@vertesia/studio-utils 1.5.0-dev.20260714.072725Z → 1.5.0-dev.20260717.131047Z

package/lib/apps/index.d.ts

@@ -0,0 +1,99 @@
+import type { AppManifestData, Endpoints } from '@vertesia/common';
+export interface ResolveAppEndpointOptions {
+    envName?: string;
+    vars?: Endpoints;
+    requestedOverride?: string;
+    version?: string;
+}
+/**
+ * Returns true if the given environment name is allowed as an endpoint override key.
+ * Any non-empty name is accepted except the reserved shared-deployment names.
+ */
+export declare function isValidEndpointOverrideEnv(envName: string): boolean;
+/**
+ * Substitutes `{{key}}` placeholders in a URL with the matching endpoint.
+ * Unknown placeholders are left untouched (so failures surface as fetch errors
+ * with the unresolved placeholder visible, rather than silently pointing nowhere).
+ * Trailing slashes on replacement values are stripped to avoid `//api/...` joins.
+ */
+export declare function substituteEndpoints(url: string, endpoints?: Endpoints): string;
+/**
+ * Resolves an app manifest endpoint to its package descriptor URL.
+ *
+ * Resolution has two modes:
+ *
+ * Gateway apps: if the base `endpoint` is an app-gateway URL, endpoint overrides
+ * are ignored. Gateway versions are resolved by rewriting the canonical gateway
+ * package URL itself:
+ * - `https://gw/tenants/t/apps/my-app`
+ *   -> `https://gw/tenants/t/apps/my-app/api/package`
+ * - `https://gw/tenants/t/package/my-app`
+ *   -> `https://gw/tenants/t/apps/my-app/api/package`
+ * - with `version: "1.2.3"`
+ *   -> `https://gw/tenants/t/apps/my-app/versions/1.2.3/api/package`
+ *
+ * Regular apps: endpoint overrides are supported in this order:
+ * 1. Version override: if `version` matches `endpoint_overrides[version]`, use
+ *    that URL. This lets regular, non-gateway apps expose version-pinned package
+ *    endpoints without going through the app gateway.
+ * 2. Explicit override: if `requestedOverride` matches an allowed
+ *    `endpoint_overrides` key, use that URL. Callers must still verify the user
+ *    is allowed to request that override.
+ * 3. Environment override: if `envName` matches an allowed `endpoint_overrides`
+ *    key, use that URL for deployment-env-specific endpoints.
+ * 4. Base endpoint: otherwise use `manifest.endpoint`.
+ * 5. Placeholder substitution: replace `{{gateway}}`, `{{studio}}`, etc. from
+ *    `vars`.
+ *
+ * Regular package URLs are returned unchanged:
+ * - `https://plugin.example.com/api/package`
+ *   -> `https://plugin.example.com/api/package`
+ *
+ * Non-standard package URLs are also returned unchanged, with a warning:
+ * - `https://plugin.example.com/exotic/pkg`
+ *   -> `https://plugin.example.com/exotic/pkg`
+ */
+export declare function resolveAppEndpoint(manifest: Pick<AppManifestData, 'endpoint' | 'endpoint_overrides'>, options?: ResolveAppEndpointOptions): string | undefined;
+/**
+ * Resolves all URL placeholders in a manifest in place (both `endpoint` and
+ * `tool_collections[].url`). Intended for server-side serialization.
+ *
+ * Mutates the manifest rather than returning a copy so it works cleanly with
+ * Mongoose populated subdocs.
+ */
+export declare function resolveManifestUrls(manifest: Partial<AppManifestData> | null | undefined, options?: ResolveAppEndpointOptions): void;
+/**
+ * Parse a gateway app endpoint into its parts. Accepts BOTH the canonical apps mount
+ * (`.../tenants/<t>/apps/<app>`), the canonical package route
+ * (`.../tenants/<t>/apps/<app>/api/package`), versioned package routes, AND the
+ * legacy package mount (`.../tenants/<t>/package/<app>`). Returns undefined for
+ * non-gateway endpoints.
+ */
+export declare function parseGatewayAppEndpoint(endpoint: string): {
+    origin: string;
+    tenant: string;
+    appId: string;
+    version?: string;
+} | undefined;
+/**
+ * Derives the runtime app API base from a package descriptor URL by removing the
+ * final path segment.
+ *
+ * Examples:
+ * - `https://plugin.example.com/api/package` -> `https://plugin.example.com/api`
+ * - `https://plugin.example.com/exotic/pkg` -> `https://plugin.example.com/exotic`
+ * - `https://gw/tenants/t/apps/my-app/api/package` -> `https://gw/tenants/t/apps/my-app/api`
+ */
+export declare function resolveAppApiBase(packageEndpoint: string): string;
+/**
+ * Resolves an app resource URL from a package descriptor endpoint and a path
+ * relative to the app `/api` base.
+ *
+ * Examples:
+ * - `resolveAppResource("https://plugin.example.com/api/package", "tools/main")`
+ *   -> `https://plugin.example.com/api/tools/main`
+ * - `resolveAppResource("https://gw/tenants/t/apps/my-app/api/package", "/interactions/x")`
+ *   -> `https://gw/tenants/t/apps/my-app/api/interactions/x`
+ */
+export declare function resolveAppResource(packageEndpoint: string, pathRelativeToApiBase: string): string;
+//# sourceMappingURL=index.d.ts.map

package/lib/apps/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/apps/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAwB,MAAM,kBAAkB,CAAC;AAYzF,MAAM,WAAW,yBAAyB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAYD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGnE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,CAO9E;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,kBAAkB,CAC9B,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,oBAAoB,CAAC,EAClE,OAAO,GAAE,yBAA8B,GACxC,MAAM,GAAG,SAAS,CAYpB;AAyCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,GAAG,SAAS,EACrD,OAAO,GAAE,yBAA8B,GACxC,IAAI,CAqBN;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACnC,QAAQ,EAAE,MAAM,GACjB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAUjF;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAMjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,GAAG,MAAM,CAKjG"}

package/lib/apps/index.js

@@ -0,0 +1,212 @@
+import { getStudioUtilsLogger } from '../logger.js';
+/**
+ * Reserved deployment environment names that may never be used as endpoint
+ * override keys. Reserving them prevents a manifest from hijacking auto-resolution
+ * on a shared production studio-server (whose environment is one of these).
+ */
+const RESERVED_ENDPOINT_OVERRIDE_ENVS = new Set(['production', 'preview', 'staging']);
+const GATEWAY_APP_ENDPOINT_PATTERN = new RegExp('^(.*)/tenants/([^/]+)/(?:' + 'package/([^/]+)|' + 'apps/([^/]+)(?:/versions/([^/]+))?(?:/api/package)?' + ')/?$');
+/**
+ * Returns true if the given environment name is allowed as an endpoint override key.
+ * Any non-empty name is accepted except the reserved shared-deployment names.
+ */
+export function isValidEndpointOverrideEnv(envName) {
+    if (!envName)
+        return false;
+    return !RESERVED_ENDPOINT_OVERRIDE_ENVS.has(envName.toLowerCase());
+}
+/**
+ * Substitutes `{{key}}` placeholders in a URL with the matching endpoint.
+ * Unknown placeholders are left untouched (so failures surface as fetch errors
+ * with the unresolved placeholder visible, rather than silently pointing nowhere).
+ * Trailing slashes on replacement values are stripped to avoid `//api/...` joins.
+ */
+export function substituteEndpoints(url, endpoints) {
+    if (!url || !endpoints)
+        return url;
+    return url.replace(/\{\{\s*(\w+)\s*\}\}/g, (match, key) => {
+        const value = endpoints[key];
+        if (typeof value !== 'string' || !value)
+            return match;
+        return trimTrailingSlashes(value);
+    });
+}
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/') {
+        end--;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+/**
+ * Resolves an app manifest endpoint to its package descriptor URL.
+ *
+ * Resolution has two modes:
+ *
+ * Gateway apps: if the base `endpoint` is an app-gateway URL, endpoint overrides
+ * are ignored. Gateway versions are resolved by rewriting the canonical gateway
+ * package URL itself:
+ * - `https://gw/tenants/t/apps/my-app`
+ *   -> `https://gw/tenants/t/apps/my-app/api/package`
+ * - `https://gw/tenants/t/package/my-app`
+ *   -> `https://gw/tenants/t/apps/my-app/api/package`
+ * - with `version: "1.2.3"`
+ *   -> `https://gw/tenants/t/apps/my-app/versions/1.2.3/api/package`
+ *
+ * Regular apps: endpoint overrides are supported in this order:
+ * 1. Version override: if `version` matches `endpoint_overrides[version]`, use
+ *    that URL. This lets regular, non-gateway apps expose version-pinned package
+ *    endpoints without going through the app gateway.
+ * 2. Explicit override: if `requestedOverride` matches an allowed
+ *    `endpoint_overrides` key, use that URL. Callers must still verify the user
+ *    is allowed to request that override.
+ * 3. Environment override: if `envName` matches an allowed `endpoint_overrides`
+ *    key, use that URL for deployment-env-specific endpoints.
+ * 4. Base endpoint: otherwise use `manifest.endpoint`.
+ * 5. Placeholder substitution: replace `{{gateway}}`, `{{studio}}`, etc. from
+ *    `vars`.
+ *
+ * Regular package URLs are returned unchanged:
+ * - `https://plugin.example.com/api/package`
+ *   -> `https://plugin.example.com/api/package`
+ *
+ * Non-standard package URLs are also returned unchanged, with a warning:
+ * - `https://plugin.example.com/exotic/pkg`
+ *   -> `https://plugin.example.com/exotic/pkg`
+ */
+export function resolveAppEndpoint(manifest, options = {}) {
+    if (!manifest.endpoint) {
+        return undefined;
+    }
+    const baseEndpoint = substituteEndpoints(manifest.endpoint, options.vars);
+    const gateway = parseGatewayAppEndpoint(baseEndpoint);
+    if (gateway) {
+        return resolveGatewayAppEndpoint(gateway, options.version);
+    }
+    return resolveRegularAppEndpoint(manifest, manifest.endpoint, options);
+}
+function resolveGatewayAppEndpoint(gateway, version) {
+    const effectiveVersion = version || gateway.version;
+    const versionSeg = effectiveVersion ? `/versions/${encodeURIComponent(effectiveVersion)}` : '';
+    return `${gateway.origin}/tenants/${gateway.tenant}/apps/${gateway.appId}${versionSeg}/api/package`;
+}
+function resolveRegularAppEndpoint(manifest, baseEndpoint, options) {
+    const { envName, vars, requestedOverride, version } = options;
+    let raw;
+    if (version && manifest.endpoint_overrides?.[version]) {
+        raw = manifest.endpoint_overrides[version];
+    }
+    else if (requestedOverride &&
+        manifest.endpoint_overrides?.[requestedOverride] &&
+        isValidEndpointOverrideEnv(requestedOverride)) {
+        raw = manifest.endpoint_overrides[requestedOverride];
+    }
+    else if (envName && manifest.endpoint_overrides?.[envName] && isValidEndpointOverrideEnv(envName)) {
+        raw = manifest.endpoint_overrides[envName];
+    }
+    else {
+        raw = baseEndpoint;
+    }
+    // Substitute the selected regular endpoint, not only the base endpoint:
+    // `raw` may be an override. Current server validation usually requires
+    // overrides to be absolute URLs, but keeping substitution here preserves
+    // compatibility if trusted/system manifests use placeholders in overrides.
+    const endpoint = substituteEndpoints(raw, vars);
+    warnIfNonStandardPackageEndpoint(endpoint);
+    return endpoint;
+}
+/**
+ * Resolves all URL placeholders in a manifest in place (both `endpoint` and
+ * `tool_collections[].url`). Intended for server-side serialization.
+ *
+ * Mutates the manifest rather than returning a copy so it works cleanly with
+ * Mongoose populated subdocs.
+ */
+export function resolveManifestUrls(manifest, options = {}) {
+    if (!manifest)
+        return;
+    const { vars } = options;
+    if (manifest.endpoint) {
+        const resolved = resolveAppEndpoint(manifest, options);
+        if (resolved && resolved !== manifest.endpoint) {
+            manifest.endpoint = resolved;
+        }
+    }
+    const toolCollections = manifest.tool_collections;
+    if (toolCollections && Array.isArray(toolCollections)) {
+        for (let i = 0; i < toolCollections.length; i++) {
+            const item = toolCollections[i];
+            if (item && typeof item === 'object' && item.url) {
+                const sub = substituteEndpoints(item.url, vars);
+                if (sub !== item.url)
+                    item.url = sub;
+            }
+        }
+    }
+}
+/**
+ * Parse a gateway app endpoint into its parts. Accepts BOTH the canonical apps mount
+ * (`.../tenants/<t>/apps/<app>`), the canonical package route
+ * (`.../tenants/<t>/apps/<app>/api/package`), versioned package routes, AND the
+ * legacy package mount (`.../tenants/<t>/package/<app>`). Returns undefined for
+ * non-gateway endpoints.
+ */
+export function parseGatewayAppEndpoint(endpoint) {
+    const m = GATEWAY_APP_ENDPOINT_PATTERN.exec(endpoint);
+    if (!m)
+        return undefined;
+    const [, origin, tenant, legacyAppId, appsAppId, version] = m;
+    return {
+        origin,
+        tenant,
+        appId: legacyAppId || appsAppId,
+        ...(version ? { version } : {}),
+    };
+}
+function warnIfNonStandardPackageEndpoint(endpoint) {
+    if (!isStandardPackageEndpoint(endpoint)) {
+        getStudioUtilsLogger().warn({ endpoint }, 'Non-standard app package endpoint; returning it unchanged during app endpoint resolution');
+    }
+}
+function isStandardPackageEndpoint(endpoint) {
+    try {
+        const url = new URL(endpoint);
+        return trimTrailingSlashes(url.pathname).endsWith('/package');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Derives the runtime app API base from a package descriptor URL by removing the
+ * final path segment.
+ *
+ * Examples:
+ * - `https://plugin.example.com/api/package` -> `https://plugin.example.com/api`
+ * - `https://plugin.example.com/exotic/pkg` -> `https://plugin.example.com/exotic`
+ * - `https://gw/tenants/t/apps/my-app/api/package` -> `https://gw/tenants/t/apps/my-app/api`
+ */
+export function resolveAppApiBase(packageEndpoint) {
+    const url = new URL(packageEndpoint);
+    const path = trimTrailingSlashes(url.pathname);
+    const lastSlash = path.lastIndexOf('/');
+    url.pathname = lastSlash <= 0 ? '/' : path.slice(0, lastSlash);
+    return url.toString();
+}
+/**
+ * Resolves an app resource URL from a package descriptor endpoint and a path
+ * relative to the app `/api` base.
+ *
+ * Examples:
+ * - `resolveAppResource("https://plugin.example.com/api/package", "tools/main")`
+ *   -> `https://plugin.example.com/api/tools/main`
+ * - `resolveAppResource("https://gw/tenants/t/apps/my-app/api/package", "/interactions/x")`
+ *   -> `https://gw/tenants/t/apps/my-app/api/interactions/x`
+ */
+export function resolveAppResource(packageEndpoint, pathRelativeToApiBase) {
+    const base = resolveAppApiBase(packageEndpoint);
+    const normalizedBase = base.endsWith('/') ? base.slice(0, -1) : base;
+    const normalizedPath = pathRelativeToApiBase.startsWith('/') ? pathRelativeToApiBase : `/${pathRelativeToApiBase}`;
+    return `${normalizedBase}${normalizedPath}`;
+}
+//# sourceMappingURL=index.js.map

package/lib/apps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/apps/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAkBpD;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,IAAI,MAAM,CAC3C,2BAA2B,GAAG,kBAAkB,GAAG,qDAAqD,GAAG,MAAM,CACpH,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CAAC,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,SAAqB;IAClE,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,CAAC;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAI,SAAgD,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACtC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,GAAG,EAAE,CAAC;IACV,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,kBAAkB,CAC9B,QAAkE,EAClE,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACV,OAAO,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,yBAAyB,CAC9B,OAA4E,EAC5E,OAAgB;IAEhB,MAAM,gBAAgB,GAAG,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,aAAa,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,OAAO,GAAG,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,KAAK,GAAG,UAAU,cAAc,CAAC;AACxG,CAAC;AAED,SAAS,yBAAyB,CAC9B,QAAqD,EACrD,YAAoB,EACpB,OAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC9D,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,GAAG,GAAG,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,IACH,iBAAiB;QACjB,QAAQ,CAAC,kBAAkB,EAAE,CAAC,iBAAiB,CAAC;QAChD,0BAA0B,CAAC,iBAAiB,CAAC,EAC/C,CAAC;QACC,GAAG,GAAG,QAAQ,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QAClG,GAAG,GAAG,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC;IACvB,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAC/B,QAAqD,EACrD,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAEzB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC7C,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACjC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,gBAAsD,CAAC;IACxF,IAAI,eAAe,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAChD,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG;oBAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;YACzC,CAAC;QACL,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACnC,QAAgB;IAEhB,MAAM,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO;QACH,MAAM;QACN,MAAM;QACN,KAAK,EAAE,WAAW,IAAI,SAAS;QAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACN,CAAC;AAED,SAAS,gCAAgC,CAAC,QAAgB;IACtD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,oBAAoB,EAAE,CAAC,IAAI,CACvB,EAAE,QAAQ,EAAE,EACZ,0FAA0F,CAC7F,CAAC;IACN,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,eAAuB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,GAAG,CAAC,QAAQ,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAuB,EAAE,qBAA6B;IACrF,MAAM,IAAI,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,cAAc,GAAG,qBAAqB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,qBAAqB,EAAE,CAAC;IACnH,OAAO,GAAG,cAAc,GAAG,cAAc,EAAE,CAAC;AAChD,CAAC"}

package/lib/vertesia-studio-utils.js

@@ -1,2 +1,2 @@
-import e from"handlebars";import{Permission as t,PromptSegmentDefType as n,SystemRoles as r,TemplateType as i}from"@vertesia/common";import{CompositeError as a,getFreeVariables as o,renderHandlebarsTemplate as s,renderJsTemplate as c}from"@vertesia/jst";function l(t){let n;try{n=e.parse(t)}catch{return new Set}let r=new Set,i=[],a=e=>i.some(t=>t.has(e)),o=e=>{if(!e||typeof e!=`object`)return;let t=e;switch(t.type){case`Program`:{let e=t.body;if(e)for(let t of e)o(t);break}case`BlockStatement`:{let e=t.params;if(e)for(let t of e)o(t);o(t.hash);let n=t.program,r=t.inverse,a=new Set([...n?.blockParams??[],...r?.blockParams??[]]);i.push(a),o(t.program),o(t.inverse),i.pop();break}case`MustacheStatement`:{let e=t.params,n=t.hash;if((e?.length??0)>0||(n?.pairs?.length??0)>0||o(t.path),e)for(let t of e)o(t);o(n);break}case`SubExpression`:{let e=t.params;if(e)for(let t of e)o(t);o(t.hash);break}case`PathExpression`:{if(t.data)break;let e=t.parts;if(!e||e.length===0)break;let n=e[0];if(a(n))break;r.add(n);break}case`Hash`:{let e=t.pairs;if(e)for(let t of e)o(t.value);break}default:break}};return o(n),r}function u(e,t=`value`){if(`$ref`in e)return`%${t}%`;switch((Array.isArray(e.type)?e.type:[e.type])[0]){case`string`:return`%${t}%`;case`number`:case`integer`:return Math.floor(Math.random()*101);case`boolean`:return!0;case`array`:{let n=e.items;if(n){let e=Math.floor(Math.random()*2)+1;return Array.from({length:e},(e,r)=>u(n,`${t}_${r}`))}return[]}case`object`:{let t={};if(e.properties)for(let[n,r]of Object.entries(e.properties))t[n]=u(r,n);return t}case`null`:return null;default:return`%${t}%`}}function d(e,t,n,r){return t===i.handlebars?s(e,r):t===i.text?e:c(e,[...n.properties?Object.keys(n.properties):[],`_model`],r)}function f(e,t,n){try{return{success:!0,content:d(e,i.jst,t,n)}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e)}}}function p(e,t,n){try{return{success:!0,content:d(e,i.handlebars,t,n)}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e)}}}function m(e,t){let n=v(e.configuration),r=t[n],i;return i=Array.isArray(r)?JSON.stringify(r,void 0,2):`No "${n}" property found on input data`,{title:`Chat history`,content:i}}function ee(e,t){if(!e.template)return{title:`(unknown segment)`,content:``,error:Error(`Prompt segment is missing its template`)};let n=e.template.inputSchema||{},r=`@${e.template.role}`;try{return{title:r,content:d(e.template.content,e.template.content_type,n,t),segmentId:e.template.id}}catch(t){return{title:r,content:t instanceof Error?t.message:String(t),segmentId:e.template.id,error:t instanceof Error?t:Error(String(t))}}}function h(e,t){let r=[];for(let i of e)i.type===n.chat?r.push(m(i,t)):i.type===n.template&&r.push(ee(i,t));return r}function g(e,t){try{return h(e,typeof t==`string`?JSON.parse(t.trim()):t||{})}catch(e){return e instanceof a?e.errors.map(e=>({error:e,title:`Rendering Error`,content:e.message})):[{error:e instanceof Error?e:Error(String(e)),title:`Rendering Error`,content:e instanceof Error?e.message:String(e)}]}}function _(e,t){let r=[];for(let i of e)if(i.template){let e=i.template.inputSchema||{},n=d(i.template.content,i.template.content_type,e,t);r.push({role:i.template.role,content:n})}else if(i.type===n.chat){let e=t[v(i.configuration)];if(!y(e))throw Error(`Chat prompt segment must have a messages array`);for(let t of e){if(!t.role)throw Error(`Chat prompt segment must have a role`);r.push({role:t.role,content:t.content})}}else throw Error(`Unknown prompt segment type: ${i.type}`);return r}function v(e){return typeof e==`object`&&e&&`chatKey`in e&&typeof e.chatKey==`string`?e.chatKey:`chat`}function y(e){return Array.isArray(e)&&e.every(b)}function b(e){return typeof e==`object`&&!!e&&`role`in e&&`content`in e}const x=[`_`,`Array`,`Set`,`_model`];function S(e){let t=0,n=0;for(let r of e)r.severity===`error`?t++:r.severity===`warning`&&n++;return{error_count:t,warning_count:n}}function te(e,t){let n=[],r=l(e),i=new Set(t?.properties?Object.keys(t.properties):[]);for(let e of r)i.has(e)||n.push({type:`undeclared_template_variable`,severity:`error`,variable:e,message:`Template references variable '{{${e}}}' but it is not declared in input_schema.properties. Add '${e}' to the schema with an appropriate type.`});for(let e of i)r.has(e)||n.push({type:`unused_schema_variable`,severity:`warning`,variable:e,message:`Schema declares property '${e}' but the template never references it. Remove it from input_schema or use it via {{${e}}}.`});let a=t??{},o=u(a),s=p(e,a,typeof o==`object`&&o&&!Array.isArray(o)?o:{});return s.success||n.push({type:`handlebars_render_error`,severity:`error`,message:`Handlebars rendering failed: ${s.error}`}),n}function ne(e,t){let n=[],r=new Set(t?.properties?Object.keys(t.properties):[]),i;try{let t=o(e,{globals:x,acorn:{allowReturnOutsideFunction:!0,locations:!0}});i=t.vars;for(let e of t.errors)n.push({type:`jst_unsafe_construct`,severity:`error`,message:`JST validation error at ${e.location}: ${e.message}`})}catch(e){return n.push({type:`jst_render_error`,severity:`error`,message:`JST parse failed: ${e instanceof Error?e.message:String(e)}`}),n}for(let e of i)r.has(e)||n.push({type:`undeclared_template_variable`,severity:`error`,variable:e,message:`Template references variable '${e}' but it is not declared in input_schema.properties. Add '${e}' to the schema with an appropriate type.`});for(let e of r)i.has(e)||n.push({type:`unused_schema_variable`,severity:`warning`,variable:e,message:`Schema declares property '${e}' but the template never references it. Remove it from input_schema or use it in the template.`});if(!n.some(e=>e.severity===`error`)){let i=u(t??{}),a=typeof i==`object`&&i&&!Array.isArray(i)?i:{};try{c(e,[...r],a)}catch(e){n.push({type:`jst_render_error`,severity:`error`,message:`JST rendering failed: ${e instanceof Error?e.message:String(e)}`})}}return n}function re(e){let t;t=e.contentType===i.handlebars?te(e.content,e.inputSchema):e.contentType===i.jst?ne(e.content,e.inputSchema):[];let{error_count:n,warning_count:r}=S(t);return{issues:t,error_count:n,warning_count:r}}var C=class{name;domain;permissions;constructor(e,t,n){this.name=e,this.domain=n,this.permissions=new Set(t)}hasPermission(e){return this.permissions.has(e)}},w=class extends C{constructor(e,t){super(e,t,`system`)}},T=class extends C{applicableScopes;constructor(e,t,n,r){super(e,t,n),this.applicableScopes=r}};const E=`content`,D=[`document`,`collection`];var O;(function(e){e.content_reader=`content:reader`,e.content_writer=`content:writer`,e.content_manager=`content:manager`})(O||={});var k=class extends T{constructor(){super(O.content_reader,[`read`],E,D)}},A=class extends T{constructor(){super(O.content_writer,[`read`,`write`],E,D)}},j=class extends T{constructor(){super(O.content_manager,[`read`,`write`,`delete`],E,D)}};const M={[O.content_reader]:new k,[O.content_writer]:new A,[O.content_manager]:new j},N={domain:E,roles:new Map(Object.entries(M))};var P=class extends w{constructor(e,n){super(e,[t.account_member,...n])}},F=class extends P{constructor(){super(r.owner,Object.values(t))}},I=class extends P{constructor(){super(r.admin,Object.values(t))}},L=class extends P{constructor(){super(r.manager,Object.values(t)),this.permissions.delete(t.account_admin),this.permissions.delete(t.manage_billing),this.permissions.delete(t.audit_read),this.permissions.delete(t.agent_run_read),this.permissions.delete(t.content_read_all),this.permissions.delete(t.content_superadmin),this.permissions.delete(t.workflow_superadmin)}},R=class extends P{constructor(){super(r.developer,Object.values(t)),this.permissions.delete(t.account_admin),this.permissions.delete(t.project_admin),this.permissions.delete(t.project_settings_write),this.permissions.delete(t.env_admin),this.permissions.delete(t.manage_billing),this.permissions.delete(t.audit_read),this.permissions.delete(t.agent_run_read),this.permissions.delete(t.content_read_all),this.permissions.delete(t.content_superadmin),this.permissions.delete(t.workflow_superadmin)}},z=class extends P{constructor(){super(r.application,[t.int_read,t.int_execute,t.int_write,t.run_read,t.content_write,t.content_read,t.content_write,t.content_admin,t.project_admin,t.workflow_run,t.project_settings_write,t.account_write])}},ie=class extends P{constructor(){super(r.automation,[t.content_read,t.content_write,t.content_admin,t.int_read,t.int_execute,t.run_read,t.workflow_run,t.project_integration_read])}},B=class extends P{constructor(){super(r.content_processor,[t.content_read,t.content_write,t.content_admin,t.content_superadmin,t.int_execute,t.workflow_read,t.workflow_run,t.run_read])}},V=class extends P{constructor(){super(r.consumer,[t.content_admin,t.content_read,t.content_write,t.content_delete,t.int_read,t.int_execute,t.run_read,t.workflow_run])}},H=class extends P{constructor(){super(r.executor,[t.int_execute,t.run_read,t.workflow_run])}},U=class extends P{constructor(){super(r.reader,[t.int_read,t.run_read,t.content_read])}};const W=[t.studio_access,t.account_read,t.project_integration_read,t.api_key_read,t.billing_read,t.audit_read,t.int_read,t.run_read,t.content_read,t.content_read_all,t.task_read,t.workflow_read,t.agent_run_read];var G=class extends P{constructor(e){super(e,W)}},K=class extends P{constructor(){super(r.billing,[t.manage_billing])}},q=class extends P{constructor(){super(r.app_member,[t.int_read,t.int_execute,t.int_write,t.run_read,t.content_write,t.content_read,t.content_delete,t.workflow_run])}},J=class extends R{constructor(){super(),this.name=r.content_superadmin,this.permissions.add(t.content_superadmin)}};const Y={[r.owner]:new F,[r.admin]:new I,[r.manager]:new L,[r.developer]:new R,[r.application]:new z,[r.automation]:new ie,[r.content_processor]:new B,[r.consumer]:new V,[r.executor]:new H,[r.reader]:new U,[r.auditor]:new G(r.auditor),[r.support]:new G(r.support),[r.billing]:new K,[r.app_member]:new q,[r.member]:new P(r.member,[]),[r.content_superadmin]:new J},X=[{domain:`system`,roles:new Map(Object.entries(Y))},N];function Z(e){for(let t of X){let n=t.roles.get(e);if(n)return n}throw Error(`Role ${e} not found`)}function Q(){let e=[];for(let t of X)for(let n of t.roles.values())e.push(n);return e}function ae(e){let t=X.find(t=>t.domain===e);return t?Array.from(t.roles.values()):[]}function oe(e){return Q().filter(t=>t instanceof T&&t.applicableScopes.includes(e))}function se(){return Q().filter(e=>e instanceof w)}function ce(){return Q().map(e=>e.name)}function le(e){let t=new Set;for(let n of e){let e=Z(n);for(let n of e.permissions)t.add(n)}return Array.from(t)}var $=class e{roles;constructor(e){this.roles=e}static fromRoleNames(t){return new e(t.map(e=>Z(e)))}static fromRoleName(t){return new e([Z(t)])}hasPermission(e){return this.roles.some(t=>t.hasPermission(e))}};export{T as AbacRole,O as ContentRoleNames,C as Role,$ as RoleList,w as SystemRole,p as executeHandlebars,f as executeJST,l as extractHandlebarsVariables,u as generateMockData,ce as getAllRoleNames,le as getPermissionsForRoles,Z as getRoleByName,oe as listAbacRolesForScope,Q as listRoles,ae as listRolesByDomain,se as listSystemRoles,_ as renderPrompt,h as renderSegments,g as renderSegmentsOrErrors,d as renderTemplate,re as validatePrompt};
+import e from"handlebars";import{Permission as t,PromptSegmentDefType as n,SystemRoles as r,TemplateType as i}from"@vertesia/common";import{CompositeError as a,getFreeVariables as o,renderHandlebarsTemplate as s,renderJsTemplate as c}from"@vertesia/jst";function l(t){let n;try{n=e.parse(t)}catch{return new Set}let r=new Set,i=[],a=e=>i.some(t=>t.has(e)),o=e=>{if(!e||typeof e!=`object`)return;let t=e;switch(t.type){case`Program`:{let e=t.body;if(e)for(let t of e)o(t);break}case`BlockStatement`:{let e=t.params;if(e)for(let t of e)o(t);o(t.hash);let n=t.program,r=t.inverse,a=new Set([...n?.blockParams??[],...r?.blockParams??[]]);i.push(a),o(t.program),o(t.inverse),i.pop();break}case`MustacheStatement`:{let e=t.params,n=t.hash;if((e?.length??0)>0||(n?.pairs?.length??0)>0||o(t.path),e)for(let t of e)o(t);o(n);break}case`SubExpression`:{let e=t.params;if(e)for(let t of e)o(t);o(t.hash);break}case`PathExpression`:{if(t.data)break;let e=t.parts;if(!e||e.length===0)break;let n=e[0];if(a(n))break;r.add(n);break}case`Hash`:{let e=t.pairs;if(e)for(let t of e)o(t.value);break}default:break}};return o(n),r}function u(e,t=`value`){if(`$ref`in e)return`%${t}%`;switch((Array.isArray(e.type)?e.type:[e.type])[0]){case`string`:return`%${t}%`;case`number`:case`integer`:return Math.floor(Math.random()*101);case`boolean`:return!0;case`array`:{let n=e.items;if(n){let e=Math.floor(Math.random()*2)+1;return Array.from({length:e},(e,r)=>u(n,`${t}_${r}`))}return[]}case`object`:{let t={};if(e.properties)for(let[n,r]of Object.entries(e.properties))t[n]=u(r,n);return t}case`null`:return null;default:return`%${t}%`}}function d(e,t,n,r){return t===i.handlebars?s(e,r):t===i.text?e:c(e,[...n.properties?Object.keys(n.properties):[],`_model`],r)}function f(e,t,n){try{return{success:!0,content:d(e,i.jst,t,n)}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e)}}}function p(e,t,n){try{return{success:!0,content:d(e,i.handlebars,t,n)}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e)}}}function m(e,t){let n=v(e.configuration),r=t[n],i;return i=Array.isArray(r)?JSON.stringify(r,void 0,2):`No "${n}" property found on input data`,{title:`Chat history`,content:i}}function ee(e,t){if(!e.template)return{title:`(unknown segment)`,content:``,error:Error(`Prompt segment is missing its template`)};let n=e.template.inputSchema||{},r=`@${e.template.role}`;try{return{title:r,content:d(e.template.content,e.template.content_type,n,t),segmentId:e.template.id}}catch(t){return{title:r,content:t instanceof Error?t.message:String(t),segmentId:e.template.id,error:t instanceof Error?t:Error(String(t))}}}function h(e,t){let r=[];for(let i of e)i.type===n.chat?r.push(m(i,t)):i.type===n.template&&r.push(ee(i,t));return r}function g(e,t){try{return h(e,typeof t==`string`?JSON.parse(t.trim()):t||{})}catch(e){return e instanceof a?e.errors.map(e=>({error:e,title:`Rendering Error`,content:e.message})):[{error:e instanceof Error?e:Error(String(e)),title:`Rendering Error`,content:e instanceof Error?e.message:String(e)}]}}function _(e,t){let r=[];for(let i of e)if(i.template){let e=i.template.inputSchema||{},n=d(i.template.content,i.template.content_type,e,t);r.push({role:i.template.role,content:n})}else if(i.type===n.chat){let e=t[v(i.configuration)];if(!y(e))throw Error(`Chat prompt segment must have a messages array`);for(let t of e){if(!t.role)throw Error(`Chat prompt segment must have a role`);r.push({role:t.role,content:t.content})}}else throw Error(`Unknown prompt segment type: ${i.type}`);return r}function v(e){return typeof e==`object`&&e&&`chatKey`in e&&typeof e.chatKey==`string`?e.chatKey:`chat`}function y(e){return Array.isArray(e)&&e.every(b)}function b(e){return typeof e==`object`&&!!e&&`role`in e&&`content`in e}const x=[`_`,`Array`,`Set`,`_model`];function S(e){let t=0,n=0;for(let r of e)r.severity===`error`?t++:r.severity===`warning`&&n++;return{error_count:t,warning_count:n}}function te(e,t){let n=[],r=l(e),i=new Set(t?.properties?Object.keys(t.properties):[]);for(let e of r)i.has(e)||n.push({type:`undeclared_template_variable`,severity:`error`,variable:e,message:`Template references variable '{{${e}}}' but it is not declared in input_schema.properties. Add '${e}' to the schema with an appropriate type.`});for(let e of i)r.has(e)||n.push({type:`unused_schema_variable`,severity:`warning`,variable:e,message:`Schema declares property '${e}' but the template never references it. Remove it from input_schema or use it via {{${e}}}.`});let a=t??{},o=u(a),s=p(e,a,typeof o==`object`&&o&&!Array.isArray(o)?o:{});return s.success||n.push({type:`handlebars_render_error`,severity:`error`,message:`Handlebars rendering failed: ${s.error}`}),n}function ne(e,t){let n=[],r=new Set(t?.properties?Object.keys(t.properties):[]),i;try{let t=o(e,{globals:x,acorn:{allowReturnOutsideFunction:!0,locations:!0}});i=t.vars;for(let e of t.errors)n.push({type:`jst_unsafe_construct`,severity:`error`,message:`JST validation error at ${e.location}: ${e.message}`})}catch(e){return n.push({type:`jst_render_error`,severity:`error`,message:`JST parse failed: ${e instanceof Error?e.message:String(e)}`}),n}for(let e of i)r.has(e)||n.push({type:`undeclared_template_variable`,severity:`error`,variable:e,message:`Template references variable '${e}' but it is not declared in input_schema.properties. Add '${e}' to the schema with an appropriate type.`});for(let e of r)i.has(e)||n.push({type:`unused_schema_variable`,severity:`warning`,variable:e,message:`Schema declares property '${e}' but the template never references it. Remove it from input_schema or use it in the template.`});if(!n.some(e=>e.severity===`error`)){let i=u(t??{}),a=typeof i==`object`&&i&&!Array.isArray(i)?i:{};try{c(e,[...r],a)}catch(e){n.push({type:`jst_render_error`,severity:`error`,message:`JST rendering failed: ${e instanceof Error?e.message:String(e)}`})}}return n}function re(e){let t;t=e.contentType===i.handlebars?te(e.content,e.inputSchema):e.contentType===i.jst?ne(e.content,e.inputSchema):[];let{error_count:n,warning_count:r}=S(t);return{issues:t,error_count:n,warning_count:r}}var C=class{name;domain;permissions;constructor(e,t,n){this.name=e,this.domain=n,this.permissions=new Set(t)}hasPermission(e){return this.permissions.has(e)}},w=class extends C{constructor(e,t){super(e,t,`system`)}},T=class extends C{applicableScopes;constructor(e,t,n,r){super(e,t,n),this.applicableScopes=r}};const E=`content`,D=[`document`,`collection`];var O;(function(e){e.content_reader=`content:reader`,e.content_writer=`content:writer`,e.content_manager=`content:manager`})(O||={});var k=class extends T{constructor(){super(O.content_reader,[`read`],E,D)}},A=class extends T{constructor(){super(O.content_writer,[`read`,`write`],E,D)}},j=class extends T{constructor(){super(O.content_manager,[`read`,`write`,`delete`],E,D)}};const M={[O.content_reader]:new k,[O.content_writer]:new A,[O.content_manager]:new j},N={domain:E,roles:new Map(Object.entries(M))};var P=class extends w{constructor(e,n){super(e,[t.account_member,...n])}},F=class extends P{constructor(){super(r.owner,Object.values(t))}},I=class extends P{constructor(){super(r.admin,Object.values(t))}},L=class extends P{constructor(){super(r.manager,Object.values(t)),this.permissions.delete(t.account_admin),this.permissions.delete(t.manage_billing),this.permissions.delete(t.audit_read),this.permissions.delete(t.agent_run_read),this.permissions.delete(t.content_read_all),this.permissions.delete(t.content_superadmin),this.permissions.delete(t.workflow_superadmin)}},R=class extends P{constructor(){super(r.developer,Object.values(t)),this.permissions.delete(t.account_admin),this.permissions.delete(t.project_admin),this.permissions.delete(t.project_settings_write),this.permissions.delete(t.env_admin),this.permissions.delete(t.manage_billing),this.permissions.delete(t.audit_read),this.permissions.delete(t.agent_run_read),this.permissions.delete(t.content_read_all),this.permissions.delete(t.content_superadmin),this.permissions.delete(t.workflow_superadmin)}},z=class extends P{constructor(){super(r.application,[t.int_read,t.int_execute,t.int_write,t.run_read,t.content_write,t.content_read,t.content_write,t.content_admin,t.project_admin,t.workflow_run,t.project_settings_write,t.account_write])}},ie=class extends P{constructor(){super(r.automation,[t.content_read,t.content_write,t.content_admin,t.int_read,t.int_execute,t.run_read,t.workflow_run,t.project_integration_read])}},B=class extends P{constructor(){super(r.content_processor,[t.content_read,t.content_write,t.content_admin,t.content_superadmin,t.int_execute,t.workflow_read,t.workflow_run,t.run_read])}},V=class extends P{constructor(){super(r.consumer,[t.content_admin,t.content_read,t.content_write,t.content_delete,t.int_read,t.int_execute,t.run_read,t.workflow_run])}},H=class extends P{constructor(){super(r.executor,[t.int_execute,t.run_read,t.workflow_run])}},U=class extends P{constructor(){super(r.reader,[t.int_read,t.run_read,t.content_read])}};const W=[t.studio_access,t.account_read,t.project_integration_read,t.api_key_read,t.billing_read,t.audit_read,t.int_read,t.run_read,t.content_read,t.content_read_all,t.task_read,t.workflow_read,t.agent_run_read];var G=class extends P{constructor(e){super(e,W)}},K=class extends P{constructor(){super(r.billing,[t.manage_billing])}},q=class extends P{constructor(){super(r.app_member,[t.int_read,t.int_execute,t.int_write,t.run_read,t.content_write,t.content_read,t.content_delete,t.workflow_run])}},J=class extends R{constructor(){super(),this.name=r.content_superadmin,this.permissions.add(t.content_superadmin)}};const Y={[r.owner]:new F,[r.admin]:new I,[r.manager]:new L,[r.developer]:new R,[r.application]:new z,[r.automation]:new ie,[r.content_processor]:new B,[r.consumer]:new V,[r.executor]:new H,[r.reader]:new U,[r.auditor]:new G(r.auditor),[r.support]:new G(r.support),[r.billing]:new K,[r.app_member]:new q,[r.member]:new P(r.member,[]),[r.content_superadmin]:new J},X=[{domain:`system`,roles:new Map(Object.entries(Y))},N];function Z(e){for(let t of X){let n=t.roles.get(e);if(n)return n}throw Error(`Role ${e} not found`)}function Q(){let e=[];for(let t of X)for(let n of t.roles.values())e.push(n);return e}function ae(e){let t=X.find(t=>t.domain===e);return t?Array.from(t.roles.values()):[]}function oe(e){return Q().filter(t=>t instanceof T&&t.applicableScopes.includes(e))}function se(){return Q().filter(e=>e instanceof w)}function ce(){return Q().map(e=>e.name)}function le(e){let t=new Set;for(let n of e){let e=Z(n);for(let n of e.permissions)t.add(n)}return Array.from(t)}var $=class e{roles;constructor(e){this.roles=e}static fromRoleNames(t){let n=t.map(e=>Z(e));return new e(n)}static fromRoleName(t){let n=[Z(t)];return new e(n)}hasPermission(e){return this.roles.some(t=>t.hasPermission(e))}};export{T as AbacRole,O as ContentRoleNames,C as Role,$ as RoleList,w as SystemRole,p as executeHandlebars,f as executeJST,l as extractHandlebarsVariables,u as generateMockData,ce as getAllRoleNames,le as getPermissionsForRoles,Z as getRoleByName,oe as listAbacRolesForScope,Q as listRoles,ae as listRolesByDomain,se as listSystemRoles,_ as renderPrompt,h as renderSegments,g as renderSegmentsOrErrors,d as renderTemplate,re as validatePrompt};
 //# sourceMappingURL=vertesia-studio-utils.js.map

package/lib/vertesia-studio-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"vertesia-studio-utils.js","names":[],"sources":["prompts/extract-vars.js","prompts/mock-data.js","prompts/render.js","prompts/validate.js","roles/classes.js","roles/content.js","roles/system.js","roles/index.js"],"sourcesContent":["import Handlebars from 'handlebars';\n/**\n * Extract the set of root-level variable names referenced by a Handlebars template.\n *\n * - `{{foo}}` → `foo`\n * - `{{obj.bar.baz}}` → `obj` (only the root identifier; nested access doesn't add `bar` or `baz`)\n * - `{{#if cond}}{{name}}{{/if}}` → `cond`, `name`\n * - `{{#each items as |item|}}{{item.name}}{{/each}}` → `items` (NOT `item` — bound by `as |item|`)\n * - `{{lookup obj key}}` → `obj`, `key` (helper name skipped)\n * - `{{@index}}`, `{{this}}` → ignored (built-in data vars / self)\n *\n * Helper names in mustaches and block heads (`{{customHelper x}}`, `{{#if x}}`) are NOT added to\n * the set — only the arguments and inner template references are. This matches the typical use\n * case for prompt validation: detect which schema properties the template actually reads.\n *\n * Returns an empty set on parse failure — callers should also run a syntactic render check\n * (e.g. `executeHandlebars`) to surface parse errors separately.\n */\nexport function extractHandlebarsVariables(template) {\n    let ast;\n    try {\n        ast = Handlebars.parse(template);\n    }\n    catch {\n        return new Set();\n    }\n    const variables = new Set();\n    const localScopes = [];\n    const isLocal = (name) => localScopes.some((scope) => scope.has(name));\n    const visit = (node) => {\n        if (!node || typeof node !== 'object')\n            return;\n        const n = node;\n        switch (n.type) {\n            case 'Program': {\n                const body = n.body;\n                if (body)\n                    for (const stmt of body)\n                        visit(stmt);\n                break;\n            }\n            case 'BlockStatement': {\n                // n.path is the helper name (`#if`, `#each`, `#customBlock`) — never a variable.\n                // Visit params + hash to capture variables passed to the block helper.\n                const params = n.params;\n                if (params)\n                    for (const p of params)\n                        visit(p);\n                visit(n.hash);\n                // Track `as |x y|` block params — these are local bindings, not variables.\n                const program = n.program;\n                const inverse = n.inverse;\n                const scope = new Set([...(program?.blockParams ?? []), ...(inverse?.blockParams ?? [])]);\n                localScopes.push(scope);\n                visit(n.program);\n                visit(n.inverse);\n                localScopes.pop();\n                break;\n            }\n            case 'MustacheStatement': {\n                // Bare mustache (no params, no hash) → it's a variable reference.\n                // With params/hash, it's a helper call — skip the path (helper name), visit args.\n                const params = n.params;\n                const hash = n.hash;\n                const isHelperCall = (params?.length ?? 0) > 0 || (hash?.pairs?.length ?? 0) > 0;\n                if (!isHelperCall) {\n                    visit(n.path);\n                }\n                if (params)\n                    for (const p of params)\n                        visit(p);\n                visit(hash);\n                break;\n            }\n            case 'SubExpression': {\n                // (helper arg1 arg2) — helper name in path is skipped, args carry variables.\n                const params = n.params;\n                if (params)\n                    for (const p of params)\n                        visit(p);\n                visit(n.hash);\n                break;\n            }\n            case 'PathExpression': {\n                if (n.data)\n                    break; // `@-data` references (@index, @key, etc.)\n                const parts = n.parts;\n                if (!parts || parts.length === 0)\n                    break; // `this` / `.`\n                const root = parts[0];\n                if (isLocal(root))\n                    break;\n                variables.add(root);\n                break;\n            }\n            case 'Hash': {\n                const pairs = n.pairs;\n                if (pairs)\n                    for (const pair of pairs)\n                        visit(pair.value);\n                break;\n            }\n            // ContentStatement, CommentStatement, *Literal, PartialStatement — no variables to extract.\n            default:\n                break;\n        }\n    };\n    visit(ast);\n    return variables;\n}\n//# sourceMappingURL=extract-vars.js.map","/**\n * Generate mock data that satisfies a JSON Schema.\n *\n * - string → `%property_name%` (visible placeholder, useful for previews and validation render tests)\n * - number/integer → random value 0–100\n * - boolean → true\n * - array → 1–2 items recursively generated from the items schema\n * - object → recursively populated from properties\n * - null → null\n * - $ref or unknown → `%property_name%`\n *\n * @param schema JSON schema to generate data for\n * @param propertyName Name used for string placeholders (default `value`)\n */\nexport function generateMockData(schema, propertyName = 'value') {\n    if ('$ref' in schema) {\n        return `%${propertyName}%`;\n    }\n    const types = Array.isArray(schema.type) ? schema.type : [schema.type];\n    const primaryType = types[0];\n    switch (primaryType) {\n        case 'string':\n            return `%${propertyName}%`;\n        case 'number':\n        case 'integer':\n            return Math.floor(Math.random() * 101);\n        case 'boolean':\n            return true;\n        case 'array': {\n            const itemSchema = schema.items;\n            if (itemSchema) {\n                const itemCount = Math.floor(Math.random() * 2) + 1;\n                return Array.from({ length: itemCount }, (_, index) => generateMockData(itemSchema, `${propertyName}_${index}`));\n            }\n            return [];\n        }\n        case 'object': {\n            const result = {};\n            if (schema.properties) {\n                for (const [propName, propSchema] of Object.entries(schema.properties)) {\n                    result[propName] = generateMockData(propSchema, propName);\n                }\n            }\n            return result;\n        }\n        case 'null':\n            return null;\n        default:\n            return `%${propertyName}%`;\n    }\n}\n//# sourceMappingURL=mock-data.js.map","import { PromptSegmentDefType, TemplateType } from '@vertesia/common';\nimport { CompositeError, renderHandlebarsTemplate, renderJsTemplate } from '@vertesia/jst';\n/**\n * Render a prompt template with the given input data.\n *\n * Handlebars templates use {{variable}} interpolation against `data`.\n * JST (JavaScript template) bodies evaluate against `data` with the schema's top-level\n * property names exposed as globals, plus `_model` — the active model id, which the\n * studio-server executor injects into the input as `{ ..._model: run.modelId }` when\n * executing an interaction (see `apps/studio-server/src/executor/ExecutionRequest.ts`\n * and `apps/studio-server/src/executor/rendering/template.ts`). Listing it here keeps\n * the Playground preview and `validatePrompt` in sync with runtime resolution — a JST\n * template referencing `_model` validates fine here and renders fine in production.\n *\n * For `TemplateType.text`, the content is returned verbatim — it is static text, not a\n * template — matching the studio-server executor (see `apps/studio-server/src/executor/\n * rendering/template.ts`). Routing it through the JST evaluator would compile the prose as\n * JavaScript and throw on any plain sentence (e.g. \"You are a helpful assistant.\").\n */\nexport function renderTemplate(code, contentType, schema, data) {\n    if (contentType === TemplateType.handlebars) {\n        return renderHandlebarsTemplate(code, data);\n    }\n    if (contentType === TemplateType.text) {\n        return code;\n    }\n    const globals = [...(schema.properties ? Object.keys(schema.properties) : []), '_model'];\n    return renderJsTemplate(code, globals, data);\n}\n/**\n * Execute a JST (JavaScript Template) with given data.\n * Returns a discriminated union to surface errors without throwing.\n */\nexport function executeJST(jstContent, schema, data) {\n    try {\n        const result = renderTemplate(jstContent, TemplateType.jst, schema, data);\n        return { success: true, content: result };\n    }\n    catch (error) {\n        return { success: false, error: error instanceof Error ? error.message : String(error) };\n    }\n}\n/**\n * Execute a Handlebars template with given data.\n * Returns a discriminated union to surface errors without throwing.\n */\nexport function executeHandlebars(handlebarsContent, schema, data) {\n    try {\n        const result = renderTemplate(handlebarsContent, TemplateType.handlebars, schema, data);\n        return { success: true, content: result };\n    }\n    catch (error) {\n        return { success: false, error: error instanceof Error ? error.message : String(error) };\n    }\n}\nfunction renderChatSegment(segment, data) {\n    const chatKey = getChatKey(segment.configuration);\n    const chat = data[chatKey];\n    let content;\n    if (Array.isArray(chat)) {\n        content = JSON.stringify(chat, undefined, 2);\n    }\n    else {\n        content = `No \"${chatKey}\" property found on input data`;\n    }\n    return {\n        title: 'Chat history',\n        content,\n    };\n}\nfunction renderTemplateSegment(segment, data) {\n    if (!segment.template) {\n        return { title: '(unknown segment)', content: '', error: new Error('Prompt segment is missing its template') };\n    }\n    const schema = segment.template.inputSchema || {};\n    const title = `@${segment.template.role}`;\n    try {\n        const content = renderTemplate(segment.template.content, segment.template.content_type, schema, data);\n        return { title, content, segmentId: segment.template.id };\n    }\n    catch (error) {\n        // Isolate the failure to this segment so the remaining segments still render.\n        return {\n            title,\n            content: error instanceof Error ? error.message : String(error),\n            segmentId: segment.template.id,\n            error: error instanceof Error ? error : new Error(String(error)),\n        };\n    }\n}\nexport function renderSegments(segments, data) {\n    const out = [];\n    for (const segment of segments) {\n        if (segment.type === PromptSegmentDefType.chat) {\n            out.push(renderChatSegment(segment, data));\n        }\n        else if (segment.type === PromptSegmentDefType.template) {\n            out.push(renderTemplateSegment(segment, data));\n        }\n    }\n    return out;\n}\nexport function renderSegmentsOrErrors(segments, textOrObject) {\n    try {\n        return renderSegments(segments, typeof textOrObject === 'string' ? JSON.parse(textOrObject.trim()) : textOrObject || {});\n    }\n    catch (error) {\n        if (error instanceof CompositeError) {\n            return error.errors.map((err) => ({\n                error: err,\n                title: 'Rendering Error',\n                content: err.message,\n            }));\n        }\n        return [\n            {\n                error: error instanceof Error ? error : new Error(String(error)),\n                title: 'Rendering Error',\n                content: error instanceof Error ? error.message : String(error),\n            },\n        ];\n    }\n}\nexport function renderPrompt(segments, payload) {\n    const out = [];\n    for (const segment of segments) {\n        if (segment.template) {\n            const schema = segment.template.inputSchema || {};\n            const content = renderTemplate(segment.template.content, segment.template.content_type, schema, payload);\n            out.push({ role: segment.template.role, content });\n        }\n        else if (segment.type === PromptSegmentDefType.chat) {\n            const chatKey = getChatKey(segment.configuration);\n            const messages = payload[chatKey];\n            if (!isPromptSegmentArray(messages)) {\n                throw new Error('Chat prompt segment must have a messages array');\n            }\n            for (const msg of messages) {\n                if (!msg.role) {\n                    throw new Error('Chat prompt segment must have a role');\n                }\n                out.push({ role: msg.role, content: msg.content });\n            }\n        }\n        else {\n            throw new Error(`Unknown prompt segment type: ${segment.type}`);\n        }\n    }\n    return out;\n}\nfunction getChatKey(configuration) {\n    if (typeof configuration === 'object' &&\n        configuration !== null &&\n        'chatKey' in configuration &&\n        typeof configuration.chatKey === 'string') {\n        return configuration.chatKey;\n    }\n    return 'chat';\n}\nfunction isPromptSegmentArray(value) {\n    return Array.isArray(value) && value.every(isPromptSegment);\n}\nfunction isPromptSegment(value) {\n    return typeof value === 'object' && value !== null && 'role' in value && 'content' in value;\n}\n//# sourceMappingURL=render.js.map","import { TemplateType } from '@vertesia/common';\nimport { getFreeVariables, renderJsTemplate } from '@vertesia/jst';\nimport { extractHandlebarsVariables } from './extract-vars.js';\nimport { generateMockData } from './mock-data.js';\nimport { executeHandlebars } from './render.js';\n// JST's renderJsTemplate auto-adds `_` (helpers object) and runtime injects `Set` and `Array`\n// — treat them as globals so they don't appear as free vars in user templates.\n// Globals always available to JST templates regardless of schema:\n//  - `_`, `Array`, `Set`: runtime-injected by `renderJsTemplate` (jst library)\n//  - `_model`: runtime-injected by the studio-server executor as `{ ..._model: run.modelId }`\n//    (see ExecutionRequest.ts:313 and executor/rendering/template.ts:13)\n// Keeping these in sync with `renderTemplate` in ./render.ts so a JST template that runs in\n// production also passes the validator.\nconst JST_AUTO_GLOBALS = ['_', 'Array', 'Set', '_model'];\nfunction countSeverities(issues) {\n    let error_count = 0;\n    let warning_count = 0;\n    for (const issue of issues) {\n        if (issue.severity === 'error') {\n            error_count++;\n        }\n        else if (issue.severity === 'warning') {\n            warning_count++;\n        }\n    }\n    return { error_count, warning_count };\n}\nfunction validateHandlebarsPrompt(content, inputSchema) {\n    const issues = [];\n    const usedVars = extractHandlebarsVariables(content);\n    const declaredVars = new Set(inputSchema?.properties ? Object.keys(inputSchema.properties) : []);\n    for (const used of usedVars) {\n        if (!declaredVars.has(used)) {\n            issues.push({\n                type: 'undeclared_template_variable',\n                severity: 'error',\n                variable: used,\n                message: `Template references variable '{{${used}}}' but it is not declared in input_schema.properties. Add '${used}' to the schema with an appropriate type.`,\n            });\n        }\n    }\n    for (const declared of declaredVars) {\n        if (!usedVars.has(declared)) {\n            issues.push({\n                type: 'unused_schema_variable',\n                severity: 'warning',\n                variable: declared,\n                message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or use it via {{${declared}}}.`,\n            });\n        }\n    }\n    // Render-time smoke test — always runs so syntax errors and failing helper calls are\n    // surfaced even when undeclared-variable errors are already in the list. Handlebars renders\n    // missing vars as empty strings (non-strict by default), so the render check does NOT echo\n    // the var errors — anything it reports is a distinct template problem worth showing.\n    const renderSchema = inputSchema ?? {};\n    const mockData = generateMockData(renderSchema);\n    const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData) ? mockData : {};\n    const renderResult = executeHandlebars(content, renderSchema, mockObject);\n    if (!renderResult.success) {\n        issues.push({\n            type: 'handlebars_render_error',\n            severity: 'error',\n            message: `Handlebars rendering failed: ${renderResult.error}`,\n        });\n    }\n    return issues;\n}\nfunction validateJstPrompt(content, inputSchema) {\n    const issues = [];\n    const declaredVars = new Set(inputSchema?.properties ? Object.keys(inputSchema.properties) : []);\n    let referenced;\n    try {\n        const result = getFreeVariables(content, {\n            globals: JST_AUTO_GLOBALS,\n            acorn: { allowReturnOutsideFunction: true, locations: true },\n        });\n        referenced = result.vars;\n        for (const err of result.errors) {\n            issues.push({\n                type: 'jst_unsafe_construct',\n                severity: 'error',\n                message: `JST validation error at ${err.location}: ${err.message}`,\n            });\n        }\n    }\n    catch (parseError) {\n        // Acorn parse failure — surface as render error since the template can't be compiled.\n        issues.push({\n            type: 'jst_render_error',\n            severity: 'error',\n            message: `JST parse failed: ${parseError instanceof Error ? parseError.message : String(parseError)}`,\n        });\n        return issues;\n    }\n    for (const used of referenced) {\n        if (!declaredVars.has(used)) {\n            issues.push({\n                type: 'undeclared_template_variable',\n                severity: 'error',\n                variable: used,\n                message: `Template references variable '${used}' but it is not declared in input_schema.properties. Add '${used}' to the schema with an appropriate type.`,\n            });\n        }\n    }\n    for (const declared of declaredVars) {\n        if (!referenced.has(declared)) {\n            issues.push({\n                type: 'unused_schema_variable',\n                severity: 'warning',\n                variable: declared,\n                message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or use it in the template.`,\n            });\n        }\n    }\n    // Render-time smoke test — only if there are no blocking errors so far, otherwise\n    // the failure mode would just echo what we already reported.\n    const blockingSoFar = issues.some((i) => i.severity === 'error');\n    if (!blockingSoFar) {\n        const renderSchema = inputSchema ?? {};\n        const mockData = generateMockData(renderSchema);\n        const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData)\n            ? mockData\n            : {};\n        try {\n            renderJsTemplate(content, [...declaredVars], mockObject);\n        }\n        catch (renderError) {\n            issues.push({\n                type: 'jst_render_error',\n                severity: 'error',\n                message: `JST rendering failed: ${renderError instanceof Error ? renderError.message : String(renderError)}`,\n            });\n        }\n    }\n    return issues;\n}\n/**\n * Validate a single prompt template against its declared input schema.\n *\n * For `handlebars` and `jst` templates, the following checks are performed:\n *  1. Every variable referenced in the template must be declared as a top-level property\n *     in `inputSchema.properties` (else → `undeclared_template_variable` error).\n *  2. Every property declared in `inputSchema.properties` should be referenced by the template\n *     (else → `unused_schema_variable` warning — non-blocking).\n *  3. The template must render successfully against schema-derived mock data\n *     (else → `handlebars_render_error` / `jst_render_error` error).\n *  4. For JST only: unsafe constructs (`with`, `for`, `while`, `import`, class, `this`,\n *     dynamic property lookup, blacklisted props) → `jst_unsafe_construct` error.\n *\n * `text` content type passes through with no issues.\n */\nexport function validatePrompt(input) {\n    let issues;\n    if (input.contentType === TemplateType.handlebars) {\n        issues = validateHandlebarsPrompt(input.content, input.inputSchema);\n    }\n    else if (input.contentType === TemplateType.jst) {\n        issues = validateJstPrompt(input.content, input.inputSchema);\n    }\n    else {\n        issues = [];\n    }\n    const { error_count, warning_count } = countSeverities(issues);\n    return { issues, error_count, warning_count };\n}\n//# sourceMappingURL=validate.js.map","/**\n * Class hierarchy and registry-bound interface for the role system. These\n * are LOGIC — they have runtime behavior (constructors, instance methods,\n * subclass dispatch via `instanceof`). They live in `@vertesia/studio-utils`\n * (not common) per the package-layering contract: only types stay in common.\n */\n/**\n * A role: a named bundle of permissions that ACEs reference by name.\n *\n * Generic over the permission type so subclasses can tighten it:\n *  - **System roles** declare `extends Role<Permission>` — construction time\n *    type-checks against the central `Permission` enum.\n *  - **ABAC roles** (`AbacRole`) declare `extends Role<string>` — permissions\n *    are bare verbs (`'read'`, `'write'`, `'delete'`, future domain-specific\n *    verbs) consumed by the JWT generator to form `{scope}:{verb}` keys in\n *    `content_security`.\n *\n * The registry stores `Role` (defaulting to `Role<string>`) — the loose type\n * is the lowest common denominator. Tight typing is only enforced at\n * declaration sites of the role subclasses.\n */\nexport class Role {\n    name;\n    domain;\n    permissions;\n    constructor(name, permissions, domain) {\n        this.name = name;\n        this.domain = domain;\n        this.permissions = new Set(permissions);\n    }\n    hasPermission(permission) {\n        return this.permissions.has(permission);\n    }\n}\n/**\n * Base class for built-in system roles. Hardcodes `domain: 'system'` and\n * specializes `Role<Permission>` so subclasses get compile-time type-checking\n * against the central `Permission` enum at construction.\n */\nexport class SystemRole extends Role {\n    constructor(name, permissions) {\n        super(name, permissions, 'system');\n    }\n}\n/**\n * A role usable in ResourceSet ACEs. Adds `applicableScopes` — the kinds of\n * objects the role can be applied to at the ABAC scope level. Inherits\n * `Role<string>` because ABAC verbs aren't constrained to the central\n * `Permission` enum.\n *\n * The IAM UI filters via `listAbacRolesForScope` which checks `instanceof AbacRole`.\n */\nexport class AbacRole extends Role {\n    applicableScopes;\n    constructor(name, permissions, domain, applicableScopes) {\n        super(name, permissions, domain);\n        this.applicableScopes = applicableScopes;\n    }\n}\n//# sourceMappingURL=classes.js.map","import { AbacRole } from './classes.js';\nconst ContentRoleDomain = 'content';\nconst APPLICABLE_SCOPES = ['document', 'collection'];\n/**\n * Names of roles owned by the `content` domain. Apply to ResourceSet ACEs\n * scoped to either `document` or `collection` — the semantics of \"read\n * content\" are the same for both kinds.\n */\nexport var ContentRoleNames;\n(function (ContentRoleNames) {\n    ContentRoleNames[\"content_reader\"] = \"content:reader\";\n    ContentRoleNames[\"content_writer\"] = \"content:writer\";\n    ContentRoleNames[\"content_manager\"] = \"content:manager\";\n})(ContentRoleNames || (ContentRoleNames = {}));\nclass ContentReaderRole extends AbacRole {\n    constructor() {\n        super(ContentRoleNames.content_reader, ['read'], ContentRoleDomain, APPLICABLE_SCOPES);\n    }\n}\nclass ContentWriterRole extends AbacRole {\n    constructor() {\n        super(ContentRoleNames.content_writer, ['read', 'write'], ContentRoleDomain, APPLICABLE_SCOPES);\n    }\n}\nclass ContentManagerRole extends AbacRole {\n    constructor() {\n        super(ContentRoleNames.content_manager, ['read', 'write', 'delete'], ContentRoleDomain, APPLICABLE_SCOPES);\n    }\n}\nconst contentRoles = {\n    [ContentRoleNames.content_reader]: new ContentReaderRole(),\n    [ContentRoleNames.content_writer]: new ContentWriterRole(),\n    [ContentRoleNames.content_manager]: new ContentManagerRole(),\n};\nexport const contentPartition = {\n    domain: ContentRoleDomain,\n    roles: new Map(Object.entries(contentRoles)),\n};\n//# sourceMappingURL=content.js.map","import { Permission, SystemRoles } from '@vertesia/common';\nimport { SystemRole } from './classes.js';\nclass OrgMemberRole extends SystemRole {\n    constructor(name, permissions) {\n        super(name, [Permission.account_member, ...permissions]);\n    }\n}\nclass OwnerRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.owner, Object.values(Permission));\n    }\n}\nclass AdminRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.admin, Object.values(Permission));\n    }\n}\nclass ManagerRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.manager, Object.values(Permission));\n        this.permissions.delete(Permission.account_admin);\n        this.permissions.delete(Permission.manage_billing);\n        this.permissions.delete(Permission.audit_read);\n        this.permissions.delete(Permission.agent_run_read);\n        this.permissions.delete(Permission.content_read_all);\n        this.permissions.delete(Permission.content_superadmin);\n        this.permissions.delete(Permission.workflow_superadmin);\n    }\n}\nclass DeveloperRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.developer, Object.values(Permission));\n        this.permissions.delete(Permission.account_admin);\n        this.permissions.delete(Permission.project_admin);\n        this.permissions.delete(Permission.project_settings_write);\n        this.permissions.delete(Permission.env_admin);\n        this.permissions.delete(Permission.manage_billing);\n        this.permissions.delete(Permission.audit_read);\n        this.permissions.delete(Permission.agent_run_read);\n        this.permissions.delete(Permission.content_read_all);\n        this.permissions.delete(Permission.content_superadmin);\n        this.permissions.delete(Permission.workflow_superadmin);\n    }\n}\nclass ApplicationRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.application, [\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.int_write,\n            Permission.run_read,\n            Permission.content_write,\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_admin,\n            Permission.project_admin,\n            Permission.workflow_run,\n            Permission.project_settings_write,\n            Permission.account_write,\n        ]);\n    }\n}\nclass AutomationRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.automation, [\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_admin,\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.run_read,\n            Permission.workflow_run,\n            Permission.project_integration_read,\n        ]);\n    }\n}\nclass ContentProcessorRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.content_processor, [\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_admin,\n            Permission.content_superadmin,\n            Permission.int_execute,\n            Permission.workflow_read,\n            Permission.workflow_run,\n            Permission.run_read,\n        ]);\n    }\n}\nclass ConsumerRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.consumer, [\n            Permission.content_admin,\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_delete,\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.run_read,\n            Permission.workflow_run,\n        ]);\n    }\n}\nclass ExecutorRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.executor, [Permission.int_execute, Permission.run_read, Permission.workflow_run]);\n    }\n}\nclass ReaderRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.reader, [Permission.int_read, Permission.run_read, Permission.content_read]);\n    }\n}\nconst READ_ONLY_AUDIT_PERMISSIONS = [\n    Permission.studio_access,\n    Permission.account_read,\n    Permission.project_integration_read,\n    Permission.api_key_read,\n    Permission.billing_read,\n    Permission.audit_read,\n    Permission.int_read,\n    Permission.run_read,\n    Permission.content_read,\n    Permission.content_read_all,\n    Permission.task_read,\n    Permission.workflow_read,\n    Permission.agent_run_read,\n];\nclass ReadOnlyAuditRole extends OrgMemberRole {\n    constructor(name) {\n        super(name, READ_ONLY_AUDIT_PERMISSIONS);\n    }\n}\nclass BillingRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.billing, [Permission.manage_billing]);\n    }\n}\nclass AppMemberRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.app_member, [\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.int_write,\n            Permission.run_read,\n            Permission.content_write,\n            Permission.content_read,\n            Permission.content_delete,\n            Permission.workflow_run,\n        ]);\n    }\n}\nclass ContentSuperAdmin extends DeveloperRole {\n    constructor() {\n        super();\n        this.name = SystemRoles.content_superadmin;\n        this.permissions.add(Permission.content_superadmin);\n    }\n}\n// The enum is still named `SystemRoles` (historical); the partition's domain\n// is `system` — the foundational built-in roles, distinct from feature domains\n// like `content` or `tasks`. Renaming the enum to `SystemRoles` is a separate\n// concern to revisit later.\nconst systemRoles = {\n    [SystemRoles.owner]: new OwnerRole(),\n    [SystemRoles.admin]: new AdminRole(),\n    [SystemRoles.manager]: new ManagerRole(),\n    [SystemRoles.developer]: new DeveloperRole(),\n    [SystemRoles.application]: new ApplicationRole(),\n    [SystemRoles.automation]: new AutomationRole(),\n    [SystemRoles.content_processor]: new ContentProcessorRole(),\n    [SystemRoles.consumer]: new ConsumerRole(),\n    [SystemRoles.executor]: new ExecutorRole(),\n    [SystemRoles.reader]: new ReaderRole(),\n    [SystemRoles.auditor]: new ReadOnlyAuditRole(SystemRoles.auditor),\n    [SystemRoles.support]: new ReadOnlyAuditRole(SystemRoles.support),\n    [SystemRoles.billing]: new BillingRole(),\n    [SystemRoles.app_member]: new AppMemberRole(),\n    [SystemRoles.member]: new OrgMemberRole(SystemRoles.member, []),\n    [SystemRoles.content_superadmin]: new ContentSuperAdmin(),\n};\nexport const systemPartition = {\n    domain: 'system',\n    roles: new Map(Object.entries(systemRoles)),\n};\n//# sourceMappingURL=system.js.map","import { AbacRole, SystemRole } from './classes.js';\nimport { contentPartition } from './content.js';\nimport { systemPartition } from './system.js';\nexport { AbacRole, Role, SystemRole } from './classes.js';\nexport { ContentRoleNames } from './content.js';\n/**\n * The ordered partition registry. Partitions are queried in this order — first\n * match wins. The `system` partition is registered first so domain-specific\n * partitions (added later) cannot shadow built-in system roles.\n */\nconst partitions = [systemPartition, contentPartition];\n/** Look up a role by its name across all registered partitions. */\nexport function getRoleByName(name) {\n    for (const partition of partitions) {\n        const role = partition.roles.get(name);\n        if (role)\n            return role;\n    }\n    throw new Error(`Role ${name} not found`);\n}\n/** List every role across all partitions, in partition registration order. */\nexport function listRoles() {\n    const result = [];\n    for (const partition of partitions) {\n        for (const role of partition.roles.values()) {\n            result.push(role);\n        }\n    }\n    return result;\n}\n/** Roles owned by a specific domain (e.g. `'system'`, `'content'`). */\nexport function listRolesByDomain(domain) {\n    const partition = partitions.find((p) => p.domain === domain);\n    return partition ? Array.from(partition.roles.values()) : [];\n}\n/**\n * ABAC roles applicable to a given ResourceSet scope (e.g. `'document'`,\n * `'collection'`). System roles are excluded — they don't carry scope semantics.\n */\nexport function listAbacRolesForScope(scope) {\n    return listRoles().filter((r) => r instanceof AbacRole && r.applicableScopes.includes(scope));\n}\n/** Shortcut for the system partition: returns only `SystemRole` instances. */\nexport function listSystemRoles() {\n    return listRoles().filter((r) => r instanceof SystemRole);\n}\n/** Names of every registered role across all partitions — suited for mongoose schema enum constraints. */\nexport function getAllRoleNames() {\n    return listRoles().map((r) => r.name);\n}\n/**\n * Merge the permissions granted by a set of roles into a single array.\n * Intended for the system-role gating path. For ABAC roles, the bare-verb\n * permissions returned here aren't directly meaningful — use the JWT\n * `content_security` pathway instead.\n */\nexport function getPermissionsForRoles(roleNames) {\n    const permissions = new Set();\n    for (const roleName of roleNames) {\n        const role = getRoleByName(roleName);\n        for (const permission of role.permissions) {\n            permissions.add(permission);\n        }\n    }\n    return Array.from(permissions);\n}\n/**\n * A list of roles with a unified `hasPermission` check across them.\n */\nexport class RoleList {\n    roles;\n    constructor(roles) {\n        this.roles = roles;\n    }\n    static fromRoleNames(roleNames) {\n        const roles = roleNames.map((r) => getRoleByName(r));\n        return new RoleList(roles);\n    }\n    static fromRoleName(roleName) {\n        const roles = [getRoleByName(roleName)];\n        return new RoleList(roles);\n    }\n    hasPermission(perm) {\n        return this.roles.some((role) => role.hasPermission(perm));\n    }\n}\n//# sourceMappingURL=index.js.map"],"mappings":"8PAkBA,SAAgB,EAA2B,EAAU,CACjD,IAAI,EACJ,GAAI,CACA,EAAM,EAAW,MAAM,CAAQ,CACnC,MACM,CACF,OAAO,IAAI,GACf,CACA,IAAM,EAAY,IAAI,IAChB,EAAc,CAAC,EACf,EAAW,GAAS,EAAY,KAAM,GAAU,EAAM,IAAI,CAAI,CAAC,EAC/D,EAAS,GAAS,CACpB,GAAI,CAAC,GAAQ,OAAO,GAAS,SACzB,OACJ,IAAM,EAAI,EACV,OAAQ,EAAE,KAAV,CACI,IAAK,UAAW,CACZ,IAAM,EAAO,EAAE,KACf,GAAI,EACA,IAAK,IAAM,KAAQ,EACf,EAAM,CAAI,EAClB,KACJ,CACA,IAAK,iBAAkB,CAGnB,IAAM,EAAS,EAAE,OACjB,GAAI,EACA,IAAK,IAAM,KAAK,EACZ,EAAM,CAAC,EACf,EAAM,EAAE,IAAI,EAEZ,IAAM,EAAU,EAAE,QACZ,EAAU,EAAE,QACZ,EAAQ,IAAI,IAAI,CAAC,GAAI,GAAS,aAAe,CAAC,EAAI,GAAI,GAAS,aAAe,CAAC,CAAE,CAAC,EACxF,EAAY,KAAK,CAAK,EACtB,EAAM,EAAE,OAAO,EACf,EAAM,EAAE,OAAO,EACf,EAAY,IAAI,EAChB,KACJ,CACA,IAAK,oBAAqB,CAGtB,IAAM,EAAS,EAAE,OACX,EAAO,EAAE,KAKf,IAJsB,GAAQ,QAAU,GAAK,IAAM,GAAM,OAAO,QAAU,GAAK,GAE3E,EAAM,EAAE,IAAI,EAEZ,EACA,IAAK,IAAM,KAAK,EACZ,EAAM,CAAC,EACf,EAAM,CAAI,EACV,KACJ,CACA,IAAK,gBAAiB,CAElB,IAAM,EAAS,EAAE,OACjB,GAAI,EACA,IAAK,IAAM,KAAK,EACZ,EAAM,CAAC,EACf,EAAM,EAAE,IAAI,EACZ,KACJ,CACA,IAAK,iBAAkB,CACnB,GAAI,EAAE,KACF,MACJ,IAAM,EAAQ,EAAE,MAChB,GAAI,CAAC,GAAS,EAAM,SAAW,EAC3B,MACJ,IAAM,EAAO,EAAM,GACnB,GAAI,EAAQ,CAAI,EACZ,MACJ,EAAU,IAAI,CAAI,EAClB,KACJ,CACA,IAAK,OAAQ,CACT,IAAM,EAAQ,EAAE,MAChB,GAAI,EACA,IAAK,IAAM,KAAQ,EACf,EAAM,EAAK,KAAK,EACxB,KACJ,CAEA,QACI,KACR,CACJ,EAEA,OADA,EAAM,CAAG,EACF,CACX,CC/FA,SAAgB,EAAiB,EAAQ,EAAe,QAAS,CAC7D,GAAI,SAAU,EACV,MAAO,IAAI,EAAa,GAI5B,QAFc,MAAM,QAAQ,EAAO,IAAI,EAAI,EAAO,KAAO,CAAC,EAAO,IAAI,EAAA,CAC3C,GAC1B,CACI,IAAK,SACD,MAAO,IAAI,EAAa,GAC5B,IAAK,SACL,IAAK,UACD,OAAO,KAAK,MAAM,KAAK,OAAO,EAAI,GAAG,EACzC,IAAK,UACD,MAAO,GACX,IAAK,QAAS,CACV,IAAM,EAAa,EAAO,MAC1B,GAAI,EAAY,CACZ,IAAM,EAAY,KAAK,MAAM,KAAK,OAAO,EAAI,CAAC,EAAI,EAClD,OAAO,MAAM,KAAK,CAAE,OAAQ,CAAU,GAAI,EAAG,IAAU,EAAiB,EAAY,GAAG,EAAa,GAAG,GAAO,CAAC,CACnH,CACA,MAAO,CAAC,CACZ,CACA,IAAK,SAAU,CACX,IAAM,EAAS,CAAC,EAChB,GAAI,EAAO,WACP,IAAK,GAAM,CAAC,EAAU,KAAe,OAAO,QAAQ,EAAO,UAAU,EACjE,EAAO,GAAY,EAAiB,EAAY,CAAQ,EAGhE,OAAO,CACX,CACA,IAAK,OACD,OAAO,KACX,QACI,MAAO,IAAI,EAAa,EAChC,CACJ,CC/BA,SAAgB,EAAe,EAAM,EAAa,EAAQ,EAAM,CAQ5D,OAPI,IAAgB,EAAa,WACtB,EAAyB,EAAM,CAAI,EAE1C,IAAgB,EAAa,KACtB,EAGJ,EAAiB,EAAM,CADb,GAAI,EAAO,WAAa,OAAO,KAAK,EAAO,UAAU,EAAI,CAAC,EAAI,QAC3C,EAAG,CAAI,CAC/C,CAKA,SAAgB,EAAW,EAAY,EAAQ,EAAM,CACjD,GAAI,CAEA,MAAO,CAAE,QAAS,GAAM,QADT,EAAe,EAAY,EAAa,IAAK,EAAQ,CAC9B,CAAE,CAC5C,OACO,EAAO,CACV,MAAO,CAAE,QAAS,GAAO,MAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAE,CAC3F,CACJ,CAKA,SAAgB,EAAkB,EAAmB,EAAQ,EAAM,CAC/D,GAAI,CAEA,MAAO,CAAE,QAAS,GAAM,QADT,EAAe,EAAmB,EAAa,WAAY,EAAQ,CAC5C,CAAE,CAC5C,OACO,EAAO,CACV,MAAO,CAAE,QAAS,GAAO,MAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAE,CAC3F,CACJ,CACA,SAAS,EAAkB,EAAS,EAAM,CACtC,IAAM,EAAU,EAAW,EAAQ,aAAa,EAC1C,EAAO,EAAK,GACd,EAOJ,MANA,CAII,EAJA,MAAM,QAAQ,CAAI,EACR,KAAK,UAAU,EAAM,IAAA,GAAW,CAAC,EAGjC,OAAO,EAAQ,gCAEtB,CACH,MAAO,eACP,SACJ,CACJ,CACA,SAAS,GAAsB,EAAS,EAAM,CAC1C,GAAI,CAAC,EAAQ,SACT,MAAO,CAAE,MAAO,oBAAqB,QAAS,GAAI,MAAW,MAAM,wCAAwC,CAAE,EAEjH,IAAM,EAAS,EAAQ,SAAS,aAAe,CAAC,EAC1C,EAAQ,IAAI,EAAQ,SAAS,OACnC,GAAI,CAEA,MAAO,CAAE,QAAO,QADA,EAAe,EAAQ,SAAS,QAAS,EAAQ,SAAS,aAAc,EAAQ,CAC1E,EAAG,UAAW,EAAQ,SAAS,EAAG,CAC5D,OACO,EAAO,CAEV,MAAO,CACH,QACA,QAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAC9D,UAAW,EAAQ,SAAS,GAC5B,MAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CACnE,CACJ,CACJ,CACA,SAAgB,EAAe,EAAU,EAAM,CAC3C,IAAM,EAAM,CAAC,EACb,IAAK,IAAM,KAAW,EACd,EAAQ,OAAS,EAAqB,KACtC,EAAI,KAAK,EAAkB,EAAS,CAAI,CAAC,EAEpC,EAAQ,OAAS,EAAqB,UAC3C,EAAI,KAAK,GAAsB,EAAS,CAAI,CAAC,EAGrD,OAAO,CACX,CACA,SAAgB,EAAuB,EAAU,EAAc,CAC3D,GAAI,CACA,OAAO,EAAe,EAAU,OAAO,GAAiB,SAAW,KAAK,MAAM,EAAa,KAAK,CAAC,EAAI,GAAgB,CAAC,CAAC,CAC3H,OACO,EAAO,CAQV,OAPI,aAAiB,EACV,EAAM,OAAO,IAAK,IAAS,CAC9B,MAAO,EACP,MAAO,kBACP,QAAS,EAAI,OACjB,EAAE,EAEC,CACH,CACI,MAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,EAC/D,MAAO,kBACP,QAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAClE,CACJ,CACJ,CACJ,CACA,SAAgB,EAAa,EAAU,EAAS,CAC5C,IAAM,EAAM,CAAC,EACb,IAAK,IAAM,KAAW,EAClB,GAAI,EAAQ,SAAU,CAClB,IAAM,EAAS,EAAQ,SAAS,aAAe,CAAC,EAC1C,EAAU,EAAe,EAAQ,SAAS,QAAS,EAAQ,SAAS,aAAc,EAAQ,CAAO,EACvG,EAAI,KAAK,CAAE,KAAM,EAAQ,SAAS,KAAM,SAAQ,CAAC,CACrD,MACK,GAAI,EAAQ,OAAS,EAAqB,KAAM,CAEjD,IAAM,EAAW,EADD,EAAW,EAAQ,aACJ,GAC/B,GAAI,CAAC,EAAqB,CAAQ,EAC9B,MAAU,MAAM,gDAAgD,EAEpE,IAAK,IAAM,KAAO,EAAU,CACxB,GAAI,CAAC,EAAI,KACL,MAAU,MAAM,sCAAsC,EAE1D,EAAI,KAAK,CAAE,KAAM,EAAI,KAAM,QAAS,EAAI,OAAQ,CAAC,CACrD,CACJ,MAEI,MAAU,MAAM,gCAAgC,EAAQ,MAAM,EAGtE,OAAO,CACX,CACA,SAAS,EAAW,EAAe,CAO/B,OANI,OAAO,GAAkB,UACzB,GACA,YAAa,GACb,OAAO,EAAc,SAAY,SAC1B,EAAc,QAElB,MACX,CACA,SAAS,EAAqB,EAAO,CACjC,OAAO,MAAM,QAAQ,CAAK,GAAK,EAAM,MAAM,CAAe,CAC9D,CACA,SAAS,EAAgB,EAAO,CAC5B,OAAO,OAAO,GAAU,YAAY,GAAkB,SAAU,GAAS,YAAa,CAC1F,CCvJA,MAAM,EAAmB,CAAC,IAAK,QAAS,MAAO,QAAQ,EACvD,SAAS,EAAgB,EAAQ,CAC7B,IAAI,EAAc,EACd,EAAgB,EACpB,IAAK,IAAM,KAAS,EACZ,EAAM,WAAa,QACnB,IAEK,EAAM,WAAa,WACxB,IAGR,MAAO,CAAE,cAAa,eAAc,CACxC,CACA,SAAS,GAAyB,EAAS,EAAa,CACpD,IAAM,EAAS,CAAC,EACV,EAAW,EAA2B,CAAO,EAC7C,EAAe,IAAI,IAAI,GAAa,WAAa,OAAO,KAAK,EAAY,UAAU,EAAI,CAAC,CAAC,EAC/F,IAAK,IAAM,KAAQ,EACV,EAAa,IAAI,CAAI,GACtB,EAAO,KAAK,CACR,KAAM,+BACN,SAAU,QACV,SAAU,EACV,QAAS,mCAAmC,EAAK,8DAA8D,EAAK,0CACxH,CAAC,EAGT,IAAK,IAAM,KAAY,EACd,EAAS,IAAI,CAAQ,GACtB,EAAO,KAAK,CACR,KAAM,yBACN,SAAU,UACV,SAAU,EACV,QAAS,6BAA6B,EAAS,sFAAsF,EAAS,IAClJ,CAAC,EAOT,IAAM,EAAe,GAAe,CAAC,EAC/B,EAAW,EAAiB,CAAY,EAExC,EAAe,EAAkB,EAAS,EAD7B,OAAO,GAAa,UAAY,GAAqB,CAAC,MAAM,QAAQ,CAAQ,EAAI,EAAW,CAAC,CACvC,EAQxE,OAPK,EAAa,SACd,EAAO,KAAK,CACR,KAAM,0BACN,SAAU,QACV,QAAS,gCAAgC,EAAa,OAC1D,CAAC,EAEE,CACX,CACA,SAAS,GAAkB,EAAS,EAAa,CAC7C,IAAM,EAAS,CAAC,EACV,EAAe,IAAI,IAAI,GAAa,WAAa,OAAO,KAAK,EAAY,UAAU,EAAI,CAAC,CAAC,EAC3F,EACJ,GAAI,CACA,IAAM,EAAS,EAAiB,EAAS,CACrC,QAAS,EACT,MAAO,CAAE,2BAA4B,GAAM,UAAW,EAAK,CAC/D,CAAC,EACD,EAAa,EAAO,KACpB,IAAK,IAAM,KAAO,EAAO,OACrB,EAAO,KAAK,CACR,KAAM,uBACN,SAAU,QACV,QAAS,2BAA2B,EAAI,SAAS,IAAI,EAAI,SAC7D,CAAC,CAET,OACO,EAAY,CAOf,OALA,EAAO,KAAK,CACR,KAAM,mBACN,SAAU,QACV,QAAS,qBAAqB,aAAsB,MAAQ,EAAW,QAAU,OAAO,CAAU,GACtG,CAAC,EACM,CACX,CACA,IAAK,IAAM,KAAQ,EACV,EAAa,IAAI,CAAI,GACtB,EAAO,KAAK,CACR,KAAM,+BACN,SAAU,QACV,SAAU,EACV,QAAS,iCAAiC,EAAK,4DAA4D,EAAK,0CACpH,CAAC,EAGT,IAAK,IAAM,KAAY,EACd,EAAW,IAAI,CAAQ,GACxB,EAAO,KAAK,CACR,KAAM,yBACN,SAAU,UACV,SAAU,EACV,QAAS,6BAA6B,EAAS,+FACnD,CAAC,EAMT,GAAI,CADkB,EAAO,KAAM,GAAM,EAAE,WAAa,OACvC,EAAG,CAEhB,IAAM,EAAW,EADI,GAAe,CAAC,CACS,EACxC,EAAa,OAAO,GAAa,UAAY,GAAqB,CAAC,MAAM,QAAQ,CAAQ,EACzF,EACA,CAAC,EACP,GAAI,CACA,EAAiB,EAAS,CAAC,GAAG,CAAY,EAAG,CAAU,CAC3D,OACO,EAAa,CAChB,EAAO,KAAK,CACR,KAAM,mBACN,SAAU,QACV,QAAS,yBAAyB,aAAuB,MAAQ,EAAY,QAAU,OAAO,CAAW,GAC7G,CAAC,CACL,CACJ,CACA,OAAO,CACX,CAgBA,SAAgB,GAAe,EAAO,CAClC,IAAI,EACJ,AAOI,EAPA,EAAM,cAAgB,EAAa,WAC1B,GAAyB,EAAM,QAAS,EAAM,WAAW,EAE7D,EAAM,cAAgB,EAAa,IAC/B,GAAkB,EAAM,QAAS,EAAM,WAAW,EAGlD,CAAC,EAEd,GAAM,CAAE,cAAa,iBAAkB,EAAgB,CAAM,EAC7D,MAAO,CAAE,SAAQ,cAAa,eAAc,CAChD,CChJA,IAAa,EAAb,KAAkB,CACd,KACA,OACA,YACA,YAAY,EAAM,EAAa,EAAQ,CACnC,KAAK,KAAO,EACZ,KAAK,OAAS,EACd,KAAK,YAAc,IAAI,IAAI,CAAW,CAC1C,CACA,cAAc,EAAY,CACtB,OAAO,KAAK,YAAY,IAAI,CAAU,CAC1C,CACJ,EAMa,EAAb,cAAgC,CAAK,CACjC,YAAY,EAAM,EAAa,CAC3B,MAAM,EAAM,EAAa,QAAQ,CACrC,CACJ,EASa,EAAb,cAA8B,CAAK,CAC/B,iBACA,YAAY,EAAM,EAAa,EAAQ,EAAkB,CACrD,MAAM,EAAM,EAAa,CAAM,EAC/B,KAAK,iBAAmB,CAC5B,CACJ,ECzDA,MAAM,EAAoB,UACpB,EAAoB,CAAC,WAAY,YAAY,EAMnD,IAAW,GACV,SAAU,EAAkB,CACzB,EAAiB,eAAoB,iBACrC,EAAiB,eAAoB,iBACrC,EAAiB,gBAAqB,iBAC1C,EAAA,CAAG,AAAqB,IAAmB,CAAC,CAAE,EAC9C,IAAM,EAAN,cAAgC,CAAS,CACrC,aAAc,CACV,MAAM,EAAiB,eAAgB,CAAC,MAAM,EAAG,EAAmB,CAAiB,CACzF,CACJ,EACM,EAAN,cAAgC,CAAS,CACrC,aAAc,CACV,MAAM,EAAiB,eAAgB,CAAC,OAAQ,OAAO,EAAG,EAAmB,CAAiB,CAClG,CACJ,EACM,EAAN,cAAiC,CAAS,CACtC,aAAc,CACV,MAAM,EAAiB,gBAAiB,CAAC,OAAQ,QAAS,QAAQ,EAAG,EAAmB,CAAiB,CAC7G,CACJ,EACA,MAAM,EAAe,EAChB,EAAiB,gBAAiB,IAAI,GACtC,EAAiB,gBAAiB,IAAI,GACtC,EAAiB,iBAAkB,IAAI,CAC5C,EACa,EAAmB,CAC5B,OAAQ,EACR,MAAO,IAAI,IAAI,OAAO,QAAQ,CAAY,CAAC,CAC/C,ECnCA,IAAM,EAAN,cAA4B,CAAW,CACnC,YAAY,EAAM,EAAa,CAC3B,MAAM,EAAM,CAAC,EAAW,eAAgB,GAAG,CAAW,CAAC,CAC3D,CACJ,EACM,EAAN,cAAwB,CAAc,CAClC,aAAc,CACV,MAAM,EAAY,MAAO,OAAO,OAAO,CAAU,CAAC,CACtD,CACJ,EACM,EAAN,cAAwB,CAAc,CAClC,aAAc,CACV,MAAM,EAAY,MAAO,OAAO,OAAO,CAAU,CAAC,CACtD,CACJ,EACM,EAAN,cAA0B,CAAc,CACpC,aAAc,CACV,MAAM,EAAY,QAAS,OAAO,OAAO,CAAU,CAAC,EACpD,KAAK,YAAY,OAAO,EAAW,aAAa,EAChD,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,UAAU,EAC7C,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,gBAAgB,EACnD,KAAK,YAAY,OAAO,EAAW,kBAAkB,EACrD,KAAK,YAAY,OAAO,EAAW,mBAAmB,CAC1D,CACJ,EACM,EAAN,cAA4B,CAAc,CACtC,aAAc,CACV,MAAM,EAAY,UAAW,OAAO,OAAO,CAAU,CAAC,EACtD,KAAK,YAAY,OAAO,EAAW,aAAa,EAChD,KAAK,YAAY,OAAO,EAAW,aAAa,EAChD,KAAK,YAAY,OAAO,EAAW,sBAAsB,EACzD,KAAK,YAAY,OAAO,EAAW,SAAS,EAC5C,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,UAAU,EAC7C,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,gBAAgB,EACnD,KAAK,YAAY,OAAO,EAAW,kBAAkB,EACrD,KAAK,YAAY,OAAO,EAAW,mBAAmB,CAC1D,CACJ,EACM,EAAN,cAA8B,CAAc,CACxC,aAAc,CACV,MAAM,EAAY,YAAa,CAC3B,EAAW,SACX,EAAW,YACX,EAAW,UACX,EAAW,SACX,EAAW,cACX,EAAW,aACX,EAAW,cACX,EAAW,cACX,EAAW,cACX,EAAW,aACX,EAAW,uBACX,EAAW,aACf,CAAC,CACL,CACJ,EACM,GAAN,cAA6B,CAAc,CACvC,aAAc,CACV,MAAM,EAAY,WAAY,CAC1B,EAAW,aACX,EAAW,cACX,EAAW,cACX,EAAW,SACX,EAAW,YACX,EAAW,SACX,EAAW,aACX,EAAW,wBACf,CAAC,CACL,CACJ,EACM,EAAN,cAAmC,CAAc,CAC7C,aAAc,CACV,MAAM,EAAY,kBAAmB,CACjC,EAAW,aACX,EAAW,cACX,EAAW,cACX,EAAW,mBACX,EAAW,YACX,EAAW,cACX,EAAW,aACX,EAAW,QACf,CAAC,CACL,CACJ,EACM,EAAN,cAA2B,CAAc,CACrC,aAAc,CACV,MAAM,EAAY,SAAU,CACxB,EAAW,cACX,EAAW,aACX,EAAW,cACX,EAAW,eACX,EAAW,SACX,EAAW,YACX,EAAW,SACX,EAAW,YACf,CAAC,CACL,CACJ,EACM,EAAN,cAA2B,CAAc,CACrC,aAAc,CACV,MAAM,EAAY,SAAU,CAAC,EAAW,YAAa,EAAW,SAAU,EAAW,YAAY,CAAC,CACtG,CACJ,EACM,EAAN,cAAyB,CAAc,CACnC,aAAc,CACV,MAAM,EAAY,OAAQ,CAAC,EAAW,SAAU,EAAW,SAAU,EAAW,YAAY,CAAC,CACjG,CACJ,EACA,MAAM,EAA8B,CAChC,EAAW,cACX,EAAW,aACX,EAAW,yBACX,EAAW,aACX,EAAW,aACX,EAAW,WACX,EAAW,SACX,EAAW,SACX,EAAW,aACX,EAAW,iBACX,EAAW,UACX,EAAW,cACX,EAAW,cACf,EACA,IAAM,EAAN,cAAgC,CAAc,CAC1C,YAAY,EAAM,CACd,MAAM,EAAM,CAA2B,CAC3C,CACJ,EACM,EAAN,cAA0B,CAAc,CACpC,aAAc,CACV,MAAM,EAAY,QAAS,CAAC,EAAW,cAAc,CAAC,CAC1D,CACJ,EACM,EAAN,cAA4B,CAAc,CACtC,aAAc,CACV,MAAM,EAAY,WAAY,CAC1B,EAAW,SACX,EAAW,YACX,EAAW,UACX,EAAW,SACX,EAAW,cACX,EAAW,aACX,EAAW,eACX,EAAW,YACf,CAAC,CACL,CACJ,EACM,EAAN,cAAgC,CAAc,CAC1C,aAAc,CACV,MAAM,EACN,KAAK,KAAO,EAAY,mBACxB,KAAK,YAAY,IAAI,EAAW,kBAAkB,CACtD,CACJ,EAKA,MAAM,EAAc,EACf,EAAY,OAAQ,IAAI,GACxB,EAAY,OAAQ,IAAI,GACxB,EAAY,SAAU,IAAI,GAC1B,EAAY,WAAY,IAAI,GAC5B,EAAY,aAAc,IAAI,GAC9B,EAAY,YAAa,IAAI,IAC7B,EAAY,mBAAoB,IAAI,GACpC,EAAY,UAAW,IAAI,GAC3B,EAAY,UAAW,IAAI,GAC3B,EAAY,QAAS,IAAI,GACzB,EAAY,SAAU,IAAI,EAAkB,EAAY,OAAO,GAC/D,EAAY,SAAU,IAAI,EAAkB,EAAY,OAAO,GAC/D,EAAY,SAAU,IAAI,GAC1B,EAAY,YAAa,IAAI,GAC7B,EAAY,QAAS,IAAI,EAAc,EAAY,OAAQ,CAAC,CAAC,GAC7D,EAAY,oBAAqB,IAAI,CAC1C,EC3KM,EAAa,CAAC,CD6KhB,OAAQ,SACR,MAAO,IAAI,IAAI,OAAO,QAAQ,CAAW,CAAC,CC9K1B,EAAiB,CAAgB,EAErD,SAAgB,EAAc,EAAM,CAChC,IAAK,IAAM,KAAa,EAAY,CAChC,IAAM,EAAO,EAAU,MAAM,IAAI,CAAI,EACrC,GAAI,EACA,OAAO,CACf,CACA,MAAU,MAAM,QAAQ,EAAK,WAAW,CAC5C,CAEA,SAAgB,GAAY,CACxB,IAAM,EAAS,CAAC,EAChB,IAAK,IAAM,KAAa,EACpB,IAAK,IAAM,KAAQ,EAAU,MAAM,OAAO,EACtC,EAAO,KAAK,CAAI,EAGxB,OAAO,CACX,CAEA,SAAgB,GAAkB,EAAQ,CACtC,IAAM,EAAY,EAAW,KAAM,GAAM,EAAE,SAAW,CAAM,EAC5D,OAAO,EAAY,MAAM,KAAK,EAAU,MAAM,OAAO,CAAC,EAAI,CAAC,CAC/D,CAKA,SAAgB,GAAsB,EAAO,CACzC,OAAO,EAAU,CAAC,CAAC,OAAQ,GAAM,aAAa,GAAY,EAAE,iBAAiB,SAAS,CAAK,CAAC,CAChG,CAEA,SAAgB,IAAkB,CAC9B,OAAO,EAAU,CAAC,CAAC,OAAQ,GAAM,aAAa,CAAU,CAC5D,CAEA,SAAgB,IAAkB,CAC9B,OAAO,EAAU,CAAC,CAAC,IAAK,GAAM,EAAE,IAAI,CACxC,CAOA,SAAgB,GAAuB,EAAW,CAC9C,IAAM,EAAc,IAAI,IACxB,IAAK,IAAM,KAAY,EAAW,CAC9B,IAAM,EAAO,EAAc,CAAQ,EACnC,IAAK,IAAM,KAAc,EAAK,YAC1B,EAAY,IAAI,CAAU,CAElC,CACA,OAAO,MAAM,KAAK,CAAW,CACjC,CAIA,IAAa,EAAb,MAAa,CAAS,CAClB,MACA,YAAY,EAAO,CACf,KAAK,MAAQ,CACjB,CACA,OAAO,cAAc,EAAW,CAE5B,OAAO,IAAI,EADG,EAAU,IAAK,GAAM,EAAc,CAAC,CAC1B,CAAC,CAC7B,CACA,OAAO,aAAa,EAAU,CAE1B,OAAO,IAAI,EAAS,CADL,EAAc,CAAQ,CACb,CAAC,CAC7B,CACA,cAAc,EAAM,CAChB,OAAO,KAAK,MAAM,KAAM,GAAS,EAAK,cAAc,CAAI,CAAC,CAC7D,CACJ"}
+{"version":3,"file":"vertesia-studio-utils.js","names":[],"sources":["prompts/extract-vars.js","prompts/mock-data.js","prompts/render.js","prompts/validate.js","roles/classes.js","roles/content.js","roles/system.js","roles/index.js"],"sourcesContent":["import Handlebars from 'handlebars';\n/**\n * Extract the set of root-level variable names referenced by a Handlebars template.\n *\n * - `{{foo}}` → `foo`\n * - `{{obj.bar.baz}}` → `obj` (only the root identifier; nested access doesn't add `bar` or `baz`)\n * - `{{#if cond}}{{name}}{{/if}}` → `cond`, `name`\n * - `{{#each items as |item|}}{{item.name}}{{/each}}` → `items` (NOT `item` — bound by `as |item|`)\n * - `{{lookup obj key}}` → `obj`, `key` (helper name skipped)\n * - `{{@index}}`, `{{this}}` → ignored (built-in data vars / self)\n *\n * Helper names in mustaches and block heads (`{{customHelper x}}`, `{{#if x}}`) are NOT added to\n * the set — only the arguments and inner template references are. This matches the typical use\n * case for prompt validation: detect which schema properties the template actually reads.\n *\n * Returns an empty set on parse failure — callers should also run a syntactic render check\n * (e.g. `executeHandlebars`) to surface parse errors separately.\n */\nexport function extractHandlebarsVariables(template) {\n    let ast;\n    try {\n        ast = Handlebars.parse(template);\n    }\n    catch {\n        return new Set();\n    }\n    const variables = new Set();\n    const localScopes = [];\n    const isLocal = (name) => localScopes.some((scope) => scope.has(name));\n    const visit = (node) => {\n        if (!node || typeof node !== 'object')\n            return;\n        const n = node;\n        switch (n.type) {\n            case 'Program': {\n                const body = n.body;\n                if (body)\n                    for (const stmt of body)\n                        visit(stmt);\n                break;\n            }\n            case 'BlockStatement': {\n                // n.path is the helper name (`#if`, `#each`, `#customBlock`) — never a variable.\n                // Visit params + hash to capture variables passed to the block helper.\n                const params = n.params;\n                if (params)\n                    for (const p of params)\n                        visit(p);\n                visit(n.hash);\n                // Track `as |x y|` block params — these are local bindings, not variables.\n                const program = n.program;\n                const inverse = n.inverse;\n                const scope = new Set([...(program?.blockParams ?? []), ...(inverse?.blockParams ?? [])]);\n                localScopes.push(scope);\n                visit(n.program);\n                visit(n.inverse);\n                localScopes.pop();\n                break;\n            }\n            case 'MustacheStatement': {\n                // Bare mustache (no params, no hash) → it's a variable reference.\n                // With params/hash, it's a helper call — skip the path (helper name), visit args.\n                const params = n.params;\n                const hash = n.hash;\n                const isHelperCall = (params?.length ?? 0) > 0 || (hash?.pairs?.length ?? 0) > 0;\n                if (!isHelperCall) {\n                    visit(n.path);\n                }\n                if (params)\n                    for (const p of params)\n                        visit(p);\n                visit(hash);\n                break;\n            }\n            case 'SubExpression': {\n                // (helper arg1 arg2) — helper name in path is skipped, args carry variables.\n                const params = n.params;\n                if (params)\n                    for (const p of params)\n                        visit(p);\n                visit(n.hash);\n                break;\n            }\n            case 'PathExpression': {\n                if (n.data)\n                    break; // `@-data` references (@index, @key, etc.)\n                const parts = n.parts;\n                if (!parts || parts.length === 0)\n                    break; // `this` / `.`\n                const root = parts[0];\n                if (isLocal(root))\n                    break;\n                variables.add(root);\n                break;\n            }\n            case 'Hash': {\n                const pairs = n.pairs;\n                if (pairs)\n                    for (const pair of pairs)\n                        visit(pair.value);\n                break;\n            }\n            // ContentStatement, CommentStatement, *Literal, PartialStatement — no variables to extract.\n            default:\n                break;\n        }\n    };\n    visit(ast);\n    return variables;\n}\n//# sourceMappingURL=extract-vars.js.map","/**\n * Generate mock data that satisfies a JSON Schema.\n *\n * - string → `%property_name%` (visible placeholder, useful for previews and validation render tests)\n * - number/integer → random value 0–100\n * - boolean → true\n * - array → 1–2 items recursively generated from the items schema\n * - object → recursively populated from properties\n * - null → null\n * - $ref or unknown → `%property_name%`\n *\n * @param schema JSON schema to generate data for\n * @param propertyName Name used for string placeholders (default `value`)\n */\nexport function generateMockData(schema, propertyName = 'value') {\n    if ('$ref' in schema) {\n        return `%${propertyName}%`;\n    }\n    const types = Array.isArray(schema.type) ? schema.type : [schema.type];\n    const primaryType = types[0];\n    switch (primaryType) {\n        case 'string':\n            return `%${propertyName}%`;\n        case 'number':\n        case 'integer':\n            return Math.floor(Math.random() * 101);\n        case 'boolean':\n            return true;\n        case 'array': {\n            const itemSchema = schema.items;\n            if (itemSchema) {\n                const itemCount = Math.floor(Math.random() * 2) + 1;\n                return Array.from({ length: itemCount }, (_, index) => generateMockData(itemSchema, `${propertyName}_${index}`));\n            }\n            return [];\n        }\n        case 'object': {\n            const result = {};\n            if (schema.properties) {\n                for (const [propName, propSchema] of Object.entries(schema.properties)) {\n                    result[propName] = generateMockData(propSchema, propName);\n                }\n            }\n            return result;\n        }\n        case 'null':\n            return null;\n        default:\n            return `%${propertyName}%`;\n    }\n}\n//# sourceMappingURL=mock-data.js.map","import { PromptSegmentDefType, TemplateType } from '@vertesia/common';\nimport { CompositeError, renderHandlebarsTemplate, renderJsTemplate } from '@vertesia/jst';\n/**\n * Render a prompt template with the given input data.\n *\n * Handlebars templates use {{variable}} interpolation against `data`.\n * JST (JavaScript template) bodies evaluate against `data` with the schema's top-level\n * property names exposed as globals, plus `_model` — the active model id, which the\n * studio-server executor injects into the input as `{ ..._model: run.modelId }` when\n * executing an interaction (see `apps/studio-server/src/executor/ExecutionRequest.ts`\n * and `apps/studio-server/src/executor/rendering/template.ts`). Listing it here keeps\n * the Playground preview and `validatePrompt` in sync with runtime resolution — a JST\n * template referencing `_model` validates fine here and renders fine in production.\n *\n * For `TemplateType.text`, the content is returned verbatim — it is static text, not a\n * template — matching the studio-server executor (see `apps/studio-server/src/executor/\n * rendering/template.ts`). Routing it through the JST evaluator would compile the prose as\n * JavaScript and throw on any plain sentence (e.g. \"You are a helpful assistant.\").\n */\nexport function renderTemplate(code, contentType, schema, data) {\n    if (contentType === TemplateType.handlebars) {\n        return renderHandlebarsTemplate(code, data);\n    }\n    if (contentType === TemplateType.text) {\n        return code;\n    }\n    const globals = [...(schema.properties ? Object.keys(schema.properties) : []), '_model'];\n    return renderJsTemplate(code, globals, data);\n}\n/**\n * Execute a JST (JavaScript Template) with given data.\n * Returns a discriminated union to surface errors without throwing.\n */\nexport function executeJST(jstContent, schema, data) {\n    try {\n        const result = renderTemplate(jstContent, TemplateType.jst, schema, data);\n        return { success: true, content: result };\n    }\n    catch (error) {\n        return { success: false, error: error instanceof Error ? error.message : String(error) };\n    }\n}\n/**\n * Execute a Handlebars template with given data.\n * Returns a discriminated union to surface errors without throwing.\n */\nexport function executeHandlebars(handlebarsContent, schema, data) {\n    try {\n        const result = renderTemplate(handlebarsContent, TemplateType.handlebars, schema, data);\n        return { success: true, content: result };\n    }\n    catch (error) {\n        return { success: false, error: error instanceof Error ? error.message : String(error) };\n    }\n}\nfunction renderChatSegment(segment, data) {\n    const chatKey = getChatKey(segment.configuration);\n    const chat = data[chatKey];\n    let content;\n    if (Array.isArray(chat)) {\n        content = JSON.stringify(chat, undefined, 2);\n    }\n    else {\n        content = `No \"${chatKey}\" property found on input data`;\n    }\n    return {\n        title: 'Chat history',\n        content,\n    };\n}\nfunction renderTemplateSegment(segment, data) {\n    if (!segment.template) {\n        return { title: '(unknown segment)', content: '', error: new Error('Prompt segment is missing its template') };\n    }\n    const schema = segment.template.inputSchema || {};\n    const title = `@${segment.template.role}`;\n    try {\n        const content = renderTemplate(segment.template.content, segment.template.content_type, schema, data);\n        return { title, content, segmentId: segment.template.id };\n    }\n    catch (error) {\n        // Isolate the failure to this segment so the remaining segments still render.\n        return {\n            title,\n            content: error instanceof Error ? error.message : String(error),\n            segmentId: segment.template.id,\n            error: error instanceof Error ? error : new Error(String(error)),\n        };\n    }\n}\nexport function renderSegments(segments, data) {\n    const out = [];\n    for (const segment of segments) {\n        if (segment.type === PromptSegmentDefType.chat) {\n            out.push(renderChatSegment(segment, data));\n        }\n        else if (segment.type === PromptSegmentDefType.template) {\n            out.push(renderTemplateSegment(segment, data));\n        }\n    }\n    return out;\n}\nexport function renderSegmentsOrErrors(segments, textOrObject) {\n    try {\n        return renderSegments(segments, typeof textOrObject === 'string' ? JSON.parse(textOrObject.trim()) : textOrObject || {});\n    }\n    catch (error) {\n        if (error instanceof CompositeError) {\n            return error.errors.map((err) => ({\n                error: err,\n                title: 'Rendering Error',\n                content: err.message,\n            }));\n        }\n        return [\n            {\n                error: error instanceof Error ? error : new Error(String(error)),\n                title: 'Rendering Error',\n                content: error instanceof Error ? error.message : String(error),\n            },\n        ];\n    }\n}\nexport function renderPrompt(segments, payload) {\n    const out = [];\n    for (const segment of segments) {\n        if (segment.template) {\n            const schema = segment.template.inputSchema || {};\n            const content = renderTemplate(segment.template.content, segment.template.content_type, schema, payload);\n            out.push({ role: segment.template.role, content });\n        }\n        else if (segment.type === PromptSegmentDefType.chat) {\n            const chatKey = getChatKey(segment.configuration);\n            const messages = payload[chatKey];\n            if (!isPromptSegmentArray(messages)) {\n                throw new Error('Chat prompt segment must have a messages array');\n            }\n            for (const msg of messages) {\n                if (!msg.role) {\n                    throw new Error('Chat prompt segment must have a role');\n                }\n                out.push({ role: msg.role, content: msg.content });\n            }\n        }\n        else {\n            throw new Error(`Unknown prompt segment type: ${segment.type}`);\n        }\n    }\n    return out;\n}\nfunction getChatKey(configuration) {\n    if (typeof configuration === 'object' &&\n        configuration !== null &&\n        'chatKey' in configuration &&\n        typeof configuration.chatKey === 'string') {\n        return configuration.chatKey;\n    }\n    return 'chat';\n}\nfunction isPromptSegmentArray(value) {\n    return Array.isArray(value) && value.every(isPromptSegment);\n}\nfunction isPromptSegment(value) {\n    return typeof value === 'object' && value !== null && 'role' in value && 'content' in value;\n}\n//# sourceMappingURL=render.js.map","import { TemplateType } from '@vertesia/common';\nimport { getFreeVariables, renderJsTemplate } from '@vertesia/jst';\nimport { extractHandlebarsVariables } from './extract-vars.js';\nimport { generateMockData } from './mock-data.js';\nimport { executeHandlebars } from './render.js';\n// JST's renderJsTemplate auto-adds `_` (helpers object) and runtime injects `Set` and `Array`\n// — treat them as globals so they don't appear as free vars in user templates.\n// Globals always available to JST templates regardless of schema:\n//  - `_`, `Array`, `Set`: runtime-injected by `renderJsTemplate` (jst library)\n//  - `_model`: runtime-injected by the studio-server executor as `{ ..._model: run.modelId }`\n//    (see ExecutionRequest.ts:313 and executor/rendering/template.ts:13)\n// Keeping these in sync with `renderTemplate` in ./render.ts so a JST template that runs in\n// production also passes the validator.\nconst JST_AUTO_GLOBALS = ['_', 'Array', 'Set', '_model'];\nfunction countSeverities(issues) {\n    let error_count = 0;\n    let warning_count = 0;\n    for (const issue of issues) {\n        if (issue.severity === 'error') {\n            error_count++;\n        }\n        else if (issue.severity === 'warning') {\n            warning_count++;\n        }\n    }\n    return { error_count, warning_count };\n}\nfunction validateHandlebarsPrompt(content, inputSchema) {\n    const issues = [];\n    const usedVars = extractHandlebarsVariables(content);\n    const declaredVars = new Set(inputSchema?.properties ? Object.keys(inputSchema.properties) : []);\n    for (const used of usedVars) {\n        if (!declaredVars.has(used)) {\n            issues.push({\n                type: 'undeclared_template_variable',\n                severity: 'error',\n                variable: used,\n                message: `Template references variable '{{${used}}}' but it is not declared in input_schema.properties. Add '${used}' to the schema with an appropriate type.`,\n            });\n        }\n    }\n    for (const declared of declaredVars) {\n        if (!usedVars.has(declared)) {\n            issues.push({\n                type: 'unused_schema_variable',\n                severity: 'warning',\n                variable: declared,\n                message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or use it via {{${declared}}}.`,\n            });\n        }\n    }\n    // Render-time smoke test — always runs so syntax errors and failing helper calls are\n    // surfaced even when undeclared-variable errors are already in the list. Handlebars renders\n    // missing vars as empty strings (non-strict by default), so the render check does NOT echo\n    // the var errors — anything it reports is a distinct template problem worth showing.\n    const renderSchema = inputSchema ?? {};\n    const mockData = generateMockData(renderSchema);\n    const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData) ? mockData : {};\n    const renderResult = executeHandlebars(content, renderSchema, mockObject);\n    if (!renderResult.success) {\n        issues.push({\n            type: 'handlebars_render_error',\n            severity: 'error',\n            message: `Handlebars rendering failed: ${renderResult.error}`,\n        });\n    }\n    return issues;\n}\nfunction validateJstPrompt(content, inputSchema) {\n    const issues = [];\n    const declaredVars = new Set(inputSchema?.properties ? Object.keys(inputSchema.properties) : []);\n    let referenced;\n    try {\n        const result = getFreeVariables(content, {\n            globals: JST_AUTO_GLOBALS,\n            acorn: { allowReturnOutsideFunction: true, locations: true },\n        });\n        referenced = result.vars;\n        for (const err of result.errors) {\n            issues.push({\n                type: 'jst_unsafe_construct',\n                severity: 'error',\n                message: `JST validation error at ${err.location}: ${err.message}`,\n            });\n        }\n    }\n    catch (parseError) {\n        // Acorn parse failure — surface as render error since the template can't be compiled.\n        issues.push({\n            type: 'jst_render_error',\n            severity: 'error',\n            message: `JST parse failed: ${parseError instanceof Error ? parseError.message : String(parseError)}`,\n        });\n        return issues;\n    }\n    for (const used of referenced) {\n        if (!declaredVars.has(used)) {\n            issues.push({\n                type: 'undeclared_template_variable',\n                severity: 'error',\n                variable: used,\n                message: `Template references variable '${used}' but it is not declared in input_schema.properties. Add '${used}' to the schema with an appropriate type.`,\n            });\n        }\n    }\n    for (const declared of declaredVars) {\n        if (!referenced.has(declared)) {\n            issues.push({\n                type: 'unused_schema_variable',\n                severity: 'warning',\n                variable: declared,\n                message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or use it in the template.`,\n            });\n        }\n    }\n    // Render-time smoke test — only if there are no blocking errors so far, otherwise\n    // the failure mode would just echo what we already reported.\n    const blockingSoFar = issues.some((i) => i.severity === 'error');\n    if (!blockingSoFar) {\n        const renderSchema = inputSchema ?? {};\n        const mockData = generateMockData(renderSchema);\n        const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData)\n            ? mockData\n            : {};\n        try {\n            renderJsTemplate(content, [...declaredVars], mockObject);\n        }\n        catch (renderError) {\n            issues.push({\n                type: 'jst_render_error',\n                severity: 'error',\n                message: `JST rendering failed: ${renderError instanceof Error ? renderError.message : String(renderError)}`,\n            });\n        }\n    }\n    return issues;\n}\n/**\n * Validate a single prompt template against its declared input schema.\n *\n * For `handlebars` and `jst` templates, the following checks are performed:\n *  1. Every variable referenced in the template must be declared as a top-level property\n *     in `inputSchema.properties` (else → `undeclared_template_variable` error).\n *  2. Every property declared in `inputSchema.properties` should be referenced by the template\n *     (else → `unused_schema_variable` warning — non-blocking).\n *  3. The template must render successfully against schema-derived mock data\n *     (else → `handlebars_render_error` / `jst_render_error` error).\n *  4. For JST only: unsafe constructs (`with`, `for`, `while`, `import`, class, `this`,\n *     dynamic property lookup, blacklisted props) → `jst_unsafe_construct` error.\n *\n * `text` content type passes through with no issues.\n */\nexport function validatePrompt(input) {\n    let issues;\n    if (input.contentType === TemplateType.handlebars) {\n        issues = validateHandlebarsPrompt(input.content, input.inputSchema);\n    }\n    else if (input.contentType === TemplateType.jst) {\n        issues = validateJstPrompt(input.content, input.inputSchema);\n    }\n    else {\n        issues = [];\n    }\n    const { error_count, warning_count } = countSeverities(issues);\n    return { issues, error_count, warning_count };\n}\n//# sourceMappingURL=validate.js.map","/**\n * Class hierarchy and registry-bound interface for the role system. These\n * are LOGIC — they have runtime behavior (constructors, instance methods,\n * subclass dispatch via `instanceof`). They live in `@vertesia/studio-utils`\n * (not common) per the package-layering contract: only types stay in common.\n */\n/**\n * A role: a named bundle of permissions that ACEs reference by name.\n *\n * Generic over the permission type so subclasses can tighten it:\n *  - **System roles** declare `extends Role<Permission>` — construction time\n *    type-checks against the central `Permission` enum.\n *  - **ABAC roles** (`AbacRole`) declare `extends Role<string>` — permissions\n *    are bare verbs (`'read'`, `'write'`, `'delete'`, future domain-specific\n *    verbs) consumed by the JWT generator to form `{scope}:{verb}` keys in\n *    `content_security`.\n *\n * The registry stores `Role` (defaulting to `Role<string>`) — the loose type\n * is the lowest common denominator. Tight typing is only enforced at\n * declaration sites of the role subclasses.\n */\nexport class Role {\n    name;\n    domain;\n    permissions;\n    constructor(name, permissions, domain) {\n        this.name = name;\n        this.domain = domain;\n        this.permissions = new Set(permissions);\n    }\n    hasPermission(permission) {\n        return this.permissions.has(permission);\n    }\n}\n/**\n * Base class for built-in system roles. Hardcodes `domain: 'system'` and\n * specializes `Role<Permission>` so subclasses get compile-time type-checking\n * against the central `Permission` enum at construction.\n */\nexport class SystemRole extends Role {\n    constructor(name, permissions) {\n        super(name, permissions, 'system');\n    }\n}\n/**\n * A role usable in ResourceSet ACEs. Adds `applicableScopes` — the kinds of\n * objects the role can be applied to at the ABAC scope level. Inherits\n * `Role<string>` because ABAC verbs aren't constrained to the central\n * `Permission` enum.\n *\n * The IAM UI filters via `listAbacRolesForScope` which checks `instanceof AbacRole`.\n */\nexport class AbacRole extends Role {\n    applicableScopes;\n    constructor(name, permissions, domain, applicableScopes) {\n        super(name, permissions, domain);\n        this.applicableScopes = applicableScopes;\n    }\n}\n//# sourceMappingURL=classes.js.map","import { AbacRole } from './classes.js';\nconst ContentRoleDomain = 'content';\nconst APPLICABLE_SCOPES = ['document', 'collection'];\n/**\n * Names of roles owned by the `content` domain. Apply to ResourceSet ACEs\n * scoped to either `document` or `collection` — the semantics of \"read\n * content\" are the same for both kinds.\n */\nexport var ContentRoleNames;\n(function (ContentRoleNames) {\n    ContentRoleNames[\"content_reader\"] = \"content:reader\";\n    ContentRoleNames[\"content_writer\"] = \"content:writer\";\n    ContentRoleNames[\"content_manager\"] = \"content:manager\";\n})(ContentRoleNames || (ContentRoleNames = {}));\nclass ContentReaderRole extends AbacRole {\n    constructor() {\n        super(ContentRoleNames.content_reader, ['read'], ContentRoleDomain, APPLICABLE_SCOPES);\n    }\n}\nclass ContentWriterRole extends AbacRole {\n    constructor() {\n        super(ContentRoleNames.content_writer, ['read', 'write'], ContentRoleDomain, APPLICABLE_SCOPES);\n    }\n}\nclass ContentManagerRole extends AbacRole {\n    constructor() {\n        super(ContentRoleNames.content_manager, ['read', 'write', 'delete'], ContentRoleDomain, APPLICABLE_SCOPES);\n    }\n}\nconst contentRoles = {\n    [ContentRoleNames.content_reader]: new ContentReaderRole(),\n    [ContentRoleNames.content_writer]: new ContentWriterRole(),\n    [ContentRoleNames.content_manager]: new ContentManagerRole(),\n};\nexport const contentPartition = {\n    domain: ContentRoleDomain,\n    roles: new Map(Object.entries(contentRoles)),\n};\n//# sourceMappingURL=content.js.map","import { Permission, SystemRoles } from '@vertesia/common';\nimport { SystemRole } from './classes.js';\nclass OrgMemberRole extends SystemRole {\n    constructor(name, permissions) {\n        super(name, [Permission.account_member, ...permissions]);\n    }\n}\nclass OwnerRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.owner, Object.values(Permission));\n    }\n}\nclass AdminRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.admin, Object.values(Permission));\n    }\n}\nclass ManagerRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.manager, Object.values(Permission));\n        this.permissions.delete(Permission.account_admin);\n        this.permissions.delete(Permission.manage_billing);\n        this.permissions.delete(Permission.audit_read);\n        this.permissions.delete(Permission.agent_run_read);\n        this.permissions.delete(Permission.content_read_all);\n        this.permissions.delete(Permission.content_superadmin);\n        this.permissions.delete(Permission.workflow_superadmin);\n    }\n}\nclass DeveloperRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.developer, Object.values(Permission));\n        this.permissions.delete(Permission.account_admin);\n        this.permissions.delete(Permission.project_admin);\n        this.permissions.delete(Permission.project_settings_write);\n        this.permissions.delete(Permission.env_admin);\n        this.permissions.delete(Permission.manage_billing);\n        this.permissions.delete(Permission.audit_read);\n        this.permissions.delete(Permission.agent_run_read);\n        this.permissions.delete(Permission.content_read_all);\n        this.permissions.delete(Permission.content_superadmin);\n        this.permissions.delete(Permission.workflow_superadmin);\n    }\n}\nclass ApplicationRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.application, [\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.int_write,\n            Permission.run_read,\n            Permission.content_write,\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_admin,\n            Permission.project_admin,\n            Permission.workflow_run,\n            Permission.project_settings_write,\n            Permission.account_write,\n        ]);\n    }\n}\nclass AutomationRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.automation, [\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_admin,\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.run_read,\n            Permission.workflow_run,\n            Permission.project_integration_read,\n        ]);\n    }\n}\nclass ContentProcessorRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.content_processor, [\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_admin,\n            Permission.content_superadmin,\n            Permission.int_execute,\n            Permission.workflow_read,\n            Permission.workflow_run,\n            Permission.run_read,\n        ]);\n    }\n}\nclass ConsumerRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.consumer, [\n            Permission.content_admin,\n            Permission.content_read,\n            Permission.content_write,\n            Permission.content_delete,\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.run_read,\n            Permission.workflow_run,\n        ]);\n    }\n}\nclass ExecutorRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.executor, [Permission.int_execute, Permission.run_read, Permission.workflow_run]);\n    }\n}\nclass ReaderRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.reader, [Permission.int_read, Permission.run_read, Permission.content_read]);\n    }\n}\nconst READ_ONLY_AUDIT_PERMISSIONS = [\n    Permission.studio_access,\n    Permission.account_read,\n    Permission.project_integration_read,\n    Permission.api_key_read,\n    Permission.billing_read,\n    Permission.audit_read,\n    Permission.int_read,\n    Permission.run_read,\n    Permission.content_read,\n    Permission.content_read_all,\n    Permission.task_read,\n    Permission.workflow_read,\n    Permission.agent_run_read,\n];\nclass ReadOnlyAuditRole extends OrgMemberRole {\n    constructor(name) {\n        super(name, READ_ONLY_AUDIT_PERMISSIONS);\n    }\n}\nclass BillingRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.billing, [Permission.manage_billing]);\n    }\n}\nclass AppMemberRole extends OrgMemberRole {\n    constructor() {\n        super(SystemRoles.app_member, [\n            Permission.int_read,\n            Permission.int_execute,\n            Permission.int_write,\n            Permission.run_read,\n            Permission.content_write,\n            Permission.content_read,\n            Permission.content_delete,\n            Permission.workflow_run,\n        ]);\n    }\n}\nclass ContentSuperAdmin extends DeveloperRole {\n    constructor() {\n        super();\n        this.name = SystemRoles.content_superadmin;\n        this.permissions.add(Permission.content_superadmin);\n    }\n}\n// The enum is still named `SystemRoles` (historical); the partition's domain\n// is `system` — the foundational built-in roles, distinct from feature domains\n// like `content` or `tasks`. Renaming the enum to `SystemRoles` is a separate\n// concern to revisit later.\nconst systemRoles = {\n    [SystemRoles.owner]: new OwnerRole(),\n    [SystemRoles.admin]: new AdminRole(),\n    [SystemRoles.manager]: new ManagerRole(),\n    [SystemRoles.developer]: new DeveloperRole(),\n    [SystemRoles.application]: new ApplicationRole(),\n    [SystemRoles.automation]: new AutomationRole(),\n    [SystemRoles.content_processor]: new ContentProcessorRole(),\n    [SystemRoles.consumer]: new ConsumerRole(),\n    [SystemRoles.executor]: new ExecutorRole(),\n    [SystemRoles.reader]: new ReaderRole(),\n    [SystemRoles.auditor]: new ReadOnlyAuditRole(SystemRoles.auditor),\n    [SystemRoles.support]: new ReadOnlyAuditRole(SystemRoles.support),\n    [SystemRoles.billing]: new BillingRole(),\n    [SystemRoles.app_member]: new AppMemberRole(),\n    [SystemRoles.member]: new OrgMemberRole(SystemRoles.member, []),\n    [SystemRoles.content_superadmin]: new ContentSuperAdmin(),\n};\nexport const systemPartition = {\n    domain: 'system',\n    roles: new Map(Object.entries(systemRoles)),\n};\n//# sourceMappingURL=system.js.map","import { AbacRole, SystemRole } from './classes.js';\nimport { contentPartition } from './content.js';\nimport { systemPartition } from './system.js';\nexport { AbacRole, Role, SystemRole } from './classes.js';\nexport { ContentRoleNames } from './content.js';\n/**\n * The ordered partition registry. Partitions are queried in this order — first\n * match wins. The `system` partition is registered first so domain-specific\n * partitions (added later) cannot shadow built-in system roles.\n */\nconst partitions = [systemPartition, contentPartition];\n/** Look up a role by its name across all registered partitions. */\nexport function getRoleByName(name) {\n    for (const partition of partitions) {\n        const role = partition.roles.get(name);\n        if (role)\n            return role;\n    }\n    throw new Error(`Role ${name} not found`);\n}\n/** List every role across all partitions, in partition registration order. */\nexport function listRoles() {\n    const result = [];\n    for (const partition of partitions) {\n        for (const role of partition.roles.values()) {\n            result.push(role);\n        }\n    }\n    return result;\n}\n/** Roles owned by a specific domain (e.g. `'system'`, `'content'`). */\nexport function listRolesByDomain(domain) {\n    const partition = partitions.find((p) => p.domain === domain);\n    return partition ? Array.from(partition.roles.values()) : [];\n}\n/**\n * ABAC roles applicable to a given ResourceSet scope (e.g. `'document'`,\n * `'collection'`). System roles are excluded — they don't carry scope semantics.\n */\nexport function listAbacRolesForScope(scope) {\n    return listRoles().filter((r) => r instanceof AbacRole && r.applicableScopes.includes(scope));\n}\n/** Shortcut for the system partition: returns only `SystemRole` instances. */\nexport function listSystemRoles() {\n    return listRoles().filter((r) => r instanceof SystemRole);\n}\n/** Names of every registered role across all partitions — suited for mongoose schema enum constraints. */\nexport function getAllRoleNames() {\n    return listRoles().map((r) => r.name);\n}\n/**\n * Merge the permissions granted by a set of roles into a single array.\n * Intended for the system-role gating path. For ABAC roles, the bare-verb\n * permissions returned here aren't directly meaningful — use the JWT\n * `content_security` pathway instead.\n */\nexport function getPermissionsForRoles(roleNames) {\n    const permissions = new Set();\n    for (const roleName of roleNames) {\n        const role = getRoleByName(roleName);\n        for (const permission of role.permissions) {\n            permissions.add(permission);\n        }\n    }\n    return Array.from(permissions);\n}\n/**\n * A list of roles with a unified `hasPermission` check across them.\n */\nexport class RoleList {\n    roles;\n    constructor(roles) {\n        this.roles = roles;\n    }\n    static fromRoleNames(roleNames) {\n        const roles = roleNames.map((r) => getRoleByName(r));\n        return new RoleList(roles);\n    }\n    static fromRoleName(roleName) {\n        const roles = [getRoleByName(roleName)];\n        return new RoleList(roles);\n    }\n    hasPermission(perm) {\n        return this.roles.some((role) => role.hasPermission(perm));\n    }\n}\n//# sourceMappingURL=index.js.map"],"mappings":"8PAkBA,SAAgB,EAA2B,EAAU,CACjD,IAAI,EACJ,GAAI,CACA,EAAM,EAAW,MAAM,CAAQ,CACnC,MACM,CACF,OAAO,IAAI,GACf,CACA,IAAM,EAAY,IAAI,IAChB,EAAc,CAAC,EACf,EAAW,GAAS,EAAY,KAAM,GAAU,EAAM,IAAI,CAAI,CAAC,EAC/D,EAAS,GAAS,CACpB,GAAI,CAAC,GAAQ,OAAO,GAAS,SACzB,OACJ,IAAM,EAAI,EACV,OAAQ,EAAE,KAAV,CACI,IAAK,UAAW,CACZ,IAAM,EAAO,EAAE,KACf,GAAI,EACA,IAAK,IAAM,KAAQ,EACf,EAAM,CAAI,EAClB,KACJ,CACA,IAAK,iBAAkB,CAGnB,IAAM,EAAS,EAAE,OACjB,GAAI,EACA,IAAK,IAAM,KAAK,EACZ,EAAM,CAAC,EACf,EAAM,EAAE,IAAI,EAEZ,IAAM,EAAU,EAAE,QACZ,EAAU,EAAE,QACZ,EAAQ,IAAI,IAAI,CAAC,GAAI,GAAS,aAAe,CAAC,EAAI,GAAI,GAAS,aAAe,CAAC,CAAE,CAAC,EACxF,EAAY,KAAK,CAAK,EACtB,EAAM,EAAE,OAAO,EACf,EAAM,EAAE,OAAO,EACf,EAAY,IAAI,EAChB,KACJ,CACA,IAAK,oBAAqB,CAGtB,IAAM,EAAS,EAAE,OACX,EAAO,EAAE,KAKf,IAJsB,GAAQ,QAAU,GAAK,IAAM,GAAM,OAAO,QAAU,GAAK,GAE3E,EAAM,EAAE,IAAI,EAEZ,EACA,IAAK,IAAM,KAAK,EACZ,EAAM,CAAC,EACf,EAAM,CAAI,EACV,KACJ,CACA,IAAK,gBAAiB,CAElB,IAAM,EAAS,EAAE,OACjB,GAAI,EACA,IAAK,IAAM,KAAK,EACZ,EAAM,CAAC,EACf,EAAM,EAAE,IAAI,EACZ,KACJ,CACA,IAAK,iBAAkB,CACnB,GAAI,EAAE,KACF,MACJ,IAAM,EAAQ,EAAE,MAChB,GAAI,CAAC,GAAS,EAAM,SAAW,EAC3B,MACJ,IAAM,EAAO,EAAM,GACnB,GAAI,EAAQ,CAAI,EACZ,MACJ,EAAU,IAAI,CAAI,EAClB,KACJ,CACA,IAAK,OAAQ,CACT,IAAM,EAAQ,EAAE,MAChB,GAAI,EACA,IAAK,IAAM,KAAQ,EACf,EAAM,EAAK,KAAK,EACxB,KACJ,CAEA,QACI,KACR,CACJ,EAEA,OADA,EAAM,CAAG,EACF,CACX,CC/FA,SAAgB,EAAiB,EAAQ,EAAe,QAAS,CAC7D,GAAI,SAAU,EACV,MAAO,IAAI,EAAa,GAI5B,QAFc,MAAM,QAAQ,EAAO,IAAI,EAAI,EAAO,KAAO,CAAC,EAAO,IAAI,EAAA,CAC3C,GAC1B,CACI,IAAK,SACD,MAAO,IAAI,EAAa,GAC5B,IAAK,SACL,IAAK,UACD,OAAO,KAAK,MAAM,KAAK,OAAO,EAAI,GAAG,EACzC,IAAK,UACD,MAAO,GACX,IAAK,QAAS,CACV,IAAM,EAAa,EAAO,MAC1B,GAAI,EAAY,CACZ,IAAM,EAAY,KAAK,MAAM,KAAK,OAAO,EAAI,CAAC,EAAI,EAClD,OAAO,MAAM,KAAK,CAAE,OAAQ,CAAU,GAAI,EAAG,IAAU,EAAiB,EAAY,GAAG,EAAa,GAAG,GAAO,CAAC,CACnH,CACA,MAAO,CAAC,CACZ,CACA,IAAK,SAAU,CACX,IAAM,EAAS,CAAC,EAChB,GAAI,EAAO,WACP,IAAK,GAAM,CAAC,EAAU,KAAe,OAAO,QAAQ,EAAO,UAAU,EACjE,EAAO,GAAY,EAAiB,EAAY,CAAQ,EAGhE,OAAO,CACX,CACA,IAAK,OACD,OAAO,KACX,QACI,MAAO,IAAI,EAAa,EAChC,CACJ,CC/BA,SAAgB,EAAe,EAAM,EAAa,EAAQ,EAAM,CAQ5D,OAPI,IAAgB,EAAa,WACtB,EAAyB,EAAM,CAAI,EAE1C,IAAgB,EAAa,KACtB,EAGJ,EAAiB,EAAM,CADb,GAAI,EAAO,WAAa,OAAO,KAAK,EAAO,UAAU,EAAI,CAAC,EAAI,QAC3C,EAAG,CAAI,CAC/C,CAKA,SAAgB,EAAW,EAAY,EAAQ,EAAM,CACjD,GAAI,CAEA,MAAO,CAAE,QAAS,GAAM,QADT,EAAe,EAAY,EAAa,IAAK,EAAQ,CAC9B,CAAE,CAC5C,OACO,EAAO,CACV,MAAO,CAAE,QAAS,GAAO,MAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAE,CAC3F,CACJ,CAKA,SAAgB,EAAkB,EAAmB,EAAQ,EAAM,CAC/D,GAAI,CAEA,MAAO,CAAE,QAAS,GAAM,QADT,EAAe,EAAmB,EAAa,WAAY,EAAQ,CAC5C,CAAE,CAC5C,OACO,EAAO,CACV,MAAO,CAAE,QAAS,GAAO,MAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAE,CAC3F,CACJ,CACA,SAAS,EAAkB,EAAS,EAAM,CACtC,IAAM,EAAU,EAAW,EAAQ,aAAa,EAC1C,EAAO,EAAK,GACd,EAOJ,MANA,CAII,EAJA,MAAM,QAAQ,CAAI,EACR,KAAK,UAAU,EAAM,IAAA,GAAW,CAAC,EAGjC,OAAO,EAAQ,gCAEtB,CACH,MAAO,eACP,SACJ,CACJ,CACA,SAAS,GAAsB,EAAS,EAAM,CAC1C,GAAI,CAAC,EAAQ,SACT,MAAO,CAAE,MAAO,oBAAqB,QAAS,GAAI,MAAW,MAAM,wCAAwC,CAAE,EAEjH,IAAM,EAAS,EAAQ,SAAS,aAAe,CAAC,EAC1C,EAAQ,IAAI,EAAQ,SAAS,OACnC,GAAI,CAEA,MAAO,CAAE,QAAO,QADA,EAAe,EAAQ,SAAS,QAAS,EAAQ,SAAS,aAAc,EAAQ,CAC1E,EAAG,UAAW,EAAQ,SAAS,EAAG,CAC5D,OACO,EAAO,CAEV,MAAO,CACH,QACA,QAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAC9D,UAAW,EAAQ,SAAS,GAC5B,MAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CACnE,CACJ,CACJ,CACA,SAAgB,EAAe,EAAU,EAAM,CAC3C,IAAM,EAAM,CAAC,EACb,IAAK,IAAM,KAAW,EACd,EAAQ,OAAS,EAAqB,KACtC,EAAI,KAAK,EAAkB,EAAS,CAAI,CAAC,EAEpC,EAAQ,OAAS,EAAqB,UAC3C,EAAI,KAAK,GAAsB,EAAS,CAAI,CAAC,EAGrD,OAAO,CACX,CACA,SAAgB,EAAuB,EAAU,EAAc,CAC3D,GAAI,CACA,OAAO,EAAe,EAAU,OAAO,GAAiB,SAAW,KAAK,MAAM,EAAa,KAAK,CAAC,EAAI,GAAgB,CAAC,CAAC,CAC3H,OACO,EAAO,CAQV,OAPI,aAAiB,EACV,EAAM,OAAO,IAAK,IAAS,CAC9B,MAAO,EACP,MAAO,kBACP,QAAS,EAAI,OACjB,EAAE,EAEC,CACH,CACI,MAAO,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,EAC/D,MAAO,kBACP,QAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAClE,CACJ,CACJ,CACJ,CACA,SAAgB,EAAa,EAAU,EAAS,CAC5C,IAAM,EAAM,CAAC,EACb,IAAK,IAAM,KAAW,EAClB,GAAI,EAAQ,SAAU,CAClB,IAAM,EAAS,EAAQ,SAAS,aAAe,CAAC,EAC1C,EAAU,EAAe,EAAQ,SAAS,QAAS,EAAQ,SAAS,aAAc,EAAQ,CAAO,EACvG,EAAI,KAAK,CAAE,KAAM,EAAQ,SAAS,KAAM,SAAQ,CAAC,CACrD,MACK,GAAI,EAAQ,OAAS,EAAqB,KAAM,CAEjD,IAAM,EAAW,EADD,EAAW,EAAQ,aACJ,GAC/B,GAAI,CAAC,EAAqB,CAAQ,EAC9B,MAAU,MAAM,gDAAgD,EAEpE,IAAK,IAAM,KAAO,EAAU,CACxB,GAAI,CAAC,EAAI,KACL,MAAU,MAAM,sCAAsC,EAE1D,EAAI,KAAK,CAAE,KAAM,EAAI,KAAM,QAAS,EAAI,OAAQ,CAAC,CACrD,CACJ,MAEI,MAAU,MAAM,gCAAgC,EAAQ,MAAM,EAGtE,OAAO,CACX,CACA,SAAS,EAAW,EAAe,CAO/B,OANI,OAAO,GAAkB,UACzB,GACA,YAAa,GACb,OAAO,EAAc,SAAY,SAC1B,EAAc,QAElB,MACX,CACA,SAAS,EAAqB,EAAO,CACjC,OAAO,MAAM,QAAQ,CAAK,GAAK,EAAM,MAAM,CAAe,CAC9D,CACA,SAAS,EAAgB,EAAO,CAC5B,OAAO,OAAO,GAAU,YAAY,GAAkB,SAAU,GAAS,YAAa,CAC1F,CCvJA,MAAM,EAAmB,CAAC,IAAK,QAAS,MAAO,QAAQ,EACvD,SAAS,EAAgB,EAAQ,CAC7B,IAAI,EAAc,EACd,EAAgB,EACpB,IAAK,IAAM,KAAS,EACZ,EAAM,WAAa,QACnB,IAEK,EAAM,WAAa,WACxB,IAGR,MAAO,CAAE,cAAa,eAAc,CACxC,CACA,SAAS,GAAyB,EAAS,EAAa,CACpD,IAAM,EAAS,CAAC,EACV,EAAW,EAA2B,CAAO,EAC7C,EAAe,IAAI,IAAI,GAAa,WAAa,OAAO,KAAK,EAAY,UAAU,EAAI,CAAC,CAAC,EAC/F,IAAK,IAAM,KAAQ,EACV,EAAa,IAAI,CAAI,GACtB,EAAO,KAAK,CACR,KAAM,+BACN,SAAU,QACV,SAAU,EACV,QAAS,mCAAmC,EAAK,8DAA8D,EAAK,0CACxH,CAAC,EAGT,IAAK,IAAM,KAAY,EACd,EAAS,IAAI,CAAQ,GACtB,EAAO,KAAK,CACR,KAAM,yBACN,SAAU,UACV,SAAU,EACV,QAAS,6BAA6B,EAAS,sFAAsF,EAAS,IAClJ,CAAC,EAOT,IAAM,EAAe,GAAe,CAAC,EAC/B,EAAW,EAAiB,CAAY,EAExC,EAAe,EAAkB,EAAS,EAD7B,OAAO,GAAa,UAAY,GAAqB,CAAC,MAAM,QAAQ,CAAQ,EAAI,EAAW,CAAC,CACvC,EAQxE,OAPK,EAAa,SACd,EAAO,KAAK,CACR,KAAM,0BACN,SAAU,QACV,QAAS,gCAAgC,EAAa,OAC1D,CAAC,EAEE,CACX,CACA,SAAS,GAAkB,EAAS,EAAa,CAC7C,IAAM,EAAS,CAAC,EACV,EAAe,IAAI,IAAI,GAAa,WAAa,OAAO,KAAK,EAAY,UAAU,EAAI,CAAC,CAAC,EAC3F,EACJ,GAAI,CACA,IAAM,EAAS,EAAiB,EAAS,CACrC,QAAS,EACT,MAAO,CAAE,2BAA4B,GAAM,UAAW,EAAK,CAC/D,CAAC,EACD,EAAa,EAAO,KACpB,IAAK,IAAM,KAAO,EAAO,OACrB,EAAO,KAAK,CACR,KAAM,uBACN,SAAU,QACV,QAAS,2BAA2B,EAAI,SAAS,IAAI,EAAI,SAC7D,CAAC,CAET,OACO,EAAY,CAOf,OALA,EAAO,KAAK,CACR,KAAM,mBACN,SAAU,QACV,QAAS,qBAAqB,aAAsB,MAAQ,EAAW,QAAU,OAAO,CAAU,GACtG,CAAC,EACM,CACX,CACA,IAAK,IAAM,KAAQ,EACV,EAAa,IAAI,CAAI,GACtB,EAAO,KAAK,CACR,KAAM,+BACN,SAAU,QACV,SAAU,EACV,QAAS,iCAAiC,EAAK,4DAA4D,EAAK,0CACpH,CAAC,EAGT,IAAK,IAAM,KAAY,EACd,EAAW,IAAI,CAAQ,GACxB,EAAO,KAAK,CACR,KAAM,yBACN,SAAU,UACV,SAAU,EACV,QAAS,6BAA6B,EAAS,+FACnD,CAAC,EAMT,GAAI,CADkB,EAAO,KAAM,GAAM,EAAE,WAAa,OACvC,EAAG,CAEhB,IAAM,EAAW,EADI,GAAe,CAAC,CACS,EACxC,EAAa,OAAO,GAAa,UAAY,GAAqB,CAAC,MAAM,QAAQ,CAAQ,EACzF,EACA,CAAC,EACP,GAAI,CACA,EAAiB,EAAS,CAAC,GAAG,CAAY,EAAG,CAAU,CAC3D,OACO,EAAa,CAChB,EAAO,KAAK,CACR,KAAM,mBACN,SAAU,QACV,QAAS,yBAAyB,aAAuB,MAAQ,EAAY,QAAU,OAAO,CAAW,GAC7G,CAAC,CACL,CACJ,CACA,OAAO,CACX,CAgBA,SAAgB,GAAe,EAAO,CAClC,IAAI,EACJ,AAOI,EAPA,EAAM,cAAgB,EAAa,WAC1B,GAAyB,EAAM,QAAS,EAAM,WAAW,EAE7D,EAAM,cAAgB,EAAa,IAC/B,GAAkB,EAAM,QAAS,EAAM,WAAW,EAGlD,CAAC,EAEd,GAAM,CAAE,cAAa,iBAAkB,EAAgB,CAAM,EAC7D,MAAO,CAAE,SAAQ,cAAa,eAAc,CAChD,CChJA,IAAa,EAAb,KAAkB,CACd,KACA,OACA,YACA,YAAY,EAAM,EAAa,EAAQ,CACnC,KAAK,KAAO,EACZ,KAAK,OAAS,EACd,KAAK,YAAc,IAAI,IAAI,CAAW,CAC1C,CACA,cAAc,EAAY,CACtB,OAAO,KAAK,YAAY,IAAI,CAAU,CAC1C,CACJ,EAMa,EAAb,cAAgC,CAAK,CACjC,YAAY,EAAM,EAAa,CAC3B,MAAM,EAAM,EAAa,QAAQ,CACrC,CACJ,EASa,EAAb,cAA8B,CAAK,CAC/B,iBACA,YAAY,EAAM,EAAa,EAAQ,EAAkB,CACrD,MAAM,EAAM,EAAa,CAAM,EAC/B,KAAK,iBAAmB,CAC5B,CACJ,ECzDA,MAAM,EAAoB,UACpB,EAAoB,CAAC,WAAY,YAAY,EAMnD,IAAW,GACV,SAAU,EAAkB,CACzB,EAAiB,eAAoB,iBACrC,EAAiB,eAAoB,iBACrC,EAAiB,gBAAqB,iBAC1C,EAAA,CAAG,AAAqB,IAAmB,CAAC,CAAE,EAC9C,IAAM,EAAN,cAAgC,CAAS,CACrC,aAAc,CACV,MAAM,EAAiB,eAAgB,CAAC,MAAM,EAAG,EAAmB,CAAiB,CACzF,CACJ,EACM,EAAN,cAAgC,CAAS,CACrC,aAAc,CACV,MAAM,EAAiB,eAAgB,CAAC,OAAQ,OAAO,EAAG,EAAmB,CAAiB,CAClG,CACJ,EACM,EAAN,cAAiC,CAAS,CACtC,aAAc,CACV,MAAM,EAAiB,gBAAiB,CAAC,OAAQ,QAAS,QAAQ,EAAG,EAAmB,CAAiB,CAC7G,CACJ,EACA,MAAM,EAAe,EAChB,EAAiB,gBAAiB,IAAI,GACtC,EAAiB,gBAAiB,IAAI,GACtC,EAAiB,iBAAkB,IAAI,CAC5C,EACa,EAAmB,CAC5B,OAAQ,EACR,MAAO,IAAI,IAAI,OAAO,QAAQ,CAAY,CAAC,CAC/C,ECnCA,IAAM,EAAN,cAA4B,CAAW,CACnC,YAAY,EAAM,EAAa,CAC3B,MAAM,EAAM,CAAC,EAAW,eAAgB,GAAG,CAAW,CAAC,CAC3D,CACJ,EACM,EAAN,cAAwB,CAAc,CAClC,aAAc,CACV,MAAM,EAAY,MAAO,OAAO,OAAO,CAAU,CAAC,CACtD,CACJ,EACM,EAAN,cAAwB,CAAc,CAClC,aAAc,CACV,MAAM,EAAY,MAAO,OAAO,OAAO,CAAU,CAAC,CACtD,CACJ,EACM,EAAN,cAA0B,CAAc,CACpC,aAAc,CACV,MAAM,EAAY,QAAS,OAAO,OAAO,CAAU,CAAC,EACpD,KAAK,YAAY,OAAO,EAAW,aAAa,EAChD,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,UAAU,EAC7C,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,gBAAgB,EACnD,KAAK,YAAY,OAAO,EAAW,kBAAkB,EACrD,KAAK,YAAY,OAAO,EAAW,mBAAmB,CAC1D,CACJ,EACM,EAAN,cAA4B,CAAc,CACtC,aAAc,CACV,MAAM,EAAY,UAAW,OAAO,OAAO,CAAU,CAAC,EACtD,KAAK,YAAY,OAAO,EAAW,aAAa,EAChD,KAAK,YAAY,OAAO,EAAW,aAAa,EAChD,KAAK,YAAY,OAAO,EAAW,sBAAsB,EACzD,KAAK,YAAY,OAAO,EAAW,SAAS,EAC5C,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,UAAU,EAC7C,KAAK,YAAY,OAAO,EAAW,cAAc,EACjD,KAAK,YAAY,OAAO,EAAW,gBAAgB,EACnD,KAAK,YAAY,OAAO,EAAW,kBAAkB,EACrD,KAAK,YAAY,OAAO,EAAW,mBAAmB,CAC1D,CACJ,EACM,EAAN,cAA8B,CAAc,CACxC,aAAc,CACV,MAAM,EAAY,YAAa,CAC3B,EAAW,SACX,EAAW,YACX,EAAW,UACX,EAAW,SACX,EAAW,cACX,EAAW,aACX,EAAW,cACX,EAAW,cACX,EAAW,cACX,EAAW,aACX,EAAW,uBACX,EAAW,aACf,CAAC,CACL,CACJ,EACM,GAAN,cAA6B,CAAc,CACvC,aAAc,CACV,MAAM,EAAY,WAAY,CAC1B,EAAW,aACX,EAAW,cACX,EAAW,cACX,EAAW,SACX,EAAW,YACX,EAAW,SACX,EAAW,aACX,EAAW,wBACf,CAAC,CACL,CACJ,EACM,EAAN,cAAmC,CAAc,CAC7C,aAAc,CACV,MAAM,EAAY,kBAAmB,CACjC,EAAW,aACX,EAAW,cACX,EAAW,cACX,EAAW,mBACX,EAAW,YACX,EAAW,cACX,EAAW,aACX,EAAW,QACf,CAAC,CACL,CACJ,EACM,EAAN,cAA2B,CAAc,CACrC,aAAc,CACV,MAAM,EAAY,SAAU,CACxB,EAAW,cACX,EAAW,aACX,EAAW,cACX,EAAW,eACX,EAAW,SACX,EAAW,YACX,EAAW,SACX,EAAW,YACf,CAAC,CACL,CACJ,EACM,EAAN,cAA2B,CAAc,CACrC,aAAc,CACV,MAAM,EAAY,SAAU,CAAC,EAAW,YAAa,EAAW,SAAU,EAAW,YAAY,CAAC,CACtG,CACJ,EACM,EAAN,cAAyB,CAAc,CACnC,aAAc,CACV,MAAM,EAAY,OAAQ,CAAC,EAAW,SAAU,EAAW,SAAU,EAAW,YAAY,CAAC,CACjG,CACJ,EACA,MAAM,EAA8B,CAChC,EAAW,cACX,EAAW,aACX,EAAW,yBACX,EAAW,aACX,EAAW,aACX,EAAW,WACX,EAAW,SACX,EAAW,SACX,EAAW,aACX,EAAW,iBACX,EAAW,UACX,EAAW,cACX,EAAW,cACf,EACA,IAAM,EAAN,cAAgC,CAAc,CAC1C,YAAY,EAAM,CACd,MAAM,EAAM,CAA2B,CAC3C,CACJ,EACM,EAAN,cAA0B,CAAc,CACpC,aAAc,CACV,MAAM,EAAY,QAAS,CAAC,EAAW,cAAc,CAAC,CAC1D,CACJ,EACM,EAAN,cAA4B,CAAc,CACtC,aAAc,CACV,MAAM,EAAY,WAAY,CAC1B,EAAW,SACX,EAAW,YACX,EAAW,UACX,EAAW,SACX,EAAW,cACX,EAAW,aACX,EAAW,eACX,EAAW,YACf,CAAC,CACL,CACJ,EACM,EAAN,cAAgC,CAAc,CAC1C,aAAc,CACV,MAAM,EACN,KAAK,KAAO,EAAY,mBACxB,KAAK,YAAY,IAAI,EAAW,kBAAkB,CACtD,CACJ,EAKA,MAAM,EAAc,EACf,EAAY,OAAQ,IAAI,GACxB,EAAY,OAAQ,IAAI,GACxB,EAAY,SAAU,IAAI,GAC1B,EAAY,WAAY,IAAI,GAC5B,EAAY,aAAc,IAAI,GAC9B,EAAY,YAAa,IAAI,IAC7B,EAAY,mBAAoB,IAAI,GACpC,EAAY,UAAW,IAAI,GAC3B,EAAY,UAAW,IAAI,GAC3B,EAAY,QAAS,IAAI,GACzB,EAAY,SAAU,IAAI,EAAkB,EAAY,OAAO,GAC/D,EAAY,SAAU,IAAI,EAAkB,EAAY,OAAO,GAC/D,EAAY,SAAU,IAAI,GAC1B,EAAY,YAAa,IAAI,GAC7B,EAAY,QAAS,IAAI,EAAc,EAAY,OAAQ,CAAC,CAAC,GAC7D,EAAY,oBAAqB,IAAI,CAC1C,EC3KM,EAAa,CAAC,CD6KhB,OAAQ,SACR,MAAO,IAAI,IAAI,OAAO,QAAQ,CAAW,CAAC,CC9K1B,EAAiB,CAAgB,EAErD,SAAgB,EAAc,EAAM,CAChC,IAAK,IAAM,KAAa,EAAY,CAChC,IAAM,EAAO,EAAU,MAAM,IAAI,CAAI,EACrC,GAAI,EACA,OAAO,CACf,CACA,MAAU,MAAM,QAAQ,EAAK,WAAW,CAC5C,CAEA,SAAgB,GAAY,CACxB,IAAM,EAAS,CAAC,EAChB,IAAK,IAAM,KAAa,EACpB,IAAK,IAAM,KAAQ,EAAU,MAAM,OAAO,EACtC,EAAO,KAAK,CAAI,EAGxB,OAAO,CACX,CAEA,SAAgB,GAAkB,EAAQ,CACtC,IAAM,EAAY,EAAW,KAAM,GAAM,EAAE,SAAW,CAAM,EAC5D,OAAO,EAAY,MAAM,KAAK,EAAU,MAAM,OAAO,CAAC,EAAI,CAAC,CAC/D,CAKA,SAAgB,GAAsB,EAAO,CACzC,OAAO,EAAU,CAAC,CAAC,OAAQ,GAAM,aAAa,GAAY,EAAE,iBAAiB,SAAS,CAAK,CAAC,CAChG,CAEA,SAAgB,IAAkB,CAC9B,OAAO,EAAU,CAAC,CAAC,OAAQ,GAAM,aAAa,CAAU,CAC5D,CAEA,SAAgB,IAAkB,CAC9B,OAAO,EAAU,CAAC,CAAC,IAAK,GAAM,EAAE,IAAI,CACxC,CAOA,SAAgB,GAAuB,EAAW,CAC9C,IAAM,EAAc,IAAI,IACxB,IAAK,IAAM,KAAY,EAAW,CAC9B,IAAM,EAAO,EAAc,CAAQ,EACnC,IAAK,IAAM,KAAc,EAAK,YAC1B,EAAY,IAAI,CAAU,CAElC,CACA,OAAO,MAAM,KAAK,CAAW,CACjC,CAIA,IAAa,EAAb,MAAa,CAAS,CAClB,MACA,YAAY,EAAO,CACf,KAAK,MAAQ,CACjB,CACA,OAAO,cAAc,EAAW,CAC5B,IAAM,EAAQ,EAAU,IAAK,GAAM,EAAc,CAAC,CAAC,EACnD,OAAO,IAAI,EAAS,CAAK,CAC7B,CACA,OAAO,aAAa,EAAU,CAC1B,IAAM,EAAQ,CAAC,EAAc,CAAQ,CAAC,EACtC,OAAO,IAAI,EAAS,CAAK,CAC7B,CACA,cAAc,EAAM,CAChB,OAAO,KAAK,MAAM,KAAM,GAAS,EAAK,cAAc,CAAI,CAAC,CAC7D,CACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertesia/studio-utils",
-  "version": "1.5.0-dev.20260714.072725Z",
+  "version": "1.5.0-dev.20260717.131047Z",
   "type": "module",
   "description": "Shared utilities for Vertesia studio: prompt template rendering, schema-based mock data generation, prompt and interaction validation helpers.",
   "main": "./lib/index.js",
@@ -14,6 +14,10 @@
       "types": "./lib/conditions/index.d.ts",
       "default": "./lib/conditions/index.js"
     },
+    "./apps": {
+      "types": "./lib/apps/index.d.ts",
+      "default": "./lib/apps/index.js"
+    },
     "./logger": {
       "types": "./lib/logger.d.ts",
       "default": "./lib/logger.js"
@@ -43,17 +47,18 @@
   ],
   "devDependencies": {
     "@types/node": "^24.13.2",
-    "rolldown": "1.1.3",
+    "rolldown": "1.1.4",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@vertesia/tsconfig": "0.1.0"
   },
   "dependencies": {
     "handlebars": "^4.7.9",
-    "@vertesia/common": "1.5.0-dev.20260714.072725Z",
     "@llumiverse/common": "1.5.0-dev.20260713.114357Z",
-    "@vertesia/jst": "1.5.0-dev.20260714.072725Z"
+    "@vertesia/common": "1.5.0-dev.20260717.131047Z",
+    "@vertesia/jst": "1.5.0-dev.20260717.131047Z"
   },
+  "gitHead": "8aaad228827b2927db8e6aa75b27bfac90fec36f",
   "scripts": {
     "lint": "biome lint src",
     "test": "vitest run",

package/src/apps/index.test.ts

@@ -0,0 +1,166 @@
+import { describe, expect, it, vi } from 'vitest';
+import { installStudioUtilsLogger, type StudioUtilsLogger } from '../logger.js';
+import {
+    parseGatewayAppEndpoint,
+    type ResolveAppEndpointOptions,
+    resolveAppApiBase,
+    resolveAppEndpoint,
+    resolveAppResource,
+} from './index.js';
+
+const APPS_MOUNT = 'https://gw.example.com/tenants/1589ba_149d0b/apps/my-app';
+const LEGACY_PACKAGE_MOUNT = 'https://gw.example.com/tenants/1589ba_149d0b/package/my-app';
+const PACKAGE_MOUNT = 'https://gw.example.com/tenants/1589ba_149d0b/apps/my-app/api/package';
+const VERSION_PACKAGE_MOUNT =
+    'https://gw.example.com/tenants/1589ba_149d0b/apps/my-app/versions/20260101T000000Z/api/package';
+
+function resolve(
+    endpoint: string,
+    options: ResolveAppEndpointOptions = {},
+    endpoint_overrides?: Record<string, string>,
+): string | undefined {
+    return resolveAppEndpoint({ endpoint, endpoint_overrides }, options);
+}
+
+describe('app endpoint resolution', () => {
+    it('parses gateway app endpoint shapes', () => {
+        expect(parseGatewayAppEndpoint(APPS_MOUNT)).toEqual({
+            origin: 'https://gw.example.com',
+            tenant: '1589ba_149d0b',
+            appId: 'my-app',
+        });
+        expect(parseGatewayAppEndpoint(LEGACY_PACKAGE_MOUNT)).toEqual({
+            origin: 'https://gw.example.com',
+            tenant: '1589ba_149d0b',
+            appId: 'my-app',
+        });
+        expect(parseGatewayAppEndpoint(VERSION_PACKAGE_MOUNT)).toEqual({
+            origin: 'https://gw.example.com',
+            tenant: '1589ba_149d0b',
+            appId: 'my-app',
+            version: '20260101T000000Z',
+        });
+        expect(parseGatewayAppEndpoint('https://third-party.example.com/api/package')).toBeUndefined();
+    });
+
+    it('normalizes gateway app endpoints to canonical package URLs', () => {
+        expect(resolve(APPS_MOUNT)).toBe(PACKAGE_MOUNT);
+        expect(resolve(LEGACY_PACKAGE_MOUNT)).toBe(PACKAGE_MOUNT);
+        expect(resolve(PACKAGE_MOUNT)).toBe(PACKAGE_MOUNT);
+    });
+
+    it('normalizes gateway app endpoints to version-pinned package URLs', () => {
+        expect(resolve(APPS_MOUNT, { version: '20260101T000000Z' })).toBe(VERSION_PACKAGE_MOUNT);
+        expect(resolve(LEGACY_PACKAGE_MOUNT, { version: '20260101T000000Z' })).toBe(VERSION_PACKAGE_MOUNT);
+        expect(resolve(PACKAGE_MOUNT, { version: '20260101T000000Z' })).toBe(VERSION_PACKAGE_MOUNT);
+    });
+
+    it('ignores endpoint overrides for gateway apps', () => {
+        const endpoint_overrides = {
+            '20260101T000000Z': 'https://plugin.example.com/releases/20260101T000000Z/package',
+            dev: 'https://plugin.example.com/dev/package',
+        };
+
+        expect(resolve(APPS_MOUNT, { version: '20260101T000000Z', envName: 'dev' }, endpoint_overrides)).toBe(
+            VERSION_PACKAGE_MOUNT,
+        );
+        expect(resolve(APPS_MOUNT, { envName: 'dev' }, endpoint_overrides)).toBe(PACKAGE_MOUNT);
+    });
+
+    it('uses endpoint overrides in version, requested override, environment, endpoint order', () => {
+        const endpoint_overrides = {
+            '1.2.3': 'https://plugin.example.com/releases/1.2.3/package',
+            dev: 'https://plugin.example.com/dev/package',
+            desktop: 'https://plugin.example.com/desktop/package',
+        };
+
+        expect(
+            resolve('https://plugin.example.com/api/package', { version: '1.2.3', envName: 'dev' }, endpoint_overrides),
+        ).toBe('https://plugin.example.com/releases/1.2.3/package');
+        expect(
+            resolve(
+                'https://plugin.example.com/api/package',
+                { requestedOverride: 'desktop', envName: 'dev' },
+                endpoint_overrides,
+            ),
+        ).toBe('https://plugin.example.com/desktop/package');
+        expect(resolve('https://plugin.example.com/api/package', { envName: 'dev' }, endpoint_overrides)).toBe(
+            'https://plugin.example.com/dev/package',
+        );
+        expect(resolve('https://plugin.example.com/api/package', {}, endpoint_overrides)).toBe(
+            'https://plugin.example.com/api/package',
+        );
+    });
+
+    it('does not use endpoint overrides without a base endpoint', () => {
+        expect(
+            resolveAppEndpoint(
+                {
+                    endpoint: undefined,
+                    endpoint_overrides: {
+                        dev: 'https://plugin.example.com/dev/package',
+                    },
+                },
+                { envName: 'dev' },
+            ),
+        ).toBeUndefined();
+    });
+
+    it('substitutes endpoint variables before gateway normalization', () => {
+        expect(
+            resolve('{{gateway}}/tenants/1589ba_149d0b/package/my-app', {
+                vars: { gateway: 'https://gw.example.com/' },
+            }),
+        ).toBe(PACKAGE_MOUNT);
+    });
+
+    it('leaves regular package endpoints unchanged', () => {
+        expect(resolve('https://third-party.example.com/api/package')).toBe(
+            'https://third-party.example.com/api/package',
+        );
+    });
+
+    it('leaves non-standard package endpoints unchanged and warns', () => {
+        const logger: StudioUtilsLogger = {
+            warn: vi.fn(),
+        };
+        const previousLogger = installStudioUtilsLogger(logger);
+
+        expect(resolve('https://third-party.example.com/exotic/pkg')).toBe(
+            'https://third-party.example.com/exotic/pkg',
+        );
+        expect(logger.warn).toHaveBeenCalledWith(
+            { endpoint: 'https://third-party.example.com/exotic/pkg' },
+            'Non-standard app package endpoint; returning it unchanged during app endpoint resolution',
+        );
+
+        installStudioUtilsLogger(previousLogger);
+    });
+});
+
+describe('app API base resolution', () => {
+    it('derives the API base by removing the final package URL segment', () => {
+        expect(resolveAppApiBase('https://third-party.example.com/api/package')).toBe(
+            'https://third-party.example.com/api',
+        );
+        expect(resolveAppApiBase('https://third-party.example.com/exotic/pkg')).toBe(
+            'https://third-party.example.com/exotic',
+        );
+        expect(resolveAppApiBase(PACKAGE_MOUNT)).toBe('https://gw.example.com/tenants/1589ba_149d0b/apps/my-app/api');
+        expect(resolveAppApiBase(VERSION_PACKAGE_MOUNT)).toBe(
+            'https://gw.example.com/tenants/1589ba_149d0b/apps/my-app/versions/20260101T000000Z/api',
+        );
+    });
+
+    it('resolves API-relative resource paths from package endpoints', () => {
+        expect(resolveAppResource('https://third-party.example.com/api/package', 'tools/main')).toBe(
+            'https://third-party.example.com/api/tools/main',
+        );
+        expect(resolveAppResource(PACKAGE_MOUNT, '/interactions/main/hello')).toBe(
+            'https://gw.example.com/tenants/1589ba_149d0b/apps/my-app/api/interactions/main/hello',
+        );
+        expect(resolveAppResource(VERSION_PACKAGE_MOUNT, 'templates/invoice')).toBe(
+            'https://gw.example.com/tenants/1589ba_149d0b/apps/my-app/versions/20260101T000000Z/api/templates/invoice',
+        );
+    });
+});

package/src/apps/index.ts

@@ -0,0 +1,258 @@
+import type { AppManifestData, Endpoints, ToolCollectionObject } from '@vertesia/common';
+import { getStudioUtilsLogger } from '../logger.js';
+
+declare const URL: {
+    new (
+        url: string,
+    ): {
+        pathname: string;
+        toString(): string;
+    };
+};
+
+export interface ResolveAppEndpointOptions {
+    envName?: string;
+    vars?: Endpoints;
+    requestedOverride?: string;
+    version?: string;
+}
+
+/**
+ * Reserved deployment environment names that may never be used as endpoint
+ * override keys. Reserving them prevents a manifest from hijacking auto-resolution
+ * on a shared production studio-server (whose environment is one of these).
+ */
+const RESERVED_ENDPOINT_OVERRIDE_ENVS = new Set(['production', 'preview', 'staging']);
+const GATEWAY_APP_ENDPOINT_PATTERN = new RegExp(
+    '^(.*)/tenants/([^/]+)/(?:' + 'package/([^/]+)|' + 'apps/([^/]+)(?:/versions/([^/]+))?(?:/api/package)?' + ')/?$',
+);
+
+/**
+ * Returns true if the given environment name is allowed as an endpoint override key.
+ * Any non-empty name is accepted except the reserved shared-deployment names.
+ */
+export function isValidEndpointOverrideEnv(envName: string): boolean {
+    if (!envName) return false;
+    return !RESERVED_ENDPOINT_OVERRIDE_ENVS.has(envName.toLowerCase());
+}
+
+/**
+ * Substitutes `{{key}}` placeholders in a URL with the matching endpoint.
+ * Unknown placeholders are left untouched (so failures surface as fetch errors
+ * with the unresolved placeholder visible, rather than silently pointing nowhere).
+ * Trailing slashes on replacement values are stripped to avoid `//api/...` joins.
+ */
+export function substituteEndpoints(url: string, endpoints?: Endpoints): string {
+    if (!url || !endpoints) return url;
+    return url.replace(/\{\{\s*(\w+)\s*\}\}/g, (match, key: string) => {
+        const value = (endpoints as Record<string, string | undefined>)[key];
+        if (typeof value !== 'string' || !value) return match;
+        return trimTrailingSlashes(value);
+    });
+}
+
+function trimTrailingSlashes(value: string): string {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/') {
+        end--;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+
+/**
+ * Resolves an app manifest endpoint to its package descriptor URL.
+ *
+ * Resolution has two modes:
+ *
+ * Gateway apps: if the base `endpoint` is an app-gateway URL, endpoint overrides
+ * are ignored. Gateway versions are resolved by rewriting the canonical gateway
+ * package URL itself:
+ * - `https://gw/tenants/t/apps/my-app`
+ *   -> `https://gw/tenants/t/apps/my-app/api/package`
+ * - `https://gw/tenants/t/package/my-app`
+ *   -> `https://gw/tenants/t/apps/my-app/api/package`
+ * - with `version: "1.2.3"`
+ *   -> `https://gw/tenants/t/apps/my-app/versions/1.2.3/api/package`
+ *
+ * Regular apps: endpoint overrides are supported in this order:
+ * 1. Version override: if `version` matches `endpoint_overrides[version]`, use
+ *    that URL. This lets regular, non-gateway apps expose version-pinned package
+ *    endpoints without going through the app gateway.
+ * 2. Explicit override: if `requestedOverride` matches an allowed
+ *    `endpoint_overrides` key, use that URL. Callers must still verify the user
+ *    is allowed to request that override.
+ * 3. Environment override: if `envName` matches an allowed `endpoint_overrides`
+ *    key, use that URL for deployment-env-specific endpoints.
+ * 4. Base endpoint: otherwise use `manifest.endpoint`.
+ * 5. Placeholder substitution: replace `{{gateway}}`, `{{studio}}`, etc. from
+ *    `vars`.
+ *
+ * Regular package URLs are returned unchanged:
+ * - `https://plugin.example.com/api/package`
+ *   -> `https://plugin.example.com/api/package`
+ *
+ * Non-standard package URLs are also returned unchanged, with a warning:
+ * - `https://plugin.example.com/exotic/pkg`
+ *   -> `https://plugin.example.com/exotic/pkg`
+ */
+export function resolveAppEndpoint(
+    manifest: Pick<AppManifestData, 'endpoint' | 'endpoint_overrides'>,
+    options: ResolveAppEndpointOptions = {},
+): string | undefined {
+    if (!manifest.endpoint) {
+        return undefined;
+    }
+
+    const baseEndpoint = substituteEndpoints(manifest.endpoint, options.vars);
+    const gateway = parseGatewayAppEndpoint(baseEndpoint);
+    if (gateway) {
+        return resolveGatewayAppEndpoint(gateway, options.version);
+    }
+
+    return resolveRegularAppEndpoint(manifest, manifest.endpoint, options);
+}
+
+function resolveGatewayAppEndpoint(
+    gateway: { origin: string; tenant: string; appId: string; version?: string },
+    version?: string,
+): string {
+    const effectiveVersion = version || gateway.version;
+    const versionSeg = effectiveVersion ? `/versions/${encodeURIComponent(effectiveVersion)}` : '';
+    return `${gateway.origin}/tenants/${gateway.tenant}/apps/${gateway.appId}${versionSeg}/api/package`;
+}
+
+function resolveRegularAppEndpoint(
+    manifest: Pick<AppManifestData, 'endpoint_overrides'>,
+    baseEndpoint: string,
+    options: ResolveAppEndpointOptions,
+): string | undefined {
+    const { envName, vars, requestedOverride, version } = options;
+    let raw: string;
+    if (version && manifest.endpoint_overrides?.[version]) {
+        raw = manifest.endpoint_overrides[version];
+    } else if (
+        requestedOverride &&
+        manifest.endpoint_overrides?.[requestedOverride] &&
+        isValidEndpointOverrideEnv(requestedOverride)
+    ) {
+        raw = manifest.endpoint_overrides[requestedOverride];
+    } else if (envName && manifest.endpoint_overrides?.[envName] && isValidEndpointOverrideEnv(envName)) {
+        raw = manifest.endpoint_overrides[envName];
+    } else {
+        raw = baseEndpoint;
+    }
+
+    // Substitute the selected regular endpoint, not only the base endpoint:
+    // `raw` may be an override. Current server validation usually requires
+    // overrides to be absolute URLs, but keeping substitution here preserves
+    // compatibility if trusted/system manifests use placeholders in overrides.
+    const endpoint = substituteEndpoints(raw, vars);
+    warnIfNonStandardPackageEndpoint(endpoint);
+    return endpoint;
+}
+
+/**
+ * Resolves all URL placeholders in a manifest in place (both `endpoint` and
+ * `tool_collections[].url`). Intended for server-side serialization.
+ *
+ * Mutates the manifest rather than returning a copy so it works cleanly with
+ * Mongoose populated subdocs.
+ */
+export function resolveManifestUrls(
+    manifest: Partial<AppManifestData> | null | undefined,
+    options: ResolveAppEndpointOptions = {},
+): void {
+    if (!manifest) return;
+    const { vars } = options;
+
+    if (manifest.endpoint) {
+        const resolved = resolveAppEndpoint(manifest, options);
+        if (resolved && resolved !== manifest.endpoint) {
+            manifest.endpoint = resolved;
+        }
+    }
+
+    const toolCollections = manifest.tool_collections as ToolCollectionObject[] | undefined;
+    if (toolCollections && Array.isArray(toolCollections)) {
+        for (let i = 0; i < toolCollections.length; i++) {
+            const item = toolCollections[i];
+            if (item && typeof item === 'object' && item.url) {
+                const sub = substituteEndpoints(item.url, vars);
+                if (sub !== item.url) item.url = sub;
+            }
+        }
+    }
+}
+
+/**
+ * Parse a gateway app endpoint into its parts. Accepts BOTH the canonical apps mount
+ * (`.../tenants/<t>/apps/<app>`), the canonical package route
+ * (`.../tenants/<t>/apps/<app>/api/package`), versioned package routes, AND the
+ * legacy package mount (`.../tenants/<t>/package/<app>`). Returns undefined for
+ * non-gateway endpoints.
+ */
+export function parseGatewayAppEndpoint(
+    endpoint: string,
+): { origin: string; tenant: string; appId: string; version?: string } | undefined {
+    const m = GATEWAY_APP_ENDPOINT_PATTERN.exec(endpoint);
+    if (!m) return undefined;
+    const [, origin, tenant, legacyAppId, appsAppId, version] = m;
+    return {
+        origin,
+        tenant,
+        appId: legacyAppId || appsAppId,
+        ...(version ? { version } : {}),
+    };
+}
+
+function warnIfNonStandardPackageEndpoint(endpoint: string): void {
+    if (!isStandardPackageEndpoint(endpoint)) {
+        getStudioUtilsLogger().warn(
+            { endpoint },
+            'Non-standard app package endpoint; returning it unchanged during app endpoint resolution',
+        );
+    }
+}
+
+function isStandardPackageEndpoint(endpoint: string): boolean {
+    try {
+        const url = new URL(endpoint);
+        return trimTrailingSlashes(url.pathname).endsWith('/package');
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Derives the runtime app API base from a package descriptor URL by removing the
+ * final path segment.
+ *
+ * Examples:
+ * - `https://plugin.example.com/api/package` -> `https://plugin.example.com/api`
+ * - `https://plugin.example.com/exotic/pkg` -> `https://plugin.example.com/exotic`
+ * - `https://gw/tenants/t/apps/my-app/api/package` -> `https://gw/tenants/t/apps/my-app/api`
+ */
+export function resolveAppApiBase(packageEndpoint: string): string {
+    const url = new URL(packageEndpoint);
+    const path = trimTrailingSlashes(url.pathname);
+    const lastSlash = path.lastIndexOf('/');
+    url.pathname = lastSlash <= 0 ? '/' : path.slice(0, lastSlash);
+    return url.toString();
+}
+
+/**
+ * Resolves an app resource URL from a package descriptor endpoint and a path
+ * relative to the app `/api` base.
+ *
+ * Examples:
+ * - `resolveAppResource("https://plugin.example.com/api/package", "tools/main")`
+ *   -> `https://plugin.example.com/api/tools/main`
+ * - `resolveAppResource("https://gw/tenants/t/apps/my-app/api/package", "/interactions/x")`
+ *   -> `https://gw/tenants/t/apps/my-app/api/interactions/x`
+ */
+export function resolveAppResource(packageEndpoint: string, pathRelativeToApiBase: string): string {
+    const base = resolveAppApiBase(packageEndpoint);
+    const normalizedBase = base.endsWith('/') ? base.slice(0, -1) : base;
+    const normalizedPath = pathRelativeToApiBase.startsWith('/') ? pathRelativeToApiBase : `/${pathRelativeToApiBase}`;
+    return `${normalizedBase}${normalizedPath}`;
+}

package/src/prompts/validate.test.ts

@@ -115,6 +115,18 @@ describe('validatePrompt — handlebars', () => {
             expect(findIssue(r.issues, 'handlebars_render_error')).toBeDefined();
             expect(r.error_count).toBeGreaterThanOrEqual(1);
         });
+
+        it('flags an unregistered helper call', () => {
+            const r = validatePrompt({
+                content: 'Tactics: {{join mitre_tactics ", "}}',
+                contentType: TemplateType.handlebars,
+                inputSchema: schema({ mitre_tactics: { type: 'array', items: { type: 'string' } } }),
+            });
+
+            const issue = findIssue(r.issues, 'handlebars_render_error');
+            expect(issue).toBeDefined();
+            expect(issue?.message).toContain('Missing helper: "join"');
+        });
     });
 
     describe('happy path', () => {