@rytass/bpm-core-react 0.18.1 → 0.20.0

package/dist/next/workflow-chat-route.d.cts

@@ -1,17 +1,105 @@
-import { ToolSet } from 'ai';
+import { ToolSet, UIMessage } from 'ai';
+import { WORKFLOW_CHAT_SYSTEM_PROMPT } from '../views/templates/designer/workflow-chat-prompt.cjs';
 /**
  * Strict guardrail: the assistant may ONLY design this approval flow, using the
- * provided tools. Anything else is declined. Lives server-side so it cannot be
- * overridden by client-supplied messages.
+ * provided tools. Lives server-side so it cannot be overridden by
+ * client-supplied messages (the route drops every `system` message a client
+ * sends). Shared with the offline Chrome model through `workflow-chat-prompt`.
  */
-export declare const WORKFLOW_CHAT_SYSTEM_PROMPT = "\u4F60\u662F\u300C\u7C3D\u6838\u6D41\u7A0B\u8A2D\u8A08\u5668\u300D\u9801\u9762\u5167\u5EFA\u7684 AI \u52A9\u7406\uFF0C\u552F\u4E00\u8077\u8CAC\u662F\u5354\u52A9\u4F7F\u7528\u8005\u5728\u9019\u500B\u756B\u5E03\u4E0A\u8A2D\u8A08\uFF0F\u4FEE\u6539\u4E00\u500B\u7C3D\u6838\u5BE9\u6279\u6D41\u7A0B\uFF08workflow\uFF09\u3002\n\n\u4F60\u53EA\u80FD\u900F\u904E\u7CFB\u7D71\u63D0\u4F9B\u7684\u5DE5\u5177\uFF08tools\uFF09\u4F86\u64CD\u4F5C\u6D41\u7A0B\uFF1A\u65B0\u589E/\u91CD\u547D\u540D/\u522A\u9664\u7BC0\u9EDE\u3001\u9023\u7DDA\u3001\u8A2D\u5B9A\u7C3D\u6838\u4EBA\u3001\u8A2D\u5B9A\u689D\u4EF6\u5206\u6D41\u3001\u8A2D\u5B9A\u7CFB\u7D71\u7BC0\u9EDE\u52D5\u4F5C\u3001\u81EA\u52D5\u6392\u7248\u3001\u67E5\u8A62\u73FE\u6CC1\u8207\u9A57\u8B49\u7B49\u3002\u9664\u4E86\u9019\u4E9B\u5DE5\u5177\uFF0C\u4F60\u6C92\u6709\u5176\u4ED6\u80FD\u529B\u3002\n\n\u5DE5\u4F5C\u5B88\u5247\uFF1A\n1. \u52D5\u4F5C\u524D\uFF0C\u5148\u547C\u53EB get_workflow_snapshot \u4E86\u89E3\u76EE\u524D\u756B\u5E03\u7684\u7BC0\u9EDE\u8207\u9023\u7DDA\uFF0C\u518D\u898F\u5283\u8981\u547C\u53EB\u54EA\u4E9B\u5DE5\u5177\u3002\n2. \u76E1\u91CF\u7528\u9AD8\u968E\u5DE5\u5177\uFF08insert_approval_step / insert_notification / insert_conditional_branch\uFF09\u4E00\u6B21\u5B8C\u6210\u591A\u6B65\uFF1B\u9700\u8981\u7D30\u4FEE\u6642\u518D\u7528\u7D30\u9846\u7C92\u5DE5\u5177\u3002\n3. **\u91CD\u8981\uFF1A\u8981\u679C\u65B7\u3001\u5148\u628A\u6D41\u7A0B\u756B\u51FA\u4F86\u3002** \u4F7F\u7528\u8005\u53EA\u7D66\u4E00\u5169\u53E5\u8A71\u6642\uFF0C\u76F4\u63A5\u4F9D\u5E38\u898B\u516C\u53F8\u6163\u4F8B\u5EFA\u7ACB\u521D\u7A3F\uFF0C\u4E0D\u8981\u53CD\u8986\u8FFD\u554F\u7D30\u7BC0\u3002\u7C3D\u6838\u4EBA\u82E5\u4F7F\u7528\u8005\u6C92\u6307\u5B9A\uFF0C\u5C31\u7701\u7565 approverResolver\uFF08\u7CFB\u7D71\u6703\u81EA\u52D5\u7528\u300C\u76F4\u5C6C\u4E3B\u7BA1\u300D\u70BA\u9810\u8A2D\uFF0C\u4E0D\u9700\u8981\u771F\u5BE6\u6703\u54E1 id\uFF09\uFF1B\u901A\u77E5\u7BC0\u9EDE\u540C\u7406\u53EF\u7701\u7565 action\uFF08\u9810\u8A2D\u7AD9\u5167\u901A\u77E5\uFF09\u3002\u5148\u628A\u7D50\u69CB\u5EFA\u597D\u3001\u518D\u8ACB\u4F7F\u7528\u8005\u8ABF\u6574\u3002\n4. \u5DE5\u5177\u547C\u53EB\u4E0D\u6703\u56E0\u70BA\u300C\u7F3A\u7C3D\u6838\u4EBA/\u7F3A\u8CC7\u6599\u300D\u800C\u5931\u6557\uFF1B\u7F3A\u7684\u90E8\u5206\u6703\u4EE5\u5408\u7406\u9810\u8A2D\u88DC\u4E0A\uFF0C\u4E26\u7531 validate_workflow \u6A19\u793A\u3002\u6240\u4EE5\u653E\u5FC3\u9023\u7E8C\u547C\u53EB\u5DE5\u5177\u628A\u6D41\u7A0B\u5EFA\u5B8C\uFF0C\u4E0D\u8981\u56E0\u70BA\u6015\u7F3A\u6B04\u4F4D\u5C31\u505C\u4E0B\u4F86\u554F\u3002\n5. \u7576\u4F7F\u7528\u8005\u300C\u9EDE\u540D\u300D\u67D0\u500B\u4EBA\u6216\u90E8\u9580\u7576\u7C3D\u6838\u4EBA/\u6536\u4EF6\u8005\u6642\uFF0C\u5148\u7528 search_members\uFF08\u4F9D\u59D3\u540D\u95DC\u9375\u5B57\uFF09\u3001list_org_units\u3001list_positions \u67E5\u5230\u771F\u5BE6 id\uFF0C\u518D\u7528 set_user_task_approver / set_service_action \u6307\u5B9A\uFF08\u5982 DIRECT memberIds\u3001ORG_UNIT_MANAGER orgUnitId\u3001POSITION positionId\uFF09\u3002\u67E5\u4E0D\u5230\u5C31\u56DE\u5831\u4E26\u8ACB\u4F7F\u7528\u8005\u78BA\u8A8D\uFF0C\u4E0D\u8981\u7DE8\u9020 id\u3002\n6. \u7BC0\u9EDE id \u53EF\u5F9E snapshot \u53D6\u5F97\uFF1B\u9023\u7DDA\u689D\u4EF6\u9700\u8981\u5148\u7D81\u5B9A\u8868\u55AE\u6B04\u4F4D\uFF08\u82E5 list_form_fields \u70BA\u7A7A\uFF0C\u63D0\u9192\u4F7F\u7528\u8005\u5148\u7D81\u5B9A\u8868\u55AE\u7248\u672C\uFF09\u3002\n7. **\u689D\u4EF6\u5206\u6D41\u52D9\u5FC5\u4E3B\u52D5\u88DC\u4E0A\u300C\u5176\u4ED6\u60C5\u6CC1\u300D**\uFF1A\u8A2D\u8A08 exclusiveGateway\uFF08\u689D\u4EF6\u5206\u6D41\uFF09\u6642\uFF0C\u9664\u4E86\u7B26\u5408\u689D\u4EF6\u7684\u5206\u652F\uFF0C\u4E00\u5B9A\u8981\u4FDD\u7559\u4E00\u689D\u672A\u8A2D\u689D\u4EF6\u3001\u6A19\u8A18\u70BA\u9810\u8A2D\uFF08isDefault\uFF09\u7684\u300C\u5176\u4ED6\u60C5\u6CC1\u300D\u8DEF\u5F91\u7576 else\uFF08\u901A\u5E38\u6307\u5411\u5F8C\u7E8C\u7BC0\u9EDE\u6216\u5B8C\u6210\uFF09\u3002\u4E0D\u8981\u628A\u6240\u6709\u8F38\u51FA\u9023\u7DDA\u90FD\u8A2D\u6210\u689D\u4EF6\u800C\u6C92\u6709\u9810\u8A2D\u51FA\u53E3\uFF1B\u7F3A\u9810\u8A2D\u51FA\u53E3\u6642\uFF0C\u7528 set_edge_default \u628A\u5176\u4E2D\u4E00\u689D\u8A2D\u70BA\u9810\u8A2D\u3002\n8. \u5B8C\u6210\u5F8C\uFF0C\u547C\u53EB validate_workflow\uFF0C\u4E26\u7528\u4E00\u5169\u53E5\u8A71\u8AAA\u660E\u4F60\u5EFA\u4E86\u4EC0\u9EBC\u6D41\u7A0B\u3001\u54EA\u4E9B\u5730\u65B9\uFF08\u5982\u7C3D\u6838\u4EBA\u3001\u689D\u4EF6\u9580\u6ABB\uFF09\u5EFA\u8B70\u4F7F\u7528\u8005\u518D\u78BA\u8A8D\u6216\u6307\u5B9A\u3002\n9. \u5168\u7A0B\u4F7F\u7528\u7E41\u9AD4\u4E2D\u6587\uFF08\u53F0\u7063\u7528\u8A9E\uFF09\u56DE\u8986\u3002\n10. \u6B04\u4F4D\u5728\u5404\u95DC\u7684\u986F\u793A\u8207\u88DC\u586B\u7528 set_field_access_matrix \u8A2D\u5B9A\uFF1AnodeIds \u53EA\u5217\u9019\u6B21\u8981\u6539\u7684\u7C3D\u6838\u7BC0\u9EDE\uFF0C\u5B83\u5011\u7684\u8A2D\u5B9A\u6703\u6574\u500B\u63DB\u6389\uFF0C\u547C\u53EB\u524D\u5148\u5F9E get_workflow_snapshot \u8B80\u51FA\u9019\u4E9B\u7BC0\u9EDE\u65E2\u6709\u7684\u300C\u6B04\u4F4D\u8A2D\u5B9A\u300D\u4E00\u4F75\u50B3\u5165\u3002\u300C\u96B1\u85CF\u300D\u53EA\u5F71\u97FF\u756B\u9762\u3001\u4E0D\u662F\u6B0A\u9650\uFF0C\u4E0D\u80FD\u7528\u4F86\u4FDD\u5BC6\uFF1B\u4F7F\u7528\u8005\u8981\u6C42\u4FDD\u5BC6\u6642\u8981\u8AAA\u660E\u9019\u4E00\u9EDE\u3002\u7BC0\u9EDE\u542B\u820A\u6B04\u4F4D\u6B0A\u9650\u8A2D\u5B9A\u6642\uFF0C\u7528 remove_legacy_field_permissions \u79FB\u9664\uFF08\u4E0D\u6703\u81EA\u52D5\u8F49\u63DB\uFF09\u3002\n\n\u56B4\u683C\u754C\u7DDA\uFF1A\n- \u53EA\u505A\u300C\u8A2D\u8A08\u9019\u500B\u7C3D\u6838\u6D41\u7A0B\u300D\u76F8\u95DC\u7684\u4E8B\u3002\u4EFB\u4F55\u8207\u6B64\u7121\u95DC\u7684\u8ACB\u6C42\uFF08\u9592\u804A\u3001\u5BEB\u8A69\u3001\u5BEB\u7A0B\u5F0F\u3001\u67E5\u5929\u6C23\uFF0F\u65B0\u805E\u3001\u64CD\u4F5C\u5176\u4ED6\u7CFB\u7D71\u6216\u9801\u9762\u3001\u56DE\u7B54\u4E00\u822C\u77E5\u8B58\u554F\u984C\u7B49\uFF09\u4E00\u5F8B\u5A49\u62D2\uFF0C\u4E26\u7C21\u77ED\u5F15\u5C0E\u4F7F\u7528\u8005\u56DE\u5230\u6D41\u7A0B\u8A2D\u8A08\uFF0C\u4F8B\u5982\uFF1A\u300C\u6211\u53EA\u80FD\u5354\u52A9\u4F60\u8A2D\u8A08\u9019\u500B\u7C3D\u6838\u6D41\u7A0B\uFF0C\u9700\u8981\u6211\u5E6B\u4F60\u65B0\u589E\u95DC\u5361\u6216\u8A2D\u5B9A\u689D\u4EF6\u55CE\uFF1F\u300D\n- \u4E0D\u8981\u5047\u88DD\u57F7\u884C\u4F60\u5DE5\u5177\u4EE5\u5916\u7684\u52D5\u4F5C\uFF0C\u4E5F\u4E0D\u8981\u7DE8\u9020\u7D50\u679C\u3002";
+export { WORKFLOW_CHAT_SYSTEM_PROMPT };
 /** Build AI SDK tools from WORKFLOW_TOOLSET — no `execute`, so the browser runs them. */
 export declare function buildWorkflowAiSdkTools(): ToolSet;
+/** Upper bound on the request body, in bytes. Tool results carry snapshots. */
+export declare const DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES = 1048576;
+/** Upper bound on the messages in one request. */
+export declare const DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES = 200;
+/** Upper bound on the tokens the model may write per response. */
+export declare const DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS = 4096;
 export interface WorkflowChatRouteOptions {
+    /**
+     * Whether the route serves at all. Absent: `BPM_AI_ASSISTANT_ENABLED` is
+     * read on every request and must be `'true'`. A disabled route answers 404.
+     */
+    readonly enabled?: boolean | (() => boolean);
+    /**
+     * The host's check that the caller may use the assistant (a session, a
+     * designer permission). Called before the body is read; `false` (or a
+     * throw) answers 401. Absent: no check, so put the route behind the host's
+     * own authentication.
+     */
+    readonly authorize?: (request: Request) => boolean | Promise<boolean>;
+    /** Request body ceiling in bytes (413 above it). */
+    readonly maxRequestBytes?: number;
+    /** Message count ceiling (413 above it). */
+    readonly maxMessages?: number;
+    /** Output token ceiling passed to the model. */
+    readonly maxOutputTokens?: number;
     /** Override the OpenAI model id (else BPM_LLM_MODEL env, else the default). */
     readonly model?: string;
     /** Override the system prompt (else the strict design-only guardrail). */
     readonly system?: string;
 }
+type ReadMessagesResult = {
+    readonly messages: readonly UIMessage[];
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly response: Response;
+};
+/**
+ * The client's messages, bounded and without any `system` message: the
+ * system prompt is the route's alone. The body is read as text first so its
+ * size is checked before anything is parsed.
+ */
+export declare function readWorkflowChatMessages(request: Request, limits: Readonly<{
+    maxMessages: number;
+    maxRequestBytes: number;
+}>): Promise<ReadMessagesResult>;
+/** The API's "who is signed in" endpoint (`apps/api` `GET /auth/me`). */
+export declare const DEFAULT_BPM_API_SESSION_PATH = "/auth/me";
+/** How long the session check may take before the route answers 401. */
+export declare const DEFAULT_BPM_API_SESSION_TIMEOUT_MS = 5000;
+export interface BPMApiSessionAuthorizeOptions {
+    /**
+     * The absolute API origin to ask, e.g. an internal service URL. Absent:
+     * read from configuration by {@link resolveBPMApiSessionBaseUrl}.
+     */
+    readonly apiBaseUrl?: string;
+    /** The fetch to use (tests, instrumented hosts). Default: global `fetch`. */
+    readonly fetch?: typeof fetch;
+    /** The session endpoint path. Default `/auth/me`. */
+    readonly sessionPath?: string;
+    /** Milliseconds before the check gives up and refuses. Default 5 000. */
+    readonly timeoutMs?: number;
+}
+/**
+ * The API origin the session check asks. It comes only from configuration,
+ * never from the request: a `Host` or forwarded header the caller controls
+ * must not choose the server that decides whether the caller is signed in.
+ *
+ * 1. `apiBaseUrl` when given;
+ * 2. `BPM_API_INTERNAL_URL` (server-only, e.g. the API's in-cluster URL);
+ * 3. `NEXT_PUBLIC_API_AUTH_URL` (the `/auth/*` base);
+ * 4. the origin of `NEXT_PUBLIC_API_URL` (the GraphQL endpoint);
+ * 5. `http://localhost:17603` outside `NODE_ENV=production`.
+ *
+ * Only absolute http(s) URLs count; a relative setting is ignored. `null`
+ * when nothing applies, and the session check then refuses every request.
+ */
+export declare function resolveBPMApiSessionBaseUrl(apiBaseUrl?: string): string | null;
+/**
+ * An `authorize` hook for {@link createWorkflowChatPOST} that lets in only a
+ * caller the BPM API recognises as signed in: it forwards the request's
+ * `Cookie` header (nothing else) to the API's session endpoint and accepts a
+ * `200` whose JSON names a `memberId`. No cookie, any other status, a body
+ * of another shape, a network error or a timeout refuses, so the route
+ * answers 401. The session itself is never read or kept here.
+ *
+ * Host usage (apps/client/src/app/api/chat/route.ts):
+ *   export const POST = createWorkflowChatPOST({
+ *     authorize: createBPMApiSessionAuthorize(),
+ *   });
+ */
+export declare function createBPMApiSessionAuthorize(options?: BPMApiSessionAuthorizeOptions): (request: Request) => Promise<boolean>;
 /** Create the `POST` handler for the workflow chat route. */
 export declare function createWorkflowChatPOST(options?: WorkflowChatRouteOptions): (request: Request) => Promise<Response>;

package/dist/next/workflow-chat-route.d.ts

@@ -1,17 +1,105 @@
-import { ToolSet } from 'ai';
+import { ToolSet, UIMessage } from 'ai';
+import { WORKFLOW_CHAT_SYSTEM_PROMPT } from '../views/templates/designer/workflow-chat-prompt.js';
 /**
  * Strict guardrail: the assistant may ONLY design this approval flow, using the
- * provided tools. Anything else is declined. Lives server-side so it cannot be
- * overridden by client-supplied messages.
+ * provided tools. Lives server-side so it cannot be overridden by
+ * client-supplied messages (the route drops every `system` message a client
+ * sends). Shared with the offline Chrome model through `workflow-chat-prompt`.
  */
-export declare const WORKFLOW_CHAT_SYSTEM_PROMPT = "\u4F60\u662F\u300C\u7C3D\u6838\u6D41\u7A0B\u8A2D\u8A08\u5668\u300D\u9801\u9762\u5167\u5EFA\u7684 AI \u52A9\u7406\uFF0C\u552F\u4E00\u8077\u8CAC\u662F\u5354\u52A9\u4F7F\u7528\u8005\u5728\u9019\u500B\u756B\u5E03\u4E0A\u8A2D\u8A08\uFF0F\u4FEE\u6539\u4E00\u500B\u7C3D\u6838\u5BE9\u6279\u6D41\u7A0B\uFF08workflow\uFF09\u3002\n\n\u4F60\u53EA\u80FD\u900F\u904E\u7CFB\u7D71\u63D0\u4F9B\u7684\u5DE5\u5177\uFF08tools\uFF09\u4F86\u64CD\u4F5C\u6D41\u7A0B\uFF1A\u65B0\u589E/\u91CD\u547D\u540D/\u522A\u9664\u7BC0\u9EDE\u3001\u9023\u7DDA\u3001\u8A2D\u5B9A\u7C3D\u6838\u4EBA\u3001\u8A2D\u5B9A\u689D\u4EF6\u5206\u6D41\u3001\u8A2D\u5B9A\u7CFB\u7D71\u7BC0\u9EDE\u52D5\u4F5C\u3001\u81EA\u52D5\u6392\u7248\u3001\u67E5\u8A62\u73FE\u6CC1\u8207\u9A57\u8B49\u7B49\u3002\u9664\u4E86\u9019\u4E9B\u5DE5\u5177\uFF0C\u4F60\u6C92\u6709\u5176\u4ED6\u80FD\u529B\u3002\n\n\u5DE5\u4F5C\u5B88\u5247\uFF1A\n1. \u52D5\u4F5C\u524D\uFF0C\u5148\u547C\u53EB get_workflow_snapshot \u4E86\u89E3\u76EE\u524D\u756B\u5E03\u7684\u7BC0\u9EDE\u8207\u9023\u7DDA\uFF0C\u518D\u898F\u5283\u8981\u547C\u53EB\u54EA\u4E9B\u5DE5\u5177\u3002\n2. \u76E1\u91CF\u7528\u9AD8\u968E\u5DE5\u5177\uFF08insert_approval_step / insert_notification / insert_conditional_branch\uFF09\u4E00\u6B21\u5B8C\u6210\u591A\u6B65\uFF1B\u9700\u8981\u7D30\u4FEE\u6642\u518D\u7528\u7D30\u9846\u7C92\u5DE5\u5177\u3002\n3. **\u91CD\u8981\uFF1A\u8981\u679C\u65B7\u3001\u5148\u628A\u6D41\u7A0B\u756B\u51FA\u4F86\u3002** \u4F7F\u7528\u8005\u53EA\u7D66\u4E00\u5169\u53E5\u8A71\u6642\uFF0C\u76F4\u63A5\u4F9D\u5E38\u898B\u516C\u53F8\u6163\u4F8B\u5EFA\u7ACB\u521D\u7A3F\uFF0C\u4E0D\u8981\u53CD\u8986\u8FFD\u554F\u7D30\u7BC0\u3002\u7C3D\u6838\u4EBA\u82E5\u4F7F\u7528\u8005\u6C92\u6307\u5B9A\uFF0C\u5C31\u7701\u7565 approverResolver\uFF08\u7CFB\u7D71\u6703\u81EA\u52D5\u7528\u300C\u76F4\u5C6C\u4E3B\u7BA1\u300D\u70BA\u9810\u8A2D\uFF0C\u4E0D\u9700\u8981\u771F\u5BE6\u6703\u54E1 id\uFF09\uFF1B\u901A\u77E5\u7BC0\u9EDE\u540C\u7406\u53EF\u7701\u7565 action\uFF08\u9810\u8A2D\u7AD9\u5167\u901A\u77E5\uFF09\u3002\u5148\u628A\u7D50\u69CB\u5EFA\u597D\u3001\u518D\u8ACB\u4F7F\u7528\u8005\u8ABF\u6574\u3002\n4. \u5DE5\u5177\u547C\u53EB\u4E0D\u6703\u56E0\u70BA\u300C\u7F3A\u7C3D\u6838\u4EBA/\u7F3A\u8CC7\u6599\u300D\u800C\u5931\u6557\uFF1B\u7F3A\u7684\u90E8\u5206\u6703\u4EE5\u5408\u7406\u9810\u8A2D\u88DC\u4E0A\uFF0C\u4E26\u7531 validate_workflow \u6A19\u793A\u3002\u6240\u4EE5\u653E\u5FC3\u9023\u7E8C\u547C\u53EB\u5DE5\u5177\u628A\u6D41\u7A0B\u5EFA\u5B8C\uFF0C\u4E0D\u8981\u56E0\u70BA\u6015\u7F3A\u6B04\u4F4D\u5C31\u505C\u4E0B\u4F86\u554F\u3002\n5. \u7576\u4F7F\u7528\u8005\u300C\u9EDE\u540D\u300D\u67D0\u500B\u4EBA\u6216\u90E8\u9580\u7576\u7C3D\u6838\u4EBA/\u6536\u4EF6\u8005\u6642\uFF0C\u5148\u7528 search_members\uFF08\u4F9D\u59D3\u540D\u95DC\u9375\u5B57\uFF09\u3001list_org_units\u3001list_positions \u67E5\u5230\u771F\u5BE6 id\uFF0C\u518D\u7528 set_user_task_approver / set_service_action \u6307\u5B9A\uFF08\u5982 DIRECT memberIds\u3001ORG_UNIT_MANAGER orgUnitId\u3001POSITION positionId\uFF09\u3002\u67E5\u4E0D\u5230\u5C31\u56DE\u5831\u4E26\u8ACB\u4F7F\u7528\u8005\u78BA\u8A8D\uFF0C\u4E0D\u8981\u7DE8\u9020 id\u3002\n6. \u7BC0\u9EDE id \u53EF\u5F9E snapshot \u53D6\u5F97\uFF1B\u9023\u7DDA\u689D\u4EF6\u9700\u8981\u5148\u7D81\u5B9A\u8868\u55AE\u6B04\u4F4D\uFF08\u82E5 list_form_fields \u70BA\u7A7A\uFF0C\u63D0\u9192\u4F7F\u7528\u8005\u5148\u7D81\u5B9A\u8868\u55AE\u7248\u672C\uFF09\u3002\n7. **\u689D\u4EF6\u5206\u6D41\u52D9\u5FC5\u4E3B\u52D5\u88DC\u4E0A\u300C\u5176\u4ED6\u60C5\u6CC1\u300D**\uFF1A\u8A2D\u8A08 exclusiveGateway\uFF08\u689D\u4EF6\u5206\u6D41\uFF09\u6642\uFF0C\u9664\u4E86\u7B26\u5408\u689D\u4EF6\u7684\u5206\u652F\uFF0C\u4E00\u5B9A\u8981\u4FDD\u7559\u4E00\u689D\u672A\u8A2D\u689D\u4EF6\u3001\u6A19\u8A18\u70BA\u9810\u8A2D\uFF08isDefault\uFF09\u7684\u300C\u5176\u4ED6\u60C5\u6CC1\u300D\u8DEF\u5F91\u7576 else\uFF08\u901A\u5E38\u6307\u5411\u5F8C\u7E8C\u7BC0\u9EDE\u6216\u5B8C\u6210\uFF09\u3002\u4E0D\u8981\u628A\u6240\u6709\u8F38\u51FA\u9023\u7DDA\u90FD\u8A2D\u6210\u689D\u4EF6\u800C\u6C92\u6709\u9810\u8A2D\u51FA\u53E3\uFF1B\u7F3A\u9810\u8A2D\u51FA\u53E3\u6642\uFF0C\u7528 set_edge_default \u628A\u5176\u4E2D\u4E00\u689D\u8A2D\u70BA\u9810\u8A2D\u3002\n8. \u5B8C\u6210\u5F8C\uFF0C\u547C\u53EB validate_workflow\uFF0C\u4E26\u7528\u4E00\u5169\u53E5\u8A71\u8AAA\u660E\u4F60\u5EFA\u4E86\u4EC0\u9EBC\u6D41\u7A0B\u3001\u54EA\u4E9B\u5730\u65B9\uFF08\u5982\u7C3D\u6838\u4EBA\u3001\u689D\u4EF6\u9580\u6ABB\uFF09\u5EFA\u8B70\u4F7F\u7528\u8005\u518D\u78BA\u8A8D\u6216\u6307\u5B9A\u3002\n9. \u5168\u7A0B\u4F7F\u7528\u7E41\u9AD4\u4E2D\u6587\uFF08\u53F0\u7063\u7528\u8A9E\uFF09\u56DE\u8986\u3002\n10. \u6B04\u4F4D\u5728\u5404\u95DC\u7684\u986F\u793A\u8207\u88DC\u586B\u7528 set_field_access_matrix \u8A2D\u5B9A\uFF1AnodeIds \u53EA\u5217\u9019\u6B21\u8981\u6539\u7684\u7C3D\u6838\u7BC0\u9EDE\uFF0C\u5B83\u5011\u7684\u8A2D\u5B9A\u6703\u6574\u500B\u63DB\u6389\uFF0C\u547C\u53EB\u524D\u5148\u5F9E get_workflow_snapshot \u8B80\u51FA\u9019\u4E9B\u7BC0\u9EDE\u65E2\u6709\u7684\u300C\u6B04\u4F4D\u8A2D\u5B9A\u300D\u4E00\u4F75\u50B3\u5165\u3002\u300C\u96B1\u85CF\u300D\u53EA\u5F71\u97FF\u756B\u9762\u3001\u4E0D\u662F\u6B0A\u9650\uFF0C\u4E0D\u80FD\u7528\u4F86\u4FDD\u5BC6\uFF1B\u4F7F\u7528\u8005\u8981\u6C42\u4FDD\u5BC6\u6642\u8981\u8AAA\u660E\u9019\u4E00\u9EDE\u3002\u7BC0\u9EDE\u542B\u820A\u6B04\u4F4D\u6B0A\u9650\u8A2D\u5B9A\u6642\uFF0C\u7528 remove_legacy_field_permissions \u79FB\u9664\uFF08\u4E0D\u6703\u81EA\u52D5\u8F49\u63DB\uFF09\u3002\n\n\u56B4\u683C\u754C\u7DDA\uFF1A\n- \u53EA\u505A\u300C\u8A2D\u8A08\u9019\u500B\u7C3D\u6838\u6D41\u7A0B\u300D\u76F8\u95DC\u7684\u4E8B\u3002\u4EFB\u4F55\u8207\u6B64\u7121\u95DC\u7684\u8ACB\u6C42\uFF08\u9592\u804A\u3001\u5BEB\u8A69\u3001\u5BEB\u7A0B\u5F0F\u3001\u67E5\u5929\u6C23\uFF0F\u65B0\u805E\u3001\u64CD\u4F5C\u5176\u4ED6\u7CFB\u7D71\u6216\u9801\u9762\u3001\u56DE\u7B54\u4E00\u822C\u77E5\u8B58\u554F\u984C\u7B49\uFF09\u4E00\u5F8B\u5A49\u62D2\uFF0C\u4E26\u7C21\u77ED\u5F15\u5C0E\u4F7F\u7528\u8005\u56DE\u5230\u6D41\u7A0B\u8A2D\u8A08\uFF0C\u4F8B\u5982\uFF1A\u300C\u6211\u53EA\u80FD\u5354\u52A9\u4F60\u8A2D\u8A08\u9019\u500B\u7C3D\u6838\u6D41\u7A0B\uFF0C\u9700\u8981\u6211\u5E6B\u4F60\u65B0\u589E\u95DC\u5361\u6216\u8A2D\u5B9A\u689D\u4EF6\u55CE\uFF1F\u300D\n- \u4E0D\u8981\u5047\u88DD\u57F7\u884C\u4F60\u5DE5\u5177\u4EE5\u5916\u7684\u52D5\u4F5C\uFF0C\u4E5F\u4E0D\u8981\u7DE8\u9020\u7D50\u679C\u3002";
+export { WORKFLOW_CHAT_SYSTEM_PROMPT };
 /** Build AI SDK tools from WORKFLOW_TOOLSET — no `execute`, so the browser runs them. */
 export declare function buildWorkflowAiSdkTools(): ToolSet;
+/** Upper bound on the request body, in bytes. Tool results carry snapshots. */
+export declare const DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES = 1048576;
+/** Upper bound on the messages in one request. */
+export declare const DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES = 200;
+/** Upper bound on the tokens the model may write per response. */
+export declare const DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS = 4096;
 export interface WorkflowChatRouteOptions {
+    /**
+     * Whether the route serves at all. Absent: `BPM_AI_ASSISTANT_ENABLED` is
+     * read on every request and must be `'true'`. A disabled route answers 404.
+     */
+    readonly enabled?: boolean | (() => boolean);
+    /**
+     * The host's check that the caller may use the assistant (a session, a
+     * designer permission). Called before the body is read; `false` (or a
+     * throw) answers 401. Absent: no check, so put the route behind the host's
+     * own authentication.
+     */
+    readonly authorize?: (request: Request) => boolean | Promise<boolean>;
+    /** Request body ceiling in bytes (413 above it). */
+    readonly maxRequestBytes?: number;
+    /** Message count ceiling (413 above it). */
+    readonly maxMessages?: number;
+    /** Output token ceiling passed to the model. */
+    readonly maxOutputTokens?: number;
     /** Override the OpenAI model id (else BPM_LLM_MODEL env, else the default). */
     readonly model?: string;
     /** Override the system prompt (else the strict design-only guardrail). */
     readonly system?: string;
 }
+type ReadMessagesResult = {
+    readonly messages: readonly UIMessage[];
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly response: Response;
+};
+/**
+ * The client's messages, bounded and without any `system` message: the
+ * system prompt is the route's alone. The body is read as text first so its
+ * size is checked before anything is parsed.
+ */
+export declare function readWorkflowChatMessages(request: Request, limits: Readonly<{
+    maxMessages: number;
+    maxRequestBytes: number;
+}>): Promise<ReadMessagesResult>;
+/** The API's "who is signed in" endpoint (`apps/api` `GET /auth/me`). */
+export declare const DEFAULT_BPM_API_SESSION_PATH = "/auth/me";
+/** How long the session check may take before the route answers 401. */
+export declare const DEFAULT_BPM_API_SESSION_TIMEOUT_MS = 5000;
+export interface BPMApiSessionAuthorizeOptions {
+    /**
+     * The absolute API origin to ask, e.g. an internal service URL. Absent:
+     * read from configuration by {@link resolveBPMApiSessionBaseUrl}.
+     */
+    readonly apiBaseUrl?: string;
+    /** The fetch to use (tests, instrumented hosts). Default: global `fetch`. */
+    readonly fetch?: typeof fetch;
+    /** The session endpoint path. Default `/auth/me`. */
+    readonly sessionPath?: string;
+    /** Milliseconds before the check gives up and refuses. Default 5 000. */
+    readonly timeoutMs?: number;
+}
+/**
+ * The API origin the session check asks. It comes only from configuration,
+ * never from the request: a `Host` or forwarded header the caller controls
+ * must not choose the server that decides whether the caller is signed in.
+ *
+ * 1. `apiBaseUrl` when given;
+ * 2. `BPM_API_INTERNAL_URL` (server-only, e.g. the API's in-cluster URL);
+ * 3. `NEXT_PUBLIC_API_AUTH_URL` (the `/auth/*` base);
+ * 4. the origin of `NEXT_PUBLIC_API_URL` (the GraphQL endpoint);
+ * 5. `http://localhost:17603` outside `NODE_ENV=production`.
+ *
+ * Only absolute http(s) URLs count; a relative setting is ignored. `null`
+ * when nothing applies, and the session check then refuses every request.
+ */
+export declare function resolveBPMApiSessionBaseUrl(apiBaseUrl?: string): string | null;
+/**
+ * An `authorize` hook for {@link createWorkflowChatPOST} that lets in only a
+ * caller the BPM API recognises as signed in: it forwards the request's
+ * `Cookie` header (nothing else) to the API's session endpoint and accepts a
+ * `200` whose JSON names a `memberId`. No cookie, any other status, a body
+ * of another shape, a network error or a timeout refuses, so the route
+ * answers 401. The session itself is never read or kept here.
+ *
+ * Host usage (apps/client/src/app/api/chat/route.ts):
+ *   export const POST = createWorkflowChatPOST({
+ *     authorize: createBPMApiSessionAuthorize(),
+ *   });
+ */
+export declare function createBPMApiSessionAuthorize(options?: BPMApiSessionAuthorizeOptions): (request: Request) => Promise<boolean>;
 /** Create the `POST` handler for the workflow chat route. */
 export declare function createWorkflowChatPOST(options?: WorkflowChatRouteOptions): (request: Request) => Promise<Response>;

package/dist/next/workflow-chat-route.js

@@ -1,31 +1,139 @@
-import { convertToModelMessages as e, jsonSchema as t, streamText as n, tool as r } from "ai";
-import { openai as i } from "@ai-sdk/openai";
-import { WORKFLOW_TOOLSET as a } from "@rytass/bpm-core-shared";
+import { n as e } from "../chunks/workflow-chat-prompt-B4wCFKPB.js";
+import { convertToModelMessages as t, jsonSchema as n, streamText as r, tool as i } from "ai";
+import { openai as a } from "@ai-sdk/openai";
+import { WORKFLOW_TOOLSET as o } from "@rytass/bpm-core-shared";
 // src/next/workflow-chat-route.ts
-var o = "gpt-5.4-mini";
-function s(e) {
-	return i(e.replace(/^openai\//u, ""));
+var s = "gpt-5.4-mini";
+function c(e) {
+	return a(e.replace(/^openai\//u, ""));
 }
-var c = "你是「簽核流程設計器」頁面內建的 AI 助理，唯一職責是協助使用者在這個畫布上設計／修改一個簽核審批流程（workflow）。\n\n你只能透過系統提供的工具（tools）來操作流程：新增/重命名/刪除節點、連線、設定簽核人、設定條件分流、設定系統節點動作、自動排版、查詢現況與驗證等。除了這些工具，你沒有其他能力。\n\n工作守則：\n1. 動作前，先呼叫 get_workflow_snapshot 了解目前畫布的節點與連線，再規劃要呼叫哪些工具。\n2. 盡量用高階工具（insert_approval_step / insert_notification / insert_conditional_branch）一次完成多步；需要細修時再用細顆粒工具。\n3. **重要：要果斷、先把流程畫出來。** 使用者只給一兩句話時，直接依常見公司慣例建立初稿，不要反覆追問細節。簽核人若使用者沒指定，就省略 approverResolver（系統會自動用「直屬主管」為預設，不需要真實會員 id）；通知節點同理可省略 action（預設站內通知）。先把結構建好、再請使用者調整。\n4. 工具呼叫不會因為「缺簽核人/缺資料」而失敗；缺的部分會以合理預設補上，並由 validate_workflow 標示。所以放心連續呼叫工具把流程建完，不要因為怕缺欄位就停下來問。\n5. 當使用者「點名」某個人或部門當簽核人/收件者時，先用 search_members（依姓名關鍵字）、list_org_units、list_positions 查到真實 id，再用 set_user_task_approver / set_service_action 指定（如 DIRECT memberIds、ORG_UNIT_MANAGER orgUnitId、POSITION positionId）。查不到就回報並請使用者確認，不要編造 id。\n6. 節點 id 可從 snapshot 取得；連線條件需要先綁定表單欄位（若 list_form_fields 為空，提醒使用者先綁定表單版本）。\n7. **條件分流務必主動補上「其他情況」**：設計 exclusiveGateway（條件分流）時，除了符合條件的分支，一定要保留一條未設條件、標記為預設（isDefault）的「其他情況」路徑當 else（通常指向後續節點或完成）。不要把所有輸出連線都設成條件而沒有預設出口；缺預設出口時，用 set_edge_default 把其中一條設為預設。\n8. 完成後，呼叫 validate_workflow，並用一兩句話說明你建了什麼流程、哪些地方（如簽核人、條件門檻）建議使用者再確認或指定。\n9. 全程使用繁體中文（台灣用語）回覆。\n10. 欄位在各關的顯示與補填用 set_field_access_matrix 設定：nodeIds 只列這次要改的簽核節點，它們的設定會整個換掉，呼叫前先從 get_workflow_snapshot 讀出這些節點既有的「欄位設定」一併傳入。「隱藏」只影響畫面、不是權限，不能用來保密；使用者要求保密時要說明這一點。節點含舊欄位權限設定時，用 remove_legacy_field_permissions 移除（不會自動轉換）。\n\n嚴格界線：\n- 只做「設計這個簽核流程」相關的事。任何與此無關的請求（閒聊、寫詩、寫程式、查天氣／新聞、操作其他系統或頁面、回答一般知識問題等）一律婉拒，並簡短引導使用者回到流程設計，例如：「我只能協助你設計這個簽核流程，需要我幫你新增關卡或設定條件嗎？」\n- 不要假裝執行你工具以外的動作，也不要編造結果。";
 function l() {
-	let e = a.map((e) => [e.name, r({
+	let e = o.map((e) => [e.name, i({
 		description: e.description,
-		inputSchema: t(e.inputSchema)
+		inputSchema: n(e.inputSchema)
 	})]);
 	return Object.fromEntries(e);
 }
-function u(t = {}) {
-	let r = l();
+var u = 1048576, d = 200, f = 4096, p = (e, t) => new Response(t, {
+	headers: { "Content-Type": "text/plain; charset=utf-8" },
+	status: e
+});
+function m(e) {
+	return typeof e == "function" ? e() : e ?? process.env.BPM_AI_ASSISTANT_ENABLED === "true";
+}
+async function h(e, t) {
+	if (!t) return !0;
+	try {
+		return await t(e) === !0;
+	} catch {
+		return !1;
+	}
+}
+function g(e) {
+	return typeof e == "object" && !!e && typeof e.role == "string" && Array.isArray(e.parts);
+}
+async function _(e, t) {
+	if (e.body === null) return "";
+	let n = e.body.getReader(), r = [], i = async (e) => {
+		let { done: a, value: o } = await n.read();
+		if (a) return e;
+		let s = e + o.byteLength;
+		return s > t ? (await n.cancel().catch(() => void 0), null) : (r.push(o), i(s));
+	}, a = await i(0);
+	if (a === null) return null;
+	let o = new Uint8Array(a);
+	return r.reduce((e, t) => (o.set(t, e), e + t.byteLength), 0), new TextDecoder().decode(o);
+}
+async function v(e, t) {
+	if (Number(e.headers.get("content-length") ?? "0") > t.maxRequestBytes) return {
+		ok: !1,
+		response: p(413, "Request too large")
+	};
+	let n = await _(e, t.maxRequestBytes);
+	if (n === null) return {
+		ok: !1,
+		response: p(413, "Request too large")
+	};
+	let r;
+	try {
+		r = JSON.parse(n);
+	} catch {
+		return {
+			ok: !1,
+			response: p(400, "Invalid request")
+		};
+	}
+	let i = typeof r == "object" && r ? r.messages : void 0;
+	return !Array.isArray(i) || !i.every(g) ? {
+		ok: !1,
+		response: p(400, "Invalid request")
+	} : i.length > t.maxMessages ? {
+		ok: !1,
+		response: p(413, "Too many messages")
+	} : {
+		messages: i.filter((e) => e.role !== "system"),
+		ok: !0
+	};
+}
+var y = "http://localhost:17603", b = "/auth/me", x = 5e3, S = (e) => {
+	let t = e?.trim();
+	if (!t) return null;
+	try {
+		let e = new URL(t);
+		return e.protocol === "http:" || e.protocol === "https:" ? e.toString().replace(/\/$/u, "") : null;
+	} catch {
+		return null;
+	}
+}, C = (e) => {
+	let t = S(e);
+	return t === null ? null : new URL(t).origin;
+};
+function w(e) {
+	return S(e) ?? S(process.env.BPM_API_INTERNAL_URL) ?? S(process.env.NEXT_PUBLIC_API_AUTH_URL) ?? C(process.env.NEXT_PUBLIC_API_URL) ?? (process.env.NODE_ENV === "production" ? null : y);
+}
+var T = (e) => typeof e == "object" && !!e && typeof e.memberId == "string" && e.memberId.length > 0;
+function E(e = {}) {
+	return async function(t) {
+		let n = t.headers.get("cookie");
+		if (!n) return !1;
+		let r = w(e.apiBaseUrl);
+		if (r === null) return !1;
+		let i = e.fetch ?? fetch, a = `${r}${e.sessionPath ?? "/auth/me"}`;
+		try {
+			let t = await i(a, {
+				cache: "no-store",
+				headers: {
+					Accept: "application/json",
+					Cookie: n
+				},
+				method: "GET",
+				redirect: "manual",
+				signal: AbortSignal.timeout(e.timeoutMs ?? 5e3)
+			});
+			return t.status === 200 && T(await t.json());
+		} catch {
+			return !1;
+		}
+	};
+}
+function D(e = {}) {
+	let n = l();
 	return async function(i) {
-		let a = await i.json();
-		return n({
-			messages: await e([...a.messages]),
-			model: s(t.model ?? process.env.BPM_LLM_MODEL ?? o),
-			system: t.system ?? "你是「簽核流程設計器」頁面內建的 AI 助理，唯一職責是協助使用者在這個畫布上設計／修改一個簽核審批流程（workflow）。\n\n你只能透過系統提供的工具（tools）來操作流程：新增/重命名/刪除節點、連線、設定簽核人、設定條件分流、設定系統節點動作、自動排版、查詢現況與驗證等。除了這些工具，你沒有其他能力。\n\n工作守則：\n1. 動作前，先呼叫 get_workflow_snapshot 了解目前畫布的節點與連線，再規劃要呼叫哪些工具。\n2. 盡量用高階工具（insert_approval_step / insert_notification / insert_conditional_branch）一次完成多步；需要細修時再用細顆粒工具。\n3. **重要：要果斷、先把流程畫出來。** 使用者只給一兩句話時，直接依常見公司慣例建立初稿，不要反覆追問細節。簽核人若使用者沒指定，就省略 approverResolver（系統會自動用「直屬主管」為預設，不需要真實會員 id）；通知節點同理可省略 action（預設站內通知）。先把結構建好、再請使用者調整。\n4. 工具呼叫不會因為「缺簽核人/缺資料」而失敗；缺的部分會以合理預設補上，並由 validate_workflow 標示。所以放心連續呼叫工具把流程建完，不要因為怕缺欄位就停下來問。\n5. 當使用者「點名」某個人或部門當簽核人/收件者時，先用 search_members（依姓名關鍵字）、list_org_units、list_positions 查到真實 id，再用 set_user_task_approver / set_service_action 指定（如 DIRECT memberIds、ORG_UNIT_MANAGER orgUnitId、POSITION positionId）。查不到就回報並請使用者確認，不要編造 id。\n6. 節點 id 可從 snapshot 取得；連線條件需要先綁定表單欄位（若 list_form_fields 為空，提醒使用者先綁定表單版本）。\n7. **條件分流務必主動補上「其他情況」**：設計 exclusiveGateway（條件分流）時，除了符合條件的分支，一定要保留一條未設條件、標記為預設（isDefault）的「其他情況」路徑當 else（通常指向後續節點或完成）。不要把所有輸出連線都設成條件而沒有預設出口；缺預設出口時，用 set_edge_default 把其中一條設為預設。\n8. 完成後，呼叫 validate_workflow，並用一兩句話說明你建了什麼流程、哪些地方（如簽核人、條件門檻）建議使用者再確認或指定。\n9. 全程使用繁體中文（台灣用語）回覆。\n10. 欄位在各關的顯示與補填用 set_field_access_matrix 設定：nodeIds 只列這次要改的簽核節點，它們的設定會整個換掉，呼叫前先從 get_workflow_snapshot 讀出這些節點既有的「欄位設定」一併傳入。「隱藏」只影響畫面、不是權限，不能用來保密；使用者要求保密時要說明這一點。節點含舊欄位權限設定時，用 remove_legacy_field_permissions 移除（不會自動轉換）。\n\n嚴格界線：\n- 只做「設計這個簽核流程」相關的事。任何與此無關的請求（閒聊、寫詩、寫程式、查天氣／新聞、操作其他系統或頁面、回答一般知識問題等）一律婉拒，並簡短引導使用者回到流程設計，例如：「我只能協助你設計這個簽核流程，需要我幫你新增關卡或設定條件嗎？」\n- 不要假裝執行你工具以外的動作，也不要編造結果。",
-			tools: r
-		}).toUIMessageStreamResponse();
+		if (!m(e.enabled)) return p(404, "Not Found");
+		if (!await h(i, e.authorize)) return p(401, "Unauthorized");
+		let a = await v(i, {
+			maxMessages: e.maxMessages ?? 200,
+			maxRequestBytes: e.maxRequestBytes ?? 1048576
+		});
+		return a.ok ? r({
+			maxOutputTokens: e.maxOutputTokens ?? 4096,
+			messages: await t([...a.messages]),
+			model: c(e.model ?? process.env.BPM_LLM_MODEL ?? s),
+			system: e.system ?? "你是「簽核流程設計器」頁面內建的 AI 助理，唯一職責是協助使用者在這個畫布上設計／修改一個簽核審批流程（workflow）。\n\n你只能透過系統提供的工具（tools）來操作流程：新增/重命名/刪除節點、連線、設定簽核人、設定條件分流、設定系統節點動作、自動排版、查詢現況與驗證等。除了這些工具，你沒有其他能力。\n\n工作守則：\n1. 動作前，先呼叫 get_workflow_snapshot 了解目前畫布的節點與連線，再規劃要呼叫哪些工具。\n2. 盡量用高階工具（insert_approval_step / insert_notification / insert_conditional_branch）一次完成多步；需要細修時再用細顆粒工具。\n3. **重要：要果斷、先把流程畫出來。** 使用者只給一兩句話時，直接依常見公司慣例建立初稿，不要反覆追問細節。簽核人若使用者沒指定，就省略 approverResolver（系統會自動用「直屬主管」為預設，不需要真實會員 id）；通知節點同理可省略 action（預設站內通知）。先把結構建好、再請使用者調整。\n4. 工具呼叫不會因為「缺簽核人/缺資料」而失敗；缺的部分會以合理預設補上，並由 validate_workflow 標示。所以放心連續呼叫工具把流程建完，不要因為怕缺欄位就停下來問。\n5. 當使用者「點名」某個人或部門當簽核人/收件者時，先用 search_members（依姓名關鍵字）、list_org_units、list_positions 查到真實 id，再用 set_user_task_approver / set_service_action 指定（如 DIRECT memberIds、ORG_UNIT_MANAGER orgUnitId、POSITION positionId）。查不到就回報並請使用者確認，不要編造 id。\n6. 節點 id 可從 snapshot 取得；連線條件需要先綁定表單欄位（若 list_form_fields 為空，提醒使用者先綁定表單版本）。\n7. **條件分流務必主動補上「其他情況」**：設計 exclusiveGateway（條件分流）時，除了符合條件的分支，一定要保留一條未設條件、標記為預設（isDefault）的「其他情況」路徑當 else（通常指向後續節點或完成）。不要把所有輸出連線都設成條件而沒有預設出口；缺預設出口時，用 set_edge_default 把其中一條設為預設。\n8. 完成後，呼叫 validate_workflow，並用一兩句話說明你建了什麼流程、哪些地方（如簽核人、條件門檻）建議使用者再確認或指定。\n9. 全程使用繁體中文（台灣用語）回覆。\n10. 欄位在各關的顯示與補填用 set_field_access_matrix 設定：nodeIds 只列這次要改的簽核節點，它們的設定會整個換掉，呼叫前先從 get_workflow_snapshot 讀出這些節點既有的「欄位設定」一併傳入。「隱藏」只影響畫面、不是權限，不能用來保密；使用者要求保密時要說明這一點。節點含舊欄位權限設定時，用 remove_legacy_field_permissions 移除（不會自動轉換）。\n\n運算式（CEL）規則：\n- 運算式只在後端檢查與執行，你看不到執行結果，也不能在瀏覽器試算。寫任何運算式（發起權限、簽核人運算式、系統節點寫入欄位的值、Webhook payload、知會對象運算式）之前，先呼叫 get_expression_catalog 取得該位置可用的根、欄位與函式，只使用目錄裡的名稱；宿主函式名稱帶版本（例如 erp_costBand_v1），要照目錄原樣寫。\n- 寫入前一定先用 preview_expression 檢查（LINT）。有 ERROR 就修正後再檢查，不要直接寫入；寫入工具也會再檢查一次，未通過會被拒絕。WARNING 只是提醒，寫入後要用一句話告訴使用者。\n- 條件分流的連線條件優先用 set_edge_condition（依欄位、運算子、值，由系統產生），不要自己拼 CEL。\n- 只有從簽核關卡出去的連線才讀得到 lastDecision；條件分流、系統節點出去的連線 lastDecision 永遠是空值，不要在那裡讀它。\n- 運算式寫進草稿後不會自動發布；發布由使用者在畫面上操作，你不能也不要嘗試發布。\n\n嚴格界線：\n- 只做「設計這個簽核流程」相關的事。任何與此無關的請求（閒聊、寫詩、寫程式、查天氣／新聞、操作其他系統或頁面、回答一般知識問題等）一律婉拒，並簡短引導使用者回到流程設計，例如：「我只能協助你設計這個簽核流程，需要我幫你新增關卡或設定條件嗎？」\n- 不要假裝執行你工具以外的動作，也不要編造結果。",
+			tools: n
+		}).toUIMessageStreamResponse() : a.response;
 	};
 }
-export { c as WORKFLOW_CHAT_SYSTEM_PROMPT, l as buildWorkflowAiSdkTools, u as createWorkflowChatPOST };
+export { b as DEFAULT_BPM_API_SESSION_PATH, x as DEFAULT_BPM_API_SESSION_TIMEOUT_MS, d as DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES, f as DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS, u as DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES, e as WORKFLOW_CHAT_SYSTEM_PROMPT, l as buildWorkflowAiSdkTools, E as createBPMApiSessionAuthorize, D as createWorkflowChatPOST, v as readWorkflowChatMessages, w as resolveBPMApiSessionBaseUrl };
 
 //# sourceMappingURL=workflow-chat-route.js.map

package/dist/next/workflow-chat-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-chat-route.js","names":["DEFAULT_MODEL","resolveModel","openai","setting","WORKFLOW_CHAT_SYSTEM_PROMPT","buildWorkflowAiSdkTools","entries","WORKFLOW_TOOLSET","workflowTool","tool","jsonSchema","createWorkflowChatPOST","tools","body","request","streamText","convertToModelMessages","options"],"sources":["../../src/next/workflow-chat-route.ts"],"sourcesContent":["import {\n  convertToModelMessages,\n  jsonSchema,\n  streamText,\n  tool,\n  type LanguageModel,\n  type Tool,\n  type ToolSet,\n  type UIMessage,\n} from 'ai';\nimport { openai } from '@ai-sdk/openai';\nimport { WORKFLOW_TOOLSET } from '@rytass/bpm-core-shared';\n\n/**\n * Next.js route handler for the workflow designer LLM assistant.\n *\n * The model is advertised the workflow {@link WORKFLOW_TOOLSET} but the tools\n * carry **no `execute`** — so every tool call is forwarded to the browser,\n * where `useChat`'s `onToolCall` runs it against the React designer controller\n * (see `use-workflow-chat.ts`). This route only holds the API key, runs the\n * model, and streams the tool-call plan back. It never touches the canvas.\n *\n * Host usage (apps/client/src/app/api/chat/route.ts):\n *   export const runtime = 'nodejs';\n *   export const POST = createWorkflowChatPOST();\n */\n\n/** Default OpenAI model id (overridable via BPM_LLM_MODEL). */\nconst DEFAULT_MODEL = 'gpt-5.4-mini';\n\n/**\n * Resolve the model via the OpenAI provider directly (reads `OPENAI_API_KEY`).\n * Accepts a bare id (`gpt-5.4-mini`) or a `openai/`-prefixed id; the prefix is\n * stripped. This deployment talks to OpenAI directly — no AI Gateway.\n */\nfunction resolveModel(setting: string): LanguageModel {\n  return openai(setting.replace(/^openai\\//u, ''));\n}\n\n/**\n * Strict guardrail: the assistant may ONLY design this approval flow, using the\n * provided tools. Anything else is declined. Lives server-side so it cannot be\n * overridden by client-supplied messages.\n */\nexport const WORKFLOW_CHAT_SYSTEM_PROMPT = `你是「簽核流程設計器」頁面內建的 AI 助理，唯一職責是協助使用者在這個畫布上設計／修改一個簽核審批流程（workflow）。\n\n你只能透過系統提供的工具（tools）來操作流程：新增/重命名/刪除節點、連線、設定簽核人、設定條件分流、設定系統節點動作、自動排版、查詢現況與驗證等。除了這些工具，你沒有其他能力。\n\n工作守則：\n1. 動作前，先呼叫 get_workflow_snapshot 了解目前畫布的節點與連線，再規劃要呼叫哪些工具。\n2. 盡量用高階工具（insert_approval_step / insert_notification / insert_conditional_branch）一次完成多步；需要細修時再用細顆粒工具。\n3. **重要：要果斷、先把流程畫出來。** 使用者只給一兩句話時，直接依常見公司慣例建立初稿，不要反覆追問細節。簽核人若使用者沒指定，就省略 approverResolver（系統會自動用「直屬主管」為預設，不需要真實會員 id）；通知節點同理可省略 action（預設站內通知）。先把結構建好、再請使用者調整。\n4. 工具呼叫不會因為「缺簽核人/缺資料」而失敗；缺的部分會以合理預設補上，並由 validate_workflow 標示。所以放心連續呼叫工具把流程建完，不要因為怕缺欄位就停下來問。\n5. 當使用者「點名」某個人或部門當簽核人/收件者時，先用 search_members（依姓名關鍵字）、list_org_units、list_positions 查到真實 id，再用 set_user_task_approver / set_service_action 指定（如 DIRECT memberIds、ORG_UNIT_MANAGER orgUnitId、POSITION positionId）。查不到就回報並請使用者確認，不要編造 id。\n6. 節點 id 可從 snapshot 取得；連線條件需要先綁定表單欄位（若 list_form_fields 為空，提醒使用者先綁定表單版本）。\n7. **條件分流務必主動補上「其他情況」**：設計 exclusiveGateway（條件分流）時，除了符合條件的分支，一定要保留一條未設條件、標記為預設（isDefault）的「其他情況」路徑當 else（通常指向後續節點或完成）。不要把所有輸出連線都設成條件而沒有預設出口；缺預設出口時，用 set_edge_default 把其中一條設為預設。\n8. 完成後，呼叫 validate_workflow，並用一兩句話說明你建了什麼流程、哪些地方（如簽核人、條件門檻）建議使用者再確認或指定。\n9. 全程使用繁體中文（台灣用語）回覆。\n10. 欄位在各關的顯示與補填用 set_field_access_matrix 設定：nodeIds 只列這次要改的簽核節點，它們的設定會整個換掉，呼叫前先從 get_workflow_snapshot 讀出這些節點既有的「欄位設定」一併傳入。「隱藏」只影響畫面、不是權限，不能用來保密；使用者要求保密時要說明這一點。節點含舊欄位權限設定時，用 remove_legacy_field_permissions 移除（不會自動轉換）。\n\n嚴格界線：\n- 只做「設計這個簽核流程」相關的事。任何與此無關的請求（閒聊、寫詩、寫程式、查天氣／新聞、操作其他系統或頁面、回答一般知識問題等）一律婉拒，並簡短引導使用者回到流程設計，例如：「我只能協助你設計這個簽核流程，需要我幫你新增關卡或設定條件嗎？」\n- 不要假裝執行你工具以外的動作，也不要編造結果。`;\n\n/** Build AI SDK tools from WORKFLOW_TOOLSET — no `execute`, so the browser runs them. */\nexport function buildWorkflowAiSdkTools(): ToolSet {\n  const entries: readonly (readonly [string, Tool])[] = WORKFLOW_TOOLSET.map(\n    (workflowTool) =>\n      [\n        workflowTool.name,\n        tool({\n          description: workflowTool.description,\n          inputSchema: jsonSchema(\n            workflowTool.inputSchema as Parameters<typeof jsonSchema>[0],\n          ),\n        }),\n      ] as const,\n  );\n\n  return Object.fromEntries(entries) as ToolSet;\n}\n\nexport interface WorkflowChatRouteOptions {\n  /** Override the OpenAI model id (else BPM_LLM_MODEL env, else the default). */\n  readonly model?: string;\n  /** Override the system prompt (else the strict design-only guardrail). */\n  readonly system?: string;\n}\n\ninterface WorkflowChatRequestBody {\n  readonly messages: readonly UIMessage[];\n}\n\n/** Create the `POST` handler for the workflow chat route. */\nexport function createWorkflowChatPOST(\n  options: WorkflowChatRouteOptions = {},\n): (request: Request) => Promise<Response> {\n  const tools = buildWorkflowAiSdkTools();\n\n  return async function POST(request: Request): Promise<Response> {\n    const body = (await request.json()) as WorkflowChatRequestBody;\n    const result = streamText({\n      messages: await convertToModelMessages([...body.messages]),\n      model: resolveModel(\n        options.model ?? process.env.BPM_LLM_MODEL ?? DEFAULT_MODEL,\n      ),\n      system: options.system ?? WORKFLOW_CHAT_SYSTEM_PROMPT,\n      tools,\n    });\n\n    return result.toUIMessageStreamResponse();\n  };\n}\n"],"mappings":";;;;AA4BA,IAAMA,IAAgB;AAOtB,SAASC,EAAa,GAAgC;CACpD,OAAOC,EAAOC,EAAQ,QAAQ,cAAc,EAAE,CAAC;AACjD;AAOA,IAAaC,IAA8B;AAqB3C,SAAgBC,IAAmC;CACjD,IAAMC,IAAgDC,EAAiB,KACpE,MACC,CACEC,EAAa,MACbC,EAAK;EACH,aAAaD,EAAa;EAC1B,aAAaE,EACXF,EAAa,WACf;CACF,CAAC,CACH,CACJ;CAEA,OAAO,OAAO,YAAYF,CAAO;AACnC;AAcA,SAAgBK,EACd,IAAoC,CAAC,GACI;CACzC,IAAMC,IAAQP,EAAwB;CAEtC,OAAO,eAAoB,GAAqC;EAC9D,IAAMQ,IAAQ,MAAMC,EAAQ,KAAK;EAUjC,OATeC,EAAW;GACxB,UAAU,MAAMC,EAAuB,CAAC,GAAGH,EAAK,QAAQ,CAAC;GACzD,OAAOZ,EACLgB,EAAQ,SAAS,QAAQ,IAAI,iBAAiBjB,CAChD;GACA,QAAQiB,EAAQ,UAAA;GAChB;EACF,CAEO,CAAA,CAAO,0BAA0B;CAC1C;AACF"}
+{"version":3,"file":"workflow-chat-route.js","names":["WORKFLOW_CHAT_SYSTEM_PROMPT","DEFAULT_MODEL","resolveModel","openai","setting","buildWorkflowAiSdkTools","entries","WORKFLOW_TOOLSET","workflowTool","tool","jsonSchema","DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES","DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES","DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS","plainResponse","text","isEnabled","enabled","isAuthorized","authorize","request","isUIMessage","value","readBodyWithinLimit","reader","chunks","readWithin","done","total","nextTotal","maxBytes","bytes","chunk","offset","readWorkflowChatMessages","limits","body","messages","message","LOCAL_BPM_API_ORIGIN","DEFAULT_BPM_API_SESSION_PATH","DEFAULT_BPM_API_SESSION_TIMEOUT_MS","readAbsoluteUrl","configured","url","readAbsoluteOrigin","resolveBPMApiSessionBaseUrl","apiBaseUrl","isSignedInMember","createBPMApiSessionAuthorize","cookie","baseUrl","options","fetchImpl","response","createWorkflowChatPOST","tools","read","streamText","convertToModelMessages"],"sources":["../../src/next/workflow-chat-route.ts"],"sourcesContent":["import {\n  convertToModelMessages,\n  jsonSchema,\n  streamText,\n  tool,\n  type LanguageModel,\n  type Tool,\n  type ToolSet,\n  type UIMessage,\n} from 'ai';\nimport { openai } from '@ai-sdk/openai';\nimport { WORKFLOW_TOOLSET } from '@rytass/bpm-core-shared';\nimport { WORKFLOW_CHAT_SYSTEM_PROMPT } from '../views/templates/designer/workflow-chat-prompt';\n\n/**\n * Next.js route handler for the workflow designer LLM assistant.\n *\n * The model is advertised the workflow {@link WORKFLOW_TOOLSET} but the tools\n * carry **no `execute`** — so every tool call is forwarded to the browser,\n * where `useChat`'s `onToolCall` runs it against the React designer controller\n * (see `use-workflow-chat.ts`). This route only holds the API key, runs the\n * model, and streams the tool-call plan back. It never touches the canvas.\n *\n * Host usage (apps/client/src/app/api/chat/route.ts):\n *   export const runtime = 'nodejs';\n *   export const POST = createWorkflowChatPOST({\n *     authorize: createBPMApiSessionAuthorize(),\n *   });\n *\n * The route answers 404 unless the assistant is enabled\n * (`BPM_AI_ASSISTANT_ENABLED=true`, read per request, or `options.enabled`),\n * runs the host's optional `authorize` hook (401 when it says no), bounds the\n * request (bytes and messages) and the model output (tokens), and drops any\n * `system` message the client sent (Phase 23 P4).\n */\n\n/** Default OpenAI model id (overridable via BPM_LLM_MODEL). */\nconst DEFAULT_MODEL = 'gpt-5.4-mini';\n\n/**\n * Resolve the model via the OpenAI provider directly (reads `OPENAI_API_KEY`).\n * Accepts a bare id (`gpt-5.4-mini`) or a `openai/`-prefixed id; the prefix is\n * stripped. This deployment talks to OpenAI directly — no AI Gateway.\n */\nfunction resolveModel(setting: string): LanguageModel {\n  return openai(setting.replace(/^openai\\//u, ''));\n}\n\n/**\n * Strict guardrail: the assistant may ONLY design this approval flow, using the\n * provided tools. Lives server-side so it cannot be overridden by\n * client-supplied messages (the route drops every `system` message a client\n * sends). Shared with the offline Chrome model through `workflow-chat-prompt`.\n */\nexport { WORKFLOW_CHAT_SYSTEM_PROMPT };\n\n/** Build AI SDK tools from WORKFLOW_TOOLSET — no `execute`, so the browser runs them. */\nexport function buildWorkflowAiSdkTools(): ToolSet {\n  const entries: readonly (readonly [string, Tool])[] = WORKFLOW_TOOLSET.map(\n    (workflowTool) =>\n      [\n        workflowTool.name,\n        tool({\n          description: workflowTool.description,\n          inputSchema: jsonSchema(\n            workflowTool.inputSchema as Parameters<typeof jsonSchema>[0],\n          ),\n        }),\n      ] as const,\n  );\n\n  return Object.fromEntries(entries) as ToolSet;\n}\n\n/** Upper bound on the request body, in bytes. Tool results carry snapshots. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES = 1_048_576;\n/** Upper bound on the messages in one request. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES = 200;\n/** Upper bound on the tokens the model may write per response. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS = 4_096;\n\nexport interface WorkflowChatRouteOptions {\n  /**\n   * Whether the route serves at all. Absent: `BPM_AI_ASSISTANT_ENABLED` is\n   * read on every request and must be `'true'`. A disabled route answers 404.\n   */\n  readonly enabled?: boolean | (() => boolean);\n  /**\n   * The host's check that the caller may use the assistant (a session, a\n   * designer permission). Called before the body is read; `false` (or a\n   * throw) answers 401. Absent: no check, so put the route behind the host's\n   * own authentication.\n   */\n  readonly authorize?: (request: Request) => boolean | Promise<boolean>;\n  /** Request body ceiling in bytes (413 above it). */\n  readonly maxRequestBytes?: number;\n  /** Message count ceiling (413 above it). */\n  readonly maxMessages?: number;\n  /** Output token ceiling passed to the model. */\n  readonly maxOutputTokens?: number;\n  /** Override the OpenAI model id (else BPM_LLM_MODEL env, else the default). */\n  readonly model?: string;\n  /** Override the system prompt (else the strict design-only guardrail). */\n  readonly system?: string;\n}\n\nconst plainResponse = (status: number, text: string): Response =>\n  new Response(text, {\n    headers: { 'Content-Type': 'text/plain; charset=utf-8' },\n    status,\n  });\n\nfunction isEnabled(enabled: WorkflowChatRouteOptions['enabled']): boolean {\n  if (typeof enabled === 'function') {\n    return enabled();\n  }\n\n  return enabled ?? process.env.BPM_AI_ASSISTANT_ENABLED === 'true';\n}\n\nasync function isAuthorized(\n  request: Request,\n  authorize: WorkflowChatRouteOptions['authorize'],\n): Promise<boolean> {\n  if (!authorize) {\n    return true;\n  }\n\n  try {\n    return (await authorize(request)) === true;\n  } catch {\n    return false;\n  }\n}\n\nfunction isUIMessage(value: unknown): value is UIMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { readonly role?: unknown }).role === 'string' &&\n    Array.isArray((value as { readonly parts?: unknown }).parts)\n  );\n}\n\ntype ReadMessagesResult =\n  | { readonly messages: readonly UIMessage[]; readonly ok: true }\n  | { readonly ok: false; readonly response: Response };\n\n/**\n * The request body as text, or `null` once it grows past `maxBytes`; reading\n * stops (and the stream is cancelled) at that point.\n */\nasync function readBodyWithinLimit(\n  request: Request,\n  maxBytes: number,\n): Promise<string | null> {\n  if (request.body === null) {\n    return '';\n  }\n\n  const reader = request.body.getReader();\n  // Local to this read and appended in place: copying the list per chunk\n  // would make a body of many tiny chunks quadratic.\n  const chunks: Uint8Array[] = [];\n\n  const readWithin = async (total: number): Promise<number | null> => {\n    const { done, value } = await reader.read();\n\n    if (done) {\n      return total;\n    }\n\n    const nextTotal = total + value.byteLength;\n\n    if (nextTotal > maxBytes) {\n      await reader.cancel().catch((): void => undefined);\n\n      return null;\n    }\n\n    chunks.push(value);\n\n    return readWithin(nextTotal);\n  };\n\n  const total = await readWithin(0);\n\n  if (total === null) {\n    return null;\n  }\n\n  const bytes = new Uint8Array(total);\n\n  chunks.reduce((offset, chunk): number => {\n    bytes.set(chunk, offset);\n\n    return offset + chunk.byteLength;\n  }, 0);\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * The client's messages, bounded and without any `system` message: the\n * system prompt is the route's alone. The body is read as text first so its\n * size is checked before anything is parsed.\n */\nexport async function readWorkflowChatMessages(\n  request: Request,\n  limits: Readonly<{ maxMessages: number; maxRequestBytes: number }>,\n): Promise<ReadMessagesResult> {\n  const declaredLength = Number(request.headers.get('content-length') ?? '0');\n\n  if (declaredLength > limits.maxRequestBytes) {\n    return { ok: false, response: plainResponse(413, 'Request too large') };\n  }\n\n  // A chunked request declares no length: read it with the limit applied as\n  // it arrives, so an oversized body is cut off instead of buffered whole.\n  const text = await readBodyWithinLimit(request, limits.maxRequestBytes);\n\n  if (text === null) {\n    return { ok: false, response: plainResponse(413, 'Request too large') };\n  }\n\n  let body: unknown;\n\n  try {\n    body = JSON.parse(text);\n  } catch {\n    return { ok: false, response: plainResponse(400, 'Invalid request') };\n  }\n\n  const messages: unknown =\n    typeof body === 'object' && body !== null\n      ? (body as { readonly messages?: unknown }).messages\n      : undefined;\n\n  if (!Array.isArray(messages) || !messages.every(isUIMessage)) {\n    return { ok: false, response: plainResponse(400, 'Invalid request') };\n  }\n\n  if (messages.length > limits.maxMessages) {\n    return { ok: false, response: plainResponse(413, 'Too many messages') };\n  }\n\n  return {\n    messages: messages.filter((message) => message.role !== 'system'),\n    ok: true,\n  };\n}\n\n/** Where the BPM API listens in local development (`@rytass/bpm-core-client`). */\nconst LOCAL_BPM_API_ORIGIN = 'http://localhost:17603';\n/** The API's \"who is signed in\" endpoint (`apps/api` `GET /auth/me`). */\nexport const DEFAULT_BPM_API_SESSION_PATH = '/auth/me';\n/** How long the session check may take before the route answers 401. */\nexport const DEFAULT_BPM_API_SESSION_TIMEOUT_MS = 5_000;\n\nexport interface BPMApiSessionAuthorizeOptions {\n  /**\n   * The absolute API origin to ask, e.g. an internal service URL. Absent:\n   * read from configuration by {@link resolveBPMApiSessionBaseUrl}.\n   */\n  readonly apiBaseUrl?: string;\n  /** The fetch to use (tests, instrumented hosts). Default: global `fetch`. */\n  readonly fetch?: typeof fetch;\n  /** The session endpoint path. Default `/auth/me`. */\n  readonly sessionPath?: string;\n  /** Milliseconds before the check gives up and refuses. Default 5 000. */\n  readonly timeoutMs?: number;\n}\n\n/** An absolute http(s) URL without its trailing slash, or `null`. */\nconst readAbsoluteUrl = (value: string | undefined): string | null => {\n  const configured = value?.trim();\n\n  if (!configured) {\n    return null;\n  }\n\n  try {\n    const url = new URL(configured);\n\n    return url.protocol === 'http:' || url.protocol === 'https:'\n      ? url.toString().replace(/\\/$/u, '')\n      : null;\n  } catch {\n    return null;\n  }\n};\n\nconst readAbsoluteOrigin = (value: string | undefined): string | null => {\n  const configured = readAbsoluteUrl(value);\n\n  return configured === null ? null : new URL(configured).origin;\n};\n\n/**\n * The API origin the session check asks. It comes only from configuration,\n * never from the request: a `Host` or forwarded header the caller controls\n * must not choose the server that decides whether the caller is signed in.\n *\n * 1. `apiBaseUrl` when given;\n * 2. `BPM_API_INTERNAL_URL` (server-only, e.g. the API's in-cluster URL);\n * 3. `NEXT_PUBLIC_API_AUTH_URL` (the `/auth/*` base);\n * 4. the origin of `NEXT_PUBLIC_API_URL` (the GraphQL endpoint);\n * 5. `http://localhost:17603` outside `NODE_ENV=production`.\n *\n * Only absolute http(s) URLs count; a relative setting is ignored. `null`\n * when nothing applies, and the session check then refuses every request.\n */\nexport function resolveBPMApiSessionBaseUrl(\n  apiBaseUrl?: string,\n): string | null {\n  return (\n    readAbsoluteUrl(apiBaseUrl) ??\n    readAbsoluteUrl(process.env.BPM_API_INTERNAL_URL) ??\n    readAbsoluteUrl(process.env.NEXT_PUBLIC_API_AUTH_URL) ??\n    readAbsoluteOrigin(process.env.NEXT_PUBLIC_API_URL) ??\n    (process.env.NODE_ENV === 'production' ? null : LOCAL_BPM_API_ORIGIN)\n  );\n}\n\nconst isSignedInMember = (value: unknown): boolean =>\n  typeof value === 'object' &&\n  value !== null &&\n  typeof (value as { readonly memberId?: unknown }).memberId === 'string' &&\n  (value as { readonly memberId: string }).memberId.length > 0;\n\n/**\n * An `authorize` hook for {@link createWorkflowChatPOST} that lets in only a\n * caller the BPM API recognises as signed in: it forwards the request's\n * `Cookie` header (nothing else) to the API's session endpoint and accepts a\n * `200` whose JSON names a `memberId`. No cookie, any other status, a body\n * of another shape, a network error or a timeout refuses, so the route\n * answers 401. The session itself is never read or kept here.\n *\n * Host usage (apps/client/src/app/api/chat/route.ts):\n *   export const POST = createWorkflowChatPOST({\n *     authorize: createBPMApiSessionAuthorize(),\n *   });\n */\nexport function createBPMApiSessionAuthorize(\n  options: BPMApiSessionAuthorizeOptions = {},\n): (request: Request) => Promise<boolean> {\n  return async function authorize(request: Request): Promise<boolean> {\n    const cookie = request.headers.get('cookie');\n\n    if (!cookie) {\n      return false;\n    }\n\n    const baseUrl = resolveBPMApiSessionBaseUrl(options.apiBaseUrl);\n\n    if (baseUrl === null) {\n      return false;\n    }\n\n    const fetchImpl = options.fetch ?? fetch;\n    const url = `${baseUrl}${options.sessionPath ?? DEFAULT_BPM_API_SESSION_PATH}`;\n\n    try {\n      const response = await fetchImpl(url, {\n        cache: 'no-store',\n        headers: { Accept: 'application/json', Cookie: cookie },\n        method: 'GET',\n        redirect: 'manual',\n        signal: AbortSignal.timeout(\n          options.timeoutMs ?? DEFAULT_BPM_API_SESSION_TIMEOUT_MS,\n        ),\n      });\n\n      if (response.status !== 200) {\n        return false;\n      }\n\n      return isSignedInMember(await response.json());\n    } catch {\n      return false;\n    }\n  };\n}\n\n/** Create the `POST` handler for the workflow chat route. */\nexport function createWorkflowChatPOST(\n  options: WorkflowChatRouteOptions = {},\n): (request: Request) => Promise<Response> {\n  const tools = buildWorkflowAiSdkTools();\n\n  return async function POST(request: Request): Promise<Response> {\n    if (!isEnabled(options.enabled)) {\n      return plainResponse(404, 'Not Found');\n    }\n\n    if (!(await isAuthorized(request, options.authorize))) {\n      return plainResponse(401, 'Unauthorized');\n    }\n\n    const read = await readWorkflowChatMessages(request, {\n      maxMessages: options.maxMessages ?? DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES,\n      maxRequestBytes:\n        options.maxRequestBytes ?? DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES,\n    });\n\n    if (!read.ok) {\n      return read.response;\n    }\n\n    const result = streamText({\n      maxOutputTokens:\n        options.maxOutputTokens ?? DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS,\n      messages: await convertToModelMessages([...read.messages]),\n      model: resolveModel(\n        options.model ?? process.env.BPM_LLM_MODEL ?? DEFAULT_MODEL,\n      ),\n      system: options.system ?? WORKFLOW_CHAT_SYSTEM_PROMPT,\n      tools,\n    });\n\n    return result.toUIMessageStreamResponse();\n  };\n}\n"],"mappings":";;;;;AAqCA,IAAMC,IAAgB;AAOtB,SAASC,EAAa,GAAgC;CACpD,OAAOC,EAAOC,EAAQ,QAAQ,cAAc,EAAE,CAAC;AACjD;AAWA,SAAgBC,IAAmC;CACjD,IAAMC,IAAgDC,EAAiB,KACpE,MACC,CACEC,EAAa,MACbC,EAAK;EACH,aAAaD,EAAa;EAC1B,aAAaE,EACXF,EAAa,WACf;CACF,CAAC,CACH,CACJ;CAEA,OAAO,OAAO,YAAYF,CAAO;AACnC;AAGA,IAAaK,IAA0C,SAE1CC,IAAqC,KAErCC,IAA0C,MA2BjDC,KAAiB,GAAgB,MACrC,IAAI,SAASC,GAAM;CACjB,SAAS,EAAE,gBAAgB,4BAA4B;CACvD;AACF,CAAC;AAEH,SAASC,EAAU,GAAuD;CAKxE,OAJI,OAAOC,KAAY,aACdA,EAAQ,IAGVA,KAAW,QAAQ,IAAI,6BAA6B;AAC7D;AAEA,eAAeC,EACb,GACA,GACkB;CAClB,IAAI,CAACC,GACH,OAAO;CAGT,IAAI;EACF,OAAQ,MAAMA,EAAUC,CAAO,MAAO;CACxC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAASC,EAAY,GAAoC;CACvD,OACE,OAAOC,KAAU,cACjBA,KACA,OAAQA,EAAsC,QAAS,YACvD,MAAM,QAASA,EAAuC,KAAK;AAE/D;AAUA,eAAeC,EACb,GACA,GACwB;CACxB,IAAIH,EAAQ,SAAS,MACnB,OAAO;CAGT,IAAMI,IAASJ,EAAQ,KAAK,UAAU,GAGhCK,IAAuB,CAAC,GAExBC,IAAa,OAAO,MAA0C;EAClE,IAAM,EAAE,SAAM,aAAU,MAAMF,EAAO,KAAK;EAE1C,IAAIG,GACF,OAAOC;EAGT,IAAMC,IAAYD,IAAQN,EAAM;EAUhC,OARIO,IAAYC,KACd,MAAMN,EAAO,OAAO,CAAC,CAAC,YAAkB,KAAA,CAAS,GAE1C,SAGTC,EAAO,KAAKH,CAAK,GAEVI,EAAWG,CAAS;CAC7B,GAEMD,IAAQ,MAAMF,EAAW,CAAC;CAEhC,IAAIE,MAAU,MACZ,OAAO;CAGT,IAAMG,IAAQ,IAAI,WAAWH,CAAK;CAQlC,OANAH,EAAO,QAAQ,GAAQ,OACrBM,EAAM,IAAIC,GAAOC,CAAM,GAEhBA,IAASD,EAAM,aACrB,CAAC,GAEG,IAAI,YAAY,CAAC,CAAC,OAAOD,CAAK;AACvC;AAOA,eAAsBG,EACpB,GACA,GAC6B;CAG7B,IAFuB,OAAOd,EAAQ,QAAQ,IAAI,gBAAgB,KAAK,GAEnE,IAAiBe,EAAO,iBAC1B,OAAO;EAAE,IAAI;EAAO,UAAUrB,EAAc,KAAK,mBAAmB;CAAE;CAKxE,IAAMC,IAAO,MAAMQ,EAAoBH,GAASe,EAAO,eAAe;CAEtE,IAAIpB,MAAS,MACX,OAAO;EAAE,IAAI;EAAO,UAAUD,EAAc,KAAK,mBAAmB;CAAE;CAGxE,IAAIsB;CAEJ,IAAI;EACF,IAAO,KAAK,MAAMrB,CAAI;CACxB,QAAQ;EACN,OAAO;GAAE,IAAI;GAAO,UAAUD,EAAc,KAAK,iBAAiB;EAAE;CACtE;CAEA,IAAMuB,IACJ,OAAOD,KAAS,YAAYA,IACvBA,EAAyC,WAC1C,KAAA;CAUN,OARI,CAAC,MAAM,QAAQC,CAAQ,KAAK,CAACA,EAAS,MAAMhB,CAAW,IAClD;EAAE,IAAI;EAAO,UAAUP,EAAc,KAAK,iBAAiB;CAAE,IAGlEuB,EAAS,SAASF,EAAO,cACpB;EAAE,IAAI;EAAO,UAAUrB,EAAc,KAAK,mBAAmB;CAAE,IAGjE;EACL,UAAUuB,EAAS,QAAQ,MAAYC,EAAQ,SAAS,QAAQ;EAChE,IAAI;CACN;AACF;AAGA,IAAMC,IAAuB,0BAEhBC,IAA+B,YAE/BC,IAAqC,KAiB5CC,KAAmB,MAA6C;CACpE,IAAMC,IAAarB,GAAO,KAAK;CAE/B,IAAI,CAACqB,GACH,OAAO;CAGT,IAAI;EACF,IAAMC,IAAM,IAAI,IAAID,CAAU;EAE9B,OAAOC,EAAI,aAAa,WAAWA,EAAI,aAAa,WAChDA,EAAI,SAAS,CAAC,CAAC,QAAQ,QAAQ,EAAE,IACjC;CACN,QAAQ;EACN,OAAO;CACT;AACF,GAEMC,KAAsB,MAA6C;CACvE,IAAMF,IAAaD,EAAgBpB,CAAK;CAExC,OAAOqB,MAAe,OAAO,OAAO,IAAI,IAAIA,CAAU,CAAC,CAAC;AAC1D;AAgBA,SAAgBG,EACd,GACe;CACf,OACEJ,EAAgBK,CAAU,KAC1BL,EAAgB,QAAQ,IAAI,oBAAoB,KAChDA,EAAgB,QAAQ,IAAI,wBAAwB,KACpDG,EAAmB,QAAQ,IAAI,mBAAmB,MAAA,QAAA,IAAA,aACxB,eAAe,OAAON;AAEpD;AAEA,IAAMS,KAAoB,MACxB,OAAO1B,KAAU,cACjBA,KACA,OAAQA,EAA0C,YAAa,YAC9DA,EAAwC,SAAS,SAAS;AAe7D,SAAgB2B,EACd,IAAyC,CAAC,GACF;CACxC,OAAO,eAAyB,GAAoC;EAClE,IAAMC,IAAS9B,EAAQ,QAAQ,IAAI,QAAQ;EAE3C,IAAI,CAAC8B,GACH,OAAO;EAGT,IAAMC,IAAUL,EAA4BM,EAAQ,UAAU;EAE9D,IAAID,MAAY,MACd,OAAO;EAGT,IAAME,IAAYD,EAAQ,SAAS,OAC7BR,IAAM,GAAGO,IAAUC,EAAQ,eAAA;EAEjC,IAAI;GACF,IAAME,IAAW,MAAMD,EAAUT,GAAK;IACpC,OAAO;IACP,SAAS;KAAE,QAAQ;KAAoB,QAAQM;IAAO;IACtD,QAAQ;IACR,UAAU;IACV,QAAQ,YAAY,QAClBE,EAAQ,aAAA,GACV;GACF,CAAC;GAMD,OAJIE,EAAS,WAAW,OAIjBN,EAAiB,MAAMM,EAAS,KAAK,CAAC;EAC/C,QAAQ;GACN,OAAO;EACT;CACF;AACF;AAGA,SAAgBC,EACd,IAAoC,CAAC,GACI;CACzC,IAAMC,IAAQnD,EAAwB;CAEtC,OAAO,eAAoB,GAAqC;EAC9D,IAAI,CAACW,EAAUoC,EAAQ,OAAO,GAC5B,OAAOtC,EAAc,KAAK,WAAW;EAGvC,IAAI,CAAE,MAAMI,EAAaE,GAASgC,EAAQ,SAAS,GACjD,OAAOtC,EAAc,KAAK,cAAc;EAG1C,IAAM2C,IAAO,MAAMvB,EAAyBd,GAAS;GACnD,aAAagC,EAAQ,eAAA;GACrB,iBACEA,EAAQ,mBAAA;EACZ,CAAC;EAiBD,OAfKK,EAAK,KAIKC,EAAW;GACxB,iBACEN,EAAQ,mBAAA;GACV,UAAU,MAAMO,EAAuB,CAAC,GAAGF,EAAK,QAAQ,CAAC;GACzD,OAAOvD,EACLkD,EAAQ,SAAS,QAAQ,IAAI,iBAAiBnD,CAChD;GACA,QAAQmD,EAAQ,UAAA;GAChB;EACF,CAEO,CAAA,CAAO,0BAA0B,IAd/BK,EAAK;CAehB;AACF"}

package/dist/pages/admin/delegations/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/delegations-CcS0SHbf.cjs");let t=require("react/jsx-runtime");var n={title:`代理設定 | BPM Admin`,description:`設定簽核代理規則，讓符合範圍的待簽任務自動改派給代理人。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/delegations-CVmtpkRn.cjs");let t=require("react/jsx-runtime");var n={title:`代理設定 | BPM Admin`,description:`設定簽核代理規則，讓符合範圍的待簽任務自動改派給代理人。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/admin/delegations/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/delegations-DBh5TT6G.js";
+import { t as e } from "../../../chunks/delegations-CxnNvTCc.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/admin/delegations/index.tsx
 var n = {

package/dist/pages/delegations/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../chunks/delegations-BmFGcuhA.cjs");let t=require("react/jsx-runtime");var n={title:`我的代理 | BPM Admin`,description:`設定自己的簽核代理，讓指定期間內的新待簽任務自動交由代理人處理。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../chunks/delegations-CrfjsH94.cjs");let t=require("react/jsx-runtime");var n={title:`我的代理 | BPM Admin`,description:`設定自己的簽核代理，讓指定期間內的新待簽任務自動交由代理人處理。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/delegations/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../chunks/delegations-BfhCDz5e.js";
+import { t as e } from "../../chunks/delegations-9-yvWWws.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/delegations/index.tsx
 var n = {

package/dist/pages/instances/detail/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/detail-BBC9kqXd.cjs");let t=require("react/jsx-runtime");var n={title:`案件詳情 | BPM Admin`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{instanceId:r})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/detail-ChseSF55.cjs");let t=require("react/jsx-runtime");var n={title:`案件詳情 | BPM Admin`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{instanceId:r})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/instances/detail/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/detail-C6XKZjlF.js";
+import { t as e } from "../../../chunks/detail-ByZV1XaI.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/instances/detail/index.tsx
 var n = { title: "案件詳情 | BPM Admin" };

package/dist/pages/templates/compose/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/compose-DtfX8DQ9.cjs");let t=require("react/jsx-runtime"),n=require("next/server");var r={title:`建立模板（表單 + 流程） | BPM Admin`,description:`以精靈式流程一次完成 BPM 表單與簽核流程設計並發佈。`};async function i(){return await(0,n.connection)(),(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`})}exports.default=i,exports.metadata=r;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/compose-Bb5bUVFd.cjs");let t=require("react/jsx-runtime"),n=require("next/server");var r={title:`建立模板（表單 + 流程） | BPM Admin`,description:`以精靈式流程一次完成 BPM 表單與簽核流程設計並發佈。`};async function i(){return await(0,n.connection)(),(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`})}exports.default=i,exports.metadata=r;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/templates/compose/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/compose-D9ipJpF_.js";
+import { t as e } from "../../../chunks/compose-egQlRjuZ.js";
 import { jsx as t } from "react/jsx-runtime";
 import { connection as n } from "next/server";
 // src/pages/templates/compose/index.tsx

package/dist/pages/templates/designer/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/designer-Df79YzUn.cjs");let t=require("react/jsx-runtime");var n={title:`流程設計器 | BPM Admin`,description:`以視覺化設計器編輯 BPM 簽核流程節點、條件與發佈版本。`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`,showDryRun:process.env.BPM_TEMPLATE_DRY_RUN_ENABLED!==`false`,templateId:r})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/designer-CX9bhYJS.cjs");let t=require("react/jsx-runtime");var n={title:`流程設計器 | BPM Admin`,description:`以視覺化設計器編輯 BPM 簽核流程節點、條件與發佈版本。`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`,showDryRun:process.env.BPM_TEMPLATE_DRY_RUN_ENABLED!==`false`,templateId:r})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/templates/designer/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/designer-ubnZbP-A.js";
+import { t as e } from "../../../chunks/designer-CZDlQ9Nf.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/templates/designer/index.tsx
 var n = {

package/dist/views/admin/delegations/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/delegations-CcS0SHbf.cjs");exports.AdminDelegationsView=e.t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/delegations-CVmtpkRn.cjs");exports.AdminDelegationsView=e.t;

package/dist/views/admin/delegations/index.js

@@ -1 +1 @@
-export { t as AdminDelegationsView } from "../../../chunks/delegations-DBh5TT6G.js";
+export { t as AdminDelegationsView } from "../../../chunks/delegations-CxnNvTCc.js";

package/dist/views/admin/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../chunks/users-EqSzDhuj.cjs"),t=require("../../chunks/orgs-B_2J2tLX.cjs"),n=require("../../chunks/delegations-CcS0SHbf.cjs"),r=require("./webhook-endpoints/index.cjs");exports.AdminDelegationsView=n.t,exports.AdminOrgsView=t.t,exports.AdminUsersView=e.t,exports.AdminWebhookEndpointsView=r.AdminWebhookEndpointsView;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../chunks/users-EqSzDhuj.cjs"),t=require("../../chunks/orgs-B_2J2tLX.cjs"),n=require("../../chunks/delegations-CVmtpkRn.cjs"),r=require("./webhook-endpoints/index.cjs");exports.AdminDelegationsView=n.t,exports.AdminOrgsView=t.t,exports.AdminUsersView=e.t,exports.AdminWebhookEndpointsView=r.AdminWebhookEndpointsView;

package/dist/views/admin/index.js

@@ -1,5 +1,5 @@
 import { t as e } from "../../chunks/users-BBtiZ9QQ.js";
 import { t } from "../../chunks/orgs-DqxMds26.js";
-import { t as n } from "../../chunks/delegations-DBh5TT6G.js";
+import { t as n } from "../../chunks/delegations-CxnNvTCc.js";
 import { AdminWebhookEndpointsView as r } from "./webhook-endpoints/index.js";
 export { n as AdminDelegationsView, t as AdminOrgsView, e as AdminUsersView, r as AdminWebhookEndpointsView };

package/dist/views/delegations/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../chunks/delegations-BmFGcuhA.cjs");exports.DelegationsView=e.t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../chunks/delegations-CrfjsH94.cjs");exports.DelegationsView=e.t;

package/dist/views/delegations/index.js

@@ -1 +1 @@
-export { t as DelegationsView } from "../../chunks/delegations-BfhCDz5e.js";
+export { t as DelegationsView } from "../../chunks/delegations-9-yvWWws.js";

package/dist/views/forms/builder/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/FormBuilderView-CHaAQL5v.cjs");exports.FormBuilderView=e.t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/FormBuilderView-CpUgbSbt.cjs");exports.FormBuilderView=e.t;

package/dist/views/forms/builder/index.js

@@ -1 +1 @@
-export { t as FormBuilderView } from "../../../chunks/FormBuilderView-vQfVc08Z.js";
+export { t as FormBuilderView } from "../../../chunks/FormBuilderView-CFRiw04B.js";