@vertesia/studio-utils 1.3.0

package/lib/prompts/render.js

@@ -0,0 +1,166 @@
+import { PromptSegmentDefType, TemplateType } from '@vertesia/common';
+import { CompositeError, renderHandlebarsTemplate, renderJsTemplate } from '@vertesia/jst';
+/**
+ * Render a prompt template with the given input data.
+ *
+ * Handlebars templates use {{variable}} interpolation against `data`.
+ * JST (JavaScript template) bodies evaluate against `data` with the schema's top-level
+ * property names exposed as globals, plus `_model` — the active model id, which the
+ * studio-server executor injects into the input as `{ ..._model: run.modelId }` when
+ * executing an interaction (see `apps/studio-server/src/executor/ExecutionRequest.ts`
+ * and `apps/studio-server/src/executor/rendering/template.ts`). Listing it here keeps
+ * the Playground preview and `validatePrompt` in sync with runtime resolution — a JST
+ * template referencing `_model` validates fine here and renders fine in production.
+ *
+ * For `TemplateType.text`, the content is returned verbatim — it is static text, not a
+ * template — matching the studio-server executor (see `apps/studio-server/src/executor/
+ * rendering/template.ts`). Routing it through the JST evaluator would compile the prose as
+ * JavaScript and throw on any plain sentence (e.g. "You are a helpful assistant.").
+ */
+export function renderTemplate(code, contentType, schema, data) {
+    if (contentType === TemplateType.handlebars) {
+        return renderHandlebarsTemplate(code, data);
+    }
+    if (contentType === TemplateType.text) {
+        return code;
+    }
+    const globals = [...(schema.properties ? Object.keys(schema.properties) : []), '_model'];
+    return renderJsTemplate(code, globals, data);
+}
+/**
+ * Execute a JST (JavaScript Template) with given data.
+ * Returns a discriminated union to surface errors without throwing.
+ */
+export function executeJST(jstContent, schema, data) {
+    try {
+        const result = renderTemplate(jstContent, TemplateType.jst, schema, data);
+        return { success: true, content: result };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+/**
+ * Execute a Handlebars template with given data.
+ * Returns a discriminated union to surface errors without throwing.
+ */
+export function executeHandlebars(handlebarsContent, schema, data) {
+    try {
+        const result = renderTemplate(handlebarsContent, TemplateType.handlebars, schema, data);
+        return { success: true, content: result };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+function renderChatSegment(segment, data) {
+    const chatKey = getChatKey(segment.configuration);
+    const chat = data[chatKey];
+    let content;
+    if (Array.isArray(chat)) {
+        content = JSON.stringify(chat, undefined, 2);
+    }
+    else {
+        content = `No "${chatKey}" property found on input data`;
+    }
+    return {
+        title: 'Chat history',
+        content,
+    };
+}
+function renderTemplateSegment(segment, data) {
+    if (!segment.template) {
+        return { title: '(unknown segment)', content: '', error: new Error('Prompt segment is missing its template') };
+    }
+    const schema = segment.template.inputSchema || {};
+    const title = `@${segment.template.role}`;
+    try {
+        const content = renderTemplate(segment.template.content, segment.template.content_type, schema, data);
+        return { title, content, segmentId: segment.template.id };
+    }
+    catch (error) {
+        // Isolate the failure to this segment so the remaining segments still render.
+        return {
+            title,
+            content: error instanceof Error ? error.message : String(error),
+            segmentId: segment.template.id,
+            error: error instanceof Error ? error : new Error(String(error)),
+        };
+    }
+}
+export function renderSegments(segments, data) {
+    const out = [];
+    for (const segment of segments) {
+        if (segment.type === PromptSegmentDefType.chat) {
+            out.push(renderChatSegment(segment, data));
+        }
+        else if (segment.type === PromptSegmentDefType.template) {
+            out.push(renderTemplateSegment(segment, data));
+        }
+    }
+    return out;
+}
+export function renderSegmentsOrErrors(segments, textOrObject) {
+    try {
+        return renderSegments(segments, typeof textOrObject === 'string' ? JSON.parse(textOrObject.trim()) : textOrObject || {});
+    }
+    catch (error) {
+        if (error instanceof CompositeError) {
+            return error.errors.map((err) => ({
+                error: err,
+                title: 'Rendering Error',
+                content: err.message,
+            }));
+        }
+        return [
+            {
+                error: error instanceof Error ? error : new Error(String(error)),
+                title: 'Rendering Error',
+                content: error instanceof Error ? error.message : String(error),
+            },
+        ];
+    }
+}
+export function renderPrompt(segments, payload) {
+    const out = [];
+    for (const segment of segments) {
+        if (segment.template) {
+            const schema = segment.template.inputSchema || {};
+            const content = renderTemplate(segment.template.content, segment.template.content_type, schema, payload);
+            out.push({ role: segment.template.role, content });
+        }
+        else if (segment.type === PromptSegmentDefType.chat) {
+            const chatKey = getChatKey(segment.configuration);
+            const messages = payload[chatKey];
+            if (!isPromptSegmentArray(messages)) {
+                throw new Error('Chat prompt segment must have a messages array');
+            }
+            for (const msg of messages) {
+                if (!msg.role) {
+                    throw new Error('Chat prompt segment must have a role');
+                }
+                out.push({ role: msg.role, content: msg.content });
+            }
+        }
+        else {
+            throw new Error(`Unknown prompt segment type: ${segment.type}`);
+        }
+    }
+    return out;
+}
+function getChatKey(configuration) {
+    if (typeof configuration === 'object' &&
+        configuration !== null &&
+        'chatKey' in configuration &&
+        typeof configuration.chatKey === 'string') {
+        return configuration.chatKey;
+    }
+    return 'chat';
+}
+function isPromptSegmentArray(value) {
+    return Array.isArray(value) && value.every(isPromptSegment);
+}
+function isPromptSegment(value) {
+    return typeof value === 'object' && value !== null && 'role' in value && 'content' in value;
+}
+//# sourceMappingURL=render.js.map

package/lib/prompts/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/prompts/render.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,oBAAoB,EAAuB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAS3F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,WAAyB,EAAE,MAAkB,EAAE,IAAgB;IACxG,IAAI,WAAW,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,WAAW,KAAK,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzF,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACtB,UAAkB,EAClB,MAAkB,EAClB,IAAgB;IAEhB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7F,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC7B,iBAAyB,EACzB,MAAkB,EAClB,IAAgB;IAEhB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7F,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAyC,EAAE,IAAgB;IAClF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAe,CAAC;IACpB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACJ,OAAO,GAAG,OAAO,OAAO,gCAAgC,CAAC;IAC7D,CAAC;IACD,OAAO;QACH,KAAK,EAAE,cAAc;QACrB,OAAO;KACV,CAAC;AACN,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAyC,EAAE,IAAgB;IACtF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,8EAA8E;QAC9E,OAAO;YACH,KAAK;YACL,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACnE,CAAC;IACN,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAA4C,EAAE,IAAgB;IACzF,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,IAAI,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAClC,QAA4C,EAC5C,YAAiC;IAEjC,IAAI,CAAC;QACD,OAAO,cAAc,CACjB,QAAQ,EACR,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAC1F,CAAC;IACN,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC9B,KAAK,EAAE,GAAY;gBACnB,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;aACvB,CAAC,CAAC,CAAC;QACR,CAAC;QACD,OAAO;YACH;gBACI,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChE,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAClE;SACJ,CAAC;IACN,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA4C,EAAE,OAAmB;IAC1F,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACzG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC5D,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,aAAsB;IACtC,IACI,OAAO,aAAa,KAAK,QAAQ;QACjC,aAAa,KAAK,IAAI;QACtB,SAAS,IAAI,aAAa;QAC1B,OAAQ,aAAsC,CAAC,OAAO,KAAK,QAAQ,EACrE,CAAC;QACC,OAAQ,aAAqC,CAAC,OAAO,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,CAAC;AAChG,CAAC"}

package/lib/prompts/validate.d.ts

@@ -0,0 +1,46 @@
+import { type JSONSchema, TemplateType } from '@vertesia/common';
+export type PromptValidationIssueType = 'undeclared_template_variable' | 'unused_schema_variable' | 'handlebars_render_error' | 'jst_unsafe_construct' | 'jst_render_error';
+export type PromptValidationIssueSeverity = 'error' | 'warning';
+export interface PromptValidationIssue {
+    /** Discriminator for issue kind */
+    type: PromptValidationIssueType;
+    /** Errors should block prompt creation; warnings are informational. */
+    severity: PromptValidationIssueSeverity;
+    /** The variable name when the issue is variable-related. */
+    variable?: string;
+    /** Human-readable message; safe to surface directly to an LLM tool error. */
+    message: string;
+}
+export interface PromptValidationResult {
+    /** Flat list of issues found. `severity` discriminates errors (blocking) from warnings. */
+    issues: PromptValidationIssue[];
+    /** Count of `severity: 'error'` entries in `issues`. Zero ⇔ validation passed. */
+    error_count: number;
+    /** Count of `severity: 'warning'` entries in `issues`. Non-blocking informational findings. */
+    warning_count: number;
+}
+export interface PromptValidationInput {
+    /** The prompt's template source. */
+    content: string;
+    /** Template language. `handlebars` and `jst` are validated; `text` passes through. */
+    contentType: TemplateType;
+    /** JSON Schema declaring the variables the template expects. */
+    inputSchema?: JSONSchema;
+}
+/**
+ * Validate a single prompt template against its declared input schema.
+ *
+ * For `handlebars` and `jst` templates, the following checks are performed:
+ *  1. Every variable referenced in the template must be declared as a top-level property
+ *     in `inputSchema.properties` (else → `undeclared_template_variable` error).
+ *  2. Every property declared in `inputSchema.properties` should be referenced by the template
+ *     (else → `unused_schema_variable` warning — non-blocking).
+ *  3. The template must render successfully against schema-derived mock data
+ *     (else → `handlebars_render_error` / `jst_render_error` error).
+ *  4. For JST only: unsafe constructs (`with`, `for`, `while`, `import`, class, `this`,
+ *     dynamic property lookup, blacklisted props) → `jst_unsafe_construct` error.
+ *
+ * `text` content type passes through with no issues.
+ */
+export declare function validatePrompt(input: PromptValidationInput): PromptValidationResult;
+//# sourceMappingURL=validate.d.ts.map

package/lib/prompts/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/prompts/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAMjE,MAAM,MAAM,yBAAyB,GAC/B,8BAA8B,GAC9B,wBAAwB,GACxB,yBAAyB,GACzB,sBAAsB,GACtB,kBAAkB,CAAC;AAEzB,MAAM,MAAM,6BAA6B,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IAClC,mCAAmC;IACnC,IAAI,EAAE,yBAAyB,CAAC;IAChC,uEAAuE;IACvE,QAAQ,EAAE,6BAA6B,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACnC,2FAA2F;IAC3F,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IAClC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,WAAW,EAAE,YAAY,CAAC;IAC1B,gEAAgE;IAChE,WAAW,CAAC,EAAE,UAAU,CAAC;CAC5B;AAkJD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAWnF"}

package/lib/prompts/validate.js

@@ -0,0 +1,167 @@
+import { TemplateType } from '@vertesia/common';
+import { getFreeVariables, renderJsTemplate } from '@vertesia/jst';
+import { extractHandlebarsVariables } from './extract-vars.js';
+import { generateMockData } from './mock-data.js';
+import { executeHandlebars } from './render.js';
+// JST's renderJsTemplate auto-adds `_` (helpers object) and runtime injects `Set` and `Array`
+// — treat them as globals so they don't appear as free vars in user templates.
+// Globals always available to JST templates regardless of schema:
+//  - `_`, `Array`, `Set`: runtime-injected by `renderJsTemplate` (jst library)
+//  - `_model`: runtime-injected by the studio-server executor as `{ ..._model: run.modelId }`
+//    (see ExecutionRequest.ts:313 and executor/rendering/template.ts:13)
+// Keeping these in sync with `renderTemplate` in ./render.ts so a JST template that runs in
+// production also passes the validator.
+const JST_AUTO_GLOBALS = ['_', 'Array', 'Set', '_model'];
+function countSeverities(issues) {
+    let error_count = 0;
+    let warning_count = 0;
+    for (const issue of issues) {
+        if (issue.severity === 'error') {
+            error_count++;
+        }
+        else if (issue.severity === 'warning') {
+            warning_count++;
+        }
+    }
+    return { error_count, warning_count };
+}
+function validateHandlebarsPrompt(content, inputSchema) {
+    const issues = [];
+    const usedVars = extractHandlebarsVariables(content);
+    const declaredVars = new Set(inputSchema?.properties ? Object.keys(inputSchema.properties) : []);
+    for (const used of usedVars) {
+        if (!declaredVars.has(used)) {
+            issues.push({
+                type: 'undeclared_template_variable',
+                severity: 'error',
+                variable: used,
+                message: `Template references variable '{{${used}}}' but it is not declared in input_schema.properties. Add '${used}' to the schema with an appropriate type.`,
+            });
+        }
+    }
+    for (const declared of declaredVars) {
+        if (!usedVars.has(declared)) {
+            issues.push({
+                type: 'unused_schema_variable',
+                severity: 'warning',
+                variable: declared,
+                message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or use it via {{${declared}}}.`,
+            });
+        }
+    }
+    // Render-time smoke test — always runs so syntax errors and failing helper calls are
+    // surfaced even when undeclared-variable errors are already in the list. Handlebars renders
+    // missing vars as empty strings (non-strict by default), so the render check does NOT echo
+    // the var errors — anything it reports is a distinct template problem worth showing.
+    const renderSchema = inputSchema ?? {};
+    const mockData = generateMockData(renderSchema);
+    const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData) ? mockData : {};
+    const renderResult = executeHandlebars(content, renderSchema, mockObject);
+    if (!renderResult.success) {
+        issues.push({
+            type: 'handlebars_render_error',
+            severity: 'error',
+            message: `Handlebars rendering failed: ${renderResult.error}`,
+        });
+    }
+    return issues;
+}
+function validateJstPrompt(content, inputSchema) {
+    const issues = [];
+    const declaredVars = new Set(inputSchema?.properties ? Object.keys(inputSchema.properties) : []);
+    let referenced;
+    try {
+        const result = getFreeVariables(content, {
+            globals: JST_AUTO_GLOBALS,
+            acorn: { allowReturnOutsideFunction: true, locations: true },
+        });
+        referenced = result.vars;
+        for (const err of result.errors) {
+            issues.push({
+                type: 'jst_unsafe_construct',
+                severity: 'error',
+                message: `JST validation error at ${err.location}: ${err.message}`,
+            });
+        }
+    }
+    catch (parseError) {
+        // Acorn parse failure — surface as render error since the template can't be compiled.
+        issues.push({
+            type: 'jst_render_error',
+            severity: 'error',
+            message: `JST parse failed: ${parseError instanceof Error ? parseError.message : String(parseError)}`,
+        });
+        return issues;
+    }
+    for (const used of referenced) {
+        if (!declaredVars.has(used)) {
+            issues.push({
+                type: 'undeclared_template_variable',
+                severity: 'error',
+                variable: used,
+                message: `Template references variable '${used}' but it is not declared in input_schema.properties. Add '${used}' to the schema with an appropriate type.`,
+            });
+        }
+    }
+    for (const declared of declaredVars) {
+        if (!referenced.has(declared)) {
+            issues.push({
+                type: 'unused_schema_variable',
+                severity: 'warning',
+                variable: declared,
+                message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or use it in the template.`,
+            });
+        }
+    }
+    // Render-time smoke test — only if there are no blocking errors so far, otherwise
+    // the failure mode would just echo what we already reported.
+    const blockingSoFar = issues.some((i) => i.severity === 'error');
+    if (!blockingSoFar) {
+        const renderSchema = inputSchema ?? {};
+        const mockData = generateMockData(renderSchema);
+        const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData)
+            ? mockData
+            : {};
+        try {
+            renderJsTemplate(content, [...declaredVars], mockObject);
+        }
+        catch (renderError) {
+            issues.push({
+                type: 'jst_render_error',
+                severity: 'error',
+                message: `JST rendering failed: ${renderError instanceof Error ? renderError.message : String(renderError)}`,
+            });
+        }
+    }
+    return issues;
+}
+/**
+ * Validate a single prompt template against its declared input schema.
+ *
+ * For `handlebars` and `jst` templates, the following checks are performed:
+ *  1. Every variable referenced in the template must be declared as a top-level property
+ *     in `inputSchema.properties` (else → `undeclared_template_variable` error).
+ *  2. Every property declared in `inputSchema.properties` should be referenced by the template
+ *     (else → `unused_schema_variable` warning — non-blocking).
+ *  3. The template must render successfully against schema-derived mock data
+ *     (else → `handlebars_render_error` / `jst_render_error` error).
+ *  4. For JST only: unsafe constructs (`with`, `for`, `while`, `import`, class, `this`,
+ *     dynamic property lookup, blacklisted props) → `jst_unsafe_construct` error.
+ *
+ * `text` content type passes through with no issues.
+ */
+export function validatePrompt(input) {
+    let issues;
+    if (input.contentType === TemplateType.handlebars) {
+        issues = validateHandlebarsPrompt(input.content, input.inputSchema);
+    }
+    else if (input.contentType === TemplateType.jst) {
+        issues = validateJstPrompt(input.content, input.inputSchema);
+    }
+    else {
+        issues = [];
+    }
+    const { error_count, warning_count } = countSeverities(issues);
+    return { issues, error_count, warning_count };
+}
+//# sourceMappingURL=validate.js.map

package/lib/prompts/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/prompts/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAwChD,8FAA8F;AAC9F,+EAA+E;AAC/E,kEAAkE;AAClE,+EAA+E;AAC/E,8FAA8F;AAC9F,yEAAyE;AACzE,4FAA4F;AAC5F,wCAAwC;AACxC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAEzD,SAAS,eAAe,CAAC,MAA+B;IACpD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,WAAW,EAAE,CAAC;QAClB,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,aAAa,EAAE,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe,EAAE,WAAwB;IACvE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEzG,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,mCAAmC,IAAI,+DAA+D,IAAI,2CAA2C;aACjK,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,6BAA6B,QAAQ,uFAAuF,QAAQ,KAAK;aACrJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,4FAA4F;IAC5F,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,YAAY,GAAG,WAAW,IAAK,EAAiB,CAAC;IACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,UAAU,GACZ,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gCAAgC,YAAY,CAAC,KAAK,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,WAAwB;IAChE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEzG,IAAI,UAAuB,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE;YACrC,OAAO,EAAE,gBAAgB;YACzB,KAAK,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SAC/D,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,2BAA2B,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE;aACrE,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QAClB,sFAAsF;QACtF,MAAM,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,qBAAqB,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;SACxG,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,iCAAiC,IAAI,6DAA6D,IAAI,2CAA2C;aAC7J,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,6BAA6B,QAAQ,gGAAgG;aACjJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,6DAA6D;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,WAAW,IAAK,EAAiB,CAAC;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,UAAU,GACZ,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACzE,CAAC,CAAE,QAAuB;YAC1B,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,CAAC;YACD,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yBAAyB,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;aAC/G,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,KAA4B;IACvD,IAAI,MAA+B,CAAC;IACpC,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACJ,MAAM,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AAClD,CAAC"}

package/lib/roles/classes.d.ts

@@ -0,0 +1,59 @@
+import type { AbacScope, Permission, RoleDomain } from '@vertesia/common';
+/**
+ * Class hierarchy and registry-bound interface for the role system. These
+ * are LOGIC — they have runtime behavior (constructors, instance methods,
+ * subclass dispatch via `instanceof`). They live in `@vertesia/studio-utils`
+ * (not common) per the package-layering contract: only types stay in common.
+ */
+/**
+ * A role: a named bundle of permissions that ACEs reference by name.
+ *
+ * Generic over the permission type so subclasses can tighten it:
+ *  - **System roles** declare `extends Role<Permission>` — construction time
+ *    type-checks against the central `Permission` enum.
+ *  - **ABAC roles** (`AbacRole`) declare `extends Role<string>` — permissions
+ *    are bare verbs (`'read'`, `'write'`, `'delete'`, future domain-specific
+ *    verbs) consumed by the JWT generator to form `{scope}:{verb}` keys in
+ *    `content_security`.
+ *
+ * The registry stores `Role` (defaulting to `Role<string>`) — the loose type
+ * is the lowest common denominator. Tight typing is only enforced at
+ * declaration sites of the role subclasses.
+ */
+export declare class Role<PermissionType extends string = string> {
+    name: string;
+    domain: RoleDomain;
+    permissions: Set<PermissionType>;
+    constructor(name: string, permissions: PermissionType[], domain: RoleDomain);
+    hasPermission(permission: PermissionType): boolean;
+}
+/**
+ * Base class for built-in system roles. Hardcodes `domain: 'system'` and
+ * specializes `Role<Permission>` so subclasses get compile-time type-checking
+ * against the central `Permission` enum at construction.
+ */
+export declare class SystemRole extends Role<Permission> {
+    constructor(name: string, permissions: Permission[]);
+}
+/**
+ * A role usable in ContentSet ACEs. Adds `applicableScopes` — the kinds of
+ * objects the role can be applied to at the ABAC scope level. Inherits
+ * `Role<string>` because ABAC verbs aren't constrained to the central
+ * `Permission` enum.
+ *
+ * The IAM UI filters via `listAbacRolesForScope` which checks `instanceof AbacRole`.
+ */
+export declare class AbacRole extends Role<string> {
+    applicableScopes: readonly AbacScope[];
+    constructor(name: string, permissions: string[], domain: RoleDomain, applicableScopes: readonly AbacScope[]);
+}
+/**
+ * A logical bucket of roles owned by a single domain. The registry iterates
+ * partitions in registration order — first match wins. The `system` partition
+ * is registered first so domain partitions cannot shadow built-in system roles.
+ */
+export interface RolePartition {
+    domain: RoleDomain;
+    roles: Map<string, Role>;
+}
+//# sourceMappingURL=classes.d.ts.map

package/lib/roles/classes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classes.d.ts","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1E;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,qBAAa,IAAI,CAAC,cAAc,SAAS,MAAM,GAAG,MAAM;IAGzC,IAAI,EAAE,MAAM;IAEZ,MAAM,EAAE,UAAU;IAJ7B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBAEtB,IAAI,EAAE,MAAM,EACnB,WAAW,EAAE,cAAc,EAAE,EACtB,MAAM,EAAE,UAAU;IAK7B,aAAa,CAAC,UAAU,EAAE,cAAc;CAG3C;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,IAAI,CAAC,UAAU,CAAC;gBAChC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE;CAGtD;AAED;;;;;;;GAOG;AACH,qBAAa,QAAS,SAAQ,IAAI,CAAC,MAAM,CAAC;IAK3B,gBAAgB,EAAE,SAAS,SAAS,EAAE;gBAH7C,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,MAAM,EAAE,UAAU,EACX,gBAAgB,EAAE,SAAS,SAAS,EAAE;CAIpD;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC5B"}

package/lib/roles/classes.js

@@ -0,0 +1,60 @@
+/**
+ * Class hierarchy and registry-bound interface for the role system. These
+ * are LOGIC — they have runtime behavior (constructors, instance methods,
+ * subclass dispatch via `instanceof`). They live in `@vertesia/studio-utils`
+ * (not common) per the package-layering contract: only types stay in common.
+ */
+/**
+ * A role: a named bundle of permissions that ACEs reference by name.
+ *
+ * Generic over the permission type so subclasses can tighten it:
+ *  - **System roles** declare `extends Role<Permission>` — construction time
+ *    type-checks against the central `Permission` enum.
+ *  - **ABAC roles** (`AbacRole`) declare `extends Role<string>` — permissions
+ *    are bare verbs (`'read'`, `'write'`, `'delete'`, future domain-specific
+ *    verbs) consumed by the JWT generator to form `{scope}:{verb}` keys in
+ *    `content_security`.
+ *
+ * The registry stores `Role` (defaulting to `Role<string>`) — the loose type
+ * is the lowest common denominator. Tight typing is only enforced at
+ * declaration sites of the role subclasses.
+ */
+export class Role {
+    name;
+    domain;
+    permissions;
+    constructor(name, permissions, domain) {
+        this.name = name;
+        this.domain = domain;
+        this.permissions = new Set(permissions);
+    }
+    hasPermission(permission) {
+        return this.permissions.has(permission);
+    }
+}
+/**
+ * Base class for built-in system roles. Hardcodes `domain: 'system'` and
+ * specializes `Role<Permission>` so subclasses get compile-time type-checking
+ * against the central `Permission` enum at construction.
+ */
+export class SystemRole extends Role {
+    constructor(name, permissions) {
+        super(name, permissions, 'system');
+    }
+}
+/**
+ * A role usable in ContentSet ACEs. Adds `applicableScopes` — the kinds of
+ * objects the role can be applied to at the ABAC scope level. Inherits
+ * `Role<string>` because ABAC verbs aren't constrained to the central
+ * `Permission` enum.
+ *
+ * The IAM UI filters via `listAbacRolesForScope` which checks `instanceof AbacRole`.
+ */
+export class AbacRole extends Role {
+    applicableScopes;
+    constructor(name, permissions, domain, applicableScopes) {
+        super(name, permissions, domain);
+        this.applicableScopes = applicableScopes;
+    }
+}
+//# sourceMappingURL=classes.js.map

package/lib/roles/classes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classes.js","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,IAAI;IAGF;IAEA;IAJX,WAAW,CAAsB;IACjC,YACW,IAAY,EACnB,WAA6B,EACtB,MAAkB;QAFlB,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAY;QAEzB,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CAAC,UAA0B;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAW,SAAQ,IAAgB;IAC5C,YAAY,IAAY,EAAE,WAAyB;QAC/C,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,IAAY;IAK3B;IAJX,YACI,IAAY,EACZ,WAAqB,EACrB,MAAkB,EACX,gBAAsC;QAE7C,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAF1B,qBAAgB,GAAhB,gBAAgB,CAAsB;IAGjD,CAAC;CACJ"}

package/lib/roles/content.d.ts

@@ -0,0 +1,13 @@
+import { type RolePartition } from './classes.js';
+/**
+ * Names of roles owned by the `content` domain. Apply to ContentSet ACEs
+ * scoped to either `document` or `collection` — the semantics of "read
+ * content" are the same for both kinds.
+ */
+export declare enum ContentRoleNames {
+    content_reader = "content_reader",
+    content_writer = "content_writer",
+    content_manager = "content_manager"
+}
+export declare const contentPartition: RolePartition;
+//# sourceMappingURL=content.d.ts.map

package/lib/roles/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAMvE;;;;GAIG;AACH,oBAAY,gBAAgB;IACxB,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;CACtC;AA0BD,eAAO,MAAM,gBAAgB,EAAE,aAG9B,CAAC"}

package/lib/roles/content.js

@@ -0,0 +1,39 @@
+import { AbacRole } from './classes.js';
+const ContentRoleDomain = 'content';
+const APPLICABLE_SCOPES = ['document', 'collection'];
+/**
+ * Names of roles owned by the `content` domain. Apply to ContentSet ACEs
+ * scoped to either `document` or `collection` — the semantics of "read
+ * content" are the same for both kinds.
+ */
+export var ContentRoleNames;
+(function (ContentRoleNames) {
+    ContentRoleNames["content_reader"] = "content_reader";
+    ContentRoleNames["content_writer"] = "content_writer";
+    ContentRoleNames["content_manager"] = "content_manager";
+})(ContentRoleNames || (ContentRoleNames = {}));
+class ContentReaderRole extends AbacRole {
+    constructor() {
+        super(ContentRoleNames.content_reader, ['read'], ContentRoleDomain, APPLICABLE_SCOPES);
+    }
+}
+class ContentWriterRole extends AbacRole {
+    constructor() {
+        super(ContentRoleNames.content_writer, ['read', 'write'], ContentRoleDomain, APPLICABLE_SCOPES);
+    }
+}
+class ContentManagerRole extends AbacRole {
+    constructor() {
+        super(ContentRoleNames.content_manager, ['read', 'write', 'delete'], ContentRoleDomain, APPLICABLE_SCOPES);
+    }
+}
+const contentRoles = {
+    [ContentRoleNames.content_reader]: new ContentReaderRole(),
+    [ContentRoleNames.content_writer]: new ContentWriterRole(),
+    [ContentRoleNames.content_manager]: new ContentManagerRole(),
+};
+export const contentPartition = {
+    domain: ContentRoleDomain,
+    roles: new Map(Object.entries(contentRoles)),
+};
+//# sourceMappingURL=content.js.map

package/lib/roles/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAiC,MAAM,cAAc,CAAC;AAEvE,MAAM,iBAAiB,GAAe,SAAS,CAAC;AAEhD,MAAM,iBAAiB,GAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IACxB,qDAAiC,CAAA;IACjC,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;AACvC,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,MAAM,iBAAkB,SAAQ,QAAQ;IACpC;QACI,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC3F,CAAC;CACJ;AAED,MAAM,iBAAkB,SAAQ,QAAQ;IACpC;QACI,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IACpG,CAAC;CACJ;AAED,MAAM,kBAAmB,SAAQ,QAAQ;IACrC;QACI,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/G,CAAC;CACJ;AAED,MAAM,YAAY,GAAmC;IACjD,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,IAAI,iBAAiB,EAAE;IAC1D,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,IAAI,iBAAiB,EAAE;IAC1D,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,IAAI,kBAAkB,EAAE;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAkB;IAC3C,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/C,CAAC"}

package/lib/roles/index.d.ts

@@ -0,0 +1,37 @@
+import type { AbacScope, RoleDomain } from '@vertesia/common';
+import { AbacRole, type Role, SystemRole } from './classes.js';
+export { AbacRole, Role, type RolePartition, SystemRole } from './classes.js';
+export { ContentRoleNames } from './content.js';
+/** Look up a role by its name across all registered partitions. */
+export declare function getRoleByName(name: string): Role;
+/** List every role across all partitions, in partition registration order. */
+export declare function listRoles(): Role[];
+/** Roles owned by a specific domain (e.g. `'system'`, `'content'`). */
+export declare function listRolesByDomain(domain: RoleDomain): Role[];
+/**
+ * ABAC roles applicable to a given ContentSet scope (e.g. `'document'`,
+ * `'collection'`). System roles are excluded — they don't carry scope semantics.
+ */
+export declare function listAbacRolesForScope(scope: AbacScope): AbacRole[];
+/** Shortcut for the system partition: returns only `SystemRole` instances. */
+export declare function listSystemRoles(): SystemRole[];
+/** Names of every registered role across all partitions — suited for mongoose schema enum constraints. */
+export declare function getAllRoleNames(): string[];
+/**
+ * Merge the permissions granted by a set of roles into a single array.
+ * Intended for the system-role gating path. For ABAC roles, the bare-verb
+ * permissions returned here aren't directly meaningful — use the JWT
+ * `content_security` pathway instead.
+ */
+export declare function getPermissionsForRoles(roleNames: Iterable<string>): string[];
+/**
+ * A list of roles with a unified `hasPermission` check across them.
+ */
+export declare class RoleList {
+    readonly roles: Role[];
+    private constructor();
+    static fromRoleNames(roleNames: string[]): RoleList;
+    static fromRoleName(roleName: string): RoleList;
+    hasPermission(perm: string): boolean;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/roles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAsB,UAAU,EAAE,MAAM,cAAc,CAAC;AAInF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAShD,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMhD;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,IAAI,IAAI,EAAE,CAQlC;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAG5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,EAAE,CAElE;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,UAAU,EAAE,CAE9C;AAED,0GAA0G;AAC1G,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAS5E;AAED;;GAEG;AACH,qBAAa,QAAQ;aACmB,KAAK,EAAE,IAAI,EAAE;IAAjD,OAAO;IAEP,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ;IAKnD,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ;IAK/C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAGvC"}