@growth-labs/cms 0.5.30 → 0.5.31

package/dist/engine/foundry-dispatch.d.ts

@@ -49,8 +49,13 @@ export declare function dispatchToFoundry(db: D1Database, contentId: string, hoo
 export declare function applyFoundryCallback(db: D1Database, input: CallbackInput): Promise<boolean>;
 /**
  * Verify a HMAC-SHA256 signature over `rawBody` using `secret`.
- * The `signature` is expected as a lowercase hex string.
- * Uses Web Crypto `crypto.subtle` and a constant-time comparison.
+ *
+ * The `signature` is a hex string, with or without a `sha256=` scheme prefix.
+ * Foundry (and the GitHub-webhook convention it mirrors) sends
+ * `X-Foundry-Signature: sha256=<hex>`; the prefix MUST be stripped before the
+ * hex parse or every prefixed signature fails to decode and the callback 401s.
+ * Comparison is case-insensitive on the hex and constant-time on the bytes.
+ * Uses Web Crypto `crypto.subtle`.
  */
 export declare function verifyHmac(secret: string, rawBody: string, signature: string): Promise<boolean>;
 //# sourceMappingURL=foundry-dispatch.d.ts.map

package/dist/engine/foundry-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"foundry-dispatch.d.ts","sourceRoot":"","sources":["../../src/engine/foundry-dispatch.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,OAAO,GACP,QAAQ,CAAA;AAIX,MAAM,WAAW,cAAc;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAS;gBAE/B,SAAS,EAAE,MAAM;CAI7B;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,eAAe,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAwCD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACtC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,GAC1C,OAAO,CAAC,cAAc,CAAC,CAkIzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJjG;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAmClB"}
+{"version":3,"file":"foundry-dispatch.d.ts","sourceRoot":"","sources":["../../src/engine/foundry-dispatch.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,OAAO,GACP,QAAQ,CAAA;AAIX,MAAM,WAAW,cAAc;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAS;gBAE/B,SAAS,EAAE,MAAM;CAI7B;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,eAAe,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAwCD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACtC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,GAC1C,OAAO,CAAC,cAAc,CAAC,CAkIzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJjG;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CA8ClB"}

package/dist/engine/foundry-dispatch.js

@@ -269,20 +269,38 @@ export async function applyFoundryCallback(db, input) {
 }
 /**
  * Verify a HMAC-SHA256 signature over `rawBody` using `secret`.
- * The `signature` is expected as a lowercase hex string.
- * Uses Web Crypto `crypto.subtle` and a constant-time comparison.
+ *
+ * The `signature` is a hex string, with or without a `sha256=` scheme prefix.
+ * Foundry (and the GitHub-webhook convention it mirrors) sends
+ * `X-Foundry-Signature: sha256=<hex>`; the prefix MUST be stripped before the
+ * hex parse or every prefixed signature fails to decode and the callback 401s.
+ * Comparison is case-insensitive on the hex and constant-time on the bytes.
+ * Uses Web Crypto `crypto.subtle`.
  */
 export async function verifyHmac(secret, rawBody, signature) {
     if (!signature)
         return false;
+    // Strip the optional `sha256=` scheme prefix (case-insensitive) and any
+    // surrounding whitespace before decoding the hex digest.
+    let hex = signature.trim();
+    if (/^sha256=/i.test(hex))
+        hex = hex.slice('sha256='.length).trim();
+    if (!hex)
+        return false;
+    // Reject non-hex up front: `Number.parseInt('1z', 16)` returns 1 (parses the
+    // leading nibble and stops), so malformed hex would otherwise decode to a
+    // truncated-but-valid byte string. The constant-time compare still guards
+    // forgery, but a strict charset check keeps the decode honest.
+    if (!/^[0-9a-f]+$/i.test(hex))
+        return false;
     let sigBytes;
     try {
         // Parse the hex signature
-        if (signature.length % 2 !== 0)
+        if (hex.length % 2 !== 0)
             return false;
-        sigBytes = new Uint8Array(signature.length / 2);
-        for (let i = 0; i < signature.length; i += 2) {
-            const byte = Number.parseInt(signature.slice(i, i + 2), 16);
+        sigBytes = new Uint8Array(hex.length / 2);
+        for (let i = 0; i < hex.length; i += 2) {
+            const byte = Number.parseInt(hex.slice(i, i + 2), 16);
             if (Number.isNaN(byte))
                 return false;
             sigBytes[i / 2] = byte;

package/dist/engine/foundry-dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"foundry-dispatch.js","sourceRoot":"","sources":["../../src/engine/foundry-dispatch.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,qCAAqC;AACrC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAchE,MAAM,eAAe,GAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AAO9D,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACjD,IAAI,GAAG,kBAA2B,CAAA;IAE3C,YAAY,SAAiB;QAC5B,KAAK,CAAC,WAAW,SAAS,sDAAsD,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAA;IAC/C,CAAC;CACD;AAeD,KAAK,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC3D,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,CACN,KAAK;SACH,IAAI,EAAE;SACN,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CACzB,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC,EAAE,QAAgB;IAC3E,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAC/B,IAAI,SAAS,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAChF,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACtD,IACC,IAAI,KAAK,aAAa;YACtB,IAAI,KAAK,iBAAiB;YAC1B,IAAI,KAAK,2BAA2B,EACnC,CAAC;YACF,OAAO,SAAS,CAAA;QACjB,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,oFAAoF;IACrF,CAAC;IACD,OAAO,UAAU,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,EAAc,EACd,SAAiB,EACjB,IAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,EAAE;SACtB,OAAO,CAAC,mFAAmF,CAAC;SAC5F,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,EAMF,CAAA;IACL,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,YAAY,CAAC,CAAA;IACrE,CAAC;IAED,oDAAoD;IACpD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CACP,sIAAsI,CACtI;SACA,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,EAMF,CAAA;IAEL,IAAI,KAA0C,CAAA;IAC9C,IAAI,SAAiB,CAAA;IACrB,IAAI,IAAY,CAAA;IAChB,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,OAAO,GAAkB,IAAI,CAAA;IACjC,IAAI,eAA8B,CAAA;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,KAAK,GAAG,eAAe,CAAA;QACvB,SAAS,GAAG,QAAQ,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,0BAA0B,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,GAAG,OAAO,CAAA;QACd,UAAU,GAAG,QAAQ,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAA;QAC/E,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3D,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAA;IAC5C,CAAC;SAAM,CAAC;QACP,MAAM,UAAU,GAAG,MAAM,EAAE;aACzB,OAAO,CACP,6FAA6F,CAC7F;aACA,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,EAIF,CAAA;QAEL,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACd,8BAA8B,SAAS,8CAA8C,CACrF,CAAA;QACF,CAAC;QACD,KAAK,GAAG,iBAAiB,CAAA;QACzB,SAAS,GAAG,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,8BAA8B,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,GAAG,SAAS,CAAA;QAChB,UAAU,GAAG,QAAQ,CAAA;QACrB,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACtD,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAA;IAC9C,CAAC;IAED,IACC,OAAO,eAAe,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,eAAe,IAAI,CAAC,EACnB,CAAC;QACF,MAAM,IAAI,gCAAgC,CAAC,SAAS,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACxC,MAAM,0BAA0B,GAAG,UAAU,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,CAAA;IAC5E,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;QAClD,SAAS;QACT,SAAS;QACT,IAAI;QACJ,eAAe;QACf,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,0BAA0B;KAC1B,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,EAAE;aACN,OAAO,CACP;;;;;;;;;;;;;;;;8BAgB0B,CAC1B;aACA,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;aACtE,GAAG,EAAE,CAAA;IACR,CAAC;SAAM,CAAC;QACP,qEAAqE;QACrE,MAAM,EAAE;aACN,OAAO,CAAC,8EAA8E,CAAC;aACvF,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC;aAC7B,GAAG,EAAE,CAAA;IACR,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAc,EAAE,KAAoB;IAC9E,MAAM,EACL,OAAO,EACP,SAAS,EACT,aAAa,EACb,YAAY,EACZ,SAAS,EACT,KAAK,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,OAAO,GACP,GAAG,KAAK,CAAA;IAET,qEAAqE;IACrE,MAAM,aAAa,GAAG,MAAM,EAAE;SAC5B,OAAO,CAAC,yEAAyE,CAAC;SAClF,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,EAAwB,CAAA;IAE/B,IAAI,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA,CAAC,uCAAuC;IACrD,CAAC;IAED,4DAA4D;IAC5D,6EAA6E;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CACP,2GAA2G,CAC3G;SACA,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,EAAmE,CAAA;IAE1E,MAAM,UAAU,GAAG,QAAQ;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,EAAE;aACP,OAAO,CACP,6GAA6G,CAC7G;aACA,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,EAAmE,CAAA;IAE5E,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAA,CAAC,yCAAyC;IACvD,CAAC;IAED,wBAAwB;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,EAAE;SACN,OAAO,CACP,6GAA6G,CAC7G;SACA,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC;SAC5C,GAAG,EAAE,CAAA;IAEP,6BAA6B;IAC7B,MAAM,UAAU,GAAI,eAA4B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAEpE,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,cAAc,GACnB,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/E,MAAM,mBAAmB,GACxB,OAAO,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,cAAc,KAAK,IAAI,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC7D,MAAM,EAAE;iBACN,OAAO,CACP;;;0BAGqB,CACrB;iBACA,IAAI,CACJ,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC/B,cAAc,EACd,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpC,mBAAmB,EACnB,UAAU,CAAC,UAAU,CACrB;iBACA,GAAG,EAAE,CAAA;QACR,CAAC;QAED,MAAM,eAAe,GACpB,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAClF,MAAM,WAAW,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACzF,IAAI,eAAe,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,EAAE;iBACN,OAAO,CACP;;;;kBAIa,CACb;iBACA,IAAI,CACJ,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChC,eAAe,EACf,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC5B,WAAW,EACX,UAAU,CAAC,UAAU,CACrB;iBACA,GAAG,EAAE,CAAA;QACR,CAAC;QAED,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,MAAM,GAAG,GAAG,QAAQ,CAAA;IAEpB,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE;aACN,OAAO,CACP;;;;;8BAK0B,CAC1B;aACA,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;aACxD,GAAG,EAAE,CAAA;IACR,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACvB,UAAU;QACV,MAAM,EAAE;aACN,OAAO,CACP;;;;8BAI0B,CAC1B;aACA,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC;aACzC,GAAG,EAAE,CAAA;IACR,CAAC;SAAM,CAAC;QACP,MAAM,EAAE;aACN,OAAO,CACP,kGAAkG,CAClG;aACA,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC;aACpC,GAAG,EAAE,CAAA;IACR,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,MAAc,EACd,OAAe,EACf,SAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,IAAI,QAAoB,CAAA;IACxB,IAAI,CAAC;QACJ,0BAA0B;QAC1B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5C,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAA;YACpC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;QACvB,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACR,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACzF,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;IAE9C,wBAAwB;IACxB,IAAI,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AAClB,CAAC"}
+{"version":3,"file":"foundry-dispatch.js","sourceRoot":"","sources":["../../src/engine/foundry-dispatch.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,qCAAqC;AACrC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAchE,MAAM,eAAe,GAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AAO9D,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACjD,IAAI,GAAG,kBAA2B,CAAA;IAE3C,YAAY,SAAiB;QAC5B,KAAK,CAAC,WAAW,SAAS,sDAAsD,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAA;IAC/C,CAAC;CACD;AAeD,KAAK,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC3D,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC9F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,CACN,KAAK;SACH,IAAI,EAAE;SACN,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CACzB,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC,EAAE,QAAgB;IAC3E,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAC/B,IAAI,SAAS,IAAI,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAChF,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACtD,IACC,IAAI,KAAK,aAAa;YACtB,IAAI,KAAK,iBAAiB;YAC1B,IAAI,KAAK,2BAA2B,EACnC,CAAC;YACF,OAAO,SAAS,CAAA;QACjB,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,oFAAoF;IACrF,CAAC;IACD,OAAO,UAAU,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,EAAc,EACd,SAAiB,EACjB,IAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,EAAE;SACtB,OAAO,CAAC,mFAAmF,CAAC;SAC5F,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,EAMF,CAAA;IACL,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,YAAY,CAAC,CAAA;IACrE,CAAC;IAED,oDAAoD;IACpD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CACP,sIAAsI,CACtI;SACA,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,EAMF,CAAA;IAEL,IAAI,KAA0C,CAAA;IAC9C,IAAI,SAAiB,CAAA;IACrB,IAAI,IAAY,CAAA;IAChB,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,OAAO,GAAkB,IAAI,CAAA;IACjC,IAAI,eAA8B,CAAA;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,KAAK,GAAG,eAAe,CAAA;QACvB,SAAS,GAAG,QAAQ,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,0BAA0B,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,GAAG,OAAO,CAAA;QACd,UAAU,GAAG,QAAQ,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAA;QAC/E,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3D,eAAe,GAAG,QAAQ,CAAC,gBAAgB,CAAA;IAC5C,CAAC;SAAM,CAAC;QACP,MAAM,UAAU,GAAG,MAAM,EAAE;aACzB,OAAO,CACP,6FAA6F,CAC7F;aACA,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,EAIF,CAAA;QAEL,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACd,8BAA8B,SAAS,8CAA8C,CACrF,CAAA;QACF,CAAC;QACD,KAAK,GAAG,iBAAiB,CAAA;QACzB,SAAS,GAAG,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,8BAA8B,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,GAAG,SAAS,CAAA;QAChB,UAAU,GAAG,QAAQ,CAAA;QACrB,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACtD,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAA;IAC9C,CAAC;IAED,IACC,OAAO,eAAe,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,eAAe,IAAI,CAAC,EACnB,CAAC;QACF,MAAM,IAAI,gCAAgC,CAAC,SAAS,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACxC,MAAM,0BAA0B,GAAG,UAAU,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,CAAA;IAC5E,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;QAClD,SAAS;QACT,SAAS;QACT,IAAI;QACJ,eAAe;QACf,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,0BAA0B;KAC1B,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,EAAE;aACN,OAAO,CACP;;;;;;;;;;;;;;;;8BAgB0B,CAC1B;aACA,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;aACtE,GAAG,EAAE,CAAA;IACR,CAAC;SAAM,CAAC;QACP,qEAAqE;QACrE,MAAM,EAAE;aACN,OAAO,CAAC,8EAA8E,CAAC;aACvF,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC;aAC7B,GAAG,EAAE,CAAA;IACR,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAc,EAAE,KAAoB;IAC9E,MAAM,EACL,OAAO,EACP,SAAS,EACT,aAAa,EACb,YAAY,EACZ,SAAS,EACT,KAAK,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,OAAO,GACP,GAAG,KAAK,CAAA;IAET,qEAAqE;IACrE,MAAM,aAAa,GAAG,MAAM,EAAE;SAC5B,OAAO,CAAC,yEAAyE,CAAC;SAClF,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,EAAwB,CAAA;IAE/B,IAAI,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA,CAAC,uCAAuC;IACrD,CAAC;IAED,4DAA4D;IAC5D,6EAA6E;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CACP,2GAA2G,CAC3G;SACA,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,EAAmE,CAAA;IAE1E,MAAM,UAAU,GAAG,QAAQ;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,EAAE;aACP,OAAO,CACP,6GAA6G,CAC7G;aACA,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,EAAmE,CAAA;IAE5E,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAA,CAAC,yCAAyC;IACvD,CAAC;IAED,wBAAwB;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,EAAE;SACN,OAAO,CACP,6GAA6G,CAC7G;SACA,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC;SAC5C,GAAG,EAAE,CAAA;IAEP,6BAA6B;IAC7B,MAAM,UAAU,GAAI,eAA4B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAEpE,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,cAAc,GACnB,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/E,MAAM,mBAAmB,GACxB,OAAO,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAA;QACR,IAAI,cAAc,KAAK,IAAI,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC7D,MAAM,EAAE;iBACN,OAAO,CACP;;;0BAGqB,CACrB;iBACA,IAAI,CACJ,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC/B,cAAc,EACd,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpC,mBAAmB,EACnB,UAAU,CAAC,UAAU,CACrB;iBACA,GAAG,EAAE,CAAA;QACR,CAAC;QAED,MAAM,eAAe,GACpB,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAClF,MAAM,WAAW,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACzF,IAAI,eAAe,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,EAAE;iBACN,OAAO,CACP;;;;kBAIa,CACb;iBACA,IAAI,CACJ,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChC,eAAe,EACf,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC5B,WAAW,EACX,UAAU,CAAC,UAAU,CACrB;iBACA,GAAG,EAAE,CAAA;QACR,CAAC;QAED,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,MAAM,GAAG,GAAG,QAAQ,CAAA;IAEpB,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE;aACN,OAAO,CACP;;;;;8BAK0B,CAC1B;aACA,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;aACxD,GAAG,EAAE,CAAA;IACR,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACvB,UAAU;QACV,MAAM,EAAE;aACN,OAAO,CACP;;;;8BAI0B,CAC1B;aACA,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC;aACzC,GAAG,EAAE,CAAA;IACR,CAAC;SAAM,CAAC;QACP,MAAM,EAAE;aACN,OAAO,CACP,kGAAkG,CAClG;aACA,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC;aACpC,GAAG,EAAE,CAAA;IACR,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,MAAc,EACd,OAAe,EACf,SAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAE3C,IAAI,QAAoB,CAAA;IACxB,IAAI,CAAC;QACJ,0BAA0B;QAC1B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACtC,QAAQ,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACrD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAA;YACpC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;QACvB,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACR,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACzF,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;IAE9C,wBAAwB;IACxB,IAAI,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AAClB,CAAC"}

package/dist/engine/fronts-publish-intent.d.ts

@@ -0,0 +1,174 @@
+import type { ContentType, FrontsPublishStatus } from '../schema/types.js';
+import type { D1Database } from './d1.js';
+/** The CMS's own name for the record this intent describes. */
+export declare const FRONTS_PUBLISH_INTENT_SOURCE = "masthead";
+/**
+ * `masthead:<content_id>:<version>`. Stable for as long as the canonical
+ * content is, and different the moment `canonical_version` advances, so a
+ * meaningful revision can never silently reuse a conflicting identity.
+ */
+export declare function frontsPublishIntentId(contentId: string, version: number): string;
+/** Every way a due item can fail to form a complete, honest intent. */
+export type FrontsPublishIntentErrorCode = 'missing_publish_at' | 'invalid_canonical_version' | 'missing_channel_targets' | 'invalid_channel_targets' | 'missing_trigger_token' | 'missing_article_body' | 'video_media_not_ready' | 'missing_podcast_audio';
+/**
+ * A due item whose canonical data cannot produce a complete intent. Thrown by
+ * the single-item hydration; collected (never swallowed) by the batch one.
+ */
+export declare class FrontsPublishIntentError extends Error {
+    readonly code: FrontsPublishIntentErrorCode;
+    readonly contentId: string;
+    constructor(code: FrontsPublishIntentErrorCode, contentId: string, detail?: string);
+}
+export interface FrontsPublishArticleRef {
+    /** Absolute when a site base/canonical URL is known, else a site-relative path. */
+    url: string;
+    slug: string;
+    word_count: number | null;
+}
+export interface FrontsPublishImageRef {
+    id: string;
+    role: 'hero' | 'social' | 'thumbnail';
+    url: string;
+    width: number | null;
+    height: number | null;
+}
+export interface FrontsPublishVideoHlsRef {
+    kind: 'hls-manifest';
+    url: string;
+    poster_url: string | null;
+    duration_seconds: number | null;
+}
+export interface FrontsPublishPodcastAudioRef {
+    /**
+     * `'r2-object'` — a progressive-download R2 audio object
+     * (podcast_content.audio_r2_key), which is what the CMS actually stores.
+     * `'hls-manifest'` is reserved for when an audio HLS pipeline exists. Always
+     * check this before treating `url` as a manifest.
+     */
+    kind: 'r2-object' | 'hls-manifest';
+    url: string;
+    duration_seconds: number | null;
+}
+export interface FrontsPublishLinkRef {
+    rel: 'canonical' | 'public';
+    url: string;
+}
+export interface FrontsPublishContentRefs {
+    article: FrontsPublishArticleRef | null;
+    /** `[]` is valid — the item simply has no hero/social/thumbnail asset. */
+    images: FrontsPublishImageRef[];
+    video_hls: FrontsPublishVideoHlsRef | null;
+    podcast_audio_hls: FrontsPublishPodcastAudioRef | null;
+    /** `[]` is valid. */
+    links: FrontsPublishLinkRef[];
+}
+/**
+ * One due/overdue item's complete canonical publish intent. Contains NO secret:
+ * `trigger_token_hash` is a digest and the raw token never leaves D1.
+ */
+export interface FrontsPublishIntent {
+    intent_id: string;
+    content_id: string;
+    version: number;
+    type: ContentType;
+    slug: string;
+    title: string;
+    /** The single editorial Fronts channel slug — NOT a publish target. */
+    channel: string | null;
+    channel_targets: string[];
+    /** Unix epoch SECONDS. Equals content_items.publish_at. */
+    deadline: number;
+    /**
+     * Unix epoch SECONDS. Equals `deadline` in this increment: the CMS declares no
+     * pre-roll lead of its own rather than inventing one. A host-configurable lead
+     * is deliberately deferred — see packages-docs/cms.md.
+     */
+    trigger_at: number;
+    content_refs: FrontsPublishContentRefs;
+    /** `sha256:<64 lowercase hex>`. Never the raw token. */
+    trigger_token_hash: string;
+    /** `deadline <= now` — the consumer is late on this one. */
+    overdue: boolean;
+    fronts_publish_status: FrontsPublishStatus | null;
+}
+/** The `sha256:` prefix every exposed CMS trigger-token digest carries. */
+export declare const FRONTS_PUBLISH_TRIGGER_TOKEN_HASH_PREFIX = "sha256:";
+/**
+ * The exposed form of a trigger token: `sha256:<hex>`. Same convention
+ * `engine/foundry-dispatch.ts` already uses for `processingTriggerTokenHash`.
+ */
+export declare function frontsPublishTriggerTokenHash(rawToken: string): Promise<string>;
+/**
+ * Mint this item's raw publish trigger token if — and only if — it has none.
+ *
+ * Idempotent by compare-and-set, so concurrent callers cannot produce two tokens
+ * and a re-arm never rotates a token out from under an in-flight intent: an
+ * armed item keeps one stable `trigger_token_hash` across every later read.
+ * Called from `scheduleContent`, the single seam an item passes through to
+ * become `scheduled` with a `publish_at`. The raw value is never returned.
+ */
+export declare function armFrontsPublishTriggerToken(db: D1Database, contentId: string): Promise<{
+    minted: boolean;
+}>;
+/**
+ * Parse `content_items.fronts_channel_targets`. Returns the target list, or a
+ * loud error code — NEVER a silent `[]`, which would read as a complete intent
+ * with nothing to publish to.
+ */
+type ChannelTargetsFailure = {
+    code: 'missing_channel_targets' | 'invalid_channel_targets';
+};
+export declare function parseFrontsChannelTargets(raw: string | null | undefined): {
+    targets: string[];
+} | ChannelTargetsFailure;
+/**
+ * Arm an item's publish targets. Rejects an empty or non-string list loudly
+ * instead of storing something that would later hydrate as "complete".
+ */
+export declare function setFrontsChannelTargets(db: D1Database, contentId: string, targets: readonly string[]): Promise<void>;
+export interface HydrateFrontsPublishIntentsOptions {
+    /** Window upper bound, unix epoch seconds. Items due at/before this are considered. */
+    toSeconds: number;
+    /** Reference time for `overdue`, unix epoch seconds. Defaults to Date.now(). */
+    nowSeconds?: number;
+    /** Hard cap on candidates. Default 200, max 1000 — mirrors the schedule poll. */
+    limit?: number;
+    /**
+     * Resolve an item's public URL (absolute when the host knows its origin, else
+     * a site-relative path). Injected rather than imported so this engine module
+     * does not depend on the UI layer.
+     */
+    resolveContentUrl: (row: {
+        type: ContentType;
+        slug: string;
+    }) => string;
+    /** Public media host used for media rows with no stored URL. Default 'media.fronts.co'. */
+    mediaPublicDomain?: string;
+}
+/** One due item that could NOT form a complete intent, with the exact reason. */
+export interface FrontsPublishIntentFailure {
+    content_id: string;
+    code: FrontsPublishIntentErrorCode;
+    message: string;
+}
+export interface HydrateFrontsPublishIntentsResult {
+    intents: FrontsPublishIntent[];
+    /**
+     * Due items that are NOT publishable — never empty-defaulted into `intents`
+     * and never silently dropped. One bad item does not suppress the others, so a
+     * single broken record cannot block the whole publish lane.
+     */
+    incomplete: FrontsPublishIntentFailure[];
+}
+/**
+ * Hydrate every due/overdue `scheduled` item into a complete canonical intent.
+ *
+ * Uses the SAME due predicate as `listFrontsPublishSchedule` — overdue items
+ * included (the window's lower bound is deliberately not applied), future items
+ * excluded — so existing window behaviour is preserved exactly. READ ONLY: it
+ * never mutates content, advances `canonical_version`, or mints a token, so
+ * polling cannot churn an intent identity.
+ */
+export declare function hydrateFrontsPublishIntents(db: D1Database, options: HydrateFrontsPublishIntentsOptions): Promise<HydrateFrontsPublishIntentsResult>;
+export {};
+//# sourceMappingURL=fronts-publish-intent.d.ts.map

package/dist/engine/fronts-publish-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fronts-publish-intent.d.ts","sourceRoot":"","sources":["../../src/engine/fronts-publish-intent.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B,aAAa,CAAA;AAEtD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED,uEAAuE;AACvE,MAAM,MAAM,4BAA4B,GACrC,oBAAoB,GACpB,2BAA2B,GAC3B,yBAAyB,GACzB,yBAAyB,GACzB,uBAAuB,GACvB,sBAAsB,GACtB,uBAAuB,GACvB,uBAAuB,CAAA;AAE1B;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAA;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBACd,IAAI,EAAE,4BAA4B,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAMlF;AAID,MAAM,WAAW,uBAAuB;IACvC,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAA;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,cAAc,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,IAAI,EAAE,WAAW,GAAG,cAAc,CAAA;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACpC,GAAG,EAAE,WAAW,GAAG,QAAQ,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACxC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAA;IACvC,0EAA0E;IAC1E,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC/B,SAAS,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC1C,iBAAiB,EAAE,4BAA4B,GAAG,IAAI,CAAA;IACtD,qBAAqB;IACrB,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,WAAW,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,wBAAwB,CAAA;IACtC,wDAAwD;IACxD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,EAAE,mBAAmB,GAAG,IAAI,CAAA;CACjD;AAYD,2EAA2E;AAC3E,eAAO,MAAM,wCAAwC,YAAY,CAAA;AAEjE;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAErF;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CACjD,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAa9B;AAID;;;;GAIG;AACH,KAAK,qBAAqB,GAAG;IAAE,IAAI,EAAE,yBAAyB,GAAG,yBAAyB,CAAA;CAAE,CAAA;AAmB5F,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC5B;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,qBAAqB,CAY/C;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC5C,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,IAAI,CAAC,CAaf;AAyBD,MAAM,WAAW,kCAAkC;IAClD,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAA;IACvE,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,iFAAiF;AACjF,MAAM,WAAW,0BAA0B;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,4BAA4B,CAAA;IAClC,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iCAAiC;IACjD,OAAO,EAAE,mBAAmB,EAAE,CAAA;IAC9B;;;;OAIG;IACH,UAAU,EAAE,0BAA0B,EAAE,CAAA;CACxC;AAmDD;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAChD,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,kCAAkC,GACzC,OAAO,CAAC,iCAAiC,CAAC,CA8C5C"}

package/dist/engine/fronts-publish-intent.js

@@ -0,0 +1,352 @@
+/** The CMS's own name for the record this intent describes. */
+export const FRONTS_PUBLISH_INTENT_SOURCE = 'masthead';
+/**
+ * `masthead:<content_id>:<version>`. Stable for as long as the canonical
+ * content is, and different the moment `canonical_version` advances, so a
+ * meaningful revision can never silently reuse a conflicting identity.
+ */
+export function frontsPublishIntentId(contentId, version) {
+    return `${FRONTS_PUBLISH_INTENT_SOURCE}:${contentId}:${version}`;
+}
+/**
+ * A due item whose canonical data cannot produce a complete intent. Thrown by
+ * the single-item hydration; collected (never swallowed) by the batch one.
+ */
+export class FrontsPublishIntentError extends Error {
+    code;
+    contentId;
+    constructor(code, contentId, detail) {
+        super(`fronts publish intent ${code} for content ${contentId}${detail ? `: ${detail}` : ''}`);
+        this.name = 'FrontsPublishIntentError';
+        this.code = code;
+        this.contentId = contentId;
+    }
+}
+// --- trigger token ---------------------------------------------------------
+/** SHA-256 hex digest via Web Crypto (never node:crypto). */
+async function sha256Hex(input) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/** The `sha256:` prefix every exposed CMS trigger-token digest carries. */
+export const FRONTS_PUBLISH_TRIGGER_TOKEN_HASH_PREFIX = 'sha256:';
+/**
+ * The exposed form of a trigger token: `sha256:<hex>`. Same convention
+ * `engine/foundry-dispatch.ts` already uses for `processingTriggerTokenHash`.
+ */
+export async function frontsPublishTriggerTokenHash(rawToken) {
+    return `${FRONTS_PUBLISH_TRIGGER_TOKEN_HASH_PREFIX}${await sha256Hex(rawToken)}`;
+}
+/**
+ * Mint this item's raw publish trigger token if — and only if — it has none.
+ *
+ * Idempotent by compare-and-set, so concurrent callers cannot produce two tokens
+ * and a re-arm never rotates a token out from under an in-flight intent: an
+ * armed item keeps one stable `trigger_token_hash` across every later read.
+ * Called from `scheduleContent`, the single seam an item passes through to
+ * become `scheduled` with a `publish_at`. The raw value is never returned.
+ */
+export async function armFrontsPublishTriggerToken(db, contentId) {
+    const result = await db
+        .prepare(`UPDATE content_items
+			 SET fronts_publish_trigger_token = ?
+			 WHERE id = ? AND fronts_publish_trigger_token IS NULL`)
+        .bind(crypto.randomUUID(), contentId)
+        .run();
+    // `meta` is a structural Record<string, unknown> on the package's minimal D1
+    // surface, so narrow before comparing (same idiom as fronts-publish.ts).
+    const changes = result.meta?.changes;
+    return { minted: typeof changes === 'number' && changes > 0 };
+}
+/** Single source of truth for what a publishable target list IS — shared by the
+ * stored-value parser and the setter so the two can never diverge. */
+function normalizeChannelTargets(entries) {
+    const targets = [];
+    for (const entry of entries) {
+        if (typeof entry !== 'string' || entry.trim() === '') {
+            return { code: 'invalid_channel_targets' };
+        }
+        const target = entry.trim();
+        if (!targets.includes(target))
+            targets.push(target);
+    }
+    if (targets.length === 0)
+        return { code: 'missing_channel_targets' };
+    return { targets };
+}
+export function parseFrontsChannelTargets(raw) {
+    if (raw === null || raw === undefined || raw.trim() === '') {
+        return { code: 'missing_channel_targets' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { code: 'invalid_channel_targets' };
+    }
+    if (!Array.isArray(parsed))
+        return { code: 'invalid_channel_targets' };
+    return normalizeChannelTargets(parsed);
+}
+/**
+ * Arm an item's publish targets. Rejects an empty or non-string list loudly
+ * instead of storing something that would later hydrate as "complete".
+ */
+export async function setFrontsChannelTargets(db, contentId, targets) {
+    const normalized = normalizeChannelTargets(targets);
+    if ('code' in normalized) {
+        throw new FrontsPublishIntentError(normalized.code, contentId, 'targets must be a non-empty list of non-empty strings');
+    }
+    await db
+        .prepare('UPDATE content_items SET fronts_channel_targets = ? WHERE id = ?')
+        .bind(JSON.stringify(normalized.targets), contentId)
+        .run();
+}
+const CANDIDATE_COLUMNS = `id, type, slug, title, channel, publish_at, fronts_publish_status,
+			 canonical_version, fronts_channel_targets, fronts_publish_trigger_token,
+			 canonical_url, hero_image_id, social_image_id`;
+/** `?, ?, ?` for an IN clause of `count` bound values. */
+function placeholders(count) {
+    return new Array(count).fill('?').join(', ');
+}
+/** An R2 object key (or already-absolute URL) against the public media host. */
+function objectKeyUrl(key, mediaPublicDomain) {
+    if (/^https?:\/\//i.test(key))
+        return key;
+    return `https://${mediaPublicDomain}/${key.replace(/^\/+/, '')}`;
+}
+/** Resolve a media row to its public URL, or null when it has no usable form. */
+function mediaUrl(row, mediaPublicDomain) {
+    const stored = row.public_url?.trim() || row.url?.trim();
+    if (stored)
+        return stored;
+    const key = row.object_key?.trim();
+    return key ? objectKeyUrl(key, mediaPublicDomain) : null;
+}
+/**
+ * Hydrate every due/overdue `scheduled` item into a complete canonical intent.
+ *
+ * Uses the SAME due predicate as `listFrontsPublishSchedule` — overdue items
+ * included (the window's lower bound is deliberately not applied), future items
+ * excluded — so existing window behaviour is preserved exactly. READ ONLY: it
+ * never mutates content, advances `canonical_version`, or mints a token, so
+ * polling cannot churn an intent identity.
+ */
+export async function hydrateFrontsPublishIntents(db, options) {
+    const now = options.nowSeconds ?? Math.floor(Date.now() / 1_000);
+    const limit = Math.min(Math.max(1, Math.floor(options.limit ?? 200)), 1000);
+    const mediaPublicDomain = options.mediaPublicDomain ?? 'media.fronts.co';
+    const candidates = await db
+        .prepare(`SELECT ${CANDIDATE_COLUMNS}
+			 FROM content_items
+			 WHERE status = 'scheduled'
+			   AND publish_at IS NOT NULL
+			   AND publish_at <= ?
+			 ORDER BY publish_at ASC
+			 LIMIT ?`)
+        .bind(options.toSeconds, limit)
+        .all();
+    const rows = candidates.results ?? [];
+    if (rows.length === 0)
+        return { intents: [], incomplete: [] };
+    const refs = await loadContentRefSources(db, rows);
+    const intents = [];
+    const incomplete = [];
+    for (const row of rows) {
+        try {
+            intents.push(await buildIntent(row, refs, {
+                now,
+                mediaPublicDomain,
+                resolve: options.resolveContentUrl,
+            }));
+        }
+        catch (error) {
+            if (error instanceof FrontsPublishIntentError) {
+                // LOUD: an operator can see exactly which due item is unpublishable and why.
+                console.error(`[cms] fronts publish intent incomplete: ${error.message}`);
+                incomplete.push({ content_id: error.contentId, code: error.code, message: error.message });
+                continue;
+            }
+            throw error;
+        }
+    }
+    return { intents, incomplete };
+}
+/** Batched per-type + media lookups — a fixed query count, not one per item. */
+async function loadContentRefSources(db, rows) {
+    const bodyBackedIds = rows
+        .filter((r) => r.type === 'article' || r.type === 'newsletter' || r.type === 'page')
+        .map((r) => r.id);
+    const videoIds = rows.filter((r) => r.type === 'video').map((r) => r.id);
+    const podcastIds = rows.filter((r) => r.type === 'podcast').map((r) => r.id);
+    const articles = new Map();
+    if (bodyBackedIds.length > 0) {
+        const res = await db
+            .prepare(`SELECT content_id, body_markdown, word_count FROM article_content
+				 WHERE content_id IN (${placeholders(bodyBackedIds.length)})`)
+            .bind(...bodyBackedIds)
+            .all();
+        for (const r of res.results ?? [])
+            articles.set(r.content_id, r);
+    }
+    const videos = new Map();
+    if (videoIds.length > 0) {
+        const res = await db
+            .prepare(`SELECT content_id, hls_ready, hls_manifest_url, hls_poster_url, duration_seconds,
+				        thumbnail_image_id
+				 FROM video_content WHERE content_id IN (${placeholders(videoIds.length)})`)
+            .bind(...videoIds)
+            .all();
+        for (const r of res.results ?? [])
+            videos.set(r.content_id, r);
+    }
+    const podcasts = new Map();
+    if (podcastIds.length > 0) {
+        const res = await db
+            .prepare(`SELECT content_id, audio_r2_key, duration_seconds FROM podcast_content
+				 WHERE content_id IN (${placeholders(podcastIds.length)})`)
+            .bind(...podcastIds)
+            .all();
+        for (const r of res.results ?? [])
+            podcasts.set(r.content_id, r);
+    }
+    const mediaIds = [];
+    const pushMediaId = (id) => {
+        const trimmed = id?.trim();
+        if (trimmed && !mediaIds.includes(trimmed))
+            mediaIds.push(trimmed);
+    };
+    for (const row of rows) {
+        pushMediaId(row.hero_image_id);
+        pushMediaId(row.social_image_id);
+    }
+    for (const video of videos.values())
+        pushMediaId(video.thumbnail_image_id);
+    const media = new Map();
+    if (mediaIds.length > 0) {
+        const res = await db
+            .prepare(`SELECT id, object_key, public_url, url, width, height FROM media_assets
+				 WHERE id IN (${placeholders(mediaIds.length)})`)
+            .bind(...mediaIds)
+            .all();
+        for (const r of res.results ?? [])
+            media.set(r.id, r);
+    }
+    return { articles, videos, podcasts, media };
+}
+/** Build one intent, throwing FrontsPublishIntentError on any missing required value. */
+async function buildIntent(row, refs, ctx) {
+    if (row.publish_at === null || !Number.isFinite(row.publish_at)) {
+        throw new FrontsPublishIntentError('missing_publish_at', row.id);
+    }
+    const version = row.canonical_version;
+    if (version === null || !Number.isInteger(version) || version < 1) {
+        throw new FrontsPublishIntentError('invalid_canonical_version', row.id, `canonical_version must be a positive integer, got ${String(version)}`);
+    }
+    const targets = parseFrontsChannelTargets(row.fronts_channel_targets);
+    if ('code' in targets) {
+        throw new FrontsPublishIntentError(targets.code, row.id, 'content_items.fronts_channel_targets must be a JSON array of target slugs');
+    }
+    const rawToken = row.fronts_publish_trigger_token?.trim();
+    if (!rawToken) {
+        throw new FrontsPublishIntentError('missing_trigger_token', row.id, 'item was never armed for the Fronts publish path (no fronts_publish_trigger_token)');
+    }
+    const deadline = Math.floor(row.publish_at);
+    return {
+        intent_id: frontsPublishIntentId(row.id, version),
+        content_id: row.id,
+        version,
+        type: row.type,
+        slug: row.slug,
+        title: row.title,
+        channel: row.channel,
+        channel_targets: targets.targets,
+        deadline,
+        trigger_at: deadline,
+        content_refs: buildContentRefs(row, refs, ctx),
+        trigger_token_hash: await frontsPublishTriggerTokenHash(rawToken),
+        overdue: deadline <= ctx.now,
+        fronts_publish_status: row.fronts_publish_status,
+    };
+}
+/** Per-type content refs, applying the absence rules in the module header. */
+function buildContentRefs(row, refs, ctx) {
+    const publicUrl = ctx.resolve({ type: row.type, slug: row.slug });
+    const canonicalUrl = row.canonical_url?.trim() || null;
+    // --- article: required for body-backed types, validly absent otherwise.
+    let article = null;
+    const bodyBacked = row.type === 'article' || row.type === 'newsletter' || row.type === 'page';
+    if (bodyBacked) {
+        const found = refs.articles.get(row.id);
+        if (!found?.body_markdown || found.body_markdown.trim() === '') {
+            throw new FrontsPublishIntentError('missing_article_body', row.id, `a ${row.type} intent requires a non-empty article_content.body_markdown`);
+        }
+        article = {
+            url: canonicalUrl ?? publicUrl,
+            slug: row.slug,
+            word_count: found.word_count ?? null,
+        };
+    }
+    // --- video_hls: required for video, and only when genuinely ready.
+    let videoHls = null;
+    if (row.type === 'video') {
+        const found = refs.videos.get(row.id);
+        const manifest = found?.hls_manifest_url?.trim();
+        if (!found || found.hls_ready !== 1 || !manifest) {
+            throw new FrontsPublishIntentError('video_media_not_ready', row.id, 'a video intent requires video_content.hls_ready = 1 and a non-empty hls_manifest_url');
+        }
+        videoHls = {
+            kind: 'hls-manifest',
+            url: manifest,
+            poster_url: found.hls_poster_url?.trim() || null,
+            duration_seconds: found.duration_seconds ?? null,
+        };
+    }
+    // --- podcast_audio_hls: required for podcast. See the module header for why
+    //     `kind` is 'r2-object' today rather than a manifest.
+    let podcastAudio = null;
+    if (row.type === 'podcast') {
+        const found = refs.podcasts.get(row.id);
+        const key = found?.audio_r2_key?.trim();
+        if (!found || !key) {
+            throw new FrontsPublishIntentError('missing_podcast_audio', row.id, 'a podcast intent requires a non-empty podcast_content.audio_r2_key');
+        }
+        podcastAudio = {
+            kind: 'r2-object',
+            url: objectKeyUrl(key, ctx.mediaPublicDomain),
+            duration_seconds: found.duration_seconds ?? null,
+        };
+    }
+    // --- images: always optional. [] means the item has no assets.
+    const images = [];
+    const pushImage = (id, role) => {
+        const assetId = id?.trim();
+        if (!assetId)
+            return;
+        const asset = refs.media.get(assetId);
+        if (!asset)
+            return;
+        const url = mediaUrl(asset, ctx.mediaPublicDomain);
+        if (!url)
+            return;
+        images.push({
+            id: assetId,
+            role,
+            url,
+            width: asset.width ?? null,
+            height: asset.height ?? null,
+        });
+    };
+    pushImage(row.hero_image_id, 'hero');
+    pushImage(row.social_image_id, 'social');
+    pushImage(refs.videos.get(row.id)?.thumbnail_image_id, 'thumbnail');
+    // --- links: always optional.
+    const links = [{ rel: 'public', url: publicUrl }];
+    if (canonicalUrl)
+        links.push({ rel: 'canonical', url: canonicalUrl });
+    return { article, images, video_hls: videoHls, podcast_audio_hls: podcastAudio, links };
+}
+//# sourceMappingURL=fronts-publish-intent.js.map