@prenta/core 7.7.1 → 7.7.2

package/dist/api/route-helpers/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/api/route-helpers/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAoB,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EACL,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,GAEjB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEjE,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B,IAAI,oBAAoB,GAAG,KAAK,CAAA;AAEhC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,eAAe,EAAE,EAAE,MAAM,CAAA;IACvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,cAAc,GAAG,IAAI,CAAA;QACrB,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,oBAAoB,GAAG,IAAI,CAAA;YAC3B,MAAM,CAAC,KAAK,CACV,6IAA6I,CAC9I,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,MAAM,CAAC,MAAM;YACb,KAAK;YACL,0GAA0G,CAC7G,CAAA;IACH,CAAC;IACD,cAAc,GAAG,KAAK,CAAA;IACtB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,cAAc;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,CAAC;QACH,gBAAgB,EAAE,CAAA;QAClB,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,IAAI,eAAe,EAAE;QAAE,OAAO,IAAI,CAAA;IAElC,IAAI,KAAyB,CAAA;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACvD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;QAC/C,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACnC,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,0EAA0E;IAC1E,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,KAAK,EAAY,CAAA;YAC3B,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YACvC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;YACtE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAA;YAEtF,MAAM,cAAc,GAAoB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC1E,CAAC,CAAE,MAAM,CAAC,cAA2B;gBACrC,CAAC,CAAC,MAAM,CAAC,cAAc;oBACrB,CAAC,CAAC,CAAE,MAAM,CAAC,cAAuC,CAAC,KAAK,IAAI,IAAI,CAAC;oBACjE,CAAC,CAAC,IAAI,CAAA;YACV,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;gBAC/B,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAA;YACxD,CAAC;YAED,uEAAuE;YACvE,qEAAqE;YACrE,kDAAkD;YAClD,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC5B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;aACpF,CAAC,CAAA;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAEhF,MAAM,MAAM,GAAI,MAAM,CAAC,MAA6B,IAAI,EAAE,CAAA;YAC1D,oEAAoE;YACpE,KAAK,CAAC,CAAC,MAAM;iBACV,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;iBACtE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACjC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC9D,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE;aAClC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;QAC1E,MAAM,CAAC,GAAG,KAAK,EAAY,CAAA;QAC3B,IAAI,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE;gBAChC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;aAC5B,CAAC,CAAA;YACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAA;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM;YAAE,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACtD,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,6CAA6C;YACpD,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,UAAU;SACnB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,EAAE,CAClD,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;QAC7C,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QACpE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,aAAa,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;YACnC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB;IAEhB,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,IAAI,CACT;gBACE,KAAK,EACH,2GAA2G;gBAC7G,IAAI,EAAE,gBAAgB;aACvB,EACD,GAAG,CACJ;SACF,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAA;IACtD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAoB,EACpB,UAAkB,EAClB,MAA+C;IAE/C,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAChC,OAAO,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;QACnE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,uCAAuC,MAAM,mBAAmB,UAAU,GAAG,CAAA;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,UAAkB,EAClB,MAA+C;IAE/C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACvE,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnD,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,IAAY;IACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,aAAa,CAAC,gDAAgD,IAAI,GAAG,EAAE,GAAG,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAoB;IACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAoB;IACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,OAAO,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAyC,EACzC,EAAY,EACZ,MAAe;IAEf,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,EAAE;KACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE1E,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAEtD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,YAAyB;IACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAoB;IACjD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;IAC7B,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC/B,GAA6C,EAAE,GAAG,EAAE,OAAO;QAC5D,IAAI,CAAA;IACN,MAAM,SAAS,GACZ,GAAiD,EAAE,KAAK,EAAE,SAAS;QACnE,GAAiD,EAAE,KAAK,EAAE,SAAS;QACpE,IAAI,CAAA;IACN,OAAO;QACL,eAAe,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAChD,SAAS;QACT,aAAa,EAAE,OAAO,CAAC,MAAM;KAC9B,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;IAC7B,IAAK,GAAiD,EAAE,QAAQ,EAAE,KAAK;QAAE,OAAO,IAAI,CAAA;IACpF,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAA;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAY;IACvD,IAAI,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAA;IAC1E,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAC;IAC5C,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;IACnD,WAAW,EAAE,GAAG;IAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAE7F,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;IAC3C,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAEhG,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,iFAAiF;AACjF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;IAC7C,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAEhG,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAE/F,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,yEAAyE;AACzE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;IACrD,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAkE,EAClE,GAAW;IAEX,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,oEAAoE;IACpE,kDAAkD;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,EAAE,CAAC;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,IAA6B;IAE7B,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAC9B,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAA;IACxF,MAAM,OAAO,GAAuD,EAAE,CAAA;IACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,SAAQ;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAQ;QAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QACnD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,CAAM,EAAE,MAAc;IACtE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;QAAE,OAAM;IACnC,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,IAAI,SAA6B,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACrC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE;gBAClD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACvB,CAAC,CAAA;YACF,MAAM,MAAM,GAAI,GAAG,EAAE,IAAuC,EAAE,QAEjD,CAAA;YACb,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAA;YAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,EAAE,EAAE,IAAI,CAAA;IACpC,MAAM,GAAG,GACP,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,IAAI,EAAE,qBAAqB,KAAK,QAAQ,IAAI,IAAI,CAAC,qBAAqB,GAAG,CAAC;YACjF,CAAC,CAAC,IAAI,CAAC,qBAAqB;YAC5B,CAAC,CAAC,uBAAuB,CAAA;IAE/B,wCAAwC;IACxC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAM;IAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE;QACjE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KACtC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,oBAAoB,CACnC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAC7E,EAAE,qBAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,CAC1D,CAAA;IACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,gBAAgB,EAAE,EAAE;YAChD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,CAAM,EAAE,MAAc;IAC5D,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;QAClC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;KAChC,CAAC,CAAA;IACF,OAAO,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,QAAQ,CAAA;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAoB,EACpB,UAAkB;IAElB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IACpE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/api/route-helpers/authoring.d.ts

@@ -0,0 +1,32 @@
+import type { PrentaDB } from '../../db/client-types.js';
+/**
+ * Build the system/user prompt for an inline co-author action. Kept
+ * deterministic and small so the governed runtime can route it to any
+ * configured provider/model.
+ */
+export declare function buildCoauthorPrompt(action: 'rewrite' | 'expand' | 'compress' | 'proofread', body: {
+    text?: string;
+    style?: string;
+    tone?: string;
+    instructions?: string;
+    targetLength?: number;
+}): {
+    system: string;
+    user: string;
+    maxTokens: number;
+};
+/**
+ * Common helper for the read endpoints. Reads the `?populate=` query param,
+ * fetches the target collection's field schema, and expands every relation
+ * reference into a {@link RelationSummary}. When the caller didn't ask for
+ * population (or the doc has no `data` field) we short-circuit and return
+ * the doc untouched.
+ *
+ * Lives here (not in `actions.ts`) because the rest of the actions API
+ * stays purely DB-shaped — population is an HTTP concern.
+ */
+export declare function maybePopulate(request: Request, collection: string, doc: Record<string, unknown> | null, dbInstance: PrentaDB, viewer?: {
+    id?: string;
+    role?: string;
+}): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=authoring.d.ts.map

package/dist/api/route-helpers/authoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring.d.ts","sourceRoot":"","sources":["../../../src/api/route-helpers/authoring.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAGxD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,EACvD,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAuDrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACnC,UAAU,EAAE,QAAQ,EACpB,MAAM,CAAC,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA4BzC"}

package/dist/api/route-helpers/authoring.js

@@ -0,0 +1,99 @@
+import { buildRelationLookup } from '../../actions.js';
+import { populateRelations, parsePopulateParam } from '../../fields/relations.js';
+import { getPrentaConfig } from '../../config/runtime.js';
+import { logger } from './http.js';
+/**
+ * Build the system/user prompt for an inline co-author action. Kept
+ * deterministic and small so the governed runtime can route it to any
+ * configured provider/model.
+ */
+export function buildCoauthorPrompt(action, body) {
+    const text = body.text ?? '';
+    switch (action) {
+        case 'expand': {
+            const hint = body.instructions ? ` Follow this guidance: ${body.instructions}.` : '';
+            return {
+                system: 'You are an expert writer. Expand the user\u2019s text with more detail and depth ' +
+                    'while preserving its meaning and voice.' +
+                    hint +
+                    ' Return only the expanded text, with no preamble.',
+                user: text,
+                maxTokens: 2048,
+            };
+        }
+        case 'compress': {
+            const hint = typeof body.targetLength === 'number' && body.targetLength > 0
+                ? ` Aim for about ${body.targetLength} words.`
+                : '';
+            return {
+                system: 'You are an expert editor. Tighten the user\u2019s text, removing redundancy while ' +
+                    'preserving the key information and voice.' +
+                    hint +
+                    ' Return only the edited text, with no preamble.',
+                user: text,
+                maxTokens: 1024,
+            };
+        }
+        case 'proofread':
+            return {
+                system: 'You are a meticulous proofreader. Correct grammar, spelling, and punctuation in the ' +
+                    'user\u2019s text. Preserve its meaning and voice. Return only the corrected text, ' +
+                    'with no preamble.',
+                user: text,
+                maxTokens: 2048,
+            };
+        case 'rewrite':
+        default: {
+            const style = body.style ? ` Write in a ${body.style} style.` : '';
+            const tone = body.tone ? ` Use a ${body.tone} tone.` : '';
+            return {
+                system: 'You are an expert editor. Rewrite the user\u2019s text to improve clarity and flow ' +
+                    'while preserving its meaning.' +
+                    style +
+                    tone +
+                    ' Return only the rewritten text, with no preamble.',
+                user: text,
+                maxTokens: 2048,
+            };
+        }
+    }
+}
+/**
+ * Common helper for the read endpoints. Reads the `?populate=` query param,
+ * fetches the target collection's field schema, and expands every relation
+ * reference into a {@link RelationSummary}. When the caller didn't ask for
+ * population (or the doc has no `data` field) we short-circuit and return
+ * the doc untouched.
+ *
+ * Lives here (not in `actions.ts`) because the rest of the actions API
+ * stays purely DB-shaped — population is an HTTP concern.
+ */
+export async function maybePopulate(request, collection, doc, dbInstance, viewer) {
+    if (!doc)
+        return doc;
+    const url = new URL(request.url);
+    const opts = parsePopulateParam(url.searchParams.get('populate'));
+    if (!opts)
+        return doc;
+    const cfg = getPrentaConfig();
+    const fields = cfg?.collections?.[collection]?.fields;
+    if (!fields)
+        return doc;
+    const data = doc.data && typeof doc.data === 'object' ? doc.data : null;
+    if (!data)
+        return doc;
+    try {
+        const populated = await populateRelations(fields, data, buildRelationLookup(dbInstance, { viewer }), opts);
+        return { ...doc, data: populated };
+    }
+    catch (err) {
+        // Never let a populate failure mask the underlying document — log and
+        // return the unpopulated doc.
+        logger.error('populate failed', {
+            collection,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return doc;
+    }
+}
+//# sourceMappingURL=authoring.js.map

package/dist/api/route-helpers/authoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring.js","sourceRoot":"","sources":["../../../src/api/route-helpers/authoring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAElC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAuD,EACvD,IAMC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;IAC5B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YACpF,OAAO;gBACL,MAAM,EACJ,mFAAmF;oBACnF,yCAAyC;oBACzC,IAAI;oBACJ,mDAAmD;gBACrD,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC;gBAC5D,CAAC,CAAC,kBAAkB,IAAI,CAAC,YAAY,SAAS;gBAC9C,CAAC,CAAC,EAAE,CAAA;YACR,OAAO;gBACL,MAAM,EACJ,oFAAoF;oBACpF,2CAA2C;oBAC3C,IAAI;oBACJ,iDAAiD;gBACnD,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,CAAC;QACD,KAAK,WAAW;YACd,OAAO;gBACL,MAAM,EACJ,sFAAsF;oBACtF,oFAAoF;oBACpF,mBAAmB;gBACrB,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,SAAS,CAAC;QACf,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;YACzD,OAAO;gBACL,MAAM,EACJ,qFAAqF;oBACrF,+BAA+B;oBAC/B,KAAK;oBACL,IAAI;oBACJ,oDAAoD;gBACtD,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,UAAkB,EAClB,GAAmC,EACnC,UAAoB,EACpB,MAAuC;IAEvC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAA;IACrB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IACvB,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzF,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,MAAM,EACN,IAAI,EACJ,mBAAmB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAC3C,IAAI,CACL,CAAA;QACD,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAC9B,UAAU;YACV,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAA;QACF,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC"}

package/dist/api/route-helpers/forms.d.ts

@@ -0,0 +1,46 @@
+import type { FetchFormEntriesParams, FetchFormsParams, FormDefinition } from '../../forms/types.js';
+import { type IncomingFile } from '../../forms/files.js';
+export declare function normalizeSubmission(submission: any): any;
+/**
+ * Map a forms-service domain error to an HTTP response. Returns `null` for
+ * unrecognised errors so the caller can fall through to `internalError`.
+ */
+export declare function mapFormError(err: unknown): Response | null;
+export declare function parseFormsQuery(url: URL): FetchFormsParams;
+export declare function parseEntriesQuery(url: URL): FetchFormEntriesParams;
+/**
+ * Build CORS headers for the public form endpoints. When the form has no
+ * embed allowlist we reflect the requesting origin (open embedding). When an
+ * allowlist is set we only echo the origin if it matches, so a disallowed site
+ * cannot read the response. Browser-level CORS is complemented by a hard
+ * server-side origin check in the submit handler.
+ */
+export declare function formCorsHeaders(request: Request, allowedDomains?: string[]): Record<string, string>;
+export declare function jsonWithHeaders(data: unknown, status: number, extra: Record<string, string>): Response;
+/**
+ * Parse a public submission request into field values, files, and metadata.
+ * Supports both `application/json` (no files) and `multipart/form-data`
+ * (files + fields). Unknown/oversized bodies are rejected by the caller's
+ * Content-Length gate before this runs.
+ */
+export declare function parseSubmissionRequest(request: Request): Promise<{
+    values: Record<string, unknown>;
+    files: IncomingFile[];
+    meta: {
+        attribution: Record<string, unknown> | null;
+        elapsedMs: number | null;
+        pageUrl: string | null;
+        captchaToken: string;
+    };
+} | null>;
+/**
+ * Shared public-submission handler used by both the slug-based public route and
+ * the legacy by-id route. Enforces per-IP+form rate limiting, embed-origin
+ * allowlisting, optional CAPTCHA, file validation, then runs the core
+ * submission pipeline. Always responds with CORS headers so embedded forms can
+ * read the result.
+ */
+export declare function submitToForm(request: Request, form: FormDefinition): Promise<Response>;
+/** Native HTML form posts typically prefer HTML; fetch/XHR clients send Accept: application/json. */
+export declare function requestPrefersHtmlResponse(request: Request): boolean;
+//# sourceMappingURL=forms.d.ts.map

package/dist/api/route-helpers/forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms.d.ts","sourceRoot":"","sources":["../../../src/api/route-helpers/forms.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EAEf,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAA;AAS7B,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,GAAG,OAuBlD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAc1D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,gBAAgB,CAkB1D;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,sBAAsB,CAyBlE;AAGD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB;AAuBD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,QAAQ,CAKV;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IACtE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,IAAI,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;QAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF,GAAG,IAAI,CAAC,CAkCR;AA4FD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmJ5F;AAED,qGAAqG;AACrG,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAWpE"}

package/dist/api/route-helpers/forms.js

@@ -0,0 +1,435 @@
+import { verifyCaptcha, getCaptchaConfig, isCaptchaProviderError } from '../../security/captcha.js';
+import { logEvent } from '../../security/audit.js';
+import { FormNotFoundError, FormValidationError, FormConflictError, FormHasSubmissionsError, } from '../../forms/service.js';
+import { processSubmission, SubmissionValidationError, resolveSubmissionFields, } from '../../forms/submission.js';
+import { validateSubmissionFiles, FORM_UPLOAD_ALLOWED_MIME_TYPES, DEFAULT_MAX_FILE_BYTES, } from '../../forms/files.js';
+import { FormWebhookError } from '../../forms/webhooks.js';
+import { createRateLimiter } from '../../security/rate-limit.js';
+import { getClientIp, isResolvedIp } from '../../security/client-ip.js';
+import { getPrentaConfig } from '../../config/runtime.js';
+import { SECURITY_HEADERS } from '../security-headers.js';
+import { json, errorResponse, internalError, clampPageSize, clampPage, asRecord } from './http.js';
+import { checkRateLimitAsync } from './auth.js';
+export function normalizeSubmission(submission) {
+    const data = asRecord(submission.data);
+    const attribution = asRecord(submission.attribution);
+    return {
+        ...submission,
+        name: String(data.name ?? submission.name ?? ''),
+        email: String(data.email ?? submission.email ?? ''),
+        phone: data.phone ?? submission.phone,
+        message: String(data.message ?? submission.message ?? ''),
+        status: submission.status ?? 'new',
+        attribution: {
+            source: String(attribution.source ?? '(direct)'),
+            medium: String(attribution.medium ?? '(none)'),
+            campaign: String(attribution.campaign ?? ''),
+            term: String(attribution.term ?? ''),
+            content: String(attribution.content ?? ''),
+            landingPage: String(attribution.landingPage ?? ''),
+            referrer: String(attribution.referrer ?? ''),
+            deviceType: attribution.deviceType ?? 'Desktop',
+            clickIds: asRecord(attribution.clickIds),
+            capturedAt: attribution.capturedAt ?? submission.submittedAt ?? submission.createdAt ?? null,
+        },
+    };
+}
+/**
+ * Map a forms-service domain error to an HTTP response. Returns `null` for
+ * unrecognised errors so the caller can fall through to `internalError`.
+ */
+export function mapFormError(err) {
+    if (err instanceof FormNotFoundError)
+        return errorResponse(err.message, 404);
+    if (err instanceof FormValidationError) {
+        return json({ error: err.message, code: 'INVALID_SCHEMA', details: err.errors }, 400);
+    }
+    if (err instanceof FormConflictError)
+        return errorResponse(err.message, 409);
+    if (err instanceof FormHasSubmissionsError) {
+        return json({ error: err.message, code: 'FORM_HAS_SUBMISSIONS', submissionCount: err.submissionCount }, 409);
+    }
+    if (err instanceof FormWebhookError)
+        return errorResponse(err.message, err.status);
+    return null;
+}
+export function parseFormsQuery(url) {
+    const sp = url.searchParams;
+    const status = sp.get('status');
+    const notify = sp.get('notifyEnabled');
+    return {
+        search: sp.get('search') ?? undefined,
+        status: status === 'active' || status === 'draft' || status === 'archived' ? status : undefined,
+        notifyEnabled: notify == null ? undefined : notify === 'true',
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc'
+            ? 'asc'
+            : sp.get('sortDirection') === 'desc'
+                ? 'desc'
+                : undefined,
+        page: sp.get('page') ? clampPage(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? clampPageSize(sp.get('pageSize')) : undefined,
+    };
+}
+export function parseEntriesQuery(url) {
+    const sp = url.searchParams;
+    const spam = sp.get('spamStatus');
+    const boolParam = (key) => {
+        const v = sp.get(key);
+        return v == null ? undefined : v === 'true';
+    };
+    return {
+        search: sp.get('search') ?? undefined,
+        formId: sp.get('formId') ?? sp.get('form') ?? undefined,
+        unread: boolParam('unread'),
+        starred: boolParam('starred'),
+        archived: boolParam('archived'),
+        spamStatus: spam === 'clean' || spam === 'suspected' || spam === 'spam'
+            ? spam
+            : undefined,
+        dateFrom: sp.get('dateFrom') ?? undefined,
+        dateTo: sp.get('dateTo') ?? undefined,
+        thisWeek: boolParam('thisWeek'),
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc' ? 'asc' : undefined,
+        page: sp.get('page') ? clampPage(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? clampPageSize(sp.get('pageSize')) : undefined,
+    };
+}
+// ─── Public form submission helpers ─────────────────────────────────────────
+/**
+ * Build CORS headers for the public form endpoints. When the form has no
+ * embed allowlist we reflect the requesting origin (open embedding). When an
+ * allowlist is set we only echo the origin if it matches, so a disallowed site
+ * cannot read the response. Browser-level CORS is complemented by a hard
+ * server-side origin check in the submit handler.
+ */
+export function formCorsHeaders(request, allowedDomains) {
+    const origin = request.headers.get('origin');
+    const headers = {
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type, X-Requested-With',
+        'Access-Control-Max-Age': '600',
+        Vary: 'Origin',
+    };
+    if (!allowedDomains || allowedDomains.length === 0) {
+        headers['Access-Control-Allow-Origin'] = origin || '*';
+    }
+    else if (origin && isOriginAllowed(origin, allowedDomains)) {
+        headers['Access-Control-Allow-Origin'] = origin;
+    }
+    return headers;
+}
+function normalizeAllowedHost(domain) {
+    return domain
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, '')
+        .replace(/\/.*$/, '')
+        .replace(/^\*\./, '');
+}
+function isOriginAllowed(origin, allowedDomains) {
+    let host;
+    try {
+        host = new URL(origin).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    return allowedDomains
+        .map(normalizeAllowedHost)
+        .some((a) => a !== '' && (host === a || host.endsWith(`.${a}`)));
+}
+export function jsonWithHeaders(data, status, extra) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { ...SECURITY_HEADERS, ...extra },
+    });
+}
+/**
+ * Parse a public submission request into field values, files, and metadata.
+ * Supports both `application/json` (no files) and `multipart/form-data`
+ * (files + fields). Unknown/oversized bodies are rejected by the caller's
+ * Content-Length gate before this runs.
+ */
+export async function parseSubmissionRequest(request) {
+    const contentType = request.headers.get('content-type') ?? '';
+    if (contentType.includes('multipart/form-data')) {
+        const form = await request.formData();
+        return parseFlatSubmissionEntries(form.entries());
+    }
+    if (contentType.includes('application/x-www-form-urlencoded')) {
+        const text = await request.text();
+        return parseFlatSubmissionEntries(new URLSearchParams(text).entries());
+    }
+    // JSON body.
+    const body = (await request.json().catch(() => null));
+    if (!body)
+        return null;
+    const values = body.fields && typeof body.fields === 'object' && !Array.isArray(body.fields)
+        ? body.fields
+        : null;
+    if (!values)
+        return null;
+    return {
+        values,
+        files: [],
+        meta: {
+            attribution: safeJsonObject(body.attribution),
+            elapsedMs: typeof body.elapsedMs === 'number' && Number.isFinite(body.elapsedMs)
+                ? body.elapsedMs
+                : null,
+            pageUrl: typeof body.pageUrl === 'string' ? body.pageUrl : null,
+            captchaToken: typeof body.captchaToken === 'string' ? body.captchaToken : '',
+        },
+    };
+}
+async function readSubmissionFile(value) {
+    if (typeof value !== 'object' || value === null || !('arrayBuffer' in value))
+        return null;
+    const file = value;
+    if (file.size === 0 && !file.name)
+        return null;
+    const buffer = Buffer.from(await file.arrayBuffer());
+    return {
+        fieldKey: '',
+        fileName: file.name || 'file',
+        mimeType: file.type || 'application/octet-stream',
+        size: buffer.byteLength,
+        buffer,
+    };
+}
+function parseFlatSubmissionEntries(entries) {
+    return (async () => {
+        const values = {};
+        const files = [];
+        let attribution = null;
+        let elapsedMs = null;
+        let pageUrl = null;
+        let captchaToken = '';
+        let renderStartedAt = null;
+        for (const [key, rawValue] of entries) {
+            if (typeof rawValue === 'object' && rawValue !== null && 'arrayBuffer' in rawValue) {
+                const file = await readSubmissionFile(rawValue);
+                if (file) {
+                    file.fieldKey = key;
+                    files.push(file);
+                }
+                continue;
+            }
+            const str = String(rawValue);
+            if (key === '__attribution') {
+                attribution = safeJsonObject(str);
+            }
+            else if (key === '__elapsedMs') {
+                const n = Number(str);
+                elapsedMs = Number.isFinite(n) ? n : null;
+            }
+            else if (key === '__renderStartedAt') {
+                const n = Number(str);
+                renderStartedAt = Number.isFinite(n) ? n : null;
+            }
+            else if (key === '__pageUrl') {
+                pageUrl = str || null;
+            }
+            else if (key === '__captchaToken' || key === 'captchaToken') {
+                captchaToken = str;
+            }
+            else if (Object.prototype.hasOwnProperty.call(values, key)) {
+                const existing = values[key];
+                values[key] = Array.isArray(existing) ? [...existing, str] : [existing, str];
+            }
+            else {
+                values[key] = str;
+            }
+        }
+        if (elapsedMs === null && renderStartedAt !== null) {
+            elapsedMs = Math.max(0, Date.now() - renderStartedAt);
+        }
+        return { values, files, meta: { attribution, elapsedMs, pageUrl, captchaToken } };
+    })();
+}
+function safeJsonObject(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim()) {
+        try {
+            const parsed = JSON.parse(value);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            /* ignore malformed attribution blob */
+        }
+    }
+    return null;
+}
+/**
+ * Shared public-submission handler used by both the slug-based public route and
+ * the legacy by-id route. Enforces per-IP+form rate limiting, embed-origin
+ * allowlisting, optional CAPTCHA, file validation, then runs the core
+ * submission pipeline. Always responds with CORS headers so embedded forms can
+ * read the result.
+ */
+export async function submitToForm(request, form) {
+    const allowedDomains = form.embedSettings?.allowedDomains;
+    const cors = formCorsHeaders(request, allowedDomains);
+    const ip = getClientIp(request);
+    const rlKey = isResolvedIp(ip) ? `formsubmit:${ip}:${form.id}` : `formsubmit:_unknown:${form.id}`;
+    if (!(await checkRateLimitAsync(formLimiterGlobal, rlKey))) {
+        return jsonWithHeaders({ error: 'Too many submissions. Please try again later.' }, 429, cors);
+    }
+    // Hard server-side origin check when an embed allowlist is configured —
+    // browser CORS alone does not prevent a non-browser client from posting.
+    if (allowedDomains && allowedDomains.length > 0) {
+        const origin = request.headers.get('origin');
+        if (origin && !isOriginAllowed(origin, allowedDomains)) {
+            return jsonWithHeaders({ error: 'This form cannot be submitted from this origin.' }, 403, cors);
+        }
+    }
+    const parsed = await parseSubmissionRequest(request);
+    if (!parsed) {
+        return jsonWithHeaders({ error: 'Invalid or missing submission body.' }, 400, cors);
+    }
+    const captchaConfig = getCaptchaConfig();
+    if (captchaConfig.provider !== 'none' && captchaConfig.enforce) {
+        const result = await verifyCaptcha(parsed.meta.captchaToken, captchaConfig, isResolvedIp(ip) ? ip : undefined);
+        if (!result.success) {
+            const providerError = isCaptchaProviderError(result);
+            if (providerError && captchaConfig.onProviderError === 'fail-open') {
+                void logEvent({
+                    event: 'captcha.provider_error',
+                    details: {
+                        formId: form.id,
+                        formSlug: form.slug,
+                        provider: captchaConfig.provider,
+                        policy: 'fail-open',
+                        errorCodes: result.errorCodes ?? [],
+                    },
+                }).catch(() => { });
+            }
+            else {
+                void logEvent({
+                    event: providerError ? 'captcha.provider_error' : 'captcha.verify_failed',
+                    details: {
+                        formId: form.id,
+                        formSlug: form.slug,
+                        provider: captchaConfig.provider,
+                        policy: providerError ? captchaConfig.onProviderError : 'reject',
+                        errorCodes: result.errorCodes ?? [],
+                        score: result.score ?? null,
+                    },
+                }).catch(() => { });
+                return jsonWithHeaders({
+                    error: providerError
+                        ? 'CAPTCHA provider unavailable. Please try again shortly.'
+                        : 'CAPTCHA verification failed. Please try again.',
+                    code: providerError ? 'CAPTCHA_PROVIDER_ERROR' : 'CAPTCHA_FAILED',
+                }, 403, cors);
+            }
+        }
+    }
+    if (parsed.files.length > 0) {
+        const fileCfg = getPrentaConfig()?.forms?.fileUpload;
+        if (fileCfg?.enabled === false) {
+            return jsonWithHeaders({ error: 'File uploads are not enabled for this site.' }, 400, cors);
+        }
+        const { fields } = await resolveSubmissionFields(form);
+        const fileCheck = validateSubmissionFiles(fields, parsed.files, {
+            maxSizeBytes: fileCfg?.maxSizeMB ? fileCfg.maxSizeMB * 1024 * 1024 : DEFAULT_MAX_FILE_BYTES,
+            allowedMimeTypes: fileCfg?.allowedMimeTypes ?? FORM_UPLOAD_ALLOWED_MIME_TYPES,
+        });
+        if (!fileCheck.ok) {
+            return jsonWithHeaders({ error: 'File validation failed.', code: 'INVALID_FILES', details: fileCheck.errors }, 422, cors);
+        }
+    }
+    const ctx = {
+        values: parsed.values,
+        files: parsed.files,
+        ip,
+        userAgent: request.headers.get('user-agent'),
+        referrer: request.headers.get('referer'),
+        origin: request.headers.get('origin'),
+        pageUrl: parsed.meta.pageUrl,
+        attribution: parsed.meta.attribution,
+        elapsedMs: parsed.meta.elapsedMs,
+    };
+    try {
+        const result = await processSubmission(form, ctx);
+        const confirmation = result.confirmation;
+        if (requestPrefersHtmlResponse(request)) {
+            if (confirmation.type === 'redirect' && confirmation.redirectUrl) {
+                return Response.redirect(confirmation.redirectUrl, 303);
+            }
+            const message = confirmation.message ??
+                form.successMessage ??
+                'Thank you! Your submission has been received.';
+            return htmlWithHeaders(renderSubmissionResultHtml(message, false), 201, cors);
+        }
+        return jsonWithHeaders({
+            data: {
+                success: true,
+                submissionId: result.submissionId,
+                entryNumber: result.entryNumber,
+                confirmation: result.confirmation,
+            },
+        }, 201, cors);
+    }
+    catch (err) {
+        if (err instanceof SubmissionValidationError) {
+            if (requestPrefersHtmlResponse(request)) {
+                return htmlWithHeaders(renderSubmissionResultHtml('Please check the form and try again.', true), 422, cors);
+            }
+            return jsonWithHeaders({ error: 'Validation failed.', code: 'VALIDATION_ERROR', details: err.fieldErrors }, 422, cors);
+        }
+        return internalError(err);
+    }
+}
+/** Native HTML form posts typically prefer HTML; fetch/XHR clients send Accept: application/json. */
+export function requestPrefersHtmlResponse(request) {
+    const accept = request.headers.get('accept') ?? '';
+    if (accept.includes('application/json') && !accept.includes('text/html'))
+        return false;
+    const contentType = request.headers.get('content-type') ?? '';
+    if (contentType.includes('application/x-www-form-urlencoded') ||
+        contentType.includes('multipart/form-data')) {
+        return !accept.includes('application/json') || accept.includes('text/html');
+    }
+    return accept.includes('text/html') && !accept.includes('application/json');
+}
+function escapeHtmlText(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+function renderSubmissionResultHtml(message, isError) {
+    const title = isError ? 'Submission error' : 'Thank you';
+    const role = isError ? 'alert' : 'status';
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${escapeHtmlText(title)}</title>
+</head>
+<body>
+<main><p role="${role}">${escapeHtmlText(message)}</p></main>
+</body>
+</html>`;
+}
+function htmlWithHeaders(body, status, extra) {
+    return new Response(body, {
+        status,
+        headers: {
+            ...SECURITY_HEADERS,
+            'Content-Type': 'text/html; charset=utf-8',
+            ...extra,
+        },
+    });
+}
+const formLimiterGlobal = createRateLimiter({ maxRequests: 10, windowMs: 60_000 });
+//# sourceMappingURL=forms.js.map