@elytracms/studio 0.0.56 → 0.0.58

package/dist/lib/ai/route.js

@@ -1,29 +1,10 @@
+import { chatToolDefinitions } from './tools.js';
 function jsonResponse(value, status) {
     return new Response(JSON.stringify(value), {
         status,
         headers: { 'content-type': 'application/json' },
     });
 }
-function isChatMessage(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const m = value;
-    return ((m.role === 'system' || m.role === 'user' || m.role === 'assistant') &&
-        typeof m.content === 'string');
-}
-/** Parse a request body into a {@link StreamChatRequest}, or `null` when malformed. */
-function parseChatBody(body) {
-    if (typeof body !== 'object' || body === null)
-        return null;
-    const { messages, system } = body;
-    if (!Array.isArray(messages) || messages.length === 0 || !messages.every(isChatMessage)) {
-        return null;
-    }
-    return {
-        messages: messages,
-        ...(typeof system === 'string' ? { system } : {}),
-    };
-}
 /** Structurally validate a {@link GenerateStructuredRequest}, or `null` when malformed. */
 function parseGenerateBody(body) {
     if (typeof body !== 'object' || body === null)
@@ -36,22 +17,34 @@ function parseGenerateBody(body) {
         return null;
     return request;
 }
-/** The `kind` a body selects: explicit `kind`, else `messages` ⇒ chat (back-compat). */
-function bodyKind(body) {
-    if (typeof body !== 'object' || body === null)
-        return null;
-    const kind = body.kind;
-    if (kind === 'chat' || kind === 'generate')
-        return kind;
-    if (Array.isArray(body.messages))
-        return 'chat';
-    return null;
+/**
+ * Fold the request-body `context` into the system prompt (EC-334). The client sends
+ * `context` as one string or ordered string sections (collections-catalog summary,
+ * client-resolved knowledge, EC-378's current-document block) — the route only
+ * ASSEMBLES them; it resolves no data itself (zero-data-access proxy). Malformed
+ * context is a structural 400, never silently dropped (validation-first).
+ */
+export function assembleSystemPrompt(context) {
+    if (context === undefined || context === null)
+        return { ok: true };
+    const sections = typeof context === 'string'
+        ? [context]
+        : Array.isArray(context) && context.every((section) => typeof section === 'string')
+            ? context
+            : null;
+    if (sections === null)
+        return { ok: false };
+    const system = sections
+        .map((section) => section.trim())
+        .filter((section) => section.length > 0)
+        .join('\n\n');
+    return { ok: true, ...(system.length > 0 ? { system } : {}) };
 }
 /**
  * Build the mounted route handler. The returned function is a plain
  * `(Request) => Promise<Response>` — session-gated, soft-rate-limited, and a thin
- * proxy to `provider.streamChat`. Never throws to the caller: every failure is a
- * structured JSON response with an appropriate status.
+ * proxy to the provider. Never throws to the caller: every failure is a structured
+ * JSON response with an appropriate status.
  */
 export function createAiRouteHandler(options) {
     const maxPerMinute = options.limits?.maxRequestsPerMinute;
@@ -71,6 +64,7 @@ export function createAiRouteHandler(options) {
     }
     return async (request) => {
         // 1. Session gate — reject anonymous callers (the route holds spend, not data).
+        //    Position is FROZEN: the 401 must precede any stream byte (EC-371/EC-334).
         let session;
         try {
             session = await options.getSession(request);
@@ -94,10 +88,12 @@ export function createAiRouteHandler(options) {
         catch {
             return jsonResponse({ error: 'invalid-json' }, 400);
         }
-        const kind = bodyKind(body);
+        if (typeof body !== 'object' || body === null) {
+            return jsonResponse({ error: 'invalid-json' }, 400);
+        }
         // 5a. Structured generation — the thin proxy that lets `applyContentWithShape`
         //     run client-side without the key ever reaching the browser.
-        if (kind === 'generate') {
+        if (body.kind === 'generate') {
             const generate = parseGenerateBody(body);
             if (!generate) {
                 return jsonResponse({ error: 'invalid-request', message: 'expected { kind: "generate", request }' }, 400);
@@ -110,16 +106,49 @@ export function createAiRouteHandler(options) {
                 return jsonResponse({ error: 'provider-error' }, 502);
             }
         }
-        // 5b. Chat stream (default / back-compat).
-        const chat = kind === 'chat' ? parseChatBody(body) : null;
-        if (!chat) {
-            return jsonResponse({ error: 'invalid-request', message: 'expected { messages: AiChatMessage[] }' }, 400);
+        // 5b. Native chat branch (EC-334): `{ messages: UIMessage[], context? }`.
+        const rawMessages = body.messages;
+        if (!Array.isArray(rawMessages) || rawMessages.length === 0) {
+            return jsonResponse({
+                error: 'invalid-request',
+                message: 'expected { kind: "generate", request } or { messages: UIMessage[] }',
+            }, 400);
+        }
+        const assembled = assembleSystemPrompt(body.context);
+        if (!assembled.ok) {
+            return jsonResponse({ error: 'invalid-request', message: 'context must be a string or string[]' }, 400);
         }
-        if (!options.provider.streamChat) {
+        if (!options.provider.languageModel) {
             return jsonResponse({ error: 'provider-cannot-stream' }, 501);
         }
+        // The SDK loads lazily INSIDE the handler (the anthropic-provider discipline):
+        // the client-imported barrel re-exports this module, and a static edge would
+        // put the AI SDK on the studio critical path (pinned in bundle.test.ts).
+        const { validateUIMessages, convertToModelMessages, streamText, createUIMessageStreamResponse, toUIMessageStream, } = await import('ai');
+        // Structural UIMessage validation (id/role/parts). Tool parts validate by
+        // shape — deep input validation belongs to the client executor (slice 2).
+        let messages;
+        try {
+            messages = await validateUIMessages({ messages: rawMessages });
+        }
+        catch {
+            return jsonResponse({ error: 'invalid-request', message: 'expected { messages: UIMessage[] }' }, 400);
+        }
         try {
-            return await options.provider.streamChat(chat);
+            const model = await options.provider.languageModel();
+            const result = streamText({
+                model,
+                ...(assembled.system !== undefined ? { system: assembled.system } : {}),
+                messages: await convertToModelMessages(messages),
+                // No `execute` on any tool — the SDK forwards each call to the client
+                // (ratified trust boundary). Continuation is therefore client-driven: one
+                // tool round-trip per REQUEST, throttled by the rate limit above; the
+                // per-turn step cap lands client-side with slice 2.
+                tools: chatToolDefinitions,
+            });
+            return createUIMessageStreamResponse({
+                stream: toUIMessageStream({ stream: result.stream, originalMessages: messages }),
+            });
         }
         catch {
             return jsonResponse({ error: 'provider-error' }, 502);

package/dist/lib/ai/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../src/lib/ai/route.ts"],"names":[],"mappings":"AAmCA,SAAS,YAAY,CAAC,KAAc,EAAE,MAAc;IAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAA8C,CAAA;IACxD,OAAO,CACL,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;QACpE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAC9B,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAgD,CAAA;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,QAA2B;QACrC,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAA;AACH,CAAC;AAKD,2FAA2F;AAC3F,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAA;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAiD,CAAA;IAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5F,OAAO,OAAoC,CAAA;AAC7C,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAA;IAC9C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACvD,IAAI,KAAK,CAAC,OAAO,CAAE,IAA+B,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAA;IAC3E,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IAEzD,SAAS,WAAW,CAAC,GAAW;QAC9B,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,CAAC,KAAK,IAAI,CAAC,CAAA;QACjB,OAAO,MAAM,CAAC,KAAK,GAAG,YAAY,CAAA;IACpC,CAAC;IAED,OAAO,KAAK,EAAE,OAAgB,EAAqB,EAAE;QACnD,gFAAgF;QAChF,IAAI,OAAyB,CAAA;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAEjE,aAAa;QACb,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QAExF,4CAA4C;QAC5C,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAEzF,2CAA2C;QAC3C,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAE3B,+EAA+E;QAC/E,iEAAiE;QACjE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAC/E,GAAG,CACJ,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBAClE,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;YACvD,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAC/E,GAAG,CACJ,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;IACH,CAAC,CAAA;AACH,CAAC","sourcesContent":["/**\n * Server-route factory (EC-331): a streaming chat/completion endpoint the consuming\n * studio app mounts. Key custody = host route (never the browser, never Convex): the\n * `provider` holds the host-env key and this handler is a THIN model proxy — NO data\n * access, NO service credentials.\n *\n * Framework-agnostic on purpose: it returns a Web `Request → Response` handler the\n * host wires into whatever server entry it has (a TanStack Start server route, a\n * Convex `httpAction`, a plain fetch handler). The current demo studio builds as a\n * pure client SPA with server functions disabled (EC-234), so actually mounting this\n * is an EC-199 integration step; phase 1 ships the handler + its contract.\n *\n * Session-gated: `getSession` (host-wired, reading its own auth — this module never\n * touches `lib/auth`) must return a session for authenticated callers; anonymous\n * callers are rejected. Plus a soft, in-memory per-project rate counter (spend guard).\n *\n * EC-199: the route serves TWO model operations — both thin proxies, neither with any\n * data access — discriminated by the request body's `kind`:\n *   - `{ kind: 'chat', messages, system? }`  → `provider.streamChat` (text stream);\n *   - `{ kind: 'generate', request }`         → `provider.generateStructured` (JSON).\n * The structured mode is what lets `applyContentWithShape` run CLIENT-side against a\n * {@link createRouteProvider} whose key never touches the browser — the creation flow's\n * whole authoring loop proxies its model calls here while the tools (search/list/apply)\n * execute in the client with the user's own session. A body with `messages` and no\n * `kind` is still treated as a chat request (back-compat with the phase-1 contract).\n */\nimport type {\n  AiChatMessage,\n  AiRouteHandler,\n  AiRouteHandlerOptions,\n  AiSession,\n  GenerateStructuredRequest,\n  StreamChatRequest,\n} from './types'\n\nfunction jsonResponse(value: unknown, status: number): Response {\n  return new Response(JSON.stringify(value), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\ninterface RateBucket {\n  windowStart: number\n  count: number\n}\n\nfunction isChatMessage(value: unknown): value is AiChatMessage {\n  if (typeof value !== 'object' || value === null) return false\n  const m = value as { role?: unknown; content?: unknown }\n  return (\n    (m.role === 'system' || m.role === 'user' || m.role === 'assistant') &&\n    typeof m.content === 'string'\n  )\n}\n\n/** Parse a request body into a {@link StreamChatRequest}, or `null` when malformed. */\nfunction parseChatBody(body: unknown): StreamChatRequest | null {\n  if (typeof body !== 'object' || body === null) return null\n  const { messages, system } = body as { messages?: unknown; system?: unknown }\n  if (!Array.isArray(messages) || messages.length === 0 || !messages.every(isChatMessage)) {\n    return null\n  }\n  return {\n    messages: messages as AiChatMessage[],\n    ...(typeof system === 'string' ? { system } : {}),\n  }\n}\n\n/** The wire discriminator selecting which model operation the route proxies. */\nexport type AiRouteKind = 'chat' | 'generate'\n\n/** Structurally validate a {@link GenerateStructuredRequest}, or `null` when malformed. */\nfunction parseGenerateBody(body: unknown): GenerateStructuredRequest | null {\n  if (typeof body !== 'object' || body === null) return null\n  const request = (body as { request?: unknown }).request\n  if (typeof request !== 'object' || request === null) return null\n  const { prompt, schema } = request as { prompt?: unknown; schema?: unknown }\n  if (typeof prompt !== 'string' || typeof schema !== 'object' || schema === null) return null\n  return request as GenerateStructuredRequest\n}\n\n/** The `kind` a body selects: explicit `kind`, else `messages` ⇒ chat (back-compat). */\nfunction bodyKind(body: unknown): AiRouteKind | null {\n  if (typeof body !== 'object' || body === null) return null\n  const kind = (body as { kind?: unknown }).kind\n  if (kind === 'chat' || kind === 'generate') return kind\n  if (Array.isArray((body as { messages?: unknown }).messages)) return 'chat'\n  return null\n}\n\n/**\n * Build the mounted route handler. The returned function is a plain\n * `(Request) => Promise<Response>` — session-gated, soft-rate-limited, and a thin\n * proxy to `provider.streamChat`. Never throws to the caller: every failure is a\n * structured JSON response with an appropriate status.\n */\nexport function createAiRouteHandler(options: AiRouteHandlerOptions): AiRouteHandler {\n  const maxPerMinute = options.limits?.maxRequestsPerMinute\n  const buckets = new Map<string, RateBucket>()\n  const projectKey = options.projectKey ?? (() => 'global')\n\n  function rateLimited(key: string): boolean {\n    if (maxPerMinute === undefined || maxPerMinute <= 0) return false\n    const now = Date.now()\n    const bucket = buckets.get(key)\n    if (!bucket || now - bucket.windowStart >= 60_000) {\n      buckets.set(key, { windowStart: now, count: 1 })\n      return false\n    }\n    bucket.count += 1\n    return bucket.count > maxPerMinute\n  }\n\n  return async (request: Request): Promise<Response> => {\n    // 1. Session gate — reject anonymous callers (the route holds spend, not data).\n    let session: AiSession | null\n    try {\n      session = await options.getSession(request)\n    } catch {\n      return jsonResponse({ error: 'unauthorized' }, 401)\n    }\n    if (!session) return jsonResponse({ error: 'unauthorized' }, 401)\n\n    // 2. Method.\n    if (request.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405)\n\n    // 3. Soft per-project rate / spend counter.\n    if (rateLimited(projectKey(request))) return jsonResponse({ error: 'rate-limited' }, 429)\n\n    // 4. Body → the requested model operation.\n    let body: unknown\n    try {\n      body = await request.json()\n    } catch {\n      return jsonResponse({ error: 'invalid-json' }, 400)\n    }\n\n    const kind = bodyKind(body)\n\n    // 5a. Structured generation — the thin proxy that lets `applyContentWithShape`\n    //     run client-side without the key ever reaching the browser.\n    if (kind === 'generate') {\n      const generate = parseGenerateBody(body)\n      if (!generate) {\n        return jsonResponse(\n          { error: 'invalid-request', message: 'expected { kind: \"generate\", request }' },\n          400,\n        )\n      }\n      try {\n        const result = await options.provider.generateStructured(generate)\n        return jsonResponse(result, 200)\n      } catch {\n        return jsonResponse({ error: 'provider-error' }, 502)\n      }\n    }\n\n    // 5b. Chat stream (default / back-compat).\n    const chat = kind === 'chat' ? parseChatBody(body) : null\n    if (!chat) {\n      return jsonResponse(\n        { error: 'invalid-request', message: 'expected { messages: AiChatMessage[] }' },\n        400,\n      )\n    }\n    if (!options.provider.streamChat) {\n      return jsonResponse({ error: 'provider-cannot-stream' }, 501)\n    }\n    try {\n      return await options.provider.streamChat(chat)\n    } catch {\n      return jsonResponse({ error: 'provider-error' }, 502)\n    }\n  }\n}\n"]}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../src/lib/ai/route.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAE7C,SAAS,YAAY,CAAC,KAAc,EAAE,MAAc;IAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAcD,2FAA2F;AAC3F,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAA;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAiD,CAAA;IAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC5F,OAAO,OAAoC,CAAA;AAC7C,CAAC;AAKD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAClE,MAAM,QAAQ,GACZ,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,CAAC,OAAO,CAAC;QACX,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC;YACjF,CAAC,CAAE,OAAoB;YACvB,CAAC,CAAC,IAAI,CAAA;IACZ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IAC3C,MAAM,MAAM,GAAG,QAAQ;SACpB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;SAChC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,IAAI,CAAC,MAAM,CAAC,CAAA;IACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IAEzD,SAAS,WAAW,CAAC,GAAW;QAC9B,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,CAAC,KAAK,IAAI,CAAC,CAAA;QACjB,OAAO,MAAM,CAAC,KAAK,GAAG,YAAY,CAAA;IACpC,CAAC;IAED,OAAO,KAAK,EAAE,OAAgB,EAAqB,EAAE;QACnD,gFAAgF;QAChF,+EAA+E;QAC/E,IAAI,OAAyB,CAAA;QAC7B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAEjE,aAAa;QACb,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QAExF,4CAA4C;QAC5C,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAEzF,2CAA2C;QAC3C,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QAED,+EAA+E;QAC/E,iEAAiE;QACjE,IAAK,IAA2B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAC/E,GAAG,CACJ,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBAClE,OAAO,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;YACvD,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,MAAM,WAAW,GAAI,IAA+B,CAAC,QAAQ,CAAA;QAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,YAAY,CACjB;gBACE,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,qEAAqE;aAC/E,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QAED,MAAM,SAAS,GAAG,oBAAoB,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAA;QAC/E,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAC7E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QAED,+EAA+E;QAC/E,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,EACJ,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,6BAA6B,EAC7B,iBAAiB,GAClB,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QAEtB,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,QAAQ,CAAA;QACZ,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAC3E,GAAG,CACJ,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAA;YACpD,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,KAAK;gBACL,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,QAAQ,EAAE,MAAM,sBAAsB,CAAC,QAAQ,CAAC;gBAChD,sEAAsE;gBACtE,0EAA0E;gBAC1E,sEAAsE;gBACtE,oDAAoD;gBACpD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAA;YACF,OAAO,6BAA6B,CAAC;gBACnC,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;aACjF,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;IACH,CAAC,CAAA;AACH,CAAC","sourcesContent":["/**\n * Server-route factory (EC-331): the session-gated endpoint the consuming studio\n * app mounts. Key custody = host route (never the browser, never Convex): the\n * `provider` holds the host-env key and this handler is a THIN model proxy — NO data\n * access, NO service credentials, NO server-side tool execution.\n *\n * Framework-agnostic on purpose: it returns a Web `Request → Response` handler the\n * host wires into whatever server entry it has (`createAiDevPlugin` in dev,\n * `toNodeHandler` on a Vercel Node function, any fetch handler).\n *\n * Session-gated: `getSession` (host-wired, reading its own auth — this module never\n * touches `lib/auth`) must return a session for authenticated callers; anonymous\n * callers are rejected with 401 BEFORE any stream byte. Plus a soft, in-memory\n * per-project rate counter (spend guard) — also the backstop for the SDK's\n * client-driven tool-call continuations, each of which is a fresh request here.\n *\n * The route serves TWO model operations — both thin proxies, neither with any data\n * access:\n *   - `{ kind: 'generate', request }` → `provider.generateStructured` (JSON) — the\n *     proxy `applyContentWithShape` / `translateDocument` run CLIENT-side against,\n *     so the key never touches the browser;\n *   - `{ messages: UIMessage[], context? }` (EC-334, kind-less — the shape the AI\n *     SDK's `DefaultChatTransport` posts) → the SDK's native streaming chat\n *     protocol: `validateUIMessages` → `streamText` over\n *     `provider.languageModel()` with {@link chatToolDefinitions} declared WITHOUT\n *     `execute` (every tool call forwards to the client, which executes it against\n *     the operations layer with the user's own session) →\n *     `createUIMessageStreamResponse` + `toUIMessageStream` (the non-deprecated\n *     pair — `result.toUIMessageStreamResponse()` dies in SDK v8). The `system`\n *     prompt is assembled from the request's `context` sections; conversation\n *     history rides natively in `messages`.\n *\n * BREAKING (EC-334, ratified): the legacy `{ kind: 'chat', messages:\n * AiChatMessage[] }` wire is gone — route factory and client ship lockstep in\n * `@elytracms/studio`, so consumers re-mount the same factory on upgrade.\n */\nimport type { AiRouteHandler, AiRouteHandlerOptions, AiSession, GenerateStructuredRequest } from './types'\nimport { chatToolDefinitions } from './tools'\n\nfunction jsonResponse(value: unknown, status: number): Response {\n  return new Response(JSON.stringify(value), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\ninterface RateBucket {\n  windowStart: number\n  count: number\n}\n\n/**\n * The wire discriminator for the structured-generation branch. The native chat\n * branch (EC-334) is deliberately kind-less: the SDK's `DefaultChatTransport`\n * posts `{ messages, … }` with no `kind`.\n */\nexport type AiRouteKind = 'generate'\n\n/** Structurally validate a {@link GenerateStructuredRequest}, or `null` when malformed. */\nfunction parseGenerateBody(body: unknown): GenerateStructuredRequest | null {\n  if (typeof body !== 'object' || body === null) return null\n  const request = (body as { request?: unknown }).request\n  if (typeof request !== 'object' || request === null) return null\n  const { prompt, schema } = request as { prompt?: unknown; schema?: unknown }\n  if (typeof prompt !== 'string' || typeof schema !== 'object' || schema === null) return null\n  return request as GenerateStructuredRequest\n}\n\n/** The outcome of folding the request `context` into a system prompt. */\nexport type AssembledSystem = { ok: true; system?: string } | { ok: false }\n\n/**\n * Fold the request-body `context` into the system prompt (EC-334). The client sends\n * `context` as one string or ordered string sections (collections-catalog summary,\n * client-resolved knowledge, EC-378's current-document block) — the route only\n * ASSEMBLES them; it resolves no data itself (zero-data-access proxy). Malformed\n * context is a structural 400, never silently dropped (validation-first).\n */\nexport function assembleSystemPrompt(context: unknown): AssembledSystem {\n  if (context === undefined || context === null) return { ok: true }\n  const sections =\n    typeof context === 'string'\n      ? [context]\n      : Array.isArray(context) && context.every((section) => typeof section === 'string')\n        ? (context as string[])\n        : null\n  if (sections === null) return { ok: false }\n  const system = sections\n    .map((section) => section.trim())\n    .filter((section) => section.length > 0)\n    .join('\\n\\n')\n  return { ok: true, ...(system.length > 0 ? { system } : {}) }\n}\n\n/**\n * Build the mounted route handler. The returned function is a plain\n * `(Request) => Promise<Response>` — session-gated, soft-rate-limited, and a thin\n * proxy to the provider. Never throws to the caller: every failure is a structured\n * JSON response with an appropriate status.\n */\nexport function createAiRouteHandler(options: AiRouteHandlerOptions): AiRouteHandler {\n  const maxPerMinute = options.limits?.maxRequestsPerMinute\n  const buckets = new Map<string, RateBucket>()\n  const projectKey = options.projectKey ?? (() => 'global')\n\n  function rateLimited(key: string): boolean {\n    if (maxPerMinute === undefined || maxPerMinute <= 0) return false\n    const now = Date.now()\n    const bucket = buckets.get(key)\n    if (!bucket || now - bucket.windowStart >= 60_000) {\n      buckets.set(key, { windowStart: now, count: 1 })\n      return false\n    }\n    bucket.count += 1\n    return bucket.count > maxPerMinute\n  }\n\n  return async (request: Request): Promise<Response> => {\n    // 1. Session gate — reject anonymous callers (the route holds spend, not data).\n    //    Position is FROZEN: the 401 must precede any stream byte (EC-371/EC-334).\n    let session: AiSession | null\n    try {\n      session = await options.getSession(request)\n    } catch {\n      return jsonResponse({ error: 'unauthorized' }, 401)\n    }\n    if (!session) return jsonResponse({ error: 'unauthorized' }, 401)\n\n    // 2. Method.\n    if (request.method !== 'POST') return jsonResponse({ error: 'method-not-allowed' }, 405)\n\n    // 3. Soft per-project rate / spend counter.\n    if (rateLimited(projectKey(request))) return jsonResponse({ error: 'rate-limited' }, 429)\n\n    // 4. Body → the requested model operation.\n    let body: unknown\n    try {\n      body = await request.json()\n    } catch {\n      return jsonResponse({ error: 'invalid-json' }, 400)\n    }\n    if (typeof body !== 'object' || body === null) {\n      return jsonResponse({ error: 'invalid-json' }, 400)\n    }\n\n    // 5a. Structured generation — the thin proxy that lets `applyContentWithShape`\n    //     run client-side without the key ever reaching the browser.\n    if ((body as { kind?: unknown }).kind === 'generate') {\n      const generate = parseGenerateBody(body)\n      if (!generate) {\n        return jsonResponse(\n          { error: 'invalid-request', message: 'expected { kind: \"generate\", request }' },\n          400,\n        )\n      }\n      try {\n        const result = await options.provider.generateStructured(generate)\n        return jsonResponse(result, 200)\n      } catch {\n        return jsonResponse({ error: 'provider-error' }, 502)\n      }\n    }\n\n    // 5b. Native chat branch (EC-334): `{ messages: UIMessage[], context? }`.\n    const rawMessages = (body as { messages?: unknown }).messages\n    if (!Array.isArray(rawMessages) || rawMessages.length === 0) {\n      return jsonResponse(\n        {\n          error: 'invalid-request',\n          message: 'expected { kind: \"generate\", request } or { messages: UIMessage[] }',\n        },\n        400,\n      )\n    }\n\n    const assembled = assembleSystemPrompt((body as { context?: unknown }).context)\n    if (!assembled.ok) {\n      return jsonResponse(\n        { error: 'invalid-request', message: 'context must be a string or string[]' },\n        400,\n      )\n    }\n\n    if (!options.provider.languageModel) {\n      return jsonResponse({ error: 'provider-cannot-stream' }, 501)\n    }\n\n    // The SDK loads lazily INSIDE the handler (the anthropic-provider discipline):\n    // the client-imported barrel re-exports this module, and a static edge would\n    // put the AI SDK on the studio critical path (pinned in bundle.test.ts).\n    const {\n      validateUIMessages,\n      convertToModelMessages,\n      streamText,\n      createUIMessageStreamResponse,\n      toUIMessageStream,\n    } = await import('ai')\n\n    // Structural UIMessage validation (id/role/parts). Tool parts validate by\n    // shape — deep input validation belongs to the client executor (slice 2).\n    let messages\n    try {\n      messages = await validateUIMessages({ messages: rawMessages })\n    } catch {\n      return jsonResponse(\n        { error: 'invalid-request', message: 'expected { messages: UIMessage[] }' },\n        400,\n      )\n    }\n\n    try {\n      const model = await options.provider.languageModel()\n      const result = streamText({\n        model,\n        ...(assembled.system !== undefined ? { system: assembled.system } : {}),\n        messages: await convertToModelMessages(messages),\n        // No `execute` on any tool — the SDK forwards each call to the client\n        // (ratified trust boundary). Continuation is therefore client-driven: one\n        // tool round-trip per REQUEST, throttled by the rate limit above; the\n        // per-turn step cap lands client-side with slice 2.\n        tools: chatToolDefinitions,\n      })\n      return createUIMessageStreamResponse({\n        stream: toUIMessageStream({ stream: result.stream, originalMessages: messages }),\n      })\n    } catch {\n      return jsonResponse({ error: 'provider-error' }, 502)\n    }\n  }\n}\n"]}

package/dist/lib/ai/shape.d.ts

@@ -1,5 +1,5 @@
 import type { CollectionDef, JsonSchema } from '@elytracms/core/cms-core';
-import type { RelationCandidates } from './types.js';
+import type { AssetCandidates, RelationCandidates } from './types.js';
 /** A relation field's resolved candidate set — how the engine maps ids → reference envelopes. */
 export interface TargetRelationField {
     fieldName: string;
@@ -9,6 +9,13 @@ export interface TargetRelationField {
     /** The allowed candidate ids (the enum the model chose from). */
     candidateIds: string[];
 }
+/** An asset field's resolved candidate set — how the engine maps ids → asset envelopes (EC-381). */
+export interface TargetAssetField {
+    fieldName: string;
+    multiple: boolean;
+    /** The allowed library asset ids (the enum the model chose from). */
+    candidateIds: string[];
+}
 /** The derived target shape + the metadata the engine needs to post-process the output. */
 export interface TargetShape {
     /** The JSON Schema the structured output must satisfy. */
@@ -19,11 +26,15 @@ export interface TargetShape {
     localizedFields: string[];
     /** Relation fields with their candidate enums. */
     relationFields: TargetRelationField[];
+    /** Asset fields with their candidate enums (EC-381). */
+    assetFields: TargetAssetField[];
 }
 export interface BuildTargetShapeInput {
     collection: CollectionDef;
     /** Relation candidate ids by field — a relation field with none is omitted from the shape. */
     candidates?: RelationCandidates;
+    /** Asset candidate ids by field — an asset field with none is omitted from the shape (EC-381). */
+    assetCandidates?: AssetCandidates;
     /** UI locale for resolving field labels into descriptions. */
     locale?: string;
 }

package/dist/lib/ai/shape.js

@@ -10,30 +10,33 @@
  *  - relation fields become an ENUM over the provided candidate ids (or are omitted
  *    when no candidates exist) — so a hallucinated relation id is not representable
  *    as valid structured output.
- *  - rich-text fields are emitted in the `{ version, doc }` ProseMirror storage shape
- *    (the `allow` leash on embeds is enforced later by `validateRichTextEmbeds`).
+ *  - asset/image fields become an ENUM over the searched library asset ids (or are
+ *    omitted when none were searched) — EC-381, the SAME leash as relations: a
+ *    proposed asset id must be a real, `listAssets`-returned library asset, and a
+ *    create shape with no searched assets simply has no asset property (empty beats
+ *    wrong; the assistant never generates or uploads).
+ *  - rich-text fields are MARKDOWN STRINGS (EC-379): the description names the
+ *    allowed subset, and the engine converts md → the `{ version, doc }` storage
+ *    envelope at proposal-build time. The field's `allow` config leashes component
+ *    EMBEDS only — markdown cannot express an embed, so the leash is satisfied by
+ *    construction (and still enforced downstream by `validateRichTextEmbeds`).
  *
  * Localized fields stay flat in the shape (the model authors one locale at a time);
  * the engine routes their values under `localized[locale]`.
  */
 import { collectionJsonSchema, resolveLabel } from '@elytracms/core/cms-core';
-/** The rich-text `{ version, doc }` storage envelope, as a JSON Schema. */
-function richTextEnvelopeSchema() {
+import { MARKDOWN_PROSE_DESCRIPTION } from '@elytracms/core/rich-text';
+/**
+ * A rich-text field's model-facing schema (EC-379): a MARKDOWN string. The
+ * description carries the allowed subset (from the engine converter — one source
+ * of truth), so the model has something concrete to aim at; the engine converts
+ * the markdown into the `{ version, doc }` storage envelope at proposal-build
+ * time and rejects out-of-subset constructs with explicit issues.
+ */
+function richTextMarkdownSchema() {
     return {
-        type: 'object',
-        description: 'Rich text in the ProseMirror storage shape: { version, doc: { type: "doc", content: [...] } }.',
-        properties: {
-            version: { type: 'number' },
-            doc: {
-                type: 'object',
-                properties: {
-                    type: { type: 'string', const: 'doc' },
-                    content: { type: 'array', items: { type: 'object' } },
-                },
-                required: ['type', 'content'],
-            },
-        },
-        required: ['version', 'doc'],
+        type: 'string',
+        description: `Rich text, written as ${MARKDOWN_PROSE_DESCRIPTION} Write genuine, publishable prose.`,
     };
 }
 /** A field's model-facing description: resolved label + optional `ai.hint`. */
@@ -56,6 +59,7 @@ export function buildTargetShape(input) {
     const excluded = [];
     const localizedFields = [];
     const relationFields = [];
+    const assetFields = [];
     for (const field of input.collection.fields) {
         if (field.localized)
             localizedFields.push(field.name);
@@ -89,8 +93,30 @@ export function buildTargetShape(input) {
                 candidateIds: ids,
             });
         }
+        else if (field.type === 'asset') {
+            // EC-381 — same leash as relations: an asset field is an enum over the ids
+            // the model actually searched in the media library (`listAssets`). No
+            // searched assets ⇒ omit the field, so the proposal simply leaves it empty
+            // (an invented / to-be-uploaded id is structurally unrepresentable).
+            const candidates = input.assetCandidates?.[field.name] ?? [];
+            if (candidates.length === 0) {
+                delete properties[field.name];
+                continue;
+            }
+            const ids = candidates.map((c) => c.id);
+            const label = candidates
+                .map((c) => (c.label ? `${c.id} (${c.label})` : c.id))
+                .join(', ');
+            const idSchema = {
+                type: 'string',
+                enum: ids,
+                description: `Choose an EXISTING library asset id, one of: ${label}. Leave empty if none fits.`,
+            };
+            properties[field.name] = field.multiple ? { type: 'array', items: idSchema } : idSchema;
+            assetFields.push({ fieldName: field.name, multiple: field.multiple, candidateIds: ids });
+        }
         else if (field.type === 'richText') {
-            properties[field.name] = richTextEnvelopeSchema();
+            properties[field.name] = richTextMarkdownSchema();
         }
         const prop = properties[field.name];
         if (prop) {
@@ -108,6 +134,6 @@ export function buildTargetShape(input) {
         additionalProperties: false,
         ...(required.length > 0 ? { required } : {}),
     };
-    return { schema, excluded, localizedFields, relationFields };
+    return { schema, excluded, localizedFields, relationFields, assetFields };
 }
 //# sourceMappingURL=shape.js.map

package/dist/lib/ai/shape.js.map

@@ -1 +1 @@
-{"version":3,"file":"shape.js","sourceRoot":"","sources":["../../../src/lib/ai/shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAkC7E,2EAA2E;AAC3E,SAAS,sBAAsB;IAC7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,gGAAgG;QAClG,UAAU,EAAE;YACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE;oBACtC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBACtD;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;aAC9B;SACF;QACD,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;KAC7B,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAe,EAAE,MAAe;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAA;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,CAAA;IAC3B,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC7F,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,UAAU,GAA+B;QAC7C,GAAG,CAAE,IAAI,CAAC,UAAyC,IAAI,EAAE,CAAC;KAC3D,CAAA;IACD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,SAAS;YAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAErD,IAAI,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzB,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC7B,SAAQ;QACV,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,4EAA4E;gBAC5E,2DAA2D;gBAC3D,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC7B,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,UAAU;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBACrD,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,MAAM,QAAQ,GAAe;gBAC3B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EAAE,kBAAkB,KAAK,EAAE;aACvC,CAAA;YACD,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;YACvF,cAAc,CAAC,IAAI,CAAC;gBAClB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,GAAG;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,EAAE,CAAA;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC1C,0EAA0E;YAC1E,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,QAAqB,CAAC,CAAC,CAAC,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAE/F,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,oBAAoB,EAAE,KAAK;QAC3B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,CAAA;AAC9D,CAAC","sourcesContent":["/**\n * Target-shape derivation for `applyContentWithShape` (EC-331).\n *\n * Reuses the existing collection→JSON-Schema derivation (`collectionJsonSchema`,\n * cms-core) rather than writing a new one, then applies the three leashes the AI\n * engine adds on top:\n *\n *  - `ai.exclude` fields are removed entirely (the model never sees them → cannot\n *    write them).\n *  - relation fields become an ENUM over the provided candidate ids (or are omitted\n *    when no candidates exist) — so a hallucinated relation id is not representable\n *    as valid structured output.\n *  - rich-text fields are emitted in the `{ version, doc }` ProseMirror storage shape\n *    (the `allow` leash on embeds is enforced later by `validateRichTextEmbeds`).\n *\n * Localized fields stay flat in the shape (the model authors one locale at a time);\n * the engine routes their values under `localized[locale]`.\n */\nimport { collectionJsonSchema, resolveLabel } from '@elytracms/core/cms-core'\nimport type { CollectionDef, FieldDef, JsonSchema } from '@elytracms/core/cms-core'\nimport type { RelationCandidates } from './types'\n\n/** A relation field's resolved candidate set — how the engine maps ids → reference envelopes. */\nexport interface TargetRelationField {\n  fieldName: string\n  /** The relation's target collection id. */\n  target: string\n  multiple: boolean\n  /** The allowed candidate ids (the enum the model chose from). */\n  candidateIds: string[]\n}\n\n/** The derived target shape + the metadata the engine needs to post-process the output. */\nexport interface TargetShape {\n  /** The JSON Schema the structured output must satisfy. */\n  schema: JsonSchema\n  /** Field names removed by `ai.exclude` (untouchable). */\n  excluded: string[]\n  /** Field names whose values route under `localized[locale]`. */\n  localizedFields: string[]\n  /** Relation fields with their candidate enums. */\n  relationFields: TargetRelationField[]\n}\n\nexport interface BuildTargetShapeInput {\n  collection: CollectionDef\n  /** Relation candidate ids by field — a relation field with none is omitted from the shape. */\n  candidates?: RelationCandidates\n  /** UI locale for resolving field labels into descriptions. */\n  locale?: string\n}\n\n/** The rich-text `{ version, doc }` storage envelope, as a JSON Schema. */\nfunction richTextEnvelopeSchema(): JsonSchema {\n  return {\n    type: 'object',\n    description:\n      'Rich text in the ProseMirror storage shape: { version, doc: { type: \"doc\", content: [...] } }.',\n    properties: {\n      version: { type: 'number' },\n      doc: {\n        type: 'object',\n        properties: {\n          type: { type: 'string', const: 'doc' },\n          content: { type: 'array', items: { type: 'object' } },\n        },\n        required: ['type', 'content'],\n      },\n    },\n    required: ['version', 'doc'],\n  }\n}\n\n/** A field's model-facing description: resolved label + optional `ai.hint`. */\nfunction describe(field: FieldDef, locale?: string): string | undefined {\n  const label = resolveLabel(field.form?.label, locale) ?? field.name\n  const hint = field.ai?.hint\n  const parts = [label, hint].filter((p): p is string => typeof p === 'string' && p.length > 0)\n  return parts.length > 0 ? parts.join(' — ') : undefined\n}\n\n/**\n * Build the leash-aware target shape from a collection + candidates. Deterministic;\n * never throws. Reuses `collectionJsonSchema` as the base, then rewrites relations /\n * rich text and strips excluded fields.\n */\nexport function buildTargetShape(input: BuildTargetShapeInput): TargetShape {\n  const base = collectionJsonSchema(input.collection)\n  const properties: Record<string, JsonSchema> = {\n    ...((base.properties as Record<string, JsonSchema>) ?? {}),\n  }\n  const excluded: string[] = []\n  const localizedFields: string[] = []\n  const relationFields: TargetRelationField[] = []\n\n  for (const field of input.collection.fields) {\n    if (field.localized) localizedFields.push(field.name)\n\n    if (field.ai?.exclude) {\n      excluded.push(field.name)\n      delete properties[field.name]\n      continue\n    }\n\n    if (field.type === 'relation') {\n      const candidates = input.candidates?.[field.name] ?? []\n      if (candidates.length === 0) {\n        // No candidate ids ⇒ omit the field: the model cannot emit a relation value\n        // at all, so a hallucinated id is structurally impossible.\n        delete properties[field.name]\n        continue\n      }\n      const ids = candidates.map((c) => c.id)\n      const label = candidates\n        .map((c) => (c.label ? `${c.id} (${c.label})` : c.id))\n        .join(', ')\n      const idSchema: JsonSchema = {\n        type: 'string',\n        enum: ids,\n        description: `Choose one of: ${label}`,\n      }\n      properties[field.name] = field.multiple ? { type: 'array', items: idSchema } : idSchema\n      relationFields.push({\n        fieldName: field.name,\n        target: field.target,\n        multiple: field.multiple,\n        candidateIds: ids,\n      })\n    } else if (field.type === 'richText') {\n      properties[field.name] = richTextEnvelopeSchema()\n    }\n\n    const prop = properties[field.name]\n    if (prop) {\n      const desc = describe(field, input.locale)\n      // Preserve an existing description (e.g. relation enum / rich-text note).\n      if (desc && typeof prop.description !== 'string') prop.description = desc\n    }\n  }\n\n  const requiredIn = Array.isArray(base.required) ? (base.required as string[]) : []\n  const required = requiredIn.filter((n) => !excluded.includes(n) && properties[n] !== undefined)\n\n  const schema: JsonSchema = {\n    type: 'object',\n    properties,\n    additionalProperties: false,\n    ...(required.length > 0 ? { required } : {}),\n  }\n  return { schema, excluded, localizedFields, relationFields }\n}\n"]}
+{"version":3,"file":"shape.js","sourceRoot":"","sources":["../../../src/lib/ai/shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AA6CtE;;;;;;GAMG;AACH,SAAS,sBAAsB;IAC7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,yBAAyB,0BAA0B,oCAAoC;KACrG,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,KAAe,EAAE,MAAe;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAA;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,CAAA;IAC3B,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC7F,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,UAAU,GAA+B;QAC7C,GAAG,CAAE,IAAI,CAAC,UAAyC,IAAI,EAAE,CAAC;KAC3D,CAAA;IACD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,cAAc,GAA0B,EAAE,CAAA;IAChD,MAAM,WAAW,GAAuB,EAAE,CAAA;IAE1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,SAAS;YAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAErD,IAAI,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzB,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC7B,SAAQ;QACV,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,4EAA4E;gBAC5E,2DAA2D;gBAC3D,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC7B,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,UAAU;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBACrD,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,MAAM,QAAQ,GAAe;gBAC3B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EAAE,kBAAkB,KAAK,EAAE;aACvC,CAAA;YACD,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;YACvF,cAAc,CAAC,IAAI,CAAC;gBAClB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,GAAG;aAClB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,2EAA2E;YAC3E,sEAAsE;YACtE,2EAA2E;YAC3E,qEAAqE;YACrE,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC7B,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,UAAU;iBACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBACrD,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,MAAM,QAAQ,GAAe;gBAC3B,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,GAAG;gBACT,WAAW,EAAE,gDAAgD,KAAK,6BAA6B;aAChG,CAAA;YACD,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;YACvF,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1F,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,EAAE,CAAA;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC1C,0EAA0E;YAC1E,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,QAAqB,CAAC,CAAC,CAAC,EAAE,CAAA;IAClF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAE/F,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,oBAAoB,EAAE,KAAK;QAC3B,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,CAAA;AAC3E,CAAC","sourcesContent":["/**\n * Target-shape derivation for `applyContentWithShape` (EC-331).\n *\n * Reuses the existing collection→JSON-Schema derivation (`collectionJsonSchema`,\n * cms-core) rather than writing a new one, then applies the three leashes the AI\n * engine adds on top:\n *\n *  - `ai.exclude` fields are removed entirely (the model never sees them → cannot\n *    write them).\n *  - relation fields become an ENUM over the provided candidate ids (or are omitted\n *    when no candidates exist) — so a hallucinated relation id is not representable\n *    as valid structured output.\n *  - asset/image fields become an ENUM over the searched library asset ids (or are\n *    omitted when none were searched) — EC-381, the SAME leash as relations: a\n *    proposed asset id must be a real, `listAssets`-returned library asset, and a\n *    create shape with no searched assets simply has no asset property (empty beats\n *    wrong; the assistant never generates or uploads).\n *  - rich-text fields are MARKDOWN STRINGS (EC-379): the description names the\n *    allowed subset, and the engine converts md → the `{ version, doc }` storage\n *    envelope at proposal-build time. The field's `allow` config leashes component\n *    EMBEDS only — markdown cannot express an embed, so the leash is satisfied by\n *    construction (and still enforced downstream by `validateRichTextEmbeds`).\n *\n * Localized fields stay flat in the shape (the model authors one locale at a time);\n * the engine routes their values under `localized[locale]`.\n */\nimport { collectionJsonSchema, resolveLabel } from '@elytracms/core/cms-core'\nimport type { CollectionDef, FieldDef, JsonSchema } from '@elytracms/core/cms-core'\nimport { MARKDOWN_PROSE_DESCRIPTION } from '@elytracms/core/rich-text'\nimport type { AssetCandidates, RelationCandidates } from './types'\n\n/** A relation field's resolved candidate set — how the engine maps ids → reference envelopes. */\nexport interface TargetRelationField {\n  fieldName: string\n  /** The relation's target collection id. */\n  target: string\n  multiple: boolean\n  /** The allowed candidate ids (the enum the model chose from). */\n  candidateIds: string[]\n}\n\n/** An asset field's resolved candidate set — how the engine maps ids → asset envelopes (EC-381). */\nexport interface TargetAssetField {\n  fieldName: string\n  multiple: boolean\n  /** The allowed library asset ids (the enum the model chose from). */\n  candidateIds: string[]\n}\n\n/** The derived target shape + the metadata the engine needs to post-process the output. */\nexport interface TargetShape {\n  /** The JSON Schema the structured output must satisfy. */\n  schema: JsonSchema\n  /** Field names removed by `ai.exclude` (untouchable). */\n  excluded: string[]\n  /** Field names whose values route under `localized[locale]`. */\n  localizedFields: string[]\n  /** Relation fields with their candidate enums. */\n  relationFields: TargetRelationField[]\n  /** Asset fields with their candidate enums (EC-381). */\n  assetFields: TargetAssetField[]\n}\n\nexport interface BuildTargetShapeInput {\n  collection: CollectionDef\n  /** Relation candidate ids by field — a relation field with none is omitted from the shape. */\n  candidates?: RelationCandidates\n  /** Asset candidate ids by field — an asset field with none is omitted from the shape (EC-381). */\n  assetCandidates?: AssetCandidates\n  /** UI locale for resolving field labels into descriptions. */\n  locale?: string\n}\n\n/**\n * A rich-text field's model-facing schema (EC-379): a MARKDOWN string. The\n * description carries the allowed subset (from the engine converter — one source\n * of truth), so the model has something concrete to aim at; the engine converts\n * the markdown into the `{ version, doc }` storage envelope at proposal-build\n * time and rejects out-of-subset constructs with explicit issues.\n */\nfunction richTextMarkdownSchema(): JsonSchema {\n  return {\n    type: 'string',\n    description: `Rich text, written as ${MARKDOWN_PROSE_DESCRIPTION} Write genuine, publishable prose.`,\n  }\n}\n\n/** A field's model-facing description: resolved label + optional `ai.hint`. */\nfunction describe(field: FieldDef, locale?: string): string | undefined {\n  const label = resolveLabel(field.form?.label, locale) ?? field.name\n  const hint = field.ai?.hint\n  const parts = [label, hint].filter((p): p is string => typeof p === 'string' && p.length > 0)\n  return parts.length > 0 ? parts.join(' — ') : undefined\n}\n\n/**\n * Build the leash-aware target shape from a collection + candidates. Deterministic;\n * never throws. Reuses `collectionJsonSchema` as the base, then rewrites relations /\n * rich text and strips excluded fields.\n */\nexport function buildTargetShape(input: BuildTargetShapeInput): TargetShape {\n  const base = collectionJsonSchema(input.collection)\n  const properties: Record<string, JsonSchema> = {\n    ...((base.properties as Record<string, JsonSchema>) ?? {}),\n  }\n  const excluded: string[] = []\n  const localizedFields: string[] = []\n  const relationFields: TargetRelationField[] = []\n  const assetFields: TargetAssetField[] = []\n\n  for (const field of input.collection.fields) {\n    if (field.localized) localizedFields.push(field.name)\n\n    if (field.ai?.exclude) {\n      excluded.push(field.name)\n      delete properties[field.name]\n      continue\n    }\n\n    if (field.type === 'relation') {\n      const candidates = input.candidates?.[field.name] ?? []\n      if (candidates.length === 0) {\n        // No candidate ids ⇒ omit the field: the model cannot emit a relation value\n        // at all, so a hallucinated id is structurally impossible.\n        delete properties[field.name]\n        continue\n      }\n      const ids = candidates.map((c) => c.id)\n      const label = candidates\n        .map((c) => (c.label ? `${c.id} (${c.label})` : c.id))\n        .join(', ')\n      const idSchema: JsonSchema = {\n        type: 'string',\n        enum: ids,\n        description: `Choose one of: ${label}`,\n      }\n      properties[field.name] = field.multiple ? { type: 'array', items: idSchema } : idSchema\n      relationFields.push({\n        fieldName: field.name,\n        target: field.target,\n        multiple: field.multiple,\n        candidateIds: ids,\n      })\n    } else if (field.type === 'asset') {\n      // EC-381 — same leash as relations: an asset field is an enum over the ids\n      // the model actually searched in the media library (`listAssets`). No\n      // searched assets ⇒ omit the field, so the proposal simply leaves it empty\n      // (an invented / to-be-uploaded id is structurally unrepresentable).\n      const candidates = input.assetCandidates?.[field.name] ?? []\n      if (candidates.length === 0) {\n        delete properties[field.name]\n        continue\n      }\n      const ids = candidates.map((c) => c.id)\n      const label = candidates\n        .map((c) => (c.label ? `${c.id} (${c.label})` : c.id))\n        .join(', ')\n      const idSchema: JsonSchema = {\n        type: 'string',\n        enum: ids,\n        description: `Choose an EXISTING library asset id, one of: ${label}. Leave empty if none fits.`,\n      }\n      properties[field.name] = field.multiple ? { type: 'array', items: idSchema } : idSchema\n      assetFields.push({ fieldName: field.name, multiple: field.multiple, candidateIds: ids })\n    } else if (field.type === 'richText') {\n      properties[field.name] = richTextMarkdownSchema()\n    }\n\n    const prop = properties[field.name]\n    if (prop) {\n      const desc = describe(field, input.locale)\n      // Preserve an existing description (e.g. relation enum / rich-text note).\n      if (desc && typeof prop.description !== 'string') prop.description = desc\n    }\n  }\n\n  const requiredIn = Array.isArray(base.required) ? (base.required as string[]) : []\n  const required = requiredIn.filter((n) => !excluded.includes(n) && properties[n] !== undefined)\n\n  const schema: JsonSchema = {\n    type: 'object',\n    properties,\n    additionalProperties: false,\n    ...(required.length > 0 ? { required } : {}),\n  }\n  return { schema, excluded, localizedFields, relationFields, assetFields }\n}\n"]}