@prenta/core 7.7.1 → 7.8.0

package/dist/api/route-helpers/authoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring.js","sourceRoot":"","sources":["../../../src/api/route-helpers/authoring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAElC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAuD,EACvD,IAMC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;IAC5B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YACpF,OAAO;gBACL,MAAM,EACJ,mFAAmF;oBACnF,yCAAyC;oBACzC,IAAI;oBACJ,mDAAmD;gBACrD,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC;gBAC5D,CAAC,CAAC,kBAAkB,IAAI,CAAC,YAAY,SAAS;gBAC9C,CAAC,CAAC,EAAE,CAAA;YACR,OAAO;gBACL,MAAM,EACJ,oFAAoF;oBACpF,2CAA2C;oBAC3C,IAAI;oBACJ,iDAAiD;gBACnD,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,CAAC;QACD,KAAK,WAAW;YACd,OAAO;gBACL,MAAM,EACJ,sFAAsF;oBACtF,oFAAoF;oBACpF,mBAAmB;gBACrB,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,KAAK,SAAS,CAAC;QACf,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;YACzD,OAAO;gBACL,MAAM,EACJ,qFAAqF;oBACrF,+BAA+B;oBAC/B,KAAK;oBACL,IAAI;oBACJ,oDAAoD;gBACtD,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,IAAI;aAChB,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,UAAkB,EAClB,GAAmC,EACnC,UAAoB,EACpB,MAAuC;IAEvC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAA;IACrB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IACvB,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzF,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,MAAM,EACN,IAAI,EACJ,mBAAmB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAC3C,IAAI,CACL,CAAA;QACD,OAAO,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAC9B,UAAU;YACV,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAA;QACF,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC"}

package/dist/api/route-helpers/forms.d.ts

@@ -0,0 +1,46 @@
+import type { FetchFormEntriesParams, FetchFormsParams, FormDefinition } from '../../forms/types.js';
+import { type IncomingFile } from '../../forms/files.js';
+export declare function normalizeSubmission(submission: any): any;
+/**
+ * Map a forms-service domain error to an HTTP response. Returns `null` for
+ * unrecognised errors so the caller can fall through to `internalError`.
+ */
+export declare function mapFormError(err: unknown): Response | null;
+export declare function parseFormsQuery(url: URL): FetchFormsParams;
+export declare function parseEntriesQuery(url: URL): FetchFormEntriesParams;
+/**
+ * Build CORS headers for the public form endpoints. When the form has no
+ * embed allowlist we reflect the requesting origin (open embedding). When an
+ * allowlist is set we only echo the origin if it matches, so a disallowed site
+ * cannot read the response. Browser-level CORS is complemented by a hard
+ * server-side origin check in the submit handler.
+ */
+export declare function formCorsHeaders(request: Request, allowedDomains?: string[]): Record<string, string>;
+export declare function jsonWithHeaders(data: unknown, status: number, extra: Record<string, string>): Response;
+/**
+ * Parse a public submission request into field values, files, and metadata.
+ * Supports both `application/json` (no files) and `multipart/form-data`
+ * (files + fields). Unknown/oversized bodies are rejected by the caller's
+ * Content-Length gate before this runs.
+ */
+export declare function parseSubmissionRequest(request: Request): Promise<{
+    values: Record<string, unknown>;
+    files: IncomingFile[];
+    meta: {
+        attribution: Record<string, unknown> | null;
+        elapsedMs: number | null;
+        pageUrl: string | null;
+        captchaToken: string;
+    };
+} | null>;
+/**
+ * Shared public-submission handler used by both the slug-based public route and
+ * the legacy by-id route. Enforces per-IP+form rate limiting, embed-origin
+ * allowlisting, optional CAPTCHA, file validation, then runs the core
+ * submission pipeline. Always responds with CORS headers so embedded forms can
+ * read the result.
+ */
+export declare function submitToForm(request: Request, form: FormDefinition): Promise<Response>;
+/** Native HTML form posts typically prefer HTML; fetch/XHR clients send Accept: application/json. */
+export declare function requestPrefersHtmlResponse(request: Request): boolean;
+//# sourceMappingURL=forms.d.ts.map

package/dist/api/route-helpers/forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms.d.ts","sourceRoot":"","sources":["../../../src/api/route-helpers/forms.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EAEf,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAA;AAS7B,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,GAAG,OAuBlD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAc1D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,gBAAgB,CAkB1D;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,sBAAsB,CAyBlE;AAGD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB;AAuBD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,QAAQ,CAKV;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IACtE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,IAAI,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;QAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF,GAAG,IAAI,CAAC,CAkCR;AA4FD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmJ5F;AAED,qGAAqG;AACrG,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAWpE"}

package/dist/api/route-helpers/forms.js

@@ -0,0 +1,435 @@
+import { verifyCaptcha, getCaptchaConfig, isCaptchaProviderError } from '../../security/captcha.js';
+import { logEvent } from '../../security/audit.js';
+import { FormNotFoundError, FormValidationError, FormConflictError, FormHasSubmissionsError, } from '../../forms/service.js';
+import { processSubmission, SubmissionValidationError, resolveSubmissionFields, } from '../../forms/submission.js';
+import { validateSubmissionFiles, FORM_UPLOAD_ALLOWED_MIME_TYPES, DEFAULT_MAX_FILE_BYTES, } from '../../forms/files.js';
+import { FormWebhookError } from '../../forms/webhooks.js';
+import { createRateLimiter } from '../../security/rate-limit.js';
+import { getClientIp, isResolvedIp } from '../../security/client-ip.js';
+import { getPrentaConfig } from '../../config/runtime.js';
+import { SECURITY_HEADERS } from '../security-headers.js';
+import { json, errorResponse, internalError, clampPageSize, clampPage, asRecord } from './http.js';
+import { checkRateLimitAsync } from './auth.js';
+export function normalizeSubmission(submission) {
+    const data = asRecord(submission.data);
+    const attribution = asRecord(submission.attribution);
+    return {
+        ...submission,
+        name: String(data.name ?? submission.name ?? ''),
+        email: String(data.email ?? submission.email ?? ''),
+        phone: data.phone ?? submission.phone,
+        message: String(data.message ?? submission.message ?? ''),
+        status: submission.status ?? 'new',
+        attribution: {
+            source: String(attribution.source ?? '(direct)'),
+            medium: String(attribution.medium ?? '(none)'),
+            campaign: String(attribution.campaign ?? ''),
+            term: String(attribution.term ?? ''),
+            content: String(attribution.content ?? ''),
+            landingPage: String(attribution.landingPage ?? ''),
+            referrer: String(attribution.referrer ?? ''),
+            deviceType: attribution.deviceType ?? 'Desktop',
+            clickIds: asRecord(attribution.clickIds),
+            capturedAt: attribution.capturedAt ?? submission.submittedAt ?? submission.createdAt ?? null,
+        },
+    };
+}
+/**
+ * Map a forms-service domain error to an HTTP response. Returns `null` for
+ * unrecognised errors so the caller can fall through to `internalError`.
+ */
+export function mapFormError(err) {
+    if (err instanceof FormNotFoundError)
+        return errorResponse(err.message, 404);
+    if (err instanceof FormValidationError) {
+        return json({ error: err.message, code: 'INVALID_SCHEMA', details: err.errors }, 400);
+    }
+    if (err instanceof FormConflictError)
+        return errorResponse(err.message, 409);
+    if (err instanceof FormHasSubmissionsError) {
+        return json({ error: err.message, code: 'FORM_HAS_SUBMISSIONS', submissionCount: err.submissionCount }, 409);
+    }
+    if (err instanceof FormWebhookError)
+        return errorResponse(err.message, err.status);
+    return null;
+}
+export function parseFormsQuery(url) {
+    const sp = url.searchParams;
+    const status = sp.get('status');
+    const notify = sp.get('notifyEnabled');
+    return {
+        search: sp.get('search') ?? undefined,
+        status: status === 'active' || status === 'draft' || status === 'archived' ? status : undefined,
+        notifyEnabled: notify == null ? undefined : notify === 'true',
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc'
+            ? 'asc'
+            : sp.get('sortDirection') === 'desc'
+                ? 'desc'
+                : undefined,
+        page: sp.get('page') ? clampPage(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? clampPageSize(sp.get('pageSize')) : undefined,
+    };
+}
+export function parseEntriesQuery(url) {
+    const sp = url.searchParams;
+    const spam = sp.get('spamStatus');
+    const boolParam = (key) => {
+        const v = sp.get(key);
+        return v == null ? undefined : v === 'true';
+    };
+    return {
+        search: sp.get('search') ?? undefined,
+        formId: sp.get('formId') ?? sp.get('form') ?? undefined,
+        unread: boolParam('unread'),
+        starred: boolParam('starred'),
+        archived: boolParam('archived'),
+        spamStatus: spam === 'clean' || spam === 'suspected' || spam === 'spam'
+            ? spam
+            : undefined,
+        dateFrom: sp.get('dateFrom') ?? undefined,
+        dateTo: sp.get('dateTo') ?? undefined,
+        thisWeek: boolParam('thisWeek'),
+        sortBy: sp.get('sortBy') ?? undefined,
+        sortDirection: sp.get('sortDirection') === 'asc' ? 'asc' : undefined,
+        page: sp.get('page') ? clampPage(sp.get('page')) : undefined,
+        pageSize: sp.get('pageSize') ? clampPageSize(sp.get('pageSize')) : undefined,
+    };
+}
+// ─── Public form submission helpers ─────────────────────────────────────────
+/**
+ * Build CORS headers for the public form endpoints. When the form has no
+ * embed allowlist we reflect the requesting origin (open embedding). When an
+ * allowlist is set we only echo the origin if it matches, so a disallowed site
+ * cannot read the response. Browser-level CORS is complemented by a hard
+ * server-side origin check in the submit handler.
+ */
+export function formCorsHeaders(request, allowedDomains) {
+    const origin = request.headers.get('origin');
+    const headers = {
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type, X-Requested-With',
+        'Access-Control-Max-Age': '600',
+        Vary: 'Origin',
+    };
+    if (!allowedDomains || allowedDomains.length === 0) {
+        headers['Access-Control-Allow-Origin'] = origin || '*';
+    }
+    else if (origin && isOriginAllowed(origin, allowedDomains)) {
+        headers['Access-Control-Allow-Origin'] = origin;
+    }
+    return headers;
+}
+function normalizeAllowedHost(domain) {
+    return domain
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, '')
+        .replace(/\/.*$/, '')
+        .replace(/^\*\./, '');
+}
+function isOriginAllowed(origin, allowedDomains) {
+    let host;
+    try {
+        host = new URL(origin).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    return allowedDomains
+        .map(normalizeAllowedHost)
+        .some((a) => a !== '' && (host === a || host.endsWith(`.${a}`)));
+}
+export function jsonWithHeaders(data, status, extra) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { ...SECURITY_HEADERS, ...extra },
+    });
+}
+/**
+ * Parse a public submission request into field values, files, and metadata.
+ * Supports both `application/json` (no files) and `multipart/form-data`
+ * (files + fields). Unknown/oversized bodies are rejected by the caller's
+ * Content-Length gate before this runs.
+ */
+export async function parseSubmissionRequest(request) {
+    const contentType = request.headers.get('content-type') ?? '';
+    if (contentType.includes('multipart/form-data')) {
+        const form = await request.formData();
+        return parseFlatSubmissionEntries(form.entries());
+    }
+    if (contentType.includes('application/x-www-form-urlencoded')) {
+        const text = await request.text();
+        return parseFlatSubmissionEntries(new URLSearchParams(text).entries());
+    }
+    // JSON body.
+    const body = (await request.json().catch(() => null));
+    if (!body)
+        return null;
+    const values = body.fields && typeof body.fields === 'object' && !Array.isArray(body.fields)
+        ? body.fields
+        : null;
+    if (!values)
+        return null;
+    return {
+        values,
+        files: [],
+        meta: {
+            attribution: safeJsonObject(body.attribution),
+            elapsedMs: typeof body.elapsedMs === 'number' && Number.isFinite(body.elapsedMs)
+                ? body.elapsedMs
+                : null,
+            pageUrl: typeof body.pageUrl === 'string' ? body.pageUrl : null,
+            captchaToken: typeof body.captchaToken === 'string' ? body.captchaToken : '',
+        },
+    };
+}
+async function readSubmissionFile(value) {
+    if (typeof value !== 'object' || value === null || !('arrayBuffer' in value))
+        return null;
+    const file = value;
+    if (file.size === 0 && !file.name)
+        return null;
+    const buffer = Buffer.from(await file.arrayBuffer());
+    return {
+        fieldKey: '',
+        fileName: file.name || 'file',
+        mimeType: file.type || 'application/octet-stream',
+        size: buffer.byteLength,
+        buffer,
+    };
+}
+function parseFlatSubmissionEntries(entries) {
+    return (async () => {
+        const values = {};
+        const files = [];
+        let attribution = null;
+        let elapsedMs = null;
+        let pageUrl = null;
+        let captchaToken = '';
+        let renderStartedAt = null;
+        for (const [key, rawValue] of entries) {
+            if (typeof rawValue === 'object' && rawValue !== null && 'arrayBuffer' in rawValue) {
+                const file = await readSubmissionFile(rawValue);
+                if (file) {
+                    file.fieldKey = key;
+                    files.push(file);
+                }
+                continue;
+            }
+            const str = String(rawValue);
+            if (key === '__attribution') {
+                attribution = safeJsonObject(str);
+            }
+            else if (key === '__elapsedMs') {
+                const n = Number(str);
+                elapsedMs = Number.isFinite(n) ? n : null;
+            }
+            else if (key === '__renderStartedAt') {
+                const n = Number(str);
+                renderStartedAt = Number.isFinite(n) ? n : null;
+            }
+            else if (key === '__pageUrl') {
+                pageUrl = str || null;
+            }
+            else if (key === '__captchaToken' || key === 'captchaToken') {
+                captchaToken = str;
+            }
+            else if (Object.prototype.hasOwnProperty.call(values, key)) {
+                const existing = values[key];
+                values[key] = Array.isArray(existing) ? [...existing, str] : [existing, str];
+            }
+            else {
+                values[key] = str;
+            }
+        }
+        if (elapsedMs === null && renderStartedAt !== null) {
+            elapsedMs = Math.max(0, Date.now() - renderStartedAt);
+        }
+        return { values, files, meta: { attribution, elapsedMs, pageUrl, captchaToken } };
+    })();
+}
+function safeJsonObject(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim()) {
+        try {
+            const parsed = JSON.parse(value);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            /* ignore malformed attribution blob */
+        }
+    }
+    return null;
+}
+/**
+ * Shared public-submission handler used by both the slug-based public route and
+ * the legacy by-id route. Enforces per-IP+form rate limiting, embed-origin
+ * allowlisting, optional CAPTCHA, file validation, then runs the core
+ * submission pipeline. Always responds with CORS headers so embedded forms can
+ * read the result.
+ */
+export async function submitToForm(request, form) {
+    const allowedDomains = form.embedSettings?.allowedDomains;
+    const cors = formCorsHeaders(request, allowedDomains);
+    const ip = getClientIp(request);
+    const rlKey = isResolvedIp(ip) ? `formsubmit:${ip}:${form.id}` : `formsubmit:_unknown:${form.id}`;
+    if (!(await checkRateLimitAsync(formLimiterGlobal, rlKey))) {
+        return jsonWithHeaders({ error: 'Too many submissions. Please try again later.' }, 429, cors);
+    }
+    // Hard server-side origin check when an embed allowlist is configured —
+    // browser CORS alone does not prevent a non-browser client from posting.
+    if (allowedDomains && allowedDomains.length > 0) {
+        const origin = request.headers.get('origin');
+        if (origin && !isOriginAllowed(origin, allowedDomains)) {
+            return jsonWithHeaders({ error: 'This form cannot be submitted from this origin.' }, 403, cors);
+        }
+    }
+    const parsed = await parseSubmissionRequest(request);
+    if (!parsed) {
+        return jsonWithHeaders({ error: 'Invalid or missing submission body.' }, 400, cors);
+    }
+    const captchaConfig = getCaptchaConfig();
+    if (captchaConfig.provider !== 'none' && captchaConfig.enforce) {
+        const result = await verifyCaptcha(parsed.meta.captchaToken, captchaConfig, isResolvedIp(ip) ? ip : undefined);
+        if (!result.success) {
+            const providerError = isCaptchaProviderError(result);
+            if (providerError && captchaConfig.onProviderError === 'fail-open') {
+                void logEvent({
+                    event: 'captcha.provider_error',
+                    details: {
+                        formId: form.id,
+                        formSlug: form.slug,
+                        provider: captchaConfig.provider,
+                        policy: 'fail-open',
+                        errorCodes: result.errorCodes ?? [],
+                    },
+                }).catch(() => { });
+            }
+            else {
+                void logEvent({
+                    event: providerError ? 'captcha.provider_error' : 'captcha.verify_failed',
+                    details: {
+                        formId: form.id,
+                        formSlug: form.slug,
+                        provider: captchaConfig.provider,
+                        policy: providerError ? captchaConfig.onProviderError : 'reject',
+                        errorCodes: result.errorCodes ?? [],
+                        score: result.score ?? null,
+                    },
+                }).catch(() => { });
+                return jsonWithHeaders({
+                    error: providerError
+                        ? 'CAPTCHA provider unavailable. Please try again shortly.'
+                        : 'CAPTCHA verification failed. Please try again.',
+                    code: providerError ? 'CAPTCHA_PROVIDER_ERROR' : 'CAPTCHA_FAILED',
+                }, 403, cors);
+            }
+        }
+    }
+    if (parsed.files.length > 0) {
+        const fileCfg = getPrentaConfig()?.forms?.fileUpload;
+        if (fileCfg?.enabled === false) {
+            return jsonWithHeaders({ error: 'File uploads are not enabled for this site.' }, 400, cors);
+        }
+        const { fields } = await resolveSubmissionFields(form);
+        const fileCheck = validateSubmissionFiles(fields, parsed.files, {
+            maxSizeBytes: fileCfg?.maxSizeMB ? fileCfg.maxSizeMB * 1024 * 1024 : DEFAULT_MAX_FILE_BYTES,
+            allowedMimeTypes: fileCfg?.allowedMimeTypes ?? FORM_UPLOAD_ALLOWED_MIME_TYPES,
+        });
+        if (!fileCheck.ok) {
+            return jsonWithHeaders({ error: 'File validation failed.', code: 'INVALID_FILES', details: fileCheck.errors }, 422, cors);
+        }
+    }
+    const ctx = {
+        values: parsed.values,
+        files: parsed.files,
+        ip,
+        userAgent: request.headers.get('user-agent'),
+        referrer: request.headers.get('referer'),
+        origin: request.headers.get('origin'),
+        pageUrl: parsed.meta.pageUrl,
+        attribution: parsed.meta.attribution,
+        elapsedMs: parsed.meta.elapsedMs,
+    };
+    try {
+        const result = await processSubmission(form, ctx);
+        const confirmation = result.confirmation;
+        if (requestPrefersHtmlResponse(request)) {
+            if (confirmation.type === 'redirect' && confirmation.redirectUrl) {
+                return Response.redirect(confirmation.redirectUrl, 303);
+            }
+            const message = confirmation.message ??
+                form.successMessage ??
+                'Thank you! Your submission has been received.';
+            return htmlWithHeaders(renderSubmissionResultHtml(message, false), 201, cors);
+        }
+        return jsonWithHeaders({
+            data: {
+                success: true,
+                submissionId: result.submissionId,
+                entryNumber: result.entryNumber,
+                confirmation: result.confirmation,
+            },
+        }, 201, cors);
+    }
+    catch (err) {
+        if (err instanceof SubmissionValidationError) {
+            if (requestPrefersHtmlResponse(request)) {
+                return htmlWithHeaders(renderSubmissionResultHtml('Please check the form and try again.', true), 422, cors);
+            }
+            return jsonWithHeaders({ error: 'Validation failed.', code: 'VALIDATION_ERROR', details: err.fieldErrors }, 422, cors);
+        }
+        return internalError(err);
+    }
+}
+/** Native HTML form posts typically prefer HTML; fetch/XHR clients send Accept: application/json. */
+export function requestPrefersHtmlResponse(request) {
+    const accept = request.headers.get('accept') ?? '';
+    if (accept.includes('application/json') && !accept.includes('text/html'))
+        return false;
+    const contentType = request.headers.get('content-type') ?? '';
+    if (contentType.includes('application/x-www-form-urlencoded') ||
+        contentType.includes('multipart/form-data')) {
+        return !accept.includes('application/json') || accept.includes('text/html');
+    }
+    return accept.includes('text/html') && !accept.includes('application/json');
+}
+function escapeHtmlText(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+function renderSubmissionResultHtml(message, isError) {
+    const title = isError ? 'Submission error' : 'Thank you';
+    const role = isError ? 'alert' : 'status';
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${escapeHtmlText(title)}</title>
+</head>
+<body>
+<main><p role="${role}">${escapeHtmlText(message)}</p></main>
+</body>
+</html>`;
+}
+function htmlWithHeaders(body, status, extra) {
+    return new Response(body, {
+        status,
+        headers: {
+            ...SECURITY_HEADERS,
+            'Content-Type': 'text/html; charset=utf-8',
+            ...extra,
+        },
+    });
+}
+const formLimiterGlobal = createRateLimiter({ maxRequests: 10, windowMs: 60_000 });
+//# sourceMappingURL=forms.js.map

package/dist/api/route-helpers/forms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms.js","sourceRoot":"","sources":["../../../src/api/route-helpers/forms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAO/B,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,sBAAsB,GAEvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAE/C,MAAM,UAAU,mBAAmB,CAAC,UAAe;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACpD,OAAO;QACL,GAAG,UAAU;QACb,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;QAChD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK;QACrC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QACzD,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,KAAK;QAClC,WAAW,EAAE;YACX,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,UAAU,CAAC;YAChD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,QAAQ,CAAC;YAC9C,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC5C,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1C,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,CAAC;YAClD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC5C,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,SAAS;YAC/C,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC;YACxC,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,SAAS,IAAI,IAAI;SAC7F;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,GAAG,YAAY,iBAAiB;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5E,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,GAAG,YAAY,iBAAiB;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5E,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,OAAO,IAAI,CACT,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,EAC1F,GAAG,CACJ,CAAA;IACH,CAAC;IACD,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAClF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAA;IAC3B,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACtC,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;QACrC,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/F,aAAa,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM;QAC7D,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;QACrC,aAAa,EACX,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK;YAC/B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM;gBAClC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS;QACjB,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAA;IAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAuB,EAAE;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAA;IAC7C,CAAC,CAAA;IACD,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;QACrC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;QACvD,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC3B,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;QAC7B,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC;QAC/B,UAAU,EACR,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,MAAM;YACzD,CAAC,CAAE,IAAmB;YACtB,CAAC,CAAC,SAAS;QACf,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS;QACzC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;QACrC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC;QAC/B,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;QACrC,aAAa,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACpE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,cAAyB;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,OAAO,GAA2B;QACtC,8BAA8B,EAAE,oBAAoB;QACpD,8BAA8B,EAAE,gCAAgC;QAChE,wBAAwB,EAAE,KAAK;QAC/B,IAAI,EAAE,QAAQ;KACf,CAAA;IACD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,IAAI,GAAG,CAAA;IACxD,CAAC;SAAM,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAA;IACjD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM;SACV,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,cAAwB;IAC/D,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,cAAc;SAClB,GAAG,CAAC,oBAAoB,CAAC;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAa,EACb,MAAc,EACd,KAA6B;IAE7B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,EAAE;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAgB;IAU3D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAE7D,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;QACrC,OAAO,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QACjC,OAAO,0BAA0B,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,aAAa;IACb,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAA;IACvF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3E,CAAC,CAAE,IAAI,CAAC,MAAkC;QAC1C,CAAC,CAAC,IAAI,CAAA;IACV,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO;QACL,MAAM;QACN,KAAK,EAAE,EAAE;QACT,IAAI,EAAE;YACJ,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAC7C,SAAS,EACP,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;gBACnE,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,IAAI;YACV,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC/D,YAAY,EAAE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;SAC7E;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAyB;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACzF,MAAM,IAAI,GAAG,KAAa,CAAA;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACpD,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM;QAC7B,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,0BAA0B;QACjD,IAAI,EAAE,MAAM,CAAC,UAAU;QACvB,MAAM;KACP,CAAA;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAwD;IAWxD,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,MAAM,KAAK,GAAmB,EAAE,CAAA;QAChC,IAAI,WAAW,GAAmC,IAAI,CAAA;QACtD,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,OAAO,GAAkB,IAAI,CAAA;QACjC,IAAI,YAAY,GAAG,EAAE,CAAA;QACrB,IAAI,eAAe,GAAkB,IAAI,CAAA;QAEzC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;gBACnF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBAC/C,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAA;oBACnB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAClB,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5B,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBAC5B,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;YACnC,CAAC;iBAAM,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBACrB,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC3C,CAAC;iBAAM,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;gBACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBACrB,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACjD,CAAC;iBAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC/B,OAAO,GAAG,GAAG,IAAI,IAAI,CAAA;YACvB,CAAC;iBAAM,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;gBAC9D,YAAY,GAAG,GAAG,CAAA;YACpB,CAAC;iBAAM,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YAC9E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;YACnB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,IAAI,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YACnD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAA;IACnF,CAAC,CAAC,EAAE,CAAA;AACN,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAA;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,MAAiC,CAAA;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAoB;IACvE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAA;IACzD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAErD,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,EAAE,EAAE,CAAA;IACjG,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC/F,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;YACvD,OAAO,eAAe,CACpB,EAAE,KAAK,EAAE,iDAAiD,EAAE,EAC5D,GAAG,EACH,IAAI,CACL,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAA;IACxC,IAAI,aAAa,CAAC,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,MAAM,CAAC,IAAI,CAAC,YAAY,EACxB,aAAa,EACb,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAClC,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,aAAa,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;YACpD,IAAI,aAAa,IAAI,aAAa,CAAC,eAAe,KAAK,WAAW,EAAE,CAAC;gBACnE,KAAK,QAAQ,CAAC;oBACZ,KAAK,EAAE,wBAAwB;oBAC/B,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,MAAM,EAAE,WAAW;wBACnB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;qBACpC;iBACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACpB,CAAC;iBAAM,CAAC;gBACN,KAAK,QAAQ,CAAC;oBACZ,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB;oBACzE,OAAO,EAAE;wBACP,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,QAAQ,EAAE,aAAa,CAAC,QAAQ;wBAChC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;wBAChE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;wBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;qBAC5B;iBACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAClB,OAAO,eAAe,CACpB;oBACE,KAAK,EAAE,aAAa;wBAClB,CAAC,CAAC,yDAAyD;wBAC3D,CAAC,CAAC,gDAAgD;oBACpD,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,gBAAgB;iBAClE,EACD,GAAG,EACH,IAAI,CACL,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,eAAe,EAAE,EAAE,KAAK,EAAE,UAAU,CAAA;QACpD,IAAI,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;YAC9D,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,sBAAsB;YAC3F,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,8BAA8B;SAC9E,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,eAAe,CACpB,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,EACtF,GAAG,EACH,IAAI,CACL,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAsB;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,EAAE;QACF,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5C,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;QAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;KACjC,CAAA;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAA;QACxC,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,YAAY,CAAC,IAAI,KAAK,UAAU,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;gBACjE,OAAO,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,OAAO,GACX,YAAY,CAAC,OAAO;gBACpB,IAAI,CAAC,cAAc;gBACnB,+CAA+C,CAAA;YACjD,OAAO,eAAe,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/E,CAAC;QACD,OAAO,eAAe,CACpB;YACE,IAAI,EAAE;gBACJ,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC;SACF,EACD,GAAG,EACH,IAAI,CACL,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,OAAO,eAAe,CACpB,0BAA0B,CAAC,sCAAsC,EAAE,IAAI,CAAC,EACxE,GAAG,EACH,IAAI,CACL,CAAA;YACH,CAAC;YACD,OAAO,eAAe,CACpB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,EACnF,GAAG,EACH,IAAI,CACL,CAAA;QACH,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAA;IACtF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAC7D,IACE,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QACzD,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAC3C,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe,EAAE,OAAgB;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAA;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzC,OAAO;;;;;SAKA,cAAc,CAAC,KAAK,CAAC;;;iBAGb,IAAI,KAAK,cAAc,CAAC,OAAO,CAAC;;QAEzC,CAAA;AACR,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc,EAAE,KAA6B;IAClF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,GAAG,gBAAgB;YACnB,cAAc,EAAE,0BAA0B;YAC1C,GAAG,KAAK;SACT;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA"}

package/dist/api/route-helpers/http.d.ts

@@ -0,0 +1,87 @@
+export declare const logger: import("../../diagnostics/logger.js").ScopedLogger;
+export declare function json(data: unknown, status?: number): Response;
+/**
+ * Variant of `json()` that emits the Phase-5.5 public-read
+ * `Cache-Control` header when the active CMS config opts in.
+ *
+ * - Session-cookie requests always get `private, no-store`.
+ * - API-key / unauthenticated requests get
+ *   `public, s-maxage=N, stale-while-revalidate=M` when
+ *   `cache.publicReads.enabled` is true.
+ * - Otherwise no `Cache-Control` header is set (i.e. the response is
+ *   uncacheable downstream, matching the pre-5.5 behaviour).
+ *
+ * Use this for the public read endpoints (`/collections/:slug`,
+ * `/collections/:slug/:id`, `/globals/:slug`, `/resolve`). Mutating
+ * endpoints stay on the plain `json()` so the CDN never caches a write
+ * response by accident.
+ */
+export declare function jsonWithCache(data: unknown, request: Request, status?: number): Response;
+export declare function errorResponse(message: string, status: number): Response;
+export declare function internalError(err: unknown, context?: string): Response;
+/**
+ * Map a thrown action-layer error to the right HTTP status. The data layer
+ * throws plain `Error`s with stable, human-readable prefixes for client-fixable
+ * problems (publish validation, access/permission, not-found); those are 4xx
+ * and the message is safe to return verbatim. Anything else falls through to
+ * {@link internalError} (500, generic message, logged).
+ */
+export declare function actionError(err: unknown, context?: string): Response;
+export declare function clampPageSize(raw: number | string | null, max?: number, fallback?: number): number;
+/**
+ * Clamp a 1-based list `page` query param. Negative / zero / NaN values must
+ * never reach Prisma `skip` (negative OFFSET → validation error → opaque 500).
+ * Mirrors forms/users/redirects (`Math.max(1, …)`).
+ */
+export declare function clampPage(raw: number | string | null | undefined, fallback?: number): number;
+/** Parse a JSON object body; invalid JSON or a non-object yields a 400. */
+export declare function readJsonBody(request: Request): Promise<{
+    ok: true;
+    data: Record<string, unknown>;
+} | {
+    ok: false;
+    error: Response;
+}>;
+export declare function asRecord(value: unknown): Record<string, unknown>;
+export declare function hasModel(d: any, name: string): boolean;
+/** Format a number compactly, e.g. 8400 -> "8.4K", 1_200_000 -> "1.2M". */
+export declare function formatCompactNumber(n: number): string;
+/** Minimal CSV line parser supporting double-quoted fields with escaped quotes. */
+export declare function parseCsvLine(line: string): string[];
+export declare function modelNotAvailable(name: string): Response;
+/**
+ * XML-escape a value for safe inclusion in sitemap content. Sitemaps reject
+ * unescaped ampersands and angle brackets; URLs frequently contain `&` query
+ * separators, so this is non-optional.
+ */
+export declare function escapeXml(value: string): string;
+/**
+ * URLs per sitemap file. The sitemaps protocol caps a single file at 50,000
+ * URLs, but the child-sitemap route must load each row's full `data` JSON blob
+ * (for path/noindex/images) into memory to build the XML — at 45k rows that is
+ * hundreds of MB per request on an unauthenticated, crawler-hit endpoint. We
+ * cap well below the protocol limit to bound per-request memory; collections
+ * larger than this are split across multiple `?page=N` files referenced from
+ * the sitemap index, so no URLs are lost.
+ */
+export declare const SITEMAP_PAGE_SIZE = 10000;
+/**
+ * Log unexpected query failures from the `safe*` wrappers.
+ *
+ * The wrappers exist so an optional Prisma model (e.g. a delegate
+ * that older schemas don't define) doesn't blow up the route — they
+ * return the empty value (`0` / `[]`) when the model isn't available.
+ * That defensive contract historically swallowed *every* error,
+ * including Prisma's "Unknown argument" rejections that flag a real
+ * application bug (see the `relationLoadStrategy` regression
+ * discovered while landing Phase 5.5 #5). Logging the underlying
+ * error preserves the defensive return semantics while making the
+ * actual class of bug visible in Vercel + Sentry logs.
+ *
+ * Kept private to this module — it's a logging contract, not a
+ * public API.
+ */
+export declare function logSafeQueryFailure(scope: string, err: unknown): void;
+export declare function safeCount(model: any, where?: Record<string, unknown>): Promise<number>;
+export declare function safeFindMany<T>(model: any, args: Record<string, unknown>): Promise<T[]>;
+//# sourceMappingURL=http.d.ts.map

package/dist/api/route-helpers/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/api/route-helpers/http.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,MAAM,oDAAsB,CAAA;AAEzC,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,QAAQ,CAKrF;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAEvE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAatE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAgBpE;AA0BD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG,SAAM,EAAE,QAAQ,SAAK,GAAG,MAAM,CAG3F;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,SAAI,GAAG,MAAM,CAIvF;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC,CAUvF;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIhE;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMtD;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BnD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAOxD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,QAAQ,CAAA;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAUrE;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5F;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAe7F"}