@heyo-sh/heyo-cms 0.3.0 → 0.3.1

package/dist/{index-zyg6bfdq.js → index-2zpnecrk.js}

@@ -1,2 +1,2 @@
-import{s,R,t,it,H,M,S,ae,le,m}from"./index-6m1kjq9g.js";import{E,l,u}from"./index-axpzy2hj.js";import{ye}from"./index-abfzb1ve.js";import{T,U,Qe}from"./index-91fa1gzf.js";import{d}from"./index-9g2n7xa6.js";import{Q}from"./index-ptttzgtp.js";import{se}from"./index-rw0hze6x.js";import{x}from"./index-2ddk43me.js";import{b}from"./index-8nzmqy0f.js";import{e}from"./index-x72d1hzh.js";function V(n,r){let i=r.map((a)=>{let o=pt(n,a.path);return{path:a.path,value:o instanceof Date?o.toISOString():gt(o),date:o instanceof Date}});return ht(JSON.stringify(i))}function J(n,r){let i=mt(n);if(i.length!==r.length)throw new e("This cursor does not match the requested sort order.",{status:400,code:"invalid_cursor"});let a=[];for(let o=0;o<r.length;o+=1){let f=[];for(let C=0;C<o;C+=1){let D=i[C];f.push(t(D.path,pe(D)))}let p=i[o],w=r[o].direction;f.push(w==="desc"?H(p.path,pe(p)):it(p.path,pe(p))),a.push(s(...f))}return R(...a)}function mt(n){try{let r=JSON.parse(yt(n));if(!Array.isArray(r))throw Error("not a cursor");return r}catch{throw new e("This cursor is not readable.",{status:400,code:"invalid_cursor"})}}function pe(n){return n.date&&typeof n.value==="string"?new Date(n.value):n.value}function pt(n,r){if(r in n)return n[r];let i=r.split("."),a=n.data??n;for(let o of i){if(typeof a!=="object"||a===null)return;a=a[o]}return a}function gt(n){if(n===void 0||n===null)return null;if(typeof n==="object")return null;return n}function ht(n){let r=new TextEncoder().encode(n),i="";for(let a of r)i+=String.fromCharCode(a);return btoa(i).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function yt(n){let r=n.replaceAll("-","+").replaceAll("_","/"),i=atob(r.padEnd(Math.ceil(r.length/4)*4,"=")),a=Uint8Array.from(i,(o)=>o.charCodeAt(0));return new TextDecoder().decode(a)}var Re={jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",avif:"image/avif",svg:"image/svg+xml",tiff:"image/tiff"};function xo(n){return Re[n]}function Ee(n){return xt(n)??Mt(n)??At(n)??Ct(n)??St(n)??It(n)}function Me(n){let i={"image/jpeg":"jpg","image/png":"png","image/gif":"gif","image/webp":"webp","image/avif":"avif","image/svg+xml":"svg","image/tiff":"tiff","video/mp4":"mp4","video/webm":"webm","audio/mpeg":"mp3","application/pdf":"pdf","application/json":"json","text/plain":"txt","text/csv":"csv"}[n.toLowerCase()];if(i)return i;let a=n.split("/")[1]?.split(";")[0]?.trim();return a&&/^[a-z0-9.+-]+$/i.test(a)?a:"bin"}function xt(n){let r=[137,80,78,71,13,10,26,10];if(n.length<24||!Ut(n,r))return null;return W("png",ie(n,16),ie(n,20))}function Mt(n){if(n.length<10||G(n,0,3)!=="GIF")return null;return W("gif",oe(n,6),oe(n,8))}function At(n){if(n.length<30||G(n,0,4)!=="RIFF"||G(n,8,4)!=="WEBP")return null;let r=G(n,12,4);if(r==="VP8X")return W("webp",De(n,24)+1,De(n,27)+1);if(r==="VP8 "){if(n[23]!==157||n[24]!==1||n[25]!==42)return null;return W("webp",oe(n,26)&16383,oe(n,28)&16383)}if(r==="VP8L"){if(n[20]!==47)return null;let i=B(n,21),a=B(n,22),o=B(n,23),f=B(n,24);return W("webp",((a&63)<<8|i)+1,((f&15)<<10|o<<2|(a&192)>>6)+1)}return null}function Ct(n){if(n.length<4||n[0]!==255||n[1]!==216)return null;let r=2;while(r+9<n.length){if(n[r]!==255){r+=1;continue}let i=B(n,r+1);if(i===255||i===1||i>=208&&i<=217){r+=2;continue}if(i>=192&&i<=195||i>=197&&i<=199||i>=201&&i<=203||i>=205&&i<=207)return W("jpeg",ge(n,r+7),ge(n,r+5));let o=ge(n,r+2);if(o<2)return null;r+=2+o}return null}function St(n){if(n.length<16||G(n,4,4)!=="ftyp")return null;let r=G(n,8,4),i=r==="avif"||r==="avis";if(!i&&!(r==="heic"||r==="heix"||r==="mif1"))return null;let o=Math.min(n.length-16,65536);for(let f=16;f<o;f+=1){if(G(n,f,4)!=="ispe")continue;let p=ie(n,f+8),w=ie(n,f+12);if(p>0&&w>0&&p<1e5&&w<1e5)return W(i?"avif":"avif",p,w)}return null}function It(n){let r=new TextDecoder().decode(n.subarray(0,2048));if(!/<svg[\s>]/i.test(r))return null;let i=(f)=>{let p=new RegExp(`\\b${f}\\s*=\\s*["']([\\d.]+)`,"i").exec(r);return p?Math.round(Number(p[1])):0},a=i("width"),o=i("height");if(a===0||o===0){let f=/\bviewBox\s*=\s*["']\s*[\d.-]+\s+[\d.-]+\s+([\d.]+)\s+([\d.]+)/i.exec(r);if(f)a=Math.round(Number(f[1])),o=Math.round(Number(f[2]))}return W("svg",a,o)}function W(n,r,i){return{format:n,contentType:Re[n],width:r,height:i}}function B(n,r){return n[r]??0}function ge(n,r){return B(n,r)<<8|B(n,r+1)}function ie(n,r){return B(n,r)*16777216+(B(n,r+1)<<16|B(n,r+2)<<8|B(n,r+3))}function oe(n,r){return B(n,r)|B(n,r+1)<<8}function De(n,r){return B(n,r)|B(n,r+1)<<8|B(n,r+2)<<16}function G(n,r,i){let a="";for(let o=0;o<i;o+=1)a+=String.fromCharCode(B(n,r+o));return a}function Ut(n,r){return r.every((i,a)=>n[a]===i)}function te(n){return Object.keys(n?.variants?.sizes??{})}function ne(n,r){let i=n?.variants?.sizes?.[r];if(!i){let a=te(n);throw e.notFound(a.length>0?`No image size named "${r}"; this configuration declares ${a.join(", ")}`:`No image size named "${r}"; this configuration declares none`)}return i}function bt(n,r,i){let a=ne(n,r),o={...a.width===void 0?{}:{width:a.width},...a.height===void 0?{}:{height:a.height},...a.fit===void 0?{}:{fit:a.fit}};if(n?.quality!==void 0)o.quality=n.quality;if(n?.stripMetadata!==!1)o.stripMetadata=!0;if(n?.focalPoint!==!1&&i.focalPoint)o.position=i.focalPoint;if(n?.crop!==!1&&i.crop)o.crop=i.crop;let f=n?.convert;if(f&&!(f.keep??[]).includes(i.mimeType))o.format=f.to;return o}function ce(n,r){let{width:i,height:a}=r;if(i===null||a===null||i<=0||a<=0)return!1;if(n.crop){let w=n.crop;if(!(w.x<=0&&w.y<=0&&w.width>=i&&w.height>=a))return!1}let o=n.fit??"inside",{width:f,height:p}=n;if(f===void 0&&p===void 0)return!0;if(o==="inside")return(f===void 0||f>=i)&&(p===void 0||p>=a);if(o==="outside")return Math.max(f===void 0?0:f/i,p===void 0?0:p/a)>=1;return!1}function X(n,r){let i=n?.convert;if(!i||(i.keep??[]).includes(r))return r;return`image/${i.to}`}function Be(n,r,i){let a=n.lastIndexOf("/"),o=n.lastIndexOf(".");return`${o>a?n.slice(0,o):n}/${r}.${Me(i)}`}function ue(n,r){let i=ne(n,r),a=new URLSearchParams;if(i.width!==void 0)a.set("w",String(i.width));if(i.height!==void 0)a.set("h",String(i.height));if(i.fit!==void 0)a.set("fit",i.fit);if(n?.quality!==void 0)a.set("q",String(n.quality));return a.toString()}async function Oe(n,r,i,a){if(!n||!n.supports(a.mimeType))return null;return n.transform(r,i,{format:a.mimeType.split("/")[1]??"jpeg",contentType:a.mimeType,width:a.width??0,height:a.height??0})}function je(n,r){let i=n.filename.replace(/\.[^.]*$/,"");return`${ye(i)||"file"}.${Me(r)}`}function he(n,r){if(!n)return null;return`${x(n)}/${encodeURIComponent(r.id)}/${je(r,r.mimeType)}`}function Y(n,r,i={}){let a=n.uploads?.images,o=n.uploads?.publicPath,f=i.variant,p=he(o,r)??`${ke(n)}/${encodeURIComponent(r.id)}/original`;if(f===void 0||f==="original")return p;ne(a,f);let w=a?.processor;if(!w||!w.supports(r.mimeType))return`${p}?${ue(a,f)}`;let C=X(a,r.mimeType);if(C===r.mimeType&&ce(bt(a,f,{mimeType:r.mimeType,crop:r.crop??null,focalPoint:r.focalPoint??null}),{width:r.width??null,height:r.height??null}))return p;if(o)return`${x(o)}/${encodeURIComponent(r.id)}/${encodeURIComponent(f)}/${je(r,C)}`;return`${ke(n)}/${encodeURIComponent(r.id)}/${encodeURIComponent(f)}`}function ke(n){return`${n.basePath==="/"?"":x(n.basePath)}/media`}function ze(n,r,i){let a=Ne(i);if(!a)return null;let o=ne(n,r),{width:f,height:p}=o,w=o.fit??"inside";if(f===void 0&&p===void 0)return a;if((w==="cover"||w==="contain")&&f!==void 0&&p!==void 0){if(w==="contain")return{width:f,height:p};let D=Math.max(f/a.width,p/a.height);return D>1?{width:Math.max(1,Math.round(f/D)),height:Math.max(1,Math.round(p/D))}:{width:f,height:p}}let C=w==="outside"?Math.min(1,Math.max(f===void 0?0:f/a.width,p===void 0?0:p/a.height)):Math.min(f===void 0?1/0:f/a.width,p===void 0?1/0:p/a.height,1);return{width:Math.max(1,Math.round(a.width*C)),height:Math.max(1,Math.round(a.height*C))}}function Fe(n,r,i={}){let a=Je(n,r,i);return a.length<2?null:a.map((o)=>`${o.url} ${o.width}w`).join(", ")}function Je(n,r,i){let a=n.uploads?.images,o=a?.variants?.sizes??{};if(!_t(r.mimeType)||!r.width||!r.height)return[];let f=i.sizes??Object.entries(o).filter(([,N])=>Pt(N)).map(([N])=>N),p=r.crop!==null&&r.crop!==void 0,w=[],C=new Set,D=Ne(r);if(!p&&D)w.push({url:Y(n,r),...D}),C.add(D.width);for(let N of f){let L=ze(a,N,r);if(!L||C.has(L.width))continue;C.add(L.width),w.push({url:Y(n,r,{variant:N}),...L})}return w.sort((N,L)=>N.width-L.width)}function we(n,r,i={}){let a=n.uploads?.images,o=Tt(n,r.alt,i.locale),f=i.sizes??null;if(i.variant!==void 0&&i.variant!=="original"){let D=ze(a,i.variant,r);return{src:Y(n,r,{variant:i.variant}),width:D?.width??null,height:D?.height??null,srcset:null,sizes:null,alt:o}}let p=Je(n,r,i.srcset===void 0?{}:{sizes:i.srcset}),C=r.crop!==null&&r.crop!==void 0?p.at(-1):void 0;return{src:C?.url??Y(n,r),width:C?.width??r.width??null,height:C?.height??r.height??null,srcset:p.length<2?null:p.map((D)=>`${D.url} ${D.width}w`).join(", "),sizes:p.length<2?null:f,alt:o}}function Tt(n,r,i){if(!r)return null;let a=(i===void 0?void 0:r[i])??r[n.i18n.defaultLocale];return typeof a==="string"&&a.trim()!==""?a:null}function Ne(n){if(n.crop)return{width:n.crop.width,height:n.crop.height};if(!n.width||!n.height)return null;return{width:n.width,height:n.height}}function Pt(n){let r=n.fit??"inside";if(r==="inside"||r==="outside")return!0;return n.width===void 0||n.height===void 0}function _t(n){return n.startsWith("image/")&&n!=="image/svg+xml"}var qe=["crop","variants"];function F(n,r,i){let a=u(n.metadata),{crop:o,variants:f,...p}=a,w=String(n.storage_key);return{id:String(n.id),filename:String(n.filename),mimeType:String(n.mime_type),size:Number(n.size??0),width:Le(n.width),height:Le(n.height),storageKey:w,checksum:ve(n.checksum),alt:Ot(n.alt),focalPoint:Dt(n.focal_x,n.focal_y),crop:Rt(o),status:$t(n.status),orphanedAt:l(n.orphaned_at),purgeAfter:l(n.purge_after),purgeError:ve(n.purge_error),metadata:p,variants:Array.isArray(f)?f.filter((C)=>typeof C==="string"):[],createdBy:ve(n.created_by),createdAt:l(n.created_at),updatedAt:l(n.updated_at),url:he(i,{id:String(n.id),filename:String(n.filename),mimeType:String(n.mime_type)})??r.url(w)}}function de(n){return JSON.parse(JSON.stringify(n))}function $t(n){return n==="orphaned"||n==="purging"?n:"active"}function Dt(n,r){if(n===null||n===void 0)return null;if(r===null||r===void 0)return null;return{x:Number(n),y:Number(r)}}function Rt(n){if(typeof n!=="object"||n===null||Array.isArray(n))return null;let r=n,i=["x","y","width","height"].map((a)=>Number(r[a]));if(i.some((a)=>Number.isNaN(a)))return null;return{x:i[0],y:i[1],width:i[2],height:i[3]}}function Ot(n){let r=u(n),i={};for(let[a,o]of Object.entries(r))if(typeof o==="string")i[a]=o;return i}function Le(n){return n===null||n===void 0?null:Number(n)}function ve(n){return n===null||n===void 0?null:String(n)}var kt=86400000,Et=100;async function We(n,r,i){if(n.config.uploads?.retention?.purgeAfter===!1)return[];let a=await n.database();return a.transaction((o)=>a.query(o,{table:T,where:s(t("status","orphaned"),le("purge_after",!0),M("purge_after",r)),orderBy:[m("purge_after","asc"),m("id","asc")],limit:i}))}async function Xe(n,r={}){let i={examined:0,purged:0,reclaimed:0,failed:0};if(!n.config.uploads)return i;let a=r.now??new Date,o=await We(n,a,r.limit??Et);for(let f of o){i.examined+=1;try{let p=await He(n,f,a);if(p==="purged")i.purged+=1;if(p==="reclaimed")i.reclaimed+=1}catch{i.failed+=1}}return i}async function He(n,r,i){let a=await n.storage(),o=F(r,a,n.config.uploads?.publicPath),f=await be(n,async(p,w)=>{if((await w.find(U,t("media_id",o.id))).length>0){if(await w.update(T,s(t("id",o.id),t("status","orphaned")),{status:"active",orphaned_at:null,purge_after:null,purge_error:null,updated_at:i})===0)return"taken";return await Ke(n,p,"media.reclaimed",{...o,status:"active",orphanedAt:null,purgeAfter:null}),"reclaimed"}return await w.update(T,s(t("id",o.id),t("status","orphaned")),{status:"purging",updated_at:i})===1?"claimed":"taken"});if(n.deliver(),f!=="claimed")return f;try{return await a.delete(Ae(o,n.config.uploads)),await be(n,async(p,w)=>{await w.delete(U,t("media_id",o.id)),await w.delete(T,t("id",o.id)),await Ke(n,p,"media.purged",o,{collected:!0})}),n.deliver(),"purged"}catch(p){throw await jt(n,o,p,i),p}}function Zt(n){return{name:"media-gc",failureType:"media.purge",failurePayload:(r)=>({mediaId:String(r.id),storageKey:String(r.storage_key),filename:String(r.filename)}),due:(r,i,a)=>We(n,i,a),run:async(r,i)=>{await He(n,i,new Date)}}}function Ae(n,r){let i=X(r?.images,n.mimeType),a=new Set([...n.variants,...te(r?.images)]);return[n.storageKey,...[...a].map((o)=>Be(n.storageKey,o,i))]}async function jt(n,r,i,a){let o=i instanceof Error?i.message:String(i);await be(n,async(f,p)=>{await p.update(T,t("id",r.id),{status:"orphaned",purge_after:new Date(a.getTime()+kt),purge_error:o.slice(0,1000),updated_at:a})})}async function Ke(n,r,i,a,o={}){await n.emit(r,[{type:i,data:{media:JSON.parse(JSON.stringify(a)),...o},previous:null}],{actor:null,collection:"media",documentId:a.id})}async function be(n,r){let i=await n.database();return i.transaction((a)=>r(a,d(i,a)))}async function xe(n){if(n instanceof Uint8Array)return n;if(n instanceof ArrayBuffer)return new Uint8Array(n);if(typeof Blob<"u"&&n instanceof Blob)return new Uint8Array(await n.arrayBuffer());let r=[],i=n.getReader();for(;;){let{done:a,value:o}=await i.read();if(a)break;if(o)r.push(o)}return Z(r)}function Z(n){if(n.length===1)return n[0];let r=n.reduce((o,f)=>o+f.byteLength,0),i=new Uint8Array(r),a=0;for(let o of n)i.set(o,a),a+=o.byteLength;return i}function wt(n){return new ReadableStream({start(r){r.enqueue(n),r.close()}})}function Ve(n){let r="";for(let i of n)r+=i.toString(16).padStart(2,"0");return r}function Zn(n){let r="";for(let i of n)r+=String.fromCharCode(i);return btoa(r)}async function vt(n){let r=typeof n==="string"?new TextEncoder().encode(n):n,i=await crypto.subtle.digest("SHA-256",r);return new Uint8Array(i)}function Ge(n,r){switch(r.toLowerCase()){case"image/jpeg":return zt(n);case"image/png":return Jt(n);case"image/webp":return Nt(n);default:return n}}function zt(n){if(n.length<4||n[0]!==255||n[1]!==216)return n;let r=[n.subarray(0,2)],i=2;while(i+4<=n.length){if(n[i]!==255)break;let a=n[i+1]??0;if(a===216||a===1||a>=208&&a<=215){r.push(n.subarray(i,i+2)),i+=2;continue}if(a===218){r.push(n.subarray(i)),i=n.length;break}let o=(n[i+2]??0)<<8|(n[i+3]??0);if(o<2||i+2+o>n.length)break;if(!Ft(a))r.push(n.subarray(i,i+2+o));i+=2+o}if(i<n.length)r.push(n.subarray(i));return Z(r)}function Ft(n){if(n===254)return!0;if(n===224)return!1;if(n===226)return!1;if(n===238)return!1;return n>=224&&n<=239}function Jt(n){let r=[137,80,78,71,13,10,26,10];if(n.length<8||!r.every((f,p)=>n[p]===f))return n;let i=new Set(["tEXt","zTXt","iTXt","eXIf","tIME","dSIG"]),a=[n.subarray(0,8)],o=8;while(o+8<=n.length){let f=Bt(n,o),p=fe(n,o+4,4),w=12+f;if(w<12||o+w>n.length)break;if(!i.has(p))a.push(n.subarray(o,o+w));if(o+=w,p==="IEND")break}return Z(a)}function Nt(n){if(n.length<12||fe(n,0,4)!=="RIFF"||fe(n,8,4)!=="WEBP")return n;let r=new Set(["EXIF","XMP "]),i=[],a=12,o=!1;while(a+8<=n.length){let w=fe(n,a,4),C=Lt(n,a+4),D=8+C+C%2;if(a+D>n.length)break;if(r.has(w))o=!0;else i.push(n.subarray(a,a+D));a+=D}if(!o)return n;let f=Z(i),p=new Uint8Array(12);return p.set(n.subarray(0,12)),Vt(p,4,f.byteLength+4),Z([p,f])}function Bt(n,r){return(n[r]??0)*16777216+((n[r+1]??0)<<16|(n[r+2]??0)<<8|(n[r+3]??0))}function Lt(n,r){return(n[r]??0)+((n[r+1]??0)<<8)+((n[r+2]??0)<<16)+(n[r+3]??0)*16777216}function Vt(n,r,i){n[r]=i&255,n[r+1]=i>>>8&255,n[r+2]=i>>>16&255,n[r+3]=i>>>24&255}function fe(n,r,i){let a="";for(let o=0;o<i;o+=1)a+=String.fromCharCode(n[r+o]??0);return a}async function An(n){let r=n.uploads.limits,i=n.uploads.images,a=Ee(n.bytes),o=Wt(n.contentType,a);if(Kt(o,r?.accept),r?.maxFileSize){let N=se(r.maxFileSize,"uploads.limits.maxFileSize");if(n.bytes.byteLength>N)throw new e(`"${n.filename}" is ${Gt(n.bytes.byteLength)}, over the ${r.maxFileSize} limit`,{status:413,code:"file_too_large"})}let f=r?.maxImageDimensions;if(a&&f){if(a.width>f.width||a.height>f.height)throw new e(`"${n.filename}" is ${a.width}x${a.height}, over the ${f.width}x${f.height} limit`,{status:422,code:"image_too_large"})}let p=n.bytes,w=a,C=o,D=null;if(a&&i){let N=await qt(p,a,i,C);p=N.data,w=N.info,C=N.contentType,D=N.error}return{data:p,contentType:C,filename:Ue(n.filename),info:w,checksum:Ve(await vt(p)),extension:Me(C),processingError:D}}async function qt(n,r,i,a){let o=i.processor,f={},p=i.convert,w=p!==void 0&&a===`image/${p.to}`;if(p&&!(p.keep??[]).includes(a)&&r.format!=="svg"&&!w)f.format=p.to;let C=i.maxDimensions;if(C&&(r.width>C.width||r.height>C.height))f.width=C.width,f.height=C.height,f.fit="inside";if(i.quality!==void 0)f.quality=i.quality;if((f.format!==void 0||f.width!==void 0)&&o&&o.supports(a)){if(i.stripMetadata!==!1)f.stripMetadata=!0;try{let q=await o.transform(n,f,r);return{data:q.data,contentType:q.contentType,info:{format:r.format,contentType:q.contentType,width:q.width,height:q.height},error:null}}catch(q){if(Ce(q))throw q;return{data:i.stripMetadata!==!1?Ge(n,a):n,info:r,contentType:a,error:Se(q)}}}return{data:i.stripMetadata===!0||w&&o!==void 0&&i.stripMetadata!==!1?Ge(n,a):n,info:r,contentType:a,error:null}}function Ce(n){return n instanceof e&&n.code==="image_processor_missing"}function Se(n){if(n instanceof Error){let r=n.code;return typeof r==="number"||typeof r==="string"&&r!==""?`${n.message} (${String(r)})`:n.message}return String(n)}function Kt(n,r){if(!r||r.length===0)return;if(r.some((i)=>Ie(n,i)))return;throw new e(`"${n}" is not an accepted file type; uploads.limits.accept allows ${r.join(", ")}`,{status:415,code:"unsupported_media_type"})}function Ie(n,r){let i=n.toLowerCase().split(";")[0]?.trim()??"",a=r.toLowerCase().trim();if(a==="*"||a==="*/*")return!0;if(a.endsWith("/*"))return i.startsWith(a.slice(0,-1));return i===a}function Wt(n,r){if(r)return r.contentType;let i=n.split(";")[0]?.trim().toLowerCase();return i&&i.includes("/")?i:"application/octet-stream"}function Ue(n){let i=(n.split(/[/\\]/).pop()??"file").replaceAll("\x00","").replace(/[\u0000-\u001f\u007f"]/g,"").trim();return i.length>0?i.slice(0,255):"file"}function Gt(n){if(n<1024)return`${n} B`;if(n<1048576)return`${(n/1024).toFixed(1)} kB`;return`${(n/1048576).toFixed(1)} MB`}var Xt=25,Qt=3600000,Ht=200,Te=[m("created_at","desc"),m("id","desc")];function Yt(n){let{config:r}=n,i,a=new Map,o=r.uploads?.publicPath,f=()=>{if(!r.uploads)throw new e("This CMS has no uploads configured; add an `uploads` section with a storage adapter.",{status:501,code:"uploads_not_configured"});return r.uploads},p=()=>(i??=Promise.resolve(typeof f().storage==="function"?f().storage():f().storage),i);async function w(c){let g=await n.database();return g.transaction((y)=>c(y,d(g,y)))}let C={config:r,database:n.database,storage:p,emit:n.emit,deliver:n.deliver},D=(c,g)=>{if(!r.rbac)return;if(E(c,`media:${g}`))return;throw c?e.forbidden(`Not allowed to ${g} media; the "media:${g}" permission is required`):e.unauthorized(`Not allowed to ${g} media`)},N=async(c,g,y,v,h={})=>{await n.emit(c,[{type:g,data:{media:de(y),...h},previous:null}],{actor:v,collection:"media",documentId:y.id})},L=async(c,g)=>{let y=await c.findOne(T,t("id",g));if(!y)throw e.notFound(`No media with id "${g}"`);return y};async function q(c){let g=f(),y=c.actor??null;D(y,"create");let v=await xe(c.file),h=await An({bytes:v,filename:c.filename??sn(c.file)??"file",contentType:c.contentType??cn(c.file)??"application/octet-stream",uploads:g}),I=b("med"),_=await p(),k=tn(_,I,h.filename,h.extension);await _.put(k,h.data,{contentType:h.contentType,size:h.data.byteLength,cacheControl:"public, max-age=31536000, immutable"});let A=new Date,P;try{P=await w(async(j,z)=>{let O=await z.insert(T,{id:I,filename:h.filename,mime_type:h.contentType,size:h.data.byteLength,width:h.info?.width??null,height:h.info?.height??null,storage_key:k,checksum:h.checksum,alt:rn(c.alt,c.locale??r.i18n.defaultLocale),focal_x:null,focal_y:null,status:"active",orphaned_at:null,purge_after:null,purge_error:null,metadata:{...c.metadata??{}},created_by:y?.id??null,created_at:A,updated_at:A}),K=F(O,_,o);if(await N(j,"media.uploaded",K,y),h.processingError!==null)await N(j,"media.processing.failed",K,y,{variant:null,error:h.processingError});return K})}catch(j){throw await _.delete([k]).catch(()=>{return}),j}if(n.deliver(),g.images?.variants?.mode==="pregenerate")return Ze(P,y);return P}async function Ze(c,g){for(let y of te(f().images))try{let v=await $e({id:c.id,variant:y});if(v)await un(v.body)}catch(v){await w((h)=>n.emit(h,[{type:"media.processing.failed",data:{media:de(c),variant:y,error:v instanceof Error?v.message:String(v)},previous:null}],{actor:g,collection:"media",documentId:c.id})),n.deliver()}return await _e(c.id)??c}async function et(c={}){let g=nn(c.limit),y=[];if(c.status)y.push(t("status",c.status));if(c.search)y.push(ae("filename",`%${c.search}%`,!0));let v=c.mimeType?.includes("*")===!0?c.mimeType:null;if(c.mimeType&&!v)y.push(t("mime_type",c.mimeType));let h=y.length>0?s(...y):void 0,I=await n.database(),_=await I.transaction((O)=>I.query(O,{table:T,...c.cursor?{where:s(...h?[h]:[],J(c.cursor,Te))}:h===void 0?{}:{where:h},orderBy:Te,limit:g+1})),k=v?_.filter((O)=>Ie(String(O.mime_type),v)):_,A=k.length>g,P=k.slice(0,g),j=await p(),z=P.at(-1);return{docs:P.map((O)=>F(O,j,o)),limit:g,hasNextPage:A,cursor:z?V(z,Te):null}}async function _e(c){let g=await w((y,v)=>v.findOne(T,t("id",c)));return g?F(g,await p(),o):null}async function me(c){let g=[...new Set(c)].filter((h)=>h.length>0),y=new Map;if(g.length===0)return y;let v=await p();for(let h=0;h<g.length;h+=90){let I=g.slice(h,h+90),_=await w((k,A)=>A.find(T,S("id",I)));for(let k of _){let A=F(k,v,o);y.set(A.id,A)}}return y}async function tt(c,g={}){let y=[...Object.values(r.collections),...Object.values(r.globals)].find((A)=>A.name===c||A.slug===c);if(!y)throw e.notFound(`No collection or global called "${c}"`);let v=y.name,h=[];if(g.ids===void 0)h.push(...await w((A,P)=>P.find(U,t("collection",v))));else{let A=[...new Set(g.ids)];for(let P=0;P<A.length;P+=90){let j=A.slice(P,P+90);h.push(...await w((z,O)=>O.find(U,s(t("collection",v),S("document_id",j)))))}}let I=await me(h.map((A)=>String(A.media_id))),_=new Map,k=[...h].sort((A,P)=>String(A.document_id).localeCompare(String(P.document_id))||String(A.id).localeCompare(String(P.id)));for(let A of k){let P=I.get(String(A.media_id));if(!P)continue;let j=String(A.document_id),z=String(A.locale??""),O=_.get(j)??[];O.push({media:P,field:String(A.field),locale:z===""?null:z}),_.set(j,O)}return _}async function nt(c,g={}){let y=r.uploads?Qe(c??null):[],v=y.length>0?await me(y):new Map;return Q(c,{format:g.format??"html",mediaImage:(h)=>{let I=v.get(h);if(!I)return null;return we(r,I,{...g.locale===void 0?{}:{locale:g.locale},...g.sizes===void 0?{}:{sizes:g.sizes}})},mediaUrl:(h)=>`${r.basePath}/media/${encodeURIComponent(h)}/original`,images:{loading:g.loading??"lazy",decoding:"async"}})}async function rt(c){return(await w((y,v)=>v.find(U,t("media_id",c)))).map((y)=>({mediaId:String(y.media_id),collection:String(y.collection),documentId:String(y.document_id),field:String(y.field),locale:String(y.locale??""),createdAt:l(y.created_at)}))}async function at(c){let g=f(),y=c.actor??null;D(y,"update"),en(g,c);let v=await p(),{media:h,stale:I}=await w(async(_,k)=>{let A=await L(k,c.id),P=F(A,v,o),z=c.crop!==void 0&&!Ye(c.crop,P.crop)||c.focalPoint!==void 0&&!Ye(c.focalPoint,P.focalPoint)?P.variants:[],O={updated_at:new Date};if(c.filename!==void 0)O.filename=Ue(c.filename);if(c.alt!==void 0)O.alt=an(P.alt,c.alt,c.locale??r.i18n.defaultLocale);if(c.focalPoint!==void 0)O.focal_x=c.focalPoint?.x??null,O.focal_y=c.focalPoint?.y??null;let K={...u(A.metadata),...c.metadata??{}};if(c.crop===null)delete K.crop;else if(c.crop!==void 0)K.crop={...c.crop};if(z.length>0)delete K.variants;O.metadata=K,await k.update(T,t("id",c.id),O);let re=F({...A,...O},v,o);await N(_,"media.updated",re,y);let lt=X(g.images,re.mimeType);return{media:re,stale:z.map((ft)=>Be(re.storageKey,ft,lt))}});if(I.length>0)await v.delete(I).catch(()=>{return});return n.deliver(),h}async function ot(c){let g=c.actor??null;D(g,"update");let y=await w(async(v,h)=>{let I=await L(h,c.id);if(String(I.status)==="active")throw e.conflict(`"${c.id}" is in use; only an unused file has a deadline to clear`);let _={purge_after:null,purge_error:null,updated_at:new Date};await h.update(T,t("id",c.id),_);let k=F({...I,..._},await p(),o);return await N(v,"media.updated",k,g,{kept:!0}),k});return n.deliver(),y}async function st(c){let g=c.actor??null;D(g,"delete");let y=await p(),{media:v,keys:h}=await w(async(I,_)=>{let k=await L(_,c.id),A=F(k,y,o);if(c.force!==!0){let P=await _.find(U,t("media_id",c.id));if(P.length>0){let j=P.slice(0,3).map((z)=>`${String(z.collection)}/${String(z.document_id)}`).join(", ");throw e.conflict(`"${A.filename}" is used by ${P.length} document${P.length===1?"":"s"} (${j}); pass force to delete it anyway`)}}return await _.delete(U,t("media_id",c.id)),await _.delete(T,t("id",c.id)),await N(I,"media.purged",A,g),{media:A,keys:Ae(A,r.uploads)}});return await y.delete(h),n.deliver(),v}async function $e(c){let g=f(),y=await p(),v=await w((z,O)=>O.findOne(T,t("id",c.id)));if(!v)return null;let h=F(v,y,o);if(!c.variant)return ee(y,h,null);let I=g.images?.processor;if(!I||!I.supports(h.mimeType)){let z=ue(g.images,c.variant);return ee(y,h,c.variant,z)}let _=bt(g.images,c.variant,h),k=X(g.images,h.mimeType);if(k===h.mimeType&&ce(_,h))return ee(y,h,c.variant);let A=Be(h.storageKey,c.variant,k);if(c.refresh!==!0){let z=await y.get(A);if(z){let O=await y.head?.(A);return{media:h,variant:c.variant,key:A,contentType:O?.contentType??k,width:null,height:null,size:O?.size??null,body:z,url:await Pe(y,A),cached:!0,processingError:null}}}let P=await y.get(h.storageKey);if(!P)return null;let j;try{j=await Oe(I,await xe(P),_,h)}catch(z){if(Ce(z))throw z;let O=Se(z);await ct(h,c.variant,O);let K=await ee(y,h,c.variant);return K&&{...K,processingError:O}}if(!j)return ee(y,h,c.variant);return await y.put(A,j.data,{contentType:j.contentType,size:j.data.byteLength,cacheControl:"public, max-age=31536000, immutable"}),await ut(h.id,c.variant),{media:h,variant:c.variant,key:A,contentType:j.contentType,width:j.width,height:j.height,size:j.data.byteLength,body:wt(j.data),url:await Pe(y,A),cached:!1,processingError:null}}async function ct(c,g,y){let v=`${c.id}|${g}`,h=Date.now(),I=a.get(v);if(I!==void 0&&h-I<Qt)return;if(a.size>=1000)a.clear();a.set(v,h);try{await w((_)=>n.emit(_,[{type:"media.processing.failed",data:{media:de(c),variant:g,error:y},previous:null}],{actor:null,collection:"media",documentId:c.id})),n.deliver()}catch{}}async function ee(c,g,y,v=""){let h=await c.get(g.storageKey);if(!h)return null;let I=await Pe(c,g.storageKey);return{media:g,variant:y,key:g.storageKey,contentType:g.mimeType,width:g.width,height:g.height,size:g.size,body:h,url:v?`${I}?${v}`:I,cached:y===null,processingError:null}}async function ut(c,g){await w(async(y,v)=>{let h=await v.findOne(T,t("id",c));if(!h)return;let I=u(h.metadata),_=Array.isArray(I.variants)?I.variants.filter((k)=>typeof k==="string"):[];if(_.includes(g))return;await v.update(T,t("id",c),{metadata:{...I,variants:[..._,g].sort()}})})}function dt(c){return Xe(C,c)}return{upload:q,list:et,get:_e,getMany:me,update:at,delete:st,keep:ot,usages:rt,variant:$e,collect:dt,storage:p,forDocuments:tt,url:(c,g)=>Y(r,c,g),srcset:(c,g)=>Fe(r,c,g),image:(c,g)=>we(r,c,g),renderRichText:nt}}function en(n,r){for(let i of Object.keys(r.metadata??{}))if(qe.includes(i))throw e.validation(`"${i}" is reserved inside media metadata; it is maintained by the engine`);if(r.focalPoint!==void 0&&n.images?.focalPoint!==!0)throw e.validation("Focal points are off; set uploads.images.focalPoint to true");if(r.crop!==void 0&&n.images?.crop!==!0)throw e.validation("Cropping is off; set uploads.images.crop to true");if(r.focalPoint&&!on(r.focalPoint))throw e.validation("A focal point is relative: x and y are between 0 and 1")}function tn(n,r,i,a){let f=(n.prefix?.({id:r,filename:i})??String(new Date().getUTCFullYear())).replace(/^\/+|\/+$/g,"");return f?`${f}/${r}.${a}`:`${r}.${a}`}async function Pe(n,r){return n.signedUrl?n.signedUrl(r):n.url(r)}function nn(n){if(n===void 0)return Xt;if(!Number.isInteger(n)||n<1)throw new e(`limit must be a positive integer, received ${n}`,{status:400,code:"invalid_pagination"});return Math.min(n,Ht)}function rn(n,r){if(n===void 0)return{};return typeof n==="string"?{[r]:n}:{...n}}function an(n,r,i){return typeof r==="string"?{...n,[i]:r}:{...r}}function on(n){return n.x>=0&&n.x<=1&&n.y>=0&&n.y<=1}function sn(n){let r=n.name;return typeof r==="string"?r:void 0}function cn(n){let r=n.type;return typeof r==="string"&&r.length>0?r:void 0}function Ye(n,r){return JSON.stringify(n??null)===JSON.stringify(r??null)}async function un(n){let r=n.getReader();for(;;){let{done:i}=await r.read();if(i)break}}
-export{V,J,xo,Ee,Me,bt,Be,F,Zt,xe,wt,Ve,Zn,vt,Ge,An,Yt};
+import{s,R,t,it,H,M,S,ae,le,m}from"./index-q6jkbsjp.js";import{E,l,u}from"./index-pkxgzw6e.js";import{ye}from"./index-e3yknwyr.js";import{T,U,Qe}from"./index-n09v6gx3.js";import{d}from"./index-9g2n7xa6.js";import{Q}from"./index-twqpdtfh.js";import{se}from"./index-rw0hze6x.js";import{x}from"./index-2ddk43me.js";import{b}from"./index-qgtvymh2.js";import{e}from"./index-x72d1hzh.js";function V(n,r){let i=r.map((a)=>{let o=pt(n,a.path);return{path:a.path,value:o instanceof Date?o.toISOString():gt(o),date:o instanceof Date}});return ht(JSON.stringify(i))}function J(n,r){let i=mt(n);if(i.length!==r.length)throw new e("This cursor does not match the requested sort order.",{status:400,code:"invalid_cursor"});let a=[];for(let o=0;o<r.length;o+=1){let f=[];for(let C=0;C<o;C+=1){let D=i[C];f.push(t(D.path,pe(D)))}let p=i[o],w=r[o].direction;f.push(w==="desc"?H(p.path,pe(p)):it(p.path,pe(p))),a.push(s(...f))}return R(...a)}function mt(n){try{let r=JSON.parse(yt(n));if(!Array.isArray(r))throw Error("not a cursor");return r}catch{throw new e("This cursor is not readable.",{status:400,code:"invalid_cursor"})}}function pe(n){return n.date&&typeof n.value==="string"?new Date(n.value):n.value}function pt(n,r){if(r in n)return n[r];let i=r.split("."),a=n.data??n;for(let o of i){if(typeof a!=="object"||a===null)return;a=a[o]}return a}function gt(n){if(n===void 0||n===null)return null;if(typeof n==="object")return null;return n}function ht(n){let r=new TextEncoder().encode(n),i="";for(let a of r)i+=String.fromCharCode(a);return btoa(i).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function yt(n){let r=n.replaceAll("-","+").replaceAll("_","/"),i=atob(r.padEnd(Math.ceil(r.length/4)*4,"=")),a=Uint8Array.from(i,(o)=>o.charCodeAt(0));return new TextDecoder().decode(a)}var Re={jpeg:"image/jpeg",png:"image/png",gif:"image/gif",webp:"image/webp",avif:"image/avif",svg:"image/svg+xml",tiff:"image/tiff"};function So(n){return Re[n]}function Ee(n){return bt(n)??Mt(n)??At(n)??Ct(n)??St(n)??It(n)}function Me(n){let i={"image/jpeg":"jpg","image/png":"png","image/gif":"gif","image/webp":"webp","image/avif":"avif","image/svg+xml":"svg","image/tiff":"tiff","video/mp4":"mp4","video/webm":"webm","audio/mpeg":"mp3","application/pdf":"pdf","application/json":"json","text/plain":"txt","text/csv":"csv"}[n.toLowerCase()];if(i)return i;let a=n.split("/")[1]?.split(";")[0]?.trim();return a&&/^[a-z0-9.+-]+$/i.test(a)?a:"bin"}function bt(n){let r=[137,80,78,71,13,10,26,10];if(n.length<24||!Ut(n,r))return null;return W("png",ie(n,16),ie(n,20))}function Mt(n){if(n.length<10||G(n,0,3)!=="GIF")return null;return W("gif",oe(n,6),oe(n,8))}function At(n){if(n.length<30||G(n,0,4)!=="RIFF"||G(n,8,4)!=="WEBP")return null;let r=G(n,12,4);if(r==="VP8X")return W("webp",De(n,24)+1,De(n,27)+1);if(r==="VP8 "){if(n[23]!==157||n[24]!==1||n[25]!==42)return null;return W("webp",oe(n,26)&16383,oe(n,28)&16383)}if(r==="VP8L"){if(n[20]!==47)return null;let i=B(n,21),a=B(n,22),o=B(n,23),f=B(n,24);return W("webp",((a&63)<<8|i)+1,((f&15)<<10|o<<2|(a&192)>>6)+1)}return null}function Ct(n){if(n.length<4||n[0]!==255||n[1]!==216)return null;let r=2;while(r+9<n.length){if(n[r]!==255){r+=1;continue}let i=B(n,r+1);if(i===255||i===1||i>=208&&i<=217){r+=2;continue}if(i>=192&&i<=195||i>=197&&i<=199||i>=201&&i<=203||i>=205&&i<=207)return W("jpeg",ge(n,r+7),ge(n,r+5));let o=ge(n,r+2);if(o<2)return null;r+=2+o}return null}function St(n){if(n.length<16||G(n,4,4)!=="ftyp")return null;let r=G(n,8,4),i=r==="avif"||r==="avis";if(!i&&!(r==="heic"||r==="heix"||r==="mif1"))return null;let o=Math.min(n.length-16,65536);for(let f=16;f<o;f+=1){if(G(n,f,4)!=="ispe")continue;let p=ie(n,f+8),w=ie(n,f+12);if(p>0&&w>0&&p<1e5&&w<1e5)return W(i?"avif":"avif",p,w)}return null}function It(n){let r=new TextDecoder().decode(n.subarray(0,2048));if(!/<svg[\s>]/i.test(r))return null;let i=(f)=>{let p=new RegExp(`\\b${f}\\s*=\\s*["']([\\d.]+)`,"i").exec(r);return p?Math.round(Number(p[1])):0},a=i("width"),o=i("height");if(a===0||o===0){let f=/\bviewBox\s*=\s*["']\s*[\d.-]+\s+[\d.-]+\s+([\d.]+)\s+([\d.]+)/i.exec(r);if(f)a=Math.round(Number(f[1])),o=Math.round(Number(f[2]))}return W("svg",a,o)}function W(n,r,i){return{format:n,contentType:Re[n],width:r,height:i}}function B(n,r){return n[r]??0}function ge(n,r){return B(n,r)<<8|B(n,r+1)}function ie(n,r){return B(n,r)*16777216+(B(n,r+1)<<16|B(n,r+2)<<8|B(n,r+3))}function oe(n,r){return B(n,r)|B(n,r+1)<<8}function De(n,r){return B(n,r)|B(n,r+1)<<8|B(n,r+2)<<16}function G(n,r,i){let a="";for(let o=0;o<i;o+=1)a+=String.fromCharCode(B(n,r+o));return a}function Ut(n,r){return r.every((i,a)=>n[a]===i)}function te(n){return Object.keys(n?.variants?.sizes??{})}function ne(n,r){let i=n?.variants?.sizes?.[r];if(!i){let a=te(n);throw e.notFound(a.length>0?`No image size named "${r}"; this configuration declares ${a.join(", ")}`:`No image size named "${r}"; this configuration declares none`)}return i}function wt(n,r,i){let a=ne(n,r),o={...a.width===void 0?{}:{width:a.width},...a.height===void 0?{}:{height:a.height},...a.fit===void 0?{}:{fit:a.fit}};if(n?.quality!==void 0)o.quality=n.quality;if(n?.stripMetadata!==!1)o.stripMetadata=!0;if(n?.focalPoint!==!1&&i.focalPoint)o.position=i.focalPoint;if(n?.crop!==!1&&i.crop)o.crop=i.crop;let f=n?.convert;if(f&&!(f.keep??[]).includes(i.mimeType))o.format=f.to;return o}function ce(n,r){let{width:i,height:a}=r;if(i===null||a===null||i<=0||a<=0)return!1;if(n.crop){let w=n.crop;if(!(w.x<=0&&w.y<=0&&w.width>=i&&w.height>=a))return!1}let o=n.fit??"inside",{width:f,height:p}=n;if(f===void 0&&p===void 0)return!0;if(o==="inside")return(f===void 0||f>=i)&&(p===void 0||p>=a);if(o==="outside")return Math.max(f===void 0?0:f/i,p===void 0?0:p/a)>=1;return!1}function X(n,r){let i=n?.convert;if(!i||(i.keep??[]).includes(r))return r;return`image/${i.to}`}function Be(n,r,i){let a=n.lastIndexOf("/"),o=n.lastIndexOf(".");return`${o>a?n.slice(0,o):n}/${r}.${Me(i)}`}function ue(n,r){let i=ne(n,r),a=new URLSearchParams;if(i.width!==void 0)a.set("w",String(i.width));if(i.height!==void 0)a.set("h",String(i.height));if(i.fit!==void 0)a.set("fit",i.fit);if(n?.quality!==void 0)a.set("q",String(n.quality));return a.toString()}async function Oe(n,r,i,a){if(!n||!n.supports(a.mimeType))return null;return n.transform(r,i,{format:a.mimeType.split("/")[1]??"jpeg",contentType:a.mimeType,width:a.width??0,height:a.height??0})}function je(n,r){let i=n.filename.replace(/\.[^.]*$/,"");return`${ye(i)||"file"}.${Me(r)}`}function he(n,r){if(!n)return null;return`${x(n)}/${encodeURIComponent(r.id)}/${je(r,r.mimeType)}`}function Y(n,r,i={}){let a=n.uploads?.images,o=n.uploads?.publicPath,f=i.variant,p=he(o,r)??`${ke(n)}/${encodeURIComponent(r.id)}/original`;if(f===void 0||f==="original")return p;ne(a,f);let w=a?.processor;if(!w||!w.supports(r.mimeType))return`${p}?${ue(a,f)}`;let C=X(a,r.mimeType);if(C===r.mimeType&&ce(wt(a,f,{mimeType:r.mimeType,crop:r.crop??null,focalPoint:r.focalPoint??null}),{width:r.width??null,height:r.height??null}))return p;if(o)return`${x(o)}/${encodeURIComponent(r.id)}/${encodeURIComponent(f)}/${je(r,C)}`;return`${ke(n)}/${encodeURIComponent(r.id)}/${encodeURIComponent(f)}`}function ke(n){return`${n.basePath==="/"?"":x(n.basePath)}/media`}function ze(n,r,i){let a=Ne(i);if(!a)return null;let o=ne(n,r),{width:f,height:p}=o,w=o.fit??"inside";if(f===void 0&&p===void 0)return a;if((w==="cover"||w==="contain")&&f!==void 0&&p!==void 0){if(w==="contain")return{width:f,height:p};let D=Math.max(f/a.width,p/a.height);return D>1?{width:Math.max(1,Math.round(f/D)),height:Math.max(1,Math.round(p/D))}:{width:f,height:p}}let C=w==="outside"?Math.min(1,Math.max(f===void 0?0:f/a.width,p===void 0?0:p/a.height)):Math.min(f===void 0?1/0:f/a.width,p===void 0?1/0:p/a.height,1);return{width:Math.max(1,Math.round(a.width*C)),height:Math.max(1,Math.round(a.height*C))}}function Fe(n,r,i={}){let a=Je(n,r,i);return a.length<2?null:a.map((o)=>`${o.url} ${o.width}w`).join(", ")}function Je(n,r,i){let a=n.uploads?.images,o=a?.variants?.sizes??{};if(!_t(r.mimeType)||!r.width||!r.height)return[];let f=i.sizes??Object.entries(o).filter(([,N])=>Pt(N)).map(([N])=>N),p=r.crop!==null&&r.crop!==void 0,w=[],C=new Set,D=Ne(r);if(!p&&D)w.push({url:Y(n,r),...D}),C.add(D.width);for(let N of f){let L=ze(a,N,r);if(!L||C.has(L.width))continue;C.add(L.width),w.push({url:Y(n,r,{variant:N}),...L})}return w.sort((N,L)=>N.width-L.width)}function we(n,r,i={}){let a=n.uploads?.images,o=Tt(n,r.alt,i.locale),f=i.sizes??null;if(i.variant!==void 0&&i.variant!=="original"){let D=ze(a,i.variant,r);return{src:Y(n,r,{variant:i.variant}),width:D?.width??null,height:D?.height??null,srcset:null,sizes:null,alt:o}}let p=Je(n,r,i.srcset===void 0?{}:{sizes:i.srcset}),C=r.crop!==null&&r.crop!==void 0?p.at(-1):void 0;return{src:C?.url??Y(n,r),width:C?.width??r.width??null,height:C?.height??r.height??null,srcset:p.length<2?null:p.map((D)=>`${D.url} ${D.width}w`).join(", "),sizes:p.length<2?null:f,alt:o}}function Tt(n,r,i){if(!r)return null;let a=(i===void 0?void 0:r[i])??r[n.i18n.defaultLocale];return typeof a==="string"&&a.trim()!==""?a:null}function Ne(n){if(n.crop)return{width:n.crop.width,height:n.crop.height};if(!n.width||!n.height)return null;return{width:n.width,height:n.height}}function Pt(n){let r=n.fit??"inside";if(r==="inside"||r==="outside")return!0;return n.width===void 0||n.height===void 0}function _t(n){return n.startsWith("image/")&&n!=="image/svg+xml"}var qe=["crop","variants"];function F(n,r,i){let a=u(n.metadata),{crop:o,variants:f,...p}=a,w=String(n.storage_key);return{id:String(n.id),filename:String(n.filename),mimeType:String(n.mime_type),size:Number(n.size??0),width:Le(n.width),height:Le(n.height),storageKey:w,checksum:ve(n.checksum),alt:Ot(n.alt),focalPoint:Dt(n.focal_x,n.focal_y),crop:Rt(o),status:$t(n.status),orphanedAt:l(n.orphaned_at),purgeAfter:l(n.purge_after),purgeError:ve(n.purge_error),metadata:p,variants:Array.isArray(f)?f.filter((C)=>typeof C==="string"):[],createdBy:ve(n.created_by),createdAt:l(n.created_at),updatedAt:l(n.updated_at),url:he(i,{id:String(n.id),filename:String(n.filename),mimeType:String(n.mime_type)})??r.url(w)}}function de(n){return JSON.parse(JSON.stringify(n))}function $t(n){return n==="orphaned"||n==="purging"?n:"active"}function Dt(n,r){if(n===null||n===void 0)return null;if(r===null||r===void 0)return null;return{x:Number(n),y:Number(r)}}function Rt(n){if(typeof n!=="object"||n===null||Array.isArray(n))return null;let r=n,i=["x","y","width","height"].map((a)=>Number(r[a]));if(i.some((a)=>Number.isNaN(a)))return null;return{x:i[0],y:i[1],width:i[2],height:i[3]}}function Ot(n){let r=u(n),i={};for(let[a,o]of Object.entries(r))if(typeof o==="string")i[a]=o;return i}function Le(n){return n===null||n===void 0?null:Number(n)}function ve(n){return n===null||n===void 0?null:String(n)}var kt=86400000,Et=100;async function We(n,r,i){if(n.config.uploads?.retention?.purgeAfter===!1)return[];let a=await n.database();return a.transaction((o)=>a.query(o,{table:T,where:s(t("status","orphaned"),le("purge_after",!0),M("purge_after",r)),orderBy:[m("purge_after","asc"),m("id","asc")],limit:i}))}async function Xe(n,r={}){let i={examined:0,purged:0,reclaimed:0,failed:0};if(!n.config.uploads)return i;let a=r.now??new Date,o=await We(n,a,r.limit??Et);for(let f of o){i.examined+=1;try{let p=await He(n,f,a);if(p==="purged")i.purged+=1;if(p==="reclaimed")i.reclaimed+=1}catch{i.failed+=1}}return i}async function He(n,r,i){let a=await n.storage(),o=F(r,a,n.config.uploads?.publicPath),f=await be(n,async(p,w)=>{if((await w.find(U,t("media_id",o.id))).length>0){if(await w.update(T,s(t("id",o.id),t("status","orphaned")),{status:"active",orphaned_at:null,purge_after:null,purge_error:null,updated_at:i})===0)return"taken";return await Ke(n,p,"media.reclaimed",{...o,status:"active",orphanedAt:null,purgeAfter:null}),"reclaimed"}return await w.update(T,s(t("id",o.id),t("status","orphaned")),{status:"purging",updated_at:i})===1?"claimed":"taken"});if(n.deliver(),f!=="claimed")return f;try{return await a.delete(Ae(o,n.config.uploads)),await be(n,async(p,w)=>{await w.delete(U,t("media_id",o.id)),await w.delete(T,t("id",o.id)),await Ke(n,p,"media.purged",o,{collected:!0})}),n.deliver(),"purged"}catch(p){throw await jt(n,o,p,i),p}}function Yt(n){return{name:"media-gc",failureType:"media.purge",failurePayload:(r)=>({mediaId:String(r.id),storageKey:String(r.storage_key),filename:String(r.filename)}),due:(r,i,a)=>We(n,i,a),run:async(r,i)=>{await He(n,i,new Date)}}}function Ae(n,r){let i=X(r?.images,n.mimeType),a=new Set([...n.variants,...te(r?.images)]);return[n.storageKey,...[...a].map((o)=>Be(n.storageKey,o,i))]}async function jt(n,r,i,a){let o=i instanceof Error?i.message:String(i);await be(n,async(f,p)=>{await p.update(T,t("id",r.id),{status:"orphaned",purge_after:new Date(a.getTime()+kt),purge_error:o.slice(0,1000),updated_at:a})})}async function Ke(n,r,i,a,o={}){await n.emit(r,[{type:i,data:{media:JSON.parse(JSON.stringify(a)),...o},previous:null}],{actor:null,collection:"media",documentId:a.id})}async function be(n,r){let i=await n.database();return i.transaction((a)=>r(a,d(i,a)))}async function xe(n){if(n instanceof Uint8Array)return n;if(n instanceof ArrayBuffer)return new Uint8Array(n);if(typeof Blob<"u"&&n instanceof Blob)return new Uint8Array(await n.arrayBuffer());let r=[],i=n.getReader();for(;;){let{done:a,value:o}=await i.read();if(a)break;if(o)r.push(o)}return Z(r)}function Z(n){if(n.length===1)return n[0];let r=n.reduce((o,f)=>o+f.byteLength,0),i=new Uint8Array(r),a=0;for(let o of n)i.set(o,a),a+=o.byteLength;return i}function vt(n){return new ReadableStream({start(r){r.enqueue(n),r.close()}})}function Ve(n){let r="";for(let i of n)r+=i.toString(16).padStart(2,"0");return r}function eo(n){let r="";for(let i of n)r+=String.fromCharCode(i);return btoa(r)}async function xt(n){let r=typeof n==="string"?new TextEncoder().encode(n):n,i=await crypto.subtle.digest("SHA-256",r);return new Uint8Array(i)}function Ge(n,r){switch(r.toLowerCase()){case"image/jpeg":return zt(n);case"image/png":return Jt(n);case"image/webp":return Nt(n);default:return n}}function zt(n){if(n.length<4||n[0]!==255||n[1]!==216)return n;let r=[n.subarray(0,2)],i=2;while(i+4<=n.length){if(n[i]!==255)break;let a=n[i+1]??0;if(a===216||a===1||a>=208&&a<=215){r.push(n.subarray(i,i+2)),i+=2;continue}if(a===218){r.push(n.subarray(i)),i=n.length;break}let o=(n[i+2]??0)<<8|(n[i+3]??0);if(o<2||i+2+o>n.length)break;if(!Ft(a))r.push(n.subarray(i,i+2+o));i+=2+o}if(i<n.length)r.push(n.subarray(i));return Z(r)}function Ft(n){if(n===254)return!0;if(n===224)return!1;if(n===226)return!1;if(n===238)return!1;return n>=224&&n<=239}function Jt(n){let r=[137,80,78,71,13,10,26,10];if(n.length<8||!r.every((f,p)=>n[p]===f))return n;let i=new Set(["tEXt","zTXt","iTXt","eXIf","tIME","dSIG"]),a=[n.subarray(0,8)],o=8;while(o+8<=n.length){let f=Bt(n,o),p=fe(n,o+4,4),w=12+f;if(w<12||o+w>n.length)break;if(!i.has(p))a.push(n.subarray(o,o+w));if(o+=w,p==="IEND")break}return Z(a)}function Nt(n){if(n.length<12||fe(n,0,4)!=="RIFF"||fe(n,8,4)!=="WEBP")return n;let r=new Set(["EXIF","XMP "]),i=[],a=12,o=!1;while(a+8<=n.length){let w=fe(n,a,4),C=Lt(n,a+4),D=8+C+C%2;if(a+D>n.length)break;if(r.has(w))o=!0;else i.push(n.subarray(a,a+D));a+=D}if(!o)return n;let f=Z(i),p=new Uint8Array(12);return p.set(n.subarray(0,12)),Vt(p,4,f.byteLength+4),Z([p,f])}function Bt(n,r){return(n[r]??0)*16777216+((n[r+1]??0)<<16|(n[r+2]??0)<<8|(n[r+3]??0))}function Lt(n,r){return(n[r]??0)+((n[r+1]??0)<<8)+((n[r+2]??0)<<16)+(n[r+3]??0)*16777216}function Vt(n,r,i){n[r]=i&255,n[r+1]=i>>>8&255,n[r+2]=i>>>16&255,n[r+3]=i>>>24&255}function fe(n,r,i){let a="";for(let o=0;o<i;o+=1)a+=String.fromCharCode(n[r+o]??0);return a}async function kn(n){let r=n.uploads.limits,i=n.uploads.images,a=Ee(n.bytes),o=Wt(n.contentType,a);if(Kt(o,r?.accept),r?.maxFileSize){let N=se(r.maxFileSize,"uploads.limits.maxFileSize");if(n.bytes.byteLength>N)throw new e(`"${n.filename}" is ${Gt(n.bytes.byteLength)}, over the ${r.maxFileSize} limit`,{status:413,code:"file_too_large"})}let f=r?.maxImageDimensions;if(a&&f){if(a.width>f.width||a.height>f.height)throw new e(`"${n.filename}" is ${a.width}x${a.height}, over the ${f.width}x${f.height} limit`,{status:422,code:"image_too_large"})}let p=n.bytes,w=a,C=o,D=null;if(a&&i){let N=await qt(p,a,i,C);p=N.data,w=N.info,C=N.contentType,D=N.error}return{data:p,contentType:C,filename:Ue(n.filename),info:w,checksum:Ve(await xt(p)),extension:Me(C),processingError:D}}async function qt(n,r,i,a){let o=i.processor,f={},p=i.convert,w=p!==void 0&&a===`image/${p.to}`;if(p&&!(p.keep??[]).includes(a)&&r.format!=="svg"&&!w)f.format=p.to;let C=i.maxDimensions;if(C&&(r.width>C.width||r.height>C.height))f.width=C.width,f.height=C.height,f.fit="inside";if(i.quality!==void 0)f.quality=i.quality;if((f.format!==void 0||f.width!==void 0)&&o&&o.supports(a)){if(i.stripMetadata!==!1)f.stripMetadata=!0;try{let q=await o.transform(n,f,r);return{data:q.data,contentType:q.contentType,info:{format:r.format,contentType:q.contentType,width:q.width,height:q.height},error:null}}catch(q){if(Ce(q))throw q;return{data:i.stripMetadata!==!1?Ge(n,a):n,info:r,contentType:a,error:Se(q)}}}return{data:i.stripMetadata===!0||w&&o!==void 0&&i.stripMetadata!==!1?Ge(n,a):n,info:r,contentType:a,error:null}}function Ce(n){return n instanceof e&&n.code==="image_processor_missing"}function Se(n){if(n instanceof Error){let r=n.code;return typeof r==="number"||typeof r==="string"&&r!==""?`${n.message} (${String(r)})`:n.message}return String(n)}function Kt(n,r){if(!r||r.length===0)return;if(r.some((i)=>Ie(n,i)))return;throw new e(`"${n}" is not an accepted file type; uploads.limits.accept allows ${r.join(", ")}`,{status:415,code:"unsupported_media_type"})}function Ie(n,r){let i=n.toLowerCase().split(";")[0]?.trim()??"",a=r.toLowerCase().trim();if(a==="*"||a==="*/*")return!0;if(a.endsWith("/*"))return i.startsWith(a.slice(0,-1));return i===a}function Wt(n,r){if(r)return r.contentType;let i=n.split(";")[0]?.trim().toLowerCase();return i&&i.includes("/")?i:"application/octet-stream"}function Ue(n){let i=(n.split(/[/\\]/).pop()??"file").replaceAll("\x00","").replace(/[\u0000-\u001f\u007f"]/g,"").trim();return i.length>0?i.slice(0,255):"file"}function Gt(n){if(n<1024)return`${n} B`;if(n<1048576)return`${(n/1024).toFixed(1)} kB`;return`${(n/1048576).toFixed(1)} MB`}var Xt=25,Ht=3600000,Zt=200,Te=[m("created_at","desc"),m("id","desc")];function Qt(n){let{config:r}=n,i,a=new Map,o=r.uploads?.publicPath,f=()=>{if(!r.uploads)throw new e("This CMS has no uploads configured; add an `uploads` section with a storage adapter.",{status:501,code:"uploads_not_configured"});return r.uploads},p=()=>(i??=Promise.resolve(typeof f().storage==="function"?f().storage():f().storage),i);async function w(c){let g=await n.database();return g.transaction((y)=>c(y,d(g,y)))}let C={config:r,database:n.database,storage:p,emit:n.emit,deliver:n.deliver},D=(c,g)=>{if(!r.rbac)return;if(E(c,`media:${g}`))return;throw c?e.forbidden(`Not allowed to ${g} media; the "media:${g}" permission is required`):e.unauthorized(`Not allowed to ${g} media`)},N=async(c,g,y,v,h={})=>{await n.emit(c,[{type:g,data:{media:de(y),...h},previous:null}],{actor:v,collection:"media",documentId:y.id})},L=async(c,g)=>{let y=await c.findOne(T,t("id",g));if(!y)throw e.notFound(`No media with id "${g}"`);return y};async function q(c){let g=f(),y=c.actor??null;D(y,"create");let v=await xe(c.file),h=await kn({bytes:v,filename:c.filename??sn(c.file)??"file",contentType:c.contentType??cn(c.file)??"application/octet-stream",uploads:g}),I=b("med"),_=await p(),k=tn(_,I,h.filename,h.extension);await _.put(k,h.data,{contentType:h.contentType,size:h.data.byteLength,cacheControl:"public, max-age=31536000, immutable"});let A=new Date,P;try{P=await w(async(j,z)=>{let O=await z.insert(T,{id:I,filename:h.filename,mime_type:h.contentType,size:h.data.byteLength,width:h.info?.width??null,height:h.info?.height??null,storage_key:k,checksum:h.checksum,alt:rn(c.alt,c.locale??r.i18n.defaultLocale),focal_x:null,focal_y:null,status:"active",orphaned_at:null,purge_after:null,purge_error:null,metadata:{...c.metadata??{}},created_by:y?.id??null,created_at:A,updated_at:A}),K=F(O,_,o);if(await N(j,"media.uploaded",K,y),h.processingError!==null)await N(j,"media.processing.failed",K,y,{variant:null,error:h.processingError});return K})}catch(j){throw await _.delete([k]).catch(()=>{return}),j}if(n.deliver(),g.images?.variants?.mode==="pregenerate")return Ze(P,y);return P}async function Ze(c,g){for(let y of te(f().images))try{let v=await $e({id:c.id,variant:y});if(v)await un(v.body)}catch(v){await w((h)=>n.emit(h,[{type:"media.processing.failed",data:{media:de(c),variant:y,error:v instanceof Error?v.message:String(v)},previous:null}],{actor:g,collection:"media",documentId:c.id})),n.deliver()}return await _e(c.id)??c}async function et(c={}){let g=nn(c.limit),y=[];if(c.status)y.push(t("status",c.status));if(c.search)y.push(ae("filename",`%${c.search}%`,!0));let v=c.mimeType?.includes("*")===!0?c.mimeType:null;if(c.mimeType&&!v)y.push(t("mime_type",c.mimeType));let h=y.length>0?s(...y):void 0,I=await n.database(),_=await I.transaction((O)=>I.query(O,{table:T,...c.cursor?{where:s(...h?[h]:[],J(c.cursor,Te))}:h===void 0?{}:{where:h},orderBy:Te,limit:g+1})),k=v?_.filter((O)=>Ie(String(O.mime_type),v)):_,A=k.length>g,P=k.slice(0,g),j=await p(),z=P.at(-1);return{docs:P.map((O)=>F(O,j,o)),limit:g,hasNextPage:A,cursor:z?V(z,Te):null}}async function _e(c){let g=await w((y,v)=>v.findOne(T,t("id",c)));return g?F(g,await p(),o):null}async function me(c){let g=[...new Set(c)].filter((h)=>h.length>0),y=new Map;if(g.length===0)return y;let v=await p();for(let h=0;h<g.length;h+=90){let I=g.slice(h,h+90),_=await w((k,A)=>A.find(T,S("id",I)));for(let k of _){let A=F(k,v,o);y.set(A.id,A)}}return y}async function tt(c,g={}){let y=[...Object.values(r.collections),...Object.values(r.globals)].find((A)=>A.name===c||A.slug===c);if(!y)throw e.notFound(`No collection or global called "${c}"`);let v=y.name,h=[];if(g.ids===void 0)h.push(...await w((A,P)=>P.find(U,t("collection",v))));else{let A=[...new Set(g.ids)];for(let P=0;P<A.length;P+=90){let j=A.slice(P,P+90);h.push(...await w((z,O)=>O.find(U,s(t("collection",v),S("document_id",j)))))}}let I=await me(h.map((A)=>String(A.media_id))),_=new Map,k=[...h].sort((A,P)=>String(A.document_id).localeCompare(String(P.document_id))||String(A.id).localeCompare(String(P.id)));for(let A of k){let P=I.get(String(A.media_id));if(!P)continue;let j=String(A.document_id),z=String(A.locale??""),O=_.get(j)??[];O.push({media:P,field:String(A.field),locale:z===""?null:z}),_.set(j,O)}return _}async function nt(c,g={}){let y=r.uploads?Qe(c??null):[],v=y.length>0?await me(y):new Map;return Q(c,{format:g.format??"html",mediaImage:(h)=>{let I=v.get(h);if(!I)return null;return we(r,I,{...g.locale===void 0?{}:{locale:g.locale},...g.sizes===void 0?{}:{sizes:g.sizes}})},mediaUrl:(h)=>`${r.basePath}/media/${encodeURIComponent(h)}/original`,images:{loading:g.loading??"lazy",decoding:"async"}})}async function rt(c){return(await w((y,v)=>v.find(U,t("media_id",c)))).map((y)=>({mediaId:String(y.media_id),collection:String(y.collection),documentId:String(y.document_id),field:String(y.field),locale:String(y.locale??""),createdAt:l(y.created_at)}))}async function at(c){let g=f(),y=c.actor??null;D(y,"update"),en(g,c);let v=await p(),{media:h,stale:I}=await w(async(_,k)=>{let A=await L(k,c.id),P=F(A,v,o),z=c.crop!==void 0&&!Ye(c.crop,P.crop)||c.focalPoint!==void 0&&!Ye(c.focalPoint,P.focalPoint)?P.variants:[],O={updated_at:new Date};if(c.filename!==void 0)O.filename=Ue(c.filename);if(c.alt!==void 0)O.alt=an(P.alt,c.alt,c.locale??r.i18n.defaultLocale);if(c.focalPoint!==void 0)O.focal_x=c.focalPoint?.x??null,O.focal_y=c.focalPoint?.y??null;let K={...u(A.metadata),...c.metadata??{}};if(c.crop===null)delete K.crop;else if(c.crop!==void 0)K.crop={...c.crop};if(z.length>0)delete K.variants;O.metadata=K,await k.update(T,t("id",c.id),O);let re=F({...A,...O},v,o);await N(_,"media.updated",re,y);let lt=X(g.images,re.mimeType);return{media:re,stale:z.map((ft)=>Be(re.storageKey,ft,lt))}});if(I.length>0)await v.delete(I).catch(()=>{return});return n.deliver(),h}async function ot(c){let g=c.actor??null;D(g,"update");let y=await w(async(v,h)=>{let I=await L(h,c.id);if(String(I.status)==="active")throw e.conflict(`"${c.id}" is in use; only an unused file has a deadline to clear`);let _={purge_after:null,purge_error:null,updated_at:new Date};await h.update(T,t("id",c.id),_);let k=F({...I,..._},await p(),o);return await N(v,"media.updated",k,g,{kept:!0}),k});return n.deliver(),y}async function st(c){let g=c.actor??null;D(g,"delete");let y=await p(),{media:v,keys:h}=await w(async(I,_)=>{let k=await L(_,c.id),A=F(k,y,o);if(c.force!==!0){let P=await _.find(U,t("media_id",c.id));if(P.length>0){let j=P.slice(0,3).map((z)=>`${String(z.collection)}/${String(z.document_id)}`).join(", ");throw e.conflict(`"${A.filename}" is used by ${P.length} document${P.length===1?"":"s"} (${j}); pass force to delete it anyway`)}}return await _.delete(U,t("media_id",c.id)),await _.delete(T,t("id",c.id)),await N(I,"media.purged",A,g),{media:A,keys:Ae(A,r.uploads)}});return await y.delete(h),n.deliver(),v}async function $e(c){let g=f(),y=await p(),v=await w((z,O)=>O.findOne(T,t("id",c.id)));if(!v)return null;let h=F(v,y,o);if(!c.variant)return ee(y,h,null);let I=g.images?.processor;if(!I||!I.supports(h.mimeType)){let z=ue(g.images,c.variant);return ee(y,h,c.variant,z)}let _=wt(g.images,c.variant,h),k=X(g.images,h.mimeType);if(k===h.mimeType&&ce(_,h))return ee(y,h,c.variant);let A=Be(h.storageKey,c.variant,k);if(c.refresh!==!0){let z=await y.get(A);if(z){let O=await y.head?.(A);return{media:h,variant:c.variant,key:A,contentType:O?.contentType??k,width:null,height:null,size:O?.size??null,body:z,url:await Pe(y,A),cached:!0,processingError:null}}}let P=await y.get(h.storageKey);if(!P)return null;let j;try{j=await Oe(I,await xe(P),_,h)}catch(z){if(Ce(z))throw z;let O=Se(z);await ct(h,c.variant,O);let K=await ee(y,h,c.variant);return K&&{...K,processingError:O}}if(!j)return ee(y,h,c.variant);return await y.put(A,j.data,{contentType:j.contentType,size:j.data.byteLength,cacheControl:"public, max-age=31536000, immutable"}),await ut(h.id,c.variant),{media:h,variant:c.variant,key:A,contentType:j.contentType,width:j.width,height:j.height,size:j.data.byteLength,body:vt(j.data),url:await Pe(y,A),cached:!1,processingError:null}}async function ct(c,g,y){let v=`${c.id}|${g}`,h=Date.now(),I=a.get(v);if(I!==void 0&&h-I<Ht)return;if(a.size>=1000)a.clear();a.set(v,h);try{await w((_)=>n.emit(_,[{type:"media.processing.failed",data:{media:de(c),variant:g,error:y},previous:null}],{actor:null,collection:"media",documentId:c.id})),n.deliver()}catch{}}async function ee(c,g,y,v=""){let h=await c.get(g.storageKey);if(!h)return null;let I=await Pe(c,g.storageKey);return{media:g,variant:y,key:g.storageKey,contentType:g.mimeType,width:g.width,height:g.height,size:g.size,body:h,url:v?`${I}?${v}`:I,cached:y===null,processingError:null}}async function ut(c,g){await w(async(y,v)=>{let h=await v.findOne(T,t("id",c));if(!h)return;let I=u(h.metadata),_=Array.isArray(I.variants)?I.variants.filter((k)=>typeof k==="string"):[];if(_.includes(g))return;await v.update(T,t("id",c),{metadata:{...I,variants:[..._,g].sort()}})})}function dt(c){return Xe(C,c)}return{upload:q,list:et,get:_e,getMany:me,update:at,delete:st,keep:ot,usages:rt,variant:$e,collect:dt,storage:p,forDocuments:tt,url:(c,g)=>Y(r,c,g),srcset:(c,g)=>Fe(r,c,g),image:(c,g)=>we(r,c,g),renderRichText:nt}}function en(n,r){for(let i of Object.keys(r.metadata??{}))if(qe.includes(i))throw e.validation(`"${i}" is reserved inside media metadata; it is maintained by the engine`);if(r.focalPoint!==void 0&&n.images?.focalPoint!==!0)throw e.validation("Focal points are off; set uploads.images.focalPoint to true");if(r.crop!==void 0&&n.images?.crop!==!0)throw e.validation("Cropping is off; set uploads.images.crop to true");if(r.focalPoint&&!on(r.focalPoint))throw e.validation("A focal point is relative: x and y are between 0 and 1")}function tn(n,r,i,a){let f=(n.prefix?.({id:r,filename:i})??String(new Date().getUTCFullYear())).replace(/^\/+|\/+$/g,"");return f?`${f}/${r}.${a}`:`${r}.${a}`}async function Pe(n,r){return n.signedUrl?n.signedUrl(r):n.url(r)}function nn(n){if(n===void 0)return Xt;if(!Number.isInteger(n)||n<1)throw new e(`limit must be a positive integer, received ${n}`,{status:400,code:"invalid_pagination"});return Math.min(n,Zt)}function rn(n,r){if(n===void 0)return{};return typeof n==="string"?{[r]:n}:{...n}}function an(n,r,i){return typeof r==="string"?{...n,[i]:r}:{...r}}function on(n){return n.x>=0&&n.x<=1&&n.y>=0&&n.y<=1}function sn(n){let r=n.name;return typeof r==="string"?r:void 0}function cn(n){let r=n.type;return typeof r==="string"&&r.length>0?r:void 0}function Ye(n,r){return JSON.stringify(n??null)===JSON.stringify(r??null)}async function un(n){let r=n.getReader();for(;;){let{done:i}=await r.read();if(i)break}}
+export{V,J,So,Ee,Me,wt,Be,F,Yt,xe,vt,Ve,eo,xt,Ge,kn,Qt};

package/dist/{index-761dec5z.js → index-344y6q4n.js}

@@ -1,2 +1,2 @@
-var z="cms_migrations";function e(u,i,a={}){return{name:u,type:i,nullable:a.default!==void 0?!1:a.nullable??!0,storage:"column",...a.default===void 0?{}:{default:a.default},...a.unique===void 0?{}:{unique:a.unique},...a.index===void 0?{}:{index:a.index},...a.array===void 0?{}:{array:a.array},...a.references===void 0?{}:{references:a.references}}}var l=()=>e("id","text",{nullable:!1,unique:!0}),n=()=>e("created_at","timestamp",{nullable:!1}),o=()=>e("updated_at","timestamp",{nullable:!1});function t(u,i,a={}){let d=i.map((c)=>({kind:"column",column:c})),r=a.unique===!0?"uniq":"idx";return{name:a.name??`${r}_${u}_${i.join("_")}`,table:u,targets:d,unique:a.unique===!0}}function s(u,i,a=[],d){return{name:u,columns:[...i].sort((r,c)=>r.name.localeCompare(c.name)),primaryKey:["id"],indexes:[...a].sort((r,c)=>r.name.localeCompare(c.name)),...d===void 0?{}:{documentColumn:d}}}function nt(){return[_(),b(),f(),p(),x(),h(),y(),g(),T(),v(),k(),q(),S(),j(),w(),C(),D()].sort((u,i)=>u.name.localeCompare(i.name))}function ot(){return["cms_migrations",m,...nt().map((u)=>u.name)].sort()}var m="slug_history";function mo(){return s(m,[l(),e("collection","text",{nullable:!1}),e("field","text",{nullable:!1}),e("locale","text",{nullable:!1,default:""}),e("slug","text",{nullable:!1}),e("document_id","text",{nullable:!1}),n()],[t(m,["collection","field","locale","slug"],{unique:!0,name:"uniq_slug_history_address"}),t(m,["document_id"])])}function _(){return s("documents",[l(),e("collection","text",{nullable:!1}),e("data","json",{nullable:!1}),e("revision","integer",{nullable:!1,default:1}),e("scheduled_at","timestamp"),e("scheduled_patch","json"),e("deleted_at","timestamp"),e("purge_after","timestamp"),n(),o(),e("updated_by","text")],[t("documents",["collection"]),t("documents",["collection","deleted_at"]),t("documents",["collection","updated_at"]),t("documents",["scheduled_at"]),t("documents",["purge_after"])],"data")}function b(){return s("cms_users",[l(),e("email","text",{nullable:!1,unique:!0}),e("name","text"),e("password_hash","text"),e("two_factor_secret","text"),e("two_factor_enabled","boolean",{default:!1}),e("status","text",{nullable:!1,default:"active"}),e("roles","json",{nullable:!1,array:!0}),e("avatar_url","text"),e("locale","text"),e("last_login_at","timestamp"),n(),o()],[t("cms_users",["email"],{unique:!0})])}function f(){return s("cms_sessions",[l(),e("user_id","text",{nullable:!1,references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("token_hash","text",{nullable:!1,unique:!0}),e("ip","text"),e("user_agent","text"),e("expires_at","timestamp",{nullable:!1}),n()],[t("cms_sessions",["token_hash"],{unique:!0}),t("cms_sessions",["user_id"]),t("cms_sessions",["expires_at"])])}function p(){return s("cms_accounts",[l(),e("user_id","text",{nullable:!1,references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("provider","text",{nullable:!1}),e("provider_account_id","text",{nullable:!1}),e("email","text"),n(),o()],[t("cms_accounts",["provider","provider_account_id"],{unique:!0,name:"uniq_cms_accounts_provider_account"}),t("cms_accounts",["user_id"])])}function x(){return s("cms_tokens",[l(),e("type","text",{nullable:!1}),e("user_id","text",{references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("email","text"),e("token_hash","text",{nullable:!1,unique:!0}),e("data","json"),e("expires_at","timestamp",{nullable:!1}),e("consumed_at","timestamp"),n()],[t("cms_tokens",["token_hash"],{unique:!0}),t("cms_tokens",["user_id"]),t("cms_tokens",["type","expires_at"])])}function h(){return s("cms_api_keys",[l(),e("name","text",{nullable:!1}),e("user_id","text",{references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("key_hash","text",{nullable:!1,unique:!0}),e("prefix","text",{nullable:!1}),e("scopes","json",{nullable:!1,array:!0}),e("last_used_at","timestamp"),e("expires_at","timestamp"),e("revoked_at","timestamp"),n()],[t("cms_api_keys",["key_hash"],{unique:!0}),t("cms_api_keys",["user_id"])])}function y(){return s("cms_roles",[l(),e("name","text",{nullable:!1,unique:!0}),e("label","text"),e("permissions","json",{nullable:!1,array:!0}),n(),o()],[t("cms_roles",["name"],{unique:!0})])}function g(){return s("cms_ai_credentials",[l(),e("provider","text",{nullable:!1,unique:!0}),e("auth_type","text",{nullable:!1,default:"api-key"}),e("secret","text",{nullable:!1}),e("hint","text"),n(),o()],[t("cms_ai_credentials",["provider"],{unique:!0})])}function T(){return s("cms_ai_mutations",[l(),e("idempotency_key","text",{nullable:!1,unique:!0}),e("run_id","text",{nullable:!1}),e("collection","text"),e("document_id","text"),e("result","json"),n()],[t("cms_ai_mutations",["idempotency_key"],{unique:!0}),t("cms_ai_mutations",["run_id"])])}function v(){return s("cms_ai_plans",[l(),e("run_id","text",{nullable:!1}),e("actor_id","text"),e("kind","text",{nullable:!1}),e("summary","text",{nullable:!1}),e("operations","json",{nullable:!1}),e("status","text",{nullable:!1,default:"pending"}),e("result","json"),e("expires_at","timestamp",{nullable:!1}),e("approved_at","timestamp"),n()],[t("cms_ai_plans",["run_id"]),t("cms_ai_plans",["status","expires_at"])])}function k(){return s("media",[l(),e("filename","text",{nullable:!1}),e("mime_type","text",{nullable:!1}),e("size","bigint",{nullable:!1}),e("width","integer"),e("height","integer"),e("storage_key","text",{nullable:!1,unique:!0}),e("checksum","text"),e("alt","json"),e("focal_x","real"),e("focal_y","real"),e("status","text",{nullable:!1,default:"active"}),e("orphaned_at","timestamp"),e("purge_after","timestamp"),e("purge_error","text"),e("metadata","json"),e("created_by","text"),n(),o()],[t("media",["storage_key"],{unique:!0}),t("media",["status"]),t("media",["status","purge_after"])])}function q(){return s("media_usages",[l(),e("media_id","text",{nullable:!1,references:{table:"media",column:"id",onDelete:"cascade"}}),e("collection","text",{nullable:!1}),e("document_id","text",{nullable:!1}),e("field","text",{nullable:!1}),e("locale","text",{nullable:!1,default:""}),n()],[t("media_usages",["media_id"]),t("media_usages",["document_id"]),t("media_usages",["media_id","document_id","field","locale"],{unique:!0,name:"uniq_media_usages_reference"})])}function S(){return s("webhooks",[l(),e("url","text",{nullable:!1}),e("events","json",{nullable:!1,array:!0}),e("filters","json"),e("headers","json"),e("secret","text"),e("active","boolean",{nullable:!1,default:!0}),n(),o()],[t("webhooks",["active"])])}function j(){return s("webhook_deliveries",[l(),e("webhook_id","text",{nullable:!1,references:{table:"webhooks",column:"id",onDelete:"cascade"}}),e("event_id","text",{nullable:!1}),e("event_type","text",{nullable:!1}),e("status","text",{nullable:!1,default:"pending"}),e("attempt","integer",{nullable:!1,default:0}),e("request_body","json"),e("response_status","integer"),e("response_body","text"),e("error","text"),e("next_attempt_at","timestamp"),e("delivered_at","timestamp"),n()],[t("webhook_deliveries",["webhook_id","created_at"]),t("webhook_deliveries",["status","next_attempt_at"]),t("webhook_deliveries",["event_id"])])}function w(){return s("outbox",[l(),e("event_id","text",{nullable:!1,unique:!0}),e("type","text",{nullable:!1}),e("payload","json",{nullable:!1}),e("previous","json"),e("actor","json"),e("collection","text"),e("document_id","text"),e("status","text",{nullable:!1,default:"pending"}),e("attempts","integer",{nullable:!1,default:0}),e("available_at","timestamp",{nullable:!1}),e("processed_at","timestamp"),e("error","text"),n()],[t("outbox",["event_id"],{unique:!0}),t("outbox",["status","available_at"]),t("outbox",["document_id","created_at"])])}function C(){return s("activity",[l(),e("actor_id","text"),e("actor_source","text"),e("action","text",{nullable:!1}),e("source","text"),e("collection","text"),e("document_id","text"),e("locale","text"),e("changes","json"),e("ip","text"),n()],[t("activity",["collection","document_id"]),t("activity",["actor_id"]),t("activity",["created_at"])])}function D(){return s("jobs",[l(),e("type","text",{nullable:!1}),e("payload","json"),e("status","text",{nullable:!1,default:"pending"}),e("run_at","timestamp",{nullable:!1}),e("attempts","integer",{nullable:!1,default:0}),e("locked_at","timestamp"),e("locked_by","text"),e("completed_at","timestamp"),e("error","text"),n()],[t("jobs",["status","run_at"]),t("jobs",["type"])])}
-export{z,nt,ot,mo};
+var z="cms_migrations";function e(u,i,a={}){return{name:u,type:i,nullable:a.default!==void 0?!1:a.nullable??!0,storage:"column",...a.default===void 0?{}:{default:a.default},...a.unique===void 0?{}:{unique:a.unique},...a.index===void 0?{}:{index:a.index},...a.array===void 0?{}:{array:a.array},...a.references===void 0?{}:{references:a.references}}}var l=()=>e("id","text",{nullable:!1,unique:!0}),n=()=>e("created_at","timestamp",{nullable:!1}),o=()=>e("updated_at","timestamp",{nullable:!1});function t(u,i,a={}){let d=i.map((c)=>({kind:"column",column:c})),r=a.unique===!0?"uniq":"idx";return{name:a.name??`${r}_${u}_${i.join("_")}`,table:u,targets:d,unique:a.unique===!0}}function s(u,i,a=[],d){return{name:u,columns:[...i].sort((r,c)=>r.name.localeCompare(c.name)),primaryKey:["id"],indexes:[...a].sort((r,c)=>r.name.localeCompare(c.name)),...d===void 0?{}:{documentColumn:d}}}function nt(){return[_(),b(),f(),p(),x(),h(),y(),g(),T(),v(),k(),q(),S(),j(),w(),C(),D()].sort((u,i)=>u.name.localeCompare(i.name))}function ot(){return["cms_migrations",m,...nt().map((u)=>u.name)].sort()}var m="slug_history";function yo(){return s(m,[l(),e("collection","text",{nullable:!1}),e("field","text",{nullable:!1}),e("locale","text",{nullable:!1,default:""}),e("slug","text",{nullable:!1}),e("document_id","text",{nullable:!1}),n()],[t(m,["collection","field","locale","slug"],{unique:!0,name:"uniq_slug_history_address"}),t(m,["document_id"])])}function _(){return s("documents",[l(),e("collection","text",{nullable:!1}),e("data","json",{nullable:!1}),e("revision","integer",{nullable:!1,default:1}),e("scheduled_at","timestamp"),e("scheduled_patch","json"),e("deleted_at","timestamp"),e("purge_after","timestamp"),n(),o(),e("updated_by","text")],[t("documents",["collection"]),t("documents",["collection","deleted_at"]),t("documents",["collection","updated_at"]),t("documents",["scheduled_at"]),t("documents",["purge_after"])],"data")}function b(){return s("cms_users",[l(),e("email","text",{nullable:!1,unique:!0}),e("name","text"),e("password_hash","text"),e("two_factor_secret","text"),e("two_factor_enabled","boolean",{default:!1}),e("status","text",{nullable:!1,default:"active"}),e("roles","json",{nullable:!1,array:!0}),e("avatar_url","text"),e("locale","text"),e("last_login_at","timestamp"),n(),o()],[t("cms_users",["email"],{unique:!0})])}function f(){return s("cms_sessions",[l(),e("user_id","text",{nullable:!1,references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("token_hash","text",{nullable:!1,unique:!0}),e("ip","text"),e("user_agent","text"),e("expires_at","timestamp",{nullable:!1}),n()],[t("cms_sessions",["token_hash"],{unique:!0}),t("cms_sessions",["user_id"]),t("cms_sessions",["expires_at"])])}function p(){return s("cms_accounts",[l(),e("user_id","text",{nullable:!1,references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("provider","text",{nullable:!1}),e("provider_account_id","text",{nullable:!1}),e("email","text"),n(),o()],[t("cms_accounts",["provider","provider_account_id"],{unique:!0,name:"uniq_cms_accounts_provider_account"}),t("cms_accounts",["user_id"])])}function x(){return s("cms_tokens",[l(),e("type","text",{nullable:!1}),e("user_id","text",{references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("email","text"),e("token_hash","text",{nullable:!1,unique:!0}),e("data","json"),e("expires_at","timestamp",{nullable:!1}),e("consumed_at","timestamp"),n()],[t("cms_tokens",["token_hash"],{unique:!0}),t("cms_tokens",["user_id"]),t("cms_tokens",["type","expires_at"])])}function h(){return s("cms_api_keys",[l(),e("name","text",{nullable:!1}),e("user_id","text",{references:{table:"cms_users",column:"id",onDelete:"cascade"}}),e("key_hash","text",{nullable:!1,unique:!0}),e("prefix","text",{nullable:!1}),e("scopes","json",{nullable:!1,array:!0}),e("last_used_at","timestamp"),e("expires_at","timestamp"),e("revoked_at","timestamp"),n()],[t("cms_api_keys",["key_hash"],{unique:!0}),t("cms_api_keys",["user_id"])])}function y(){return s("cms_roles",[l(),e("name","text",{nullable:!1,unique:!0}),e("label","text"),e("permissions","json",{nullable:!1,array:!0}),n(),o()],[t("cms_roles",["name"],{unique:!0})])}function g(){return s("cms_ai_credentials",[l(),e("provider","text",{nullable:!1,unique:!0}),e("auth_type","text",{nullable:!1,default:"api-key"}),e("secret","text",{nullable:!1}),e("hint","text"),n(),o()],[t("cms_ai_credentials",["provider"],{unique:!0})])}function T(){return s("cms_ai_mutations",[l(),e("idempotency_key","text",{nullable:!1,unique:!0}),e("run_id","text",{nullable:!1}),e("collection","text"),e("document_id","text"),e("result","json"),n()],[t("cms_ai_mutations",["idempotency_key"],{unique:!0}),t("cms_ai_mutations",["run_id"])])}function v(){return s("cms_ai_plans",[l(),e("run_id","text",{nullable:!1}),e("actor_id","text"),e("kind","text",{nullable:!1}),e("summary","text",{nullable:!1}),e("operations","json",{nullable:!1}),e("status","text",{nullable:!1,default:"pending"}),e("result","json"),e("expires_at","timestamp",{nullable:!1}),e("approved_at","timestamp"),n()],[t("cms_ai_plans",["run_id"]),t("cms_ai_plans",["status","expires_at"])])}function k(){return s("media",[l(),e("filename","text",{nullable:!1}),e("mime_type","text",{nullable:!1}),e("size","bigint",{nullable:!1}),e("width","integer"),e("height","integer"),e("storage_key","text",{nullable:!1,unique:!0}),e("checksum","text"),e("alt","json"),e("focal_x","real"),e("focal_y","real"),e("status","text",{nullable:!1,default:"active"}),e("orphaned_at","timestamp"),e("purge_after","timestamp"),e("purge_error","text"),e("metadata","json"),e("created_by","text"),n(),o()],[t("media",["storage_key"],{unique:!0}),t("media",["status"]),t("media",["status","purge_after"])])}function q(){return s("media_usages",[l(),e("media_id","text",{nullable:!1,references:{table:"media",column:"id",onDelete:"cascade"}}),e("collection","text",{nullable:!1}),e("document_id","text",{nullable:!1}),e("field","text",{nullable:!1}),e("locale","text",{nullable:!1,default:""}),n()],[t("media_usages",["media_id"]),t("media_usages",["document_id"]),t("media_usages",["media_id","document_id","field","locale"],{unique:!0,name:"uniq_media_usages_reference"})])}function S(){return s("webhooks",[l(),e("url","text",{nullable:!1}),e("events","json",{nullable:!1,array:!0}),e("filters","json"),e("headers","json"),e("secret","text"),e("active","boolean",{nullable:!1,default:!0}),n(),o()],[t("webhooks",["active"])])}function j(){return s("webhook_deliveries",[l(),e("webhook_id","text",{nullable:!1,references:{table:"webhooks",column:"id",onDelete:"cascade"}}),e("event_id","text",{nullable:!1}),e("event_type","text",{nullable:!1}),e("status","text",{nullable:!1,default:"pending"}),e("attempt","integer",{nullable:!1,default:0}),e("request_body","json"),e("response_status","integer"),e("response_body","text"),e("error","text"),e("next_attempt_at","timestamp"),e("delivered_at","timestamp"),n()],[t("webhook_deliveries",["webhook_id","created_at"]),t("webhook_deliveries",["status","next_attempt_at"]),t("webhook_deliveries",["event_id"])])}function w(){return s("outbox",[l(),e("event_id","text",{nullable:!1,unique:!0}),e("type","text",{nullable:!1}),e("payload","json",{nullable:!1}),e("previous","json"),e("actor","json"),e("collection","text"),e("document_id","text"),e("status","text",{nullable:!1,default:"pending"}),e("attempts","integer",{nullable:!1,default:0}),e("available_at","timestamp",{nullable:!1}),e("processed_at","timestamp"),e("error","text"),n()],[t("outbox",["event_id"],{unique:!0}),t("outbox",["status","available_at"]),t("outbox",["document_id","created_at"])])}function C(){return s("activity",[l(),e("actor_id","text"),e("actor_source","text"),e("action","text",{nullable:!1}),e("source","text"),e("collection","text"),e("document_id","text"),e("locale","text"),e("changes","json"),e("ip","text"),n()],[t("activity",["collection","document_id"]),t("activity",["actor_id"]),t("activity",["created_at"])])}function D(){return s("jobs",[l(),e("type","text",{nullable:!1}),e("payload","json"),e("status","text",{nullable:!1,default:"pending"}),e("run_at","timestamp",{nullable:!1}),e("attempts","integer",{nullable:!1,default:0}),e("locked_at","timestamp"),e("locked_by","text"),e("completed_at","timestamp"),e("error","text"),n()],[t("jobs",["status","run_at"]),t("jobs",["type"])])}
+export{z,nt,ot,yo};

package/dist/index-4j1kkeg2.js

@@ -0,0 +1,2 @@
+import{e}from"./index-x72d1hzh.js";function Vn(n){let t=x(n),i=/UNIQUE constraint failed: (.*)/.exec(t)?.[1];if(i===void 0)return null;let s=/^index '([^']+)'/.exec(i)?.[1];if(s!==void 0)return{index:s};let r=(/^[\w.]+(?:, [\w.]+)*/.exec(i)?.[0]??"").split(", ").map((o)=>o.slice(o.lastIndexOf(".")+1)).filter(Boolean);return r.length>0?{columns:r}:{}}function Gn(n){if(typeof n!=="object"||n===null)return null;let t=n;if(t.code!=="23505")return null;let i=t.constraint??t.constraint_name,s=typeof i==="string"?i:/unique constraint "([^"]+)"/.exec(x(n))?.[1];return s===void 0?{}:{index:s}}function Kn(n){let t=x(n);if(n?.code!==11000&&!t.startsWith("E11000"))return null;let s=/index: (\S+)/.exec(t)?.[1];return s===void 0?{}:{index:s}}function at(n,t,i,s,r){let o=(u,d)=>new e(u,{status:409,code:"conflict",cause:r,...d===void 0?{}:{details:d}}),l=n.tables.find((u)=>u.name===t),c=y(n,t,i);if(c?.where?.column==="collection"){let u=n.collections.find((g)=>g.slug===c.where?.equals&&g.table===c.table),d=c.targets.length===1?c.targets[0]:void 0,p=d?.kind==="json"?d.path.join("."):void 0;if(u!==void 0&&p!==void 0)return o(`${u.name}: ${p} is already used by another document, possibly one in the trash.`,{fields:{[p]:"is already used by another document"}})}let a=c?.targets.map((u)=>u.column)??i.columns??[],f=l?.primaryKey??[],m=n.collections.some((u)=>u.table===t)?"A document":`A ${t} row`;if(i.index===`${t}_pkey`||i.index==="_id_"||a.length>0&&h(a,f)){let u=f.length===1?f[0]:void 0,d=u===void 0?void 0:s?.[u];return o(typeof d==="string"?`${m} with the id "${d}" already exists.`:`${m} with the same ${f.join(", ")||"key"} already exists.`)}return o(a.length>0?`${m} with the same ${a.join(", ")} already exists.`:`${m} with the same unique value already exists.`)}function y(n,t,i){let s=n.tables.flatMap((o)=>o.indexes);if(i.index!==void 0)return s.find((o)=>o.name===i.index);let r=i.columns;if(r===void 0)return;return s.find((o)=>o.table===t&&o.unique&&o.targets.every((l)=>l.kind==="column")&&h(o.targets.map((l)=>l.column),r))}function h(n,t){return n.length===t.length&&n.every((i)=>t.includes(i))}function x(n){return n instanceof Error?n.message:typeof n==="string"?n:""}
+export{Vn,Gn,Kn,at};

package/dist/{index-eqfcxn71.js → index-5j0cqm43.js}

@@ -1,2 +1,2 @@
-import{s,R,t,H,ae,m}from"./index-6m1kjq9g.js";import{ho,rt,It,Et,l,u}from"./index-axpzy2hj.js";import{Pe,pn,we,re,fo}from"./index-p2cqsmvw.js";import{w}from"./index-rw0hze6x.js";import{x}from"./index-2ddk43me.js";import{b}from"./index-8nzmqy0f.js";import{e}from"./index-x72d1hzh.js";var Nn={github:{id:"github",endpoints:{authorization:"https://github.com/login/oauth/authorize",token:"https://github.com/login/oauth/access_token",userinfo:"https://api.github.com/user"},scope:"read:user user:email",pkce:!1,async profile(c,f){let p=await pe(f,"https://api.github.com/user",c.accessToken),g=typeof p.email==="string"?p.email:await Me(f,c.accessToken);return{id:String(p.id??""),email:g,name:M(p.name)??M(p.login),avatarUrl:M(p.avatar_url),claims:p}}},google:{id:"google",endpoints:{authorization:"https://accounts.google.com/o/oauth2/v2/auth",token:"https://oauth2.googleapis.com/token",userinfo:"https://openidconnect.googleapis.com/v1/userinfo"},scope:"openid email profile",pkce:!0,async profile(c,f){let p=c.idToken?$t(c.idToken):await pe(f,"https://openidconnect.googleapis.com/v1/userinfo",c.accessToken);return X(p)}},microsoft:{id:"microsoft",endpoints:{authorization:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",token:"https://login.microsoftonline.com/common/oauth2/v2.0/token",userinfo:"https://graph.microsoft.com/oidc/userinfo"},scope:"openid email profile",pkce:!0,async profile(c,f){let p=c.idToken?$t(c.idToken):await pe(f,"https://graph.microsoft.com/oidc/userinfo",c.accessToken);return X(p)}}};function X(c){return{id:String(c.sub??""),email:M(c.email),name:M(c.name)??M(c.preferred_username),avatarUrl:M(c.picture),claims:c}}function $t(c){let f=c.split(".")[1];if(!f)return{};let p=f.replaceAll("-","+").replaceAll("_","/");try{let g=atob(p.padEnd(Math.ceil(p.length/4)*4,"=")),k=Uint8Array.from(g,(v)=>v.charCodeAt(0));return JSON.parse(new TextDecoder().decode(k))}catch{return{}}}var fe=new Map;function Ce(c,f){let p=`${x(c)}/.well-known/openid-configuration`,g=fe.get(p);if(g)return g;let k=(async()=>{let v=await f(p,{headers:{accept:"application/json"}});if(!v.ok)throw new e(`OIDC discovery failed for ${c} (${v.status})`,{status:502,code:"oidc_discovery_failed"});let T=await v.json();return{authorization:String(T.authorization_endpoint??""),token:String(T.token_endpoint??""),...typeof T.userinfo_endpoint==="string"?{userinfo:T.userinfo_endpoint}:{}}})();return fe.set(p,k),k.catch(()=>fe.delete(p)),k}function Ue(c){let f=new URL(c.endpoints.authorization);if(f.searchParams.set("response_type","code"),f.searchParams.set("client_id",c.clientId),f.searchParams.set("redirect_uri",c.redirectUri),f.searchParams.set("scope",c.scope),f.searchParams.set("state",c.state),c.codeChallenge)f.searchParams.set("code_challenge",c.codeChallenge),f.searchParams.set("code_challenge_method","S256");for(let[p,g]of Object.entries(c.extra??{}))f.searchParams.set(p,g);return f.toString()}async function Oe(c){return{verifier:c,challenge:await fo(c)}}async function xe(c){let f=new URLSearchParams({grant_type:"authorization_code",code:c.code,redirect_uri:c.redirectUri,client_id:c.clientId,client_secret:c.clientSecret});if(c.codeVerifier)f.set("code_verifier",c.codeVerifier);let p=await c.fetchImpl(c.endpoints.token,{method:"POST",headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:f.toString()}),g=await p.json().catch(()=>({}));if(!p.ok||typeof g.access_token!=="string"){let k=M(g.error_description)??M(g.error)??`HTTP ${p.status}`;throw new e(`OAuth token exchange failed: ${k}`,{status:401,code:"oauth_exchange_failed"})}return{accessToken:g.access_token,...typeof g.id_token==="string"?{idToken:g.id_token}:{},...typeof g.token_type==="string"?{tokenType:g.token_type}:{}}}async function pe(c,f,p){let g=await c(f,{headers:{authorization:`Bearer ${p}`,accept:"application/json","user-agent":"heyo-cms"}});if(!g.ok)throw new e(`OAuth profile request failed (${g.status})`,{status:502,code:"oauth_profile_failed"});return await g.json()}async function Me(c,f){let p=await c("https://api.github.com/user/emails",{headers:{authorization:`Bearer ${f}`,accept:"application/json","user-agent":"heyo-cms"}});if(!p.ok)return null;let g=await p.json();return(g.find((v)=>v.primary&&v.verified)??g.find((v)=>v.verified))?.email??null}function M(c){return typeof c==="string"&&c.length>0?c:null}function Un(){return qe(crypto.getRandomValues(new Uint8Array(20)))}function Jn(c){let f=`${encodeURIComponent(c.issuer)}:${encodeURIComponent(c.account)}`,p=new URLSearchParams({secret:c.secret,issuer:c.issuer,algorithm:"SHA1",digits:String(6),period:String(30)});return`otpauth://totp/${f}?${p.toString()}`}async function Qo(c,f=Date.now()){return De(c,Math.floor(f/1000/30))}async function cn(c,f,p={}){if(!c)return!1;let g=f.replaceAll(/\s/g,"");if(!/^\d{6}$/.test(g))return!1;let k=Math.floor((p.at??Date.now())/1000/30),v=p.window??1;for(let T=-v;T<=v;T+=1){let C=await De(c,k+T),U=0;for(let E=0;E<C.length;E+=1)U|=C.charCodeAt(E)^g.charCodeAt(E);if(U===0)return!0}return!1}async function De(c,f){let p=await crypto.subtle.importKey("raw",Ne(c),{name:"HMAC",hash:"SHA-1"},!1,["sign"]),g=new Uint8Array(8),k=f;for(let U=7;U>=0;U-=1)g[U]=k&255,k=Math.floor(k/256);let v=new Uint8Array(await crypto.subtle.sign("HMAC",p,g)),T=(v[v.length-1]??0)&15,C=((v[T]??0)&127)<<24|((v[T+1]??0)&255)<<16|((v[T+2]??0)&255)<<8|(v[T+3]??0)&255;return String(C%1e6).padStart(6,"0")}function qe(c){let f=0,p=0,g="";for(let k of c){p=p<<8|k,f+=8;while(f>=5)g+="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"[p>>>f-5&31],f-=5}if(f>0)g+="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"[p<<5-f&31];return g}function Ne(c){let f=c.replaceAll("=","").replaceAll(/\s/g,"").toUpperCase(),p=[],g=0,k=0;for(let v of f){let T="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567".indexOf(v);if(T===-1)continue;if(k=k<<5|T,g+=5,g>=8)p.push(k>>>g-8&255),g-=8}return new Uint8Array(p)}var A="cms_users",z="cms_sessions",q="cms_tokens",he="cms_accounts",V="cms_api_keys",N="cms_roles",be="heyo_cms_session",dn="hck_",Je={session:"7d",invite:"7d",magicLink:"15m",passwordReset:"1h",twoFactor:"10m",oauth:"10m"},Be=8,$e=5,Ke=/^[^@\s]+@[^@\s.]+\.[^@\s]+$/,He=/^[a-z][a-z0-9_-]*$/,Ve=1e4;function un(c){let{config:f}=c,p=c.fetch??((...n)=>fetch(...n)),g,k=()=>g??=Pe(we(16)),v,T=!1,C=()=>f.admin.auth,U=(n,i)=>w(i??Je[n]),E=(n)=>{let i=C();if(!i||!i.methods.includes(n))throw new e(`The "${n}" sign-in method is not enabled; add it to admin.auth.methods`,{status:400,code:"method_not_enabled"});return i};async function y(n){let i=await c.database();return i.transaction((r)=>n(r,i))}async function O(n,i,r,o){return(await i.query(n,{table:r,where:o,limit:1}))[0]??null}async function B(n,i,r,o){let d=(await i.mutate(n,{kind:"insert",table:r,values:o})).rows[0];if(!d)throw new e(`Insert into ${r} returned no row.`,{status:500,code:"insert_without_row"});return d}async function S(n,i,r,o,a){return(await i.mutate(n,{kind:"update",table:r,where:o,set:a,returning:!1})).count}async function F(n,i,r,o){return(await i.mutate(n,{kind:"delete",table:r,where:o})).count}async function j(n,i,r,o=null){let a={type:i,data:r,previous:null},d={actor:o};await c.emit(n,[a],d)}async function le(){let n=f.rbac?.roles??{};if(f.rbac?.customRoles!==!0)return n;let i=Date.now();if(v&&i-v.at<Ve)return v.map;let r=await y((d,h)=>h.query(d,{table:N})),o={};for(let d of r)o[String(d.name)]=J(d.permissions);let a={...o,...n};return v={at:i,map:a},a}async function Z(n){let i=n.roles.length>0?n.roles:f.rbac?.defaultRole?[f.rbac.defaultRole]:[];return{id:n.id,source:"session",roles:i,permissions:rt(i,await le())}}async function Y(n,i,r){let o=r.token??we(),a=new Date(Date.now()+r.ttlMs);return await B(n,i,q,{id:b("tok"),type:r.type,user_id:r.userId??null,email:r.email??null,token_hash:await re(o),data:r.data??null,expires_at:a,consumed_at:null,created_at:new Date}),{token:o,expiresAt:a}}async function _e(n,i,r,o){let a=await O(n,i,q,s(t("token_hash",await re(o)),t("type",r)));if(!a||ye(a.expires_at))throw e.unauthorized("This link is invalid or has expired");if(a.consumed_at!==null)throw e.unauthorized("This link has already been used");return a}async function ve(n,i,r){if(await S(n,i,q,s(t("id",String(r.id)),t("consumed_at",null)),{consumed_at:new Date})!==1)throw e.unauthorized("This link has already been used")}async function ee(n,i,r,o){let a=await _e(n,i,r,o);return await ve(n,i,a),a}async function te(n,i,r,o){let a=we(),d=new Date,h=new Date(d.getTime()+U("session",C()?.session?.expiresIn)),_=await B(n,i,z,{id:b("ses"),user_id:r.id,token_hash:await re(a),ip:o.ip??null,user_agent:o.userAgent??null,expires_at:h,created_at:d});return await S(n,i,A,t("id",r.id),{last_login_at:d}),{status:"signed-in",token:a,expiresAt:h.toISOString(),session:ge(_),user:{...r,lastLoginAt:d.toISOString()},actor:await Z(r)}}async function ne(n,i,r,o){if(!r.twoFactorEnabled)return te(n,i,r,o);let a=await Y(n,i,{type:"two-factor",ttlMs:U("twoFactor",void 0),userId:r.id,email:r.email});return{status:"two-factor-required",challenge:a.token,expiresAt:a.expiresAt.toISOString(),userId:r.id}}async function D(n,i,r){let o=await O(n,i,A,t("id",r));return o?W(o):null}async function K(n,i,r){let o=await O(n,i,A,t("email",ce(r)));return o?{user:W(o),row:o}:null}function se(n){if(n.status==="disabled")throw e.forbidden("This account has been disabled")}async function ke(n){let i=C();if(n==="oidc"){let a=i?.sso;if(!a)throw new e("SSO is not configured; set admin.auth.sso",{status:400,code:"method_not_enabled"});let d=await Ce(a.issuer,p),h=Ae("oidc",{...a.clientId===void 0?{}:{clientId:a.clientId},...a.clientSecret===void 0?{}:{clientSecret:a.clientSecret}});return{id:"oidc",endpoints:d,scope:a.scope??"openid email profile",pkce:!0,...h,provision:a.provision!==!1,...a.mapRoles?{mapRoles:a.mapRoles}:{},profile:async(_)=>_.idToken?X($t(_.idToken)):X(await je(d,_.accessToken))}}E(n);let r=Nn[n];if(!r)throw new e(`Unknown OAuth provider "${n}"`,{status:400,code:"unknown_provider"});let o=Ae(n);return{id:n,endpoints:r.endpoints,scope:i?.providers?.[n]?.scope??r.scope,pkce:r.pkce,...o,provision:!1,profile:r.profile}}async function je(n,i){if(!n.userinfo)return{};let r=await p(n.userinfo,{headers:{authorization:`Bearer ${i}`,accept:"application/json"}});if(!r.ok)return{};return await r.json()}function Ae(n,i={}){let r=C()?.providers?.[n],o=n.toUpperCase(),a=i.clientId??r?.clientId??ue(`HEYO_CMS_${o}_CLIENT_ID`)??ue(`${o}_CLIENT_ID`),d=i.clientSecret??r?.clientSecret??ue(`HEYO_CMS_${o}_CLIENT_SECRET`)??ue(`${o}_CLIENT_SECRET`);if(!a||!d)throw new e(`No credentials for "${n}": set admin.auth.providers.${n} or ${o}_CLIENT_ID and ${o}_CLIENT_SECRET`,{status:500,code:"provider_not_configured"});return{clientId:a,clientSecret:d}}async function ze(n,i,r,o){let a=await O(n,i,he,s(t("provider",r.id),t("provider_account_id",o.id)));if(a){let P=await D(n,i,String(a.user_id));if(!P)throw e.unauthorized("The linked account no longer exists");return Te(n,i,r,o,P)}let d=o.email?ce(o.email):null;if(!d)throw new e(`${r.id} did not return a verified email address, so the account cannot be matched`,{status:400,code:"oauth_without_email"});let _=(await K(n,i,d))?.user??null;if(!_){if(!r.provision)throw e.forbidden(`No CMS account for ${d}. An administrator has to invite this address first.`);_=await ie(n,i,{email:d,...o.name?{name:o.name}:{},roles:r.mapRoles?r.mapRoles(o.claims):f.rbac?.defaultRole?[f.rbac.defaultRole]:[],status:"active"}),await j(n,"user.joined",{userId:_.id,email:d,provider:r.id,provisioned:!0})}else if(_.status==="invited")await S(n,i,A,t("id",_.id),{status:"active",updated_at:new Date}),_={..._,status:"active"},await j(n,"user.joined",{userId:_.id,email:_.email});return await B(n,i,he,{id:b("acc"),user_id:_.id,provider:r.id,provider_account_id:o.id,email:d,created_at:new Date,updated_at:new Date}),Te(n,i,r,o,_)}async function Te(n,i,r,o,a){if(!r.mapRoles)return a;let d=r.mapRoles(o.claims);if(Fe(d,a.roles))return a;return await S(n,i,A,t("id",a.id),{roles:d,updated_at:new Date}),await j(n,"role.changed",{userId:a.id,roles:d,previous:a.roles,source:r.id}),{...a,roles:d}}async function ie(n,i,r){let o=ce(r.email);if(await O(n,i,A,t("email",o)))throw e.conflict(`A user with the email ${o} already exists`);if(r.password!==void 0)G(r.password);let d=new Date,h=await B(n,i,A,{id:b("usr"),email:o,name:r.name??null,password_hash:r.password===void 0?null:await Pe(r.password),two_factor_secret:null,two_factor_enabled:!1,status:r.status??"active",roles:r.roles??[],avatar_url:null,locale:r.locale??null,last_login_at:null,created_at:d,updated_at:d});return W(h)}function G(n){let i=C()?.password?.minLength??Be;if(n.length<i)throw e.validation(`The password must be at least ${i} characters`)}function Se(){let n=C();if(!n||!n.methods.includes("password"))return null;let i=n.firstUser??!0;if(i===!1)return null;if(i!==!0&&i.roles)return i.roles;let r=f.rbac?.roles;if(!r||"admin"in r)return["admin"];let o=Object.entries(r).find(([,a])=>a.includes(ho));return o?[o[0]]:["admin"]}async function oe(n){if(n.length===0||!f.rbac)return;let i=await le(),r=n.filter((o)=>!(o in i));if(r.length>0)throw e.validation(`Unknown role ${r.map((o)=>`"${o}"`).join(", ")}`)}let Q={async actorFromRequest(n){let i=n.headers.get("authorization"),o=(i?.toLowerCase().startsWith("bearer ")?i.slice(7).trim():null)??We(n,be);return o?Q.actorFromToken(o):null},async actorFromToken(n){if(n.startsWith(dn))return Q.apiKeys.verify(n);return(await Q.sessions.verify(n))?.actor??null},actorForUser:Z,users:{async list(n={}){let i=[];if(n.status)i.push(t("status",n.status));if(n.search){let o=`%${n.search}%`;i.push(R(ae("email",o,!0),ae("name",o,!0)))}return(await y((o,a)=>a.query(o,{table:A,...i.length>0?{where:s(...i)}:{},orderBy:[m("created_at","asc"),m("id","asc")],limit:n.limit??50,...n.offset===void 0?{}:{offset:n.offset}}))).map(W)},async get(n){return y((i,r)=>D(i,r,n))},async byEmail(n){return y(async(i,r)=>(await K(i,r,n))?.user??null)},async count(){let n=await y((i,r)=>r.query(i,{table:A,count:!0}));return Number(n[0]?.count??0)},async create(n){return await oe(n.roles??[]),y((i,r)=>ie(i,r,n))},async update(n,i){if(i.roles)await oe(i.roles);let r=await y(async(o,a)=>{let d=await D(o,a,n);if(!d)throw e.notFound(`No user with id "${n}"`);let h={updated_at:new Date};if(i.name!==void 0)h.name=i.name;if(i.status!==void 0)h.status=i.status;if(i.locale!==void 0)h.locale=i.locale;if(i.avatarUrl!==void 0)h.avatar_url=i.avatarUrl;if(i.roles!==void 0)h.roles=i.roles;if(await S(o,a,A,t("id",n),h),i.roles&&!Fe(i.roles,d.roles))await j(o,"role.changed",{userId:n,roles:i.roles,previous:d.roles},i.actor??null);if(i.status==="disabled")await F(o,a,z,t("user_id",n));return await D(o,a,n)});return c.deliver(),r},async remove(n,i={}){await y(async(r,o)=>{let a=await D(r,o,n);if(!a)throw e.notFound(`No user with id "${n}"`);for(let d of[z,q,he,V])await F(r,o,d,t("user_id",n));await F(r,o,A,t("id",n)),await j(r,"user.removed",{userId:n,email:a.email},i.actor??null)}),c.deliver()},async setPassword(n,i){G(i),await y(async(r,o)=>{let a=await Pe(i);if(await S(r,o,A,t("id",n),{password_hash:a,updated_at:new Date})===0)throw e.notFound(`No user with id "${n}"`);await F(r,o,z,t("user_id",n))})},async invite(n){await oe(n.roles??[]);let i=await y(async(r,o)=>{let a=ce(n.email),d=await K(r,o,a);if(d&&d.user.status==="active")throw e.conflict(`${a} is already an active user`);let h=d?.user??await ie(r,o,{email:a,...n.name?{name:n.name}:{},roles:n.roles??(f.rbac?.defaultRole?[f.rbac.defaultRole]:[]),status:"invited"}),_=await Y(r,o,{type:"invite",ttlMs:U("invite",C()?.invites?.expiresIn),userId:h.id,email:a});return await j(r,"user.invited",{userId:h.id,email:a,roles:h.roles},n.actor??null),{user:h,token:_.token,expiresAt:_.expiresAt.toISOString(),userId:h.id,email:a}});return c.deliver(),i},async acceptInvite(n){let i=await y(async(r,o)=>{let a=await ee(r,o,"invite",n.token),d=await D(r,o,String(a.user_id));if(!d)throw e.unauthorized("This invitation is no longer valid");let h={status:"active",updated_at:new Date};if(n.password!==void 0)G(n.password),h.password_hash=await Pe(n.password);if(n.name!==void 0)h.name=n.name;await S(r,o,A,t("id",d.id),h);let _={...d,status:"active",...n.name===void 0?{}:{name:n.name}};return await j(r,"user.joined",{userId:d.id,email:d.email}),te(r,o,_,n)});return c.deliver(),i}},setup:{async required(){if(Se()===null)return!1;if(T)return!1;let n=await Q.users.count();if(n>0)T=!0;return n===0},async claim(n){let i=Se();if(i===null)throw e.forbidden("This deployment does not accept a first account over HTTP; use heyo-cms create-admin");try{await oe(i)}catch(o){if(o instanceof e&&o.code==="validation_failed")throw e.validation(`The first account would be given the role ${i.map((a)=>`"${a}"`).join(", ")}, which rbac.roles does not define; set admin.auth.firstUser.roles`);throw o}G(n.password);let r=await y(async(o,a)=>{let d=await a.query(o,{table:A,count:!0});if(Number(d[0]?.count??0)>0)throw e.conflict("This CMS already has an account; sign in instead");let h=await ie(o,a,{email:n.email,password:n.password,roles:i,status:"active",...n.name===void 0?{}:{name:n.name}});return await j(o,"user.joined",{userId:h.id,email:h.email,first:!0}),te(o,a,h,n)});return T=!0,c.deliver(),r}},sessions:{async verify(n){return y(async(i,r)=>{let o=await O(i,r,z,t("token_hash",await re(n)));if(!o||ye(o.expires_at))return null;let a=await D(i,r,String(o.user_id));if(!a||a.status!=="active")return null;return{status:"signed-in",token:n,expiresAt:l(o.expires_at)??"",session:ge(o),user:a,actor:await Z(a)}})},async list(n){return(await y((r,o)=>o.query(r,{table:z,where:t("user_id",n),orderBy:[m("created_at","desc")]}))).map(ge)},async revoke(n){let i=await re(n);return await y((o,a)=>F(o,a,z,t("token_hash",i)))>0},async revokeById(n){return await y((r,o)=>F(r,o,z,t("id",n)))>0},async revokeAll(n){return y((i,r)=>F(i,r,z,t("user_id",n)))},async cleanup(){let n=new Date;return y(async(i,r)=>{let o=await F(i,r,z,H("expires_at",n));return await F(i,r,q,H("expires_at",n)),o})}},password:{async signIn(n){E("password");let i=await y(async(r,o)=>{let a=await K(r,o,n.email),d=a?a.row.password_hash:await k(),h=await pn(n.password,d);if(!a||!h)throw e.unauthorized("Invalid email or password");if(se(a.user),a.user.status==="invited")throw e.forbidden("This invitation has not been accepted yet");return ne(r,o,a.user,n)});return c.deliver(),i},async requestReset(n){return E("password"),y(async(i,r)=>{let o=await K(i,r,n.email);if(!o||o.user.status==="disabled")return null;let a=await Y(i,r,{type:"password-reset",ttlMs:U("passwordReset",C()?.passwordReset?.expiresIn),userId:o.user.id,email:o.user.email});return{token:a.token,expiresAt:a.expiresAt.toISOString(),userId:o.user.id,email:o.user.email}})},async reset(n){return E("password"),G(n.password),y(async(i,r)=>{let o=await ee(i,r,"password-reset",n.token),a=String(o.user_id);await S(i,r,A,t("id",a),{password_hash:await Pe(n.password),status:"active",updated_at:new Date}),await F(i,r,z,t("user_id",a));let d=await D(i,r,a);if(!d)throw e.unauthorized("This link is no longer valid");return d})}},magicLink:{async request(n){return E("magic-link"),y(async(i,r)=>{let o=await K(i,r,n.email);if(!o||o.user.status==="disabled")return null;let a=await Y(i,r,{type:"magic-link",ttlMs:U("magicLink",C()?.magicLink?.expiresIn),userId:o.user.id,email:o.user.email});return{token:a.token,expiresAt:a.expiresAt.toISOString(),userId:o.user.id,email:o.user.email}})},async verify(n){E("magic-link");let i=await y(async(r,o)=>{let a=await ee(r,o,"magic-link",n.token),d=await D(r,o,String(a.user_id));if(!d)throw e.unauthorized("This link is no longer valid");if(se(d),d.status==="invited")return await S(r,o,A,t("id",d.id),{status:"active",updated_at:new Date}),await j(r,"user.joined",{userId:d.id,email:d.email}),ne(r,o,{...d,status:"active"},n);return ne(r,o,d,n)});return c.deliver(),i}},oauth:{async authorize(n){let i=await ke(n.provider),r=we(24),o=we(),a=i.pkce?(await Oe(o)).challenge:void 0;return await y((d,h)=>Y(d,h,{type:"oauth",ttlMs:U("oauth",void 0),token:r,data:{provider:i.id,redirectUri:n.redirectUri,verifier:o,redirectTo:n.redirectTo??null}})),{url:Ue({endpoints:i.endpoints,clientId:i.clientId,redirectUri:n.redirectUri,scope:i.scope,state:r,...a===void 0?{}:{codeChallenge:a}}),state:r}},async callback(n){let i=await ke(n.provider),r=await y(async(o,a)=>{let d=await ee(o,a,"oauth",n.state),h=u(d.data);if(h.provider!==i.id)throw e.unauthorized("This sign-in request does not match");if(h.redirectUri!==n.redirectUri)throw e.unauthorized("The redirect URI does not match");let _=await xe({endpoints:i.endpoints,clientId:i.clientId,clientSecret:i.clientSecret,code:n.code,redirectUri:n.redirectUri,...i.pkce&&typeof h.verifier==="string"?{codeVerifier:h.verifier}:{},fetchImpl:p}),P=await i.profile(_,p),I=await ze(o,a,i,P);return se(I),{...await ne(o,a,I,n),redirectTo:typeof h.redirectTo==="string"?h.redirectTo:null}});return c.deliver(),r}},twoFactor:{async begin(n){let i=Un();return y(async(r,o)=>{let a=await D(r,o,n);if(!a)throw e.notFound(`No user with id "${n}"`);if(a.twoFactorEnabled)throw e.conflict("Disable the existing authenticator before enrolling another.");return await S(r,o,A,t("id",n),{two_factor_secret:i,updated_at:new Date}),{secret:i,uri:Jn({secret:i,account:a.email,issuer:f.admin.title??"Heyo CMS"})}})},async enable(n){return y(async(i,r)=>{let o=await O(i,r,A,t("id",n.userId));if(!o)throw e.notFound(`No user with id "${n.userId}"`);let a=o.two_factor_secret;if(!a)throw e.validation("Start the setup before enabling it");if(!await cn(a,n.code))throw e.unauthorized("That code is not valid");return await S(i,r,A,t("id",n.userId),{two_factor_enabled:!0,updated_at:new Date}),{...W(o),twoFactorEnabled:!0}})},async disable(n){return y(async(i,r)=>{if(await S(i,r,A,t("id",n),{two_factor_enabled:!1,two_factor_secret:null,updated_at:new Date})===0)throw e.notFound(`No user with id "${n}"`);return await D(i,r,n)})},async complete(n){let i=await y(async(r,o)=>{let a=await _e(r,o,"two-factor",n.challenge),d=await O(r,o,A,t("id",String(a.user_id)));if(!d)throw e.unauthorized("This challenge is no longer valid");if(!await cn(d.two_factor_secret,n.code)){let P=a;for(let I=0;I<$e;I+=1){let L=u(P.data).attempts,Ie=typeof L==="number"?L:null,Re=Number(Ie??0)+1;if(await S(r,o,q,s(t("id",String(P.id)),t("consumed_at",null),t("data.attempts",Ie)),{data:{...u(P.data),attempts:Re},...Re>=$e?{consumed_at:new Date}:{}})===1)break;let me=await O(r,o,q,t("id",String(P.id)));if(!me||me.consumed_at!==null)break;P=me}return null}await ve(r,o,a);let _=W(d);return se(_),te(r,o,_,n)});if(i===null)throw e.unauthorized("That code is not valid");return c.deliver(),i}},apiKeys:{async create(n){let i=C()?.apiKeys;if(!i?.enabled)throw new e("API keys are not enabled; set admin.auth.apiKeys.enabled",{status:400,code:"method_not_enabled"});let r=n.scopes??i.scopes??["read"],o=i.scopes;if(o){let P=r.filter((I)=>!o.includes(I));if(P.length>0)throw e.validation(`Scope ${P.map((I)=>`"${I}"`).join(", ")} is not in admin.auth.apiKeys.scopes`)}let a=`${dn}${we()}`,d=n.expiresIn??i.expiresIn,h=d?new Date(Date.now()+w(d)):null,_=await y(async(P,I)=>{let L=await B(P,I,V,{id:b("key"),name:n.name,user_id:n.userId??null,key_hash:await re(a),prefix:a.slice(0,dn.length+6),scopes:r,last_used_at:null,expires_at:h,revoked_at:null,created_at:new Date});return await j(P,"apikey.created",{id:String(L.id),name:n.name,scopes:r,userId:n.userId??null},n.actor??null),Ee(L)});return c.deliver(),{..._,key:a}},async list(n={}){return(await y((r,o)=>o.query(r,{table:V,...n.userId?{where:t("user_id",n.userId)}:{},orderBy:[m("created_at","desc")]}))).map(Ee)},async revoke(n,i={}){let r=await y(async(o,a)=>{let d=await S(o,a,V,s(t("id",n),t("revoked_at",null)),{revoked_at:new Date});if(d>0)await j(o,"apikey.revoked",{id:n},i.actor??null);return d>0});return c.deliver(),r},async verify(n){return y(async(i,r)=>{let o=await O(i,r,V,t("key_hash",await re(n)));if(!o)return null;if(o.revoked_at!==null)return null;if(o.expires_at!==null&&ye(o.expires_at))return null;let a=J(o.scopes),d=Et(a),h=[],_=d,P=String(o.id);if(o.user_id!==null&&o.user_id!==void 0){let I=await D(i,r,String(o.user_id));if(!I||I.status!=="active")return null;let L=await Z(I);h=L.roles,_=It(L.permissions,d),P=I.id}return await S(i,r,V,t("id",String(o.id)),{last_used_at:new Date}),{id:P,source:"api-key",roles:h,permissions:_}})}},roles:{async list(){let n=Object.entries(f.rbac?.roles??{}).map(([a,d])=>({name:a,label:null,permissions:d,source:"config"}));if(f.rbac?.customRoles!==!0)return n;let i=await y((a,d)=>d.query(a,{table:N,orderBy:[m("name")]})),r=new Set(n.map((a)=>a.name)),o=i.filter((a)=>!r.has(String(a.name))).map((a)=>({name:String(a.name),label:a.label??null,permissions:J(a.permissions),source:"database"}));return[...n,...o].sort((a,d)=>a.name.localeCompare(d.name))},async create(n){if(de(),Le(n.name),f.rbac?.roles[n.name])throw e.conflict(`"${n.name}" is defined in the configuration; change it there`);let i=await y(async(r,o)=>{if(await O(r,o,N,t("name",n.name)))throw e.conflict(`The role "${n.name}" already exists`);return B(r,o,N,{id:b("rol"),name:n.name,label:n.label??null,permissions:n.permissions,created_at:new Date,updated_at:new Date})});return v=void 0,{name:String(i.name),label:i.label??null,permissions:J(i.permissions),source:"database"}},async update(n,i){de();let r=await y(async(o,a)=>{let d={updated_at:new Date};if(i.permissions)d.permissions=i.permissions;if(i.label!==void 0)d.label=i.label;if(await S(o,a,N,t("name",n),d)===0)throw e.notFound(`No role named "${n}"`);return O(o,a,N,t("name",n))});return v=void 0,{name:n,label:r?.label??null,permissions:J(r?.permissions),source:"database"}},async remove(n){de();let i=await y((r,o)=>F(r,o,N,t("name",n)));return v=void 0,i>0},async permissionsFor(n){return rt(n,await le())}}};function de(){if(f.rbac?.customRoles!==!0)throw new e("Roles are defined in the configuration; set rbac.customRoles to manage them in the panel",{status:400,code:"custom_roles_disabled"})}function Le(n){if(!He.test(n))throw e.validation(`"${n}" is not a role name; use lowercase letters, digits, dashes and underscores`)}return Q}function W(c){return{id:String(c.id),email:String(c.email),name:c.name??null,status:c.status??"active",roles:J(c.roles),avatarUrl:c.avatar_url??null,locale:c.locale??null,twoFactorEnabled:c.two_factor_enabled===!0,lastLoginAt:l(c.last_login_at),createdAt:l(c.created_at)??"",updatedAt:l(c.updated_at)??""}}function ge(c){return{id:String(c.id),userId:String(c.user_id),expiresAt:l(c.expires_at)??"",createdAt:l(c.created_at)??"",ip:c.ip??null,userAgent:c.user_agent??null}}function Ee(c){return{id:String(c.id),name:String(c.name),prefix:String(c.prefix),userId:c.user_id??null,scopes:J(c.scopes),lastUsedAt:l(c.last_used_at),expiresAt:l(c.expires_at),revokedAt:l(c.revoked_at),createdAt:l(c.created_at)??""}}function J(c){if(!Array.isArray(c))return[];return c.filter((f)=>typeof f==="string")}function ye(c){if(c===null||c===void 0)return!1;return(c instanceof Date?c:new Date(String(c))).getTime()<=Date.now()}function ce(c){let f=c.trim().toLowerCase();if(!Ke.test(f))throw e.validation(`"${c}" is not an email address`);return f}function Fe(c,f){if(c.length!==f.length)return!1;let p=[...f].sort();return[...c].sort().every((g,k)=>g===p[k])}function We(c,f){let p=c.headers.get("cookie");if(!p)return null;for(let g of p.split(";")){let k=g.indexOf("=");if(k===-1)continue;if(g.slice(0,k).trim()!==f)continue;return decodeURIComponent(g.slice(k+1).trim())}return null}function ue(c){return globalThis.process?.env?.[c]}
-export{Nn,$t,Un,Jn,Qo,cn,be,dn,un};
+import{s,R,t,H,ae,m}from"./index-q6jkbsjp.js";import{wo,rt,Et,Mt,l,u}from"./index-pkxgzw6e.js";import{Pe,mn,we,re,bo}from"./index-cnzt9x9x.js";import{w}from"./index-rw0hze6x.js";import{x}from"./index-2ddk43me.js";import{b}from"./index-qgtvymh2.js";import{e}from"./index-x72d1hzh.js";var Un={github:{id:"github",endpoints:{authorization:"https://github.com/login/oauth/authorize",token:"https://github.com/login/oauth/access_token",userinfo:"https://api.github.com/user"},scope:"read:user user:email",pkce:!1,async profile(c,f){let p=await pe(f,"https://api.github.com/user",c.accessToken),g=typeof p.email==="string"?p.email:await Me(f,c.accessToken);return{id:String(p.id??""),email:g,name:M(p.name)??M(p.login),avatarUrl:M(p.avatar_url),claims:p}}},google:{id:"google",endpoints:{authorization:"https://accounts.google.com/o/oauth2/v2/auth",token:"https://oauth2.googleapis.com/token",userinfo:"https://openidconnect.googleapis.com/v1/userinfo"},scope:"openid email profile",pkce:!0,async profile(c,f){let p=c.idToken?jt(c.idToken):await pe(f,"https://openidconnect.googleapis.com/v1/userinfo",c.accessToken);return X(p)}},microsoft:{id:"microsoft",endpoints:{authorization:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",token:"https://login.microsoftonline.com/common/oauth2/v2.0/token",userinfo:"https://graph.microsoft.com/oidc/userinfo"},scope:"openid email profile",pkce:!0,async profile(c,f){let p=c.idToken?jt(c.idToken):await pe(f,"https://graph.microsoft.com/oidc/userinfo",c.accessToken);return X(p)}}};function X(c){return{id:String(c.sub??""),email:M(c.email),name:M(c.name)??M(c.preferred_username),avatarUrl:M(c.picture),claims:c}}function jt(c){let f=c.split(".")[1];if(!f)return{};let p=f.replaceAll("-","+").replaceAll("_","/");try{let g=atob(p.padEnd(Math.ceil(p.length/4)*4,"=")),k=Uint8Array.from(g,(v)=>v.charCodeAt(0));return JSON.parse(new TextDecoder().decode(k))}catch{return{}}}var fe=new Map;function Ce(c,f){let p=`${x(c)}/.well-known/openid-configuration`,g=fe.get(p);if(g)return g;let k=(async()=>{let v=await f(p,{headers:{accept:"application/json"}});if(!v.ok)throw new e(`OIDC discovery failed for ${c} (${v.status})`,{status:502,code:"oidc_discovery_failed"});let T=await v.json();return{authorization:String(T.authorization_endpoint??""),token:String(T.token_endpoint??""),...typeof T.userinfo_endpoint==="string"?{userinfo:T.userinfo_endpoint}:{}}})();return fe.set(p,k),k.catch(()=>fe.delete(p)),k}function Ue(c){let f=new URL(c.endpoints.authorization);if(f.searchParams.set("response_type","code"),f.searchParams.set("client_id",c.clientId),f.searchParams.set("redirect_uri",c.redirectUri),f.searchParams.set("scope",c.scope),f.searchParams.set("state",c.state),c.codeChallenge)f.searchParams.set("code_challenge",c.codeChallenge),f.searchParams.set("code_challenge_method","S256");for(let[p,g]of Object.entries(c.extra??{}))f.searchParams.set(p,g);return f.toString()}async function Oe(c){return{verifier:c,challenge:await bo(c)}}async function xe(c){let f=new URLSearchParams({grant_type:"authorization_code",code:c.code,redirect_uri:c.redirectUri,client_id:c.clientId,client_secret:c.clientSecret});if(c.codeVerifier)f.set("code_verifier",c.codeVerifier);let p=await c.fetchImpl(c.endpoints.token,{method:"POST",headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:f.toString()}),g=await p.json().catch(()=>({}));if(!p.ok||typeof g.access_token!=="string"){let k=M(g.error_description)??M(g.error)??`HTTP ${p.status}`;throw new e(`OAuth token exchange failed: ${k}`,{status:401,code:"oauth_exchange_failed"})}return{accessToken:g.access_token,...typeof g.id_token==="string"?{idToken:g.id_token}:{},...typeof g.token_type==="string"?{tokenType:g.token_type}:{}}}async function pe(c,f,p){let g=await c(f,{headers:{authorization:`Bearer ${p}`,accept:"application/json","user-agent":"heyo-cms"}});if(!g.ok)throw new e(`OAuth profile request failed (${g.status})`,{status:502,code:"oauth_profile_failed"});return await g.json()}async function Me(c,f){let p=await c("https://api.github.com/user/emails",{headers:{authorization:`Bearer ${f}`,accept:"application/json","user-agent":"heyo-cms"}});if(!p.ok)return null;let g=await p.json();return(g.find((v)=>v.primary&&v.verified)??g.find((v)=>v.verified))?.email??null}function M(c){return typeof c==="string"&&c.length>0?c:null}function Jn(){return qe(crypto.getRandomValues(new Uint8Array(20)))}function Wn(c){let f=`${encodeURIComponent(c.issuer)}:${encodeURIComponent(c.account)}`,p=new URLSearchParams({secret:c.secret,issuer:c.issuer,algorithm:"SHA1",digits:String(6),period:String(30)});return`otpauth://totp/${f}?${p.toString()}`}async function nr(c,f=Date.now()){return De(c,Math.floor(f/1000/30))}async function dn(c,f,p={}){if(!c)return!1;let g=f.replaceAll(/\s/g,"");if(!/^\d{6}$/.test(g))return!1;let k=Math.floor((p.at??Date.now())/1000/30),v=p.window??1;for(let T=-v;T<=v;T+=1){let C=await De(c,k+T),U=0;for(let E=0;E<C.length;E+=1)U|=C.charCodeAt(E)^g.charCodeAt(E);if(U===0)return!0}return!1}async function De(c,f){let p=await crypto.subtle.importKey("raw",Ne(c),{name:"HMAC",hash:"SHA-1"},!1,["sign"]),g=new Uint8Array(8),k=f;for(let U=7;U>=0;U-=1)g[U]=k&255,k=Math.floor(k/256);let v=new Uint8Array(await crypto.subtle.sign("HMAC",p,g)),T=(v[v.length-1]??0)&15,C=((v[T]??0)&127)<<24|((v[T+1]??0)&255)<<16|((v[T+2]??0)&255)<<8|(v[T+3]??0)&255;return String(C%1e6).padStart(6,"0")}function qe(c){let f=0,p=0,g="";for(let k of c){p=p<<8|k,f+=8;while(f>=5)g+="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"[p>>>f-5&31],f-=5}if(f>0)g+="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"[p<<5-f&31];return g}function Ne(c){let f=c.replaceAll("=","").replaceAll(/\s/g,"").toUpperCase(),p=[],g=0,k=0;for(let v of f){let T="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567".indexOf(v);if(T===-1)continue;if(k=k<<5|T,g+=5,g>=8)p.push(k>>>g-8&255),g-=8}return new Uint8Array(p)}var A="cms_users",z="cms_sessions",q="cms_tokens",he="cms_accounts",V="cms_api_keys",N="cms_roles",be="heyo_cms_session",un="hck_",Je={session:"7d",invite:"7d",magicLink:"15m",passwordReset:"1h",twoFactor:"10m",oauth:"10m"},Be=8,$e=5,Ke=/^[^@\s]+@[^@\s.]+\.[^@\s]+$/,He=/^[a-z][a-z0-9_-]*$/,Ve=1e4;function pn(c){let{config:f}=c,p=c.fetch??((...n)=>fetch(...n)),g,k=()=>g??=Pe(we(16)),v,T=!1,C=()=>f.admin.auth,U=(n,i)=>w(i??Je[n]),E=(n)=>{let i=C();if(!i||!i.methods.includes(n))throw new e(`The "${n}" sign-in method is not enabled; add it to admin.auth.methods`,{status:400,code:"method_not_enabled"});return i};async function y(n){let i=await c.database();return i.transaction((r)=>n(r,i))}async function O(n,i,r,o){return(await i.query(n,{table:r,where:o,limit:1}))[0]??null}async function B(n,i,r,o){let d=(await i.mutate(n,{kind:"insert",table:r,values:o})).rows[0];if(!d)throw new e(`Insert into ${r} returned no row.`,{status:500,code:"insert_without_row"});return d}async function S(n,i,r,o,a){return(await i.mutate(n,{kind:"update",table:r,where:o,set:a,returning:!1})).count}async function F(n,i,r,o){return(await i.mutate(n,{kind:"delete",table:r,where:o})).count}async function j(n,i,r,o=null){let a={type:i,data:r,previous:null},d={actor:o};await c.emit(n,[a],d)}async function le(){let n=f.rbac?.roles??{};if(f.rbac?.customRoles!==!0)return n;let i=Date.now();if(v&&i-v.at<Ve)return v.map;let r=await y((d,h)=>h.query(d,{table:N})),o={};for(let d of r)o[String(d.name)]=J(d.permissions);let a={...o,...n};return v={at:i,map:a},a}async function Z(n){let i=n.roles.length>0?n.roles:f.rbac?.defaultRole?[f.rbac.defaultRole]:[];return{id:n.id,source:"session",roles:i,permissions:rt(i,await le())}}async function Y(n,i,r){let o=r.token??we(),a=new Date(Date.now()+r.ttlMs);return await B(n,i,q,{id:b("tok"),type:r.type,user_id:r.userId??null,email:r.email??null,token_hash:await re(o),data:r.data??null,expires_at:a,consumed_at:null,created_at:new Date}),{token:o,expiresAt:a}}async function _e(n,i,r,o){let a=await O(n,i,q,s(t("token_hash",await re(o)),t("type",r)));if(!a||ye(a.expires_at))throw e.unauthorized("This link is invalid or has expired");if(a.consumed_at!==null)throw e.unauthorized("This link has already been used");return a}async function ve(n,i,r){if(await S(n,i,q,s(t("id",String(r.id)),t("consumed_at",null)),{consumed_at:new Date})!==1)throw e.unauthorized("This link has already been used")}async function ee(n,i,r,o){let a=await _e(n,i,r,o);return await ve(n,i,a),a}async function te(n,i,r,o){let a=we(),d=new Date,h=new Date(d.getTime()+U("session",C()?.session?.expiresIn)),_=await B(n,i,z,{id:b("ses"),user_id:r.id,token_hash:await re(a),ip:o.ip??null,user_agent:o.userAgent??null,expires_at:h,created_at:d});return await S(n,i,A,t("id",r.id),{last_login_at:d}),{status:"signed-in",token:a,expiresAt:h.toISOString(),session:ge(_),user:{...r,lastLoginAt:d.toISOString()},actor:await Z(r)}}async function ne(n,i,r,o){if(!r.twoFactorEnabled)return te(n,i,r,o);let a=await Y(n,i,{type:"two-factor",ttlMs:U("twoFactor",void 0),userId:r.id,email:r.email});return{status:"two-factor-required",challenge:a.token,expiresAt:a.expiresAt.toISOString(),userId:r.id}}async function D(n,i,r){let o=await O(n,i,A,t("id",r));return o?W(o):null}async function K(n,i,r){let o=await O(n,i,A,t("email",ce(r)));return o?{user:W(o),row:o}:null}function se(n){if(n.status==="disabled")throw e.forbidden("This account has been disabled")}async function ke(n){let i=C();if(n==="oidc"){let a=i?.sso;if(!a)throw new e("SSO is not configured; set admin.auth.sso",{status:400,code:"method_not_enabled"});let d=await Ce(a.issuer,p),h=Ae("oidc",{...a.clientId===void 0?{}:{clientId:a.clientId},...a.clientSecret===void 0?{}:{clientSecret:a.clientSecret}});return{id:"oidc",endpoints:d,scope:a.scope??"openid email profile",pkce:!0,...h,provision:a.provision!==!1,...a.mapRoles?{mapRoles:a.mapRoles}:{},profile:async(_)=>_.idToken?X(jt(_.idToken)):X(await je(d,_.accessToken))}}E(n);let r=Un[n];if(!r)throw new e(`Unknown OAuth provider "${n}"`,{status:400,code:"unknown_provider"});let o=Ae(n);return{id:n,endpoints:r.endpoints,scope:i?.providers?.[n]?.scope??r.scope,pkce:r.pkce,...o,provision:!1,profile:r.profile}}async function je(n,i){if(!n.userinfo)return{};let r=await p(n.userinfo,{headers:{authorization:`Bearer ${i}`,accept:"application/json"}});if(!r.ok)return{};return await r.json()}function Ae(n,i={}){let r=C()?.providers?.[n],o=n.toUpperCase(),a=i.clientId??r?.clientId??ue(`HEYO_CMS_${o}_CLIENT_ID`)??ue(`${o}_CLIENT_ID`),d=i.clientSecret??r?.clientSecret??ue(`HEYO_CMS_${o}_CLIENT_SECRET`)??ue(`${o}_CLIENT_SECRET`);if(!a||!d)throw new e(`No credentials for "${n}": set admin.auth.providers.${n} or ${o}_CLIENT_ID and ${o}_CLIENT_SECRET`,{status:500,code:"provider_not_configured"});return{clientId:a,clientSecret:d}}async function ze(n,i,r,o){let a=await O(n,i,he,s(t("provider",r.id),t("provider_account_id",o.id)));if(a){let P=await D(n,i,String(a.user_id));if(!P)throw e.unauthorized("The linked account no longer exists");return Te(n,i,r,o,P)}let d=o.email?ce(o.email):null;if(!d)throw new e(`${r.id} did not return a verified email address, so the account cannot be matched`,{status:400,code:"oauth_without_email"});let _=(await K(n,i,d))?.user??null;if(!_){if(!r.provision)throw e.forbidden(`No CMS account for ${d}. An administrator has to invite this address first.`);_=await ie(n,i,{email:d,...o.name?{name:o.name}:{},roles:r.mapRoles?r.mapRoles(o.claims):f.rbac?.defaultRole?[f.rbac.defaultRole]:[],status:"active"}),await j(n,"user.joined",{userId:_.id,email:d,provider:r.id,provisioned:!0})}else if(_.status==="invited")await S(n,i,A,t("id",_.id),{status:"active",updated_at:new Date}),_={..._,status:"active"},await j(n,"user.joined",{userId:_.id,email:_.email});return await B(n,i,he,{id:b("acc"),user_id:_.id,provider:r.id,provider_account_id:o.id,email:d,created_at:new Date,updated_at:new Date}),Te(n,i,r,o,_)}async function Te(n,i,r,o,a){if(!r.mapRoles)return a;let d=r.mapRoles(o.claims);if(Fe(d,a.roles))return a;return await S(n,i,A,t("id",a.id),{roles:d,updated_at:new Date}),await j(n,"role.changed",{userId:a.id,roles:d,previous:a.roles,source:r.id}),{...a,roles:d}}async function ie(n,i,r){let o=ce(r.email);if(await O(n,i,A,t("email",o)))throw e.conflict(`A user with the email ${o} already exists`);if(r.password!==void 0)G(r.password);let d=new Date,h=await B(n,i,A,{id:b("usr"),email:o,name:r.name??null,password_hash:r.password===void 0?null:await Pe(r.password),two_factor_secret:null,two_factor_enabled:!1,status:r.status??"active",roles:r.roles??[],avatar_url:null,locale:r.locale??null,last_login_at:null,created_at:d,updated_at:d});return W(h)}function G(n){let i=C()?.password?.minLength??Be;if(n.length<i)throw e.validation(`The password must be at least ${i} characters`)}function Se(){let n=C();if(!n||!n.methods.includes("password"))return null;let i=n.firstUser??!0;if(i===!1)return null;if(i!==!0&&i.roles)return i.roles;let r=f.rbac?.roles;if(!r||"admin"in r)return["admin"];let o=Object.entries(r).find(([,a])=>a.includes(wo));return o?[o[0]]:["admin"]}async function oe(n){if(n.length===0||!f.rbac)return;let i=await le(),r=n.filter((o)=>!(o in i));if(r.length>0)throw e.validation(`Unknown role ${r.map((o)=>`"${o}"`).join(", ")}`)}let Q={async actorFromRequest(n){let i=n.headers.get("authorization"),o=(i?.toLowerCase().startsWith("bearer ")?i.slice(7).trim():null)??We(n,be);return o?Q.actorFromToken(o):null},async actorFromToken(n){if(n.startsWith(un))return Q.apiKeys.verify(n);return(await Q.sessions.verify(n))?.actor??null},actorForUser:Z,users:{async list(n={}){let i=[];if(n.status)i.push(t("status",n.status));if(n.search){let o=`%${n.search}%`;i.push(R(ae("email",o,!0),ae("name",o,!0)))}return(await y((o,a)=>a.query(o,{table:A,...i.length>0?{where:s(...i)}:{},orderBy:[m("created_at","asc"),m("id","asc")],limit:n.limit??50,...n.offset===void 0?{}:{offset:n.offset}}))).map(W)},async get(n){return y((i,r)=>D(i,r,n))},async byEmail(n){return y(async(i,r)=>(await K(i,r,n))?.user??null)},async count(){let n=await y((i,r)=>r.query(i,{table:A,count:!0}));return Number(n[0]?.count??0)},async create(n){return await oe(n.roles??[]),y((i,r)=>ie(i,r,n))},async update(n,i){if(i.roles)await oe(i.roles);let r=await y(async(o,a)=>{let d=await D(o,a,n);if(!d)throw e.notFound(`No user with id "${n}"`);let h={updated_at:new Date};if(i.name!==void 0)h.name=i.name;if(i.status!==void 0)h.status=i.status;if(i.locale!==void 0)h.locale=i.locale;if(i.avatarUrl!==void 0)h.avatar_url=i.avatarUrl;if(i.roles!==void 0)h.roles=i.roles;if(await S(o,a,A,t("id",n),h),i.roles&&!Fe(i.roles,d.roles))await j(o,"role.changed",{userId:n,roles:i.roles,previous:d.roles},i.actor??null);if(i.status==="disabled")await F(o,a,z,t("user_id",n));return await D(o,a,n)});return c.deliver(),r},async remove(n,i={}){await y(async(r,o)=>{let a=await D(r,o,n);if(!a)throw e.notFound(`No user with id "${n}"`);for(let d of[z,q,he,V])await F(r,o,d,t("user_id",n));await F(r,o,A,t("id",n)),await j(r,"user.removed",{userId:n,email:a.email},i.actor??null)}),c.deliver()},async setPassword(n,i){G(i),await y(async(r,o)=>{let a=await Pe(i);if(await S(r,o,A,t("id",n),{password_hash:a,updated_at:new Date})===0)throw e.notFound(`No user with id "${n}"`);await F(r,o,z,t("user_id",n))})},async invite(n){await oe(n.roles??[]);let i=await y(async(r,o)=>{let a=ce(n.email),d=await K(r,o,a);if(d&&d.user.status==="active")throw e.conflict(`${a} is already an active user`);let h=d?.user??await ie(r,o,{email:a,...n.name?{name:n.name}:{},roles:n.roles??(f.rbac?.defaultRole?[f.rbac.defaultRole]:[]),status:"invited"}),_=await Y(r,o,{type:"invite",ttlMs:U("invite",C()?.invites?.expiresIn),userId:h.id,email:a});return await j(r,"user.invited",{userId:h.id,email:a,roles:h.roles},n.actor??null),{user:h,token:_.token,expiresAt:_.expiresAt.toISOString(),userId:h.id,email:a}});return c.deliver(),i},async acceptInvite(n){let i=await y(async(r,o)=>{let a=await ee(r,o,"invite",n.token),d=await D(r,o,String(a.user_id));if(!d)throw e.unauthorized("This invitation is no longer valid");let h={status:"active",updated_at:new Date};if(n.password!==void 0)G(n.password),h.password_hash=await Pe(n.password);if(n.name!==void 0)h.name=n.name;await S(r,o,A,t("id",d.id),h);let _={...d,status:"active",...n.name===void 0?{}:{name:n.name}};return await j(r,"user.joined",{userId:d.id,email:d.email}),te(r,o,_,n)});return c.deliver(),i}},setup:{async required(){if(Se()===null)return!1;if(T)return!1;let n=await Q.users.count();if(n>0)T=!0;return n===0},async claim(n){let i=Se();if(i===null)throw e.forbidden("This deployment does not accept a first account over HTTP; use heyo-cms create-admin");try{await oe(i)}catch(o){if(o instanceof e&&o.code==="validation_failed")throw e.validation(`The first account would be given the role ${i.map((a)=>`"${a}"`).join(", ")}, which rbac.roles does not define; set admin.auth.firstUser.roles`);throw o}G(n.password);let r=await y(async(o,a)=>{let d=await a.query(o,{table:A,count:!0});if(Number(d[0]?.count??0)>0)throw e.conflict("This CMS already has an account; sign in instead");let h=await ie(o,a,{email:n.email,password:n.password,roles:i,status:"active",...n.name===void 0?{}:{name:n.name}});return await j(o,"user.joined",{userId:h.id,email:h.email,first:!0}),te(o,a,h,n)});return T=!0,c.deliver(),r}},sessions:{async verify(n){return y(async(i,r)=>{let o=await O(i,r,z,t("token_hash",await re(n)));if(!o||ye(o.expires_at))return null;let a=await D(i,r,String(o.user_id));if(!a||a.status!=="active")return null;return{status:"signed-in",token:n,expiresAt:l(o.expires_at)??"",session:ge(o),user:a,actor:await Z(a)}})},async list(n){return(await y((r,o)=>o.query(r,{table:z,where:t("user_id",n),orderBy:[m("created_at","desc")]}))).map(ge)},async revoke(n){let i=await re(n);return await y((o,a)=>F(o,a,z,t("token_hash",i)))>0},async revokeById(n){return await y((r,o)=>F(r,o,z,t("id",n)))>0},async revokeAll(n){return y((i,r)=>F(i,r,z,t("user_id",n)))},async cleanup(){let n=new Date;return y(async(i,r)=>{let o=await F(i,r,z,H("expires_at",n));return await F(i,r,q,H("expires_at",n)),o})}},password:{async signIn(n){E("password");let i=await y(async(r,o)=>{let a=await K(r,o,n.email),d=a?a.row.password_hash:await k(),h=await mn(n.password,d);if(!a||!h)throw e.unauthorized("Invalid email or password");if(se(a.user),a.user.status==="invited")throw e.forbidden("This invitation has not been accepted yet");return ne(r,o,a.user,n)});return c.deliver(),i},async requestReset(n){return E("password"),y(async(i,r)=>{let o=await K(i,r,n.email);if(!o||o.user.status==="disabled")return null;let a=await Y(i,r,{type:"password-reset",ttlMs:U("passwordReset",C()?.passwordReset?.expiresIn),userId:o.user.id,email:o.user.email});return{token:a.token,expiresAt:a.expiresAt.toISOString(),userId:o.user.id,email:o.user.email}})},async reset(n){return E("password"),G(n.password),y(async(i,r)=>{let o=await ee(i,r,"password-reset",n.token),a=String(o.user_id);await S(i,r,A,t("id",a),{password_hash:await Pe(n.password),status:"active",updated_at:new Date}),await F(i,r,z,t("user_id",a));let d=await D(i,r,a);if(!d)throw e.unauthorized("This link is no longer valid");return d})}},magicLink:{async request(n){return E("magic-link"),y(async(i,r)=>{let o=await K(i,r,n.email);if(!o||o.user.status==="disabled")return null;let a=await Y(i,r,{type:"magic-link",ttlMs:U("magicLink",C()?.magicLink?.expiresIn),userId:o.user.id,email:o.user.email});return{token:a.token,expiresAt:a.expiresAt.toISOString(),userId:o.user.id,email:o.user.email}})},async verify(n){E("magic-link");let i=await y(async(r,o)=>{let a=await ee(r,o,"magic-link",n.token),d=await D(r,o,String(a.user_id));if(!d)throw e.unauthorized("This link is no longer valid");if(se(d),d.status==="invited")return await S(r,o,A,t("id",d.id),{status:"active",updated_at:new Date}),await j(r,"user.joined",{userId:d.id,email:d.email}),ne(r,o,{...d,status:"active"},n);return ne(r,o,d,n)});return c.deliver(),i}},oauth:{async authorize(n){let i=await ke(n.provider),r=we(24),o=we(),a=i.pkce?(await Oe(o)).challenge:void 0;return await y((d,h)=>Y(d,h,{type:"oauth",ttlMs:U("oauth",void 0),token:r,data:{provider:i.id,redirectUri:n.redirectUri,verifier:o,redirectTo:n.redirectTo??null}})),{url:Ue({endpoints:i.endpoints,clientId:i.clientId,redirectUri:n.redirectUri,scope:i.scope,state:r,...a===void 0?{}:{codeChallenge:a}}),state:r}},async callback(n){let i=await ke(n.provider),r=await y(async(o,a)=>{let d=await ee(o,a,"oauth",n.state),h=u(d.data);if(h.provider!==i.id)throw e.unauthorized("This sign-in request does not match");if(h.redirectUri!==n.redirectUri)throw e.unauthorized("The redirect URI does not match");let _=await xe({endpoints:i.endpoints,clientId:i.clientId,clientSecret:i.clientSecret,code:n.code,redirectUri:n.redirectUri,...i.pkce&&typeof h.verifier==="string"?{codeVerifier:h.verifier}:{},fetchImpl:p}),P=await i.profile(_,p),I=await ze(o,a,i,P);return se(I),{...await ne(o,a,I,n),redirectTo:typeof h.redirectTo==="string"?h.redirectTo:null}});return c.deliver(),r}},twoFactor:{async begin(n){let i=Jn();return y(async(r,o)=>{let a=await D(r,o,n);if(!a)throw e.notFound(`No user with id "${n}"`);if(a.twoFactorEnabled)throw e.conflict("Disable the existing authenticator before enrolling another.");return await S(r,o,A,t("id",n),{two_factor_secret:i,updated_at:new Date}),{secret:i,uri:Wn({secret:i,account:a.email,issuer:f.admin.title??"Heyo CMS"})}})},async enable(n){return y(async(i,r)=>{let o=await O(i,r,A,t("id",n.userId));if(!o)throw e.notFound(`No user with id "${n.userId}"`);let a=o.two_factor_secret;if(!a)throw e.validation("Start the setup before enabling it");if(!await dn(a,n.code))throw e.unauthorized("That code is not valid");return await S(i,r,A,t("id",n.userId),{two_factor_enabled:!0,updated_at:new Date}),{...W(o),twoFactorEnabled:!0}})},async disable(n){return y(async(i,r)=>{if(await S(i,r,A,t("id",n),{two_factor_enabled:!1,two_factor_secret:null,updated_at:new Date})===0)throw e.notFound(`No user with id "${n}"`);return await D(i,r,n)})},async complete(n){let i=await y(async(r,o)=>{let a=await _e(r,o,"two-factor",n.challenge),d=await O(r,o,A,t("id",String(a.user_id)));if(!d)throw e.unauthorized("This challenge is no longer valid");if(!await dn(d.two_factor_secret,n.code)){let P=a;for(let I=0;I<$e;I+=1){let L=u(P.data).attempts,Ie=typeof L==="number"?L:null,Re=Number(Ie??0)+1;if(await S(r,o,q,s(t("id",String(P.id)),t("consumed_at",null),t("data.attempts",Ie)),{data:{...u(P.data),attempts:Re},...Re>=$e?{consumed_at:new Date}:{}})===1)break;let me=await O(r,o,q,t("id",String(P.id)));if(!me||me.consumed_at!==null)break;P=me}return null}await ve(r,o,a);let _=W(d);return se(_),te(r,o,_,n)});if(i===null)throw e.unauthorized("That code is not valid");return c.deliver(),i}},apiKeys:{async create(n){let i=C()?.apiKeys;if(!i?.enabled)throw new e("API keys are not enabled; set admin.auth.apiKeys.enabled",{status:400,code:"method_not_enabled"});let r=n.scopes??i.scopes??["read"],o=i.scopes;if(o){let P=r.filter((I)=>!o.includes(I));if(P.length>0)throw e.validation(`Scope ${P.map((I)=>`"${I}"`).join(", ")} is not in admin.auth.apiKeys.scopes`)}let a=`${un}${we()}`,d=n.expiresIn??i.expiresIn,h=d?new Date(Date.now()+w(d)):null,_=await y(async(P,I)=>{let L=await B(P,I,V,{id:b("key"),name:n.name,user_id:n.userId??null,key_hash:await re(a),prefix:a.slice(0,un.length+6),scopes:r,last_used_at:null,expires_at:h,revoked_at:null,created_at:new Date});return await j(P,"apikey.created",{id:String(L.id),name:n.name,scopes:r,userId:n.userId??null},n.actor??null),Ee(L)});return c.deliver(),{..._,key:a}},async list(n={}){return(await y((r,o)=>o.query(r,{table:V,...n.userId?{where:t("user_id",n.userId)}:{},orderBy:[m("created_at","desc")]}))).map(Ee)},async revoke(n,i={}){let r=await y(async(o,a)=>{let d=await S(o,a,V,s(t("id",n),t("revoked_at",null)),{revoked_at:new Date});if(d>0)await j(o,"apikey.revoked",{id:n},i.actor??null);return d>0});return c.deliver(),r},async verify(n){return y(async(i,r)=>{let o=await O(i,r,V,t("key_hash",await re(n)));if(!o)return null;if(o.revoked_at!==null)return null;if(o.expires_at!==null&&ye(o.expires_at))return null;let a=J(o.scopes),d=Mt(a),h=[],_=d,P=String(o.id);if(o.user_id!==null&&o.user_id!==void 0){let I=await D(i,r,String(o.user_id));if(!I||I.status!=="active")return null;let L=await Z(I);h=L.roles,_=Et(L.permissions,d),P=I.id}return await S(i,r,V,t("id",String(o.id)),{last_used_at:new Date}),{id:P,source:"api-key",roles:h,permissions:_}})}},roles:{async list(){let n=Object.entries(f.rbac?.roles??{}).map(([a,d])=>({name:a,label:null,permissions:d,source:"config"}));if(f.rbac?.customRoles!==!0)return n;let i=await y((a,d)=>d.query(a,{table:N,orderBy:[m("name")]})),r=new Set(n.map((a)=>a.name)),o=i.filter((a)=>!r.has(String(a.name))).map((a)=>({name:String(a.name),label:a.label??null,permissions:J(a.permissions),source:"database"}));return[...n,...o].sort((a,d)=>a.name.localeCompare(d.name))},async create(n){if(de(),Le(n.name),f.rbac?.roles[n.name])throw e.conflict(`"${n.name}" is defined in the configuration; change it there`);let i=await y(async(r,o)=>{if(await O(r,o,N,t("name",n.name)))throw e.conflict(`The role "${n.name}" already exists`);return B(r,o,N,{id:b("rol"),name:n.name,label:n.label??null,permissions:n.permissions,created_at:new Date,updated_at:new Date})});return v=void 0,{name:String(i.name),label:i.label??null,permissions:J(i.permissions),source:"database"}},async update(n,i){de();let r=await y(async(o,a)=>{let d={updated_at:new Date};if(i.permissions)d.permissions=i.permissions;if(i.label!==void 0)d.label=i.label;if(await S(o,a,N,t("name",n),d)===0)throw e.notFound(`No role named "${n}"`);return O(o,a,N,t("name",n))});return v=void 0,{name:n,label:r?.label??null,permissions:J(r?.permissions),source:"database"}},async remove(n){de();let i=await y((r,o)=>F(r,o,N,t("name",n)));return v=void 0,i>0},async permissionsFor(n){return rt(n,await le())}}};function de(){if(f.rbac?.customRoles!==!0)throw new e("Roles are defined in the configuration; set rbac.customRoles to manage them in the panel",{status:400,code:"custom_roles_disabled"})}function Le(n){if(!He.test(n))throw e.validation(`"${n}" is not a role name; use lowercase letters, digits, dashes and underscores`)}return Q}function W(c){return{id:String(c.id),email:String(c.email),name:c.name??null,status:c.status??"active",roles:J(c.roles),avatarUrl:c.avatar_url??null,locale:c.locale??null,twoFactorEnabled:c.two_factor_enabled===!0,lastLoginAt:l(c.last_login_at),createdAt:l(c.created_at)??"",updatedAt:l(c.updated_at)??""}}function ge(c){return{id:String(c.id),userId:String(c.user_id),expiresAt:l(c.expires_at)??"",createdAt:l(c.created_at)??"",ip:c.ip??null,userAgent:c.user_agent??null}}function Ee(c){return{id:String(c.id),name:String(c.name),prefix:String(c.prefix),userId:c.user_id??null,scopes:J(c.scopes),lastUsedAt:l(c.last_used_at),expiresAt:l(c.expires_at),revokedAt:l(c.revoked_at),createdAt:l(c.created_at)??""}}function J(c){if(!Array.isArray(c))return[];return c.filter((f)=>typeof f==="string")}function ye(c){if(c===null||c===void 0)return!1;return(c instanceof Date?c:new Date(String(c))).getTime()<=Date.now()}function ce(c){let f=c.trim().toLowerCase();if(!Ke.test(f))throw e.validation(`"${c}" is not an email address`);return f}function Fe(c,f){if(c.length!==f.length)return!1;let p=[...f].sort();return[...c].sort().every((g,k)=>g===p[k])}function We(c,f){let p=c.headers.get("cookie");if(!p)return null;for(let g of p.split(";")){let k=g.indexOf("=");if(k===-1)continue;if(g.slice(0,k).trim()!==f)continue;return decodeURIComponent(g.slice(k+1).trim())}return null}function ue(c){return globalThis.process?.env?.[c]}
+export{Un,jt,Jn,Wn,nr,dn,be,un,pn};