@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/api/[id]/attachments/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/documents/api/%5Bid%5D/attachments/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  DOCUMENT_ATTACHMENT_UPLOAD_CONTEXT,\n  type DocumentAttachmentCreateCommandInput,\n  type DocumentAttachmentCreateCommandResult,\n} from '../../../commands/attachments'\nimport { DOCUMENTS_ENTITY_IDS } from '../../../lib/constants'\nimport { readAttachmentUploadForm, resolveAttachmentServicePort } from '../../../lib/attachmentServicePort'\nimport { assertTier } from '../../../lib/permissions'\nimport {\n  assertDocumentNotArchived,\n  handleDocumentsRouteError,\n  loadScopedDocument,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  runMutationGuardAfterSuccess,\n  validateMutationGuard,\n  withDocumentsContextErrors,\n} from '../../_shared'\nimport {\n  attachDocumentsOperationMetadata,\n  buildDocumentsCommandRuntimeContext,\n  resolveDocumentsCommandBus,\n} from '../../_commands'\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nconst attachmentUploadBodySchema = z.object({\n  file: z.string().min(1).describe('Binary file payload supplied as multipart form-data'),\n})\n\n// The guard sees exactly the fields the command consumes. `fileSize` is pinned\n// to the real byte length: a guard may rename or retype a file, but it must not\n// be able to talk the route past the upload-size validation below.\nconst attachmentGuardPayloadSchema = z.object({\n  fileName: z.string().trim().min(1),\n  fileType: z.string(),\n  fileSize: z.number().int().nonnegative(),\n})\n\nconst attachmentUploadResponseSchema = z.object({\n  id: z.string().uuid(),\n  attachmentId: z.string().uuid(),\n  updatedAt: z.string().datetime(),\n  url: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['documents.edit'] },\n}\n\nasync function resolveId(context: RouteContext): Promise<string> {\n  const params = await context.params\n  return params.id\n}\n\nfunction assertMultipartUpload(request: Request): void {\n  const contentType = request.headers.get('content-type') ?? ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    throw new CrudHttpError(400, { error: 'Expected multipart/form-data' })\n  }\n}\n\nfunction readUploadFile(form: FormData): File {\n  const file = form.get('file')\n  if (!(file instanceof File)) {\n    throw new CrudHttpError(400, { error: 'File is required' })\n  }\n  return file\n}\n\nexport async function POST(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const documentId = await resolveId(context)\n    const ctx = await resolveDocumentsContext(request, ['documents.edit'])\n    await assertTier(ctx.em, documentId, ctx.auth, 'editor')\n    await assertDocumentNotArchived(ctx, documentId)\n    await loadScopedDocument(ctx, documentId)\n    const attachmentService = resolveAttachmentServicePort(ctx.container)\n    assertMultipartUpload(request)\n    const form = await readAttachmentUploadForm(attachmentService, request)\n    const file = readUploadFile(form)\n    attachmentService.validateUpload({ fileName: file.name, fileSize: file.size })\n    const guardPayload = attachmentGuardPayloadSchema.parse({\n      fileName: file.name,\n      fileType: file.type,\n      fileSize: file.size,\n    })\n    const guardResult = await validateMutationGuard(ctx, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.documentAttachment,\n      resourceId: documentId,\n      operation: 'create',\n      mutationPayload: guardPayload,\n      mutationPayloadSchema: attachmentGuardPayloadSchema.refine(\n        (payload) => payload.fileSize === file.size,\n        { path: ['fileSize'], message: '[internal] mutation guard changed the file size' },\n      ),\n    })\n    // Re-validate against the possibly rewritten name before the bytes are read.\n    attachmentService.validateUpload({\n      fileName: guardPayload.fileName,\n      fileSize: guardPayload.fileSize,\n    })\n\n    const buffer = Buffer.from(await file.arrayBuffer())\n    const commandInput: DocumentAttachmentCreateCommandInput = {\n      documentId,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      fileName: guardPayload.fileName,\n      fileType: guardPayload.fileType || null,\n      fileSize: guardPayload.fileSize,\n    }\n    const commandContext = {\n      ...buildDocumentsCommandRuntimeContext(ctx),\n      [DOCUMENT_ATTACHMENT_UPLOAD_CONTEXT]: { buffer },\n    }\n    const { result, logEntry } = await resolveDocumentsCommandBus(ctx).execute<\n      DocumentAttachmentCreateCommandInput,\n      DocumentAttachmentCreateCommandResult\n    >('documents.attachment.create', {\n      input: commandInput,\n      ctx: commandContext,\n    })\n\n    await runMutationGuardAfterSuccess(ctx, guardResult, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.documentAttachment,\n      resourceId: result.linkId,\n      operation: 'create',\n    })\n\n    const url = `/api/documents/${encodeURIComponent(documentId)}/attachments/${encodeURIComponent(result.attachmentId)}`\n    const response = NextResponse.json({\n      id: result.id,\n      attachmentId: result.attachmentId,\n      updatedAt: result.updatedAt,\n      url,\n    }, { status: 201 })\n    return attachDocumentsOperationMetadata(response, logEntry, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.documentAttachment,\n      resourceId: result.linkId,\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.attachments.create')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Document attachments',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Upload document attachment',\n      requestBody: { contentType: 'multipart/form-data', schema: attachmentUploadBodySchema },\n      responses: [{ status: 201, description: 'Document-scoped attachment uploaded', schema: attachmentUploadResponseSchema }],\n      errors: [\n        { status: 400, description: 'Payload validation error', schema: routeErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 413, description: 'Attachment too large', schema: routeErrorSchema },\n        { status: 503, description: 'Attachment service unavailable', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { POST }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,OAGK;AACP,SAAS,4BAA4B;AACrC,SAAS,0BAA0B,oCAAoC;AACvE,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,qDAAqD;AACxF,CAAC;AAKD,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EACjC,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACzC,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,KAAK,EAAE,OAAO;AAChB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,eAAe,UAAU,SAAwC;AAC/D,QAAM,SAAS,MAAM,QAAQ;AAC7B,SAAO,OAAO;AAChB;AAEA,SAAS,sBAAsB,SAAwB;AACrD,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,+BAA+B,CAAC;AAAA,EACxE;AACF;AAEA,SAAS,eAAe,MAAsB;AAC5C,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,EAAE,gBAAgB,OAAO;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,eAAsB,KAAK,SAAkB,SAA0C;AACrF,MAAI;AACF,UAAM,aAAa,MAAM,UAAU,OAAO;AAC1C,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,gBAAgB,CAAC;AACrE,UAAM,WAAW,IAAI,IAAI,YAAY,IAAI,MAAM,QAAQ;AACvD,UAAM,0BAA0B,KAAK,UAAU;AAC/C,UAAM,mBAAmB,KAAK,UAAU;AACxC,UAAM,oBAAoB,6BAA6B,IAAI,SAAS;AACpE,0BAAsB,OAAO;AAC7B,UAAM,OAAO,MAAM,yBAAyB,mBAAmB,OAAO;AACtE,UAAM,OAAO,eAAe,IAAI;AAChC,sBAAkB,eAAe,EAAE,UAAU,KAAK,MAAM,UAAU,KAAK,KAAK,CAAC;AAC7E,UAAM,eAAe,6BAA6B,MAAM;AAAA,MACtD,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,UAAM,cAAc,MAAM,sBAAsB,KAAK;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,uBAAuB,6BAA6B;AAAA,QAClD,CAAC,YAAY,QAAQ,aAAa,KAAK;AAAA,QACvC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,kDAAkD;AAAA,MACnF;AAAA,IACF,CAAC;AAED,sBAAkB,eAAe;AAAA,MAC/B,UAAU,aAAa;AAAA,MACvB,UAAU,aAAa;AAAA,IACzB,CAAC;AAED,UAAM,SAAS,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AACnD,UAAM,eAAqD;AAAA,MACzD;AAAA,MACA,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,UAAU,aAAa;AAAA,MACvB,UAAU,aAAa,YAAY;AAAA,MACnC,UAAU,aAAa;AAAA,IACzB;AACA,UAAM,iBAAiB;AAAA,MACrB,GAAG,oCAAoC,GAAG;AAAA,MAC1C,CAAC,kCAAkC,GAAG,EAAE,OAAO;AAAA,IACjD;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,2BAA2B,GAAG,EAAE,QAGjE,+BAA+B;AAAA,MAC/B,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAED,UAAM,6BAA6B,KAAK,aAAa;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,IACb,CAAC;AAED,UAAM,MAAM,kBAAkB,mBAAmB,UAAU,CAAC,gBAAgB,mBAAmB,OAAO,YAAY,CAAC;AACnH,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,OAAO;AAAA,MACX,cAAc,OAAO;AAAA,MACrB,WAAW,OAAO;AAAA,MAClB;AAAA,IACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClB,WAAO,iCAAiC,UAAU,UAAU;AAAA,MAC1D,cAAc,qBAAqB;AAAA,MACnC,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,8BAA8B;AAAA,EACxE;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,uBAAuB,QAAQ,2BAA2B;AAAA,MACtF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,+BAA+B,CAAC;AAAA,MACvH,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,iBAAiB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,iBAAiB;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,KAAK;",
+  "names": []
+}

package/dist/modules/documents/api/[id]/collab-token/route.js

@@ -0,0 +1,180 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  COLLAB_TOKEN_TTL_SECONDS,
+  isCollabTokenV2Ready,
+  mintCollabTokenV2,
+  verifyCollabTokenV2
+} from "../../../lib/collabToken.js";
+import { resolveUserLabels } from "../../../lib/userLabels.js";
+import { resolveCollaborationUserColor } from "../../../lib/collaborationAwareness.js";
+import { resolveDocumentsCollaborationEndpoint } from "../../../lib/collabEndpoint.js";
+import { resolvePermission } from "../../../lib/permissions.js";
+import {
+  loadDocumentArchivedState,
+  deriveCapabilitiesForContext,
+  handleDocumentsRouteError,
+  resolveActorUserId,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  withDocumentsContextErrors
+} from "../../_shared.js";
+const collabTokenResponseSchema = z.object({
+  token: z.string(),
+  url: z.string().nullable(),
+  documentId: z.string(),
+  tier: z.enum(["owner", "editor", "commenter", "viewer"]),
+  expiresInSec: z.number(),
+  expiresAt: z.string(),
+  userName: z.string(),
+  userColor: z.string(),
+  canEdit: z.boolean(),
+  readOnly: z.boolean(),
+  user: z.object({
+    id: z.string(),
+    name: z.string(),
+    color: z.string()
+  })
+});
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["documents.view"] }
+};
+const logger = createLogger("documents").child({ component: "api" });
+let warnedCollabTokenSecretNotReady = false;
+let warnedCollabEndpointInvalid = false;
+function warnCollabTokenSecretNotReadyOnce() {
+  if (warnedCollabTokenSecretNotReady) return;
+  warnedCollabTokenSecretNotReady = true;
+  logger.warn(
+    "DOCUMENTS_COLLAB_JWT_SECRET_V2 is missing, shorter than 32 UTF-8 bytes, or equal to DOCUMENTS_COLLAB_JWT_SECRET; collaboration tokens cannot be minted and clients fall back to non-collaborative editing."
+  );
+}
+function warnCollabEndpointInvalidOnce() {
+  if (warnedCollabEndpointInvalid) return;
+  warnedCollabEndpointInvalid = true;
+  logger.warn(
+    "Ignoring NEXT_PUBLIC_DOCUMENTS_COLLAB_URL because it is not a valid browser-reachable ws(s) endpoint; collaboration is disabled and clients fall back to non-collaborative editing."
+  );
+}
+async function GET(request, context) {
+  try {
+    const params = await context.params;
+    const id = params.id;
+    const ctx = await resolveDocumentsContext(request, ["documents.view"]);
+    if (ctx.auth.isApiKey === true || ctx.auth.sub.startsWith("api_key:")) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const relationshipTier = await resolvePermission(ctx.em, id, ctx.auth);
+    if (!relationshipTier || !deriveCapabilitiesForContext(ctx, relationshipTier).canView) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const archivedState = await loadDocumentArchivedState(ctx, id);
+    const capabilities = deriveCapabilitiesForContext(ctx, relationshipTier, {
+      archived: archivedState.archivedAt !== null
+    });
+    if (!capabilities.canView) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const userId = resolveActorUserId(ctx.auth);
+    const [userLabels, translations] = await Promise.all([
+      resolveUserLabels(
+        ctx.container,
+        { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+        [userId]
+      ),
+      resolveTranslations()
+    ]);
+    const userName = userLabels.get(userId)?.label ?? translations.translate("documents.users.unknown", "Unknown user");
+    const userColor = resolveCollaborationUserColor(userId);
+    const readOnly = !capabilities.canEdit;
+    if (!isCollabTokenV2Ready()) {
+      warnCollabTokenSecretNotReadyOnce();
+      return NextResponse.json(
+        {
+          token: "",
+          url: null,
+          documentId: id,
+          tier: relationshipTier,
+          expiresInSec: COLLAB_TOKEN_TTL_SECONDS,
+          expiresAt: new Date(Date.now() + COLLAB_TOKEN_TTL_SECONDS * 1e3).toISOString(),
+          userName,
+          userColor,
+          canEdit: capabilities.canEdit,
+          readOnly,
+          user: {
+            id: userId,
+            name: userName,
+            color: userColor
+          }
+        },
+        { headers: { "Cache-Control": "private, no-store" } }
+      );
+    }
+    const collaborationEndpoint = resolveDocumentsCollaborationEndpoint();
+    if (process.env.NEXT_PUBLIC_DOCUMENTS_COLLAB_URL && !collaborationEndpoint) {
+      warnCollabEndpointInvalidOnce();
+    }
+    const token = mintCollabTokenV2({
+      userId,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      documentId: id,
+      tier: relationshipTier,
+      tokenVersion: 2,
+      readOnly
+    });
+    const verifiedToken = verifyCollabTokenV2(token);
+    if (!verifiedToken) {
+      throw new Error("[internal] Failed to verify a freshly minted collaboration token");
+    }
+    return NextResponse.json(
+      {
+        token,
+        url: collaborationEndpoint,
+        documentId: id,
+        tier: relationshipTier,
+        expiresInSec: COLLAB_TOKEN_TTL_SECONDS,
+        expiresAt: new Date(verifiedToken.exp * 1e3).toISOString(),
+        userName,
+        userColor,
+        canEdit: capabilities.canEdit,
+        readOnly,
+        user: {
+          id: userId,
+          name: userName,
+          color: userColor
+        }
+      },
+      { headers: { "Cache-Control": "private, no-store" } }
+    );
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.collabToken.get");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Document collaboration token",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "Mint document collaboration token",
+      responses: [{ status: 200, description: "Collaboration token", schema: collabTokenResponseSchema }],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Not found", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { GET };
+export {
+  GET,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/[id]/collab-token/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/documents/api/%5Bid%5D/collab-token/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  COLLAB_TOKEN_TTL_SECONDS,\n  isCollabTokenV2Ready,\n  mintCollabTokenV2,\n  verifyCollabTokenV2,\n} from '../../../lib/collabToken'\nimport { resolveUserLabels } from '../../../lib/userLabels'\nimport { resolveCollaborationUserColor } from '../../../lib/collaborationAwareness'\nimport { resolveDocumentsCollaborationEndpoint } from '../../../lib/collabEndpoint'\nimport { resolvePermission } from '../../../lib/permissions'\nimport {\n  loadDocumentArchivedState,\n  deriveCapabilitiesForContext,\n  handleDocumentsRouteError,\n  resolveActorUserId,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  withDocumentsContextErrors,\n} from '../../_shared'\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nconst collabTokenResponseSchema = z.object({\n  token: z.string(),\n  url: z.string().nullable(),\n  documentId: z.string(),\n  tier: z.enum(['owner', 'editor', 'commenter', 'viewer']),\n  expiresInSec: z.number(),\n  expiresAt: z.string(),\n  userName: z.string(),\n  userColor: z.string(),\n  canEdit: z.boolean(),\n  readOnly: z.boolean(),\n  user: z.object({\n    id: z.string(),\n    name: z.string(),\n    color: z.string(),\n  }),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['documents.view'] },\n}\n\nconst logger = createLogger('documents').child({ component: 'api' })\n\nlet warnedCollabTokenSecretNotReady = false\nlet warnedCollabEndpointInvalid = false\n\nfunction warnCollabTokenSecretNotReadyOnce(): void {\n  if (warnedCollabTokenSecretNotReady) return\n  warnedCollabTokenSecretNotReady = true\n  logger.warn(\n    'DOCUMENTS_COLLAB_JWT_SECRET_V2 is missing, shorter than 32 UTF-8 bytes, '\n    + 'or equal to DOCUMENTS_COLLAB_JWT_SECRET; collaboration tokens cannot be minted '\n    + 'and clients fall back to non-collaborative editing.',\n  )\n}\n\nfunction warnCollabEndpointInvalidOnce(): void {\n  if (warnedCollabEndpointInvalid) return\n  warnedCollabEndpointInvalid = true\n  logger.warn(\n    'Ignoring NEXT_PUBLIC_DOCUMENTS_COLLAB_URL because it is not a valid browser-reachable '\n    + 'ws(s) endpoint; collaboration is disabled and clients fall back to non-collaborative editing.',\n  )\n}\n\nexport async function GET(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const params = await context.params\n    const id = params.id\n    const ctx = await resolveDocumentsContext(request, ['documents.view'])\n    // The collaboration sidecar currently reauthorizes the signed user\n    // identity and has no API-key subject with which to reload the key's\n    // restricted ACL/roles. Do not mint a token that would silently promote a\n    // bound key to its backing user's full collaboration access.\n    if (ctx.auth.isApiKey === true || ctx.auth.sub.startsWith('api_key:')) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    // One relationship lookup feeds both projections. The pre-archive check\n    // still runs first so an unauthorized caller cannot tell an existing\n    // document apart from a missing one via the 404 the archived read raises.\n    const relationshipTier = await resolvePermission(ctx.em, id, ctx.auth)\n    if (!relationshipTier || !deriveCapabilitiesForContext(ctx, relationshipTier).canView) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    const archivedState = await loadDocumentArchivedState(ctx, id)\n    const capabilities = deriveCapabilitiesForContext(ctx, relationshipTier, {\n      archived: archivedState.archivedAt !== null,\n    })\n    if (!capabilities.canView) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    const userId = resolveActorUserId(ctx.auth)\n    const [userLabels, translations] = await Promise.all([\n      resolveUserLabels(\n        ctx.container,\n        { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n        [userId],\n      ),\n      resolveTranslations(),\n    ])\n    const userName = userLabels.get(userId)?.label\n      ?? translations.translate('documents.users.unknown', 'Unknown user')\n    const userColor = resolveCollaborationUserColor(userId)\n    const readOnly = !capabilities.canEdit\n    if (!isCollabTokenV2Ready()) {\n      // A misconfigured capability secret must degrade to the same graceful\n      // non-collaborative response as an unset NEXT_PUBLIC_DOCUMENTS_COLLAB_URL\n      // (url: null) instead of a 500 the client would classify as transient\n      // and retry until its fallback timer.\n      warnCollabTokenSecretNotReadyOnce()\n      return NextResponse.json(\n        {\n          token: '',\n          url: null,\n          documentId: id,\n          tier: relationshipTier,\n          expiresInSec: COLLAB_TOKEN_TTL_SECONDS,\n          expiresAt: new Date(Date.now() + COLLAB_TOKEN_TTL_SECONDS * 1000).toISOString(),\n          userName,\n          userColor,\n          canEdit: capabilities.canEdit,\n          readOnly,\n          user: {\n            id: userId,\n            name: userName,\n            color: userColor,\n          },\n        },\n        { headers: { 'Cache-Control': 'private, no-store' } },\n      )\n    }\n    const collaborationEndpoint = resolveDocumentsCollaborationEndpoint()\n    if (process.env.NEXT_PUBLIC_DOCUMENTS_COLLAB_URL && !collaborationEndpoint) {\n      warnCollabEndpointInvalidOnce()\n    }\n    const token = mintCollabTokenV2({\n      userId,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      documentId: id,\n      tier: relationshipTier,\n      tokenVersion: 2,\n      readOnly,\n    })\n    const verifiedToken = verifyCollabTokenV2(token)\n    if (!verifiedToken) {\n      throw new Error('[internal] Failed to verify a freshly minted collaboration token')\n    }\n\n    return NextResponse.json(\n      {\n        token,\n        url: collaborationEndpoint,\n        documentId: id,\n        tier: relationshipTier,\n        expiresInSec: COLLAB_TOKEN_TTL_SECONDS,\n        expiresAt: new Date(verifiedToken.exp * 1000).toISOString(),\n        userName,\n        userColor,\n        canEdit: capabilities.canEdit,\n        readOnly,\n        user: {\n          id: userId,\n          name: userName,\n          color: userColor,\n        },\n      },\n      { headers: { 'Cache-Control': 'private, no-store' } },\n    )\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.collabToken.get')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Document collaboration token',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: 'Mint document collaboration token',\n      responses: [{ status: 200, description: 'Collaboration token', schema: collabTokenResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 404, description: 'Not found', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { GET }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,qCAAqC;AAC9C,SAAS,6CAA6C;AACtD,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,OAAO;AAAA,EAChB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,YAAY,EAAE,OAAO;AAAA,EACrB,MAAM,EAAE,KAAK,CAAC,SAAS,UAAU,aAAa,QAAQ,CAAC;AAAA,EACvD,cAAc,EAAE,OAAO;AAAA,EACvB,WAAW,EAAE,OAAO;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO;AAAA,EACpB,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,EAClB,CAAC;AACH,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEA,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAEnE,IAAI,kCAAkC;AACtC,IAAI,8BAA8B;AAElC,SAAS,oCAA0C;AACjD,MAAI,gCAAiC;AACrC,oCAAkC;AAClC,SAAO;AAAA,IACL;AAAA,EAGF;AACF;AAEA,SAAS,gCAAsC;AAC7C,MAAI,4BAA6B;AACjC,gCAA8B;AAC9B,SAAO;AAAA,IACL;AAAA,EAEF;AACF;AAEA,eAAsB,IAAI,SAAkB,SAA0C;AACpF,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ;AAC7B,UAAM,KAAK,OAAO;AAClB,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,gBAAgB,CAAC;AAKrE,QAAI,IAAI,KAAK,aAAa,QAAQ,IAAI,KAAK,IAAI,WAAW,UAAU,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AAIA,UAAM,mBAAmB,MAAM,kBAAkB,IAAI,IAAI,IAAI,IAAI,IAAI;AACrE,QAAI,CAAC,oBAAoB,CAAC,6BAA6B,KAAK,gBAAgB,EAAE,SAAS;AACrF,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AACA,UAAM,gBAAgB,MAAM,0BAA0B,KAAK,EAAE;AAC7D,UAAM,eAAe,6BAA6B,KAAK,kBAAkB;AAAA,MACvE,UAAU,cAAc,eAAe;AAAA,IACzC,CAAC;AACD,QAAI,CAAC,aAAa,SAAS;AACzB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AACA,UAAM,SAAS,mBAAmB,IAAI,IAAI;AAC1C,UAAM,CAAC,YAAY,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,MACnD;AAAA,QACE,IAAI;AAAA,QACJ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,QAC7D,CAAC,MAAM;AAAA,MACT;AAAA,MACA,oBAAoB;AAAA,IACtB,CAAC;AACD,UAAM,WAAW,WAAW,IAAI,MAAM,GAAG,SACpC,aAAa,UAAU,2BAA2B,cAAc;AACrE,UAAM,YAAY,8BAA8B,MAAM;AACtD,UAAM,WAAW,CAAC,aAAa;AAC/B,QAAI,CAAC,qBAAqB,GAAG;AAK3B,wCAAkC;AAClC,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,KAAK;AAAA,UACL,YAAY;AAAA,UACZ,MAAM;AAAA,UACN,cAAc;AAAA,UACd,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI,EAAE,YAAY;AAAA,UAC9E;AAAA,UACA;AAAA,UACA,SAAS,aAAa;AAAA,UACtB;AAAA,UACA,MAAM;AAAA,YACJ,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,OAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA,EAAE,SAAS,EAAE,iBAAiB,oBAAoB,EAAE;AAAA,MACtD;AAAA,IACF;AACA,UAAM,wBAAwB,sCAAsC;AACpE,QAAI,QAAQ,IAAI,oCAAoC,CAAC,uBAAuB;AAC1E,oCAA8B;AAAA,IAChC;AACA,UAAM,QAAQ,kBAAkB;AAAA,MAC9B;AAAA,MACA,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,cAAc;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,gBAAgB,oBAAoB,KAAK;AAC/C,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AAEA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE;AAAA,QACA,KAAK;AAAA,QACL,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,cAAc;AAAA,QACd,WAAW,IAAI,KAAK,cAAc,MAAM,GAAI,EAAE,YAAY;AAAA,QAC1D;AAAA,QACA;AAAA,QACA,SAAS,aAAa;AAAA,QACtB;AAAA,QACA,MAAM;AAAA,UACJ,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,OAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,EAAE,SAAS,EAAE,iBAAiB,oBAAoB,EAAE;AAAA,IACtD;AAAA,EACF,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,2BAA2B;AAAA,EACrE;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,0BAA0B,CAAC;AAAA,MAClG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,IAAI;",
+  "names": []
+}

package/dist/modules/documents/api/[id]/comments/access-check/route.js

@@ -0,0 +1,86 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { assertTier, resolveUserAccess } from "../../../../lib/permissions.js";
+import {
+  handleDocumentsRouteError,
+  readBody,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  withDocumentsContextErrors
+} from "../../../_shared.js";
+const accessCheckSchema = z.object({
+  userIds: z.array(z.string().uuid()).max(50)
+});
+const accessCheckResponseSchema = z.object({
+  withoutAccess: z.array(z.string().uuid()),
+  withoutAccessUsers: z.array(
+    z.object({
+      userId: z.string().uuid(),
+      // Keep the published nullable-string contract for generated clients;
+      // this route deliberately returns null values to avoid identity lookup.
+      label: z.string().nullable(),
+      secondary: z.string().nullable()
+    })
+  )
+});
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["documents.view"] }
+};
+async function resolveId(context) {
+  const params = await context.params;
+  return params.id;
+}
+async function POST(request, context) {
+  try {
+    const documentId = await resolveId(context);
+    const ctx = await resolveDocumentsContext(request, ["documents.view"]);
+    await assertTier(ctx.em, documentId, ctx.auth, "commenter");
+    const input = accessCheckSchema.parse(await readBody(request));
+    const uniqueUserIds = Array.from(new Set(input.userIds.map((userId) => userId.toLowerCase())));
+    const withoutAccess = [];
+    for (const userId of uniqueUserIds) {
+      const tier = await resolveUserAccess(
+        ctx.em,
+        documentId,
+        { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+        userId,
+        ctx.container
+      );
+      if (!tier) withoutAccess.push(userId);
+    }
+    const withoutAccessUsers = withoutAccess.map((userId) => ({
+      userId,
+      label: null,
+      secondary: null
+    }));
+    return NextResponse.json({ withoutAccess, withoutAccessUsers });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.comments.accessCheck");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Check mentioned user document access",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    POST: {
+      summary: "Check which mentioned users lack access",
+      requestBody: { contentType: "application/json", schema: accessCheckSchema },
+      responses: [{ status: 200, description: "Mention access check result", schema: accessCheckResponseSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 413, description: "Request body exceeds the safe resource bound", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { POST };
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/[id]/comments/access-check/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/documents/api/%5Bid%5D/comments/access-check/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { assertTier, resolveUserAccess } from '../../../../lib/permissions'\nimport {\n  handleDocumentsRouteError,\n  readBody,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  withDocumentsContextErrors,\n} from '../../../_shared'\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nconst accessCheckSchema = z.object({\n  userIds: z.array(z.string().uuid()).max(50),\n})\n\nconst accessCheckResponseSchema = z.object({\n  withoutAccess: z.array(z.string().uuid()),\n  withoutAccessUsers: z.array(\n    z.object({\n      userId: z.string().uuid(),\n      // Keep the published nullable-string contract for generated clients;\n      // this route deliberately returns null values to avoid identity lookup.\n      label: z.string().nullable(),\n      secondary: z.string().nullable(),\n    }),\n  ),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['documents.view'] },\n}\n\nasync function resolveId(context: RouteContext): Promise<string> {\n  const params = await context.params\n  return params.id\n}\n\nexport async function POST(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const documentId = await resolveId(context)\n    const ctx = await resolveDocumentsContext(request, ['documents.view'])\n    await assertTier(ctx.em, documentId, ctx.auth, 'commenter')\n    const input = accessCheckSchema.parse(await readBody(request))\n    const uniqueUserIds = Array.from(new Set(input.userIds.map((userId) => userId.toLowerCase())))\n    const withoutAccess: string[] = []\n\n    for (const userId of uniqueUserIds) {\n      const tier = await resolveUserAccess(\n        ctx.em,\n        documentId,\n        { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n        userId,\n        ctx.container,\n      )\n      if (!tier) withoutAccess.push(userId)\n    }\n    // Keep the historical response shape for clients, but never turn this\n    // authorization probe into a user-directory/PII lookup. The caller\n    // already supplied these IDs and owns their local mention labels.\n    const withoutAccessUsers = withoutAccess.map((userId) => ({\n      userId,\n      label: null,\n      secondary: null,\n    }))\n\n    return NextResponse.json({ withoutAccess, withoutAccessUsers })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.comments.accessCheck')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Check mentioned user document access',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Check which mentioned users lack access',\n      requestBody: { contentType: 'application/json', schema: accessCheckSchema },\n      responses: [{ status: 200, description: 'Mention access check result', schema: accessCheckResponseSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: routeErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 413, description: 'Request body exceeds the safe resource bound', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { POST }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,YAAY,yBAAyB;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE;AAC5C,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,EACxC,oBAAoB,EAAE;AAAA,IACpB,EAAE,OAAO;AAAA,MACP,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,MAGxB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IACjC,CAAC;AAAA,EACH;AACF,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,eAAe,UAAU,SAAwC;AAC/D,QAAM,SAAS,MAAM,QAAQ;AAC7B,SAAO,OAAO;AAChB;AAEA,eAAsB,KAAK,SAAkB,SAA0C;AACrF,MAAI;AACF,UAAM,aAAa,MAAM,UAAU,OAAO;AAC1C,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,gBAAgB,CAAC;AACrE,UAAM,WAAW,IAAI,IAAI,YAAY,IAAI,MAAM,WAAW;AAC1D,UAAM,QAAQ,kBAAkB,MAAM,MAAM,SAAS,OAAO,CAAC;AAC7D,UAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,YAAY,CAAC,CAAC,CAAC;AAC7F,UAAM,gBAA0B,CAAC;AAEjC,eAAW,UAAU,eAAe;AAClC,YAAM,OAAO,MAAM;AAAA,QACjB,IAAI;AAAA,QACJ;AAAA,QACA,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,QAC7D;AAAA,QACA,IAAI;AAAA,MACN;AACA,UAAI,CAAC,KAAM,eAAc,KAAK,MAAM;AAAA,IACtC;AAIA,UAAM,qBAAqB,cAAc,IAAI,CAAC,YAAY;AAAA,MACxD;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IACb,EAAE;AAEF,WAAO,aAAa,KAAK,EAAE,eAAe,mBAAmB,CAAC;AAAA,EAChE,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,gCAAgC;AAAA,EAC1E;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,kBAAkB;AAAA,MAC1E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,0BAA0B,CAAC;AAAA,MAC1G,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,iBAAiB;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,KAAK;",
+  "names": []
+}