@nextsparkjs/core 0.1.0-beta.194 → 0.1.0-beta.196

package/dist/lib/api/auth.js

@@ -1,22 +1,19 @@
 import { queryOne } from "../db.js";
-import { ApiKeyManager } from "./keys.js";
+import { ApiKeyManager, presentedApiKey } from "./keys.js";
 import { apiKeyCache, getCacheKey } from "./cache.js";
 import { TeamMemberService } from "../services/team-member.service.js";
 import { ScopeService } from "../services/scope.service.js";
 function hasScope(auth, requiredScope) {
   return auth.scopes.includes(requiredScope);
 }
+const validatedKeys = /* @__PURE__ */ new WeakMap();
+function getValidatedApiKey(request) {
+  return validatedKeys.get(request) ?? null;
+}
 async function validateApiKey(request) {
   const startTime = Date.now();
   try {
-    const authHeader = request.headers.get("Authorization");
-    const xApiKeyHeader = request.headers.get("x-api-key");
-    let apiKey = null;
-    if (authHeader == null ? void 0 : authHeader.startsWith("Bearer ")) {
-      apiKey = authHeader.substring(7);
-    } else if (xApiKeyHeader) {
-      apiKey = xApiKeyHeader;
-    }
+    const apiKey = presentedApiKey(request.headers);
     if (!apiKey) {
       await constantTimeDelay(startTime);
       return null;
@@ -72,11 +69,13 @@ async function validateApiKey(request) {
     updateLastUsed(keyData.id).catch((error) => {
       console.error("Error updating API key last used:", error);
     });
-    return {
+    const validated = {
       userId: keyData.userId,
       keyId: keyData.id,
       scopes: keyData.scopes || []
     };
+    validatedKeys.set(request, validated);
+    return validated;
   } catch (error) {
     console.error("Error validating API key:", error);
     await constantTimeDelay(startTime);
@@ -245,6 +244,7 @@ async function validateScopesForUser(userId, teamId, requestedScopes) {
 export {
   canCreateApiKeys,
   getApiKeyUser,
+  getValidatedApiKey,
   hasAllScopes,
   hasAnyScope,
   hasScope,

package/dist/lib/api/client-headers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The custom request headers core's own clients send to /api. The clients set them by these names and
+ * CORS_ALLOW_HEADERS (cors-response.ts) is built from this list, so a listed origin's preflight allows
+ * every header core's clients send. Client-safe: no imports.
+ */
+export declare const TEAM_ID_HEADER = "x-team-id";
+export declare const BUILDER_SOURCE_HEADER = "x-builder-source";
+export declare const SIGNUP_INTENT_HEADER = "x-signup-intent";
+export declare const VERIFY_FROM_UI_HEADER = "x-verify-from-ui";
+export declare const CLIENT_REQUEST_HEADERS: readonly ["x-team-id", "x-builder-source", "x-signup-intent", "x-verify-from-ui"];
+//# sourceMappingURL=client-headers.d.ts.map

package/dist/lib/api/client-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-headers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/client-headers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc,cAAc,CAAA;AACzC,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AACvD,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AACrD,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AAEvD,eAAO,MAAM,sBAAsB,mFAAgG,CAAA"}

package/dist/lib/api/client-headers.js

@@ -0,0 +1,12 @@
+const TEAM_ID_HEADER = "x-team-id";
+const BUILDER_SOURCE_HEADER = "x-builder-source";
+const SIGNUP_INTENT_HEADER = "x-signup-intent";
+const VERIFY_FROM_UI_HEADER = "x-verify-from-ui";
+const CLIENT_REQUEST_HEADERS = [TEAM_ID_HEADER, BUILDER_SOURCE_HEADER, SIGNUP_INTENT_HEADER, VERIFY_FROM_UI_HEADER];
+export {
+  BUILDER_SOURCE_HEADER,
+  CLIENT_REQUEST_HEADERS,
+  SIGNUP_INTENT_HEADER,
+  TEAM_ID_HEADER,
+  VERIFY_FROM_UI_HEADER
+};

package/dist/lib/api/client-ip.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The client address of a request: the one place that decides it, for rate limits, audit logs,
+ * security notifications and every other reader in core.
+ *
+ * Which header can be trusted depends on what sits in front of the app, so the deployment names it:
+ *
+ *   NEXTSPARK_CLIENT_IP_SOURCE=vercel         x-vercel-forwarded-for, then x-real-ip (set by Vercel)
+ *   NEXTSPARK_CLIENT_IP_SOURCE=cloudflare     cf-connecting-ip (set by Cloudflare)
+ *   NEXTSPARK_CLIENT_IP_SOURCE=header:<name>  one header that your proxy sets, e.g. header:x-real-ip
+ *   NEXTSPARK_CLIENT_IP_SOURCE=xff            X-Forwarded-For, counting NEXTSPARK_TRUSTED_PROXY_HOPS
+ *                                             (default 1) trusted proxies from the right
+ *   NEXTSPARK_CLIENT_IP_SOURCE=none           no client address: every request shares one bucket
+ *
+ * Unset keeps the order core always used (cf-connecting-ip, rightmost X-Forwarded-For, x-real-ip,
+ * true-client-ip), and production logs one warning saying what to set. Next.js gives route handlers
+ * no socket address, so 'none' cannot fall back to one.
+ * What to set per deployment: the upgrade note in CHANGELOG.md, and https://nextspark.dev/docs.
+ */
+export declare const UNKNOWN_CLIENT_IP = "unknown";
+export type ClientIpSource = {
+    kind: 'default';
+} | {
+    kind: 'vercel';
+} | {
+    kind: 'cloudflare';
+} | {
+    kind: 'header';
+    header: string;
+} | {
+    kind: 'xff';
+    hops: number;
+} | {
+    kind: 'none';
+};
+type Env = Record<string, string | undefined>;
+/** Reads the setting. Throws on a value it does not understand: a typo must not silently trust a header. */
+export declare function getClientIpSource(env?: Env): ClientIpSource;
+/** The client address of a request, from the source the deployment configured (getClientIpSource). */
+export declare function getClientIp(headers: Headers, env?: Env): string;
+/**
+ * getClientIp for readers that only record the address (audit rows, the new-device fingerprint): an invalid
+ * setting records UNKNOWN_CLIENT_IP instead of throwing, so the row is still written. Rate limits use getClientIp,
+ * which throws.
+ */
+export declare function getRecordedClientIp(headers: Headers, env?: Env): string;
+/**
+ * The headers Better Auth's own rate limiter should read (advanced.ipAddress.ipAddressHeaders), or undefined
+ * to keep its default. Better Auth trusts only a single-valued header, so 'xff' keeps its default; 'none' names no
+ * header, so Better Auth counts every request to a path in one shared bucket.
+ */
+export declare function getBetterAuthIpHeaders(env?: Env): string[] | undefined;
+/**
+ * Logs once per process when the client address source is invalid (in every environment) or, in production
+ * only, not set. Called at server start (logAuthReadinessAtStartup) and again on first use, for projects whose
+ * instrumentation does not run it; the flag lives on globalThis so both bundles share it.
+ */
+export declare function warnClientIpSourceAtStartup(env?: Env): void;
+export {};
+//# sourceMappingURL=client-ip.d.ts.map

package/dist/lib/api/client-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.d.ts","sourceRoot":"","sources":["../../../src/lib/api/client-ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,iBAAiB,YAAY,CAAA;AAE1C,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAI7C,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,GAAiB,GAAG,cAAc,CAiBxE;AAWD,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,GAAiB,GAAG,MAAM,CA2B5E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,GAAiB,GAAG,MAAM,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,EAAE,GAAG,SAAS,CAWnF;AAID;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,GAAiB,GAAG,IAAI,CAkBxE"}

package/dist/lib/api/client-ip.js

@@ -0,0 +1,91 @@
+const UNKNOWN_CLIENT_IP = "unknown";
+const HEADER_NAME = /^[a-z0-9!#$%&'*+.^_`|~-]+$/;
+function getClientIpSource(env = process.env) {
+  var _a, _b;
+  const raw = (_a = env.NEXTSPARK_CLIENT_IP_SOURCE) == null ? void 0 : _a.trim().toLowerCase();
+  if (!raw) return { kind: "default" };
+  if (raw === "vercel" || raw === "cloudflare" || raw === "none") return { kind: raw };
+  if (raw === "xff") {
+    const hopsRaw = ((_b = env.NEXTSPARK_TRUSTED_PROXY_HOPS) == null ? void 0 : _b.trim()) || "1";
+    const hops = Number(hopsRaw);
+    if (!/^\d+$/.test(hopsRaw) || hops < 1) {
+      throw new Error("[client-ip] NEXTSPARK_TRUSTED_PROXY_HOPS must be a whole number of 1 or more");
+    }
+    return { kind: "xff", hops };
+  }
+  if (raw.startsWith("header:")) {
+    const header = raw.slice("header:".length).trim();
+    if (HEADER_NAME.test(header)) return { kind: "header", header };
+  }
+  throw new Error("[client-ip] NEXTSPARK_CLIENT_IP_SOURCE must be vercel, cloudflare, xff, none or header:<name>");
+}
+function entries(value) {
+  return value ? value.split(",").map((ip) => ip.trim()).filter(Boolean) : [];
+}
+function lastEntry(value) {
+  return entries(value).at(-1) ?? null;
+}
+function getClientIp(headers, env = process.env) {
+  warnClientIpSourceAtStartup(env);
+  const source = getClientIpSource(env);
+  switch (source.kind) {
+    case "vercel":
+      return lastEntry(headers.get("x-vercel-forwarded-for")) ?? lastEntry(headers.get("x-real-ip")) ?? UNKNOWN_CLIENT_IP;
+    case "cloudflare":
+      return lastEntry(headers.get("cf-connecting-ip")) ?? UNKNOWN_CLIENT_IP;
+    case "header":
+      return lastEntry(headers.get(source.header)) ?? UNKNOWN_CLIENT_IP;
+    case "xff": {
+      const ips = entries(headers.get("x-forwarded-for"));
+      return ips.length >= source.hops ? ips[ips.length - source.hops] : UNKNOWN_CLIENT_IP;
+    }
+    case "none":
+      return UNKNOWN_CLIENT_IP;
+    default:
+      return headers.get("cf-connecting-ip") || lastEntry(headers.get("x-forwarded-for")) || headers.get("x-real-ip") || headers.get("true-client-ip") || UNKNOWN_CLIENT_IP;
+  }
+}
+function getRecordedClientIp(headers, env = process.env) {
+  try {
+    return getClientIp(headers, env);
+  } catch {
+    return UNKNOWN_CLIENT_IP;
+  }
+}
+function getBetterAuthIpHeaders(env = process.env) {
+  try {
+    const source = getClientIpSource(env);
+    if (source.kind === "vercel") return ["x-vercel-forwarded-for", "x-real-ip"];
+    if (source.kind === "cloudflare") return ["cf-connecting-ip"];
+    if (source.kind === "header") return [source.header];
+    if (source.kind === "none") return [];
+  } catch {
+  }
+  return void 0;
+}
+const WARNED = /* @__PURE__ */ Symbol.for("nextspark.clientIpSourceWarned");
+function warnClientIpSourceAtStartup(env = process.env) {
+  const state = globalThis;
+  if (state[WARNED]) return;
+  let source;
+  try {
+    source = getClientIpSource(env);
+  } catch (error) {
+    state[WARNED] = true;
+    console.error(error.message);
+    return;
+  }
+  if (source.kind !== "default" || env.NODE_ENV !== "production") return;
+  state[WARNED] = true;
+  console.warn(
+    "[client-ip] NEXTSPARK_CLIENT_IP_SOURCE is not set, so rate limits and audit logs read the client address from request headers in a fixed order. Set it for your deployment: vercel, cloudflare, xff (with NEXTSPARK_TRUSTED_PROXY_HOPS) or header:<name>; none if nothing in front sets a client address."
+  );
+}
+export {
+  UNKNOWN_CLIENT_IP,
+  getBetterAuthIpHeaders,
+  getClientIp,
+  getClientIpSource,
+  getRecordedClientIp,
+  warnClientIpSourceAtStartup
+};

package/dist/lib/api/cors-response.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Core's CORS answer for /api responses, in one place: addCorsHeaders and wrapAuthHandlerWithCors (helpers.ts)
+ * and the common route wrapper (withRateLimitTier) all use it, so every response and preflight a route gives
+ * names the same origin, with or without credentials, for the same request.
+ */
+import { NextResponse } from 'next/server';
+import type { ApplicationConfig } from '../config/config-types';
+type CorsConfig = Pick<ApplicationConfig, 'api'>;
+export declare const CORS_ALLOW_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
+export declare const CORS_ALLOW_HEADERS: string;
+/**
+ * True for a path under the admin or developer areas, which answer CORS only to the app's own origin and accept
+ * cookie-authenticated writes only from it (checkRequestOrigin).
+ */
+export declare function isAppOnlyCorsPath(pathname: string): boolean;
+/** A request's path, for corsGrant (undefined when its URL does not parse, which corsGrant treats as app-only). */
+export declare function requestPathname(request: Request): string | undefined;
+/** The app's own origins: NEXT_PUBLIC_APP_URL and BETTER_AUTH_URL. */
+export declare function appOrigins(): string[];
+/**
+ * Which origin a CORS response may name, and whether credentials go with it.
+ * A listed origin (getCorsOrigins, wildcard entries allowed) is echoed with
+ * credentials. In development with allowAllOrigins.development, any other
+ * origin is echoed too, but with credentials only when the cookie-write origin
+ * check trusts it (getTrustedOrigins). Any other origin gets no grant: the
+ * response names no origin and sends no credentials header.
+ * Under the admin and developer areas (isAppOnlyCorsPath, given the request's
+ * `pathname`), only the app's own origin is granted, with credentials; no
+ * other origin, listed or not. A `pathname` that is undefined (not known)
+ * gets the same answer as those areas.
+ */
+export declare function corsGrant(origin: string, config: CorsConfig, env: string, pathname?: string): {
+    origin: string;
+    credentials: boolean;
+} | null;
+/** `Vary: Origin` once, however many times CORS is applied to the same response. */
+export declare function varyOnOrigin(headers: Headers): void;
+/** Core's CORS headers for a request's grant (corsGrant; null for none), written onto `headers`. */
+export declare function setCorsHeaders(headers: Headers, grant: {
+    origin: string;
+    credentials: boolean;
+} | null): void;
+/**
+ * `response` with core's CORS for `request`. A response that already names an origin was answered by its
+ * route (addCorsHeaders, or a CORS policy of its own) and is returned as it is. A response with read-only
+ * headers is copied first.
+ */
+export declare function withCors<R extends Response>(response: R, request: Request): R;
+/**
+ * A CORS preflight answered with the same grant the route's responses get. Routes export it as their
+ * `OPTIONS`: without one, Next.js answers OPTIONS itself, with no CORS headers.
+ */
+export declare function corsPreflight(request: Request): NextResponse;
+export {};
+//# sourceMappingURL=cors-response.d.ts.map

package/dist/lib/api/cors-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-response.d.ts","sourceRoot":"","sources":["../../../src/lib/api/cors-response.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG/D,KAAK,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;AAEhD,eAAO,MAAM,kBAAkB,2CAA2C,CAAA;AAC1E,eAAO,MAAM,kBAAkB,QAAuF,CAAA;AAKtH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED,mHAAmH;AACnH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,UAAU,IAAI,MAAM,EAAE,CAKrC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAYjD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAGnD;AAED,oGAAoG;AACpG,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GACrD,IAAI,CAWN;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAa7E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAE5D"}

package/dist/lib/api/cors-response.js

@@ -0,0 +1,90 @@
+import { NextResponse } from "next/server";
+import { APP_CONFIG_MERGED } from "../config/index.js";
+import { getCorsOrigins, getTrustedOrigins, isOriginAllowed, normalizeOrigin } from "../utils/cors.js";
+import { CLIENT_REQUEST_HEADERS } from "./client-headers.js";
+const CORS_ALLOW_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
+const CORS_ALLOW_HEADERS = ["Content-Type", "Authorization", "X-API-Key", ...CLIENT_REQUEST_HEADERS].join(", ");
+const APP_ONLY_PATH = /(^|\/)api\/(v1\/)?(superadmin|devtools)(\/|$)/;
+function isAppOnlyCorsPath(pathname) {
+  const path = pathname.split("/").map((segment) => {
+    try {
+      return decodeURIComponent(segment);
+    } catch {
+      return segment;
+    }
+  }).join("/");
+  return APP_ONLY_PATH.test(path.toLowerCase().replace(/\/{2,}/g, "/"));
+}
+function requestPathname(request) {
+  try {
+    return new URL(request.url).pathname;
+  } catch {
+    return void 0;
+  }
+}
+function appOrigins() {
+  return [process.env.NEXT_PUBLIC_APP_URL, process.env.BETTER_AUTH_URL].flatMap((url) => {
+    if (!url) return [];
+    try {
+      return [new URL(url).origin];
+    } catch {
+      return [];
+    }
+  });
+}
+function corsGrant(origin, config, env, pathname) {
+  const normalizedOrigin = normalizeOrigin(origin);
+  if (pathname === void 0 || isAppOnlyCorsPath(pathname)) {
+    return appOrigins().includes(normalizedOrigin) ? { origin: normalizedOrigin, credentials: true } : null;
+  }
+  const listed = isOriginAllowed(normalizedOrigin, getCorsOrigins(config, env));
+  if (listed) return { origin: listed, credentials: true };
+  if (env === "development" && config.api.cors.allowAllOrigins.development) {
+    const trusted = isOriginAllowed(normalizedOrigin, getTrustedOrigins(config, normalizedOrigin, env));
+    return { origin: normalizedOrigin, credentials: trusted !== null };
+  }
+  return null;
+}
+function varyOnOrigin(headers) {
+  const vary = headers.get("vary") ?? "";
+  if (!vary.split(",").some((value) => value.trim().toLowerCase() === "origin")) headers.set("Vary", vary ? `${vary}, Origin` : "Origin");
+}
+function setCorsHeaders(headers, grant) {
+  if (grant) {
+    headers.set("Access-Control-Allow-Origin", grant.origin);
+    if (grant.credentials) headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  varyOnOrigin(headers);
+  headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
+  headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
+  headers.set("Access-Control-Max-Age", "86400");
+}
+function withCors(response, request) {
+  if (response.headers.has("access-control-allow-origin")) return response;
+  const origin = request.headers.get("origin");
+  const env = process.env.NODE_ENV || "development";
+  const grant = origin ? corsGrant(origin, APP_CONFIG_MERGED, env, requestPathname(request)) : null;
+  try {
+    setCorsHeaders(response.headers, grant);
+    return response;
+  } catch {
+    const copy = new Response(response.body, { status: response.status, statusText: response.statusText, headers: new Headers(response.headers) });
+    setCorsHeaders(copy.headers, grant);
+    return copy;
+  }
+}
+function corsPreflight(request) {
+  return withCors(new NextResponse(null, { status: 204 }), request);
+}
+export {
+  CORS_ALLOW_HEADERS,
+  CORS_ALLOW_METHODS,
+  appOrigins,
+  corsGrant,
+  corsPreflight,
+  isAppOnlyCorsPath,
+  requestPathname,
+  setCorsHeaders,
+  varyOnOrigin,
+  withCors
+};

package/dist/lib/api/entities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../../src/lib/api/entities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;QACpB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KACtB,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,mBAAmB,EAAE,aAAa,EAAE,CAAA;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AA2CD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAQ;gBAEX,OAAO,SAAY;IAI/B;;;OAGG;YACW,eAAe;IAoC7B;;OAEG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+D1F;;OAEG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAuCnF;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkClH;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAoC5F;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAqCvF;;;OAGG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA+B3G;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB9D;;OAEG;YACW,mBAAmB;IA6BjC;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA+CrE;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAsBrE;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAsB3F;;OAEG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiBpE;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAK7B;AAGD,eAAO,MAAM,SAAS,iBAAwB,CAAA;AAG9C,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,MAAM,UAAU,wBAE1E,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,wBAE/F,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM;aArRF,OAAO;QAAM,MAAM;EAuRrF,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,qBAAmB,wBAEtF,CAAA;AAED,eAAO,MAAM,cAAc,GAAU,YAAY,MAAM,EAAE,SAAQ,gBAAqB,gCAErF,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,wBAEvE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,kBAAkB,MAAM,EACxB,UAAU,MAAM,EAChB,iBAAiB,MAAM,EACvB,SAAQ,gBAAqB,KAC5B,OAAO,CAAC,UAAU,EAAE,CA2BtB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../../src/lib/api/entities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;QACpB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KACtB,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAA;IACb,IAAI,EAAE,UAAU,EAAE,CAAA;IAClB,KAAK,EAAE,WAAW,CAAA;IAClB,mBAAmB,EAAE,aAAa,EAAE,CAAA;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AA2CD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAQ;gBAEX,OAAO,SAAY;IAI/B;;;OAGG;YACW,eAAe;IAoC7B;;OAEG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA+D1F;;OAEG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAuCnF;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkClH;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAoC5F;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAqCvF;;;OAGG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA+B3G;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB9D;;OAEG;YACW,mBAAmB;IA6BjC;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA+CrE;;OAEG;IACG,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAsBrE;;OAEG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAsB3F;;OAEG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiBpE;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAK7B;AAGD,eAAO,MAAM,SAAS,iBAAwB,CAAA;AAG9C,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,MAAM,UAAU,wBAE1E,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,wBAE/F,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM;aArRF,OAAO;QAAM,MAAM;EAuRrF,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,EAAE,qBAAmB,wBAEtF,CAAA;AAED,eAAO,MAAM,cAAc,GAAU,YAAY,MAAM,EAAE,SAAQ,gBAAqB,gCAErF,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAU,YAAY,MAAM,EAAE,IAAI,MAAM,wBAEvE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,kBAAkB,MAAM,EACxB,UAAU,MAAM,EAChB,iBAAiB,MAAM,EACvB,SAAQ,gBAAqB,KAC5B,OAAO,CAAC,UAAU,EAAE,CA2BtB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}

package/dist/lib/api/entities.js

@@ -1,5 +1,6 @@
 import { getClientEntityApiPath, getClientEntityConfigs } from "../entities/client-entity-meta.js";
 import { withBasePath, withBasePathIfInApp } from "../base-path.js";
+import { BUILDER_SOURCE_HEADER, TEAM_ID_HEADER } from "./client-headers.js";
 function getApiBaseUrl() {
   if (typeof window !== "undefined") {
     return window.location.origin;
@@ -20,7 +21,7 @@ function buildHeaders(additionalHeaders = {}) {
   };
   const teamId = getCurrentTeamId();
   if (teamId) {
-    headers["x-team-id"] = teamId;
+    headers[TEAM_ID_HEADER] = teamId;
   }
   return headers;
 }
@@ -418,7 +419,7 @@ class EntityApiClient {
     delete copyData.createdAt;
     delete copyData.updatedAt;
     const hasBlocks = "blocks" in copyData && Array.isArray(copyData.blocks);
-    return this.create(entityType, copyData, hasBlocks ? { "x-builder-source": "true" } : {});
+    return this.create(entityType, copyData, hasBlocks ? { [BUILDER_SOURCE_HEADER]: "true" } : {});
   }
   /**
    * Detect if entity has custom override (client-side detection)
@@ -474,7 +475,7 @@ async function fetchWithTeam(url, options = {}) {
     headers.set("Content-Type", "application/json");
   }
   if (activeTeamId) {
-    headers.set("x-team-id", activeTeamId);
+    headers.set(TEAM_ID_HEADER, activeTeamId);
   }
   return fetch(withBasePathIfInApp(url), {
     ...options,

package/dist/lib/api/entity/audit-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;CAC5B;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,EAC3B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAqDf"}
+{"version":3,"file":"audit-log.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;CAC5B;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,cAAc,GAAG,IAAI,EAC3B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAqDf"}

package/dist/lib/api/entity/audit-log.js

@@ -1,4 +1,5 @@
 import { mutateWithRLS } from "../../db.js";
+import { getRecordedClientIp } from "../client-ip.js";
 async function logGenericHandlerUsage(auth, request, statusCode, responseTime) {
   var _a;
   const userId = (_a = auth == null ? void 0 : auth.user) == null ? void 0 : _a.id;
@@ -9,7 +10,7 @@ async function logGenericHandlerUsage(auth, request, statusCode, responseTime) {
   try {
     endpoint = request.nextUrl.pathname;
     method = request.method;
-    const ipAddress = request.headers.get("x-forwarded-for") || request.headers.get("x-real-ip") || "unknown";
+    const ipAddress = getRecordedClientIp(request.headers);
     const userAgent = request.headers.get("user-agent");
     await mutateWithRLS(
       `INSERT INTO "api_audit_log"

package/dist/lib/api/entity/generic-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA6wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAoaD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA+YD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}
+{"version":3,"file":"generic-handler.d.ts","sourceRoot":"","sources":["../../../../src/lib/api/entity/generic-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA4wBvD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnF;AA8lBD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAErF;AAyaD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEpJ;AAoND;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AA6ZD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtJ;AAwKD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAEtF"}

package/dist/lib/api/entity/generic-handler.js

@@ -2,6 +2,8 @@ import { NextResponse } from "next/server";
 import { authenticateRequest, createAuthFailureResponse, canBypassTeamContext } from "../auth/dual-auth.js";
 import { resolveEntityFromUrl, validateEntityOperation } from "./resolver.js";
 import { generateEntitySchemas } from "../../entities/schema-generator.js";
+import { publicSlugIssue, otherBasePathSegments } from "../../entities/public-slug.js";
+import { getAllEntityConfigs } from "../../entities/registry.js";
 import { entityResponseSystemColumns, taxonomyResponseFields } from "../../entities/portable/response-shape.js";
 import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db.js";
 import {
@@ -348,13 +350,11 @@ async function checkAuthPermission(authResult, entitySlug, action, teamId, reque
 }
 async function validateTeamMembership(userId, teamId) {
   try {
-    console.log("[GenericHandler] Validating team membership:", { userId, teamId, teamIdLength: teamId == null ? void 0 : teamId.length });
     const member = await queryOneWithRLS(
       'SELECT id FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
       [teamId, userId],
       userId
     );
-    console.log("[GenericHandler] Team membership result:", { found: !!member, memberId: member == null ? void 0 : member.id });
     return !!member;
   } catch (error) {
     console.error("[GenericHandler] Error validating team membership:", error);
@@ -365,7 +365,6 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
   const teamId = getTeamIdFromRequest(request);
   const canBypass = await canBypassTeamContext(authResult, request);
   if (canBypass) {
-    console.log("[GenericHandler] Admin bypass active:", { userId, teamId: teamId || "cross-team" });
     return { valid: true, teamId, isBypass: true };
   }
   if (!teamId) {
@@ -832,6 +831,10 @@ async function handleGenericCreateImpl(request, audit) {
       return addCorsHeaders(response2, request);
     }
     let validatedData = validation.data;
+    const slugIssue = publicSlugIssue(entityConfig, validatedData, otherBasePathSegments(entityConfig, getAllEntityConfigs()));
+    if (slugIssue) {
+      return addCorsHeaders(createApiError(slugIssue.message, 400, [slugIssue], "VALIDATION_ERROR"), request);
+    }
     const xssField = checkNameFieldXss(entityConfig, validatedData);
     if (xssField) {
       const xssResponse = createApiError(
@@ -1204,7 +1207,7 @@ async function handleGenericUpdate(request, { params }) {
   return runWithAuditLog(request, (audit) => handleGenericUpdateImpl(request, audit, { params }));
 }
 async function handleGenericUpdateImpl(request, audit, { params }) {
-  var _a, _b, _c, _d, _e, _f, _g;
+  var _a, _b, _c, _d, _e, _f, _g, _h;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
@@ -1285,6 +1288,18 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       return addCorsHeaders(response2, request);
     }
     let validatedData = validation.data;
+    let slugIssue = publicSlugIssue(entityConfig, validatedData, otherBasePathSegments(entityConfig, getAllEntityConfigs()));
+    if (slugIssue) {
+      const current = await queryWithRLS(
+        `SELECT "slug" FROM "${tableName}" WHERE id = $1 AND "teamId" = $2`,
+        [id, teamId],
+        authResult.user.id
+      );
+      if (((_d = current[0]) == null ? void 0 : _d.slug) === validatedData.slug) slugIssue = null;
+    }
+    if (slugIssue) {
+      return addCorsHeaders(createApiError(slugIssue.message, 400, [slugIssue], "VALIDATION_ERROR"), request);
+    }
     const updateXssField = checkNameFieldXss(entityConfig, validatedData);
     if (updateXssField) {
       const updateXssResponse = createApiError(
@@ -1316,7 +1331,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
     const values = [];
     let paramCount = 1;
     const builderRequest = isBuilderRequest(request);
-    const entityHasBuilder = ((_d = entityConfig.builder) == null ? void 0 : _d.enabled) === true;
+    const entityHasBuilder = ((_e = entityConfig.builder) == null ? void 0 : _e.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in entityData) {
       let blocksData = entityData.blocks;
       blocksData = await filterOrphanedPatternReferences(blocksData, authResult.user.id);
@@ -1392,7 +1407,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
         whereConditions.push(`"teamId" = $${paramCount++}`);
         values.push(teamId);
       }
-      if (!((_e = entityConfig.access) == null ? void 0 : _e.shared)) {
+      if (!((_f = entityConfig.access) == null ? void 0 : _f.shared)) {
         whereConditions.push(`"userId" = $${paramCount++}`);
         values.push(authResult.user.id);
       }
@@ -1436,7 +1451,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       }
       updatedItem = result[0];
     }
-    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
+    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
       await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, true);
     }
     if (metadataWasProvided) {
@@ -1448,7 +1463,7 @@ async function handleGenericUpdateImpl(request, audit, { params }) {
       );
     }
     let responseItem = updatedItem;
-    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
+    if ((_h = entityConfig.taxonomies) == null ? void 0 : _h.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [updatedItem],

package/dist/lib/api/helpers.d.ts

@@ -46,7 +46,9 @@ export declare function validateAndAuthenticateApiRequest(request: NextRequest):
     rateLimitResponse?: NextResponse;
 }>;
 /**
- * Extrae la información de autenticación API de los headers de la request
+ * The API key this request was authenticated with: the one validateApiKey accepted for it (directly, or through
+ * authenticateRequest / validateAndAuthenticateRequest). Throws when no key was validated for the request.
+ * Identity never comes from request headers.
  * @deprecated Use validateAndAuthenticateApiRequest instead
  */
 export declare function getApiAuth(request: NextRequest): ApiKeyAuth;
@@ -106,6 +108,10 @@ export declare function createPaginationMeta(page: number, limit: number, total:
 export declare function logApiUsage(auth: ApiKeyAuth, request: NextRequest, statusCode: number, responseTime?: number, requestBody?: unknown): Promise<void>;
 /**
  * Wrapper para endpoints que agrega logging automático
+ *
+ * Writes an api_audit_log row for a request authenticated with an API key, attributed to the key the handler
+ * validated (getValidatedApiKey), never to identity headers in the request. Requests without a validated key
+ * are not logged here. The request body is not stored, as in entity/audit-log.ts: payloads carry personal data.
  */
 export declare function withApiLogging<T extends unknown[]>(handler: (request: NextRequest, ...args: T) => Promise<NextResponse>): (request: NextRequest, ...args: T) => Promise<NextResponse>;
 /**
@@ -125,7 +131,7 @@ export declare function sanitizeSearchQuery(query: string): string;
 export declare function parseFilters(request: NextRequest): Record<string, string>;
 /**
  * Agrega headers de CORS para API externa
- * Uses unified getCorsOrigins() for single source of truth
+ * Uses unified getCorsOrigins() for single source of truth (see corsGrant)
  */
 export declare function addCorsHeaders(response: NextResponse, request?: NextRequest): Promise<NextResponse>;
 /**

package/dist/lib/api/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAWpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CASD;AA+BD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAsC,MAAM,QAAQ,CAAC;AAaxE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,KAAK,mBAAmB,EAKzB,MAAM,qBAAqB,CAAC;AAG7B,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,iBAAiB,CAAC,EAAE,YAAY,CAAC;IACjC,wEAAwE;IACxE,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B,CAAC,CAwDD;AAgFD;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CAUD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAM3D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,YAAY,GAAG,IAAI,CAiB5F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CAkBvE;AAED;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAuBnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}