBACzB,IAAI,EAAE;oBACJ,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnE;aACF,CAAC,CAAA;YAEF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAC7B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;gBAC3D,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAA;YAC7B,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,aAAa,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAA;YAC9C,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;gBACtC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;YAC3C,CAAC;YAED,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,EAAE,CAAC,CAAA;YAEtD,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,eAAe;gBACtB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;aAC1D,CAAC,CAAA;YAEF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/routes/meta.d.ts

@@ -0,0 +1,3 @@
+import type { ApiRouter } from '../router.js';
+export declare function registerMetaRoutes(router: ApiRouter): void;
+//# sourceMappingURL=meta.d.ts.map

package/dist/api/routes/meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../../src/api/routes/meta.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAO7C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA4F1D"}

package/dist/api/routes/meta.js

@@ -0,0 +1,96 @@
+import { summarizeCollectionFields } from '../collection-introspection.js';
+import { generateToken as generateCsrfToken } from '../../security/csrf.js';
+import { generateOpenAPISpec } from '../openapi.js';
+import { getActuateConfig } from '../../config/runtime.js';
+import { json, errorResponse } from '../route-helpers.js';
+export function registerMetaRoutes(router) {
+    // ---------------------------------------------------------------------------
+    // CSRF token endpoint
+    // ---------------------------------------------------------------------------
+    router.get('/auth/csrf', async () => {
+        const token = await generateCsrfToken();
+        const isProduction = process.env.NODE_ENV === 'production';
+        const cookieFlags = [`actuate_csrf=${token}`, 'Path=/', 'SameSite=Lax', 'Max-Age=86400'];
+        if (isProduction)
+            cookieFlags.push('Secure');
+        const response = json({ data: { token } });
+        response.headers.set('Set-Cookie', cookieFlags.join('; '));
+        return response;
+    });
+    // ---------------------------------------------------------------------------
+    // OpenAPI spec
+    // ---------------------------------------------------------------------------
+    router.get('/openapi.json', async () => {
+        const config = getActuateConfig();
+        if (!config)
+            return errorResponse('CMS not configured', 500);
+        const spec = generateOpenAPISpec(config);
+        return new Response(JSON.stringify(spec, null, 2), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
+        });
+    });
+    // ---------------------------------------------------------------------------
+    // Collection discovery (Phase 7 PR F)
+    //
+    // Lightweight enumeration sourced directly from `getActuateConfig()` so
+    // agents and the MCP server's `list_collections` tool don't depend on
+    // OpenAPI spec generation succeeding. OpenAPI is still the source of
+    // truth for full per-field JSON Schemas; this endpoint trades depth
+    // for reliability and surfaces just enough metadata for the agent to
+    // plan a follow-up call (create_document, list_documents, etc.).
+    //
+    // Auth: unauthenticated, like /openapi.json — the response contains
+    // only schema-shape metadata that is already public via OpenAPI.
+    // ---------------------------------------------------------------------------
+    router.get('/collections', async () => {
+        const config = getActuateConfig();
+        if (!config)
+            return errorResponse('CMS not configured', 500);
+        const collections = Object.entries(config.collections ?? {}).map(([slug, def]) => {
+            // Reduce each field to `{ name, type, required }` plus, where present,
+            // the relationship target, select options, and (for `array`/`blocks`)
+            // the nested subfield schema — enough for the agent to plan a deep
+            // create/update AND resolve relationship fields (WS-B4 + WS-C C2)
+            // without sending the full validator. See collection-introspection.ts.
+            const fieldSummary = summarizeCollectionFields(def?.fields);
+            return {
+                slug,
+                labels: def?.labels ?? { singular: slug, plural: slug },
+                type: def?.type ?? 'page',
+                urlPrefix: def?.urlPrefix ?? slug,
+                hidden: def?.admin?.hidden === true,
+                // Surface the admin metadata the Posts area needs to render
+                // type tabs / cards (description, icon, accent color, group).
+                // None are sensitive — they all already live on the public
+                // collection definition the admin client receives via props.
+                description: def?.admin?.description ?? null,
+                icon: def?.admin?.icon ?? null,
+                color: def?.admin?.color ?? null,
+                group: def?.admin?.group ?? null,
+                fieldCount: fieldSummary.length,
+                fields: fieldSummary,
+            };
+        });
+        return json({ data: collections });
+    });
+    router.get('/docs', async () => {
+        const html = `<!DOCTYPE html>
+<html>
+<head>
+  <title>Actuate CMS API Reference</title>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+</head>
+<body>
+  <script id="api-reference" data-url="/api/cms/openapi.json"></script>
+  <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
+</body>
+</html>`;
+        return new Response(html, {
+            status: 200,
+            headers: { 'Content-Type': 'text/html; charset=utf-8' },
+        });
+    });
+}
+//# sourceMappingURL=meta.js.map

package/dist/api/routes/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/api/routes/meta.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEzD,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,8EAA8E;IAC9E,sBAAsB;IACtB,8EAA8E;IAE9E,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACvC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;QAC1D,MAAM,WAAW,GAAG,CAAC,gBAAgB,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,CAAC,CAAA;QACxF,IAAI,YAAY;YAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC1C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC5D,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;QACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACjD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,GAAG,EAAE;SACpF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,sCAAsC;IACtC,EAAE;IACF,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,iEAAiE;IACjE,EAAE;IACF,oEAAoE;IACpE,iEAAiE;IACjE,8EAA8E;IAE9E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;YAC/E,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,kEAAkE;YAClE,uEAAuE;YACvE,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC3D,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;gBACvD,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,MAAM;gBACzB,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;gBACjC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI;gBACnC,4DAA4D;gBAC5D,8DAA8D;gBAC9D,2DAA2D;gBAC3D,6DAA6D;gBAC7D,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,IAAI,IAAI;gBAC5C,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI;gBAC9B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI;gBAChC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI;gBAChC,UAAU,EAAE,YAAY,CAAC,MAAM;gBAC/B,MAAM,EAAE,YAAY;aACrB,CAAA;QACH,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QAC7B,MAAM,IAAI,GAAG;;;;;;;;;;;QAWT,CAAA;QACJ,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/routes/page-templates.d.ts

@@ -0,0 +1,3 @@
+import type { ApiRouter } from '../router.js';
+export declare function registerPageTemplateRoutes(router: ApiRouter): void;
+//# sourceMappingURL=page-templates.d.ts.map