@happyvertical/smrt-core 0.30.0

package/dist/generators/rest.js

@@ -0,0 +1,591 @@
+import http from "node:http";
+import { ObjectRegistry } from "../registry.js";
+class APIGenerator {
+  config;
+  collections = /* @__PURE__ */ new Map();
+  context;
+  constructor(config = {}, context = {}) {
+    this.config = {
+      basePath: "/api/v1",
+      // Security defaults (#1540): bind to loopback and keep CORS off unless an
+      // explicit origin allowlist is supplied. No `Access-Control-Allow-Origin: *`.
+      enableCors: false,
+      port: 3e3,
+      hostname: "127.0.0.1",
+      ...config
+    };
+    this.context = context;
+  }
+  /**
+   * Register a pre-configured collection instance for API exposure
+   *
+   * @param name - URL path segment for the collection (e.g., 'products' for /api/products)
+   * @param collection - Pre-initialized SmrtCollection instance
+   */
+  registerCollection(name, collection) {
+    this.collections.set(name, collection);
+  }
+  /**
+   * Create Node.js HTTP server with all routes
+   */
+  createServer() {
+    const server = http.createServer(async (req, res) => {
+      try {
+        const request = await this.nodeRequestToWebRequest(req);
+        const response = await this.handleRequest(request);
+        await this.webResponseToNodeResponse(response, res);
+      } catch (_error) {
+        res.statusCode = 500;
+        res.end("Internal Server Error");
+      }
+    });
+    server.listen(this.config.port, this.config.hostname);
+    return {
+      server,
+      url: `http://${this.config.hostname}:${this.config.port}`
+    };
+  }
+  /**
+   * Convert stream to string
+   */
+  async streamToString(stream) {
+    const chunks = [];
+    for await (const chunk of stream) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf-8");
+  }
+  /**
+   * Convert Node.js IncomingMessage to Web Request
+   */
+  async nodeRequestToWebRequest(req) {
+    const url = `http://${this.config.hostname}:${this.config.port}${req.url}`;
+    const method = req.method || "GET";
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+      if (value) {
+        headers.set(key, Array.isArray(value) ? value[0] : value);
+      }
+    }
+    let body;
+    if (method !== "GET" && method !== "HEAD") {
+      body = await this.streamToString(req);
+    }
+    return new Request(url, {
+      method,
+      headers,
+      body
+    });
+  }
+  /**
+   * Convert Web Response to Node.js ServerResponse
+   */
+  async webResponseToNodeResponse(webResponse, res) {
+    res.statusCode = webResponse.status;
+    webResponse.headers.forEach((value, key) => {
+      res.setHeader(key, value);
+    });
+    if (webResponse.body) {
+      const reader = webResponse.body.getReader();
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        res.write(value);
+      }
+    }
+    res.end();
+  }
+  /**
+   * Generate fetch handler function (for serverless environments)
+   */
+  generateHandler() {
+    return (req) => this.handleRequest(req);
+  }
+  /**
+   * Main request handler using native Bun APIs
+   */
+  async handleRequest(req) {
+    const url = new URL(req.url);
+    if (req.method === "OPTIONS" && this.config.enableCors) {
+      return this.createCorsResponse(req);
+    }
+    if (this.config.customRoutes) {
+      for (const [path, handler] of Object.entries(this.config.customRoutes)) {
+        if (url.pathname === `${this.config.basePath}${path}`) {
+          const response = await handler(req);
+          return this.addCorsHeaders(response, req);
+        }
+      }
+    }
+    if (url.pathname.startsWith(this.config.basePath || "")) {
+      const response = await this.handleObjectRoute(req, url);
+      return this.addCorsHeaders(response, req);
+    }
+    return this.createErrorResponse(404, "Not found");
+  }
+  /**
+   * Handle CRUD routes for SMRT objects
+   */
+  async handleObjectRoute(req, url) {
+    const pathParts = url.pathname.replace(this.config.basePath || "", "").split("/").filter(Boolean);
+    if (pathParts.length === 0) {
+      return this.createErrorResponse(400, "Object type required");
+    }
+    const objectType = pathParts[0];
+    const objectId = pathParts[1];
+    if (this.collections.has(objectType)) {
+      const collection2 = this.collections.get(objectType);
+      if (!collection2) throw new Error(`Collection ${objectType} not found`);
+      const objectName = this.getCollectionObjectName(collection2) || objectType;
+      if (this.config.authMiddleware) {
+        const authCheck = this.config.authMiddleware(
+          objectName,
+          req.method.toLowerCase()
+        );
+        const authResult = await authCheck(req);
+        if (authResult instanceof Response) {
+          return authResult;
+        }
+        req = authResult;
+      } else if (!this.isRoutePublic(objectName, req.method)) {
+        return this.createErrorResponse(401, "Authentication required");
+      }
+      return await this.executeCrudOperation(
+        req,
+        collection2,
+        objectId,
+        url,
+        objectName
+      );
+    }
+    const registeredClasses = ObjectRegistry.getAllClasses();
+    const pluralName = this.pluralize(objectType);
+    let classInfo = null;
+    for (const [_key, info] of registeredClasses) {
+      if (this.pluralize((info.name || _key).toLowerCase()) === pluralName) {
+        classInfo = info;
+        break;
+      }
+    }
+    if (!classInfo) {
+      return this.createErrorResponse(
+        404,
+        `Object type '${objectType}' not found`
+      );
+    }
+    if (this.config.authMiddleware) {
+      const authCheck = this.config.authMiddleware(
+        classInfo.name,
+        req.method.toLowerCase()
+      );
+      const authResult = await authCheck(req);
+      if (authResult instanceof Response) {
+        return authResult;
+      }
+      req = authResult;
+    } else if (!this.isRoutePublic(classInfo.name, req.method)) {
+      return this.createErrorResponse(401, "Authentication required");
+    }
+    const collection = this.getCollection(classInfo);
+    return await this.executeCrudOperation(
+      req,
+      collection,
+      objectId,
+      url,
+      classInfo.name
+    );
+  }
+  /**
+   * Execute CRUD operation on a collection
+   */
+  async executeCrudOperation(req, collection, objectId, url, objectName) {
+    try {
+      const action = this.getCrudAction(req.method, objectId);
+      if (action && !this.isApiActionEnabled(objectName, action)) {
+        return this.createErrorResponse(405, "Method not allowed");
+      }
+      if (objectId === "count" && req.method === "GET") {
+        return await this.handleCount(collection, url.searchParams);
+      }
+      switch (req.method) {
+        case "GET":
+          return objectId ? await this.handleGet(collection, objectId) : await this.handleList(collection, url.searchParams);
+        case "POST":
+          return await this.handleCreate(collection, req, objectName);
+        case "PUT":
+        case "PATCH":
+          if (!objectId) {
+            return this.createErrorResponse(
+              400,
+              "Object ID required for update"
+            );
+          }
+          return await this.handleUpdate(collection, objectId, req, objectName);
+        case "DELETE":
+          if (!objectId) {
+            return this.createErrorResponse(
+              400,
+              "Object ID required for delete"
+            );
+          }
+          return await this.handleDelete(collection, objectId);
+        default:
+          return this.createErrorResponse(405, "Method not allowed");
+      }
+    } catch (error) {
+      console.error("API Error:", error);
+      return this.createErrorResponse(500, "Internal server error");
+    }
+  }
+  getCrudAction(method, objectId) {
+    switch (method) {
+      case "GET":
+        return objectId && objectId !== "count" ? "get" : "list";
+      case "POST":
+        return "create";
+      case "PUT":
+      case "PATCH":
+        return "update";
+      case "DELETE":
+        return "delete";
+      default:
+        return null;
+    }
+  }
+  /**
+   * Fail-closed authorization posture (#1540). Returns true only when the
+   * object opts out of auth via `@smrt({ api: { public } })`:
+   * - `public: true` → all methods are public.
+   * - `public: 'read'` → only safe (GET) methods are public.
+   * Everything else requires an `authMiddleware` to be configured.
+   */
+  isRoutePublic(objectName, method) {
+    if (!objectName) return false;
+    const apiConfig = ObjectRegistry.getConfig(objectName)?.api;
+    if (!apiConfig || typeof apiConfig !== "object") return false;
+    const publicAccess = apiConfig.public;
+    if (publicAccess === true) return true;
+    if (publicAccess === "read") return method.toUpperCase() === "GET";
+    return false;
+  }
+  isApiActionEnabled(objectName, action) {
+    if (!objectName) {
+      return true;
+    }
+    const config = ObjectRegistry.getConfig(objectName);
+    const apiConfig = config.api;
+    if (apiConfig === false) {
+      return false;
+    }
+    if (apiConfig && typeof apiConfig === "object") {
+      if (apiConfig.include && !apiConfig.include.includes(action)) {
+        return false;
+      }
+      if (apiConfig.exclude?.includes(action)) {
+        return false;
+      }
+    }
+    return true;
+  }
+  getCollectionObjectName(collection) {
+    const itemClass = collection._itemClass || collection.constructor?._itemClass;
+    if (!itemClass) {
+      return void 0;
+    }
+    const registered = ObjectRegistry.getClassByConstructor(itemClass);
+    return registered?.qualifiedName || registered?.name || itemClass.name;
+  }
+  /**
+   * Handle GET /objects/:id
+   */
+  async handleGet(collection, id) {
+    const object = await collection.get(id);
+    if (!object) {
+      return this.createErrorResponse(404, "Object not found");
+    }
+    return this.createJsonResponse(this.toPublicData(object));
+  }
+  /**
+   * Handle GET /objects (list with query params)
+   */
+  async handleList(collection, params) {
+    const limit = Number.parseInt(params.get("limit") || "50", 10);
+    const offset = Number.parseInt(params.get("offset") || "0", 10);
+    const orderBy = params.get("orderBy") || "created_at DESC";
+    const where = {};
+    for (const [key, value] of params.entries()) {
+      if (!["limit", "offset", "orderBy"].includes(key)) {
+        const match = key.match(/^(.+)\[(.+)\]$/);
+        if (match) {
+          const field = match[1];
+          const operator = match[2];
+          const operatorMap = {
+            gt: ">",
+            gte: ">=",
+            lt: "<",
+            lte: "<=",
+            ne: "!=",
+            in: "in",
+            like: "like"
+          };
+          const sqlOperator = operatorMap[operator] || operator;
+          const sqlKey = `${field} ${sqlOperator}`;
+          where[sqlKey] = operator === "in" ? value.split(",") : value;
+        } else {
+          where[key] = value;
+        }
+      }
+    }
+    const objects = await collection.list({
+      where: Object.keys(where).length > 0 ? where : void 0,
+      limit,
+      offset,
+      orderBy
+    });
+    return this.createJsonResponse(
+      objects.map((object) => this.toPublicData(object))
+    );
+  }
+  /**
+   * Handle GET /objects/count
+   */
+  async handleCount(collection, params) {
+    const where = {};
+    for (const [key, value] of params.entries()) {
+      const match = key.match(/^(.+)\[(.+)\]$/);
+      if (match) {
+        const field = match[1];
+        const operator = match[2];
+        const operatorMap = {
+          gt: ">",
+          gte: ">=",
+          lt: "<",
+          lte: "<=",
+          ne: "!=",
+          in: "in",
+          like: "like"
+        };
+        const sqlOperator = operatorMap[operator] || operator;
+        const sqlKey = `${field} ${sqlOperator}`;
+        where[sqlKey] = operator === "in" ? value.split(",") : value;
+      } else {
+        where[key] = value;
+      }
+    }
+    const count = await collection.count({
+      where: Object.keys(where).length > 0 ? where : void 0
+    });
+    return this.createJsonResponse({ count });
+  }
+  /**
+   * Handle POST /objects
+   */
+  async handleCreate(collection, req, objectName) {
+    const data = this.applyWritablePolicy(objectName, await req.json());
+    const object = await collection.create({ ...data, _skipLoad: true });
+    await object.save();
+    return this.createJsonResponse(this.toPublicData(object), 201);
+  }
+  /**
+   * Handle PUT/PATCH /objects/:id
+   */
+  async handleUpdate(collection, id, req, objectName) {
+    const data = this.applyWritablePolicy(objectName, await req.json());
+    const object = await collection.get(id);
+    if (!object) {
+      return this.createErrorResponse(404, "Object not found");
+    }
+    Object.assign(object, data);
+    await object.save();
+    return this.createJsonResponse(this.toPublicData(object));
+  }
+  /**
+   * Handle DELETE /objects/:id
+   */
+  async handleDelete(collection, id) {
+    const object = await collection.get(id);
+    if (!object) {
+      return this.createErrorResponse(404, "Object not found");
+    }
+    await object.delete();
+    return new Response(null, { status: 204 });
+  }
+  /**
+   * Get or create collection instance
+   */
+  getCollection(classInfo) {
+    if (!this.collections.has(classInfo.name)) {
+      const collection2 = new classInfo.collectionConstructor({
+        ai: this.context.ai,
+        db: this.context.db
+      });
+      this.collections.set(classInfo.name, collection2);
+    }
+    const collection = this.collections.get(classInfo.name);
+    if (!collection) throw new Error(`Collection ${classInfo.name} not found`);
+    return collection;
+  }
+  /**
+   * Mass-assignment guard (#1540): strip framework/server-managed and
+   * `@field({ readonly: true })` fields from a create/update body, and — when an
+   * `@smrt({ api: { writable: [...] } })` allowlist is set — intersect with it.
+   */
+  applyWritablePolicy(objectName, data) {
+    if (!data || typeof data !== "object") {
+      return {};
+    }
+    const serverManaged = /* @__PURE__ */ new Set([
+      "id",
+      "tenantId",
+      "tenant_id",
+      "createdAt",
+      "created_at",
+      "updatedAt",
+      "updated_at"
+    ]);
+    const readonly = /* @__PURE__ */ new Set();
+    let writable = null;
+    if (objectName) {
+      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;
+      if (apiConfig && typeof apiConfig === "object" && Array.isArray(apiConfig.writable)) {
+        writable = apiConfig.writable;
+      }
+      for (const [name, def] of ObjectRegistry.getFields(objectName)) {
+        if (def && (def.readonly === true || def._meta?.readonly === true)) {
+          readonly.add(name);
+        }
+      }
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+      if (key.startsWith("_")) continue;
+      if (serverManaged.has(key)) continue;
+      if (readonly.has(key)) continue;
+      if (writable && !writable.includes(key)) continue;
+      result[key] = value;
+    }
+    return result;
+  }
+  /**
+   * Serialize a SmrtObject for a network response, excluding sensitive fields
+   * (#1540). Falls back to the value unchanged for non-SmrtObject payloads.
+   */
+  toPublicData(object) {
+    return typeof object?.toPublicJSON === "function" ? object.toPublicJSON() : object;
+  }
+  /**
+   * Create JSON response with proper headers
+   */
+  createJsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data), {
+      status,
+      headers: {
+        "Content-Type": "application/json"
+      }
+    });
+  }
+  /**
+   * Create error response
+   */
+  createErrorResponse(status, message) {
+    return new Response(JSON.stringify({ error: message }), {
+      status,
+      headers: {
+        "Content-Type": "application/json"
+      }
+    });
+  }
+  /**
+   * Resolve the allowed `Access-Control-Allow-Origin` for a request (#1540).
+   * Returns the request's `Origin` only when it is in the configured allowlist;
+   * never `*`. Returns null when CORS should not be applied.
+   */
+  resolveAllowedOrigin(req) {
+    if (!this.config.enableCors) return null;
+    const allowed = this.config.allowedOrigins;
+    if (!allowed || allowed.length === 0) return null;
+    const origin = req.headers.get("origin");
+    return origin && allowed.includes(origin) ? origin : null;
+  }
+  /**
+   * Create CORS preflight response
+   */
+  createCorsResponse(req) {
+    const headers = {
+      "Access-Control-Allow-Methods": "GET,POST,PUT,PATCH,DELETE,OPTIONS",
+      "Access-Control-Allow-Headers": "Content-Type,Authorization",
+      "Access-Control-Max-Age": "86400"
+    };
+    const origin = this.resolveAllowedOrigin(req);
+    if (origin) {
+      headers["Access-Control-Allow-Origin"] = origin;
+      headers.Vary = "Origin";
+    }
+    return new Response(null, { status: 200, headers });
+  }
+  /**
+   * Add CORS headers to response
+   */
+  addCorsHeaders(response, req) {
+    const origin = this.resolveAllowedOrigin(req);
+    if (!origin) return response;
+    const headers = new Headers(response.headers);
+    headers.set("Access-Control-Allow-Origin", origin);
+    headers.set("Vary", "Origin");
+    headers.set(
+      "Access-Control-Allow-Methods",
+      "GET,POST,PUT,PATCH,DELETE,OPTIONS"
+    );
+    headers.set("Access-Control-Allow-Headers", "Content-Type,Authorization");
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+  /**
+   * Simple pluralization (basic implementation)
+   */
+  pluralize(word) {
+    if (word.endsWith("y")) {
+      return `${word.slice(0, -1)}ies`;
+    }
+    if (word.endsWith("s") || word.endsWith("sh") || word.endsWith("ch")) {
+      return `${word}es`;
+    }
+    return `${word}s`;
+  }
+}
+function createRestServer(objects, context = {}, config = {}) {
+  objects.forEach((obj) => {
+    if (!ObjectRegistry.hasClass(obj.name)) {
+      console.warn(`Object ${obj.name} not registered with @smrt decorator`);
+    }
+  });
+  const generator = new APIGenerator(config, context);
+  const { server, url } = generator.createServer();
+  console.log(`🚀 smrt REST API server running at ${url}`);
+  return { server, url };
+}
+function startRestServer(objects, context = {}, config = {}) {
+  return new Promise((resolve) => {
+    const { server, url } = createRestServer(objects, context, config);
+    const shutdown = () => {
+      return new Promise((shutdownResolve) => {
+        console.log("🛑 Shutting down server gracefully...");
+        server.stop();
+        console.log("✅ Server shut down complete");
+        shutdownResolve();
+      });
+    };
+    process.on("SIGTERM", shutdown);
+    process.on("SIGINT", shutdown);
+    resolve(shutdown);
+  });
+}
+export {
+  APIGenerator,
+  createRestServer,
+  startRestServer
+};
+//# sourceMappingURL=rest.js.map

package/dist/generators/rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.js","sources":["../../src/generators/rest.ts"],"sourcesContent":["/**\n * High-performance REST API generator for smrt objects using Node.js HTTP server\n *\n * Designed for minimal bundle size and maximum performance\n */\n\nimport http from 'node:http';\nimport type { SmrtCollection } from '../collection';\nimport type { SmrtObject } from '../object';\nimport { ObjectRegistry } from '../registry';\n\nexport interface APIConfig {\n  basePath?: string;\n  enableCors?: boolean;\n  /**\n   * Explicit CORS origin allowlist (#1540). Required when `enableCors` is true —\n   * the generator never emits `Access-Control-Allow-Origin: *`. A request's\n   * `Origin` is echoed only when it appears here.\n   */\n  allowedOrigins?: string[];\n  customRoutes?: Record<string, (req: Request) => Promise<Response>>;\n  authMiddleware?: (\n    objectName: string,\n    action: string,\n  ) => (req: Request) => Promise<Request | Response>;\n  port?: number;\n  hostname?: string;\n}\n\nexport interface APIContext {\n  db?: any;\n  ai?: any;\n  user?: {\n    id: string;\n    username?: string;\n    roles?: string[];\n  };\n}\n\n/**\n * High-performance API generator using native Bun\n */\nexport class APIGenerator {\n  private config: APIConfig;\n  private collections = new Map<string, SmrtCollection<any>>();\n  private context: APIContext;\n\n  constructor(config: APIConfig = {}, context: APIContext = {}) {\n    this.config = {\n      basePath: '/api/v1',\n      // Security defaults (#1540): bind to loopback and keep CORS off unless an\n      // explicit origin allowlist is supplied. No `Access-Control-Allow-Origin: *`.\n      enableCors: false,\n      port: 3000,\n      hostname: '127.0.0.1',\n      ...config,\n    };\n    this.context = context;\n  }\n\n  /**\n   * Register a pre-configured collection instance for API exposure\n   *\n   * @param name - URL path segment for the collection (e.g., 'products' for /api/products)\n   * @param collection - Pre-initialized SmrtCollection instance\n   */\n  registerCollection(name: string, collection: SmrtCollection<any>): void {\n    this.collections.set(name, collection);\n  }\n\n  /**\n   * Create Node.js HTTP server with all routes\n   */\n  createServer(): { server: any; url: string } {\n    const server = http.createServer(async (req, res) => {\n      try {\n        const request = await this.nodeRequestToWebRequest(req);\n        const response = await this.handleRequest(request);\n        await this.webResponseToNodeResponse(response, res);\n      } catch (_error) {\n        res.statusCode = 500;\n        res.end('Internal Server Error');\n      }\n    });\n\n    server.listen(this.config.port, this.config.hostname);\n\n    return {\n      server,\n      url: `http://${this.config.hostname}:${this.config.port}`,\n    };\n  }\n\n  /**\n   * Convert stream to string\n   */\n  private async streamToString(stream: http.IncomingMessage): Promise<string> {\n    const chunks: Buffer[] = [];\n    for await (const chunk of stream) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    return Buffer.concat(chunks).toString('utf-8');\n  }\n\n  /**\n   * Convert Node.js IncomingMessage to Web Request\n   */\n  private async nodeRequestToWebRequest(\n    req: http.IncomingMessage,\n  ): Promise<Request> {\n    const url = `http://${this.config.hostname}:${this.config.port}${req.url}`;\n    const method = req.method || 'GET';\n    const headers = new Headers();\n\n    for (const [key, value] of Object.entries(req.headers)) {\n      if (value) {\n        headers.set(key, Array.isArray(value) ? value[0] : value);\n      }\n    }\n\n    let body: string | undefined;\n    if (method !== 'GET' && method !== 'HEAD') {\n      body = await this.streamToString(req);\n    }\n\n    return new Request(url, {\n      method,\n      headers,\n      body,\n    });\n  }\n\n  /**\n   * Convert Web Response to Node.js ServerResponse\n   */\n  private async webResponseToNodeResponse(\n    webResponse: Response,\n    res: http.ServerResponse,\n  ): Promise<void> {\n    res.statusCode = webResponse.status;\n\n    // Set headers\n    webResponse.headers.forEach((value, key) => {\n      res.setHeader(key, value);\n    });\n\n    // Send body\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        res.write(value);\n      }\n    }\n\n    res.end();\n  }\n\n  /**\n   * Generate fetch handler function (for serverless environments)\n   */\n  generateHandler(): (req: Request) => Promise<Response> {\n    return (req) => this.handleRequest(req);\n  }\n\n  /**\n   * Main request handler using native Bun APIs\n   */\n  private async handleRequest(req: Request): Promise<Response> {\n    const url = new URL(req.url);\n\n    // Handle CORS preflight\n    if (req.method === 'OPTIONS' && this.config.enableCors) {\n      return this.createCorsResponse(req);\n    }\n\n    // Handle custom routes first\n    if (this.config.customRoutes) {\n      for (const [path, handler] of Object.entries(this.config.customRoutes)) {\n        if (url.pathname === `${this.config.basePath}${path}`) {\n          const response = await handler(req);\n          return this.addCorsHeaders(response, req);\n        }\n      }\n    }\n\n    // Handle object routes\n    if (url.pathname.startsWith(this.config.basePath || '')) {\n      const response = await this.handleObjectRoute(req, url);\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Not found\n    return this.createErrorResponse(404, 'Not found');\n  }\n\n  /**\n   * Handle CRUD routes for SMRT objects\n   */\n  private async handleObjectRoute(req: Request, url: URL): Promise<Response> {\n    const pathParts = url.pathname\n      .replace(this.config.basePath || '', '')\n      .split('/')\n      .filter(Boolean);\n\n    if (pathParts.length === 0) {\n      return this.createErrorResponse(400, 'Object type required');\n    }\n\n    const objectType = pathParts[0];\n    const objectId = pathParts[1];\n\n    // Check for explicitly registered collection first\n    if (this.collections.has(objectType)) {\n      const collection = this.collections.get(objectType);\n      if (!collection) throw new Error(`Collection ${objectType} not found`);\n\n      const objectName = this.getCollectionObjectName(collection) || objectType;\n\n      // Apply auth middleware if configured\n      if (this.config.authMiddleware) {\n        const authCheck = this.config.authMiddleware(\n          objectName,\n          req.method.toLowerCase(),\n        );\n        const authResult = await authCheck(req);\n        if (authResult instanceof Response) {\n          return authResult; // Auth failed\n        }\n        // Auth passed, use the potentially modified request\n        req = authResult;\n      } else if (!this.isRoutePublic(objectName, req.method)) {\n        // Fail-closed (#1540): no auth middleware wired and the object isn't\n        // marked `@smrt({ api: { public } })` → refuse rather than serve open.\n        return this.createErrorResponse(401, 'Authentication required');\n      }\n\n      // Use registered collection directly\n      return await this.executeCrudOperation(\n        req,\n        collection,\n        objectId,\n        url,\n        objectName,\n      );\n    }\n\n    // Fall back to auto-discovery via ObjectRegistry\n    const registeredClasses = ObjectRegistry.getAllClasses();\n    const pluralName = this.pluralize(objectType);\n\n    let classInfo: any = null;\n    for (const [_key, info] of registeredClasses) {\n      // Issue #951: Use simple name (info.name) for URL matching, not the map key\n      // which may be a qualified name like '@happyvertical/smrt-events:Event'\n      if (this.pluralize((info.name || _key).toLowerCase()) === pluralName) {\n        classInfo = info;\n        break;\n      }\n    }\n\n    if (!classInfo) {\n      return this.createErrorResponse(\n        404,\n        `Object type '${objectType}' not found`,\n      );\n    }\n\n    // Apply auth middleware if configured\n    if (this.config.authMiddleware) {\n      const authCheck = this.config.authMiddleware(\n        classInfo.name,\n        req.method.toLowerCase(),\n      );\n      const authResult = await authCheck(req);\n      if (authResult instanceof Response) {\n        return authResult; // Auth failed\n      }\n      // Auth passed, use the potentially modified request\n      req = authResult;\n    } else if (!this.isRoutePublic(classInfo.name, req.method)) {\n      // Fail-closed (#1540): see registered-collection branch above.\n      return this.createErrorResponse(401, 'Authentication required');\n    }\n\n    // Get or create collection\n    const collection = this.getCollection(classInfo);\n\n    return await this.executeCrudOperation(\n      req,\n      collection,\n      objectId,\n      url,\n      classInfo.name,\n    );\n  }\n\n  /**\n   * Execute CRUD operation on a collection\n   */\n  private async executeCrudOperation(\n    req: Request,\n    collection: SmrtCollection<any>,\n    objectId: string | undefined,\n    url: URL,\n    objectName?: string,\n  ): Promise<Response> {\n    try {\n      const action = this.getCrudAction(req.method, objectId);\n      if (action && !this.isApiActionEnabled(objectName, action)) {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n\n      // Handle special /count endpoint\n      if (objectId === 'count' && req.method === 'GET') {\n        return await this.handleCount(collection, url.searchParams);\n      }\n\n      // Route to appropriate CRUD operation\n      switch (req.method) {\n        case 'GET':\n          return objectId\n            ? await this.handleGet(collection, objectId)\n            : await this.handleList(collection, url.searchParams);\n\n        case 'POST':\n          return await this.handleCreate(collection, req, objectName);\n\n        case 'PUT':\n        case 'PATCH':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for update',\n            );\n          }\n          return await this.handleUpdate(collection, objectId, req, objectName);\n\n        case 'DELETE':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for delete',\n            );\n          }\n          return await this.handleDelete(collection, objectId);\n\n        default:\n          return this.createErrorResponse(405, 'Method not allowed');\n      }\n    } catch (error) {\n      console.error('API Error:', error);\n      return this.createErrorResponse(500, 'Internal server error');\n    }\n  }\n\n  private getCrudAction(\n    method: string,\n    objectId: string | undefined,\n  ): 'list' | 'get' | 'create' | 'update' | 'delete' | null {\n    switch (method) {\n      case 'GET':\n        return objectId && objectId !== 'count' ? 'get' : 'list';\n      case 'POST':\n        return 'create';\n      case 'PUT':\n      case 'PATCH':\n        return 'update';\n      case 'DELETE':\n        return 'delete';\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Fail-closed authorization posture (#1540). Returns true only when the\n   * object opts out of auth via `@smrt({ api: { public } })`:\n   * - `public: true` → all methods are public.\n   * - `public: 'read'` → only safe (GET) methods are public.\n   * Everything else requires an `authMiddleware` to be configured.\n   */\n  private isRoutePublic(\n    objectName: string | undefined,\n    method: string,\n  ): boolean {\n    if (!objectName) return false;\n    const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n    if (!apiConfig || typeof apiConfig !== 'object') return false;\n    const publicAccess = (apiConfig as { public?: boolean | 'read' }).public;\n    if (publicAccess === true) return true;\n    if (publicAccess === 'read') return method.toUpperCase() === 'GET';\n    return false;\n  }\n\n  private isApiActionEnabled(\n    objectName: string | undefined,\n    action: 'list' | 'get' | 'create' | 'update' | 'delete',\n  ): boolean {\n    if (!objectName) {\n      return true;\n    }\n\n    const config = ObjectRegistry.getConfig(objectName);\n    const apiConfig = config.api;\n\n    if (apiConfig === false) {\n      return false;\n    }\n\n    if (apiConfig && typeof apiConfig === 'object') {\n      if (apiConfig.include && !apiConfig.include.includes(action)) {\n        return false;\n      }\n\n      if (apiConfig.exclude?.includes(action)) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  private getCollectionObjectName(\n    collection: SmrtCollection<any>,\n  ): string | undefined {\n    const itemClass =\n      (collection as any)._itemClass ||\n      (collection.constructor as any)?._itemClass;\n\n    if (!itemClass) {\n      return undefined;\n    }\n\n    const registered = ObjectRegistry.getClassByConstructor(itemClass);\n    return registered?.qualifiedName || registered?.name || itemClass.name;\n  }\n\n  /**\n   * Handle GET /objects/:id\n   */\n  private async handleGet(\n    collection: SmrtCollection<any>,\n    id: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n    return this.createJsonResponse(this.toPublicData(object));\n  }\n\n  /**\n   * Handle GET /objects (list with query params)\n   */\n  private async handleList(\n    collection: SmrtCollection<any>,\n    params: URLSearchParams,\n  ): Promise<Response> {\n    const limit = Number.parseInt(params.get('limit') || '50', 10);\n    const offset = Number.parseInt(params.get('offset') || '0', 10);\n    const orderBy = params.get('orderBy') || 'created_at DESC';\n\n    // Build where clause from query params\n    // Convert REST-style operators (price[gt]) to SQL-style (price >)\n    const where: any = {};\n    for (const [key, value] of params.entries()) {\n      if (!['limit', 'offset', 'orderBy'].includes(key)) {\n        // Parse REST operator format: field[operator]\n        const match = key.match(/^(.+)\\[(.+)\\]$/);\n        if (match) {\n          const field = match[1];\n          const operator = match[2];\n          // Map REST operators to SQL operators\n          const operatorMap: Record<string, string> = {\n            gt: '>',\n            gte: '>=',\n            lt: '<',\n            lte: '<=',\n            ne: '!=',\n            in: 'in',\n            like: 'like',\n          };\n          const sqlOperator = operatorMap[operator] || operator;\n          const sqlKey = `${field} ${sqlOperator}`;\n          // Handle 'in' operator - convert comma-separated string to array\n          where[sqlKey] = operator === 'in' ? value.split(',') : value;\n        } else {\n          where[key] = value;\n        }\n      }\n    }\n\n    const objects = await collection.list({\n      where: Object.keys(where).length > 0 ? where : undefined,\n      limit,\n      offset,\n      orderBy,\n    });\n\n    return this.createJsonResponse(\n      objects.map((object: any) => this.toPublicData(object)),\n    );\n  }\n\n  /**\n   * Handle GET /objects/count\n   */\n  private async handleCount(\n    collection: SmrtCollection<any>,\n    params: URLSearchParams,\n  ): Promise<Response> {\n    // Build where clause from query params (same logic as handleList)\n    const where: any = {};\n    for (const [key, value] of params.entries()) {\n      // Parse REST operator format: field[operator]\n      const match = key.match(/^(.+)\\[(.+)\\]$/);\n      if (match) {\n        const field = match[1];\n        const operator = match[2];\n        // Map REST operators to SQL operators\n        const operatorMap: Record<string, string> = {\n          gt: '>',\n          gte: '>=',\n          lt: '<',\n          lte: '<=',\n          ne: '!=',\n          in: 'in',\n          like: 'like',\n        };\n        const sqlOperator = operatorMap[operator] || operator;\n        const sqlKey = `${field} ${sqlOperator}`;\n        // Handle 'in' operator - convert comma-separated string to array\n        where[sqlKey] = operator === 'in' ? value.split(',') : value;\n      } else {\n        where[key] = value;\n      }\n    }\n\n    const count = await collection.count({\n      where: Object.keys(where).length > 0 ? where : undefined,\n    });\n\n    return this.createJsonResponse({ count });\n  }\n\n  /**\n   * Handle POST /objects\n   */\n  private async handleCreate(\n    collection: SmrtCollection<any>,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.create({ ...data, _skipLoad: true });\n    await object.save();\n    return this.createJsonResponse(this.toPublicData(object), 201);\n  }\n\n  /**\n   * Handle PUT/PATCH /objects/:id\n   */\n  private async handleUpdate(\n    collection: SmrtCollection<any>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    // Update object properties\n    Object.assign(object, data);\n    await object.save();\n\n    return this.createJsonResponse(this.toPublicData(object));\n  }\n\n  /**\n   * Handle DELETE /objects/:id\n   */\n  private async handleDelete(\n    collection: SmrtCollection<any>,\n    id: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    await object.delete();\n    return new Response(null, { status: 204 });\n  }\n\n  /**\n   * Get or create collection instance\n   */\n  private getCollection(classInfo: any): SmrtCollection<any> {\n    if (!this.collections.has(classInfo.name)) {\n      const collection = new classInfo.collectionConstructor({\n        ai: this.context.ai,\n        db: this.context.db,\n      });\n      this.collections.set(classInfo.name, collection);\n    }\n    const collection = this.collections.get(classInfo.name);\n    if (!collection) throw new Error(`Collection ${classInfo.name} not found`);\n    return collection;\n  }\n\n  /**\n   * Mass-assignment guard (#1540): strip framework/server-managed and\n   * `@field({ readonly: true })` fields from a create/update body, and — when an\n   * `@smrt({ api: { writable: [...] } })` allowlist is set — intersect with it.\n   */\n  private applyWritablePolicy(\n    objectName: string | undefined,\n    data: any,\n  ): Record<string, any> {\n    if (!data || typeof data !== 'object') {\n      return {};\n    }\n\n    const serverManaged = new Set([\n      'id',\n      'tenantId',\n      'tenant_id',\n      'createdAt',\n      'created_at',\n      'updatedAt',\n      'updated_at',\n    ]);\n\n    const readonly = new Set<string>();\n    let writable: string[] | null = null;\n\n    if (objectName) {\n      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n      if (\n        apiConfig &&\n        typeof apiConfig === 'object' &&\n        Array.isArray((apiConfig as { writable?: unknown }).writable)\n      ) {\n        writable = (apiConfig as { writable: string[] }).writable;\n      }\n\n      for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n        if (def && (def.readonly === true || def._meta?.readonly === true)) {\n          readonly.add(name);\n        }\n      }\n    }\n\n    const result: Record<string, any> = {};\n    for (const [key, value] of Object.entries(data)) {\n      if (key.startsWith('_')) continue;\n      if (serverManaged.has(key)) continue;\n      if (readonly.has(key)) continue;\n      if (writable && !writable.includes(key)) continue;\n      result[key] = value;\n    }\n    return result;\n  }\n\n  /**\n   * Serialize a SmrtObject for a network response, excluding sensitive fields\n   * (#1540). Falls back to the value unchanged for non-SmrtObject payloads.\n   */\n  private toPublicData(object: any): any {\n    return typeof object?.toPublicJSON === 'function'\n      ? object.toPublicJSON()\n      : object;\n  }\n\n  /**\n   * Create JSON response with proper headers\n   */\n  private createJsonResponse(data: any, status = 200): Response {\n    return new Response(JSON.stringify(data), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Create error response\n   */\n  private createErrorResponse(status: number, message: string): Response {\n    return new Response(JSON.stringify({ error: message }), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Resolve the allowed `Access-Control-Allow-Origin` for a request (#1540).\n   * Returns the request's `Origin` only when it is in the configured allowlist;\n   * never `*`. Returns null when CORS should not be applied.\n   */\n  private resolveAllowedOrigin(req: Request): string | null {\n    if (!this.config.enableCors) return null;\n    const allowed = this.config.allowedOrigins;\n    if (!allowed || allowed.length === 0) return null;\n    const origin = req.headers.get('origin');\n    return origin && allowed.includes(origin) ? origin : null;\n  }\n\n  /**\n   * Create CORS preflight response\n   */\n  private createCorsResponse(req: Request): Response {\n    const headers: Record<string, string> = {\n      'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n      'Access-Control-Allow-Headers': 'Content-Type,Authorization',\n      'Access-Control-Max-Age': '86400',\n    };\n    const origin = this.resolveAllowedOrigin(req);\n    if (origin) {\n      headers['Access-Control-Allow-Origin'] = origin;\n      headers.Vary = 'Origin';\n    }\n    return new Response(null, { status: 200, headers });\n  }\n\n  /**\n   * Add CORS headers to response\n   */\n  private addCorsHeaders(response: Response, req: Request): Response {\n    const origin = this.resolveAllowedOrigin(req);\n    if (!origin) return response;\n\n    const headers = new Headers(response.headers);\n    headers.set('Access-Control-Allow-Origin', origin);\n    headers.set('Vary', 'Origin');\n    headers.set(\n      'Access-Control-Allow-Methods',\n      'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n    );\n    headers.set('Access-Control-Allow-Headers', 'Content-Type,Authorization');\n\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  /**\n   * Simple pluralization (basic implementation)\n   */\n  private pluralize(word: string): string {\n    if (word.endsWith('y')) {\n      return `${word.slice(0, -1)}ies`;\n    }\n    if (word.endsWith('s') || word.endsWith('sh') || word.endsWith('ch')) {\n      return `${word}es`;\n    }\n    return `${word}s`;\n  }\n}\n\n// REST Server Utilities\n\nexport interface RestServerConfig extends APIConfig {\n  healthCheck?: {\n    enabled?: boolean;\n    path?: string;\n    customChecks?: (() => Promise<boolean>)[];\n  };\n}\n\n/**\n * Create REST server with health checks using Bun\n */\nexport function createRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): { server: any; url: string } {\n  // Register objects if not already registered\n  objects.forEach((obj) => {\n    if (!ObjectRegistry.hasClass(obj.name)) {\n      console.warn(`Object ${obj.name} not registered with @smrt decorator`);\n    }\n  });\n\n  const generator = new APIGenerator(config, context);\n  const { server, url } = generator.createServer();\n\n  console.log(`🚀 smrt REST API server running at ${url}`);\n\n  return { server, url };\n}\n\n/**\n * Start server with graceful shutdown\n */\nexport function startRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): Promise<() => Promise<void>> {\n  return new Promise((resolve) => {\n    const { server, url } = createRestServer(objects, context, config);\n\n    // Graceful shutdown function\n    const shutdown = (): Promise<void> => {\n      return new Promise((shutdownResolve) => {\n        console.log('🛑 Shutting down server gracefully...');\n        server.stop();\n        console.log('✅ Server shut down complete');\n        shutdownResolve();\n      });\n    };\n\n    // Handle shutdown signals\n    process.on('SIGTERM', shutdown);\n    process.on('SIGINT', shutdown);\n\n    resolve(shutdown);\n  });\n}\n"],"names":["collection"],"mappings":";;AA0CO,MAAM,aAAa;AAAA,EAChB;AAAA,EACA,kCAAkB,IAAA;AAAA,EAClB;AAAA,EAER,YAAY,SAAoB,IAAI,UAAsB,CAAA,GAAI;AAC5D,SAAK,SAAS;AAAA,MACZ,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,UAAU;AAAA,MACV,GAAG;AAAA,IAAA;AAEL,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,mBAAmB,MAAc,YAAuC;AACtE,SAAK,YAAY,IAAI,MAAM,UAAU;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,eAA6C;AAC3C,UAAM,SAAS,KAAK,aAAa,OAAO,KAAK,QAAQ;AACnD,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,wBAAwB,GAAG;AACtD,cAAM,WAAW,MAAM,KAAK,cAAc,OAAO;AACjD,cAAM,KAAK,0BAA0B,UAAU,GAAG;AAAA,MACpD,SAAS,QAAQ;AACf,YAAI,aAAa;AACjB,YAAI,IAAI,uBAAuB;AAAA,MACjC;AAAA,IACF,CAAC;AAED,WAAO,OAAO,KAAK,OAAO,MAAM,KAAK,OAAO,QAAQ;AAEpD,WAAO;AAAA,MACL;AAAA,MACA,KAAK,UAAU,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,IAAI;AAAA,IAAA;AAAA,EAE3D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAe,QAA+C;AAC1E,UAAM,SAAmB,CAAA;AACzB,qBAAiB,SAAS,QAAQ;AAChC,aAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACjE;AACA,WAAO,OAAO,OAAO,MAAM,EAAE,SAAS,OAAO;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBACZ,KACkB;AAClB,UAAM,MAAM,UAAU,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,IAAI,GAAG,IAAI,GAAG;AACxE,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,UAAU,IAAI,QAAA;AAEpB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACtD,UAAI,OAAO;AACT,gBAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK;AAAA,MAC1D;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,aAAO,MAAM,KAAK,eAAe,GAAG;AAAA,IACtC;AAEA,WAAO,IAAI,QAAQ,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,0BACZ,aACA,KACe;AACf,QAAI,aAAa,YAAY;AAG7B,gBAAY,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC1C,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAGD,QAAI,YAAY,MAAM;AACpB,YAAM,SAAS,YAAY,KAAK,UAAA;AAChC,aAAO,MAAM;AACX,cAAM,EAAE,MAAM,MAAA,IAAU,MAAM,OAAO,KAAA;AACrC,YAAI,KAAM;AACV,YAAI,MAAM,KAAK;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,IAAA;AAAA,EACN;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAuD;AACrD,WAAO,CAAC,QAAQ,KAAK,cAAc,GAAG;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,KAAiC;AAC3D,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAG3B,QAAI,IAAI,WAAW,aAAa,KAAK,OAAO,YAAY;AACtD,aAAO,KAAK,mBAAmB,GAAG;AAAA,IACpC;AAGA,QAAI,KAAK,OAAO,cAAc;AAC5B,iBAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,YAAY,GAAG;AACtE,YAAI,IAAI,aAAa,GAAG,KAAK,OAAO,QAAQ,GAAG,IAAI,IAAI;AACrD,gBAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,iBAAO,KAAK,eAAe,UAAU,GAAG;AAAA,QAC1C;AAAA,MACF;AAAA,IACF;AAGA,QAAI,IAAI,SAAS,WAAW,KAAK,OAAO,YAAY,EAAE,GAAG;AACvD,YAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,GAAG;AACtD,aAAO,KAAK,eAAe,UAAU,GAAG;AAAA,IAC1C;AAGA,WAAO,KAAK,oBAAoB,KAAK,WAAW;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,KAAc,KAA6B;AACzE,UAAM,YAAY,IAAI,SACnB,QAAQ,KAAK,OAAO,YAAY,IAAI,EAAE,EACtC,MAAM,GAAG,EACT,OAAO,OAAO;AAEjB,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO,KAAK,oBAAoB,KAAK,sBAAsB;AAAA,IAC7D;AAEA,UAAM,aAAa,UAAU,CAAC;AAC9B,UAAM,WAAW,UAAU,CAAC;AAG5B,QAAI,KAAK,YAAY,IAAI,UAAU,GAAG;AACpC,YAAMA,cAAa,KAAK,YAAY,IAAI,UAAU;AAClD,UAAI,CAACA,YAAY,OAAM,IAAI,MAAM,cAAc,UAAU,YAAY;AAErE,YAAM,aAAa,KAAK,wBAAwBA,WAAU,KAAK;AAG/D,UAAI,KAAK,OAAO,gBAAgB;AAC9B,cAAM,YAAY,KAAK,OAAO;AAAA,UAC5B;AAAA,UACA,IAAI,OAAO,YAAA;AAAA,QAAY;AAEzB,cAAM,aAAa,MAAM,UAAU,GAAG;AACtC,YAAI,sBAAsB,UAAU;AAClC,iBAAO;AAAA,QACT;AAEA,cAAM;AAAA,MACR,WAAW,CAAC,KAAK,cAAc,YAAY,IAAI,MAAM,GAAG;AAGtD,eAAO,KAAK,oBAAoB,KAAK,yBAAyB;AAAA,MAChE;AAGA,aAAO,MAAM,KAAK;AAAA,QAChB;AAAA,QACAA;AAAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAGA,UAAM,oBAAoB,eAAe,cAAA;AACzC,UAAM,aAAa,KAAK,UAAU,UAAU;AAE5C,QAAI,YAAiB;AACrB,eAAW,CAAC,MAAM,IAAI,KAAK,mBAAmB;AAG5C,UAAI,KAAK,WAAW,KAAK,QAAQ,MAAM,aAAa,MAAM,YAAY;AACpE,oBAAY;AACZ;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,WAAW;AACd,aAAO,KAAK;AAAA,QACV;AAAA,QACA,gBAAgB,UAAU;AAAA,MAAA;AAAA,IAE9B;AAGA,QAAI,KAAK,OAAO,gBAAgB;AAC9B,YAAM,YAAY,KAAK,OAAO;AAAA,QAC5B,UAAU;AAAA,QACV,IAAI,OAAO,YAAA;AAAA,MAAY;AAEzB,YAAM,aAAa,MAAM,UAAU,GAAG;AACtC,UAAI,sBAAsB,UAAU;AAClC,eAAO;AAAA,MACT;AAEA,YAAM;AAAA,IACR,WAAW,CAAC,KAAK,cAAc,UAAU,MAAM,IAAI,MAAM,GAAG;AAE1D,aAAO,KAAK,oBAAoB,KAAK,yBAAyB;AAAA,IAChE;AAGA,UAAM,aAAa,KAAK,cAAc,SAAS;AAE/C,WAAO,MAAM,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU;AAAA,IAAA;AAAA,EAEd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,qBACZ,KACA,YACA,UACA,KACA,YACmB;AACnB,QAAI;AACF,YAAM,SAAS,KAAK,cAAc,IAAI,QAAQ,QAAQ;AACtD,UAAI,UAAU,CAAC,KAAK,mBAAmB,YAAY,MAAM,GAAG;AAC1D,eAAO,KAAK,oBAAoB,KAAK,oBAAoB;AAAA,MAC3D;AAGA,UAAI,aAAa,WAAW,IAAI,WAAW,OAAO;AAChD,eAAO,MAAM,KAAK,YAAY,YAAY,IAAI,YAAY;AAAA,MAC5D;AAGA,cAAQ,IAAI,QAAA;AAAA,QACV,KAAK;AACH,iBAAO,WACH,MAAM,KAAK,UAAU,YAAY,QAAQ,IACzC,MAAM,KAAK,WAAW,YAAY,IAAI,YAAY;AAAA,QAExD,KAAK;AACH,iBAAO,MAAM,KAAK,aAAa,YAAY,KAAK,UAAU;AAAA,QAE5D,KAAK;AAAA,QACL,KAAK;AACH,cAAI,CAAC,UAAU;AACb,mBAAO,KAAK;AAAA,cACV;AAAA,cACA;AAAA,YAAA;AAAA,UAEJ;AACA,iBAAO,MAAM,KAAK,aAAa,YAAY,UAAU,KAAK,UAAU;AAAA,QAEtE,KAAK;AACH,cAAI,CAAC,UAAU;AACb,mBAAO,KAAK;AAAA,cACV;AAAA,cACA;AAAA,YAAA;AAAA,UAEJ;AACA,iBAAO,MAAM,KAAK,aAAa,YAAY,QAAQ;AAAA,QAErD;AACE,iBAAO,KAAK,oBAAoB,KAAK,oBAAoB;AAAA,MAAA;AAAA,IAE/D,SAAS,OAAO;AACd,cAAQ,MAAM,cAAc,KAAK;AACjC,aAAO,KAAK,oBAAoB,KAAK,uBAAuB;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,cACN,QACA,UACwD;AACxD,YAAQ,QAAA;AAAA,MACN,KAAK;AACH,eAAO,YAAY,aAAa,UAAU,QAAQ;AAAA,MACpD,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IAAA;AAAA,EAEb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cACN,YACA,QACS;AACT,QAAI,CAAC,WAAY,QAAO;AACxB,UAAM,YAAY,eAAe,UAAU,UAAU,GAAG;AACxD,QAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,UAAM,eAAgB,UAA4C;AAClE,QAAI,iBAAiB,KAAM,QAAO;AAClC,QAAI,iBAAiB,OAAQ,QAAO,OAAO,kBAAkB;AAC7D,WAAO;AAAA,EACT;AAAA,EAEQ,mBACN,YACA,QACS;AACT,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,eAAe,UAAU,UAAU;AAClD,UAAM,YAAY,OAAO;AAEzB,QAAI,cAAc,OAAO;AACvB,aAAO;AAAA,IACT;AAEA,QAAI,aAAa,OAAO,cAAc,UAAU;AAC9C,UAAI,UAAU,WAAW,CAAC,UAAU,QAAQ,SAAS,MAAM,GAAG;AAC5D,eAAO;AAAA,MACT;AAEA,UAAI,UAAU,SAAS,SAAS,MAAM,GAAG;AACvC,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,wBACN,YACoB;AACpB,UAAM,YACH,WAAmB,cACnB,WAAW,aAAqB;AAEnC,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,eAAe,sBAAsB,SAAS;AACjE,WAAO,YAAY,iBAAiB,YAAY,QAAQ,UAAU;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,UACZ,YACA,IACmB;AACnB,UAAM,SAAS,MAAM,WAAW,IAAI,EAAE;AACtC,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,oBAAoB,KAAK,kBAAkB;AAAA,IACzD;AACA,WAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,CAAC;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WACZ,YACA,QACmB;AACnB,UAAM,QAAQ,OAAO,SAAS,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE;AAC7D,UAAM,SAAS,OAAO,SAAS,OAAO,IAAI,QAAQ,KAAK,KAAK,EAAE;AAC9D,UAAM,UAAU,OAAO,IAAI,SAAS,KAAK;AAIzC,UAAM,QAAa,CAAA;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,WAAW;AAC3C,UAAI,CAAC,CAAC,SAAS,UAAU,SAAS,EAAE,SAAS,GAAG,GAAG;AAEjD,cAAM,QAAQ,IAAI,MAAM,gBAAgB;AACxC,YAAI,OAAO;AACT,gBAAM,QAAQ,MAAM,CAAC;AACrB,gBAAM,WAAW,MAAM,CAAC;AAExB,gBAAM,cAAsC;AAAA,YAC1C,IAAI;AAAA,YACJ,KAAK;AAAA,YACL,IAAI;AAAA,YACJ,KAAK;AAAA,YACL,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ,MAAM;AAAA,UAAA;AAER,gBAAM,cAAc,YAAY,QAAQ,KAAK;AAC7C,gBAAM,SAAS,GAAG,KAAK,IAAI,WAAW;AAEtC,gBAAM,MAAM,IAAI,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;AAAA,QACzD,OAAO;AACL,gBAAM,GAAG,IAAI;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,WAAW,KAAK;AAAA,MACpC,OAAO,OAAO,KAAK,KAAK,EAAE,SAAS,IAAI,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AAED,WAAO,KAAK;AAAA,MACV,QAAQ,IAAI,CAAC,WAAgB,KAAK,aAAa,MAAM,CAAC;AAAA,IAAA;AAAA,EAE1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YACZ,YACA,QACmB;AAEnB,UAAM,QAAa,CAAA;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,WAAW;AAE3C,YAAM,QAAQ,IAAI,MAAM,gBAAgB;AACxC,UAAI,OAAO;AACT,cAAM,QAAQ,MAAM,CAAC;AACrB,cAAM,WAAW,MAAM,CAAC;AAExB,cAAM,cAAsC;AAAA,UAC1C,IAAI;AAAA,UACJ,KAAK;AAAA,UACL,IAAI;AAAA,UACJ,KAAK;AAAA,UACL,IAAI;AAAA,UACJ,IAAI;AAAA,UACJ,MAAM;AAAA,QAAA;AAER,cAAM,cAAc,YAAY,QAAQ,KAAK;AAC7C,cAAM,SAAS,GAAG,KAAK,IAAI,WAAW;AAEtC,cAAM,MAAM,IAAI,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;AAAA,MACzD,OAAO;AACL,cAAM,GAAG,IAAI;AAAA,MACf;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,WAAW,MAAM;AAAA,MACnC,OAAO,OAAO,KAAK,KAAK,EAAE,SAAS,IAAI,QAAQ;AAAA,IAAA,CAChD;AAED,WAAO,KAAK,mBAAmB,EAAE,OAAO;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,aACZ,YACA,KACA,YACmB;AACnB,UAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,MAAM;AAClE,UAAM,SAAS,MAAM,WAAW,OAAO,EAAE,GAAG,MAAM,WAAW,MAAM;AACnE,UAAM,OAAO,KAAA;AACb,WAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,GAAG,GAAG;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,aACZ,YACA,IACA,KACA,YACmB;AACnB,UAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,MAAM;AAClE,UAAM,SAAS,MAAM,WAAW,IAAI,EAAE;AAEtC,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,oBAAoB,KAAK,kBAAkB;AAAA,IACzD;AAGA,WAAO,OAAO,QAAQ,IAAI;AAC1B,UAAM,OAAO,KAAA;AAEb,WAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,CAAC;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,aACZ,YACA,IACmB;AACnB,UAAM,SAAS,MAAM,WAAW,IAAI,EAAE;AAEtC,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,oBAAoB,KAAK,kBAAkB;AAAA,IACzD;AAEA,UAAM,OAAO,OAAA;AACb,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,WAAqC;AACzD,QAAI,CAAC,KAAK,YAAY,IAAI,UAAU,IAAI,GAAG;AACzC,YAAMA,cAAa,IAAI,UAAU,sBAAsB;AAAA,QACrD,IAAI,KAAK,QAAQ;AAAA,QACjB,IAAI,KAAK,QAAQ;AAAA,MAAA,CAClB;AACD,WAAK,YAAY,IAAI,UAAU,MAAMA,WAAU;AAAA,IACjD;AACA,UAAM,aAAa,KAAK,YAAY,IAAI,UAAU,IAAI;AACtD,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,cAAc,UAAU,IAAI,YAAY;AACzE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,oBACN,YACA,MACqB;AACrB,QAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,aAAO,CAAA;AAAA,IACT;AAEA,UAAM,oCAAoB,IAAI;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AAED,UAAM,+BAAe,IAAA;AACrB,QAAI,WAA4B;AAEhC,QAAI,YAAY;AACd,YAAM,YAAY,eAAe,UAAU,UAAU,GAAG;AACxD,UACE,aACA,OAAO,cAAc,YACrB,MAAM,QAAS,UAAqC,QAAQ,GAC5D;AACA,mBAAY,UAAqC;AAAA,MACnD;AAEA,iBAAW,CAAC,MAAM,GAAG,KAAK,eAAe,UAAU,UAAU,GAAG;AAC9D,YAAI,QAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,aAAa,OAAO;AAClE,mBAAS,IAAI,IAAI;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAA8B,CAAA;AACpC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,UAAI,IAAI,WAAW,GAAG,EAAG;AACzB,UAAI,cAAc,IAAI,GAAG,EAAG;AAC5B,UAAI,SAAS,IAAI,GAAG,EAAG;AACvB,UAAI,YAAY,CAAC,SAAS,SAAS,GAAG,EAAG;AACzC,aAAO,GAAG,IAAI;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,QAAkB;AACrC,WAAO,OAAO,QAAQ,iBAAiB,aACnC,OAAO,iBACP;AAAA,EACN;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAmB,MAAW,SAAS,KAAe;AAC5D,WAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,MACxC;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,MAAA;AAAA,IAClB,CACD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,oBAAoB,QAAgB,SAA2B;AACrE,WAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,QAAA,CAAS,GAAG;AAAA,MACtD;AAAA,MACA,SAAS;AAAA,QACP,gBAAgB;AAAA,MAAA;AAAA,IAClB,CACD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,qBAAqB,KAA6B;AACxD,QAAI,CAAC,KAAK,OAAO,WAAY,QAAO;AACpC,UAAM,UAAU,KAAK,OAAO;AAC5B,QAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAC7C,UAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;AACvC,WAAO,UAAU,QAAQ,SAAS,MAAM,IAAI,SAAS;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAAmB,KAAwB;AACjD,UAAM,UAAkC;AAAA,MACtC,gCAAgC;AAAA,MAChC,gCAAgC;AAAA,MAChC,0BAA0B;AAAA,IAAA;AAE5B,UAAM,SAAS,KAAK,qBAAqB,GAAG;AAC5C,QAAI,QAAQ;AACV,cAAQ,6BAA6B,IAAI;AACzC,cAAQ,OAAO;AAAA,IACjB;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,UAAoB,KAAwB;AACjE,UAAM,SAAS,KAAK,qBAAqB,GAAG;AAC5C,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;AAC5C,YAAQ,IAAI,+BAA+B,MAAM;AACjD,YAAQ,IAAI,QAAQ,QAAQ;AAC5B,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IAAA;AAEF,YAAQ,IAAI,gCAAgC,4BAA4B;AAExE,WAAO,IAAI,SAAS,SAAS,MAAM;AAAA,MACjC,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB;AAAA,IAAA,CACD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,UAAU,MAAsB;AACtC,QAAI,KAAK,SAAS,GAAG,GAAG;AACtB,aAAO,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA,IAC7B;AACA,QAAI,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG;AACpE,aAAO,GAAG,IAAI;AAAA,IAChB;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACF;AAeO,SAAS,iBACd,SACA,UAAsB,CAAA,GACtB,SAA2B,CAAA,GACG;AAE9B,UAAQ,QAAQ,CAAC,QAAQ;AACvB,QAAI,CAAC,eAAe,SAAS,IAAI,IAAI,GAAG;AACtC,cAAQ,KAAK,UAAU,IAAI,IAAI,sCAAsC;AAAA,IACvE;AAAA,EACF,CAAC;AAED,QAAM,YAAY,IAAI,aAAa,QAAQ,OAAO;AAClD,QAAM,EAAE,QAAQ,QAAQ,UAAU,aAAA;AAElC,UAAQ,IAAI,sCAAsC,GAAG,EAAE;AAEvD,SAAO,EAAE,QAAQ,IAAA;AACnB;AAKO,SAAS,gBACd,SACA,UAAsB,CAAA,GACtB,SAA2B,CAAA,GACG;AAC9B,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,EAAE,QAAQ,IAAA,IAAQ,iBAAiB,SAAS,SAAS,MAAM;AAGjE,UAAM,WAAW,MAAqB;AACpC,aAAO,IAAI,QAAQ,CAAC,oBAAoB;AACtC,gBAAQ,IAAI,uCAAuC;AACnD,eAAO,KAAA;AACP,gBAAQ,IAAI,6BAA6B;AACzC,wBAAA;AAAA,MACF,CAAC;AAAA,IACH;AAGA,YAAQ,GAAG,WAAW,QAAQ;AAC9B,YAAQ,GAAG,UAAU,QAAQ;AAE7B,YAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;"}