@rytass/bpm-core-react 0.20.0 → 0.21.0

package/dist/next/workflow-chat-route.cjs

@@ -1,4 +1,4 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../chunks/workflow-chat-prompt-B803qVdt.cjs");let t=require("ai"),n=require("@ai-sdk/openai"),r=require("@rytass/bpm-core-shared");var i=`gpt-5.4-mini`;function a(e){return(0,n.openai)(e.replace(/^openai\//u,``))}function o(){let e=r.WORKFLOW_TOOLSET.map(e=>[e.name,(0,t.tool)({description:e.description,inputSchema:(0,t.jsonSchema)(e.inputSchema)})]);return Object.fromEntries(e)}var s=1048576,c=200,l=4096,u=(e,t)=>new Response(t,{headers:{"Content-Type":`text/plain; charset=utf-8`},status:e});function d(e){return typeof e==`function`?e():e??process.env.BPM_AI_ASSISTANT_ENABLED===`true`}async function f(e,t){if(!t)return!0;try{return await t(e)===!0}catch{return!1}}function p(e){return typeof e==`object`&&!!e&&typeof e.role==`string`&&Array.isArray(e.parts)}async function m(e,t){if(e.body===null)return``;let n=e.body.getReader(),r=[],i=async e=>{let{done:a,value:o}=await n.read();if(a)return e;let s=e+o.byteLength;return s>t?(await n.cancel().catch(()=>void 0),null):(r.push(o),i(s))},a=await i(0);if(a===null)return null;let o=new Uint8Array(a);return r.reduce((e,t)=>(o.set(t,e),e+t.byteLength),0),new TextDecoder().decode(o)}async function h(e,t){if(Number(e.headers.get(`content-length`)??`0`)>t.maxRequestBytes)return{ok:!1,response:u(413,`Request too large`)};let n=await m(e,t.maxRequestBytes);if(n===null)return{ok:!1,response:u(413,`Request too large`)};let r;try{r=JSON.parse(n)}catch{return{ok:!1,response:u(400,`Invalid request`)}}let i=typeof r==`object`&&r?r.messages:void 0;return!Array.isArray(i)||!i.every(p)?{ok:!1,response:u(400,`Invalid request`)}:i.length>t.maxMessages?{ok:!1,response:u(413,`Too many messages`)}:{messages:i.filter(e=>e.role!==`system`),ok:!0}}var g=`http://localhost:17603`,_=`/auth/me`,v=5e3,y=e=>{let t=e?.trim();if(!t)return null;try{let e=new URL(t);return e.protocol===`http:`||e.protocol===`https:`?e.toString().replace(/\/$/u,``):null}catch{return null}},b=e=>{let t=y(e);return t===null?null:new URL(t).origin};function x(e){return y(e)??y(process.env.BPM_API_INTERNAL_URL)??y(process.env.NEXT_PUBLIC_API_AUTH_URL)??b(process.env.NEXT_PUBLIC_API_URL)??(process.env.NODE_ENV===`production`?null:g)}var S=e=>typeof e==`object`&&!!e&&typeof e.memberId==`string`&&e.memberId.length>0;function C(e={}){return async function(t){let n=t.headers.get(`cookie`);if(!n)return!1;let r=x(e.apiBaseUrl);if(r===null)return!1;let i=e.fetch??fetch,a=`${r}${e.sessionPath??`/auth/me`}`;try{let t=await i(a,{cache:`no-store`,headers:{Accept:`application/json`,Cookie:n},method:`GET`,redirect:`manual`,signal:AbortSignal.timeout(e.timeoutMs??5e3)});return t.status===200&&S(await t.json())}catch{return!1}}}function w(e={}){let n=o();return async function(r){if(!d(e.enabled))return u(404,`Not Found`);if(!await f(r,e.authorize))return u(401,`Unauthorized`);let o=await h(r,{maxMessages:e.maxMessages??200,maxRequestBytes:e.maxRequestBytes??1048576});return o.ok?(0,t.streamText)({maxOutputTokens:e.maxOutputTokens??4096,messages:await(0,t.convertToModelMessages)([...o.messages]),model:a(e.model??process.env.BPM_LLM_MODEL??i),system:e.system??`你是「簽核流程設計器」頁面內建的 AI 助理，唯一職責是協助使用者在這個畫布上設計／修改一個簽核審批流程（workflow）。
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../chunks/workflow-chat-prompt-B803qVdt.cjs");let t=require("@rytass/bpm-core-shared"),n=require("ai"),r=require("@ai-sdk/openai");var i=`gpt-5.4-mini`;function a(e){return(0,r.openai)(e.replace(/^openai\//u,``))}function o(){let e=t.WORKFLOW_TOOLSET.map(e=>[e.name,(0,n.tool)({description:e.description,inputSchema:(0,n.jsonSchema)(e.inputSchema)})]);return Object.fromEntries(e)}var s=1048576,c=200,l=4096,u=(e,t)=>new Response(t,{headers:{"Content-Type":`text/plain; charset=utf-8`},status:e});function d(e){return typeof e==`function`?e():e??process.env.BPM_AI_ASSISTANT_ENABLED===`true`}async function f(e,t){if(!t)return!0;try{return await t(e)===!0}catch{return!1}}function p(e){return typeof e==`object`&&!!e&&typeof e.role==`string`&&Array.isArray(e.parts)}async function m(e,t){if(e.body===null)return``;let n=e.body.getReader(),r=[],i=async e=>{let{done:a,value:o}=await n.read();if(a)return e;let s=e+o.byteLength;return s>t?(await n.cancel().catch(()=>void 0),null):(r.push(o),i(s))},a=await i(0);if(a===null)return null;let o=new Uint8Array(a);return r.reduce((e,t)=>(o.set(t,e),e+t.byteLength),0),new TextDecoder().decode(o)}async function h(e,t){if(Number(e.headers.get(`content-length`)??`0`)>t.maxRequestBytes)return{ok:!1,response:u(413,`Request too large`)};let n=await m(e,t.maxRequestBytes);if(n===null)return{ok:!1,response:u(413,`Request too large`)};let r;try{r=JSON.parse(n)}catch{return{ok:!1,response:u(400,`Invalid request`)}}let i=typeof r==`object`&&r?r.messages:void 0;return!Array.isArray(i)||!i.every(p)?{ok:!1,response:u(400,`Invalid request`)}:i.length>t.maxMessages?{ok:!1,response:u(413,`Too many messages`)}:{messages:i.filter(e=>e.role!==`system`),ok:!0}}var g=`http://localhost:17603`,_=`/auth/me`,v=5e3,y=e=>{let t=e?.trim();if(!t)return null;try{let e=new URL(t);return e.protocol===`http:`||e.protocol===`https:`?e.toString().replace(/\/$/u,``):null}catch{return null}},b=e=>{let t=y(e);return t===null?null:new URL(t).origin};function x(e){return y(e)??y(process.env.BPM_API_INTERNAL_URL)??y(process.env.NEXT_PUBLIC_API_AUTH_URL)??b(process.env.NEXT_PUBLIC_API_URL)??(process.env.NODE_ENV===`production`?null:g)}var S=e=>typeof e==`object`&&!!e&&typeof e.memberId==`string`&&e.memberId.length>0;function C(e={}){return async function(t){let n=t.headers.get(`cookie`);if(!n)return!1;let r=x(e.apiBaseUrl);if(r===null)return!1;let i=e.fetch??fetch,a=`${r}${e.sessionPath??`/auth/me`}`;try{let t=await i(a,{cache:`no-store`,headers:{Accept:`application/json`,Cookie:n},method:`GET`,redirect:`manual`,signal:AbortSignal.timeout(e.timeoutMs??5e3)});return t.status===200&&S(await t.json())}catch{return!1}}}function w(e={}){let t=o();return async function(r){if(!d(e.enabled))return u(404,`Not Found`);if(!await f(r,e.authorize))return u(401,`Unauthorized`);let o=await h(r,{maxMessages:e.maxMessages??200,maxRequestBytes:e.maxRequestBytes??1048576});return o.ok?(0,n.streamText)({maxOutputTokens:e.maxOutputTokens??4096,messages:await(0,n.convertToModelMessages)([...o.messages]),model:a(e.model??process.env.BPM_LLM_MODEL??i),system:e.system??`你是「簽核流程設計器」頁面內建的 AI 助理，唯一職責是協助使用者在這個畫布上設計／修改一個簽核審批流程（workflow）。
 
 你只能透過系統提供的工具（tools）來操作流程：新增/重命名/刪除節點、連線、設定簽核人、設定條件分流、設定系統節點動作、自動排版、查詢現況與驗證等。除了這些工具，你沒有其他能力。
 
@@ -23,5 +23,5 @@ Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=requi
 
 嚴格界線：
 - 只做「設計這個簽核流程」相關的事。任何與此無關的請求（閒聊、寫詩、寫程式、查天氣／新聞、操作其他系統或頁面、回答一般知識問題等）一律婉拒，並簡短引導使用者回到流程設計，例如：「我只能協助你設計這個簽核流程，需要我幫你新增關卡或設定條件嗎？」
-- 不要假裝執行你工具以外的動作，也不要編造結果。`,tools:n}).toUIMessageStreamResponse():o.response}}exports.DEFAULT_BPM_API_SESSION_PATH=_,exports.DEFAULT_BPM_API_SESSION_TIMEOUT_MS=v,exports.DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES=c,exports.DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS=l,exports.DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES=s,exports.WORKFLOW_CHAT_SYSTEM_PROMPT=e.n,exports.buildWorkflowAiSdkTools=o,exports.createBPMApiSessionAuthorize=C,exports.createWorkflowChatPOST=w,exports.readWorkflowChatMessages=h,exports.resolveBPMApiSessionBaseUrl=x;
+- 不要假裝執行你工具以外的動作，也不要編造結果。`,tools:t}).toUIMessageStreamResponse():o.response}}exports.DEFAULT_BPM_API_SESSION_PATH=_,exports.DEFAULT_BPM_API_SESSION_TIMEOUT_MS=v,exports.DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES=c,exports.DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS=l,exports.DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES=s,exports.WORKFLOW_CHAT_SYSTEM_PROMPT=e.n,exports.buildWorkflowAiSdkTools=o,exports.createBPMApiSessionAuthorize=C,exports.createWorkflowChatPOST=w,exports.readWorkflowChatMessages=h,exports.resolveBPMApiSessionBaseUrl=x;
 //# sourceMappingURL=workflow-chat-route.cjs.map

package/dist/next/workflow-chat-route.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-chat-route.cjs","names":["openai","WORKFLOW_TOOLSET","tool","jsonSchema","streamText","convertToModelMessages","require_workflow_chat_prompt","ai","_ai_sdk_openai","_rytass_bpm_core_shared","DEFAULT_MODEL","resolveModel","setting","buildWorkflowAiSdkTools","entries","workflowTool","DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES","DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES","DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS","plainResponse","text","isEnabled","enabled","isAuthorized","authorize","request","isUIMessage","value","readBodyWithinLimit","reader","chunks","readWithin","done","total","nextTotal","maxBytes","bytes","chunk","offset","readWorkflowChatMessages","limits","body","messages","message","LOCAL_BPM_API_ORIGIN","DEFAULT_BPM_API_SESSION_PATH","DEFAULT_BPM_API_SESSION_TIMEOUT_MS","readAbsoluteUrl","configured","url","readAbsoluteOrigin","resolveBPMApiSessionBaseUrl","apiBaseUrl","isSignedInMember","createBPMApiSessionAuthorize","cookie","baseUrl","options","fetchImpl","response","createWorkflowChatPOST","tools","read"],"sources":["../../src/next/workflow-chat-route.ts"],"sourcesContent":["import {\n  convertToModelMessages,\n  jsonSchema,\n  streamText,\n  tool,\n  type LanguageModel,\n  type Tool,\n  type ToolSet,\n  type UIMessage,\n} from 'ai';\nimport { openai } from '@ai-sdk/openai';\nimport { WORKFLOW_TOOLSET } from '@rytass/bpm-core-shared';\nimport { WORKFLOW_CHAT_SYSTEM_PROMPT } from '../views/templates/designer/workflow-chat-prompt';\n\n/**\n * Next.js route handler for the workflow designer LLM assistant.\n *\n * The model is advertised the workflow {@link WORKFLOW_TOOLSET} but the tools\n * carry **no `execute`** — so every tool call is forwarded to the browser,\n * where `useChat`'s `onToolCall` runs it against the React designer controller\n * (see `use-workflow-chat.ts`). This route only holds the API key, runs the\n * model, and streams the tool-call plan back. It never touches the canvas.\n *\n * Host usage (apps/client/src/app/api/chat/route.ts):\n *   export const runtime = 'nodejs';\n *   export const POST = createWorkflowChatPOST({\n *     authorize: createBPMApiSessionAuthorize(),\n *   });\n *\n * The route answers 404 unless the assistant is enabled\n * (`BPM_AI_ASSISTANT_ENABLED=true`, read per request, or `options.enabled`),\n * runs the host's optional `authorize` hook (401 when it says no), bounds the\n * request (bytes and messages) and the model output (tokens), and drops any\n * `system` message the client sent (Phase 23 P4).\n */\n\n/** Default OpenAI model id (overridable via BPM_LLM_MODEL). */\nconst DEFAULT_MODEL = 'gpt-5.4-mini';\n\n/**\n * Resolve the model via the OpenAI provider directly (reads `OPENAI_API_KEY`).\n * Accepts a bare id (`gpt-5.4-mini`) or a `openai/`-prefixed id; the prefix is\n * stripped. This deployment talks to OpenAI directly — no AI Gateway.\n */\nfunction resolveModel(setting: string): LanguageModel {\n  return openai(setting.replace(/^openai\\//u, ''));\n}\n\n/**\n * Strict guardrail: the assistant may ONLY design this approval flow, using the\n * provided tools. Lives server-side so it cannot be overridden by\n * client-supplied messages (the route drops every `system` message a client\n * sends). Shared with the offline Chrome model through `workflow-chat-prompt`.\n */\nexport { WORKFLOW_CHAT_SYSTEM_PROMPT };\n\n/** Build AI SDK tools from WORKFLOW_TOOLSET — no `execute`, so the browser runs them. */\nexport function buildWorkflowAiSdkTools(): ToolSet {\n  const entries: readonly (readonly [string, Tool])[] = WORKFLOW_TOOLSET.map(\n    (workflowTool) =>\n      [\n        workflowTool.name,\n        tool({\n          description: workflowTool.description,\n          inputSchema: jsonSchema(\n            workflowTool.inputSchema as Parameters<typeof jsonSchema>[0],\n          ),\n        }),\n      ] as const,\n  );\n\n  return Object.fromEntries(entries) as ToolSet;\n}\n\n/** Upper bound on the request body, in bytes. Tool results carry snapshots. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES = 1_048_576;\n/** Upper bound on the messages in one request. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES = 200;\n/** Upper bound on the tokens the model may write per response. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS = 4_096;\n\nexport interface WorkflowChatRouteOptions {\n  /**\n   * Whether the route serves at all. Absent: `BPM_AI_ASSISTANT_ENABLED` is\n   * read on every request and must be `'true'`. A disabled route answers 404.\n   */\n  readonly enabled?: boolean | (() => boolean);\n  /**\n   * The host's check that the caller may use the assistant (a session, a\n   * designer permission). Called before the body is read; `false` (or a\n   * throw) answers 401. Absent: no check, so put the route behind the host's\n   * own authentication.\n   */\n  readonly authorize?: (request: Request) => boolean | Promise<boolean>;\n  /** Request body ceiling in bytes (413 above it). */\n  readonly maxRequestBytes?: number;\n  /** Message count ceiling (413 above it). */\n  readonly maxMessages?: number;\n  /** Output token ceiling passed to the model. */\n  readonly maxOutputTokens?: number;\n  /** Override the OpenAI model id (else BPM_LLM_MODEL env, else the default). */\n  readonly model?: string;\n  /** Override the system prompt (else the strict design-only guardrail). */\n  readonly system?: string;\n}\n\nconst plainResponse = (status: number, text: string): Response =>\n  new Response(text, {\n    headers: { 'Content-Type': 'text/plain; charset=utf-8' },\n    status,\n  });\n\nfunction isEnabled(enabled: WorkflowChatRouteOptions['enabled']): boolean {\n  if (typeof enabled === 'function') {\n    return enabled();\n  }\n\n  return enabled ?? process.env.BPM_AI_ASSISTANT_ENABLED === 'true';\n}\n\nasync function isAuthorized(\n  request: Request,\n  authorize: WorkflowChatRouteOptions['authorize'],\n): Promise<boolean> {\n  if (!authorize) {\n    return true;\n  }\n\n  try {\n    return (await authorize(request)) === true;\n  } catch {\n    return false;\n  }\n}\n\nfunction isUIMessage(value: unknown): value is UIMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { readonly role?: unknown }).role === 'string' &&\n    Array.isArray((value as { readonly parts?: unknown }).parts)\n  );\n}\n\ntype ReadMessagesResult =\n  | { readonly messages: readonly UIMessage[]; readonly ok: true }\n  | { readonly ok: false; readonly response: Response };\n\n/**\n * The request body as text, or `null` once it grows past `maxBytes`; reading\n * stops (and the stream is cancelled) at that point.\n */\nasync function readBodyWithinLimit(\n  request: Request,\n  maxBytes: number,\n): Promise<string | null> {\n  if (request.body === null) {\n    return '';\n  }\n\n  const reader = request.body.getReader();\n  // Local to this read and appended in place: copying the list per chunk\n  // would make a body of many tiny chunks quadratic.\n  const chunks: Uint8Array[] = [];\n\n  const readWithin = async (total: number): Promise<number | null> => {\n    const { done, value } = await reader.read();\n\n    if (done) {\n      return total;\n    }\n\n    const nextTotal = total + value.byteLength;\n\n    if (nextTotal > maxBytes) {\n      await reader.cancel().catch((): void => undefined);\n\n      return null;\n    }\n\n    chunks.push(value);\n\n    return readWithin(nextTotal);\n  };\n\n  const total = await readWithin(0);\n\n  if (total === null) {\n    return null;\n  }\n\n  const bytes = new Uint8Array(total);\n\n  chunks.reduce((offset, chunk): number => {\n    bytes.set(chunk, offset);\n\n    return offset + chunk.byteLength;\n  }, 0);\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * The client's messages, bounded and without any `system` message: the\n * system prompt is the route's alone. The body is read as text first so its\n * size is checked before anything is parsed.\n */\nexport async function readWorkflowChatMessages(\n  request: Request,\n  limits: Readonly<{ maxMessages: number; maxRequestBytes: number }>,\n): Promise<ReadMessagesResult> {\n  const declaredLength = Number(request.headers.get('content-length') ?? '0');\n\n  if (declaredLength > limits.maxRequestBytes) {\n    return { ok: false, response: plainResponse(413, 'Request too large') };\n  }\n\n  // A chunked request declares no length: read it with the limit applied as\n  // it arrives, so an oversized body is cut off instead of buffered whole.\n  const text = await readBodyWithinLimit(request, limits.maxRequestBytes);\n\n  if (text === null) {\n    return { ok: false, response: plainResponse(413, 'Request too large') };\n  }\n\n  let body: unknown;\n\n  try {\n    body = JSON.parse(text);\n  } catch {\n    return { ok: false, response: plainResponse(400, 'Invalid request') };\n  }\n\n  const messages: unknown =\n    typeof body === 'object' && body !== null\n      ? (body as { readonly messages?: unknown }).messages\n      : undefined;\n\n  if (!Array.isArray(messages) || !messages.every(isUIMessage)) {\n    return { ok: false, response: plainResponse(400, 'Invalid request') };\n  }\n\n  if (messages.length > limits.maxMessages) {\n    return { ok: false, response: plainResponse(413, 'Too many messages') };\n  }\n\n  return {\n    messages: messages.filter((message) => message.role !== 'system'),\n    ok: true,\n  };\n}\n\n/** Where the BPM API listens in local development (`@rytass/bpm-core-client`). */\nconst LOCAL_BPM_API_ORIGIN = 'http://localhost:17603';\n/** The API's \"who is signed in\" endpoint (`apps/api` `GET /auth/me`). */\nexport const DEFAULT_BPM_API_SESSION_PATH = '/auth/me';\n/** How long the session check may take before the route answers 401. */\nexport const DEFAULT_BPM_API_SESSION_TIMEOUT_MS = 5_000;\n\nexport interface BPMApiSessionAuthorizeOptions {\n  /**\n   * The absolute API origin to ask, e.g. an internal service URL. Absent:\n   * read from configuration by {@link resolveBPMApiSessionBaseUrl}.\n   */\n  readonly apiBaseUrl?: string;\n  /** The fetch to use (tests, instrumented hosts). Default: global `fetch`. */\n  readonly fetch?: typeof fetch;\n  /** The session endpoint path. Default `/auth/me`. */\n  readonly sessionPath?: string;\n  /** Milliseconds before the check gives up and refuses. Default 5 000. */\n  readonly timeoutMs?: number;\n}\n\n/** An absolute http(s) URL without its trailing slash, or `null`. */\nconst readAbsoluteUrl = (value: string | undefined): string | null => {\n  const configured = value?.trim();\n\n  if (!configured) {\n    return null;\n  }\n\n  try {\n    const url = new URL(configured);\n\n    return url.protocol === 'http:' || url.protocol === 'https:'\n      ? url.toString().replace(/\\/$/u, '')\n      : null;\n  } catch {\n    return null;\n  }\n};\n\nconst readAbsoluteOrigin = (value: string | undefined): string | null => {\n  const configured = readAbsoluteUrl(value);\n\n  return configured === null ? null : new URL(configured).origin;\n};\n\n/**\n * The API origin the session check asks. It comes only from configuration,\n * never from the request: a `Host` or forwarded header the caller controls\n * must not choose the server that decides whether the caller is signed in.\n *\n * 1. `apiBaseUrl` when given;\n * 2. `BPM_API_INTERNAL_URL` (server-only, e.g. the API's in-cluster URL);\n * 3. `NEXT_PUBLIC_API_AUTH_URL` (the `/auth/*` base);\n * 4. the origin of `NEXT_PUBLIC_API_URL` (the GraphQL endpoint);\n * 5. `http://localhost:17603` outside `NODE_ENV=production`.\n *\n * Only absolute http(s) URLs count; a relative setting is ignored. `null`\n * when nothing applies, and the session check then refuses every request.\n */\nexport function resolveBPMApiSessionBaseUrl(\n  apiBaseUrl?: string,\n): string | null {\n  return (\n    readAbsoluteUrl(apiBaseUrl) ??\n    readAbsoluteUrl(process.env.BPM_API_INTERNAL_URL) ??\n    readAbsoluteUrl(process.env.NEXT_PUBLIC_API_AUTH_URL) ??\n    readAbsoluteOrigin(process.env.NEXT_PUBLIC_API_URL) ??\n    (process.env.NODE_ENV === 'production' ? null : LOCAL_BPM_API_ORIGIN)\n  );\n}\n\nconst isSignedInMember = (value: unknown): boolean =>\n  typeof value === 'object' &&\n  value !== null &&\n  typeof (value as { readonly memberId?: unknown }).memberId === 'string' &&\n  (value as { readonly memberId: string }).memberId.length > 0;\n\n/**\n * An `authorize` hook for {@link createWorkflowChatPOST} that lets in only a\n * caller the BPM API recognises as signed in: it forwards the request's\n * `Cookie` header (nothing else) to the API's session endpoint and accepts a\n * `200` whose JSON names a `memberId`. No cookie, any other status, a body\n * of another shape, a network error or a timeout refuses, so the route\n * answers 401. The session itself is never read or kept here.\n *\n * Host usage (apps/client/src/app/api/chat/route.ts):\n *   export const POST = createWorkflowChatPOST({\n *     authorize: createBPMApiSessionAuthorize(),\n *   });\n */\nexport function createBPMApiSessionAuthorize(\n  options: BPMApiSessionAuthorizeOptions = {},\n): (request: Request) => Promise<boolean> {\n  return async function authorize(request: Request): Promise<boolean> {\n    const cookie = request.headers.get('cookie');\n\n    if (!cookie) {\n      return false;\n    }\n\n    const baseUrl = resolveBPMApiSessionBaseUrl(options.apiBaseUrl);\n\n    if (baseUrl === null) {\n      return false;\n    }\n\n    const fetchImpl = options.fetch ?? fetch;\n    const url = `${baseUrl}${options.sessionPath ?? DEFAULT_BPM_API_SESSION_PATH}`;\n\n    try {\n      const response = await fetchImpl(url, {\n        cache: 'no-store',\n        headers: { Accept: 'application/json', Cookie: cookie },\n        method: 'GET',\n        redirect: 'manual',\n        signal: AbortSignal.timeout(\n          options.timeoutMs ?? DEFAULT_BPM_API_SESSION_TIMEOUT_MS,\n        ),\n      });\n\n      if (response.status !== 200) {\n        return false;\n      }\n\n      return isSignedInMember(await response.json());\n    } catch {\n      return false;\n    }\n  };\n}\n\n/** Create the `POST` handler for the workflow chat route. */\nexport function createWorkflowChatPOST(\n  options: WorkflowChatRouteOptions = {},\n): (request: Request) => Promise<Response> {\n  const tools = buildWorkflowAiSdkTools();\n\n  return async function POST(request: Request): Promise<Response> {\n    if (!isEnabled(options.enabled)) {\n      return plainResponse(404, 'Not Found');\n    }\n\n    if (!(await isAuthorized(request, options.authorize))) {\n      return plainResponse(401, 'Unauthorized');\n    }\n\n    const read = await readWorkflowChatMessages(request, {\n      maxMessages: options.maxMessages ?? DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES,\n      maxRequestBytes:\n        options.maxRequestBytes ?? DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES,\n    });\n\n    if (!read.ok) {\n      return read.response;\n    }\n\n    const result = streamText({\n      maxOutputTokens:\n        options.maxOutputTokens ?? DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS,\n      messages: await convertToModelMessages([...read.messages]),\n      model: resolveModel(\n        options.model ?? process.env.BPM_LLM_MODEL ?? DEFAULT_MODEL,\n      ),\n      system: options.system ?? WORKFLOW_CHAT_SYSTEM_PROMPT,\n      tools,\n    });\n\n    return result.toUIMessageStreamResponse();\n  };\n}\n"],"mappings":"A,uNAqCA,IAAMU,EAAgB,eAOtB,SAASC,EAAa,EAAgC,CACpD,OAAA,EAAOX,EAAAA,OAAAA,CAAOY,EAAQ,QAAQ,aAAc,EAAE,CAAC,CACjD,CAWA,SAAgBC,GAAmC,CACjD,IAAMC,EAAgDb,EAAAA,iBAAiB,IACpE,GACC,CACEc,EAAa,MAAA,EACbb,EAAAA,KAAAA,CAAK,CACH,YAAaa,EAAa,YAC1B,aAAA,EAAaZ,EAAAA,WAAAA,CACXY,EAAa,WACf,CACF,CAAC,CACH,CACJ,EAEA,OAAO,OAAO,YAAYD,CAAO,CACnC,CAGA,IAAaE,EAA0C,QAE1CC,EAAqC,IAErCC,EAA0C,KA2BjDC,GAAiB,EAAgB,IACrC,IAAI,SAASC,EAAM,CACjB,QAAS,CAAE,eAAgB,2BAA4B,EACvD,QACF,CAAC,EAEH,SAASC,EAAU,EAAuD,CAKxE,OAJI,OAAOC,GAAY,WACdA,EAAQ,EAGVA,GAAW,QAAQ,IAAI,2BAA6B,MAC7D,CAEA,eAAeC,EACb,EACA,EACkB,CAClB,GAAI,CAACC,EACH,MAAO,GAGT,GAAI,CACF,OAAQ,MAAMA,EAAUC,CAAO,IAAO,EACxC,MAAQ,CACN,MAAO,EACT,CACF,CAEA,SAASC,EAAY,EAAoC,CACvD,OACE,OAAOC,GAAU,YACjBA,GACA,OAAQA,EAAsC,MAAS,UACvD,MAAM,QAASA,EAAuC,KAAK,CAE/D,CAUA,eAAeC,EACb,EACA,EACwB,CACxB,GAAIH,EAAQ,OAAS,KACnB,MAAO,GAGT,IAAMI,EAASJ,EAAQ,KAAK,UAAU,EAGhCK,EAAuB,CAAC,EAExBC,EAAa,KAAO,IAA0C,CAClE,GAAM,CAAE,OAAM,SAAU,MAAMF,EAAO,KAAK,EAE1C,GAAIG,EACF,OAAOC,EAGT,IAAMC,EAAYD,EAAQN,EAAM,WAUhC,OARIO,EAAYC,GACd,MAAMN,EAAO,OAAO,CAAC,CAAC,UAAkB,IAAA,EAAS,EAE1C,OAGTC,EAAO,KAAKH,CAAK,EAEVI,EAAWG,CAAS,EAC7B,EAEMD,EAAQ,MAAMF,EAAW,CAAC,EAEhC,GAAIE,IAAU,KACZ,OAAO,KAGT,IAAMG,EAAQ,IAAI,WAAWH,CAAK,EAQlC,OANAH,EAAO,QAAQ,EAAQ,KACrBM,EAAM,IAAIC,EAAOC,CAAM,EAEhBA,EAASD,EAAM,YACrB,CAAC,EAEG,IAAI,YAAY,CAAC,CAAC,OAAOD,CAAK,CACvC,CAOA,eAAsBG,EACpB,EACA,EAC6B,CAG7B,GAFuB,OAAOd,EAAQ,QAAQ,IAAI,gBAAgB,GAAK,GAEnE,EAAiBe,EAAO,gBAC1B,MAAO,CAAE,GAAI,GAAO,SAAUrB,EAAc,IAAK,mBAAmB,CAAE,EAKxE,IAAMC,EAAO,MAAMQ,EAAoBH,EAASe,EAAO,eAAe,EAEtE,GAAIpB,IAAS,KACX,MAAO,CAAE,GAAI,GAAO,SAAUD,EAAc,IAAK,mBAAmB,CAAE,EAGxE,IAAIsB,EAEJ,GAAI,CACF,EAAO,KAAK,MAAMrB,CAAI,CACxB,MAAQ,CACN,MAAO,CAAE,GAAI,GAAO,SAAUD,EAAc,IAAK,iBAAiB,CAAE,CACtE,CAEA,IAAMuB,EACJ,OAAOD,GAAS,UAAYA,EACvBA,EAAyC,SAC1C,IAAA,GAUN,MARI,CAAC,MAAM,QAAQC,CAAQ,GAAK,CAACA,EAAS,MAAMhB,CAAW,EAClD,CAAE,GAAI,GAAO,SAAUP,EAAc,IAAK,iBAAiB,CAAE,EAGlEuB,EAAS,OAASF,EAAO,YACpB,CAAE,GAAI,GAAO,SAAUrB,EAAc,IAAK,mBAAmB,CAAE,EAGjE,CACL,SAAUuB,EAAS,OAAQ,GAAYC,EAAQ,OAAS,QAAQ,EAChE,GAAI,EACN,CACF,CAGA,IAAMC,EAAuB,yBAEhBC,EAA+B,WAE/BC,EAAqC,IAiB5CC,EAAmB,GAA6C,CACpE,IAAMC,EAAarB,GAAO,KAAK,EAE/B,GAAI,CAACqB,EACH,OAAO,KAGT,GAAI,CACF,IAAMC,EAAM,IAAI,IAAID,CAAU,EAE9B,OAAOC,EAAI,WAAa,SAAWA,EAAI,WAAa,SAChDA,EAAI,SAAS,CAAC,CAAC,QAAQ,OAAQ,EAAE,EACjC,IACN,MAAQ,CACN,OAAO,IACT,CACF,EAEMC,EAAsB,GAA6C,CACvE,IAAMF,EAAaD,EAAgBpB,CAAK,EAExC,OAAOqB,IAAe,KAAO,KAAO,IAAI,IAAIA,CAAU,CAAC,CAAC,MAC1D,EAgBA,SAAgBG,EACd,EACe,CACf,OACEJ,EAAgBK,CAAU,GAC1BL,EAAgB,QAAQ,IAAI,oBAAoB,GAChDA,EAAgB,QAAQ,IAAI,wBAAwB,GACpDG,EAAmB,QAAQ,IAAI,mBAAmB,IAAA,QAAA,IAAA,WACxB,aAAe,KAAON,EAEpD,CAEA,IAAMS,EAAoB,GACxB,OAAO1B,GAAU,YACjBA,GACA,OAAQA,EAA0C,UAAa,UAC9DA,EAAwC,SAAS,OAAS,EAe7D,SAAgB2B,EACd,EAAyC,CAAC,EACF,CACxC,OAAO,eAAyB,EAAoC,CAClE,IAAMC,EAAS9B,EAAQ,QAAQ,IAAI,QAAQ,EAE3C,GAAI,CAAC8B,EACH,MAAO,GAGT,IAAMC,EAAUL,EAA4BM,EAAQ,UAAU,EAE9D,GAAID,IAAY,KACd,MAAO,GAGT,IAAME,EAAYD,EAAQ,OAAS,MAC7BR,EAAM,GAAGO,IAAUC,EAAQ,aAAA,aAEjC,GAAI,CACF,IAAME,EAAW,MAAMD,EAAUT,EAAK,CACpC,MAAO,WACP,QAAS,CAAE,OAAQ,mBAAoB,OAAQM,CAAO,EACtD,OAAQ,MACR,SAAU,SACV,OAAQ,YAAY,QAClBE,EAAQ,WAAA,GACV,CACF,CAAC,EAMD,OAJIE,EAAS,SAAW,KAIjBN,EAAiB,MAAMM,EAAS,KAAK,CAAC,CAC/C,MAAQ,CACN,MAAO,EACT,CACF,CACF,CAGA,SAAgBC,EACd,EAAoC,CAAC,EACI,CACzC,IAAMC,EAAQhD,EAAwB,EAEtC,OAAO,eAAoB,EAAqC,CAC9D,GAAI,CAACQ,EAAUoC,EAAQ,OAAO,EAC5B,OAAOtC,EAAc,IAAK,WAAW,EAGvC,GAAI,CAAE,MAAMI,EAAaE,EAASgC,EAAQ,SAAS,EACjD,OAAOtC,EAAc,IAAK,cAAc,EAG1C,IAAM2C,EAAO,MAAMvB,EAAyBd,EAAS,CACnD,YAAagC,EAAQ,aAAA,IACrB,gBACEA,EAAQ,iBAAA,OACZ,CAAC,EAiBD,OAfKK,EAAK,IAeV,EAXe1D,EAAAA,WAAAA,CAAW,CACxB,gBACEqD,EAAQ,iBAAA,KACV,SAAU,MAAA,EAAMpD,EAAAA,uBAAAA,CAAuB,CAAC,GAAGyD,EAAK,QAAQ,CAAC,EACzD,MAAOnD,EACL8C,EAAQ,OAAS,QAAQ,IAAI,eAAiB/C,CAChD,EACA,OAAQ+C,EAAQ,QAAA;;;;;;;;;;;;;;;;;;;;;;;;;2BAChB,OACF,CAEO,CAAA,CAAO,0BAA0B,EAd/BK,EAAK,QAehB,CACF,C"}
+{"version":3,"file":"workflow-chat-route.cjs","names":["openai","WORKFLOW_TOOLSET","tool","jsonSchema","streamText","convertToModelMessages","require_workflow_chat_prompt","_rytass_bpm_core_shared","ai","_ai_sdk_openai","DEFAULT_MODEL","resolveModel","setting","buildWorkflowAiSdkTools","entries","workflowTool","DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES","DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES","DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS","plainResponse","text","isEnabled","enabled","isAuthorized","authorize","request","isUIMessage","value","readBodyWithinLimit","reader","chunks","readWithin","done","total","nextTotal","maxBytes","bytes","chunk","offset","readWorkflowChatMessages","limits","body","messages","message","LOCAL_BPM_API_ORIGIN","DEFAULT_BPM_API_SESSION_PATH","DEFAULT_BPM_API_SESSION_TIMEOUT_MS","readAbsoluteUrl","configured","url","readAbsoluteOrigin","resolveBPMApiSessionBaseUrl","apiBaseUrl","isSignedInMember","createBPMApiSessionAuthorize","cookie","baseUrl","options","fetchImpl","response","createWorkflowChatPOST","tools","read"],"sources":["../../src/next/workflow-chat-route.ts"],"sourcesContent":["import {\n  convertToModelMessages,\n  jsonSchema,\n  streamText,\n  tool,\n  type LanguageModel,\n  type Tool,\n  type ToolSet,\n  type UIMessage,\n} from 'ai';\nimport { openai } from '@ai-sdk/openai';\nimport { WORKFLOW_TOOLSET } from '@rytass/bpm-core-shared';\nimport { WORKFLOW_CHAT_SYSTEM_PROMPT } from '../views/templates/designer/workflow-chat-prompt';\n\n/**\n * Next.js route handler for the workflow designer LLM assistant.\n *\n * The model is advertised the workflow {@link WORKFLOW_TOOLSET} but the tools\n * carry **no `execute`** — so every tool call is forwarded to the browser,\n * where `useChat`'s `onToolCall` runs it against the React designer controller\n * (see `use-workflow-chat.ts`). This route only holds the API key, runs the\n * model, and streams the tool-call plan back. It never touches the canvas.\n *\n * Host usage (apps/client/src/app/api/chat/route.ts):\n *   export const runtime = 'nodejs';\n *   export const POST = createWorkflowChatPOST({\n *     authorize: createBPMApiSessionAuthorize(),\n *   });\n *\n * The route answers 404 unless the assistant is enabled\n * (`BPM_AI_ASSISTANT_ENABLED=true`, read per request, or `options.enabled`),\n * runs the host's optional `authorize` hook (401 when it says no), bounds the\n * request (bytes and messages) and the model output (tokens), and drops any\n * `system` message the client sent (Phase 23 P4).\n */\n\n/** Default OpenAI model id (overridable via BPM_LLM_MODEL). */\nconst DEFAULT_MODEL = 'gpt-5.4-mini';\n\n/**\n * Resolve the model via the OpenAI provider directly (reads `OPENAI_API_KEY`).\n * Accepts a bare id (`gpt-5.4-mini`) or a `openai/`-prefixed id; the prefix is\n * stripped. This deployment talks to OpenAI directly — no AI Gateway.\n */\nfunction resolveModel(setting: string): LanguageModel {\n  return openai(setting.replace(/^openai\\//u, ''));\n}\n\n/**\n * Strict guardrail: the assistant may ONLY design this approval flow, using the\n * provided tools. Lives server-side so it cannot be overridden by\n * client-supplied messages (the route drops every `system` message a client\n * sends). Shared with the offline Chrome model through `workflow-chat-prompt`.\n */\nexport { WORKFLOW_CHAT_SYSTEM_PROMPT };\n\n/** Build AI SDK tools from WORKFLOW_TOOLSET — no `execute`, so the browser runs them. */\nexport function buildWorkflowAiSdkTools(): ToolSet {\n  const entries: readonly (readonly [string, Tool])[] = WORKFLOW_TOOLSET.map(\n    (workflowTool) =>\n      [\n        workflowTool.name,\n        tool({\n          description: workflowTool.description,\n          inputSchema: jsonSchema(\n            workflowTool.inputSchema as Parameters<typeof jsonSchema>[0],\n          ),\n        }),\n      ] as const,\n  );\n\n  return Object.fromEntries(entries) as ToolSet;\n}\n\n/** Upper bound on the request body, in bytes. Tool results carry snapshots. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES = 1_048_576;\n/** Upper bound on the messages in one request. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES = 200;\n/** Upper bound on the tokens the model may write per response. */\nexport const DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS = 4_096;\n\nexport interface WorkflowChatRouteOptions {\n  /**\n   * Whether the route serves at all. Absent: `BPM_AI_ASSISTANT_ENABLED` is\n   * read on every request and must be `'true'`. A disabled route answers 404.\n   */\n  readonly enabled?: boolean | (() => boolean);\n  /**\n   * The host's check that the caller may use the assistant (a session, a\n   * designer permission). Called before the body is read; `false` (or a\n   * throw) answers 401. Absent: no check, so put the route behind the host's\n   * own authentication.\n   */\n  readonly authorize?: (request: Request) => boolean | Promise<boolean>;\n  /** Request body ceiling in bytes (413 above it). */\n  readonly maxRequestBytes?: number;\n  /** Message count ceiling (413 above it). */\n  readonly maxMessages?: number;\n  /** Output token ceiling passed to the model. */\n  readonly maxOutputTokens?: number;\n  /** Override the OpenAI model id (else BPM_LLM_MODEL env, else the default). */\n  readonly model?: string;\n  /** Override the system prompt (else the strict design-only guardrail). */\n  readonly system?: string;\n}\n\nconst plainResponse = (status: number, text: string): Response =>\n  new Response(text, {\n    headers: { 'Content-Type': 'text/plain; charset=utf-8' },\n    status,\n  });\n\nfunction isEnabled(enabled: WorkflowChatRouteOptions['enabled']): boolean {\n  if (typeof enabled === 'function') {\n    return enabled();\n  }\n\n  return enabled ?? process.env.BPM_AI_ASSISTANT_ENABLED === 'true';\n}\n\nasync function isAuthorized(\n  request: Request,\n  authorize: WorkflowChatRouteOptions['authorize'],\n): Promise<boolean> {\n  if (!authorize) {\n    return true;\n  }\n\n  try {\n    return (await authorize(request)) === true;\n  } catch {\n    return false;\n  }\n}\n\nfunction isUIMessage(value: unknown): value is UIMessage {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { readonly role?: unknown }).role === 'string' &&\n    Array.isArray((value as { readonly parts?: unknown }).parts)\n  );\n}\n\ntype ReadMessagesResult =\n  | { readonly messages: readonly UIMessage[]; readonly ok: true }\n  | { readonly ok: false; readonly response: Response };\n\n/**\n * The request body as text, or `null` once it grows past `maxBytes`; reading\n * stops (and the stream is cancelled) at that point.\n */\nasync function readBodyWithinLimit(\n  request: Request,\n  maxBytes: number,\n): Promise<string | null> {\n  if (request.body === null) {\n    return '';\n  }\n\n  const reader = request.body.getReader();\n  // Local to this read and appended in place: copying the list per chunk\n  // would make a body of many tiny chunks quadratic.\n  const chunks: Uint8Array[] = [];\n\n  const readWithin = async (total: number): Promise<number | null> => {\n    const { done, value } = await reader.read();\n\n    if (done) {\n      return total;\n    }\n\n    const nextTotal = total + value.byteLength;\n\n    if (nextTotal > maxBytes) {\n      await reader.cancel().catch((): void => undefined);\n\n      return null;\n    }\n\n    chunks.push(value);\n\n    return readWithin(nextTotal);\n  };\n\n  const total = await readWithin(0);\n\n  if (total === null) {\n    return null;\n  }\n\n  const bytes = new Uint8Array(total);\n\n  chunks.reduce((offset, chunk): number => {\n    bytes.set(chunk, offset);\n\n    return offset + chunk.byteLength;\n  }, 0);\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * The client's messages, bounded and without any `system` message: the\n * system prompt is the route's alone. The body is read as text first so its\n * size is checked before anything is parsed.\n */\nexport async function readWorkflowChatMessages(\n  request: Request,\n  limits: Readonly<{ maxMessages: number; maxRequestBytes: number }>,\n): Promise<ReadMessagesResult> {\n  const declaredLength = Number(request.headers.get('content-length') ?? '0');\n\n  if (declaredLength > limits.maxRequestBytes) {\n    return { ok: false, response: plainResponse(413, 'Request too large') };\n  }\n\n  // A chunked request declares no length: read it with the limit applied as\n  // it arrives, so an oversized body is cut off instead of buffered whole.\n  const text = await readBodyWithinLimit(request, limits.maxRequestBytes);\n\n  if (text === null) {\n    return { ok: false, response: plainResponse(413, 'Request too large') };\n  }\n\n  let body: unknown;\n\n  try {\n    body = JSON.parse(text);\n  } catch {\n    return { ok: false, response: plainResponse(400, 'Invalid request') };\n  }\n\n  const messages: unknown =\n    typeof body === 'object' && body !== null\n      ? (body as { readonly messages?: unknown }).messages\n      : undefined;\n\n  if (!Array.isArray(messages) || !messages.every(isUIMessage)) {\n    return { ok: false, response: plainResponse(400, 'Invalid request') };\n  }\n\n  if (messages.length > limits.maxMessages) {\n    return { ok: false, response: plainResponse(413, 'Too many messages') };\n  }\n\n  return {\n    messages: messages.filter((message) => message.role !== 'system'),\n    ok: true,\n  };\n}\n\n/** Where the BPM API listens in local development (`@rytass/bpm-core-client`). */\nconst LOCAL_BPM_API_ORIGIN = 'http://localhost:17603';\n/** The API's \"who is signed in\" endpoint (`apps/api` `GET /auth/me`). */\nexport const DEFAULT_BPM_API_SESSION_PATH = '/auth/me';\n/** How long the session check may take before the route answers 401. */\nexport const DEFAULT_BPM_API_SESSION_TIMEOUT_MS = 5_000;\n\nexport interface BPMApiSessionAuthorizeOptions {\n  /**\n   * The absolute API origin to ask, e.g. an internal service URL. Absent:\n   * read from configuration by {@link resolveBPMApiSessionBaseUrl}.\n   */\n  readonly apiBaseUrl?: string;\n  /** The fetch to use (tests, instrumented hosts). Default: global `fetch`. */\n  readonly fetch?: typeof fetch;\n  /** The session endpoint path. Default `/auth/me`. */\n  readonly sessionPath?: string;\n  /** Milliseconds before the check gives up and refuses. Default 5 000. */\n  readonly timeoutMs?: number;\n}\n\n/** An absolute http(s) URL without its trailing slash, or `null`. */\nconst readAbsoluteUrl = (value: string | undefined): string | null => {\n  const configured = value?.trim();\n\n  if (!configured) {\n    return null;\n  }\n\n  try {\n    const url = new URL(configured);\n\n    return url.protocol === 'http:' || url.protocol === 'https:'\n      ? url.toString().replace(/\\/$/u, '')\n      : null;\n  } catch {\n    return null;\n  }\n};\n\nconst readAbsoluteOrigin = (value: string | undefined): string | null => {\n  const configured = readAbsoluteUrl(value);\n\n  return configured === null ? null : new URL(configured).origin;\n};\n\n/**\n * The API origin the session check asks. It comes only from configuration,\n * never from the request: a `Host` or forwarded header the caller controls\n * must not choose the server that decides whether the caller is signed in.\n *\n * 1. `apiBaseUrl` when given;\n * 2. `BPM_API_INTERNAL_URL` (server-only, e.g. the API's in-cluster URL);\n * 3. `NEXT_PUBLIC_API_AUTH_URL` (the `/auth/*` base);\n * 4. the origin of `NEXT_PUBLIC_API_URL` (the GraphQL endpoint);\n * 5. `http://localhost:17603` outside `NODE_ENV=production`.\n *\n * Only absolute http(s) URLs count; a relative setting is ignored. `null`\n * when nothing applies, and the session check then refuses every request.\n */\nexport function resolveBPMApiSessionBaseUrl(\n  apiBaseUrl?: string,\n): string | null {\n  return (\n    readAbsoluteUrl(apiBaseUrl) ??\n    readAbsoluteUrl(process.env.BPM_API_INTERNAL_URL) ??\n    readAbsoluteUrl(process.env.NEXT_PUBLIC_API_AUTH_URL) ??\n    readAbsoluteOrigin(process.env.NEXT_PUBLIC_API_URL) ??\n    (process.env.NODE_ENV === 'production' ? null : LOCAL_BPM_API_ORIGIN)\n  );\n}\n\nconst isSignedInMember = (value: unknown): boolean =>\n  typeof value === 'object' &&\n  value !== null &&\n  typeof (value as { readonly memberId?: unknown }).memberId === 'string' &&\n  (value as { readonly memberId: string }).memberId.length > 0;\n\n/**\n * An `authorize` hook for {@link createWorkflowChatPOST} that lets in only a\n * caller the BPM API recognises as signed in: it forwards the request's\n * `Cookie` header (nothing else) to the API's session endpoint and accepts a\n * `200` whose JSON names a `memberId`. No cookie, any other status, a body\n * of another shape, a network error or a timeout refuses, so the route\n * answers 401. The session itself is never read or kept here.\n *\n * Host usage (apps/client/src/app/api/chat/route.ts):\n *   export const POST = createWorkflowChatPOST({\n *     authorize: createBPMApiSessionAuthorize(),\n *   });\n */\nexport function createBPMApiSessionAuthorize(\n  options: BPMApiSessionAuthorizeOptions = {},\n): (request: Request) => Promise<boolean> {\n  return async function authorize(request: Request): Promise<boolean> {\n    const cookie = request.headers.get('cookie');\n\n    if (!cookie) {\n      return false;\n    }\n\n    const baseUrl = resolveBPMApiSessionBaseUrl(options.apiBaseUrl);\n\n    if (baseUrl === null) {\n      return false;\n    }\n\n    const fetchImpl = options.fetch ?? fetch;\n    const url = `${baseUrl}${options.sessionPath ?? DEFAULT_BPM_API_SESSION_PATH}`;\n\n    try {\n      const response = await fetchImpl(url, {\n        cache: 'no-store',\n        headers: { Accept: 'application/json', Cookie: cookie },\n        method: 'GET',\n        redirect: 'manual',\n        signal: AbortSignal.timeout(\n          options.timeoutMs ?? DEFAULT_BPM_API_SESSION_TIMEOUT_MS,\n        ),\n      });\n\n      if (response.status !== 200) {\n        return false;\n      }\n\n      return isSignedInMember(await response.json());\n    } catch {\n      return false;\n    }\n  };\n}\n\n/** Create the `POST` handler for the workflow chat route. */\nexport function createWorkflowChatPOST(\n  options: WorkflowChatRouteOptions = {},\n): (request: Request) => Promise<Response> {\n  const tools = buildWorkflowAiSdkTools();\n\n  return async function POST(request: Request): Promise<Response> {\n    if (!isEnabled(options.enabled)) {\n      return plainResponse(404, 'Not Found');\n    }\n\n    if (!(await isAuthorized(request, options.authorize))) {\n      return plainResponse(401, 'Unauthorized');\n    }\n\n    const read = await readWorkflowChatMessages(request, {\n      maxMessages: options.maxMessages ?? DEFAULT_WORKFLOW_CHAT_MAX_MESSAGES,\n      maxRequestBytes:\n        options.maxRequestBytes ?? DEFAULT_WORKFLOW_CHAT_MAX_REQUEST_BYTES,\n    });\n\n    if (!read.ok) {\n      return read.response;\n    }\n\n    const result = streamText({\n      maxOutputTokens:\n        options.maxOutputTokens ?? DEFAULT_WORKFLOW_CHAT_MAX_OUTPUT_TOKENS,\n      messages: await convertToModelMessages([...read.messages]),\n      model: resolveModel(\n        options.model ?? process.env.BPM_LLM_MODEL ?? DEFAULT_MODEL,\n      ),\n      system: options.system ?? WORKFLOW_CHAT_SYSTEM_PROMPT,\n      tools,\n    });\n\n    return result.toUIMessageStreamResponse();\n  };\n}\n"],"mappings":"A,uNAqCA,IAAMU,EAAgB,eAOtB,SAASC,EAAa,EAAgC,CACpD,OAAA,EAAOX,EAAAA,OAAAA,CAAOY,EAAQ,QAAQ,aAAc,EAAE,CAAC,CACjD,CAWA,SAAgBC,GAAmC,CACjD,IAAMC,EAAgDb,EAAAA,iBAAiB,IACpE,GACC,CACEc,EAAa,MAAA,EACbb,EAAAA,KAAAA,CAAK,CACH,YAAaa,EAAa,YAC1B,aAAA,EAAaZ,EAAAA,WAAAA,CACXY,EAAa,WACf,CACF,CAAC,CACH,CACJ,EAEA,OAAO,OAAO,YAAYD,CAAO,CACnC,CAGA,IAAaE,EAA0C,QAE1CC,EAAqC,IAErCC,EAA0C,KA2BjDC,GAAiB,EAAgB,IACrC,IAAI,SAASC,EAAM,CACjB,QAAS,CAAE,eAAgB,2BAA4B,EACvD,QACF,CAAC,EAEH,SAASC,EAAU,EAAuD,CAKxE,OAJI,OAAOC,GAAY,WACdA,EAAQ,EAGVA,GAAW,QAAQ,IAAI,2BAA6B,MAC7D,CAEA,eAAeC,EACb,EACA,EACkB,CAClB,GAAI,CAACC,EACH,MAAO,GAGT,GAAI,CACF,OAAQ,MAAMA,EAAUC,CAAO,IAAO,EACxC,MAAQ,CACN,MAAO,EACT,CACF,CAEA,SAASC,EAAY,EAAoC,CACvD,OACE,OAAOC,GAAU,YACjBA,GACA,OAAQA,EAAsC,MAAS,UACvD,MAAM,QAASA,EAAuC,KAAK,CAE/D,CAUA,eAAeC,EACb,EACA,EACwB,CACxB,GAAIH,EAAQ,OAAS,KACnB,MAAO,GAGT,IAAMI,EAASJ,EAAQ,KAAK,UAAU,EAGhCK,EAAuB,CAAC,EAExBC,EAAa,KAAO,IAA0C,CAClE,GAAM,CAAE,OAAM,SAAU,MAAMF,EAAO,KAAK,EAE1C,GAAIG,EACF,OAAOC,EAGT,IAAMC,EAAYD,EAAQN,EAAM,WAUhC,OARIO,EAAYC,GACd,MAAMN,EAAO,OAAO,CAAC,CAAC,UAAkB,IAAA,EAAS,EAE1C,OAGTC,EAAO,KAAKH,CAAK,EAEVI,EAAWG,CAAS,EAC7B,EAEMD,EAAQ,MAAMF,EAAW,CAAC,EAEhC,GAAIE,IAAU,KACZ,OAAO,KAGT,IAAMG,EAAQ,IAAI,WAAWH,CAAK,EAQlC,OANAH,EAAO,QAAQ,EAAQ,KACrBM,EAAM,IAAIC,EAAOC,CAAM,EAEhBA,EAASD,EAAM,YACrB,CAAC,EAEG,IAAI,YAAY,CAAC,CAAC,OAAOD,CAAK,CACvC,CAOA,eAAsBG,EACpB,EACA,EAC6B,CAG7B,GAFuB,OAAOd,EAAQ,QAAQ,IAAI,gBAAgB,GAAK,GAEnE,EAAiBe,EAAO,gBAC1B,MAAO,CAAE,GAAI,GAAO,SAAUrB,EAAc,IAAK,mBAAmB,CAAE,EAKxE,IAAMC,EAAO,MAAMQ,EAAoBH,EAASe,EAAO,eAAe,EAEtE,GAAIpB,IAAS,KACX,MAAO,CAAE,GAAI,GAAO,SAAUD,EAAc,IAAK,mBAAmB,CAAE,EAGxE,IAAIsB,EAEJ,GAAI,CACF,EAAO,KAAK,MAAMrB,CAAI,CACxB,MAAQ,CACN,MAAO,CAAE,GAAI,GAAO,SAAUD,EAAc,IAAK,iBAAiB,CAAE,CACtE,CAEA,IAAMuB,EACJ,OAAOD,GAAS,UAAYA,EACvBA,EAAyC,SAC1C,IAAA,GAUN,MARI,CAAC,MAAM,QAAQC,CAAQ,GAAK,CAACA,EAAS,MAAMhB,CAAW,EAClD,CAAE,GAAI,GAAO,SAAUP,EAAc,IAAK,iBAAiB,CAAE,EAGlEuB,EAAS,OAASF,EAAO,YACpB,CAAE,GAAI,GAAO,SAAUrB,EAAc,IAAK,mBAAmB,CAAE,EAGjE,CACL,SAAUuB,EAAS,OAAQ,GAAYC,EAAQ,OAAS,QAAQ,EAChE,GAAI,EACN,CACF,CAGA,IAAMC,EAAuB,yBAEhBC,EAA+B,WAE/BC,EAAqC,IAiB5CC,EAAmB,GAA6C,CACpE,IAAMC,EAAarB,GAAO,KAAK,EAE/B,GAAI,CAACqB,EACH,OAAO,KAGT,GAAI,CACF,IAAMC,EAAM,IAAI,IAAID,CAAU,EAE9B,OAAOC,EAAI,WAAa,SAAWA,EAAI,WAAa,SAChDA,EAAI,SAAS,CAAC,CAAC,QAAQ,OAAQ,EAAE,EACjC,IACN,MAAQ,CACN,OAAO,IACT,CACF,EAEMC,EAAsB,GAA6C,CACvE,IAAMF,EAAaD,EAAgBpB,CAAK,EAExC,OAAOqB,IAAe,KAAO,KAAO,IAAI,IAAIA,CAAU,CAAC,CAAC,MAC1D,EAgBA,SAAgBG,EACd,EACe,CACf,OACEJ,EAAgBK,CAAU,GAC1BL,EAAgB,QAAQ,IAAI,oBAAoB,GAChDA,EAAgB,QAAQ,IAAI,wBAAwB,GACpDG,EAAmB,QAAQ,IAAI,mBAAmB,IAAA,QAAA,IAAA,WACxB,aAAe,KAAON,EAEpD,CAEA,IAAMS,EAAoB,GACxB,OAAO1B,GAAU,YACjBA,GACA,OAAQA,EAA0C,UAAa,UAC9DA,EAAwC,SAAS,OAAS,EAe7D,SAAgB2B,EACd,EAAyC,CAAC,EACF,CACxC,OAAO,eAAyB,EAAoC,CAClE,IAAMC,EAAS9B,EAAQ,QAAQ,IAAI,QAAQ,EAE3C,GAAI,CAAC8B,EACH,MAAO,GAGT,IAAMC,EAAUL,EAA4BM,EAAQ,UAAU,EAE9D,GAAID,IAAY,KACd,MAAO,GAGT,IAAME,EAAYD,EAAQ,OAAS,MAC7BR,EAAM,GAAGO,IAAUC,EAAQ,aAAA,aAEjC,GAAI,CACF,IAAME,EAAW,MAAMD,EAAUT,EAAK,CACpC,MAAO,WACP,QAAS,CAAE,OAAQ,mBAAoB,OAAQM,CAAO,EACtD,OAAQ,MACR,SAAU,SACV,OAAQ,YAAY,QAClBE,EAAQ,WAAA,GACV,CACF,CAAC,EAMD,OAJIE,EAAS,SAAW,KAIjBN,EAAiB,MAAMM,EAAS,KAAK,CAAC,CAC/C,MAAQ,CACN,MAAO,EACT,CACF,CACF,CAGA,SAAgBC,EACd,EAAoC,CAAC,EACI,CACzC,IAAMC,EAAQhD,EAAwB,EAEtC,OAAO,eAAoB,EAAqC,CAC9D,GAAI,CAACQ,EAAUoC,EAAQ,OAAO,EAC5B,OAAOtC,EAAc,IAAK,WAAW,EAGvC,GAAI,CAAE,MAAMI,EAAaE,EAASgC,EAAQ,SAAS,EACjD,OAAOtC,EAAc,IAAK,cAAc,EAG1C,IAAM2C,EAAO,MAAMvB,EAAyBd,EAAS,CACnD,YAAagC,EAAQ,aAAA,IACrB,gBACEA,EAAQ,iBAAA,OACZ,CAAC,EAiBD,OAfKK,EAAK,IAeV,EAXe1D,EAAAA,WAAAA,CAAW,CACxB,gBACEqD,EAAQ,iBAAA,KACV,SAAU,MAAA,EAAMpD,EAAAA,uBAAAA,CAAuB,CAAC,GAAGyD,EAAK,QAAQ,CAAC,EACzD,MAAOnD,EACL8C,EAAQ,OAAS,QAAQ,IAAI,eAAiB/C,CAChD,EACA,OAAQ+C,EAAQ,QAAA;;;;;;;;;;;;;;;;;;;;;;;;;2BAChB,OACF,CAEO,CAAA,CAAO,0BAA0B,EAd/BK,EAAK,QAehB,CACF,C"}

package/dist/next/workflow-chat-route.js

@@ -1,16 +1,16 @@
 import { n as e } from "../chunks/workflow-chat-prompt-B4wCFKPB.js";
-import { convertToModelMessages as t, jsonSchema as n, streamText as r, tool as i } from "ai";
-import { openai as a } from "@ai-sdk/openai";
-import { WORKFLOW_TOOLSET as o } from "@rytass/bpm-core-shared";
+import { WORKFLOW_TOOLSET as t } from "@rytass/bpm-core-shared";
+import { convertToModelMessages as n, jsonSchema as r, streamText as i, tool as a } from "ai";
+import { openai as o } from "@ai-sdk/openai";
 // src/next/workflow-chat-route.ts
 var s = "gpt-5.4-mini";
 function c(e) {
-	return a(e.replace(/^openai\//u, ""));
+	return o(e.replace(/^openai\//u, ""));
 }
 function l() {
-	let e = o.map((e) => [e.name, i({
+	let e = t.map((e) => [e.name, a({
 		description: e.description,
-		inputSchema: n(e.inputSchema)
+		inputSchema: r(e.inputSchema)
 	})]);
 	return Object.fromEntries(e);
 }
@@ -117,20 +117,20 @@ function E(e = {}) {
 	};
 }
 function D(e = {}) {
-	let n = l();
-	return async function(i) {
+	let t = l();
+	return async function(r) {
 		if (!m(e.enabled)) return p(404, "Not Found");
-		if (!await h(i, e.authorize)) return p(401, "Unauthorized");
-		let a = await v(i, {
+		if (!await h(r, e.authorize)) return p(401, "Unauthorized");
+		let a = await v(r, {
 			maxMessages: e.maxMessages ?? 200,
 			maxRequestBytes: e.maxRequestBytes ?? 1048576
 		});
-		return a.ok ? r({
+		return a.ok ? i({
 			maxOutputTokens: e.maxOutputTokens ?? 4096,
-			messages: await t([...a.messages]),
+			messages: await n([...a.messages]),
 			model: c(e.model ?? process.env.BPM_LLM_MODEL ?? s),
 			system: e.system ?? "你是「簽核流程設計器」頁面內建的 AI 助理，唯一職責是協助使用者在這個畫布上設計／修改一個簽核審批流程（workflow）。\n\n你只能透過系統提供的工具（tools）來操作流程：新增/重命名/刪除節點、連線、設定簽核人、設定條件分流、設定系統節點動作、自動排版、查詢現況與驗證等。除了這些工具，你沒有其他能力。\n\n工作守則：\n1. 動作前，先呼叫 get_workflow_snapshot 了解目前畫布的節點與連線，再規劃要呼叫哪些工具。\n2. 盡量用高階工具（insert_approval_step / insert_notification / insert_conditional_branch）一次完成多步；需要細修時再用細顆粒工具。\n3. **重要：要果斷、先把流程畫出來。** 使用者只給一兩句話時，直接依常見公司慣例建立初稿，不要反覆追問細節。簽核人若使用者沒指定，就省略 approverResolver（系統會自動用「直屬主管」為預設，不需要真實會員 id）；通知節點同理可省略 action（預設站內通知）。先把結構建好、再請使用者調整。\n4. 工具呼叫不會因為「缺簽核人/缺資料」而失敗；缺的部分會以合理預設補上，並由 validate_workflow 標示。所以放心連續呼叫工具把流程建完，不要因為怕缺欄位就停下來問。\n5. 當使用者「點名」某個人或部門當簽核人/收件者時，先用 search_members（依姓名關鍵字）、list_org_units、list_positions 查到真實 id，再用 set_user_task_approver / set_service_action 指定（如 DIRECT memberIds、ORG_UNIT_MANAGER orgUnitId、POSITION positionId）。查不到就回報並請使用者確認，不要編造 id。\n6. 節點 id 可從 snapshot 取得；連線條件需要先綁定表單欄位（若 list_form_fields 為空，提醒使用者先綁定表單版本）。\n7. **條件分流務必主動補上「其他情況」**：設計 exclusiveGateway（條件分流）時，除了符合條件的分支，一定要保留一條未設條件、標記為預設（isDefault）的「其他情況」路徑當 else（通常指向後續節點或完成）。不要把所有輸出連線都設成條件而沒有預設出口；缺預設出口時，用 set_edge_default 把其中一條設為預設。\n8. 完成後，呼叫 validate_workflow，並用一兩句話說明你建了什麼流程、哪些地方（如簽核人、條件門檻）建議使用者再確認或指定。\n9. 全程使用繁體中文（台灣用語）回覆。\n10. 欄位在各關的顯示與補填用 set_field_access_matrix 設定：nodeIds 只列這次要改的簽核節點，它們的設定會整個換掉，呼叫前先從 get_workflow_snapshot 讀出這些節點既有的「欄位設定」一併傳入。「隱藏」只影響畫面、不是權限，不能用來保密；使用者要求保密時要說明這一點。節點含舊欄位權限設定時，用 remove_legacy_field_permissions 移除（不會自動轉換）。\n\n運算式（CEL）規則：\n- 運算式只在後端檢查與執行，你看不到執行結果，也不能在瀏覽器試算。寫任何運算式（發起權限、簽核人運算式、系統節點寫入欄位的值、Webhook payload、知會對象運算式）之前，先呼叫 get_expression_catalog 取得該位置可用的根、欄位與函式，只使用目錄裡的名稱；宿主函式名稱帶版本（例如 erp_costBand_v1），要照目錄原樣寫。\n- 寫入前一定先用 preview_expression 檢查（LINT）。有 ERROR 就修正後再檢查，不要直接寫入；寫入工具也會再檢查一次，未通過會被拒絕。WARNING 只是提醒，寫入後要用一句話告訴使用者。\n- 條件分流的連線條件優先用 set_edge_condition（依欄位、運算子、值，由系統產生），不要自己拼 CEL。\n- 只有從簽核關卡出去的連線才讀得到 lastDecision；條件分流、系統節點出去的連線 lastDecision 永遠是空值，不要在那裡讀它。\n- 運算式寫進草稿後不會自動發布；發布由使用者在畫面上操作，你不能也不要嘗試發布。\n\n嚴格界線：\n- 只做「設計這個簽核流程」相關的事。任何與此無關的請求（閒聊、寫詩、寫程式、查天氣／新聞、操作其他系統或頁面、回答一般知識問題等）一律婉拒，並簡短引導使用者回到流程設計，例如：「我只能協助你設計這個簽核流程，需要我幫你新增關卡或設定條件嗎？」\n- 不要假裝執行你工具以外的動作，也不要編造結果。",
-			tools: n
+			tools: t
 		}).toUIMessageStreamResponse() : a.response;
 	};
 }

package/dist/pages/admin/delegations/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/delegations-CVmtpkRn.cjs");let t=require("react/jsx-runtime");var n={title:`代理設定 | BPM Admin`,description:`設定簽核代理規則，讓符合範圍的待簽任務自動改派給代理人。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/delegations-ClRCwD1I.cjs");let t=require("react/jsx-runtime");var n={title:`代理設定 | BPM Admin`,description:`設定簽核代理規則，讓符合範圍的待簽任務自動改派給代理人。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/admin/delegations/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/delegations-CxnNvTCc.js";
+import { t as e } from "../../../chunks/delegations-zisffLwk.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/admin/delegations/index.tsx
 var n = {

package/dist/pages/delegations/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../chunks/delegations-CrfjsH94.cjs");let t=require("react/jsx-runtime");var n={title:`我的代理 | BPM Admin`,description:`設定自己的簽核代理，讓指定期間內的新待簽任務自動交由代理人處理。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../chunks/delegations-D43VDSz1.cjs");let t=require("react/jsx-runtime");var n={title:`我的代理 | BPM Admin`,description:`設定自己的簽核代理，讓指定期間內的新待簽任務自動交由代理人處理。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/delegations/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../chunks/delegations-9-yvWWws.js";
+import { t as e } from "../../chunks/delegations-CqND-Qtz.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/delegations/index.tsx
 var n = {

package/dist/pages/instances/detail/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/detail-ChseSF55.cjs");let t=require("react/jsx-runtime");var n={title:`案件詳情 | BPM Admin`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{instanceId:r})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/detail-DNzqesdI.cjs");let t=require("react/jsx-runtime");var n={title:`案件詳情 | BPM Admin`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{instanceId:r})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/instances/detail/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/detail-ByZV1XaI.js";
+import { t as e } from "../../../chunks/detail-Bv90gvy0.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/instances/detail/index.tsx
 var n = { title: "案件詳情 | BPM Admin" };

package/dist/pages/templates/categories/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/categories-DQUtVEiV.cjs");let t=require("react/jsx-runtime");var n={title:`範本分類管理 | BPM Admin`,description:`維護 BPM 流程範本的分類設定。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/categories-CyyqG6wG.cjs");let t=require("react/jsx-runtime");var n={title:`範本分類管理 | BPM Admin`,description:`維護 BPM 流程範本的分類設定。`};function r(){return(0,t.jsx)(e.t,{})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/templates/categories/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/categories-BAdxjNSA.js";
+import { t as e } from "../../../chunks/categories-f7E-RJEc.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/templates/categories/index.tsx
 var n = {

package/dist/pages/templates/compose/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/compose-Bb5bUVFd.cjs");let t=require("react/jsx-runtime"),n=require("next/server");var r={title:`建立模板（表單 + 流程） | BPM Admin`,description:`以精靈式流程一次完成 BPM 表單與簽核流程設計並發佈。`};async function i(){return await(0,n.connection)(),(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`})}exports.default=i,exports.metadata=r;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/compose-BKUTsB2W.cjs");let t=require("react/jsx-runtime"),n=require("next/server");var r={title:`建立模板（表單 + 流程） | BPM Admin`,description:`以精靈式流程一次完成 BPM 表單與簽核流程設計並發佈。`};async function i(){return await(0,n.connection)(),(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`})}exports.default=i,exports.metadata=r;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/templates/compose/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/compose-egQlRjuZ.js";
+import { t as e } from "../../../chunks/compose-DZvIspW3.js";
 import { jsx as t } from "react/jsx-runtime";
 import { connection as n } from "next/server";
 // src/pages/templates/compose/index.tsx

package/dist/pages/templates/designer/index.cjs

@@ -1,2 +1,2 @@
-Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/designer-CX9bhYJS.cjs");let t=require("react/jsx-runtime");var n={title:`流程設計器 | BPM Admin`,description:`以視覺化設計器編輯 BPM 簽核流程節點、條件與發佈版本。`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`,showDryRun:process.env.BPM_TEMPLATE_DRY_RUN_ENABLED!==`false`,templateId:r})}exports.default=r,exports.metadata=n;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});const e=require("../../../chunks/designer-C_m8DmMl.cjs");let t=require("react/jsx-runtime");var n={title:`流程設計器 | BPM Admin`,description:`以視覺化設計器編輯 BPM 簽核流程節點、條件與發佈版本。`};async function r({params:n}){let{id:r}=await n;return(0,t.jsx)(e.t,{aiAssistantAvailable:!!process.env.OPENAI_API_KEY,showAiAssistant:process.env.BPM_AI_ASSISTANT_ENABLED===`true`,showDryRun:process.env.BPM_TEMPLATE_DRY_RUN_ENABLED!==`false`,templateId:r})}exports.default=r,exports.metadata=n;
 //# sourceMappingURL=index.cjs.map

package/dist/pages/templates/designer/index.js

@@ -1,4 +1,4 @@
-import { t as e } from "../../../chunks/designer-CZDlQ9Nf.js";
+import { t as e } from "../../../chunks/designer-CWubIE69.js";
 import { jsx as t } from "react/jsx-runtime";
 // src/pages/templates/designer/index.tsx
 var n = {

package/dist/views/admin/delegations/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/delegations-CVmtpkRn.cjs");exports.AdminDelegationsView=e.t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/delegations-ClRCwD1I.cjs");exports.AdminDelegationsView=e.t;

package/dist/views/admin/delegations/index.js

@@ -1 +1 @@
-export { t as AdminDelegationsView } from "../../../chunks/delegations-CxnNvTCc.js";
+export { t as AdminDelegationsView } from "../../../chunks/delegations-zisffLwk.js";

package/dist/views/admin/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../chunks/users-EqSzDhuj.cjs"),t=require("../../chunks/orgs-B_2J2tLX.cjs"),n=require("../../chunks/delegations-CVmtpkRn.cjs"),r=require("./webhook-endpoints/index.cjs");exports.AdminDelegationsView=n.t,exports.AdminOrgsView=t.t,exports.AdminUsersView=e.t,exports.AdminWebhookEndpointsView=r.AdminWebhookEndpointsView;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../chunks/users-EqSzDhuj.cjs"),t=require("../../chunks/orgs-B_2J2tLX.cjs"),n=require("../../chunks/delegations-ClRCwD1I.cjs"),r=require("./webhook-endpoints/index.cjs");exports.AdminDelegationsView=n.t,exports.AdminOrgsView=t.t,exports.AdminUsersView=e.t,exports.AdminWebhookEndpointsView=r.AdminWebhookEndpointsView;

package/dist/views/admin/index.js

@@ -1,5 +1,5 @@
 import { t as e } from "../../chunks/users-BBtiZ9QQ.js";
 import { t } from "../../chunks/orgs-DqxMds26.js";
-import { t as n } from "../../chunks/delegations-CxnNvTCc.js";
+import { t as n } from "../../chunks/delegations-zisffLwk.js";
 import { AdminWebhookEndpointsView as r } from "./webhook-endpoints/index.js";
 export { n as AdminDelegationsView, t as AdminOrgsView, e as AdminUsersView, r as AdminWebhookEndpointsView };

package/dist/views/admin/webhook-endpoints/index.cjs

@@ -1,2 +1,2 @@
-"use client";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/rolldown-runtime-BocRIvOZ.cjs"),t=require("../../../chunks/bpm-form-field-Bc6k4ZEO.cjs"),n=require("../../../chunks/format-date-time-D-cx5M8z.cjs");let r=require("react"),i=require("@mezzanine-ui/react"),a=require("react/jsx-runtime"),o=require("@mezzanine-ui/react/ContentHeader");o=e.t(o,1);let s=require("@mezzanine-ui/icons"),c=require("@rytass/bpm-core-client/template");var l={display:`grid`,gap:`var(--mzn-spacing-gap-base)`},u={alignItems:`center`,display:`grid`,gap:`var(--mzn-spacing-gap-base)`,gridTemplateColumns:`minmax(0, 1fr) minmax(0, 1fr) minmax(0, 1fr) auto auto`},d={alignItems:`center`,display:`grid`,gap:`var(--mzn-spacing-gap-base)`,gridTemplateColumns:`minmax(0, 1fr) minmax(0, 2fr) auto`},f=[{id:`POST`,name:`POST`},{id:`PUT`,name:`PUT`},{id:`PATCH`,name:`PATCH`}],p=[{id:`string`,name:`文字`},{id:`number`,name:`數字`},{id:`boolean`,name:`是／否`},{id:`stringArray`,name:`文字清單`},{id:`json`,name:`JSON`}],m={CREATED:`建立`,DISABLED:`停用`,ENABLED:`啟用`,SECRET_ROTATED:`輪替金鑰`,TEST_SENT:`測試送出`,UPDATED:`更新`},h={deprecated:!1,description:``,endpointId:null,headers:[],key:``,label:``,method:`POST`,mode:`create`,originalUrl:``,parameters:[],replaceHeaders:!0,signingSecret:``,timeoutMs:``,url:``,version:`1`};function g(){let[e,u]=(0,r.useState)(null),[d,f]=(0,r.useState)([]),[p,m]=(0,r.useState)(!0),[g,S]=(0,r.useState)(null),[w,T]=(0,r.useState)(null),[E,D]=(0,r.useState)(null),[O,k]=(0,r.useState)(!1),[A,j]=(0,r.useState)(null),[M,N]=(0,r.useState)(``),[P,F]=(0,r.useState)(!1),[I,L]=(0,r.useState)(null),R=(0,r.useCallback)(async()=>{m(!0);try{let e=await(0,c.readWorkflowWebhookEndpointManagement)();u(e),f(e.enabled?await(0,c.listWorkflowWebhookManagedEndpoints)():[]),S(null)}catch(e){S(C(e))}finally{m(!1)}},[]);(0,r.useEffect)(()=>{R()},[R]);let z=(0,r.useCallback)(async e=>{S(null),T(null);try{return T(await e()),await R(),!0}catch(e){return S(C(e)),!1}},[R]),B=(0,r.useMemo)(()=>d.map(e=>({endpoint:e,key:e.id})),[d]),V=(0,r.useMemo)(()=>[{key:`label`,render:({endpoint:e})=>(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.label}),(0,a.jsxs)(i.Typography,{color:`text-neutral`,component:`span`,variant:`caption`,children:[e.key,`@`,e.version,` · 參數`,` `,e.parameters.length,` 個`]})]}),title:`端點`,width:240},{key:`url`,render:({endpoint:e})=>(0,a.jsxs)(i.Typography,{component:`span`,variant:`body`,children:[e.method,` `,e.url]}),title:`URL`,width:320},{key:`status`,render:({endpoint:e})=>e.active?e.deprecated?(0,a.jsx)(i.Badge,{size:`sub`,text:`不建議使用`,variant:`dot-warning`}):(0,a.jsx)(i.Badge,{size:`sub`,text:`啟用中`,variant:`dot-success`}):(0,a.jsx)(i.Badge,{size:`sub`,text:`已停用`,variant:`dot-inactive`}),title:`狀態`,width:120},{key:`credentials`,render:({endpoint:e})=>(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.hasSigningSecret?`已設定簽章金鑰`:`未簽章`}),(0,a.jsx)(i.Typography,{color:`text-neutral`,component:`span`,variant:`caption`,children:e.headerNames.length?`Header：${e.headerNames.join(`、`)}`:`沒有自訂 header`})]}),title:`憑證`,width:200},{key:`updatedAt`,render:({endpoint:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:n.t(e.updatedAt)}),title:`更新時間`,width:180}],[]),H=(0,r.useMemo)(()=>({render:({endpoint:e})=>[{name:`編輯`,onClick:()=>D(y(e,`edit`))},{name:`建立新版本`,onClick:()=>D(y(e,`version`))},{name:`測試送出`,onClick:()=>{z(async()=>b(e,await(0,c.testWorkflowWebhookEndpoint)(e.id)))}},{name:`輪替金鑰`,onClick:()=>{N(``),F(!1),j(e)}},{name:e.active?`停用`:`啟用`,onClick:()=>{z(async()=>(await(0,c.setWorkflowWebhookEndpointActive)(e.id,!e.active),`已${e.active?`停用`:`啟用`}「${e.label}」。`))}},{name:`異動紀錄`,onClick:()=>{(0,c.listWorkflowWebhookEndpointAudits)(e.id).then(t=>L({endpoint:e,records:t})).catch(e=>S(C(e)))}}],variant:`base-secondary`,width:180}),[z]);async function U(){if(!E)return;k(!0);let e=await z(async()=>{let e=E.parameters.map(e=>({description:e.description.trim()||null,key:e.key.trim(),label:e.label.trim(),required:e.required,type:e.type})),t=E.headers.filter(e=>e.name.trim()).map(e=>({name:e.name.trim(),value:e.value})),n=E.timeoutMs.trim()?Number(E.timeoutMs):null;return E.mode===`edit`&&E.endpointId?(await(0,c.updateWorkflowWebhookEndpoint)({deprecated:E.deprecated,description:E.description,headers:E.replaceHeaders||x(E)?t:null,id:E.endpointId,label:E.label,method:E.method,parameters:e,timeoutMs:n,url:E.url}),`已更新「${E.label}」。`):(await(0,c.createWorkflowWebhookEndpoint)({deprecated:E.deprecated,description:E.description,headers:t,key:E.key,label:E.label,method:E.method,parameters:e,signingSecret:E.signingSecret||null,timeoutMs:n,url:E.url,version:Number(E.version)}),`已建立「${E.label}」v${E.version}，設計器現在可以選用。`)});k(!1),e&&D(null)}async function W(){if(!A)return;let e=A;await z(async()=>(await(0,c.rotateWorkflowWebhookEndpointSecret)(e.id,P?null:M),P?`已移除「${e.label}」的簽章金鑰，之後的請求不再簽章。`:`已輪替「${e.label}」的簽章金鑰，接收端需改用新金鑰驗簽。`))&&(j(null),N(``))}let G=!!e?.enabled;return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(i.PageHeader,{children:(0,a.jsx)(o.default,{description:`維護知會節點可呼叫的外部系統端點。Header 值與簽章金鑰加密保存，儲存後不會再顯示。`,title:`Webhook 端點`,children:(0,a.jsx)(i.Button,{disabled:!G,icon:s.PlusIcon,iconType:`leading`,onClick:()=>D(h),variant:`base-primary`,children:`新增端點`})})}),(0,a.jsx)(i.SectionGroup,{children:(0,a.jsx)(i.Section,{children:(0,a.jsxs)(`div`,{style:l,children:[g?(0,a.jsx)(i.Typography,{color:`text-error`,variant:`body`,children:g}):null,w?(0,a.jsx)(i.Typography,{color:`text-success`,variant:`body`,children:w}):null,e&&!G?(0,a.jsx)(i.Typography,{color:`text-warning`,variant:`body`,children:`此伺服器未啟用後台維護的 Webhook 端點：需要設定 workflowWebhookTargetSources 含 DATABASE、URL 白名單與加密金鑰。程式註冊的端點不受影響。`}):null,G?(0,a.jsxs)(i.Typography,{color:`text-neutral`,variant:`caption`,children:[`允許的 URL：`,e?.allowedUrlPatterns.join(`、`)]}):null,(0,a.jsx)(i.Table,{actions:H,columns:V,dataSource:B,fullWidth:!0,loading:p})]})})}),E?(0,a.jsx)(v,{draft:E,onCancel:()=>D(null),onChange:D,onConfirm:()=>void U(),saving:O}):null,(0,a.jsx)(i.Modal,{cancelText:`取消`,confirmButtonProps:{disabled:!P&&!M},confirmText:P?`移除金鑰`:`輪替金鑰`,modalType:`standard`,onCancel:()=>j(null),onClose:()=>j(null),onConfirm:()=>void W(),open:!!A,showModalFooter:!0,showModalHeader:!0,supportingText:`新金鑰會加密保存，不會再顯示；請同時更新接收端的驗簽金鑰。`,title:`輪替簽章金鑰：${A?.label??``}`,children:(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(t.t,{label:`移除金鑰`,name:`removeSigningSecret`,children:(0,a.jsx)(i.Toggle,{checked:P,onChange:e=>F(e.target.checked)})}),P?null:(0,a.jsx)(t.t,{label:`新金鑰`,name:`nextSigningSecret`,required:!0,children:(0,a.jsx)(i.Input,{onChange:e=>N(e.target.value),value:M,inputProps:{autoComplete:`new-password`},variant:`password`})})]})}),(0,a.jsx)(i.Modal,{confirmText:`關閉`,modalType:`standard`,onClose:()=>L(null),onConfirm:()=>L(null),open:!!I,showModalFooter:!0,showModalHeader:!0,size:`wide`,supportingText:`只記錄誰在何時變更了哪些欄位，不記錄任何值。`,title:`異動紀錄：${I?.endpoint.label??``}`,children:(0,a.jsx)(i.Table,{columns:_,dataSource:(I?.records??[]).map(e=>({audit:e,key:e.id})),fullWidth:!0})})]})}var _=[{key:`createdAt`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:n.t(e.createdAt)}),title:`時間`,width:180},{key:`action`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:m[e.action]}),title:`動作`,width:120},{key:`changedFields`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.changedFields.join(`、`)||`—`}),title:`欄位`,width:280},{key:`actor`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.actorMemberId??`系統`}),title:`操作者`,width:160}];function v({draft:e,onCancel:n,onChange:r,onConfirm:o,saving:c}){let m=e.mode===`edit`,h=x(e),g=e.replaceHeaders||h,_=t=>r({...e,...t}),v=(t,n)=>_({parameters:e.parameters.map((e,r)=>r===t?{...e,...n}:e)}),y=(t,n)=>_({headers:e.headers.map((e,r)=>r===t?{...e,...n}:e)}),b=e=>t=>_({[e]:t.target.value});return(0,a.jsx)(i.Modal,{cancelText:`取消`,confirmText:m?`儲存`:`建立`,loading:c,modalType:`standard`,onCancel:n,onClose:n,onConfirm:o,open:!0,showModalFooter:!0,showModalHeader:!0,size:`wide`,supportingText:m?`參數的鍵、型別與必填是這個版本的契約，無法修改；需要變更請建立新版本。`:e.mode===`version`?`新版本可調整參數；既有模板仍使用舊版本，直到設計者改選。`:`URL 需符合伺服器設定的白名單。`,title:m?`編輯端點：${e.label}`:e.mode===`version`?`建立新版本：${e.key}`:`新增 Webhook 端點`,children:(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(t.t,{label:`Key`,name:`endpointKey`,required:!0,children:(0,a.jsx)(i.Input,{...e.mode===`create`?{}:{readonly:!0},onChange:b(`key`),placeholder:`例如 crm.lead-created`,value:e.key,inputProps:{autoComplete:`off`},variant:`base`})}),(0,a.jsx)(t.t,{label:`版本`,name:`endpointVersion`,required:!0,children:(0,a.jsx)(i.Input,{...m?{readonly:!0}:{},inputProps:{autoComplete:`off`,inputMode:`numeric`},onChange:b(`version`),value:e.version,variant:`base`})}),(0,a.jsx)(t.t,{label:`名稱`,name:`endpointLabel`,required:!0,children:(0,a.jsx)(i.Input,{onChange:b(`label`),placeholder:`例如 CRM 建立名單`,value:e.label,inputProps:{autoComplete:`off`},variant:`base`})}),(0,a.jsx)(t.t,{label:`說明`,name:`endpointDescription`,children:(0,a.jsx)(i.Textarea,{onChange:b(`description`),rows:2,value:e.description})}),(0,a.jsx)(t.t,{label:`URL`,name:`endpointUrl`,required:!0,children:(0,a.jsx)(i.Input,{onChange:b(`url`),placeholder:`https://`,value:e.url,inputProps:{autoComplete:`off`},variant:`base`})}),(0,a.jsx)(t.t,{label:`Method`,name:`endpointMethod`,required:!0,children:(0,a.jsx)(i.Select,{clearable:!1,onChange:e=>_({method:e?.id??`POST`}),options:[...f],value:f.find(t=>t.id===e.method)??null})}),(0,a.jsx)(t.t,{hintText:`留空使用預設 10 秒，上限 30000 毫秒。`,label:`逾時（毫秒）`,name:`endpointTimeout`,children:(0,a.jsx)(i.Input,{inputProps:{autoComplete:`off`,inputMode:`numeric`},onChange:b(`timeoutMs`),value:e.timeoutMs,variant:`base`})}),(0,a.jsx)(t.t,{label:`不建議使用`,name:`endpointDeprecated`,children:(0,a.jsx)(i.Toggle,{checked:e.deprecated,onChange:e=>_({deprecated:e.target.checked})})}),m?null:(0,a.jsx)(t.t,{hintText:`選填；設定後 BPM 以 HMAC-SHA256 簽章，儲存後不會再顯示。`,label:`簽章金鑰`,name:`endpointSigningSecret`,children:(0,a.jsx)(i.Input,{onChange:b(`signingSecret`),placeholder:`選填，儲存後不再顯示`,value:e.signingSecret,inputProps:{autoComplete:`new-password`},variant:`password`})}),(0,a.jsx)(i.Typography,{variant:`label-primary-highlight`,children:`Headers`}),m?(0,a.jsx)(t.t,{hintText:h?`URL 已改到其他主機，必須重新輸入 header（留空代表不帶任何 header）。`:`現有 header 的值不會顯示；開啟後以下列內容取代全部 header。`,label:`取代 headers`,name:`endpointReplaceHeaders`,children:(0,a.jsx)(i.Toggle,{checked:g,disabled:h,onChange:e=>_({replaceHeaders:e.target.checked})})}):null,g?e.headers.map((t,n)=>(0,a.jsxs)(`div`,{style:d,children:[(0,a.jsx)(i.Input,{onChange:e=>y(n,{name:e.target.value}),placeholder:`名稱，例如 Authorization`,inputProps:{autoComplete:`off`},value:t.name,variant:`base`}),(0,a.jsx)(i.Input,{onChange:e=>y(n,{value:e.target.value}),placeholder:`值`,value:t.value,inputProps:{autoComplete:`new-password`},variant:`password`}),(0,a.jsx)(i.Button,{icon:s.TrashIcon,iconType:`icon-only`,onClick:()=>_({headers:e.headers.filter((e,t)=>t!==n)}),variant:`destructive-text-link`,children:`移除 header`})]},n)):null,g?(0,a.jsx)(`div`,{children:(0,a.jsx)(i.Button,{icon:s.PlusIcon,iconType:`leading`,onClick:()=>_({headers:[...e.headers,{name:``,value:``}]}),variant:`base-dashed`,children:`新增 header`})}):null,(0,a.jsx)(i.Typography,{variant:`label-primary-highlight`,children:`參數`}),e.parameters.map((t,n)=>(0,a.jsxs)(`div`,{style:u,children:[(0,a.jsx)(i.Input,{...m?{readonly:!0}:{},onChange:e=>v(n,{key:e.target.value}),placeholder:`參數鍵`,inputProps:{autoComplete:`off`},value:t.key,variant:`base`}),(0,a.jsx)(i.Input,{onChange:e=>v(n,{label:e.target.value}),placeholder:`顯示名稱`,inputProps:{autoComplete:`off`},value:t.label,variant:`base`}),(0,a.jsx)(i.Select,{clearable:!1,disabled:m,onChange:e=>v(n,{type:S(e?.id??null)}),options:[...p],value:p.find(e=>e.id===t.type)??null}),(0,a.jsx)(i.Toggle,{checked:t.required,disabled:m,label:`必填`,onChange:e=>v(n,{required:e.target.checked})}),(0,a.jsx)(i.Button,{disabled:m,icon:s.TrashIcon,iconType:`icon-only`,onClick:()=>_({parameters:e.parameters.filter((e,t)=>t!==n)}),variant:`destructive-text-link`,children:`移除參數`})]},n)),m?null:(0,a.jsx)(`div`,{children:(0,a.jsx)(i.Button,{icon:s.PlusIcon,iconType:`leading`,onClick:()=>_({parameters:[...e.parameters,{description:``,key:``,label:``,required:!1,type:`string`}]}),variant:`base-dashed`,children:`新增參數`})})]})})}function y(e,t){return{deprecated:e.deprecated,description:e.description??``,endpointId:t===`edit`?e.id:null,headers:[],key:e.key,label:e.label,method:e.method,mode:t,originalUrl:e.url,parameters:e.parameters.map(e=>({description:e.description??``,key:e.key,label:e.label,required:e.required,type:e.type})),replaceHeaders:t===`version`,signingSecret:``,timeoutMs:e.timeoutMs?String(e.timeoutMs):``,url:e.url,version:String(t===`version`?e.version+1:e.version)}}function b(e,t){if(t.ok)return`測試送出成功：「${e.label}」回應 HTTP ${t.status??``}。`;throw Error(`測試送出失敗：「${e.label}」${t.status?`回應 HTTP ${t.status}`:``}（${t.errorCode??`未知錯誤`}）${t.errorDetail?`：${t.errorDetail}`:``}`)}function x(e){if(e.mode!==`edit`)return!1;let t=e=>{try{return new URL(e.trim()).origin}catch{return e.trim()}};return t(e.url)!==t(e.originalUrl)}function S(e){return p.some(t=>t.id===e)?e:`string`}function C(e){if(!(e instanceof Error))return`發生未知錯誤`;let t=e.message;return t.includes(`WORKFLOW_WEBHOOK_URL_NOT_ALLOWED`)?`URL 不在伺服器允許的白名單內。`:t.includes(`WORKFLOW_WEBHOOK_ENDPOINT_KEY_CONFLICT`)?`這個 Key 已由程式註冊的端點使用，請換一個。`:t.includes(`WORKFLOW_WEBHOOK_ENDPOINT_CONTRACT_CHANGED`)?`參數契約不能修改，請改用「建立新版本」。`:t.includes(`WORKFLOW_WEBHOOK_TEST_RATE_LIMITED`)?`測試送出太頻繁，請稍後再試（每 10 秒一次、10 分鐘最多 5 次）。`:t}exports.AdminWebhookEndpointsView=g;
+"use client";Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../../../chunks/rolldown-runtime-BocRIvOZ.cjs"),t=require("../../../chunks/bpm-form-field-Bc6k4ZEO.cjs"),n=require("../../../chunks/format-date-time-D-cx5M8z.cjs");let r=require("react"),i=require("@mezzanine-ui/react"),a=require("react/jsx-runtime"),o=require("@mezzanine-ui/react/ContentHeader");o=e.t(o,1);let s=require("@rytass/bpm-core-client/template"),c=require("@mezzanine-ui/icons");var l={display:`grid`,gap:`var(--mzn-spacing-gap-base)`},u={alignItems:`center`,display:`grid`,gap:`var(--mzn-spacing-gap-base)`,gridTemplateColumns:`minmax(0, 1fr) minmax(0, 1fr) minmax(0, 1fr) auto auto`},d={alignItems:`center`,display:`grid`,gap:`var(--mzn-spacing-gap-base)`,gridTemplateColumns:`minmax(0, 1fr) minmax(0, 2fr) auto`},f=[{id:`POST`,name:`POST`},{id:`PUT`,name:`PUT`},{id:`PATCH`,name:`PATCH`}],p=[{id:`string`,name:`文字`},{id:`number`,name:`數字`},{id:`boolean`,name:`是／否`},{id:`stringArray`,name:`文字清單`},{id:`json`,name:`JSON`}],m={CREATED:`建立`,DISABLED:`停用`,ENABLED:`啟用`,SECRET_ROTATED:`輪替金鑰`,TEST_SENT:`測試送出`,UPDATED:`更新`},h={deprecated:!1,description:``,endpointId:null,headers:[],key:``,label:``,method:`POST`,mode:`create`,originalUrl:``,parameters:[],replaceHeaders:!0,signingSecret:``,timeoutMs:``,url:``,version:`1`};function g(){let[e,u]=(0,r.useState)(null),[d,f]=(0,r.useState)([]),[p,m]=(0,r.useState)(!0),[g,S]=(0,r.useState)(null),[w,T]=(0,r.useState)(null),[E,D]=(0,r.useState)(null),[O,k]=(0,r.useState)(!1),[A,j]=(0,r.useState)(null),[M,N]=(0,r.useState)(``),[P,F]=(0,r.useState)(!1),[I,L]=(0,r.useState)(null),R=(0,r.useCallback)(async()=>{m(!0);try{let e=await(0,s.readWorkflowWebhookEndpointManagement)();u(e),f(e.enabled?await(0,s.listWorkflowWebhookManagedEndpoints)():[]),S(null)}catch(e){S(C(e))}finally{m(!1)}},[]);(0,r.useEffect)(()=>{R()},[R]);let z=(0,r.useCallback)(async e=>{S(null),T(null);try{return T(await e()),await R(),!0}catch(e){return S(C(e)),!1}},[R]),B=(0,r.useMemo)(()=>d.map(e=>({endpoint:e,key:e.id})),[d]),V=(0,r.useMemo)(()=>[{key:`label`,render:({endpoint:e})=>(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.label}),(0,a.jsxs)(i.Typography,{color:`text-neutral`,component:`span`,variant:`caption`,children:[e.key,`@`,e.version,` · 參數`,` `,e.parameters.length,` 個`]})]}),title:`端點`,width:240},{key:`url`,render:({endpoint:e})=>(0,a.jsxs)(i.Typography,{component:`span`,variant:`body`,children:[e.method,` `,e.url]}),title:`URL`,width:320},{key:`status`,render:({endpoint:e})=>e.active?e.deprecated?(0,a.jsx)(i.Badge,{size:`sub`,text:`不建議使用`,variant:`dot-warning`}):(0,a.jsx)(i.Badge,{size:`sub`,text:`啟用中`,variant:`dot-success`}):(0,a.jsx)(i.Badge,{size:`sub`,text:`已停用`,variant:`dot-inactive`}),title:`狀態`,width:120},{key:`credentials`,render:({endpoint:e})=>(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.hasSigningSecret?`已設定簽章金鑰`:`未簽章`}),(0,a.jsx)(i.Typography,{color:`text-neutral`,component:`span`,variant:`caption`,children:e.headerNames.length?`Header：${e.headerNames.join(`、`)}`:`沒有自訂 header`})]}),title:`憑證`,width:200},{key:`updatedAt`,render:({endpoint:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:n.t(e.updatedAt)}),title:`更新時間`,width:180}],[]),H=(0,r.useMemo)(()=>({render:({endpoint:e})=>[{name:`編輯`,onClick:()=>D(y(e,`edit`))},{name:`建立新版本`,onClick:()=>D(y(e,`version`))},{name:`測試送出`,onClick:()=>{z(async()=>b(e,await(0,s.testWorkflowWebhookEndpoint)(e.id)))}},{name:`輪替金鑰`,onClick:()=>{N(``),F(!1),j(e)}},{name:e.active?`停用`:`啟用`,onClick:()=>{z(async()=>(await(0,s.setWorkflowWebhookEndpointActive)(e.id,!e.active),`已${e.active?`停用`:`啟用`}「${e.label}」。`))}},{name:`異動紀錄`,onClick:()=>{(0,s.listWorkflowWebhookEndpointAudits)(e.id).then(t=>L({endpoint:e,records:t})).catch(e=>S(C(e)))}}],variant:`base-secondary`,width:180}),[z]);async function U(){if(!E)return;k(!0);let e=await z(async()=>{let e=E.parameters.map(e=>({description:e.description.trim()||null,key:e.key.trim(),label:e.label.trim(),required:e.required,type:e.type})),t=E.headers.filter(e=>e.name.trim()).map(e=>({name:e.name.trim(),value:e.value})),n=E.timeoutMs.trim()?Number(E.timeoutMs):null;return E.mode===`edit`&&E.endpointId?(await(0,s.updateWorkflowWebhookEndpoint)({deprecated:E.deprecated,description:E.description,headers:E.replaceHeaders||x(E)?t:null,id:E.endpointId,label:E.label,method:E.method,parameters:e,timeoutMs:n,url:E.url}),`已更新「${E.label}」。`):(await(0,s.createWorkflowWebhookEndpoint)({deprecated:E.deprecated,description:E.description,headers:t,key:E.key,label:E.label,method:E.method,parameters:e,signingSecret:E.signingSecret||null,timeoutMs:n,url:E.url,version:Number(E.version)}),`已建立「${E.label}」v${E.version}，設計器現在可以選用。`)});k(!1),e&&D(null)}async function W(){if(!A)return;let e=A;await z(async()=>(await(0,s.rotateWorkflowWebhookEndpointSecret)(e.id,P?null:M),P?`已移除「${e.label}」的簽章金鑰，之後的請求不再簽章。`:`已輪替「${e.label}」的簽章金鑰，接收端需改用新金鑰驗簽。`))&&(j(null),N(``))}let G=!!e?.enabled;return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(i.PageHeader,{children:(0,a.jsx)(o.default,{description:`維護知會節點可呼叫的外部系統端點。Header 值與簽章金鑰加密保存，儲存後不會再顯示。`,title:`Webhook 端點`,children:(0,a.jsx)(i.Button,{disabled:!G,icon:c.PlusIcon,iconType:`leading`,onClick:()=>D(h),variant:`base-primary`,children:`新增端點`})})}),(0,a.jsx)(i.SectionGroup,{children:(0,a.jsx)(i.Section,{children:(0,a.jsxs)(`div`,{style:l,children:[g?(0,a.jsx)(i.Typography,{color:`text-error`,variant:`body`,children:g}):null,w?(0,a.jsx)(i.Typography,{color:`text-success`,variant:`body`,children:w}):null,e&&!G?(0,a.jsx)(i.Typography,{color:`text-warning`,variant:`body`,children:`此伺服器未啟用後台維護的 Webhook 端點：需要設定 workflowWebhookTargetSources 含 DATABASE、URL 白名單與加密金鑰。程式註冊的端點不受影響。`}):null,G?(0,a.jsxs)(i.Typography,{color:`text-neutral`,variant:`caption`,children:[`允許的 URL：`,e?.allowedUrlPatterns.join(`、`)]}):null,(0,a.jsx)(i.Table,{actions:H,columns:V,dataSource:B,fullWidth:!0,loading:p})]})})}),E?(0,a.jsx)(v,{draft:E,onCancel:()=>D(null),onChange:D,onConfirm:()=>void U(),saving:O}):null,(0,a.jsx)(i.Modal,{cancelText:`取消`,confirmButtonProps:{disabled:!P&&!M},confirmText:P?`移除金鑰`:`輪替金鑰`,modalType:`standard`,onCancel:()=>j(null),onClose:()=>j(null),onConfirm:()=>void W(),open:!!A,showModalFooter:!0,showModalHeader:!0,supportingText:`新金鑰會加密保存，不會再顯示；請同時更新接收端的驗簽金鑰。`,title:`輪替簽章金鑰：${A?.label??``}`,children:(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(t.t,{label:`移除金鑰`,name:`removeSigningSecret`,children:(0,a.jsx)(i.Toggle,{checked:P,onChange:e=>F(e.target.checked)})}),P?null:(0,a.jsx)(t.t,{label:`新金鑰`,name:`nextSigningSecret`,required:!0,children:(0,a.jsx)(i.Input,{onChange:e=>N(e.target.value),value:M,inputProps:{autoComplete:`new-password`},variant:`password`})})]})}),(0,a.jsx)(i.Modal,{confirmText:`關閉`,modalType:`standard`,onClose:()=>L(null),onConfirm:()=>L(null),open:!!I,showModalFooter:!0,showModalHeader:!0,size:`wide`,supportingText:`只記錄誰在何時變更了哪些欄位，不記錄任何值。`,title:`異動紀錄：${I?.endpoint.label??``}`,children:(0,a.jsx)(i.Table,{columns:_,dataSource:(I?.records??[]).map(e=>({audit:e,key:e.id})),fullWidth:!0})})]})}var _=[{key:`createdAt`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:n.t(e.createdAt)}),title:`時間`,width:180},{key:`action`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:m[e.action]}),title:`動作`,width:120},{key:`changedFields`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.changedFields.join(`、`)||`—`}),title:`欄位`,width:280},{key:`actor`,render:({audit:e})=>(0,a.jsx)(i.Typography,{component:`span`,variant:`body`,children:e.actorMemberId??`系統`}),title:`操作者`,width:160}];function v({draft:e,onCancel:n,onChange:r,onConfirm:o,saving:s}){let m=e.mode===`edit`,h=x(e),g=e.replaceHeaders||h,_=t=>r({...e,...t}),v=(t,n)=>_({parameters:e.parameters.map((e,r)=>r===t?{...e,...n}:e)}),y=(t,n)=>_({headers:e.headers.map((e,r)=>r===t?{...e,...n}:e)}),b=e=>t=>_({[e]:t.target.value});return(0,a.jsx)(i.Modal,{cancelText:`取消`,confirmText:m?`儲存`:`建立`,loading:s,modalType:`standard`,onCancel:n,onClose:n,onConfirm:o,open:!0,showModalFooter:!0,showModalHeader:!0,size:`wide`,supportingText:m?`參數的鍵、型別與必填是這個版本的契約，無法修改；需要變更請建立新版本。`:e.mode===`version`?`新版本可調整參數；既有模板仍使用舊版本，直到設計者改選。`:`URL 需符合伺服器設定的白名單。`,title:m?`編輯端點：${e.label}`:e.mode===`version`?`建立新版本：${e.key}`:`新增 Webhook 端點`,children:(0,a.jsxs)(`div`,{style:l,children:[(0,a.jsx)(t.t,{label:`Key`,name:`endpointKey`,required:!0,children:(0,a.jsx)(i.Input,{...e.mode===`create`?{}:{readonly:!0},onChange:b(`key`),placeholder:`例如 crm.lead-created`,value:e.key,inputProps:{autoComplete:`off`},variant:`base`})}),(0,a.jsx)(t.t,{label:`版本`,name:`endpointVersion`,required:!0,children:(0,a.jsx)(i.Input,{...m?{readonly:!0}:{},inputProps:{autoComplete:`off`,inputMode:`numeric`},onChange:b(`version`),value:e.version,variant:`base`})}),(0,a.jsx)(t.t,{label:`名稱`,name:`endpointLabel`,required:!0,children:(0,a.jsx)(i.Input,{onChange:b(`label`),placeholder:`例如 CRM 建立名單`,value:e.label,inputProps:{autoComplete:`off`},variant:`base`})}),(0,a.jsx)(t.t,{label:`說明`,name:`endpointDescription`,children:(0,a.jsx)(i.Textarea,{onChange:b(`description`),rows:2,value:e.description})}),(0,a.jsx)(t.t,{label:`URL`,name:`endpointUrl`,required:!0,children:(0,a.jsx)(i.Input,{onChange:b(`url`),placeholder:`https://`,value:e.url,inputProps:{autoComplete:`off`},variant:`base`})}),(0,a.jsx)(t.t,{label:`Method`,name:`endpointMethod`,required:!0,children:(0,a.jsx)(i.Select,{clearable:!1,onChange:e=>_({method:e?.id??`POST`}),options:[...f],value:f.find(t=>t.id===e.method)??null})}),(0,a.jsx)(t.t,{hintText:`留空使用預設 10 秒，上限 30000 毫秒。`,label:`逾時（毫秒）`,name:`endpointTimeout`,children:(0,a.jsx)(i.Input,{inputProps:{autoComplete:`off`,inputMode:`numeric`},onChange:b(`timeoutMs`),value:e.timeoutMs,variant:`base`})}),(0,a.jsx)(t.t,{label:`不建議使用`,name:`endpointDeprecated`,children:(0,a.jsx)(i.Toggle,{checked:e.deprecated,onChange:e=>_({deprecated:e.target.checked})})}),m?null:(0,a.jsx)(t.t,{hintText:`選填；設定後 BPM 以 HMAC-SHA256 簽章，儲存後不會再顯示。`,label:`簽章金鑰`,name:`endpointSigningSecret`,children:(0,a.jsx)(i.Input,{onChange:b(`signingSecret`),placeholder:`選填，儲存後不再顯示`,value:e.signingSecret,inputProps:{autoComplete:`new-password`},variant:`password`})}),(0,a.jsx)(i.Typography,{variant:`label-primary-highlight`,children:`Headers`}),m?(0,a.jsx)(t.t,{hintText:h?`URL 已改到其他主機，必須重新輸入 header（留空代表不帶任何 header）。`:`現有 header 的值不會顯示；開啟後以下列內容取代全部 header。`,label:`取代 headers`,name:`endpointReplaceHeaders`,children:(0,a.jsx)(i.Toggle,{checked:g,disabled:h,onChange:e=>_({replaceHeaders:e.target.checked})})}):null,g?e.headers.map((t,n)=>(0,a.jsxs)(`div`,{style:d,children:[(0,a.jsx)(i.Input,{onChange:e=>y(n,{name:e.target.value}),placeholder:`名稱，例如 Authorization`,inputProps:{autoComplete:`off`},value:t.name,variant:`base`}),(0,a.jsx)(i.Input,{onChange:e=>y(n,{value:e.target.value}),placeholder:`值`,value:t.value,inputProps:{autoComplete:`new-password`},variant:`password`}),(0,a.jsx)(i.Button,{icon:c.TrashIcon,iconType:`icon-only`,onClick:()=>_({headers:e.headers.filter((e,t)=>t!==n)}),variant:`destructive-text-link`,children:`移除 header`})]},n)):null,g?(0,a.jsx)(`div`,{children:(0,a.jsx)(i.Button,{icon:c.PlusIcon,iconType:`leading`,onClick:()=>_({headers:[...e.headers,{name:``,value:``}]}),variant:`base-dashed`,children:`新增 header`})}):null,(0,a.jsx)(i.Typography,{variant:`label-primary-highlight`,children:`參數`}),e.parameters.map((t,n)=>(0,a.jsxs)(`div`,{style:u,children:[(0,a.jsx)(i.Input,{...m?{readonly:!0}:{},onChange:e=>v(n,{key:e.target.value}),placeholder:`參數鍵`,inputProps:{autoComplete:`off`},value:t.key,variant:`base`}),(0,a.jsx)(i.Input,{onChange:e=>v(n,{label:e.target.value}),placeholder:`顯示名稱`,inputProps:{autoComplete:`off`},value:t.label,variant:`base`}),(0,a.jsx)(i.Select,{clearable:!1,disabled:m,onChange:e=>v(n,{type:S(e?.id??null)}),options:[...p],value:p.find(e=>e.id===t.type)??null}),(0,a.jsx)(i.Toggle,{checked:t.required,disabled:m,label:`必填`,onChange:e=>v(n,{required:e.target.checked})}),(0,a.jsx)(i.Button,{disabled:m,icon:c.TrashIcon,iconType:`icon-only`,onClick:()=>_({parameters:e.parameters.filter((e,t)=>t!==n)}),variant:`destructive-text-link`,children:`移除參數`})]},n)),m?null:(0,a.jsx)(`div`,{children:(0,a.jsx)(i.Button,{icon:c.PlusIcon,iconType:`leading`,onClick:()=>_({parameters:[...e.parameters,{description:``,key:``,label:``,required:!1,type:`string`}]}),variant:`base-dashed`,children:`新增參數`})})]})})}function y(e,t){return{deprecated:e.deprecated,description:e.description??``,endpointId:t===`edit`?e.id:null,headers:[],key:e.key,label:e.label,method:e.method,mode:t,originalUrl:e.url,parameters:e.parameters.map(e=>({description:e.description??``,key:e.key,label:e.label,required:e.required,type:e.type})),replaceHeaders:t===`version`,signingSecret:``,timeoutMs:e.timeoutMs?String(e.timeoutMs):``,url:e.url,version:String(t===`version`?e.version+1:e.version)}}function b(e,t){if(t.ok)return`測試送出成功：「${e.label}」回應 HTTP ${t.status??``}。`;throw Error(`測試送出失敗：「${e.label}」${t.status?`回應 HTTP ${t.status}`:``}（${t.errorCode??`未知錯誤`}）${t.errorDetail?`：${t.errorDetail}`:``}`)}function x(e){if(e.mode!==`edit`)return!1;let t=e=>{try{return new URL(e.trim()).origin}catch{return e.trim()}};return t(e.url)!==t(e.originalUrl)}function S(e){return p.some(t=>t.id===e)?e:`string`}function C(e){if(!(e instanceof Error))return`發生未知錯誤`;let t=e.message;return t.includes(`WORKFLOW_WEBHOOK_URL_NOT_ALLOWED`)?`URL 不在伺服器允許的白名單內。`:t.includes(`WORKFLOW_WEBHOOK_ENDPOINT_KEY_CONFLICT`)?`這個 Key 已由程式註冊的端點使用，請換一個。`:t.includes(`WORKFLOW_WEBHOOK_ENDPOINT_CONTRACT_CHANGED`)?`參數契約不能修改，請改用「建立新版本」。`:t.includes(`WORKFLOW_WEBHOOK_TEST_RATE_LIMITED`)?`測試送出太頻繁，請稍後再試（每 10 秒一次、10 分鐘最多 5 次）。`:t}exports.AdminWebhookEndpointsView=g;
 //# sourceMappingURL=index.cjs.map