@407dev/cms-astro 0.1.0

package/dist/dev/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/dev/token.ts","../../src/dev/config.ts","../../src/dev/routes.ts","../../src/dev/verifier.ts"],"names":["path"],"mappings":";;;;;;;;;;AAcA,IAAM,2CAA2B,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA;AAG5D,SAAS,sBAAsB,OAAA,EAA4C;AACzE,EAAA,MAAM,cAAc,OAAA,CAAQ,YAAA;AAC5B,EAAA,IAAI,CAAC,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,SAAiB,EAAC;AAE7D,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,IAAI,OAAO,WAAA,CAAY,YAAA,KAAiB,YAAY,OAAO,WAAA,CAAY,SAAS,QAAA,EAAU;AACxF,IAAA,KAAA,CAAM,IAAA,CAAK,YAAY,IAAI,CAAA;AAAA,EAC7B;AAEA,EAAA,MAAM,aAAa,WAAA,CAAY,UAAA;AAC/B,EAAA,IAAI,UAAA,IAAc,OAAO,UAAA,KAAe,QAAA,EAAU;AAChD,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,UAAqC,CAAA,EAAG;AACxE,MAAA,MAAM,OAAQ,KAAA,EAA0C,IAAA;AACxD,MAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,IAC/C;AAAA,EACF;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,IAAI,MAAA,GAAS,IAAI,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACrD,EAAA,OAAO,MAAA,CAAO,MAAA,GAAS,CAAA,KAAM,CAAA,EAAG;AAC9B,IAAA,MAAA,IAAU,GAAA;AAAA,EACZ;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA,CAAE,SAAS,OAAO,CAAA;AACvD;AAUO,SAAS,gBAAA,CACd,OACA,OAAA,EACwB;AACxB,EAAA,MAAM,gBAAgB,OAAO,OAAA,KAAY,YAAY,OAAA,GAAU,OAAA,CAAQ,SAAS,aAAa,CAAA;AAE7F,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,MAAK,EAAG;AACxD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,mCAAA,EAAoC;AAAA,EAClE;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,CAAE,MAAM,GAAG,CAAA;AACpC,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yCAAA,EAA0C;AAAA,EACxE;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,KAAA,CAAM,CAAC,CAAC,CAAA;AACxC,IAAA,OAAA,GAAU,IAAA,CAAK,MAAM,OAAO,CAAA;AAC5B,IAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,EAAU;AAC3C,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kDAAA,EAAmD;AAAA,IACjF;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wCAAA,EAAyC;AAAA,EACvE;AAGA,EAAA,IAAI,OAAA,CAAQ,SAAS,cAAA,EAAgB;AACnC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAGA,EAAA,IAAI,OAAA,CAAQ,SAAS,eAAA,EAAiB;AACpC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,QAAQ,CAAA,gCAAA,EAAmC,MAAA,CAAO,OAAA,CAAQ,IAAA,IAAQ,MAAM,CAAC,CAAA,2BAAA;AAAA,KAC3E;AAAA,EACF;AAGA,EAAA,IAAI,OAAO,QAAQ,GAAA,KAAQ,QAAA,IAAY,QAAQ,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,EAAI,EAAG;AACvE,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,EAC1D;AAGA,EAAA,MAAM,cAAA,GAAiB,sBAAsB,OAAO,CAAA;AACpD,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,YAAA,GAAe,eAAe,IAAA,CAAK,CAAC,SAAS,wBAAA,CAAyB,GAAA,CAAI,IAAI,CAAC,CAAA;AACrF,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,mCAAmC,YAAY,CAAA,mDAAA;AAAA,OACzD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAM,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,GAAW,QAAQ,GAAA,GAAM,EAAA;AAC5D,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,oCAAA,EAAqC;AAAA,EACnE;AAEA,EAAA,MAAM,KAAA,GACJ,OAAO,OAAA,CAAQ,KAAA,KAAU,WACrB,OAAA,CAAQ,KAAA,GACR,OAAQ,OAAA,CAAQ,aAAA,EAAuD,KAAA,KAAU,QAAA,GAC7E,OAAA,CAAQ,cAA0C,KAAA,GACpD,MAAA;AAER,EAAA,MAAM,MAAM,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,GAAW,QAAQ,GAAA,GAAM,MAAA;AAE5D,EAAA,MAAM,aAAA,GAAgB,eAAe,CAAC,CAAA;AAEtC,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,QAAA,EAAU;AAAA,MACR,GAAA;AAAA,MACA,KAAA;AAAA,MACA,GAAA;AAAA,MACA;AAAA;AACF,GACF;AACF;AAWO,SAAS,YAAA,CACd,MAAA,EACA,eAAA,EACA,gBAAA,EACA,WAAA,EACQ;AACR,EAAA,IAAI,MAAA,GAAS,sCAAA;AACb,EAAA,IAAI,WAAA,GAAc,sCAAA;AAClB,EAAA,IAAI,MAAA,GAAS,sCAAA;AAEb,EAAA,IAAI,OAAO,eAAA,KAAoB,QAAA,IAAY,eAAA,KAAoB,IAAA,EAAM;AACnE,IAAA,IAAI,eAAA,CAAgB,MAAA,EAAQ,MAAA,GAAS,eAAA,CAAgB,MAAA;AACrD,IAAA,IAAI,eAAA,CAAgB,WAAA,EAAa,WAAA,GAAc,eAAA,CAAgB,WAAA;AAC/D,IAAA,IAAI,eAAA,CAAgB,MAAA,EAAQ,MAAA,GAAS,eAAA,CAAgB,MAAA;AAAA,EACvD,CAAA,MAAO;AACL,IAAA,IAAI,OAAO,eAAA,KAAoB,QAAA,EAAU,MAAA,GAAS,eAAA;AAClD,IAAA,IAAI,OAAO,gBAAA,KAAqB,QAAA,EAAU,WAAA,GAAc,gBAAA;AACxD,IAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,EAAU,MAAA,GAAS,WAAA;AAAA,EAChD;AAEA,EAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,OAAA,EAAS,KAAK,KAAA,EAAM;AAC1C,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAA,EAAK,eAAA;AAAA,IACL,IAAA,EAAM,eAAA;AAAA,IACN,GAAA,EAAK,MAAA;AAAA,IACL,KAAA,EAAO,iBAAA;AAAA,IACP,YAAA,EAAc;AAAA,MACZ,YAAA,EAAc,WAAA;AAAA,MACd,OAAA,EAAS,MAAA;AAAA,MACT,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,CAAC,WAAW,GAAG,EAAE,MAAM,QAAA;AAAS,OAClC;AAAA,MACA,KAAA,EAAO;AAAA,QACL,CAAC,MAAM,GAAG,EAAE,IAAA,EAAM,QAAA,EAAU,cAAc,WAAA;AAAY,OACxD;AAAA,MACA,UAAA,EAAY;AAAA,QACV,CAAC,MAAM,GAAG;AAAA;AACZ,KACF;AAAA,IACA,aAAA,EAAe,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,IAChC,KAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAAA,IACjC,GAAA,EAAK,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,CAAA,GAAI,IAAA,GAAO,EAAA,GAAK;AAAA,GACnD;AAEA,EAAA,MAAM,aAAA,GAAgB,OAAO,IAAA,CAAK,IAAA,CAAK,UAAU,MAAM,CAAC,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC9E,EAAA,MAAM,cAAA,GAAiB,OAAO,IAAA,CAAK,IAAA,CAAK,UAAU,OAAO,CAAC,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAChF,EAAA,MAAM,IAAA,GAAO,CAAA,EAAG,aAAa,CAAA,CAAA,EAAI,cAAc,CAAA,CAAA;AAC/C,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,UAAA,CAAW,QAAA,EAAU,MAAM,EAAE,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA,CAAO,WAAW,CAAA;AAErF,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAC7B;;;ACrKA,eAAe,qBAAA,CACb,QACA,OAAA,EACwB;AACxB,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,aAAA;AACf,IAAA,MAAM,YAAY,MAAM;AAAA;AAAA,MAA0B;AAAA,KAAA;AAClD,IAAA,IAAI,CAAC,SAAA,EAAW,oBAAA,IAAwB,CAAC,WAAW,0BAAA,EAA4B;AAC9E,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,oBAAA,CAAqB,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,YAAY,MAAM,SAAA,CAAU,2BAA2B,MAAA,EAAQ,KAAA,EAAO,QAAW,OAAO,CAAA;AAC9F,IAAA,OAAO,WAAW,YAAA,IAAgB,IAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQA,eAAsB,qBAAA,CACpB,SAAA,EACA,OAAA,GAAwC,EAAC,EACf;AAC1B,EAAA,IAAI,SAAA,CAAU,gBAAgB,KAAA,EAAO;AACnC,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,UAAU,QAAA,EAAU,GAAA;AAChC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI,EAAA,EAAI;AACvE,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,MAAM,cAAA,GACJ,QAAQ,cAAA,KAAmB,CAAC,QAAgB,qBAAA,CAAsB,GAAA,EAAK,QAAQ,OAAO,CAAA,CAAA;AAExF,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,GAAiB,MAAM,cAAA,CAAe,SAAA,CAAU,MAAM,CAAA;AAC5D,IAAA,IAAI,CAAC,cAAA,EAAgB,IAAA,EAAK,EAAG;AAC3B,MAAA,OAAO,SAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAa,gBAAA,CAAiB,cAAA,EAAgB,EAAE,aAAA,EAAe,MAAM,CAAA;AAC3E,IAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,MAAA,OAAO,SAAA;AAAA,IACT;AAEA,IAAA,SAAA,CAAU,QAAA,GAAW,eAAe,IAAA,EAAK;AACzC,IAAA,SAAA,CAAU,WAAW,UAAA,CAAW,QAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO,SAAA;AACT;AAMA,eAAsB,gBAAA,CACpB,OAAA,GAAmC,EAAC,EACV;AAC1B,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,GAAU,IAAA,CAAK,QAAQ,OAAA,CAAQ,OAAO,CAAA,GAAI,OAAA,CAAQ,GAAA,EAAI;AAC9E,EAAA,MAAM,WAAA,GAAc,QAAQ,OAAA,IAAW,KAAA;AAGvC,EAAA,IAAI,MAA8B,EAAC;AACnC,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,MAAA;AAChB,IAAA,MAAM,OAAO,MAAM;AAAA;AAAA,MAA0B;AAAA,KAAA;AAC7C,IAAA,IAAI,OAAO,IAAA,CAAK,OAAA,KAAY,UAAA,EAAY;AACtC,MAAA,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,OAAA,EAAS,EAAE,CAAA;AAAA,IAC/C;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,IAAI,QAAA,GAAW,GAAA,CAAI,aAAA,IAAiB,OAAA,CAAQ,IAAI,aAAA,IAAiB,EAAA;AACjE,EAAA,IAAI,WAAA,GAA0C,WAAW,KAAA,GAAQ,MAAA;AACjE,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,YAAA,IAAgB,OAAA,CAAQ,IAAI,YAAA,IAAgB,EAAA;AAClE,EAAA,MAAM,MAAA,GAAA,CACJ,OAAA,CAAQ,MAAA,IACR,GAAA,CAAI,WAAA,IACJ,OAAA,CAAQ,GAAA,CAAI,WAAA,IACZ,mBAAA,EACA,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACnB,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA,IAAU,IAAI,WAAA,IAAe,OAAA,CAAQ,IAAI,WAAA,IAAe,EAAA;AAG/E,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,iBACJ,OAAA,CAAQ,cAAA,KAAmB,CAAC,GAAA,KAAQ,qBAAA,CAAsB,KAAK,WAAW,CAAA,CAAA;AAC5E,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,MAAM,CAAA;AAC5C,MAAA,IAAI,QAAA,EAAU,MAAK,EAAG;AACpB,QAAA,QAAA,GAAW,SAAS,IAAA,EAAK;AACzB,QAAA,WAAA,GAAc,KAAA;AAAA,MAChB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,aAAa,MAAA,CAAO,QAAA,CAAS,WAAW,CAAA,IAAK,MAAA,CAAO,QAAA,CAAS,WAAW,CAAA,CAAA,EAAI;AAC/E,IAAA,MAAM,SAAA,GACJ,GAAA,CAAI,mBAAA,IACJ,OAAA,CAAQ,IAAI,mBAAA,IACZ,yDAAA;AACF,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,YAAA,CAAa,SAAA,EAAW,MAAA,IAAU,SAAA,IAAa,KAAA,CAAS,CAAA;AACnE,MAAA,WAAA,GAAc,YAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAGA,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,QAAA,CAAS,MAAK,EAAG;AACjC,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,cAAA;AAAA,MACR,MAAA;AAAA,MACA,WAAW,SAAA,IAAa,MAAA;AAAA,MACxB,MAAA;AAAA,MACA,QAAA,EAAU,IAAA;AAAA,MACV,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAGA,EAAA,MAAM,eAAA,GAAkB,iBAAiB,QAAA,EAAU;AAAA,IACjD,eAAe,WAAA,KAAgB;AAAA,GAChC,CAAA;AACD,EAAA,IAAI,CAAC,gBAAgB,EAAA,EAAI;AACvB,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,SAAA;AAAA,MACR,MAAA;AAAA,MACA,WAAW,SAAA,IAAa,MAAA;AAAA,MACxB,MAAA;AAAA,MACA,QAAA,EAAU,IAAA;AAAA,MACV,QAAQ,eAAA,CAAgB,MAAA;AAAA,MACxB;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,WAAW,eAAA,CAAgB,QAAA;AAGjC,EAAA,MAAM,kBAAkB,MAAA,IAAU,SAAA;AAClC,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,SAAA;AAAA,MACR,MAAA;AAAA,MACA,WAAW,SAAA,IAAa,MAAA;AAAA,MACxB,MAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA,EAAU,IAAA;AAAA,MACV,MAAA,EAAQ,wDAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,CAAA,EAAG,MAAM,CAAA,OAAA,EAAU,kBAAA,CAAmB,eAAe,CAAC,CAAA,CAAA,EAAI;AAAA,MAC3F,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,UAAU,QAAQ,CAAA;AAAA;AACnC,KACD,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,IAAI,WAAA,GAAc,EAAA;AAClB,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,QAAA,WAAA,GAAc,KAAK,KAAA,IAAS,EAAA;AAAA,MAC9B,CAAA,CAAA,MAAQ;AACN,QAAA,WAAA,GAAc,QAAA,CAAS,UAAA,IAAc,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAAA,MAC7D;AACA,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,MAAA,EAAQ,eAAA;AAAA,QACR,WAAW,SAAA,IAAa,KAAA,CAAA;AAAA,QACxB,MAAA;AAAA,QACA,QAAA;AAAA,QACA,QAAA,EAAU,IAAA;AAAA,QACV,QAAQ,CAAA,MAAA,EAAS,eAAe,uCAAuC,QAAA,CAAS,MAAM,KAAK,WAAW,CAAA,CAAA,CAAA;AAAA,QACtG;AAAA,OACF;AAAA,IACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,SAAA;AAAA,MACR,MAAA,EAAQ,eAAA;AAAA,MACR,WAAW,SAAA,IAAa,MAAA;AAAA,MACxB,MAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA,EAAU,IAAA;AAAA,MACV,MAAA,EAAQ,CAAA,gCAAA,EAAmC,MAAM,CAAA,EAAA,EAAK,GAAG,CAAA,CAAA;AAAA,MACzD;AAAA,KACF;AAAA,EACF;AAIA,EAAA,IAAI,QAAA,GAAmC,IAAA;AAEvC,EAAA,IAAI,SAAA,IAAa,MAAA,IAAU,SAAA,KAAc,MAAA,EAAQ;AAC/C,IAAA,QAAA,GAAW;AAAA,MACT,MAAA,EAAQ,cAAA;AAAA,MACR,QAAA,EAAU,MAAA;AAAA,MACV,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,QAAQ,aAAa,CAAA;AAC3D,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7B,MAAA,IAAI;AACF,QAAA,MAAM,gBAAgB,IAAA,CAAK,KAAA,CAAM,GAAG,YAAA,CAAa,UAAA,EAAY,OAAO,CAAC,CAAA;AACrE,QAAA,IAAI,aAAA,EAAe,OAAA,IAAW,MAAA,IAAU,aAAA,CAAc,YAAY,MAAA,EAAQ;AACxE,UAAA,QAAA,GAAW;AAAA,YACT,MAAA,EAAQ,kBAAA;AAAA,YACR,QAAA,EAAU,MAAA;AAAA,YACV,QAAQ,aAAA,CAAc;AAAA,WACxB;AAAA,QACF;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,QAAQ,YAAY,CAAA;AACzD,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG;AAC5B,MAAA,IAAI;AACF,QAAA,MAAM,eAAe,IAAA,CAAK,KAAA,CAAM,GAAG,YAAA,CAAa,SAAA,EAAW,OAAO,CAAC,CAAA;AACnE,QAAA,MAAM,aAAA,GAAgB,cAAc,KAAA,GAAQ,MAAA,CAAO,KAAK,YAAA,CAAa,KAAK,IAAI,EAAC;AAC/E,QAAA,IAAI,aAAA,CAAc,SAAS,CAAA,IAAK,MAAA,IAAU,CAAC,aAAA,CAAc,QAAA,CAAS,MAAM,CAAA,EAAG;AACzE,UAAA,QAAA,GAAW;AAAA,YACT,MAAA,EAAQ,iBAAA;AAAA,YACR,QAAA,EAAU,MAAA;AAAA,YACV,MAAA,EAAQ,aAAA,CAAc,IAAA,CAAK,IAAI;AAAA,WACjC;AAAA,QACF;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,WAAA;AAAA,MACR,MAAA,EAAQ,eAAA;AAAA,MACR,WAAW,SAAA,IAAa,MAAA;AAAA,MACxB,MAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,IAAA;AAAA,IACR,MAAA,EAAQ,eAAA;AAAA,IACR,WAAW,SAAA,IAAa,eAAA;AAAA,IACxB,MAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAA;AAAA,IACA,QAAA,EAAU,IAAA;AAAA,IACV;AAAA,GACF;AACF;;;AC3SO,SAAS,kBAAkB,aAAA,EAAwC;AACxE,EAAA,IAAI,CAAC,eAAe,OAAO,KAAA;AAC3B,EAAA,MAAM,OAAA,GAAU,cAAc,IAAA,EAAK;AACnC,EAAA,IACE,YAAY,WAAA,IACZ,OAAA,KAAY,SACZ,OAAA,KAAY,kBAAA,IACZ,YAAY,WAAA,EACZ;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,aAAa,CAAA,IAAK,YAAY,iBAAA,EAAmB;AACtE,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,QAAA,CAAS,GAAA,EAAqB,UAAA,EAAoB,IAAA,EAAe;AACxE,EAAA,GAAA,CAAI,UAAA,GAAa,UAAA;AACjB,EAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,kBAAkB,CAAA;AAChD,EAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAC9B;AAEA,eAAe,aAA0B,GAAA,EAAkC;AACzE,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AACxB,MAAA,IAAA,IAAQ,KAAA;AAAA,IACV,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,OAAO,MAAM;AAClB,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,OAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,GAAW,EAAQ,CAAA;AAAA,MACpD,SAAS,GAAA,EAAK;AACZ,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ;AAAA,IACF,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAEO,SAAS,uBAAuB,OAAA,EAAiC;AACtE,EAAA,MAAM;AAAA,IACJ,SAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,aAAA;AAAA,IACA,aAAA;AAAA,IACA,OAAA,GAAU,KAAA;AAAA,IACV;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,OAAO,eAAe,gBAAA,CACpB,GAAA,EACA,GAAA,EACA,IAAA,EACA;AACA,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,IAAO,EAAA;AAC1B,IAAA,MAAM,CAAC,QAAQ,CAAA,GAAI,MAAA,CAAO,MAAM,GAAG,CAAA;AAEnC,IAAA,IAAI,CAAC,QAAA,CAAS,UAAA,CAAW,WAAW,CAAA,EAAG;AACrC,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,MAAM,aAAA,GAAgB,IAAI,MAAA,EAAQ,aAAA;AAClC,IAAA,IAAI,CAAC,iBAAA,CAAkB,aAAa,CAAA,EAAG;AACrC,MAAA,OAAO,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,QACxB,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,qBAAA,CAAsB,SAAA,EAAW,EAAE,cAAA,EAAgB,SAAS,CAAA;AAGlE,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,SAAA,IAAa,SAAA,CAAU,WAAW,cAAA,EAAgB;AACzE,MAAA,OAAO,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,QACxB,KAAA,EAAO,UAAU,MAAA,IAAU,6BAAA;AAAA,QAC3B,QAAQ,SAAA,CAAU;AAAA,OACnB,CAAA;AAAA,IACH;AAGA,IAAA,IAAI,QAAA,KAAa,kBAAA,IAAsB,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAC3D,MAAA,MAAM,IAAA,GAAO,QAAA,GACT,MAAM,QAAA,CAAS,gBAAe,GAC9B;AAAA,QACE,SAAA,EAAW,KAAA;AAAA,QACX,QAAQ,EAAC;AAAA,QACT,UAAU,EAAC;AAAA,QACX,SAAA,EAAW,IAAA;AAAA,QACX,UAAA,EAAY,IAAA;AAAA,QACZ,KAAA,EAAO;AAAA,OACT;AAEJ,MAAA,OAAO,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,QACxB,QAAQ,SAAA,CAAU,MAAA;AAAA,QAClB,QAAQ,SAAA,CAAU,MAAA;AAAA,QAClB,WAAW,SAAA,CAAU,SAAA;AAAA,QACrB,QAAQ,SAAA,CAAU,MAAA;AAAA,QAClB,GAAA,EAAK,EAAE,WAAA,EAAa,SAAA,CAAU,MAAA,EAAO;AAAA,QACrC,QAAA,EAAU,UAAU,QAAA,IAAY,IAAA;AAAA,QAChC,QAAA,EAAU,UAAU,QAAA,IAAY,IAAA;AAAA,QAChC,QAAA,EAAU;AAAA,UACR,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,YAAY,IAAA,CAAK;AAAA,SACnB;AAAA,QACA,QAAA,EAAU;AAAA,UACR,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,UAAU,IAAA,CAAK;AAAA,SACjB;AAAA,QACA,aAAA,EAAe,qBAAqB,aAAa;AAAA,OAClD,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,QAAA,KAAa,kBAAA,IAAsB,GAAA,CAAI,MAAA,KAAW,KAAA,EAAO;AAC3D,MAAA,IAAI;AACF,QAAA,IAAI,MAAA,GAA+B,IAAA;AACnC,QAAA,IAAI,MAAA,EAAQ;AACV,UAAA,IAAI;AACF,YAAA,MAAM,eAAe,MAAM,mBAAA;AAAA,cACzB,SAAA,CAAU,MAAA;AAAA,cACV,iBAAiB,MAAA,CAAO;AAAA,aAC1B;AACA,YAAA,MAAA,GAAS,MAAM,MAAA,CAAO,SAAA,CAAU,eAAe,EAAE,YAAA,KAAiB,KAAA,CAAS,CAAA;AAAA,UAC7E,CAAA,CAAA,MAAQ;AACN,YAAA,MAAA,GAAS,IAAA;AAAA,UACX;AAAA,QACF;AAGA,QAAA,IAAI,SAAoB,EAAC;AACzB,QAAA,IAAI;AACF,UAAA,MAAM,YAAY,MAAM,OAAA;AAAA,YACtB,GAAG,SAAA,CAAU,MAAM,UAAU,kBAAA,CAAmB,SAAA,CAAU,MAAM,CAAC,CAAA,0BAAA,CAAA;AAAA,YACjE;AAAA,cACE,MAAA,EAAQ,KAAA;AAAA,cACR,OAAA,EAAS;AAAA,gBACP,aAAA,EAAe,CAAA,OAAA,EAAU,SAAA,CAAU,QAAQ,CAAA;AAAA;AAC7C;AACF,WACF;AACA,UAAA,IAAI,UAAU,EAAA,EAAI;AAChB,YAAA,MAAM,UAAA,GAAc,MAAM,SAAA,CAAU,IAAA,EAAK;AACzC,YAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAA,GAAI,UAAA,CAAW,OAAO,EAAC;AAAA,UAC/D;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAEA,QAAA,OAAO,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,UACxB,MAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,QAAA,OAAO,QAAA,CAAS,KAAK,GAAA,EAAK,EAAE,OAAO,CAAA,uBAAA,EAA0B,GAAG,IAAI,CAAA;AAAA,MACtE;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,KAAa,iBAAA,IAAqB,GAAA,CAAI,MAAA,KAAW,OAAA,EAAS;AAC5D,MAAA,IAAI,SAAA,CAAU,WAAW,WAAA,EAAa;AACpC,QAAA,OAAO,QAAA,CAAS,KAAK,GAAA,EAAK;AAAA,UACxB,KAAA,EAAO,sDAAA;AAAA,UACP,UAAU,SAAA,CAAU;AAAA,SACrB,CAAA;AAAA,MACH;AAEA,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI;AACF,QAAA,IAAA,GAAO,MAAM,aAAgD,GAAG,CAAA;AAAA,MAClE,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,SAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,6BAA6B,CAAA;AAAA,MAClE;AAEA,MAAA,IAAI,CAAC,IAAA,CAAK,GAAA,IAAO,OAAO,IAAA,CAAK,QAAQ,QAAA,EAAU;AAC7C,QAAA,OAAO,SAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,yBAAyB,CAAA;AAAA,MAC9D;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,cAAc,MAAM,OAAA;AAAA,UACxB,CAAA,EAAG,SAAA,CAAU,MAAM,CAAA,OAAA,EAAU,kBAAA,CAAmB,SAAA,CAAU,MAAM,CAAC,CAAA,QAAA,EAAW,kBAAA,CAAmB,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAAA,UACxG;AAAA,YACE,MAAA,EAAQ,OAAA;AAAA,YACR,OAAA,EAAS;AAAA,cACP,cAAA,EAAgB,kBAAA;AAAA,cAChB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAA,CAAU,QAAQ,CAAA;AAAA,aAC7C;AAAA,YACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,IAAA,CAAK,OAAO;AAAA;AAC5C,SACF;AAEA,QAAA,MAAM,gBAAA,GAAmB,MAAM,WAAA,CAAY,IAAA,EAAK;AAChD,QAAA,IAAI,YAAY,EAAA,EAAI;AAClB,UAAA,sBAAA,CAAuB,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,KAAK,CAAA;AAAA,QAC7C;AACA,QAAA,GAAA,CAAI,aAAa,WAAA,CAAY,MAAA;AAC7B,QAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,kBAAkB,CAAA;AAChD,QAAA,GAAA,CAAI,IAAI,gBAAgB,CAAA;AACxB,QAAA;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,QAAA,OAAO,QAAA,CAAS,KAAK,GAAA,EAAK,EAAE,OAAO,CAAA,6BAAA,EAAgC,GAAG,IAAI,CAAA;AAAA,MAC5E;AAAA,IACF;AAGA,IAAA,OAAO,SAAS,GAAA,EAAK,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,EAClD,CAAA;AACF;AAEO,SAAS,gBAAgB,OAAA,EAAyC;AACvE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,aAAA;AAAA,IACN,KAAA,EAAO,OAAA;AAAA,IACP,OAAA,EAAS,KAAA;AAAA,IACT,gBAAgB,MAAA,EAAuB;AACrC,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,OAAA,CAAQ,QAAA,CAAS,aAAa,MAAM,CAAA;AAAA,MACtC;AACA,MAAA,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,sBAAA,CAAuB,OAAO,CAAC,CAAA;AAAA,IACxD;AAAA,GACF;AACF;AC/MA,eAAsB,eAAe,OAAA,EAA2D;AAC9F,EAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAO,GAAI,OAAA;AAE5B,EAAA,IAAI,SAAA,GAAiD,IAAA;AACrD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,aAAA;AACf,IAAA,SAAA,GAAY,MAAM;AAAA;AAAA,MAA0B;AAAA,KAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,SAAA,GAAY,IAAA;AAAA,EACd;AAEA,EAAA,IAAI,WAAA,GAA6B;AAAA,IAC/B,SAAA,EAAW,QAAQ,SAAS,CAAA;AAAA,IAC5B,QAAQ,EAAC;AAAA,IACT,UAAU,EAAC;AAAA,IACX,SAAA,EAAW,IAAA;AAAA,IACX,UAAA,EAAY,IAAA;AAAA,IACZ,KAAA,EAAO;AAAA,GACT;AAEA,EAAA,IAAI,YAAA,GAAqC,IAAA;AACzC,EAAA,IAAI,aAAA,GAAsD,IAAA;AAE1D,EAAA,eAAe,GAAA,GAA8B;AAC3C,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,WAAA,GAAc;AAAA,QACZ,SAAA,EAAW,KAAA;AAAA,QACX,QAAQ,EAAC;AAAA,QACT,UAAU,EAAC;AAAA,QACX,SAAA,EAAW,IAAA;AAAA,QACX,UAAA,EAAY,IAAA;AAAA,QACZ,KAAA,EAAO;AAAA,OACT;AACA,MAAA,OAAO,WAAA;AAAA,IACT;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAAgB,MAAM,SAAA,CAAU,cAAA,CAAe,SAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AAC9E,MAAA,MAAM,SAAA,GAAY,UAAA,CAAW,aAAA,CAAc,QAAQ,CAAA;AAEnD,MAAA,MAAM,cAAA,GAAiBA,IAAAA,CAAK,IAAA,CAAK,OAAA,EAAS,QAAQ,YAAY,CAAA;AAC9D,MAAA,MAAM,KAAA,GAAQ,IAAI,SAAA,CAAU,UAAA,CAAW,cAAc,CAAA;AACrD,MAAA,MAAM,UAAA,GAAa,KAAA,CAAM,mBAAA,CAAoB,MAAM,CAAA;AAEnD,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,SAAA,IAAa,UAAA,IAAc,cAAc,UAAU,CAAA;AAEzE,MAAA,MAAM,UAAgC,aAAA,CAAc,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAC5E,IAAA,EAAM,OAAA;AAAA,QACN,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,MAAM,CAAA,CAAE;AAAA,OACV,CAAE,CAAA;AAEF,MAAA,MAAM,YAAkC,aAAA,CAAc,QAAA,IAAY,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QAChF,IAAA,EAAM,SAAA;AAAA,QACN,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,QAAQ,CAAA,CAAE,MAAA;AAAA,QACV,MAAM,CAAA,CAAE;AAAA,OACV,CAAE,CAAA;AAGF,MAAA,WAAA,GAAc;AAAA,QACZ,SAAA,EAAW,IAAA;AAAA,QACX,MAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAA;AAAA,QACA,UAAA;AAAA,QACA;AAAA,OACF;AAEA,MAAA,IAAI,cAAc,GAAA,EAAK;AACrB,QAAA,YAAA,CAAa,IAAI,IAAA,CAAK;AAAA,UACpB,IAAA,EAAM,QAAA;AAAA,UACN,KAAA,EAAO,iBAAA;AAAA,UACP,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AAEA,MAAA,OAAO,WAAA;AAAA,IACT,SAAS,IAAA,EAAM;AACb,MAAA,OAAO,WAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,SAAS,gBAAgB,QAAA,EAAkB;AACzC,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AAC9C,IAAA,IACE,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA,IAC3B,0BAAA,CAA2B,IAAA,CAAK,UAAU,CAAA,IAC1C,CAAC,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA,EAC5B;AACA,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,YAAA,CAAa,aAAa,CAAA;AAAA,MAC5B;AACA,MAAA,aAAA,GAAgB,WAAW,MAAM;AAC/B,QAAA,aAAA,GAAgB,IAAA;AAChB,QAAA,GAAA,EAAI;AAAA,MACN,GAAG,GAAG,CAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,SAAS,aAAa,MAAA,EAAuB;AAC3C,IAAA,YAAA,GAAe,MAAA;AAEf,IAAA,MAAA,CAAO,OAAA,CAAQ,EAAA,CAAG,QAAA,EAAU,eAAe,CAAA;AAC3C,IAAA,MAAA,CAAO,OAAA,CAAQ,EAAA,CAAG,KAAA,EAAO,eAAe,CAAA;AACxC,IAAA,MAAA,CAAO,OAAA,CAAQ,EAAA,CAAG,QAAA,EAAU,eAAe,CAAA;AAAA,EAC7C;AAGA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAM,GAAA,EAAI;AAAA,EACZ;AAEA,EAAA,OAAO;AAAA,IACL,gBAAgB,YAAY,WAAA;AAAA,IAC5B,GAAA;AAAA,IACA;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import crypto from 'node:crypto';\n\nexport interface DevTokenIdentity {\n  sub: string;\n  email?: string;\n  exp?: number;\n  workspaceRole?: string;\n}\n\nexport type ValidateDevTokenResult =\n  | { ok: true; identity: DevTokenIdentity }\n  | { ok: false; reason: string };\n\n// Matches is_workspace_admin_or_dev()'s RLS bypass roles (owner | editor); CMS_DEV_TOKEN must not carry them.\nconst WORKSPACE_ELEVATED_ROLES = new Set(['owner', 'editor']);\n\n// Reads both claim shapes RLS accepts: the flat single-workspace shortcut (app_metadata.workspace_id + app_metadata.role) and the per-workspace map (app_metadata.workspaces[id].role).\nfunction collectWorkspaceRoles(payload: Record<string, unknown>): string[] {\n  const appMetadata = payload.app_metadata as Record<string, unknown> | undefined;\n  if (!appMetadata || typeof appMetadata !== 'object') return [];\n\n  const roles: string[] = [];\n\n  if (typeof appMetadata.workspace_id === 'string' && typeof appMetadata.role === 'string') {\n    roles.push(appMetadata.role);\n  }\n\n  const workspaces = appMetadata.workspaces;\n  if (workspaces && typeof workspaces === 'object') {\n    for (const entry of Object.values(workspaces as Record<string, unknown>)) {\n      const role = (entry as Record<string, unknown> | null)?.role;\n      if (typeof role === 'string') roles.push(role);\n    }\n  }\n\n  return roles;\n}\n\nfunction base64UrlDecode(str: string): string {\n  let base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n  while (base64.length % 4 !== 0) {\n    base64 += '=';\n  }\n  return Buffer.from(base64, 'base64').toString('utf-8');\n}\n\nexport interface ValidateDevTokenOptions {\n  allowElevated?: boolean;\n}\n\n/**\n * Decodes and validates a developer user JWT for the dev toolbar.\n * Rejects non-JWTs, service-role keys, anon keys, and expired tokens.\n */\nexport function validateDevToken(\n  token: string | null | undefined,\n  options?: ValidateDevTokenOptions | boolean,\n): ValidateDevTokenResult {\n  const allowElevated = typeof options === 'boolean' ? options : Boolean(options?.allowElevated);\n\n  if (!token || typeof token !== 'string' || !token.trim()) {\n    return { ok: false, reason: 'CMS_DEV_TOKEN is missing or empty' };\n  }\n\n  const parts = token.trim().split('.');\n  if (parts.length !== 3) {\n    return { ok: false, reason: 'CMS_DEV_TOKEN is not a valid 3-part JWT' };\n  }\n\n  let payload: Record<string, unknown>;\n  try {\n    const decoded = base64UrlDecode(parts[1]);\n    payload = JSON.parse(decoded);\n    if (!payload || typeof payload !== 'object') {\n      return { ok: false, reason: 'CMS_DEV_TOKEN payload is not a valid JSON object' };\n    }\n  } catch {\n    return { ok: false, reason: 'CMS_DEV_TOKEN payload is not decodable' };\n  }\n\n  // 1. Refuse service_role\n  if (payload.role === 'service_role') {\n    return {\n      ok: false,\n      reason: 'CMS_DEV_TOKEN must not be a service_role key; authenticated user JWT required',\n    };\n  }\n\n  // 2. Refuse non-authenticated (e.g. anon / publishable)\n  if (payload.role !== 'authenticated') {\n    return {\n      ok: false,\n      reason: `CMS_DEV_TOKEN has invalid role '${String(payload.role || 'none')}'; expected 'authenticated'`,\n    };\n  }\n\n  // 3. Refuse expired\n  if (typeof payload.exp === 'number' && payload.exp * 1000 <= Date.now()) {\n    return { ok: false, reason: 'CMS_DEV_TOKEN has expired' };\n  }\n\n  // 4. Refuse workspace scope above 'viewer'/'member' unless explicitly allowed (e.g. CLI session)\n  const workspaceRoles = collectWorkspaceRoles(payload);\n  if (!allowElevated) {\n    const elevatedRole = workspaceRoles.find((role) => WORKSPACE_ELEVATED_ROLES.has(role));\n    if (elevatedRole) {\n      return {\n        ok: false,\n        reason: `CMS_DEV_TOKEN grants workspace '${elevatedRole}' scope; only workspace-member tokens are permitted`,\n      };\n    }\n  }\n\n  const sub = typeof payload.sub === 'string' ? payload.sub : '';\n  if (!sub) {\n    return { ok: false, reason: 'CMS_DEV_TOKEN is missing sub claim' };\n  }\n\n  const email =\n    typeof payload.email === 'string'\n      ? payload.email\n      : typeof (payload.user_metadata as Record<string, unknown> | undefined)?.email === 'string'\n        ? ((payload.user_metadata as Record<string, unknown>).email as string)\n        : undefined;\n\n  const exp = typeof payload.exp === 'number' ? payload.exp : undefined;\n\n  const workspaceRole = workspaceRoles[0];\n\n  return {\n    ok: true,\n    identity: {\n      sub,\n      email,\n      exp,\n      workspaceRole,\n    },\n  };\n}\n\nexport interface SignDevTokenOptions {\n  siteId?: string;\n  workspaceId?: string;\n  userId?: string;\n}\n\n/**\n * Signs a developer user JWT (with workspace viewer & site editor roles) for local development against local Supabase/CMS API.\n */\nexport function signDevToken(\n  secret: string,\n  siteIdOrOptions?: string | SignDevTokenOptions,\n  workspaceIdParam?: string,\n  userIdParam?: string,\n): string {\n  let siteId = '00000000-0000-0000-0000-000000000002';\n  let workspaceId = '00000000-0000-0000-0000-000000000001';\n  let userId = '00000000-0000-0000-0000-000000000003';\n\n  if (typeof siteIdOrOptions === 'object' && siteIdOrOptions !== null) {\n    if (siteIdOrOptions.siteId) siteId = siteIdOrOptions.siteId;\n    if (siteIdOrOptions.workspaceId) workspaceId = siteIdOrOptions.workspaceId;\n    if (siteIdOrOptions.userId) userId = siteIdOrOptions.userId;\n  } else {\n    if (typeof siteIdOrOptions === 'string') siteId = siteIdOrOptions;\n    if (typeof workspaceIdParam === 'string') workspaceId = workspaceIdParam;\n    if (typeof userIdParam === 'string') userId = userIdParam;\n  }\n\n  const header = { alg: 'HS256', typ: 'JWT' };\n  const payload = {\n    aud: 'authenticated',\n    role: 'authenticated',\n    sub: userId,\n    email: 'dev@example.com',\n    app_metadata: {\n      workspace_id: workspaceId,\n      site_id: siteId,\n      role: 'viewer',\n      workspaces: {\n        [workspaceId]: { role: 'viewer' },\n      },\n      sites: {\n        [siteId]: { role: 'editor', workspace_id: workspaceId },\n      },\n      site_roles: {\n        [siteId]: 'editor',\n      },\n    },\n    user_metadata: { role: 'viewer' },\n    iat: Math.floor(Date.now() / 1000),\n    exp: Math.floor(Date.now() / 1000) + 3600 * 24 * 365,\n  };\n\n  const encodedHeader = Buffer.from(JSON.stringify(header)).toString('base64url');\n  const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url');\n  const data = `${encodedHeader}.${encodedPayload}`;\n  const signature = crypto.createHmac('sha256', secret).update(data).digest('base64url');\n\n  return `${data}.${signature}`;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\nimport { DEFAULT_DEV_API_URL } from '@407dev/config';\nimport { type DevTokenIdentity, signDevToken, validateDevToken } from './token';\n\nexport type DevConfigStatus = 'ok' | 'read-only' | 'refused' | 'unconfigured';\nexport type DevTokenSource = 'env' | 'cli' | 'local-mint';\nexport type LoadCredentialFn = (apiUrl: string) => Promise<string | null> | string | null;\n\nexport interface DevSiteMismatch {\n  source: string;\n  expected: string;\n  actual: string;\n}\n\nexport interface DevConfigResult {\n  status: DevConfigStatus;\n  siteId: string;\n  devSiteId?: string;\n  apiUrl: string;\n  devToken?: string;\n  identity?: DevTokenIdentity | null;\n  mismatch?: DevSiteMismatch | null;\n  reason?: string;\n  tokenSource?: DevTokenSource;\n}\n\nexport interface ResolveDevConfigOptions {\n  siteId?: string;\n  apiUrl?: string;\n  siteDir?: string;\n  fetchFn?: typeof fetch;\n  loadCredential?: LoadCredentialFn;\n}\n\nasync function defaultLoadCredential(\n  apiUrl: string,\n  fetchFn?: typeof fetch,\n): Promise<string | null> {\n  try {\n    const cliPkg = '@407dev/cli';\n    const cliModule = await import(/* @vite-ignore */ cliPkg);\n    if (!cliModule?.getStoredCredentials || !cliModule?.refreshCredentialsIfNeeded) {\n      return null;\n    }\n    const creds = cliModule.getStoredCredentials(apiUrl);\n    if (!creds) {\n      return null;\n    }\n    const refreshed = await cliModule.refreshCredentialsIfNeeded(apiUrl, creds, undefined, fetchFn);\n    return refreshed?.access_token || null;\n  } catch {\n    return null;\n  }\n}\n\nexport interface RefreshDevConfigTokenOptions {\n  loadCredential?: LoadCredentialFn;\n  fetchFn?: typeof fetch;\n}\n\n// resolveDevConfig runs once at startup, so the CLI rung's ~1h access_token needs refreshing on later requests; mutates devConfig in place since callers hold onto the single startup instance.\nexport async function refreshDevConfigToken(\n  devConfig: DevConfigResult,\n  options: RefreshDevConfigTokenOptions = {},\n): Promise<DevConfigResult> {\n  if (devConfig.tokenSource !== 'cli') {\n    return devConfig;\n  }\n\n  const exp = devConfig.identity?.exp;\n  if (typeof exp === 'number' && exp - Math.floor(Date.now() / 1000) > 60) {\n    return devConfig;\n  }\n\n  const loadCredential =\n    options.loadCredential ?? ((url: string) => defaultLoadCredential(url, options.fetchFn));\n\n  try {\n    const refreshedToken = await loadCredential(devConfig.apiUrl);\n    if (!refreshedToken?.trim()) {\n      return devConfig;\n    }\n\n    const validation = validateDevToken(refreshedToken, { allowElevated: true });\n    if (!validation.ok) {\n      return devConfig;\n    }\n\n    devConfig.devToken = refreshedToken.trim();\n    devConfig.identity = validation.identity;\n  } catch {\n    // Keep the existing (possibly stale) token; the proxied upstream call surfaces the failure.\n  }\n\n  return devConfig;\n}\n\n/**\n * Resolves dev environment configuration, validates the user dev JWT, probes\n * the write API for site accessibility, and verifies site identity consistency.\n */\nexport async function resolveDevConfig(\n  options: ResolveDevConfigOptions = {},\n): Promise<DevConfigResult> {\n  const siteDir = options.siteDir ? path.resolve(options.siteDir) : process.cwd();\n  const fetchClient = options.fetchFn || fetch;\n\n  // Load environment variables via Vite's loadEnv to match .env files\n  let env: Record<string, string> = {};\n  try {\n    const vitePkg = 'vite';\n    const vite = await import(/* @vite-ignore */ vitePkg);\n    if (typeof vite.loadEnv === 'function') {\n      env = vite.loadEnv('development', siteDir, '');\n    }\n  } catch {\n    // Fall back to process.env\n  }\n\n  let devToken = env.CMS_DEV_TOKEN || process.env.CMS_DEV_TOKEN || '';\n  let tokenSource: DevTokenSource | undefined = devToken ? 'env' : undefined;\n  const devSiteId = env.CMS_DEV_SITE || process.env.CMS_DEV_SITE || '';\n  const apiUrl = (\n    options.apiUrl ||\n    env.CMS_API_URL ||\n    process.env.CMS_API_URL ||\n    DEFAULT_DEV_API_URL\n  ).replace(/\\/$/, '');\n  const siteId = options.siteId || env.CMS_SITE_ID || process.env.CMS_SITE_ID || '';\n\n  // 2nd rung: CLI session (stored credentials)\n  if (!devToken) {\n    const loadCredential =\n      options.loadCredential ?? ((url) => defaultLoadCredential(url, fetchClient));\n    try {\n      const cliToken = await loadCredential(apiUrl);\n      if (cliToken?.trim()) {\n        devToken = cliToken.trim();\n        tokenSource = 'cli';\n      }\n    } catch {\n      // Swallow failure and fall through\n    }\n  }\n\n  // 3rd rung: Auto-mint development JWT if running against local API and token is not explicitly configured\n  if (!devToken && (apiUrl.includes('127.0.0.1') || apiUrl.includes('localhost'))) {\n    const jwtSecret =\n      env.SUPABASE_JWT_SECRET ||\n      process.env.SUPABASE_JWT_SECRET ||\n      'super-secret-jwt-token-with-at-least-32-characters-long';\n    try {\n      devToken = signDevToken(jwtSecret, siteId || devSiteId || undefined);\n      tokenSource = 'local-mint';\n    } catch {\n      // Fall through to unconfigured check\n    }\n  }\n\n  // 1. Unconfigured check\n  if (!devToken || !devToken.trim()) {\n    return {\n      status: 'unconfigured',\n      siteId,\n      devSiteId: devSiteId || undefined,\n      apiUrl,\n      mismatch: null,\n      reason: 'Not logged in. Run `cms login` to enable dev-time editing.',\n    };\n  }\n\n  // 2. Token format and scope validation (CLI rung allows elevated roles)\n  const tokenValidation = validateDevToken(devToken, {\n    allowElevated: tokenSource === 'cli',\n  });\n  if (!tokenValidation.ok) {\n    return {\n      status: 'refused',\n      siteId,\n      devSiteId: devSiteId || undefined,\n      apiUrl,\n      mismatch: null,\n      reason: tokenValidation.reason,\n      tokenSource,\n    };\n  }\n\n  const identity = tokenValidation.identity;\n\n  // 3. Probe site accessibility on API via GET /sites/:id with token\n  const effectiveSiteId = siteId || devSiteId;\n  if (!effectiveSiteId) {\n    return {\n      status: 'refused',\n      siteId,\n      devSiteId: devSiteId || undefined,\n      apiUrl,\n      identity,\n      mismatch: null,\n      reason: 'No site ID provided (set CMS_SITE_ID or siteId option)',\n      tokenSource,\n    };\n  }\n\n  try {\n    const probeRes = await fetchClient(`${apiUrl}/sites/${encodeURIComponent(effectiveSiteId)}`, {\n      method: 'GET',\n      headers: {\n        Authorization: `Bearer ${devToken}`,\n      },\n    });\n\n    if (!probeRes.ok) {\n      let errorDetail = '';\n      try {\n        const body = (await probeRes.json()) as { error?: string };\n        errorDetail = body.error || '';\n      } catch {\n        errorDetail = probeRes.statusText || String(probeRes.status);\n      }\n      return {\n        status: 'refused',\n        siteId: effectiveSiteId,\n        devSiteId: devSiteId || undefined,\n        apiUrl,\n        identity,\n        mismatch: null,\n        reason: `Site '${effectiveSiteId}' inaccessible with dev token (HTTP ${probeRes.status}: ${errorDetail})`,\n        tokenSource,\n      };\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    return {\n      status: 'refused',\n      siteId: effectiveSiteId,\n      devSiteId: devSiteId || undefined,\n      apiUrl,\n      identity,\n      mismatch: null,\n      reason: `Failed to connect to CMS API at ${apiUrl}: ${msg}`,\n      tokenSource,\n    };\n  }\n\n  // 4. Site identity comparison (Wrong-site guard)\n  // Check against CMS_DEV_SITE, .cms/bundle.json, and .cms/state.json\n  let mismatch: DevSiteMismatch | null = null;\n\n  if (devSiteId && siteId && devSiteId !== siteId) {\n    mismatch = {\n      source: 'CMS_DEV_SITE',\n      expected: siteId,\n      actual: devSiteId,\n    };\n  }\n\n  if (!mismatch) {\n    const bundlePath = path.join(siteDir, '.cms', 'bundle.json');\n    if (fs.existsSync(bundlePath)) {\n      try {\n        const bundleContent = JSON.parse(fs.readFileSync(bundlePath, 'utf-8'));\n        if (bundleContent?.site_id && siteId && bundleContent.site_id !== siteId) {\n          mismatch = {\n            source: '.cms/bundle.json',\n            expected: siteId,\n            actual: bundleContent.site_id,\n          };\n        }\n      } catch {\n        // Ignore unreadable bundle.json\n      }\n    }\n  }\n\n  if (!mismatch) {\n    const statePath = path.join(siteDir, '.cms', 'state.json');\n    if (fs.existsSync(statePath)) {\n      try {\n        const stateContent = JSON.parse(fs.readFileSync(statePath, 'utf-8'));\n        const stateSiteKeys = stateContent?.sites ? Object.keys(stateContent.sites) : [];\n        if (stateSiteKeys.length > 0 && siteId && !stateSiteKeys.includes(siteId)) {\n          mismatch = {\n            source: '.cms/state.json',\n            expected: siteId,\n            actual: stateSiteKeys.join(', '),\n          };\n        }\n      } catch {\n        // Ignore unreadable state.json\n      }\n    }\n  }\n\n  if (mismatch) {\n    return {\n      status: 'read-only',\n      siteId: effectiveSiteId,\n      devSiteId: devSiteId || undefined,\n      apiUrl,\n      devToken,\n      identity,\n      mismatch,\n      tokenSource,\n    };\n  }\n\n  return {\n    status: 'ok',\n    siteId: effectiveSiteId,\n    devSiteId: devSiteId || effectiveSiteId,\n    apiUrl,\n    devToken,\n    identity,\n    mismatch: null,\n    tokenSource,\n  };\n}\n","import type { IncomingMessage, ServerResponse } from 'node:http';\nimport type { Plugin, ViteDevServer } from 'vite';\nimport { resolveEditorOrigins } from '../preview/origins';\nimport { updateBundleFieldValue } from '../runtime/store';\nimport type { CmsClient, ContentBundle } from '../types';\nimport { type DevConfigResult, type LoadCredentialFn, refreshDevConfigToken } from './config';\nimport { mintDevPreviewToken } from './preview-token';\nimport type { VerifierInstance } from './verifier';\n\nexport interface CmsDevApiPluginOptions {\n  devConfig: DevConfigResult;\n  client?: CmsClient | null;\n  verifier?: VerifierInstance;\n  previewSecret?: string;\n  editorOrigins?: string[];\n  fetchFn?: typeof fetch;\n  loadCredential?: LoadCredentialFn;\n}\n\nexport function isLoopbackAddress(remoteAddress?: string | null): boolean {\n  if (!remoteAddress) return false;\n  const cleaned = remoteAddress.trim();\n  if (\n    cleaned === '127.0.0.1' ||\n    cleaned === '::1' ||\n    cleaned === '::ffff:127.0.0.1' ||\n    cleaned === 'localhost'\n  ) {\n    return true;\n  }\n  // IPv6 loopback variants or IPv4 mapped loopback\n  if (cleaned.startsWith('::ffff:127.') || cleaned === '0:0:0:0:0:0:0:1') {\n    return true;\n  }\n  return false;\n}\n\nfunction sendJson(res: ServerResponse, statusCode: number, data: unknown) {\n  res.statusCode = statusCode;\n  res.setHeader('Content-Type', 'application/json');\n  res.end(JSON.stringify(data));\n}\n\nasync function readJsonBody<T = unknown>(req: IncomingMessage): Promise<T> {\n  return new Promise((resolve, reject) => {\n    let body = '';\n    req.on('data', (chunk) => {\n      body += chunk;\n    });\n    req.on('end', () => {\n      try {\n        resolve(body ? (JSON.parse(body) as T) : ({} as T));\n      } catch (err) {\n        reject(err);\n      }\n    });\n    req.on('error', reject);\n  });\n}\n\nexport function createDevApiMiddleware(options: CmsDevApiPluginOptions) {\n  const {\n    devConfig,\n    client,\n    verifier,\n    previewSecret,\n    editorOrigins,\n    fetchFn = fetch,\n    loadCredential,\n  } = options;\n\n  return async function devApiMiddleware(\n    req: IncomingMessage,\n    res: ServerResponse,\n    next: () => void,\n  ) {\n    const rawUrl = req.url || '';\n    const [pathname] = rawUrl.split('?');\n\n    if (!pathname.startsWith('/_cms/dev')) {\n      return next();\n    }\n\n    // 1. Loopback-only security gate\n    const remoteAddress = req.socket?.remoteAddress;\n    if (!isLoopbackAddress(remoteAddress)) {\n      return sendJson(res, 403, {\n        error: 'Forbidden: CMS dev routes accept loopback callers only',\n      });\n    }\n\n    await refreshDevConfigToken(devConfig, { loadCredential, fetchFn });\n\n    // 2. Refused or unconfigured gate\n    if (devConfig.status === 'refused' || devConfig.status === 'unconfigured') {\n      return sendJson(res, 503, {\n        error: devConfig.reason || 'CMS dev routes unconfigured',\n        status: devConfig.status,\n      });\n    }\n\n    // 3. Dispatch routes\n    if (pathname === '/_cms/dev/status' && req.method === 'GET') {\n      const diag = verifier\n        ? await verifier.getDiagnostics()\n        : {\n            available: false,\n            errors: [],\n            warnings: [],\n            localHash: null,\n            pushedHash: null,\n            fresh: true,\n          };\n\n      return sendJson(res, 200, {\n        status: devConfig.status,\n        siteId: devConfig.siteId,\n        devSiteId: devConfig.devSiteId,\n        apiUrl: devConfig.apiUrl,\n        env: { CMS_API_URL: devConfig.apiUrl },\n        identity: devConfig.identity || null,\n        mismatch: devConfig.mismatch || null,\n        manifest: {\n          fresh: diag.fresh,\n          localHash: diag.localHash,\n          pushedHash: diag.pushedHash,\n        },\n        verifier: {\n          available: diag.available,\n          errors: diag.errors,\n          warnings: diag.warnings,\n        },\n        editorOrigins: resolveEditorOrigins(editorOrigins),\n      });\n    }\n\n    if (pathname === '/_cms/dev/bundle' && req.method === 'GET') {\n      try {\n        let bundle: ContentBundle | null = null;\n        if (client) {\n          try {\n            const previewToken = await mintDevPreviewToken(\n              devConfig.siteId,\n              previewSecret || client.previewSecret,\n            );\n            bundle = await client.getBundle(previewToken ? { previewToken } : undefined);\n          } catch {\n            bundle = null;\n          }\n        }\n\n        // Fetch fields from write API\n        let fields: unknown[] = [];\n        try {\n          const fieldsRes = await fetchFn(\n            `${devConfig.apiUrl}/sites/${encodeURIComponent(devConfig.siteId)}/fields?include_orphaned=1`,\n            {\n              method: 'GET',\n              headers: {\n                Authorization: `Bearer ${devConfig.devToken}`,\n              },\n            },\n          );\n          if (fieldsRes.ok) {\n            const fieldsJson = (await fieldsRes.json()) as { ok?: boolean; data?: unknown[] };\n            fields = Array.isArray(fieldsJson.data) ? fieldsJson.data : [];\n          }\n        } catch {\n          // Keep empty fields on failure\n        }\n\n        return sendJson(res, 200, {\n          bundle,\n          fields,\n        });\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        return sendJson(res, 500, { error: `Failed to load bundle: ${msg}` });\n      }\n    }\n\n    if (pathname === '/_cms/dev/value' && req.method === 'PATCH') {\n      if (devConfig.status === 'read-only') {\n        return sendJson(res, 403, {\n          error: 'Toolbar is in read-only mode due to site ID mismatch',\n          mismatch: devConfig.mismatch,\n        });\n      }\n\n      let body: { key?: string; value?: unknown };\n      try {\n        body = await readJsonBody<{ key?: string; value?: unknown }>(req);\n      } catch {\n        return sendJson(res, 400, { error: 'Invalid JSON request body' });\n      }\n\n      if (!body.key || typeof body.key !== 'string') {\n        return sendJson(res, 400, { error: 'Field key is required' });\n      }\n\n      try {\n        const upstreamRes = await fetchFn(\n          `${devConfig.apiUrl}/sites/${encodeURIComponent(devConfig.siteId)}/fields/${encodeURIComponent(body.key)}`,\n          {\n            method: 'PATCH',\n            headers: {\n              'Content-Type': 'application/json',\n              Authorization: `Bearer ${devConfig.devToken}`,\n            },\n            body: JSON.stringify({ value: body.value }),\n          },\n        );\n\n        const upstreamBodyText = await upstreamRes.text();\n        if (upstreamRes.ok) {\n          updateBundleFieldValue(body.key, body.value);\n        }\n        res.statusCode = upstreamRes.status;\n        res.setHeader('Content-Type', 'application/json');\n        res.end(upstreamBodyText);\n        return;\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        return sendJson(res, 502, { error: `Upstream API request failed: ${msg}` });\n      }\n    }\n\n    // Unmatched /_cms/dev path\n    return sendJson(res, 404, { error: 'Not Found' });\n  };\n}\n\nexport function cmsDevApiPlugin(options: CmsDevApiPluginOptions): Plugin {\n  return {\n    name: 'cms-dev-api',\n    apply: 'serve',\n    enforce: 'pre',\n    configureServer(server: ViteDevServer) {\n      if (options.verifier) {\n        options.verifier.attachServer(server);\n      }\n      server.middlewares.use(createDevApiMiddleware(options));\n    },\n  };\n}\n","import path from 'node:path';\nimport { hashSchema } from '@407dev/blocks';\nimport type { ViteDevServer } from 'vite';\n\nexport interface VerifierDiagnostic {\n  type: 'error' | 'warning';\n  message: string;\n  file?: string;\n  line?: number;\n  column?: number;\n  code?: string;\n}\n\nexport interface VerifierState {\n  available: boolean;\n  errors: VerifierDiagnostic[];\n  warnings: VerifierDiagnostic[];\n  localHash: string | null;\n  pushedHash: string | null;\n  fresh: boolean;\n}\n\nexport interface VerifierInstance {\n  getDiagnostics: () => Promise<VerifierState>;\n  run: () => Promise<VerifierState>;\n  attachServer: (server: ViteDevServer) => void;\n}\n\nexport interface CreateVerifierOptions {\n  siteDir: string;\n  siteId: string;\n}\n\n/**\n * Creates a diagnostics verifier that extracts AST diagnostics from templates via @407dev/cli,\n * tracks manifest freshness against .cms/state.json, and streams updates via Vite HMR.\n */\nexport async function createVerifier(options: CreateVerifierOptions): Promise<VerifierInstance> {\n  const { siteDir, siteId } = options;\n\n  let cliModule: typeof import('@407dev/cli') | null = null;\n  try {\n    const cliPkg = '@407dev/cli';\n    cliModule = await import(/* @vite-ignore */ cliPkg);\n  } catch {\n    cliModule = null;\n  }\n\n  let cachedState: VerifierState = {\n    available: Boolean(cliModule),\n    errors: [],\n    warnings: [],\n    localHash: null,\n    pushedHash: null,\n    fresh: true,\n  };\n\n  let activeServer: ViteDevServer | null = null;\n  let debounceTimer: ReturnType<typeof setTimeout> | null = null;\n\n  async function run(): Promise<VerifierState> {\n    if (!cliModule) {\n      cachedState = {\n        available: false,\n        errors: [],\n        warnings: [],\n        localHash: null,\n        pushedHash: null,\n        fresh: true,\n      };\n      return cachedState;\n    }\n\n    try {\n      const extractResult = await cliModule.extractProject(siteDir, { noSync: true });\n      const localHash = hashSchema(extractResult.manifest);\n\n      const stateStorePath = path.join(siteDir, '.cms', 'state.json');\n      const store = new cliModule.StateStore(stateStorePath);\n      const pushedHash = store.getSiteManifestHash(siteId);\n\n      const fresh = Boolean(localHash && pushedHash && localHash === pushedHash);\n\n      const errors: VerifierDiagnostic[] = (extractResult.errors || []).map((e) => ({\n        type: 'error',\n        message: e.message,\n        file: e.file,\n        line: e.line,\n        column: e.column,\n        code: e.code,\n      }));\n\n      const warnings: VerifierDiagnostic[] = (extractResult.warnings || []).map((w) => ({\n        type: 'warning',\n        message: w.message,\n        file: w.file,\n        line: w.line,\n        column: w.column,\n        code: w.code,\n      }));\n\n      // A run replaces the cache, ensuring warnings clear on fix\n      cachedState = {\n        available: true,\n        errors,\n        warnings,\n        localHash,\n        pushedHash,\n        fresh,\n      };\n\n      if (activeServer?.hot) {\n        activeServer.hot.send({\n          type: 'custom',\n          event: 'cms:diagnostics',\n          data: cachedState,\n        });\n      }\n\n      return cachedState;\n    } catch (_err) {\n      return cachedState;\n    }\n  }\n\n  function handleFileEvent(filePath: string) {\n    const normalized = filePath.replace(/\\\\/g, '/');\n    if (\n      normalized.includes('/src/') &&\n      /\\.(astro|ts|tsx|js|mjs)$/.test(normalized) &&\n      !normalized.endsWith('.d.ts')\n    ) {\n      if (debounceTimer) {\n        clearTimeout(debounceTimer);\n      }\n      debounceTimer = setTimeout(() => {\n        debounceTimer = null;\n        run();\n      }, 300);\n    }\n  }\n\n  function attachServer(server: ViteDevServer) {\n    activeServer = server;\n\n    server.watcher.on('change', handleFileEvent);\n    server.watcher.on('add', handleFileEvent);\n    server.watcher.on('unlink', handleFileEvent);\n  }\n\n  // Initial execution\n  if (cliModule) {\n    await run();\n  }\n\n  return {\n    getDiagnostics: async () => cachedState,\n    run,\n    attachServer,\n  };\n}\n"]}

package/dist/fields/collections.d.ts

@@ -0,0 +1,18 @@
+import { C as CollectionHandle } from '../types-CEYS5Fzc.js';
+import { z } from '@407dev/blocks';
+
+declare function defineEmailCampaignCollection(): CollectionHandle<z.ZodObject<{
+    subject: z.ZodString;
+    preheader: z.ZodOptional<z.ZodString>;
+    body: z.ZodAny;
+    cta: z.ZodOptional<z.ZodObject<{
+        text: z.ZodString;
+        url: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>>;
+declare function defineSmsCampaignCollection(): CollectionHandle<z.ZodObject<{
+    name: z.ZodString;
+    body: z.ZodString;
+}, z.core.$strip>>;
+
+export { defineEmailCampaignCollection, defineSmsCampaignCollection };

package/dist/fields/collections.js

@@ -0,0 +1,37 @@
+import { defineCollection } from '../chunk-7E3XJLKX.js';
+import '../chunk-DMLOBKYE.js';
+import { z } from '@407dev/blocks';
+
+function defineEmailCampaignCollection() {
+  return defineCollection({
+    key: "email.campaign",
+    presentation: "form",
+    titleField: "subject",
+    listColumns: ["preheader"],
+    bodyField: "body",
+    schema: z.object({
+      subject: z.string(),
+      preheader: z.string().optional(),
+      body: z.any(),
+      cta: z.object({
+        text: z.string(),
+        url: z.string()
+      }).optional()
+    })
+  });
+}
+function defineSmsCampaignCollection() {
+  return defineCollection({
+    key: "sms.campaign",
+    presentation: "form",
+    titleField: "name",
+    schema: z.object({
+      name: z.string(),
+      body: z.string()
+    })
+  });
+}
+
+export { defineEmailCampaignCollection, defineSmsCampaignCollection };
+//# sourceMappingURL=collections.js.map
+//# sourceMappingURL=collections.js.map

package/dist/fields/collections.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/fields/collections.ts"],"names":[],"mappings":";;;;AAGO,SAAS,6BAAA,GAAgC;AAC9C,EAAA,OAAO,gBAAA,CAAiB;AAAA,IACtB,GAAA,EAAK,gBAAA;AAAA,IACL,YAAA,EAAc,MAAA;AAAA,IACd,UAAA,EAAY,SAAA;AAAA,IACZ,WAAA,EAAa,CAAC,WAAW,CAAA;AAAA,IACzB,SAAA,EAAW,MAAA;AAAA,IACX,MAAA,EAAQ,EAAE,MAAA,CAAO;AAAA,MACf,OAAA,EAAS,EAAE,MAAA,EAAO;AAAA,MAClB,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MAC/B,IAAA,EAAM,EAAE,GAAA,EAAI;AAAA,MACZ,GAAA,EAAK,EACF,MAAA,CAAO;AAAA,QACN,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,QACf,GAAA,EAAK,EAAE,MAAA;AAAO,OACf,EACA,QAAA;AAAS,KACb;AAAA,GACF,CAAA;AACH;AAEO,SAAS,2BAAA,GAA8B;AAC5C,EAAA,OAAO,gBAAA,CAAiB;AAAA,IACtB,GAAA,EAAK,cAAA;AAAA,IACL,YAAA,EAAc,MAAA;AAAA,IACd,UAAA,EAAY,MAAA;AAAA,IACZ,MAAA,EAAQ,EAAE,MAAA,CAAO;AAAA,MACf,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,IAAA,EAAM,EAAE,MAAA;AAAO,KAChB;AAAA,GACF,CAAA;AACH","file":"collections.js","sourcesContent":["import { z } from '@407dev/blocks';\nimport { defineCollection } from './collection';\n\nexport function defineEmailCampaignCollection() {\n  return defineCollection({\n    key: 'email.campaign',\n    presentation: 'form',\n    titleField: 'subject',\n    listColumns: ['preheader'],\n    bodyField: 'body',\n    schema: z.object({\n      subject: z.string(),\n      preheader: z.string().optional(),\n      body: z.any(),\n      cta: z\n        .object({\n          text: z.string(),\n          url: z.string(),\n        })\n        .optional(),\n    }),\n  });\n}\n\nexport function defineSmsCampaignCollection() {\n  return defineCollection({\n    key: 'sms.campaign',\n    presentation: 'form',\n    titleField: 'name',\n    schema: z.object({\n      name: z.string(),\n      body: z.string(),\n    }),\n  });\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,235 @@
+import { a as CmsClientConfig, C as CmsClient, R as RouteSeo, b as CmsSiteConfig, c as CmsAstroOptions, V as VerifyTokenResult, d as ContentBundle, e as CmsRedirect } from './types-NaKJe6Pg.js';
+export { f as CmsIntegrationOptions, G as GetBundleOptions, P as PreviewTokenPayload } from './types-NaKJe6Pg.js';
+import { z } from '@407dev/blocks';
+export { CmsAsset, z } from '@407dev/blocks';
+import { C as CollectionHandle, a as CollectionEntry, I as InferEntryContent, D as DefineCollectionOptions, b as CollectionStaticPath, c as DualCallableHelper, G as GroupDefinition, F as FieldScope, d as FieldHelpersMap } from './types-CEYS5Fzc.js';
+export { B as BoundGroupAccessor, e as FieldComponentProps, f as FieldReadOptions, g as GroupAccessor } from './types-CEYS5Fzc.js';
+import { AstroIntegration } from 'astro';
+export { P as PreviewMiddlewareContext, a as PreviewMiddlewareOptions, c as createPreviewMiddleware } from './preview-D9yewK8x.js';
+
+declare function createCmsClient(config: CmsClientConfig): CmsClient;
+declare function initCmsClient(options: {
+    siteId?: string;
+    contentUrl?: string;
+    previewSecret?: string;
+    client?: CmsClient;
+}): CmsClient;
+declare function getClient(): CmsClient | null;
+declare function setClient(client: CmsClient | null): void;
+
+declare function defineCollection<TSchema extends z.ZodTypeAny>(options: DefineCollectionOptions<TSchema>): CollectionHandle<TSchema>;
+declare function getEntries<T extends CollectionHandle<z.ZodTypeAny> | string>(handleOrKey: T): Array<CollectionEntry<InferEntryContent<T>>>;
+declare function getEntry<T extends CollectionHandle<z.ZodTypeAny> | string>(handleOrKey: T, slug: string): CollectionEntry<InferEntryContent<T>> | null;
+declare function collectionPaths<T extends CollectionHandle<z.ZodTypeAny> | string>(handleOrKey: T): Promise<Array<CollectionStaticPath<InferEntryContent<T>>>>;
+
+declare function createEntryDualCallableHelper<TValue = unknown, TDefault = TValue>(typeId: string, publicName: string, collectionKey: string, slug: string, defaultPath?: string): DualCallableHelper<TValue, TDefault>;
+type EntryScopeAccessor = {
+    attrs(): {
+        'data-cms-collection': string;
+        'data-cms-entry'?: string;
+    };
+    collectionKey: string;
+    slug: string;
+    text: DualCallableHelper<string>;
+    number: DualCallableHelper<number>;
+    toggle: DualCallableHelper<boolean>;
+    select: DualCallableHelper<string>;
+    img: DualCallableHelper<unknown>;
+    image: DualCallableHelper<unknown>;
+    richText: DualCallableHelper<unknown>;
+    richtext: DualCallableHelper<unknown>;
+    [key: string]: any;
+};
+declare function createEntryScope(handleOrKey: CollectionHandle<z.ZodTypeAny> | string, slug: string): EntryScopeAccessor;
+declare const entryScope: typeof createEntryScope;
+
+declare function defineGroup<TShape extends Record<string, unknown>>(nameOrShape: string | TShape, shapeOrUndefined?: TShape): GroupDefinition<TShape>;
+
+declare function createScope(prefix?: string): FieldScope;
+
+declare function cmsFieldAttr(key: string): {
+    'data-cms-field': string;
+};
+declare function cmsGroupAttr(groupName: string, prefix: string): {
+    'data-cms-group': string;
+};
+declare function cmsEntryAttr(collectionKey: string, slug?: string): {
+    'data-cms-collection': string;
+    'data-cms-entry'?: string;
+};
+declare function cmsEntryFieldAttr(path: string): {
+    'data-cms-entry-field': string;
+};
+
+type CmsF = FieldHelpersMap & {
+    scope: typeof createScope;
+    entryScope: typeof createEntryScope;
+    group: typeof defineGroup;
+    entries: typeof getEntries;
+    entry: typeof getEntry;
+    defineCollection: typeof defineCollection;
+    collectionPaths: typeof collectionPaths;
+};
+declare const f: CmsF;
+
+interface HeadTag {
+    tag: 'title' | 'meta' | 'link';
+    attrs?: Record<string, string>;
+    content?: string;
+}
+interface BuildHeadTagsOptions {
+    siteUrl?: string;
+}
+interface HeadRouteInput {
+    path?: string;
+    pattern?: string;
+    title?: string;
+    seo?: RouteSeo;
+    [key: string]: unknown;
+}
+/**
+ * Pure function building an array of head tag descriptors from route and site config.
+ * Merges site_settings.default_seo underneath routes.seo overrides.
+ */
+declare function buildHeadTags(route?: HeadRouteInput | null, siteConfig?: CmsSiteConfig | null, options?: BuildHeadTagsOptions): HeadTag[];
+
+interface ImageTransformOptions {
+    width?: number;
+    height?: number;
+    format?: string;
+    fit?: 'scale-down' | 'contain' | 'cover' | 'crop' | 'pad' | string;
+    quality?: number;
+}
+/**
+ * Determines whether a URL is hosted on a zone domain eligible for /cdn-cgi/image transforms.
+ * Non-zone URLs (*.r2.dev, localhost, relative paths, data/blob URLs) return false.
+ */
+declare function isCdnTransformableUrl(url: string): boolean;
+/**
+ * Builds a Cloudflare /cdn-cgi/image/... transform URL.
+ * Automatically degrades to the raw source URL for non-transformable hostnames.
+ */
+declare function buildCdnImageUrl(url: string, options?: ImageTransformOptions): string;
+/**
+ * Generates an HTML srcset string with Cloudflare /cdn-cgi/image transforms for specified widths.
+ */
+declare function buildSrcSet(url: string, widths?: number[], options?: Omit<ImageTransformOptions, 'width'>): string;
+
+declare function cmsAstro(options?: CmsAstroOptions): AstroIntegration;
+declare const cms: typeof cmsAstro;
+
+/**
+ * Signs a payload with HS256 using standard Web Crypto API.
+ */
+declare function signPreviewToken(payload: Record<string, unknown>, secret: string): Promise<string>;
+/**
+ * Locally verifies a signed JWT token against a shared secret using standard Web Crypto API.
+ * Never performs network requests.
+ */
+declare function verifyPreviewToken(token: string | null | undefined, secret: string | undefined, expectedSiteId?: string): Promise<VerifyTokenResult>;
+
+declare const DEFAULT_EDITOR_ORIGINS: string[];
+declare function resolveEditorOrigins(explicit?: string[] | string): string[];
+
+interface GetPreviewDataOptions {
+    previewToken?: string | null;
+    client: CmsClient;
+    /** @deprecated Site hosts no longer verify preview tokens locally. */
+    previewSecret?: string;
+    siteId?: string;
+}
+interface PreviewBundleResult {
+    ok: boolean;
+    status: number;
+    bundle?: ContentBundle;
+    error?: string;
+}
+/**
+ * Retrieves draft content bundle using preview token (verified by content-worker).
+ */
+declare function getPreviewData(options: GetPreviewDataOptions): Promise<PreviewBundleResult>;
+
+interface RichTextRenderOptions {
+    components?: Record<string, unknown>;
+    maxDepth?: number;
+}
+declare function escapeHtml(str: string): string;
+declare const KNOWN_NODES: Set<string>;
+interface RichTextNodeShape {
+    type?: string;
+    text?: string;
+    attrs?: Record<string, unknown>;
+    marks?: Array<{
+        type: string;
+        attrs?: Record<string, unknown>;
+    }>;
+    content?: unknown[];
+}
+interface LinkMarkAttrs {
+    href: string;
+    target?: string;
+    rel?: string;
+    title?: string;
+}
+/** Parses a richtext value (doc object or JSON string) into a doc root, or null if invalid/empty. */
+declare function parseRichTextDoc(value: unknown): {
+    type?: string;
+    content?: unknown[];
+} | null;
+/** Applies non-link marks to escaped text; `link` is resolved separately via getLinkMarkAttrs so callers can swap in a component. */
+declare function renderMarksOnly(text: string, marks: Array<{
+    type: string;
+    attrs?: Record<string, unknown>;
+}> | undefined): string;
+declare function getLinkMarkAttrs(marks: Array<{
+    type: string;
+    attrs?: Record<string, unknown>;
+}> | undefined): LinkMarkAttrs | null;
+declare function renderRichTextHtml(doc: unknown, options?: RichTextRenderOptions): string;
+
+declare const bundleReady: Promise<ContentBundle>;
+declare function markBundleReady(bundle: ContentBundle): void;
+declare function isBundleReady(): boolean;
+
+declare function setActiveDraftBundle(bundle: ContentBundle | null): void;
+declare function setBuildBundle(bundle: ContentBundle | null): void;
+declare function getBuildBundle(): ContentBundle | null;
+declare function getActiveBundle(): ContentBundle | null;
+declare function isDraftMode(): boolean;
+declare function runWithDraftBundle<T>(bundle: ContentBundle, fn: () => T): T;
+declare function recordMissingField(key: string): void;
+declare function getMissingFieldWarnings(): string[];
+declare function clearMissingFieldWarnings(): void;
+declare function updateBundleFieldValue(key: string, value: unknown): void;
+
+/**
+ * Renders Cloudflare Pages _redirects file content from redirect definitions.
+ */
+declare function renderRedirectsFile(redirects?: CmsRedirect[]): string;
+interface RenderRobotsOptions {
+    siteUrl?: string;
+}
+/**
+ * Renders robots.txt content from site settings.
+ */
+declare function renderRobotsTxt(config?: CmsSiteConfig | null, options?: RenderRobotsOptions): string;
+interface RenderSitemapOptions {
+    siteUrl: string;
+    siteConfig?: CmsSiteConfig | null;
+}
+interface SitemapRouteItem {
+    id?: string;
+    path?: string;
+    pattern?: string;
+    published_at?: string;
+    updated_at?: string;
+    seo?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/**
+ * Renders sitemap.xml content from routes and site config.
+ * Excludes noindex routes and the 404 route.
+ */
+declare function renderSitemapXml(routes: SitemapRouteItem[], options: RenderSitemapOptions): string;
+
+export { type BuildHeadTagsOptions, CmsAstroOptions, CmsClient, CmsClientConfig, type CmsF, CmsRedirect, CmsSiteConfig, CollectionEntry, CollectionHandle, CollectionStaticPath, ContentBundle, DEFAULT_EDITOR_ORIGINS, DefineCollectionOptions, DualCallableHelper, type EntryScopeAccessor, FieldHelpersMap, FieldScope, type GetPreviewDataOptions, GroupDefinition, type HeadRouteInput, type HeadTag, type ImageTransformOptions, InferEntryContent, KNOWN_NODES, type LinkMarkAttrs, type PreviewBundleResult, type RenderRobotsOptions, type RenderSitemapOptions, type RichTextNodeShape, type RichTextRenderOptions, RouteSeo, type SitemapRouteItem, VerifyTokenResult, buildCdnImageUrl, buildHeadTags, buildSrcSet, bundleReady, clearMissingFieldWarnings, cms, cmsAstro, cmsEntryAttr, cmsEntryFieldAttr, cmsFieldAttr, cmsGroupAttr, collectionPaths, createCmsClient, createEntryDualCallableHelper, createEntryScope, createScope, defineCollection, defineGroup, entryScope, escapeHtml, f, getActiveBundle, getBuildBundle, getClient, getEntries, getEntry, getLinkMarkAttrs, getMissingFieldWarnings, getPreviewData, initCmsClient, isBundleReady, isCdnTransformableUrl, isDraftMode, markBundleReady, parseRichTextDoc, recordMissingField, renderMarksOnly, renderRedirectsFile, renderRichTextHtml, renderRobotsTxt, renderSitemapXml, resolveEditorOrigins, runWithDraftBundle, setActiveDraftBundle, setBuildBundle, setClient, signPreviewToken, updateBundleFieldValue, verifyPreviewToken };