@prenta/core 7.7.1 → 7.8.0

package/dist/api/route-helpers/auth.js

@@ -0,0 +1,505 @@
+import { assertCollectionAccess } from '../../actions.js';
+import { verifySession } from '../../auth/session.js';
+import { resolveEmailSender } from '../../email/sender.js';
+import { workspaceDomainFromUrl } from '../../auth/team.js';
+import { getDB } from '../../db.js';
+import { createRateLimiter } from '../../security/rate-limit.js';
+import { bindRequestLogUser } from '../../diagnostics/logger.js';
+import { getClientIp } from '../../security/client-ip.js';
+import { enforceSessionLimits } from '../../security/session-limits.js';
+import { verifyReauth } from '../../security/reauth.js';
+import { getPrentaConfig } from '../../config/runtime.js';
+import { hashApiKey, looksLikeApiKey, validateApiKeyScope, validateApiKeyGlobalScope, validateApiKeyMediaScope, validateApiKeyIp, } from '../../security/api-key-enhanced.js';
+import { guardedDb } from '../guarded-db.js';
+import { SECURITY_HEADERS } from '../security-headers.js';
+import { logger, json, errorResponse, hasModel } from './http.js';
+let _secretMissing = false;
+let _secretWarningLogged = false;
+export function getSessionSecret() {
+    const secret = process.env.CMS_SECRET ?? process.env.CMS_SESSION_SECRET ?? getPrentaConfig()?.secret;
+    if (!secret) {
+        _secretMissing = true;
+        if (!_secretWarningLogged) {
+            _secretWarningLogged = true;
+            logger.error('Missing CMS secret. Set CMS_SECRET (min 32 characters) or pass secret in prenta.config.ts. Authenticated routes return 503 until it is set.');
+        }
+        throw new Error('CMS secret not configured');
+    }
+    if (secret.length < 32) {
+        throw new Error('[Prenta CMS] CMS secret must be at least 32 characters (got ' +
+            secret.length +
+            '). ' +
+            "Generate a secure value with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
+    }
+    _secretMissing = false;
+    return secret;
+}
+export function isSecretMissing() {
+    if (_secretMissing)
+        return true;
+    try {
+        getSessionSecret();
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+export async function extractSession(request) {
+    if (isSecretMissing())
+        return null;
+    let token;
+    const authHeader = request.headers.get('Authorization');
+    if (authHeader?.startsWith('Bearer ')) {
+        token = authHeader.slice(7);
+    }
+    if (!token) {
+        const cookieHeader = request.headers.get('cookie') ?? '';
+        const cookies = parseCookieHeader(cookieHeader);
+        token = cookies['prenta_session'];
+    }
+    if (!token)
+        return null;
+    // API key path. Keys are recognized by the `act_sk_` prefix and looked up
+    // by SHA-256 hash. We never JWT-verify these tokens — they are opaque
+    // random secrets stored as hashes in `prenta_api_keys`.
+    if (looksLikeApiKey(token)) {
+        try {
+            const d = getDB();
+            if (!hasModel(d, 'apiKey'))
+                return null;
+            const hash = await hashApiKey(token);
+            const apiKey = await d.apiKey.findUnique({ where: { keyHash: hash } });
+            if (!apiKey)
+                return null;
+            if (apiKey.revokedAt)
+                return null;
+            if (apiKey.expiresAt && new Date(apiKey.expiresAt).getTime() < Date.now())
+                return null;
+            const ipRestrictions = Array.isArray(apiKey.ipRestrictions)
+                ? apiKey.ipRestrictions
+                : apiKey.ipRestrictions
+                    ? (apiKey.ipRestrictions.allow ?? null)
+                    : null;
+            if (ipRestrictions && ipRestrictions.length > 0) {
+                const ip = getClientIp(request);
+                if (!validateApiKeyIp(ipRestrictions, ip))
+                    return null;
+            }
+            // Keys inherit the owner's current lifecycle + role. Suspension, lock,
+            // deactivation, or a demotion must take effect immediately — the key
+            // cannot outrank the user who minted it (CRIT-1).
+            if (!hasModel(d, 'user'))
+                return null;
+            const owner = await d.user.findUnique({
+                where: { id: apiKey.userId },
+                select: { id: true, role: true, isActive: true, suspendedAt: true, lockedAt: true },
+            });
+            if (!owner)
+                return null;
+            if (owner.isActive === false || owner.suspendedAt || owner.lockedAt)
+                return null;
+            const scopes = apiKey.scopes ?? {};
+            // Fire-and-forget lastUsedAt update; never block the request on it.
+            void d.apiKey
+                .update({ where: { id: apiKey.id }, data: { lastUsedAt: new Date() } })
+                .catch(() => { });
+            bindRequestLogUser(apiKey.userId);
+            return {
+                userId: apiKey.userId,
+                role: scopes.admin ? String(owner.role || 'ADMIN') : 'API_KEY',
+                sessionId: apiKey.id,
+                apiKey: { id: apiKey.id, scopes },
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    // Session JWT path.
+    try {
+        const payload = await verifySession(token, { secret: getSessionSecret() });
+        const d = getDB();
+        if (hasModel(d, 'session')) {
+            const dbSession = await d.session.findUnique({
+                where: { id: payload.sessionId },
+                select: { revokedAt: true },
+            });
+            if (!dbSession || dbSession.revokedAt)
+                return null;
+        }
+        if (payload.userId)
+            bindRequestLogUser(payload.userId);
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseCookieHeader(cookieHeader) {
+    const cookies = {};
+    for (const pair of cookieHeader.split(';')) {
+        const [key, ...rest] = pair.split('=');
+        if (key) {
+            cookies[key.trim()] = rest.join('=').trim();
+        }
+    }
+    return cookies;
+}
+/**
+ * Verify a password (or "current password") posted in the X-Reauth-Password
+ * header against the authenticated user. Returns an error Response when the
+ * header is missing or the password is wrong; returns null on success.
+ *
+ * Use this for high-impact account changes (TOTP enable/disable, role change,
+ * delete user, etc.) so a stolen session alone cannot perform them.
+ */
+export async function requirePasswordReauth(request, userId) {
+    const password = request.headers.get('x-reauth-password');
+    if (!password) {
+        return new Response(JSON.stringify({
+            error: 'Re-authentication required for this action.',
+            code: 'REAUTH_REQUIRED',
+            method: 'password',
+        }), { status: 401, headers: { ...SECURITY_HEADERS } });
+    }
+    try {
+        const { getDB } = await import('../../db.js');
+        const ok = await verifyReauth(userId, password, 'password', getDB());
+        if (!ok) {
+            return errorResponse('Re-authentication failed.', 401);
+        }
+        return null;
+    }
+    catch (err) {
+        logger.error('reauth verify failed', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return errorResponse('Re-authentication failed.', 401);
+    }
+}
+export async function requireAuth(request) {
+    if (isSecretMissing()) {
+        return {
+            error: json({
+                error: 'CMS secret not configured. Set CMS_SECRET or CMS_SESSION_SECRET environment variable (min 32 characters).',
+                code: 'MISSING_SECRET',
+            }, 503),
+        };
+    }
+    const session = await extractSession(request);
+    if (!session) {
+        return { error: errorResponse('Unauthorized', 401) };
+    }
+    return { session };
+}
+/**
+ * API-key collection-scope check as a plain denial reason (`null` = allowed).
+ * JWT sessions are never denied here — role checks are the route's job. Use
+ * this where the collection is only known deep inside a service (e.g. an SEO
+ * fix that writes a document) and a `Response` cannot be returned directly.
+ */
+export function apiKeyCollectionScopeDenial(session, collection, action) {
+    if (!session.apiKey)
+        return null;
+    return validateApiKeyScope(session.apiKey.scopes, collection, action)
+        ? null
+        : `API key does not have permission to ${action} on collection "${collection}"`;
+}
+/**
+ * Check that the request's auth context permits `action` on `collection`.
+ * - Session-authenticated requests fall through to `requireRole` semantics:
+ *   write actions require WRITE_ROLES.
+ * - API-key-authenticated requests must have an explicit scope match.
+ */
+export function requireCollectionScope(session, collection, action) {
+    if (session.apiKey) {
+        const denial = apiKeyCollectionScopeDenial(session, collection, action);
+        return denial ? errorResponse(denial, 403) : null;
+    }
+    if (action === 'read')
+        return null;
+    return requireRole(session.role, WRITE_ROLES);
+}
+export function requireGlobalScope(session, slug) {
+    if (session.apiKey) {
+        if (!validateApiKeyGlobalScope(session.apiKey.scopes, slug)) {
+            return errorResponse(`API key does not have permission for global "${slug}"`, 403);
+        }
+    }
+    return null;
+}
+export function requireMediaScope(session) {
+    if (session.apiKey) {
+        if (!validateApiKeyMediaScope(session.apiKey.scopes)) {
+            return errorResponse('API key does not have media scope', 403);
+        }
+    }
+    return null;
+}
+export function requireAdminScope(session) {
+    if (session.apiKey) {
+        if (!session.apiKey.scopes.admin) {
+            return errorResponse('API key does not have admin scope', 403);
+        }
+        return null;
+    }
+    return requireRole(session.role, ADMIN_ROLES);
+}
+export function buildActionContext(session, db, locale) {
+    return {
+        userId: session.userId,
+        role: session.role,
+        locale,
+        db,
+    };
+}
+export const WRITE_ROLES = new Set(['OWNER', 'ADMIN', 'EDITOR', 'AUTHOR']);
+export const ADMIN_ROLES = new Set(['OWNER', 'ADMIN']);
+export function requireRole(role, allowedRoles) {
+    if (!allowedRoles.has(role)) {
+        return errorResponse('Insufficient permissions', 403);
+    }
+    return null;
+}
+/**
+ * Build the shared {@link TeamOptions} for the Users endpoints from config +
+ * session: the workspace domain (for external-domain detection) and the seat
+ * cap (config-provided; null = unlimited until billing exists).
+ */
+export function teamOptionsFor(session) {
+    const cfg = getPrentaConfig();
+    const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ??
+        cfg?.seo?.siteUrl ??
+        null;
+    const seatLimit = cfg?.users?.seatLimit ??
+        cfg?.admin?.seatLimit ??
+        null;
+    return {
+        workspaceDomain: workspaceDomainFromUrl(siteUrl),
+        seatLimit,
+        currentUserId: session.userId,
+    };
+}
+/** Whether the configured email provider can actually send mail. */
+function isEmailConfigured() {
+    const cfg = getPrentaConfig();
+    if (cfg?.platform?.email)
+        return true;
+    return !!resolveEmailSender();
+}
+/**
+ * DB-aware variant of {@link isEmailConfigured} — also true when a provider
+ * is configured through Settings > Email.
+ */
+export async function isEmailConfiguredAsync(db) {
+    if (isEmailConfigured())
+        return true;
+    const { resolveEmailSenderAsync } = await import('../../email/resolve.js');
+    return Boolean(await resolveEmailSenderAsync(db));
+}
+export const loginLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+// Fallback limiter for auth requests whose client IP can't be resolved (no
+// trusted proxy header) — those all share ONE bucket. The strict 5/15min
+// `loginLimiter` there would let a handful of anonymous requests lock every
+// user out of login (see #536), so the shared "unknown" bucket gets a much
+// higher ceiling. The real fix is resolving IPs (PRENTA_TRUST_PROXY); this
+// just bounds abuse without turning a mis-config into a global outage.
+export const loginUnknownLimiter = createRateLimiter({
+    maxRequests: 100,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+/** Per-email-hash login limiter so account protection does not depend on IP. */
+export const loginEmailLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+// Admin-gated, but bounds invitation-email volume (and accidental loops) per
+// admin: enough to onboard a team, low enough to deter abuse.
+export const inviteLimiter = createRateLimiter({ maxRequests: 20, windowMs: 60 * 60 * 1000 });
+export const totpLimiter = createRateLimiter({
+    maxRequests: 10,
+    windowMs: 15 * 60 * 1000,
+    failClosed: true,
+});
+// Admin-gated test sends from Settings > Email — enough to debug a provider
+// setup, low enough that a compromised admin session can't spray mail.
+export const emailTestLimiter = createRateLimiter({ maxRequests: 10, windowMs: 60 * 60 * 1000 });
+export const aiGenerateLimiter = createRateLimiter({
+    maxRequests: 20,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Strict per-user upload cap (security rule: uploads strict at 20/hour) — guards
+// storage cost and optimization abuse beyond the global per-IP API bucket.
+export const uploadLimiter = createRateLimiter({
+    maxRequests: 20,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Deterministic (no provider) AI-adjacent routes that scan/iterate documents.
+// Cheaper than the generation budget but still bounded against cost/DoS.
+export const aiAnalysisLimiter = createRateLimiter({
+    maxRequests: 60,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Upper bound on free-text inputs to the deterministic analysis routes
+// (document body / link-candidate content) — caps memory + scan work.
+export const AI_ANALYSIS_MAX_CHARS = 50_000;
+export const linkHealthLimiter = createRateLimiter({ maxRequests: 4, windowMs: 60 * 60 * 1000 });
+export const seoAuditLimiter = createRateLimiter({ maxRequests: 10, windowMs: 60 * 60 * 1000 });
+// Admin-gated live checks against the Google Search Console API ("Test
+// connection") — enough to debug a setup, bounded against key-guessing.
+export const searchConsoleTestLimiter = createRateLimiter({
+    maxRequests: 10,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Manual search-data syncs hit Google quotas and write big row sets; the
+// nightly cron is the normal path, so the manual button is strictly bounded.
+export const searchSyncLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+// Digest test-sends dispatch real email to the caller — strictly bounded.
+export const digestTestSendLimiter = createRateLimiter({
+    maxRequests: 5,
+    windowMs: 60 * 60 * 1000,
+    failClosed: true,
+});
+export async function checkRateLimitAsync(limiter, key) {
+    // Explicit, environment-gated bypass for test harnesses. Production never
+    // sets this — Vercel + the deploy guide both omit it. We deliberately do
+    // NOT key off `NODE_ENV === 'test'` because Next.js builds run with
+    // NODE_ENV=test in some CI configurations and we want rate limiting
+    // exercised by unit tests that explicitly opt in.
+    if (process.env.PRENTA_DISABLE_RATE_LIMIT === '1') {
+        return true;
+    }
+    const result = await limiter.check(key);
+    return result.allowed;
+}
+/**
+ * Resolve the client IP from trusted-proxy headers (Vercel first, then x-real-ip,
+ * then x-forwarded-for only when PRENTA_TRUST_PROXY=1). Returns 'unknown' when
+ * no trustworthy source is available — callers MUST treat that case as a hard
+ * failure for security-sensitive decisions like rate-limit keys and IP allowlists.
+ */
+export function clientIp(request) {
+    return getClientIp(request);
+}
+/**
+ * Compute a before/after diff of top-level scalar (string/number/boolean) keys
+ * between a stored record and an incoming patch. Used to audit settings changes
+ * without ever logging nested objects (which may hold secret blobs).
+ */
+export function diffScalarKeys(previous, next) {
+    const isScalar = (v) => typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean' || v === null;
+    const changes = [];
+    for (const key of Object.keys(next)) {
+        const to = next[key];
+        if (!isScalar(to))
+            continue;
+        const from = previous[key];
+        if (isScalar(from) && from === to)
+            continue;
+        if (!isScalar(from) && from !== undefined)
+            continue;
+        changes.push({ key, from: isScalar(from) ? from : undefined, to });
+    }
+    return changes;
+}
+const MAX_CONCURRENT_SESSIONS = 5;
+/**
+ * After a successful primary-credential check, prune the user's active sessions
+ * down to the configured concurrent maximum (default 5; configurable via
+ * `auth.maxConcurrentSessions`). Strategy is "revoke oldest" so a user can
+ * always sign in.
+ */
+export async function enforceSessionLimitsForUser(d, userId) {
+    if (!hasModel(d, 'session'))
+        return;
+    // Precedence: explicitly-saved Security setting (database) ▸ auth config ▸
+    // default. We read the stored value directly (rather than the parsed
+    // defaults) so an unsaved policy doesn't shadow a config-provided override.
+    let storedMax;
+    try {
+        if (hasModel(d, 'document')) {
+            const row = await d.document.findFirst({
+                where: { collection: 'settings', deletedAt: null },
+                select: { data: true },
+            });
+            const stored = row?.data?.security;
+            const v = stored?.session?.maxConcurrentSessions;
+            if (typeof v === 'number' && Number.isInteger(v) && v >= 0)
+                storedMax = v;
+        }
+    }
+    catch {
+        /* fall back to config/default below */
+    }
+    const auth = getPrentaConfig()?.auth;
+    const max = storedMax !== undefined
+        ? storedMax
+        : typeof auth?.maxConcurrentSessions === 'number' && auth.maxConcurrentSessions > 0
+            ? auth.maxConcurrentSessions
+            : MAX_CONCURRENT_SESSIONS;
+    // 0 ⇒ unlimited: skip pruning entirely.
+    if (max <= 0)
+        return;
+    const active = await d.session.findMany({
+        where: { userId, revokedAt: null, expiresAt: { gt: new Date() } },
+        select: { id: true, createdAt: true },
+    });
+    const decision = enforceSessionLimits(active.map((s) => ({ sessionId: s.id, userId, createdAt: s.createdAt })), { maxConcurrentSessions: max, strategy: 'revoke_oldest' });
+    if (decision.sessionsToRevoke.length > 0) {
+        await d.session.updateMany({
+            where: { id: { in: decision.sessionsToRevoke } },
+            data: { revokedAt: new Date() },
+        });
+    }
+}
+/** Revoke every live API key for a user. Called with session revocation. */
+export async function revokeUserApiKeys(d, userId) {
+    if (!hasModel(d, 'apiKey'))
+        return 0;
+    const result = await d.apiKey.updateMany({
+        where: { userId, revokedAt: null },
+        data: { revokedAt: new Date() },
+    });
+    return typeof result?.count === 'number' ? result.count : 0;
+}
+export function getAdminPath() {
+    return process.env.PRENTA_ADMIN_PATH ?? getPrentaConfig()?.admin?.path ?? '/admin';
+}
+/**
+ * Gate a per-document read for endpoints (e.g. SEO analysis) that fetch a
+ * document directly rather than through the collection CRUD routes. Enforces
+ * both the API-key collection scope and the collection's `access.read` rule
+ * so an AUTHOR scoped to one collection cannot read another's content.
+ * Returns a `Response` to short-circuit with, or `null` when allowed.
+ */
+export async function enforceDocumentReadAccess(session, collection) {
+    const scopeErr = requireCollectionScope(session, collection, 'read');
+    if (scopeErr)
+        return scopeErr;
+    try {
+        await assertCollectionAccess(collection, 'read', buildActionContext(session, guardedDb()));
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.includes('Access denied')) {
+            return errorResponse('Insufficient permissions', 403);
+        }
+        throw err;
+    }
+    return null;
+}
+//# sourceMappingURL=auth.js.map

package/dist/api/route-helpers/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/api/route-helpers/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAoB,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EACL,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,GAEjB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEjE,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B,IAAI,oBAAoB,GAAG,KAAK,CAAA;AAEhC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,eAAe,EAAE,EAAE,MAAM,CAAA;IACvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,cAAc,GAAG,IAAI,CAAA;QACrB,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,oBAAoB,GAAG,IAAI,CAAA;YAC3B,MAAM,CAAC,KAAK,CACV,6IAA6I,CAC9I,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,MAAM,CAAC,MAAM;YACb,KAAK;YACL,0GAA0G,CAC7G,CAAA;IACH,CAAC;IACD,cAAc,GAAG,KAAK,CAAA;IACtB,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,cAAc;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,CAAC;QACH,gBAAgB,EAAE,CAAA;QAClB,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,IAAI,eAAe,EAAE;QAAE,OAAO,IAAI,CAAA;IAElC,IAAI,KAAyB,CAAA;IAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACvD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;QAC/C,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACnC,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,0EAA0E;IAC1E,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,KAAK,EAAY,CAAA;YAC3B,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YACvC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;YACtE,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACxB,IAAI,MAAM,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAA;YAEtF,MAAM,cAAc,GAAoB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC1E,CAAC,CAAE,MAAM,CAAC,cAA2B;gBACrC,CAAC,CAAC,MAAM,CAAC,cAAc;oBACrB,CAAC,CAAC,CAAE,MAAM,CAAC,cAAuC,CAAC,KAAK,IAAI,IAAI,CAAC;oBACjE,CAAC,CAAC,IAAI,CAAA;YACV,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;gBAC/B,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAA;YACxD,CAAC;YAED,uEAAuE;YACvE,qEAAqE;YACrE,kDAAkD;YAClD,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAA;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC5B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;aACpF,CAAC,CAAA;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAEhF,MAAM,MAAM,GAAI,MAAM,CAAC,MAA6B,IAAI,EAAE,CAAA;YAC1D,oEAAoE;YACpE,KAAK,CAAC,CAAC,MAAM;iBACV,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;iBACtE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAElB,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACjC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC9D,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE;aAClC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;QAC1E,MAAM,CAAC,GAAG,KAAK,EAAY,CAAA;QAC3B,IAAI,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE;gBAChC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;aAC5B,CAAC,CAAA;YACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAA;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM;YAAE,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACtD,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,6CAA6C;YACpD,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,UAAU;SACnB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,EAAE,CAClD,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;QAC7C,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QACpE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,aAAa,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;YACnC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB;IAEhB,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,IAAI,CACT;gBACE,KAAK,EACH,2GAA2G;gBAC7G,IAAI,EAAE,gBAAgB;aACvB,EACD,GAAG,CACJ;SACF,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAA;IACtD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAoB,EACpB,UAAkB,EAClB,MAA+C;IAE/C,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAChC,OAAO,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;QACnE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,uCAAuC,MAAM,mBAAmB,UAAU,GAAG,CAAA;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,UAAkB,EAClB,MAA+C;IAE/C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACvE,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnD,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,IAAY;IACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,aAAa,CAAC,gDAAgD,IAAI,GAAG,EAAE,GAAG,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAoB;IACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAoB;IACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACjC,OAAO,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAyC,EACzC,EAAY,EACZ,MAAe;IAEf,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;QACN,EAAE;KACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE1E,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAEtD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,YAAyB;IACjE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAoB;IACjD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;IAC7B,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAC/B,GAA6C,EAAE,GAAG,EAAE,OAAO;QAC5D,IAAI,CAAA;IACN,MAAM,SAAS,GACZ,GAAiD,EAAE,KAAK,EAAE,SAAS;QACnE,GAAiD,EAAE,KAAK,EAAE,SAAS;QACpE,IAAI,CAAA;IACN,OAAO;QACL,eAAe,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAChD,SAAS;QACT,aAAa,EAAE,OAAO,CAAC,MAAM;KAC9B,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;IAC7B,IAAK,GAAiD,EAAE,QAAQ,EAAE,KAAK;QAAE,OAAO,IAAI,CAAA;IACpF,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAA;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAY;IACvD,IAAI,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAA;IAC1E,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAC;IAC5C,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;IACnD,WAAW,EAAE,GAAG;IAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,6EAA6E;AAC7E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAE7F,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;IAC3C,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAEhG,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,iFAAiF;AACjF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;IAC7C,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAEhG,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;AAE/F,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;IACxD,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,yEAAyE;AACzE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;IACjD,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;IACrD,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACxB,UAAU,EAAE,IAAI;CACjB,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAkE,EAClE,GAAW;IAEX,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,oEAAoE;IACpE,kDAAkD;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,EAAE,CAAC;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,IAA6B;IAE7B,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAC9B,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAA;IACxF,MAAM,OAAO,GAAuD,EAAE,CAAA;IACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACpB,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,SAAQ;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAQ;QAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QACnD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;IACpE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,CAAM,EAAE,MAAc;IACtE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;QAAE,OAAM;IACnC,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,IAAI,SAA6B,CAAA;IACjC,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACrC,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE;gBAClD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;aACvB,CAAC,CAAA;YACF,MAAM,MAAM,GAAI,GAAG,EAAE,IAAuC,EAAE,QAEjD,CAAA;YACb,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAA;YAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,EAAE,EAAE,IAAI,CAAA;IACpC,MAAM,GAAG,GACP,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,IAAI,EAAE,qBAAqB,KAAK,QAAQ,IAAI,IAAI,CAAC,qBAAqB,GAAG,CAAC;YACjF,CAAC,CAAC,IAAI,CAAC,qBAAqB;YAC5B,CAAC,CAAC,uBAAuB,CAAA;IAE/B,wCAAwC;IACxC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAM;IAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE;QACjE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KACtC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,oBAAoB,CACnC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAC7E,EAAE,qBAAqB,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,CAC1D,CAAA;IACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,gBAAgB,EAAE,EAAE;YAChD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,CAAM,EAAE,MAAc;IAC5D,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;QAClC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;KAChC,CAAC,CAAA;IACF,OAAO,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,IAAI,QAAQ,CAAA;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAoB,EACpB,UAAkB;IAElB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IACpE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/api/route-helpers/authoring.d.ts

@@ -0,0 +1,32 @@
+import type { PrentaDB } from '../../db/client-types.js';
+/**
+ * Build the system/user prompt for an inline co-author action. Kept
+ * deterministic and small so the governed runtime can route it to any
+ * configured provider/model.
+ */
+export declare function buildCoauthorPrompt(action: 'rewrite' | 'expand' | 'compress' | 'proofread', body: {
+    text?: string;
+    style?: string;
+    tone?: string;
+    instructions?: string;
+    targetLength?: number;
+}): {
+    system: string;
+    user: string;
+    maxTokens: number;
+};
+/**
+ * Common helper for the read endpoints. Reads the `?populate=` query param,
+ * fetches the target collection's field schema, and expands every relation
+ * reference into a {@link RelationSummary}. When the caller didn't ask for
+ * population (or the doc has no `data` field) we short-circuit and return
+ * the doc untouched.
+ *
+ * Lives here (not in `actions.ts`) because the rest of the actions API
+ * stays purely DB-shaped — population is an HTTP concern.
+ */
+export declare function maybePopulate(request: Request, collection: string, doc: Record<string, unknown> | null, dbInstance: PrentaDB, viewer?: {
+    id?: string;
+    role?: string;
+}): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=authoring.d.ts.map

package/dist/api/route-helpers/authoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring.d.ts","sourceRoot":"","sources":["../../../src/api/route-helpers/authoring.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAGxD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,EACvD,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAuDrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACnC,UAAU,EAAE,QAAQ,EACpB,MAAM,CAAC,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CA4BzC"}

package/dist/api/route-helpers/authoring.js

@@ -0,0 +1,99 @@
+import { buildRelationLookup } from '../../actions.js';
+import { populateRelations, parsePopulateParam } from '../../fields/relations.js';
+import { getPrentaConfig } from '../../config/runtime.js';
+import { logger } from './http.js';
+/**
+ * Build the system/user prompt for an inline co-author action. Kept
+ * deterministic and small so the governed runtime can route it to any
+ * configured provider/model.
+ */
+export function buildCoauthorPrompt(action, body) {
+    const text = body.text ?? '';
+    switch (action) {
+        case 'expand': {
+            const hint = body.instructions ? ` Follow this guidance: ${body.instructions}.` : '';
+            return {
+                system: 'You are an expert writer. Expand the user\u2019s text with more detail and depth ' +
+                    'while preserving its meaning and voice.' +
+                    hint +
+                    ' Return only the expanded text, with no preamble.',
+                user: text,
+                maxTokens: 2048,
+            };
+        }
+        case 'compress': {
+            const hint = typeof body.targetLength === 'number' && body.targetLength > 0
+                ? ` Aim for about ${body.targetLength} words.`
+                : '';
+            return {
+                system: 'You are an expert editor. Tighten the user\u2019s text, removing redundancy while ' +
+                    'preserving the key information and voice.' +
+                    hint +
+                    ' Return only the edited text, with no preamble.',
+                user: text,
+                maxTokens: 1024,
+            };
+        }
+        case 'proofread':
+            return {
+                system: 'You are a meticulous proofreader. Correct grammar, spelling, and punctuation in the ' +
+                    'user\u2019s text. Preserve its meaning and voice. Return only the corrected text, ' +
+                    'with no preamble.',
+                user: text,
+                maxTokens: 2048,
+            };
+        case 'rewrite':
+        default: {
+            const style = body.style ? ` Write in a ${body.style} style.` : '';
+            const tone = body.tone ? ` Use a ${body.tone} tone.` : '';
+            return {
+                system: 'You are an expert editor. Rewrite the user\u2019s text to improve clarity and flow ' +
+                    'while preserving its meaning.' +
+                    style +
+                    tone +
+                    ' Return only the rewritten text, with no preamble.',
+                user: text,
+                maxTokens: 2048,
+            };
+        }
+    }
+}
+/**
+ * Common helper for the read endpoints. Reads the `?populate=` query param,
+ * fetches the target collection's field schema, and expands every relation
+ * reference into a {@link RelationSummary}. When the caller didn't ask for
+ * population (or the doc has no `data` field) we short-circuit and return
+ * the doc untouched.
+ *
+ * Lives here (not in `actions.ts`) because the rest of the actions API
+ * stays purely DB-shaped — population is an HTTP concern.
+ */
+export async function maybePopulate(request, collection, doc, dbInstance, viewer) {
+    if (!doc)
+        return doc;
+    const url = new URL(request.url);
+    const opts = parsePopulateParam(url.searchParams.get('populate'));
+    if (!opts)
+        return doc;
+    const cfg = getPrentaConfig();
+    const fields = cfg?.collections?.[collection]?.fields;
+    if (!fields)
+        return doc;
+    const data = doc.data && typeof doc.data === 'object' ? doc.data : null;
+    if (!data)
+        return doc;
+    try {
+        const populated = await populateRelations(fields, data, buildRelationLookup(dbInstance, { viewer }), opts);
+        return { ...doc, data: populated };
+    }
+    catch (err) {
+        // Never let a populate failure mask the underlying document — log and
+        // return the unpopulated doc.
+        logger.error('populate failed', {
+            collection,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return doc;
+    }
+}
+//# sourceMappingURL=authoring.js.map