@nexpress/core 0.3.7 → 0.3.8

package/dist/chunk-6UV2P5MW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/config/access.ts","../src/auth/token.ts","../src/auth/users.ts","../src/auth/password.ts","../src/auth/csrf.ts","../src/auth/oauth-providers.ts","../src/auth/oauth-resolve.ts","../src/auth/oauth-resolve-member.ts","../src/auth/oauth-state.ts","../src/auth/oauth-arctic.ts","../src/auth/session.ts","../src/auth/identities-admin.ts","../src/auth/reset-token.ts","../src/auth/member-token.ts","../src/auth/member-session.ts","../src/auth/member-credentials.ts"],"sourcesContent":["import { type NpAccessFunction } from \"./types.js\";\n\nexport const authenticated: NpAccessFunction = ({ user }) => !!user;\n\nexport const isAdmin: NpAccessFunction = ({ user }) => user?.role === \"admin\";\n\nexport const isEditorOrAbove: NpAccessFunction = ({ user }) =>\n  !!user && (user.role === \"admin\" || user.role === \"editor\");\n\nexport const isOwnerOrAdmin: NpAccessFunction = ({ user, doc }) =>\n  user?.role === \"admin\" || doc?.createdBy === user?.id;\n","import { randomBytes } from \"node:crypto\";\nimport { jwtVerify, SignJWT, errors as joseErrors, type JWTPayload } from \"jose\";\n\nimport type { NpUserRole } from \"../config/types.js\";\nimport { NpAuthError } from \"../errors.js\";\n\n/**\n * Staff-side JWT helpers. Both access (`np-session`) and refresh\n * (`np-refresh`) cookies are signed with this module; the\n * `use: \"access\" | \"refresh\"` claim separates them so a stolen\n * refresh JWT cannot be replayed as a session cookie. Without this\n * separation a leaked 7-day refresh became a 7-day admin bearer\n * because both cookies decoded to the same `{ sub, role, ver }`\n * payload through `verifyToken` (#94).\n *\n * The fix mirrors the member-side fix from #92/#93: the `use` claim\n * is required, no legacy fallback for tokens missing the claim. The\n * cost is one forced re-login for staff sessions issued before the\n * deploy; bounded by the 7-day refresh TTL.\n */\nexport type NpTokenUse = \"access\" | \"refresh\";\n\nexport interface NpTokenPayload {\n  sub: string;\n  role: NpUserRole;\n  ver: number;\n  /** Required. `verifyToken` refuses tokens missing this claim so\n   *  legacy refresh JWTs cannot be smuggled into the session\n   *  cookie path. */\n  use: NpTokenUse;\n  /** Random per-token id — needed if rotation lands on the staff\n   *  side (mirrors the member-side `jti` for #45). Optional today\n   *  but populated on every newly-minted token. */\n  jti?: string;\n  iat: number;\n  exp: number;\n}\n\nconst textEncoder = new TextEncoder();\n\nexport async function signToken(\n  user: { id: string; role: NpUserRole; tokenVersion: number },\n  secret: string,\n  expirationSeconds: number = 7200,\n  tokenUse: NpTokenUse = \"access\",\n): Promise<string> {\n  const secretKey = textEncoder.encode(secret);\n\n  return new SignJWT({\n    sub: user.id,\n    role: user.role,\n    ver: user.tokenVersion,\n    use: tokenUse,\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setJti(randomBytes(16).toString(\"base64url\"))\n    .setIssuedAt()\n    .setExpirationTime(Math.floor(Date.now() / 1000) + expirationSeconds)\n    .sign(secretKey);\n}\n\n/**\n * Verify a staff JWT. When `expectedUse` is provided, refuses tokens\n * whose `use` claim doesn't match — that's how `getSessionUser`\n * rejects a refresh token used as a session cookie and how the\n * refresh route rejects an access token as a refresh trigger.\n *\n * Tokens minted before the `use` claim landed have NO `use` payload\n * field. We refuse those outright rather than treating them as\n * `access` — the prior fallback would let still-live legacy refresh\n * JWTs be smuggled into the session cookie and pass the access\n * check. Cost: staff logged in before this deploy must log in once.\n * Bounded by the refresh-token TTL (default 7 days).\n */\nexport async function verifyToken(\n  token: string,\n  secret: string,\n  expectedUse?: NpTokenUse,\n): Promise<NpTokenPayload> {\n  const secretKey = textEncoder.encode(secret);\n  const { payload } = await jwtVerify(token, secretKey);\n  const typed = payload as JWTPayload & {\n    sub: string;\n    role: NpUserRole;\n    ver: number;\n    iat: number;\n    exp: number;\n    use?: NpTokenUse;\n  };\n  if (typed.use !== \"access\" && typed.use !== \"refresh\") {\n    throw new NpAuthError(\"Staff token missing `use` claim\");\n  }\n  const use: NpTokenUse = typed.use;\n  if (expectedUse && use !== expectedUse) {\n    throw new NpAuthError(\n      `Staff token use mismatch: expected ${expectedUse}, got ${use}`,\n    );\n  }\n  return { ...typed, use };\n}\n\n/**\n * True when `err` represents a token-verification failure rather than\n * an unrelated runtime fault (DB outage, misconfiguration, …). Auth\n * helpers use this to keep the existing \"bad token → 401\" behavior\n * silent while letting infrastructure failures surface as 5xx.\n *\n * Covers:\n *   - `NpAuthError` — `verifyToken` / `verifyMemberToken` rejecting a\n *     missing or wrong `use` claim, or `verifyCsrf` failing.\n *   - `jose.errors.JOSEError` — every JWT signature / format /\n *     expiration failure, including subclasses like `JWTExpired`,\n *     `JWSSignatureVerificationFailed`, `JWTInvalid`.\n */\nexport function isTokenVerificationError(err: unknown): boolean {\n  if (err instanceof NpAuthError) return true;\n  if (err instanceof joseErrors.JOSEError) return true;\n  return false;\n}\n","import { eq } from \"drizzle-orm\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npUsers } from \"../db/schema/system.js\";\n\n/**\n * Minimal public projection of a user row — `id` + `name` + `email`.\n * Themes / plugins reach for this when they need to display a byline\n * (post.author → user) without pulling in session machinery. Password\n * hash + tokenVersion + reset state stay private to the auth module.\n */\nexport interface NpUserBasic {\n  id: string;\n  name: string;\n  email: string;\n}\n\n/**\n * Look up a user by id. Returns `null` when the id doesn't exist\n * (caller handles missing-author UI). UUID validation lives at the\n * caller — Postgres rejects malformed ids inside `eq()` and the\n * surfacing error is already informative.\n *\n * This is the supported entry point for theme code that needs to\n * render a byline from `posts.author: relationTo(\"users\")`. Direct\n * drizzle reads against `np_users` are private to the framework.\n */\nexport async function getUserById(id: string): Promise<NpUserBasic | null> {\n  const db = getDb();\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      name: npUsers.name,\n      email: npUsers.email,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.id, id))\n    .limit(1);\n  return user ?? null;\n}\n","import { hash, verify, type Options } from \"@node-rs/argon2\";\n\nexport const ARGON2_OPTIONS: Options = {\n  memoryCost: 19456,\n  timeCost: 2,\n  outputLen: 32,\n  parallelism: 1,\n};\n\n// Test-only weak params — drops a hash from ~75ms to <1ms. Only kicks in\n// when NP_TEST_FAST_HASH=1 is explicitly set (vitest's setup-env.ts does\n// this) so production / dev never see weakened security.\nconst TEST_ARGON2_OPTIONS: Options = {\n  memoryCost: 8,\n  timeCost: 1,\n  outputLen: 32,\n  parallelism: 1,\n};\n\nexport function hashPassword(password: string): Promise<string> {\n  return hash(\n    password,\n    process.env.NP_TEST_FAST_HASH === \"1\" ? TEST_ARGON2_OPTIONS : ARGON2_OPTIONS,\n  );\n}\n\nexport function verifyPassword(\n  passwordHash: string,\n  password: string,\n): Promise<boolean> {\n  return verify(passwordHash, password);\n}\n","const SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\nexport function verifyCsrf(\n  method: string,\n  cookieToken: string | undefined,\n  headerToken: string | undefined,\n): boolean {\n  if (SAFE_METHODS.has(method.toUpperCase())) {\n    return true;\n  }\n\n  return Boolean(cookieToken && headerToken && cookieToken === headerToken);\n}\n","/**\n * OAuth provider registry — extension point for SSO. A provider plugin\n * (e.g. `@nexpress/plugin-oauth-github`) registers itself at startup\n * via `registerOAuthProvider()`; the framework's `/api/auth/oauth/{id}`\n * routes look it up by id.\n *\n * The provider is responsible for:\n *  - Building the authorize URL (`authorize`).\n *  - Exchanging the callback code for a normalized profile (`exchange`).\n *\n * The framework owns state-cookie signing, identity ↔ user resolution,\n * session minting, and audit. Providers must NOT touch cookies, the DB,\n * or response objects directly.\n */\n\n/**\n * Profile returned from a successful `exchange()`. The framework uses\n * `providerUserId` as the durable identifier — `email` may change at the\n * provider but `providerUserId` should not. If the provider doesn't\n * surface `email`, the framework falls back to creating a synthetic\n * placeholder (`<providerUserId>@<provider>.oauth.local`) so the\n * `np_users.email NOT NULL UNIQUE` constraint is still satisfied.\n */\nexport interface OAuthProfile {\n  /** Stable per-user id from the provider. Required. */\n  providerUserId: string;\n  /** Optional — falls back to synthetic if missing. */\n  email?: string | null;\n  /** Optional — defaults to email local-part on user creation. */\n  name?: string | null;\n  /** Optional — written into `np_user_oauth_identities.metadata`. */\n  avatarUrl?: string | null;\n  /** Optional — full payload the provider wants to remember (e.g. scopes). */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Inputs the provider receives at the two callback boundaries. The\n * framework picks `redirectUri` from `SITE_URL` (or the request origin\n * in dev) so the provider doesn't have to know its own deployment URL.\n */\nexport interface OAuthAuthorizeParams {\n  state: string;\n  redirectUri: string;\n  /**\n   * PKCE code verifier (32+ char URL-safe random). The framework\n   * generates one for every login and threads it through the state\n   * cookie. Providers that don't support PKCE (e.g. GitHub) ignore it;\n   * providers that require it (e.g. Google) hash it into the\n   * `code_challenge` query param.\n   */\n  codeVerifier: string;\n}\n\nexport interface OAuthExchangeParams {\n  code: string;\n  state: string;\n  redirectUri: string;\n  /** Same verifier minted at /start, recovered from the state cookie. */\n  codeVerifier: string;\n}\n\nexport interface OAuthProvider {\n  /** Stable id used in route paths and `np_user_oauth_identities.provider`. */\n  id: string;\n  /** Human-readable label for admin UI / login buttons. */\n  label?: string;\n  /**\n   * Returns a fully-qualified URL the framework should redirect the\n   * browser to. Async to allow providers that need to mint per-request\n   * client credentials.\n   */\n  authorize(params: OAuthAuthorizeParams): Promise<string> | string;\n  /**\n   * Validates the callback and returns the normalized profile.\n   * Throwing here aborts the login with `OAUTH_EXCHANGE_FAILED`.\n   */\n  exchange(params: OAuthExchangeParams): Promise<OAuthProfile>;\n}\n\nconst providers = new Map<string, OAuthProvider>();\n\n/**\n * Register a provider. Idempotent: re-registering with the same id\n * overwrites — useful in dev when a plugin's `setup()` runs again on\n * reload.\n */\nexport function registerOAuthProvider(provider: OAuthProvider): void {\n  if (!provider.id || typeof provider.id !== \"string\") {\n    throw new Error(\"OAuth provider must have a non-empty string id\");\n  }\n  if (typeof provider.authorize !== \"function\" || typeof provider.exchange !== \"function\") {\n    throw new Error(\n      `OAuth provider \"${provider.id}\" must implement authorize() and exchange()`,\n    );\n  }\n  providers.set(provider.id, provider);\n}\n\nexport function getOAuthProvider(id: string): OAuthProvider | undefined {\n  return providers.get(id);\n}\n\nexport function listOAuthProviders(): OAuthProvider[] {\n  return Array.from(providers.values());\n}\n\n/** Reset the registry — tests use this between cases. Not for runtime use. */\nexport function resetOAuthProviders(): void {\n  providers.clear();\n}\n","import { eq, and, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npUserOAuthIdentities, npUsers } from \"../db/schema/system.js\";\nimport type { NpUserRole } from \"../config/types.js\";\n\nimport { hashPassword } from \"./password.js\";\nimport type { OAuthProfile } from \"./oauth-providers.js\";\n\n/**\n * Resolves an `OAuthProfile` to a real `np_users` row, in this order:\n *\n *  1. Lookup by `(provider, provider_user_id)` — the durable link. This\n *     is the only path that survives an email change at the provider.\n *  2. Email-match — if the provider gave us an email and an existing\n *     user has it, link the OAuth identity to that user. Lets a staff\n *     member who originally signed up with a password later \"sign in\n *     with Google\" and have it just work, without an explicit linking\n *     UI.\n *  3. Create — auto-provision a new user with the provider's profile,\n *     default role `viewer`. The password column is filled with an\n *     unrecoverable Argon2 hash of a random secret so the column\n *     constraints are satisfied; the user can later run the\n *     forgot-password flow to set a real password if they want one.\n *\n * Side effects: writes a row into `np_user_oauth_identities` for paths\n * 2 and 3, updates `metadata` for path 1.\n */\nexport interface ResolveOAuthLoginResult {\n  user: ResolvedOAuthUser;\n  /** Tells the caller whether this login created the underlying user. */\n  created: boolean;\n  /** Tells the caller whether this login linked a new identity row. */\n  linked: boolean;\n}\n\nexport interface ResolvedOAuthUser {\n  id: string;\n  email: string;\n  name: string;\n  role: NpUserRole;\n  tokenVersion: number;\n}\n\nexport interface ResolveOAuthLoginInput {\n  provider: string;\n  profile: OAuthProfile;\n  /** Default role for auto-created users. Defaults to `\"viewer\"`. */\n  defaultRole?: NpUserRole;\n}\n\nconst SYNTHETIC_EMAIL_SUFFIX = \".oauth.local\";\n\nfunction syntheticEmail(provider: string, providerUserId: string): string {\n  // Stable, namespaced, doesn't collide with real provider domains.\n  return `${providerUserId}@${provider}${SYNTHETIC_EMAIL_SUFFIX}`;\n}\n\nfunction deriveName(profile: OAuthProfile, fallbackEmail: string): string {\n  if (profile.name && profile.name.trim().length > 0) return profile.name.trim();\n  const localPart = fallbackEmail.split(\"@\")[0];\n  return localPart && localPart.length > 0 ? localPart : \"Member\";\n}\n\nexport async function resolveOAuthLogin(\n  input: ResolveOAuthLoginInput,\n): Promise<ResolveOAuthLoginResult> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const provider = input.provider;\n  const profile = input.profile;\n  const role: NpUserRole = input.defaultRole ?? \"viewer\";\n\n  // Step 1: lookup by durable provider link.\n  const [existingLink] = (await db\n    .select({\n      userId: npUserOAuthIdentities.userId,\n      identityId: npUserOAuthIdentities.id,\n    })\n    .from(npUserOAuthIdentities)\n    .where(\n      and(\n        eq(npUserOAuthIdentities.provider, provider),\n        eq(npUserOAuthIdentities.providerUserId, profile.providerUserId),\n      ),\n    )\n    .limit(1)) as Array<{ userId: string; identityId: string }>;\n\n  if (existingLink) {\n    // Refresh metadata so the most recent provider info is captured.\n    const metadata = mergeMetadata(profile);\n    await db\n      .update(npUserOAuthIdentities)\n      .set({ metadata, updatedAt: new Date() })\n      .where(eq(npUserOAuthIdentities.id, existingLink.identityId));\n\n    const user = await loadUser(db, existingLink.userId);\n    return { user, created: false, linked: false };\n  }\n\n  // Step 2: email match. Skipped when the provider doesn't surface an\n  // email — we can't risk linking by guesswork.\n  if (profile.email) {\n    const normalizedEmail = profile.email.trim().toLowerCase();\n    const [existingUser] = (await db\n      .select({\n        id: npUsers.id,\n        email: npUsers.email,\n        name: npUsers.name,\n        role: npUsers.role,\n        tokenVersion: npUsers.tokenVersion,\n      })\n      .from(npUsers)\n      .where(eq(sql`lower(${npUsers.email})`, normalizedEmail))\n      .limit(1)) as ResolvedOAuthUser[];\n\n    if (existingUser) {\n      await db.insert(npUserOAuthIdentities).values({\n        userId: existingUser.id,\n        provider,\n        providerUserId: profile.providerUserId,\n        metadata: mergeMetadata(profile),\n      });\n      return { user: existingUser, created: false, linked: true };\n    }\n  }\n\n  // Step 3: auto-provision.\n  const email =\n    profile.email && profile.email.trim().length > 0\n      ? profile.email.trim().toLowerCase()\n      : syntheticEmail(provider, profile.providerUserId);\n  const name = deriveName(profile, email);\n  const placeholderPassword = await hashPassword(\n    crypto.randomUUID() + crypto.randomUUID(),\n  );\n\n  const [created] = (await db\n    .insert(npUsers)\n    .values({\n      email,\n      name,\n      password: placeholderPassword,\n      role,\n    })\n    .returning({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n      role: npUsers.role,\n      tokenVersion: npUsers.tokenVersion,\n    })) as ResolvedOAuthUser[];\n\n  await db.insert(npUserOAuthIdentities).values({\n    userId: created.id,\n    provider,\n    providerUserId: profile.providerUserId,\n    metadata: mergeMetadata(profile),\n  });\n\n  return { user: created, created: true, linked: true };\n}\n\nfunction mergeMetadata(profile: OAuthProfile): Record<string, unknown> {\n  const base: Record<string, unknown> = {};\n  if (profile.avatarUrl) base.avatarUrl = profile.avatarUrl;\n  if (profile.email) base.email = profile.email;\n  if (profile.name) base.name = profile.name;\n  if (profile.metadata) Object.assign(base, profile.metadata);\n  return base;\n}\n\nasync function loadUser(\n  db: NodePgDatabase<Record<string, unknown>>,\n  userId: string,\n): Promise<ResolvedOAuthUser> {\n  const [row] = (await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n      role: npUsers.role,\n      tokenVersion: npUsers.tokenVersion,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.id, userId))\n    .limit(1)) as ResolvedOAuthUser[];\n  if (!row) {\n    throw new Error(`User ${userId} referenced by oauth identity is missing`);\n  }\n  return row;\n}\n","import { and, eq, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { getCommunitySettings } from \"../community/settings.js\";\nimport { npMemberIdentities, npMembers } from \"../db/schema/community.js\";\nimport { NpForbiddenError } from \"../errors.js\";\n\nimport { hashPassword } from \"./password.js\";\nimport type { OAuthProfile } from \"./oauth-providers.js\";\n\n/**\n * Member-side mirror of `resolveOAuthLogin` (the staff resolver in\n * `oauth-resolve.ts`). Walks the same three-step ladder:\n *\n *   1. Lookup by `(provider, subject)` in `np_member_identities` —\n *      durable provider link.\n *   2. Email match — if the profile carries an email, link the\n *      identity to the existing `np_members` row.\n *   3. Auto-provision a new member with status=`active`, default\n *      password = unrecoverable Argon2 of a random secret. The user\n *      can later run forgot-password to set a real password if they\n *      want one (or stay SSO-only).\n *\n * Members are kept distinct from staff users at every layer\n * (different table, different cookies, different audience claim on\n * the JWT). This resolver intentionally never touches `np_users`.\n */\nexport interface ResolvedOAuthMember {\n  id: string;\n  email: string;\n  handle: string;\n  displayName: string;\n  status: \"active\" | \"pending\" | \"suspended\" | \"deleted\";\n  tokenVersion: number;\n}\n\nexport interface ResolveMemberOAuthLoginInput {\n  provider: string;\n  profile: OAuthProfile;\n}\n\nexport interface ResolveMemberOAuthLoginResult {\n  member: ResolvedOAuthMember;\n  /** True when this login auto-provisioned the underlying member. */\n  created: boolean;\n  /** True when this login linked a new identity row (covers steps 2 + 3). */\n  linked: boolean;\n}\n\nconst SYNTHETIC_EMAIL_SUFFIX = \".oauth.local\";\nconst HANDLE_FALLBACK = \"user\";\nconst HANDLE_RANDOM_SUFFIX_BYTES = 4;\n\nfunction syntheticEmail(provider: string, providerUserId: string): string {\n  return `${providerUserId}@${provider}${SYNTHETIC_EMAIL_SUFFIX}`;\n}\n\n/**\n * Members have a unique `handle` field. Build a candidate from the\n * provider's profile, sanitize to the project's handle regex, and add\n * a short random suffix to dodge collisions on common values like\n * \"alice\" / \"octocat\".\n *\n * Handle regex (per `register/route.ts`):\n *   /^[a-z0-9][a-z0-9_-]{2,29}$/\n */\nfunction generateHandle(profile: OAuthProfile, fallbackEmail: string): string {\n  const seed =\n    (profile.metadata && typeof profile.metadata.login === \"string\" && profile.metadata.login) ||\n    profile.name ||\n    fallbackEmail.split(\"@\")[0] ||\n    HANDLE_FALLBACK;\n  const sanitized = String(seed)\n    .toLowerCase()\n    .replace(/[^a-z0-9_-]/g, \"-\")\n    .replace(/^[-_]+/, \"\")\n    .slice(0, 20);\n  const base = sanitized.length >= 3 ? sanitized : HANDLE_FALLBACK;\n  // Random suffix keeps handles unique across the OAuth user pool —\n  // accept the cost of \"alice-9k2x\" rather than fighting a tight loop\n  // of insert-and-retry on every collision.\n  const suffix = Math.random()\n    .toString(36)\n    .slice(2, 2 + HANDLE_RANDOM_SUFFIX_BYTES);\n  return `${base}-${suffix}`.slice(0, 30);\n}\n\nfunction deriveDisplayName(profile: OAuthProfile, fallbackEmail: string): string {\n  if (profile.name && profile.name.trim().length > 0) return profile.name.trim();\n  const localPart = fallbackEmail.split(\"@\")[0];\n  return localPart && localPart.length > 0 ? localPart : \"Member\";\n}\n\nfunction mergeMetadata(profile: OAuthProfile): Record<string, unknown> {\n  const base: Record<string, unknown> = {};\n  if (profile.avatarUrl) base.avatarUrl = profile.avatarUrl;\n  if (profile.email) base.email = profile.email;\n  if (profile.name) base.name = profile.name;\n  if (profile.metadata) Object.assign(base, profile.metadata);\n  return base;\n}\n\nasync function loadMember(\n  db: NodePgDatabase<Record<string, unknown>>,\n  memberId: string,\n): Promise<ResolvedOAuthMember> {\n  const [row] = (await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n      tokenVersion: npMembers.tokenVersion,\n    })\n    .from(npMembers)\n    .where(eq(npMembers.id, memberId))\n    .limit(1)) as ResolvedOAuthMember[];\n  if (!row) {\n    throw new Error(`Member ${memberId} referenced by oauth identity is missing`);\n  }\n  return row;\n}\n\nexport async function resolveMemberOAuthLogin(\n  input: ResolveMemberOAuthLoginInput,\n): Promise<ResolveMemberOAuthLoginResult> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const { provider, profile } = input;\n\n  // Step 1: durable lookup.\n  const [existingLink] = (await db\n    .select({ memberId: npMemberIdentities.memberId, identityId: npMemberIdentities.id })\n    .from(npMemberIdentities)\n    .where(\n      and(\n        eq(npMemberIdentities.provider, provider),\n        eq(npMemberIdentities.subject, profile.providerUserId),\n      ),\n    )\n    .limit(1)) as Array<{ memberId: string; identityId: string }>;\n\n  if (existingLink) {\n    await db\n      .update(npMemberIdentities)\n      .set({ metadata: mergeMetadata(profile), updatedAt: new Date() })\n      .where(eq(npMemberIdentities.id, existingLink.identityId));\n    const member = await loadMember(db, existingLink.memberId);\n    return { member, created: false, linked: false };\n  }\n\n  // Step 2: email match.\n  if (profile.email) {\n    const normalizedEmail = profile.email.trim().toLowerCase();\n    const [existingMember] = (await db\n      .select({\n        id: npMembers.id,\n        email: npMembers.email,\n        handle: npMembers.handle,\n        displayName: npMembers.displayName,\n        status: npMembers.status,\n        tokenVersion: npMembers.tokenVersion,\n      })\n      .from(npMembers)\n      .where(eq(sql`lower(${npMembers.email})`, normalizedEmail))\n      .limit(1)) as ResolvedOAuthMember[];\n\n    if (existingMember) {\n      // Refuse to auto-link an OAuth identity to a non-active member.\n      // Without this guard an attacker who controls an OAuth account\n      // with a victim's email could pre-link an identity to the\n      // victim's pending (unverified) row; once the victim later\n      // activates, the attacker's identity is already attached and\n      // they can sign in as the victim. The callback would still\n      // refuse the immediate login (status check below), but the\n      // dangling link would persist.\n      //\n      // Active members are the only ones we'll cross-link\n      // automatically — pending / suspended / deleted are returned\n      // as-is and the route's status check refuses the login.\n      if (existingMember.status !== \"active\") {\n        return { member: existingMember, created: false, linked: false };\n      }\n      await db.insert(npMemberIdentities).values({\n        memberId: existingMember.id,\n        provider,\n        subject: profile.providerUserId,\n        email: profile.email,\n        metadata: mergeMetadata(profile),\n      });\n      return { member: existingMember, created: false, linked: true };\n    }\n  }\n\n  // Step 3: auto-provision a brand-new member account. This is the\n  // step the `community.registrationEnabled` site setting gates —\n  // an invite-only site that disables password sign-up via\n  // `/api/members/register` would otherwise be joined through OAuth\n  // (the password endpoint and OAuth callback both create new\n  // member rows from an unauthenticated request, so they're the\n  // same surface from a policy point of view).\n  //\n  // Steps 1 and 2 are NOT gated: durable links and email matches\n  // log an EXISTING member back in, which isn't a new\n  // registration. An admin who flips `registrationEnabled = false`\n  // expects existing members to keep working — only new accounts\n  // should be refused.\n  const settings = await getCommunitySettings();\n  if (!settings.registrationEnabled) {\n    throw new NpForbiddenError(\"members\", \"register\");\n  }\n\n  const email =\n    profile.email && profile.email.trim().length > 0\n      ? profile.email.trim().toLowerCase()\n      : syntheticEmail(provider, profile.providerUserId);\n  const displayName = deriveDisplayName(profile, email);\n  const handle = generateHandle(profile, email);\n  const placeholderPassword = await hashPassword(\n    crypto.randomUUID() + crypto.randomUUID(),\n  );\n\n  const [created] = (await db\n    .insert(npMembers)\n    .values({\n      email,\n      handle,\n      displayName,\n      password: placeholderPassword,\n      // OAuth verifies the address out-of-band (the provider showed the\n      // user a real login screen for it), so skip the email-verify\n      // dance that password registration goes through.\n      emailVerified: true,\n      status: \"active\",\n    })\n    .returning({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n      tokenVersion: npMembers.tokenVersion,\n    })) as ResolvedOAuthMember[];\n\n  await db.insert(npMemberIdentities).values({\n    memberId: created.id,\n    provider,\n    subject: profile.providerUserId,\n    email: profile.email ?? null,\n    metadata: mergeMetadata(profile),\n  });\n\n  return { member: created, created: true, linked: true };\n}\n","import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\n\nimport { readEnvPositiveInt } from \"../config/env.js\";\n\n/**\n * HMAC-signed state tokens for the OAuth start ↔ callback handshake.\n * The framework (not the provider) issues + verifies these — providers\n * only see them as opaque strings.\n *\n * Token shape: `<base64url(payload)>.<base64url(hmac)>` where payload is\n * JSON `{ providerId, nonce, expSeconds, codeVerifier }`. Using an HMAC\n * instead of a JWT keeps this self-contained — no jose import, no key\n * rotation surface — and the payload stays comfortably under the\n * cookie size cap.\n *\n * The `codeVerifier` is a 32-byte URL-safe random string that providers\n * supporting PKCE (Google, etc.) hash into the authorize URL. Providers\n * that don't use PKCE (GitHub) ignore it. We always generate one so the\n * flow is uniform.\n *\n * Default state TTL is 10 minutes — long enough for slow IdP redirects\n * (corporate SSO with MFA prompts), short enough that a stale state\n * cookie doesn't sit around forever. Override via\n * `NP_OAUTH_STATE_TTL_SECONDS`.\n */\n\nconst STATE_TTL_SECONDS = readEnvPositiveInt(\"NP_OAUTH_STATE_TTL_SECONDS\", 600);\nconst CODE_VERIFIER_BYTES = 32;\n\nexport interface OAuthStatePayload {\n  providerId: string;\n  nonce: string;\n  expSeconds: number;\n  codeVerifier: string;\n}\n\nexport interface IssuedOAuthState {\n  /** The serialized state token (cookie + redirect query value). */\n  token: string;\n  /** The PKCE verifier — also embedded in the token, surfaced here so\n   *  the route can pass it to `provider.authorize()` without re-parsing. */\n  codeVerifier: string;\n}\n\nfunction b64url(input: string | Buffer): string {\n  return Buffer.from(input).toString(\"base64url\");\n}\n\nfunction sign(payload: string, secret: string): string {\n  return createHmac(\"sha256\", secret).update(payload).digest(\"base64url\");\n}\n\nexport function issueOAuthState(providerId: string, secret: string): IssuedOAuthState {\n  const nonce = randomBytes(16).toString(\"base64url\");\n  const codeVerifier = randomBytes(CODE_VERIFIER_BYTES).toString(\"base64url\");\n  const expSeconds = Math.floor(Date.now() / 1000) + STATE_TTL_SECONDS;\n  const payload: OAuthStatePayload = { providerId, nonce, expSeconds, codeVerifier };\n  const encoded = b64url(JSON.stringify(payload));\n  const sig = sign(encoded, secret);\n  return { token: `${encoded}.${sig}`, codeVerifier };\n}\n\nexport interface VerifyOAuthStateResult {\n  ok: boolean;\n  payload?: OAuthStatePayload;\n  reason?: \"format\" | \"signature\" | \"expired\";\n}\n\n/**\n * Strict verification:\n *  - Format must be `<payload>.<sig>` with two segments.\n *  - HMAC must match (constant-time compare).\n *  - `expSeconds` must be in the future.\n *  - `providerId` in the payload must match the route's expected provider.\n *  - `codeVerifier` must be a non-empty string.\n */\nexport function verifyOAuthState(\n  token: string,\n  expectedProviderId: string,\n  secret: string,\n): VerifyOAuthStateResult {\n  if (typeof token !== \"string\" || !token.includes(\".\")) {\n    return { ok: false, reason: \"format\" };\n  }\n  const [encoded, sig] = token.split(\".\") as [string, string];\n  if (!encoded || !sig) {\n    return { ok: false, reason: \"format\" };\n  }\n  const expectedSig = sign(encoded, secret);\n  const sigBuf = Buffer.from(sig);\n  const expectedBuf = Buffer.from(expectedSig);\n  if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {\n    return { ok: false, reason: \"signature\" };\n  }\n\n  let payload: OAuthStatePayload;\n  try {\n    payload = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return { ok: false, reason: \"format\" };\n  }\n\n  if (\n    !payload ||\n    typeof payload.providerId !== \"string\" ||\n    typeof payload.nonce !== \"string\" ||\n    typeof payload.expSeconds !== \"number\" ||\n    typeof payload.codeVerifier !== \"string\" ||\n    payload.codeVerifier.length === 0\n  ) {\n    return { ok: false, reason: \"format\" };\n  }\n\n  if (payload.providerId !== expectedProviderId) {\n    return { ok: false, reason: \"signature\" };\n  }\n\n  if (payload.expSeconds <= Math.floor(Date.now() / 1000)) {\n    return { ok: false, reason: \"expired\" };\n  }\n\n  return { ok: true, payload };\n}\n","import type { OAuthProfile, OAuthProvider } from \"./oauth-providers.js\";\n\n/**\n * Adapter that bridges any [arctic](https://arctic.js.org/) provider\n * (`new GitHub(...)`, `new Google(...)`, `new Apple(...)`, etc.) to\n * NexPress's `OAuthProvider` interface.\n *\n * Why this exists: arctic ships ~25 maintained providers and handles\n * the OAuth dance — token exchange, PKCE hashing, refresh-token\n * support — so plugin authors only have to write the **profile fetch**\n * (the part that varies most by provider). Our framework still owns\n * state cookies, identity ↔ user resolution, and session minting; this\n * adapter just lets users skip the boilerplate token POST.\n *\n * Usage from a plugin:\n *\n *   import { Apple } from \"arctic\";\n *   import { fromArctic, registerOAuthProvider } from \"@nexpress/core\";\n *\n *   registerOAuthProvider(fromArctic(\n *     // Factory: framework calls this each request with the freshly-\n *     // resolved redirectUri (matters in dev when Next.js may bind a\n *     // non-default port).\n *     (redirectUri) => new Apple(clientId, teamId, keyId, privateKey, redirectUri),\n *     {\n *       id: \"apple\",\n *       scopes: [\"name\", \"email\"],\n *       fetchProfile: async (accessToken, tokens) => {\n *         // Apple returns the user payload INSIDE the token response\n *         // (not a separate userinfo endpoint) — pull it from\n *         // `tokens.idToken()` here and parse the JWT body.\n *         return { providerUserId: parseAppleSub(tokens.idToken()), email: null };\n *       },\n *     },\n *   ));\n */\n\n/**\n * Minimal slice of arctic's provider classes that the adapter actually\n * needs. Both `GitHub` (no PKCE) and `Google` (PKCE-required) match\n * this — the third positional arg is \"second positional\" for\n * non-PKCE providers (just unused) and \"code verifier\" for PKCE ones.\n *\n * Declared structurally so we don't drag arctic into the public type\n * graph of `@nexpress/core`. Plugins that import a real arctic class\n * pass it directly; the structural match keeps the signature lined up.\n */\nexport interface ArcticLikeProvider {\n  createAuthorizationURL(state: string, ...rest: never[]): URL;\n  validateAuthorizationCode(code: string, ...rest: never[]): Promise<ArcticLikeTokens>;\n}\n\nexport interface ArcticLikeTokens {\n  accessToken(): string;\n  hasRefreshToken?(): boolean;\n  refreshToken?(): string;\n  idToken?(): string;\n}\n\nexport interface FromArcticOptions {\n  /** Provider id used in route paths and `np_user_oauth_identities.provider`. */\n  id: string;\n  /** Human label for admin UI / login buttons. */\n  label?: string;\n  /** Scopes passed to `createAuthorizationURL`. Most providers default\n   *  to nothing useful — set this. */\n  scopes?: string[];\n  /**\n   * Whether the underlying arctic provider expects a PKCE code verifier\n   * as the second arg to `createAuthorizationURL` and\n   * `validateAuthorizationCode`. Default `true` (Google, Apple, etc.).\n   * Set `false` for non-PKCE providers like GitHub.\n   */\n  pkce?: boolean;\n  /**\n   * Turns an access token (and the full token response, useful for\n   * providers like Apple that return the profile in the token) into the\n   * normalized `OAuthProfile` consumed by `resolveOAuthLogin`.\n   *\n   * Throwing aborts the login with `oauth_error=exchange_failed`.\n   */\n  fetchProfile: (\n    accessToken: string,\n    tokens: ArcticLikeTokens,\n  ) => Promise<OAuthProfile>;\n}\n\n/**\n * Wraps an arctic provider into the framework's `OAuthProvider`\n * shape. The framework calls `authorize` and `exchange`; this adapter\n * builds a fresh arctic instance per request via `factory(redirectUri)`\n * so the redirect URI always matches what the framework computed for\n * THIS request — critical in dev where Next.js may fall back to a\n * non-3000 port and a setup-time-frozen redirectUri would diverge.\n *\n * Arctic provider classes are cheap to construct (just hold the three\n * credential strings), so the per-request factory call has no\n * meaningful cost.\n */\nexport function fromArctic(\n  factory: (redirectUri: string) => ArcticLikeProvider,\n  opts: FromArcticOptions,\n): OAuthProvider {\n  const usePkce = opts.pkce !== false;\n  const scopes = opts.scopes ?? [];\n\n  return {\n    id: opts.id,\n    label: opts.label,\n    authorize({ state, redirectUri, codeVerifier }) {\n      const arctic = factory(redirectUri);\n      // Arctic's signatures vary: `(state, scopes)` for non-PKCE,\n      // `(state, codeVerifier, scopes)` for PKCE. The structural type\n      // hides this; do the dispatch here so plugin code stays clean.\n      const url = usePkce\n        ? (arctic.createAuthorizationURL as unknown as (\n            state: string,\n            verifier: string,\n            scopes: string[],\n          ) => URL)(state, codeVerifier, scopes)\n        : (arctic.createAuthorizationURL as unknown as (\n            state: string,\n            scopes: string[],\n          ) => URL)(state, scopes);\n      return url.toString();\n    },\n    async exchange({ code, redirectUri, codeVerifier }) {\n      const arctic = factory(redirectUri);\n      const tokens = usePkce\n        ? await (arctic.validateAuthorizationCode as unknown as (\n            code: string,\n            verifier: string,\n          ) => Promise<ArcticLikeTokens>)(code, codeVerifier)\n        : await (arctic.validateAuthorizationCode as unknown as (\n            code: string,\n          ) => Promise<ArcticLikeTokens>)(code);\n      return opts.fetchProfile(tokens.accessToken(), tokens);\n    },\n  };\n}\n","import { webcrypto } from \"node:crypto\";\n\nimport { eq, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport type { NpAuthUser } from \"../config/types.js\";\nimport { verifyToken, type NpTokenUse } from \"./token.js\";\nimport { npSessions, npUsers } from \"../db/schema/system.js\";\n\n/**\n * Loose Drizzle handle type — every staff-auth caller passes\n * the same NodePgDatabase, but TS over-narrows when the\n * generated schema record is folded in. Using\n * `Record<string, unknown>` keeps the helper portable across\n * schema generations without surfacing as `any`.\n */\ntype SessionDb = NodePgDatabase<Record<string, unknown>>;\n\nexport async function sha256(input: string): Promise<string> {\n  const digest = await webcrypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(input),\n  );\n\n  return Array.from(new Uint8Array(digest), (byte) =>\n    byte.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n}\n\n/**\n * Verify a staff JWT and resolve the active user.\n *\n * `expectedUse` defaults to `\"access\"` because every caller of this\n * helper outside the rotation endpoint reads `np-session` (server\n * components, route handlers, the bootstrap layout). Defaulting\n * means a fresh route or RSC page can't accidentally tolerate a\n * refresh JWT in the session cookie just by forgetting the\n * argument. The rotation route explicitly passes `\"refresh\"` for\n * its `np-refresh` read.\n *\n * Tokens missing the `use` claim throw via `verifyToken`; we let\n * that propagate so a `NpAuthError` surfaces as 401 at the API\n * layer.\n */\nexport async function verifyTokenFull(\n  token: string,\n  secret: string,\n  db: SessionDb,\n  expectedUse: NpTokenUse = \"access\",\n): Promise<NpAuthUser | null> {\n  const payload = await verifyToken(token, secret, expectedUse);\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n      role: npUsers.role,\n      tokenVersion: npUsers.tokenVersion,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.id, payload.sub))\n    .limit(1);\n\n  if (!user || user.tokenVersion !== payload.ver) {\n    return null;\n  }\n\n  return user;\n}\n\nexport async function invalidateAllSessions(\n  userId: string,\n  db: SessionDb,\n): Promise<void> {\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npUsers)\n      .set({\n        tokenVersion: sql`${npUsers.tokenVersion} + 1`,\n      })\n      .where(eq(npUsers.id, userId));\n\n    await tx.delete(npSessions).where(eq(npSessions.userId, userId));\n  });\n}\n","import { and, desc, eq } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { recordAuditEvent } from \"../community/audit.js\";\nimport {\n  npMemberIdentities,\n  npMembers,\n} from \"../db/schema/community.js\";\nimport { npUserOAuthIdentities, npUsers } from \"../db/schema/system.js\";\nimport { NpNotFoundError } from \"../errors.js\";\n\n/**\n * Admin-side helpers for listing and revoking OAuth identity links.\n * Both staff (`np_user_oauth_identities`) and member\n * (`np_member_identities`) tables use the same shape: one row per\n * (account, provider) pair, holding the durable provider subject\n * plus arbitrary metadata. These helpers are the source of truth for\n * `/api/admin/users/[id]/identities` and the member equivalent.\n *\n * Revoking does not invalidate sessions — the user / member can\n * re-link by signing in via OAuth again, which creates a fresh\n * identity row through the resolver. Revocation is intentionally\n * reversible because the durable link is the only thing dropped;\n * the underlying account remains.\n */\n\nexport interface NpUserIdentityRow {\n  id: string;\n  userId: string;\n  provider: string;\n  providerUserId: string;\n  metadata: Record<string, unknown>;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\nexport interface NpMemberIdentityRow {\n  id: string;\n  memberId: string;\n  provider: string;\n  subject: string;\n  email: string | null;\n  metadata: Record<string, unknown>;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\nasync function assertUserExists(userId: string): Promise<void> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const [row] = (await db\n    .select({ id: npUsers.id })\n    .from(npUsers)\n    .where(eq(npUsers.id, userId))\n    .limit(1)) as Array<{ id: string }>;\n  if (!row) throw new NpNotFoundError(\"user\", userId);\n}\n\nasync function assertMemberExists(memberId: string): Promise<void> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const [row] = (await db\n    .select({ id: npMembers.id })\n    .from(npMembers)\n    .where(eq(npMembers.id, memberId))\n    .limit(1)) as Array<{ id: string }>;\n  if (!row) throw new NpNotFoundError(\"member\", memberId);\n}\n\nexport async function listUserIdentities(userId: string): Promise<NpUserIdentityRow[]> {\n  await assertUserExists(userId);\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const rows = (await db\n    .select()\n    .from(npUserOAuthIdentities)\n    .where(eq(npUserOAuthIdentities.userId, userId))\n    .orderBy(desc(npUserOAuthIdentities.createdAt))) as NpUserIdentityRow[];\n  return rows;\n}\n\nexport async function listMemberIdentities(memberId: string): Promise<NpMemberIdentityRow[]> {\n  await assertMemberExists(memberId);\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const rows = (await db\n    .select()\n    .from(npMemberIdentities)\n    .where(eq(npMemberIdentities.memberId, memberId))\n    .orderBy(desc(npMemberIdentities.createdAt))) as NpMemberIdentityRow[];\n  return rows;\n}\n\nexport interface RevokeIdentityInput {\n  /** Staff user id whose identity is being revoked (`actorKind: \"staff\"`). */\n  staffUserId: string;\n}\n\nexport async function revokeUserIdentity(\n  userId: string,\n  identityId: string,\n  actor: RevokeIdentityInput,\n): Promise<void> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  // Fetch the row first so the audit event captures the provider /\n  // subject — once deleted we'd lose the forensic context.\n  const [existing] = (await db\n    .select()\n    .from(npUserOAuthIdentities)\n    .where(\n      and(\n        eq(npUserOAuthIdentities.id, identityId),\n        eq(npUserOAuthIdentities.userId, userId),\n      ),\n    )\n    .limit(1)) as NpUserIdentityRow[];\n  if (!existing) {\n    // Either the identity doesn't exist or it belongs to a different\n    // user — both surface as 404 to avoid leaking cross-user\n    // existence to staff who don't have the right grants.\n    throw new NpNotFoundError(\"identity\", identityId);\n  }\n  // Use `.returning()` so we can tell whether OUR call did the\n  // delete. Two concurrent revokes both pass the select check\n  // above; if we record an audit event unconditionally we'd\n  // double-log the revocation. The second caller's delete returns\n  // zero rows — we skip the audit there.\n  const deleted = (await db\n    .delete(npUserOAuthIdentities)\n    .where(eq(npUserOAuthIdentities.id, identityId))\n    .returning({ id: npUserOAuthIdentities.id })) as Array<{ id: string }>;\n  if (deleted.length === 0) return;\n  await recordAuditEvent({\n    actor: { kind: \"staff\", userId: actor.staffUserId },\n    action: \"user.identity.revoke\",\n    targetType: \"user\",\n    targetId: userId,\n    payload: {\n      identityId,\n      provider: existing.provider,\n      providerUserId: existing.providerUserId,\n    },\n  });\n}\n\nexport async function revokeMemberIdentity(\n  memberId: string,\n  identityId: string,\n  actor: RevokeIdentityInput,\n): Promise<void> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const [existing] = (await db\n    .select()\n    .from(npMemberIdentities)\n    .where(\n      and(\n        eq(npMemberIdentities.id, identityId),\n        eq(npMemberIdentities.memberId, memberId),\n      ),\n    )\n    .limit(1)) as NpMemberIdentityRow[];\n  if (!existing) throw new NpNotFoundError(\"identity\", identityId);\n  const deleted = (await db\n    .delete(npMemberIdentities)\n    .where(eq(npMemberIdentities.id, identityId))\n    .returning({ id: npMemberIdentities.id })) as Array<{ id: string }>;\n  if (deleted.length === 0) return;\n  await recordAuditEvent({\n    actor: { kind: \"staff\", userId: actor.staffUserId },\n    action: \"member.identity.revoke\",\n    targetType: \"member\",\n    targetId: memberId,\n    payload: {\n      identityId,\n      provider: existing.provider,\n      subject: existing.subject,\n    },\n  });\n}\n","import { randomBytes } from \"node:crypto\";\n\nimport { and, eq, gt, isNotNull, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { NpValidationError } from \"../errors.js\";\nimport { npSessions, npUsers } from \"../db/schema/system.js\";\nimport { hashPassword } from \"./password.js\";\nimport { sha256 } from \"./session.js\";\n\nexport type NpPasswordResetPurpose = \"invite\" | \"reset\";\n\nexport interface NpIssuedResetToken {\n  /** The raw token — deliver to the user, never persist. */\n  token: string;\n  /** Matches `np_users.password_reset_expires_at`. */\n  expiresAt: Date;\n  purpose: NpPasswordResetPurpose;\n}\n\nexport interface NpCreateResetTokenOptions {\n  userId: string;\n  purpose: NpPasswordResetPurpose;\n  ttlMs: number;\n}\n\nconst MIN_PASSWORD_LENGTH = 8;\n\nfunction generateRawToken(): string {\n  // 32 bytes → 64 hex chars. Wide enough that brute force is hopeless.\n  return randomBytes(32).toString(\"hex\");\n}\n\n/**\n * Issues a new password reset token for `userId`. Stores the **hash** of the\n * token in the `np_users` row alongside the expiry and purpose, then returns\n * the raw token for the caller to deliver (email/link).\n *\n * Any previously-outstanding reset token for the user is replaced.\n */\nexport async function createPasswordResetToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  options: NpCreateResetTokenOptions,\n): Promise<NpIssuedResetToken> {\n  const token = generateRawToken();\n  const tokenHash = await sha256(token);\n  const expiresAt = new Date(Date.now() + options.ttlMs);\n\n  await db\n    .update(npUsers)\n    .set({\n      passwordResetTokenHash: tokenHash,\n      passwordResetExpiresAt: expiresAt,\n      passwordResetPurpose: options.purpose,\n      updatedAt: new Date(),\n    })\n    .where(eq(npUsers.id, options.userId));\n\n  return { token, expiresAt, purpose: options.purpose };\n}\n\nexport interface NpResetRequestResult {\n  userId: string | null;\n  name: string | null;\n  email: string | null;\n  issued: NpIssuedResetToken | null;\n}\n\n/**\n * Handles the \"forgot password\" flow. If the email matches a user, issues a\n * reset token and returns their name so the mailer can personalise the email.\n * If not, silently returns nulls so callers can respond with a constant\n * message and avoid email enumeration.\n */\nexport async function requestPasswordReset(\n  db: NodePgDatabase<Record<string, unknown>>,\n  email: string,\n  ttlMs: number,\n): Promise<NpResetRequestResult> {\n  const normalizedEmail = email.trim().toLowerCase();\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.email, normalizedEmail))\n    .limit(1);\n\n  if (!user) {\n    return { userId: null, name: null, email: null, issued: null };\n  }\n\n  const issued = await createPasswordResetToken(db, {\n    userId: user.id,\n    purpose: \"reset\",\n    ttlMs,\n  });\n\n  return { userId: user.id, name: user.name, email: user.email, issued };\n}\n\nexport interface NpConsumeResetTokenOptions {\n  token: string;\n  newPassword: string;\n}\n\nexport interface NpConsumeResetTokenResult {\n  userId: string;\n  email: string;\n  purpose: NpPasswordResetPurpose;\n}\n\n/**\n * Verifies a password reset token and atomically:\n * - sets the new password hash\n * - bumps `tokenVersion` and deletes all sessions (force logout everywhere)\n * - clears the reset columns on the user row\n *\n * Throws `NpValidationError` when the token is unknown, expired, or the\n * password is too short. Uses a single DB transaction for atomicity.\n */\nexport async function consumePasswordResetToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  options: NpConsumeResetTokenOptions,\n): Promise<NpConsumeResetTokenResult> {\n  if (!options.token || typeof options.token !== \"string\") {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset token is required.\" },\n    ]);\n  }\n\n  if (!options.newPassword || options.newPassword.length < MIN_PASSWORD_LENGTH) {\n    throw new NpValidationError(\"Invalid input\", [\n      {\n        field: \"password\",\n        message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`,\n      },\n    ]);\n  }\n\n  const tokenHash = await sha256(options.token);\n  const now = new Date();\n\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      purpose: npUsers.passwordResetPurpose,\n    })\n    .from(npUsers)\n    .where(\n      and(\n        eq(npUsers.passwordResetTokenHash, tokenHash),\n        isNotNull(npUsers.passwordResetExpiresAt),\n        gt(npUsers.passwordResetExpiresAt, now),\n      ),\n    )\n    .limit(1);\n\n  if (!user) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset link is invalid or has expired.\" },\n    ]);\n  }\n\n  const newPasswordHash = await hashPassword(options.newPassword);\n\n  // We inline the tokenVersion bump + session delete instead of calling\n  // invalidateAllSessions because we need them to land in the same\n  // transaction as the password write + reset-column clear. Splitting into\n  // two transactions could leave the user with a new password but still-\n  // valid old JWTs if the second call failed.\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npUsers)\n      .set({\n        password: newPasswordHash,\n        passwordResetTokenHash: null,\n        passwordResetExpiresAt: null,\n        passwordResetPurpose: null,\n        loginAttempts: 0,\n        lockUntil: null,\n        tokenVersion: sql`${npUsers.tokenVersion} + 1`,\n        updatedAt: new Date(),\n      })\n      .where(eq(npUsers.id, user.id));\n\n    await tx.delete(npSessions).where(eq(npSessions.userId, user.id));\n  });\n\n  return {\n    userId: user.id,\n    email: user.email,\n    purpose: (user.purpose ?? \"reset\") as NpPasswordResetPurpose,\n  };\n}\n","import { randomBytes } from \"node:crypto\";\nimport { jwtVerify, SignJWT, type JWTPayload } from \"jose\";\n\nimport { NpAuthError } from \"../errors.js\";\n\n/**\n * Member-side JWT helpers. Mirrors `signToken` / `verifyToken` for\n * staff but adds a fixed `aud: \"member\"` claim so a forged JWT signed\n * for a staff user can't be replayed against member-only routes (and\n * vice-versa).\n *\n * The signing secret is the same `NP_SECRET`; rotating it invalidates\n * both staff and member sessions, which is the desired behavior.\n *\n * Every token gets a random `jti` so two tokens minted within the\n * same second for the same member produce DIFFERENT JWT strings —\n * needed for refresh-token rotation: without it, the rotated token\n * hash would collide with the prior token hash and revocation by\n * tokenHash would still resolve the rotated row.\n *\n * `use: \"access\" | \"refresh\"` separates the two token purposes. A\n * refresh JWT cannot be presented as the `np-mb-session` cookie and\n * a session JWT cannot drive the rotation endpoint — without this\n * separation a leaked refresh token effectively became a long-lived\n * bearer access token because both kinds were stored as fungible\n * rows in `np_member_sessions` with no row-level kind column.\n */\nexport type NpMemberTokenUse = \"access\" | \"refresh\";\n\nexport interface NpMemberTokenPayload {\n  sub: string;\n  aud: \"member\";\n  ver: number;\n  /** Required. `verifyMemberToken` refuses tokens missing this claim\n   *  so legacy refresh JWTs from before #92 cannot be smuggled into\n   *  the session cookie path (#91 reopen). */\n  use: NpMemberTokenUse;\n  /** Optional only for the deploy window; new tokens always carry\n   *  one. */\n  jti?: string;\n  iat: number;\n  exp: number;\n}\n\nconst textEncoder = new TextEncoder();\nconst MEMBER_AUDIENCE = \"member\";\n\nexport async function signMemberToken(\n  member: { id: string; tokenVersion: number },\n  secret: string,\n  expirationSeconds: number = 7200,\n  tokenUse: NpMemberTokenUse = \"access\",\n): Promise<string> {\n  const secretKey = textEncoder.encode(secret);\n  return new SignJWT({ sub: member.id, ver: member.tokenVersion, use: tokenUse })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setAudience(MEMBER_AUDIENCE)\n    .setJti(randomBytes(16).toString(\"base64url\"))\n    .setIssuedAt()\n    .setExpirationTime(Math.floor(Date.now() / 1000) + expirationSeconds)\n    .sign(secretKey);\n}\n\n/**\n * Verify a member JWT and return the parsed payload. When\n * `expectedUse` is provided, refuses tokens whose `use` claim doesn't\n * match — that's how `getSessionMember` rejects a refresh token used\n * as a session cookie and how the refresh route rejects an access\n * token as a refresh trigger.\n *\n * Tokens minted before the `use` claim landed have NO `use` payload\n * field. We refuse those outright rather than treating them as\n * `access` — the prior fallback let still-live legacy refresh JWTs\n * (already persisted in `np_member_sessions` per #45's fix) be\n * smuggled into the session cookie and pass the access check (#91\n * reopen). The cost: members logged in before this deploy must log\n * in once. That's bounded by the access-token TTL (default 2h);\n * legacy session rows that don't match a new login age out via\n * `expiresAt` within 7 days regardless.\n */\nexport async function verifyMemberToken(\n  token: string,\n  secret: string,\n  expectedUse?: NpMemberTokenUse,\n): Promise<NpMemberTokenPayload> {\n  const secretKey = textEncoder.encode(secret);\n  const { payload } = await jwtVerify(token, secretKey, { audience: MEMBER_AUDIENCE });\n  // jwtVerify already validated `aud === MEMBER_AUDIENCE`; cast through\n  // JWTPayload to lock in the fields we know land on member tokens.\n  const typed = payload as JWTPayload & {\n    sub: string;\n    ver: number;\n    iat: number;\n    exp: number;\n    use?: NpMemberTokenUse;\n  };\n  if (typed.use !== \"access\" && typed.use !== \"refresh\") {\n    throw new NpAuthError(\"Member token missing `use` claim\");\n  }\n  const use: NpMemberTokenUse = typed.use;\n  if (expectedUse && use !== expectedUse) {\n    // Throw `NpAuthError` so the response mapper emits 401 instead of\n    // a plain 500 — this is an auth failure, not a server failure.\n    throw new NpAuthError(\n      `Member token use mismatch: expected ${expectedUse}, got ${use}`,\n    );\n  }\n  return { ...typed, aud: MEMBER_AUDIENCE, use };\n}\n","import { and, eq, gt, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { npMemberSessions, npMembers } from \"../db/schema/community.js\";\nimport { sha256 } from \"./session.js\";\n\n/**\n * Member-side session lookups, mirroring the staff helpers in session.ts\n * but for `np_members` / `np_member_sessions`. The sha256 helper is\n * reused (sessions store hashed tokens regardless of the principal kind).\n */\n\nexport interface NpMemberAuthRow {\n  id: string;\n  email: string;\n  handle: string;\n  displayName: string;\n  status: \"active\" | \"pending\" | \"suspended\" | \"deleted\";\n  tokenVersion: number;\n}\n\n/**\n * Resolve a member from a verified JWT payload AND the raw access\n * token. We hash the token and require a live row in\n * `np_member_sessions` — without that row check, deleting a session in\n * `/api/members/logout` had no effect and a stolen token kept working\n * until JWT expiry. (#45)\n *\n * Backward-compat: when no `accessToken` is passed (legacy callers in\n * tests / older routes), we fall back to the previous tokenVersion\n * check only. New paths should always pass the token.\n */\nexport async function getMemberFromTokenPayload(\n  db: NodePgDatabase<Record<string, unknown>>,\n  payload: { sub: string; ver: number },\n  accessToken?: string,\n): Promise<NpMemberAuthRow | null> {\n  const [row] = await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n      tokenVersion: npMembers.tokenVersion,\n    })\n    .from(npMembers)\n    .where(eq(npMembers.id, payload.sub))\n    .limit(1);\n\n  if (!row) return null;\n  if (row.tokenVersion !== payload.ver) return null;\n\n  if (accessToken) {\n    const tokenHash = await sha256(accessToken);\n    const now = new Date();\n    const [session] = (await db\n      .select({ id: npMemberSessions.id })\n      .from(npMemberSessions)\n      .where(\n        and(\n          eq(npMemberSessions.memberId, row.id),\n          eq(npMemberSessions.tokenHash, tokenHash),\n          gt(npMemberSessions.expiresAt, now),\n        ),\n      )\n      .limit(1)) as Array<{ id: string }>;\n    if (!session) return null;\n  }\n\n  return row as NpMemberAuthRow;\n}\n\n/**\n * Bumps a member's tokenVersion + drops every session row, force-logging\n * them out everywhere. Call inside the same transaction as a password\n * change / soft-delete so a leaked old JWT can't outlive the change.\n */\nexport async function invalidateAllMemberSessions(\n  db: NodePgDatabase<Record<string, unknown>>,\n  memberId: string,\n): Promise<void> {\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npMembers)\n      .set({\n        tokenVersion: sql`${npMembers.tokenVersion} + 1`,\n        updatedAt: new Date(),\n      })\n      .where(eq(npMembers.id, memberId));\n    await tx.delete(npMemberSessions).where(eq(npMemberSessions.memberId, memberId));\n  });\n}\n","import { randomBytes } from \"node:crypto\";\n\nimport { and, eq, gt, isNotNull, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { NpValidationError } from \"../errors.js\";\nimport { npMemberSessions, npMembers } from \"../db/schema/community.js\";\nimport { hashPassword } from \"./password.js\";\nimport { sha256 } from \"./session.js\";\n\n/**\n * Member-side credential flows: email verification on registration,\n * password reset, password change. Mirrors the staff equivalents in\n * `reset-token.ts` but writes to `np_members` and uses dedicated\n * verify columns (`email_verify_token_hash` / `email_verify_expires_at`)\n * so a verify and a reset can coexist on the same member row.\n */\n\nconst MIN_PASSWORD_LENGTH = 8;\n\nexport interface NpIssuedMemberToken {\n  /** The raw token to ship to the user. Never persist. */\n  token: string;\n  expiresAt: Date;\n}\n\nfunction generateRawToken(): string {\n  return randomBytes(32).toString(\"hex\");\n}\n\n// ── Email verification ────────────────────────────────────────────────\n\nexport async function createMemberEmailVerifyToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  memberId: string,\n  ttlMs: number,\n): Promise<NpIssuedMemberToken> {\n  const token = generateRawToken();\n  const tokenHash = await sha256(token);\n  const expiresAt = new Date(Date.now() + ttlMs);\n\n  await db\n    .update(npMembers)\n    .set({\n      emailVerifyTokenHash: tokenHash,\n      emailVerifyExpiresAt: expiresAt,\n      updatedAt: new Date(),\n    })\n    .where(eq(npMembers.id, memberId));\n\n  return { token, expiresAt };\n}\n\nexport interface NpConsumeMemberEmailVerifyResult {\n  memberId: string;\n  email: string;\n  handle: string;\n  displayName: string;\n}\n\nexport async function consumeMemberEmailVerifyToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  token: string,\n): Promise<NpConsumeMemberEmailVerifyResult> {\n  if (!token || typeof token !== \"string\") {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Verification token is required.\" },\n    ]);\n  }\n  const tokenHash = await sha256(token);\n  const now = new Date();\n\n  const [member] = await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n    })\n    .from(npMembers)\n    .where(\n      and(\n        eq(npMembers.emailVerifyTokenHash, tokenHash),\n        isNotNull(npMembers.emailVerifyExpiresAt),\n        gt(npMembers.emailVerifyExpiresAt, now),\n      ),\n    )\n    .limit(1);\n\n  if (!member) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Verification link is invalid or has expired.\" },\n    ]);\n  }\n\n  await db\n    .update(npMembers)\n    .set({\n      emailVerified: true,\n      // Pending → active on first verify so login can succeed afterwards.\n      // Suspended/deleted members stay where they are; the mod UI flips\n      // those statuses, never the verify endpoint.\n      status: sql`case when ${npMembers.status} = 'pending' then 'active' else ${npMembers.status} end`,\n      emailVerifyTokenHash: null,\n      emailVerifyExpiresAt: null,\n      updatedAt: now,\n    })\n    .where(eq(npMembers.id, member.id));\n\n  return {\n    memberId: member.id,\n    email: member.email,\n    handle: member.handle,\n    displayName: member.displayName,\n  };\n}\n\n// ── Password reset ────────────────────────────────────────────────────\n\nexport interface NpMemberResetRequestResult {\n  memberId: string | null;\n  displayName: string | null;\n  email: string | null;\n  issued: NpIssuedMemberToken | null;\n}\n\nexport async function requestMemberPasswordReset(\n  db: NodePgDatabase<Record<string, unknown>>,\n  email: string,\n  ttlMs: number,\n): Promise<NpMemberResetRequestResult> {\n  const normalizedEmail = email.trim().toLowerCase();\n  const [member] = await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n    })\n    .from(npMembers)\n    .where(eq(npMembers.email, normalizedEmail))\n    .limit(1);\n\n  if (!member || member.status === \"deleted\") {\n    return { memberId: null, displayName: null, email: null, issued: null };\n  }\n\n  const token = generateRawToken();\n  const tokenHash = await sha256(token);\n  const expiresAt = new Date(Date.now() + ttlMs);\n\n  await db\n    .update(npMembers)\n    .set({\n      passwordResetTokenHash: tokenHash,\n      passwordResetExpiresAt: expiresAt,\n      updatedAt: new Date(),\n    })\n    .where(eq(npMembers.id, member.id));\n\n  return {\n    memberId: member.id,\n    displayName: member.displayName,\n    email: member.email,\n    issued: { token, expiresAt },\n  };\n}\n\nexport interface NpConsumeMemberResetResult {\n  memberId: string;\n  email: string;\n}\n\nexport async function consumeMemberPasswordReset(\n  db: NodePgDatabase<Record<string, unknown>>,\n  token: string,\n  newPassword: string,\n): Promise<NpConsumeMemberResetResult> {\n  if (!token || typeof token !== \"string\") {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset token is required.\" },\n    ]);\n  }\n  if (!newPassword || newPassword.length < MIN_PASSWORD_LENGTH) {\n    throw new NpValidationError(\"Invalid input\", [\n      {\n        field: \"password\",\n        message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`,\n      },\n    ]);\n  }\n\n  const tokenHash = await sha256(token);\n  const now = new Date();\n\n  const [member] = await db\n    .select({ id: npMembers.id, email: npMembers.email })\n    .from(npMembers)\n    .where(\n      and(\n        eq(npMembers.passwordResetTokenHash, tokenHash),\n        isNotNull(npMembers.passwordResetExpiresAt),\n        gt(npMembers.passwordResetExpiresAt, now),\n      ),\n    )\n    .limit(1);\n\n  if (!member) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset link is invalid or has expired.\" },\n    ]);\n  }\n\n  const newPasswordHash = await hashPassword(newPassword);\n\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npMembers)\n      .set({\n        password: newPasswordHash,\n        passwordResetTokenHash: null,\n        passwordResetExpiresAt: null,\n        loginAttempts: 0,\n        lockUntil: null,\n        // Bump tokenVersion in-place so existing JWTs are invalidated. Also\n        // mark email as verified — completing a reset on an unverified\n        // account is itself proof of email ownership.\n        tokenVersion: sql`${npMembers.tokenVersion} + 1`,\n        emailVerified: true,\n        status: sql`case when ${npMembers.status} = 'pending' then 'active' else ${npMembers.status} end`,\n        updatedAt: new Date(),\n      })\n      .where(eq(npMembers.id, member.id));\n\n    await tx.delete(npMemberSessions).where(eq(npMemberSessions.memberId, member.id));\n  });\n\n  return { memberId: member.id, email: member.email };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,IAAM,gBAAkC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;AAExD,IAAM,UAA4B,CAAC,EAAE,KAAK,MAAM,MAAM,SAAS;AAE/D,IAAM,kBAAoC,CAAC,EAAE,KAAK,MACvD,CAAC,CAAC,SAAS,KAAK,SAAS,WAAW,KAAK,SAAS;AAE7C,IAAM,iBAAmC,CAAC,EAAE,MAAM,IAAI,MAC3D,MAAM,SAAS,WAAW,KAAK,cAAc,MAAM;;;ACVrD,SAAS,mBAAmB;AAC5B,SAAS,WAAW,SAAS,UAAU,kBAAmC;AAqC1E,IAAM,cAAc,IAAI,YAAY;AAEpC,eAAsB,UACpB,MACA,QACA,oBAA4B,MAC5B,WAAuB,UACN;AACjB,QAAM,YAAY,YAAY,OAAO,MAAM;AAE3C,SAAO,IAAI,QAAQ;AAAA,IACjB,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,IACV,KAAK;AAAA,EACP,CAAC,EACE,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW,CAAC,EAC5C,YAAY,EACZ,kBAAkB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,iBAAiB,EACnE,KAAK,SAAS;AACnB;AAeA,eAAsB,YACpB,OACA,QACA,aACyB;AACzB,QAAM,YAAY,YAAY,OAAO,MAAM;AAC3C,QAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,SAAS;AACpD,QAAM,QAAQ;AAQd,MAAI,MAAM,QAAQ,YAAY,MAAM,QAAQ,WAAW;AACrD,UAAM,IAAI,YAAY,iCAAiC;AAAA,EACzD;AACA,QAAM,MAAkB,MAAM;AAC9B,MAAI,eAAe,QAAQ,aAAa;AACtC,UAAM,IAAI;AAAA,MACR,sCAAsC,WAAW,SAAS,GAAG;AAAA,IAC/D;AAAA,EACF;AACA,SAAO,EAAE,GAAG,OAAO,IAAI;AACzB;AAeO,SAAS,yBAAyB,KAAuB;AAC9D,MAAI,eAAe,YAAa,QAAO;AACvC,MAAI,eAAe,WAAW,UAAW,QAAO;AAChD,SAAO;AACT;;;ACtHA,SAAS,UAAU;AA2BnB,eAAsB,YAAY,IAAyC;AACzE,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,MAAM,QAAQ;AAAA,IACd,OAAO,QAAQ;AAAA,EACjB,CAAC,EACA,KAAK,OAAO,EACZ,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC,EACxB,MAAM,CAAC;AACV,SAAO,QAAQ;AACjB;;;ACvCA,SAAS,MAAM,cAA4B;AAEpC,IAAM,iBAA0B;AAAA,EACrC,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,WAAW;AAAA,EACX,aAAa;AACf;AAKA,IAAM,sBAA+B;AAAA,EACnC,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,WAAW;AAAA,EACX,aAAa;AACf;AAEO,SAAS,aAAa,UAAmC;AAC9D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,IAAI,sBAAsB,MAAM,sBAAsB;AAAA,EAChE;AACF;AAEO,SAAS,eACd,cACA,UACkB;AAClB,SAAO,OAAO,cAAc,QAAQ;AACtC;;;AC/BA,IAAM,eAAe,oBAAI,IAAI,CAAC,OAAO,QAAQ,SAAS,CAAC;AAEhD,SAAS,WACd,QACA,aACA,aACS;AACT,MAAI,aAAa,IAAI,OAAO,YAAY,CAAC,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,eAAe,eAAe,gBAAgB,WAAW;AAC1E;;;ACoEA,IAAM,YAAY,oBAAI,IAA2B;AAO1C,SAAS,sBAAsB,UAA+B;AACnE,MAAI,CAAC,SAAS,MAAM,OAAO,SAAS,OAAO,UAAU;AACnD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,OAAO,SAAS,cAAc,cAAc,OAAO,SAAS,aAAa,YAAY;AACvF,UAAM,IAAI;AAAA,MACR,mBAAmB,SAAS,EAAE;AAAA,IAChC;AAAA,EACF;AACA,YAAU,IAAI,SAAS,IAAI,QAAQ;AACrC;AAEO,SAAS,iBAAiB,IAAuC;AACtE,SAAO,UAAU,IAAI,EAAE;AACzB;AAEO,SAAS,qBAAsC;AACpD,SAAO,MAAM,KAAK,UAAU,OAAO,CAAC;AACtC;AAGO,SAAS,sBAA4B;AAC1C,YAAU,MAAM;AAClB;;;AC9GA,SAAS,MAAAA,KAAI,KAAK,WAAW;AAoD7B,IAAM,yBAAyB;AAE/B,SAAS,eAAe,UAAkB,gBAAgC;AAExE,SAAO,GAAG,cAAc,IAAI,QAAQ,GAAG,sBAAsB;AAC/D;AAEA,SAAS,WAAW,SAAuB,eAA+B;AACxE,MAAI,QAAQ,QAAQ,QAAQ,KAAK,KAAK,EAAE,SAAS,EAAG,QAAO,QAAQ,KAAK,KAAK;AAC7E,QAAM,YAAY,cAAc,MAAM,GAAG,EAAE,CAAC;AAC5C,SAAO,aAAa,UAAU,SAAS,IAAI,YAAY;AACzD;AAEA,eAAsB,kBACpB,OACkC;AAClC,QAAM,KAAK,MAAM;AACjB,QAAM,WAAW,MAAM;AACvB,QAAM,UAAU,MAAM;AACtB,QAAM,OAAmB,MAAM,eAAe;AAG9C,QAAM,CAAC,YAAY,IAAK,MAAM,GAC3B,OAAO;AAAA,IACN,QAAQ,sBAAsB;AAAA,IAC9B,YAAY,sBAAsB;AAAA,EACpC,CAAC,EACA,KAAK,qBAAqB,EAC1B;AAAA,IACC;AAAA,MACEC,IAAG,sBAAsB,UAAU,QAAQ;AAAA,MAC3CA,IAAG,sBAAsB,gBAAgB,QAAQ,cAAc;AAAA,IACjE;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,cAAc;AAEhB,UAAM,WAAW,cAAc,OAAO;AACtC,UAAM,GACH,OAAO,qBAAqB,EAC5B,IAAI,EAAE,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC,EACvC,MAAMA,IAAG,sBAAsB,IAAI,aAAa,UAAU,CAAC;AAE9D,UAAM,OAAO,MAAM,SAAS,IAAI,aAAa,MAAM;AACnD,WAAO,EAAE,MAAM,SAAS,OAAO,QAAQ,MAAM;AAAA,EAC/C;AAIA,MAAI,QAAQ,OAAO;AACjB,UAAM,kBAAkB,QAAQ,MAAM,KAAK,EAAE,YAAY;AACzD,UAAM,CAAC,YAAY,IAAK,MAAM,GAC3B,OAAO;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,IACxB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMA,IAAG,YAAY,QAAQ,KAAK,KAAK,eAAe,CAAC,EACvD,MAAM,CAAC;AAEV,QAAI,cAAc;AAChB,YAAM,GAAG,OAAO,qBAAqB,EAAE,OAAO;AAAA,QAC5C,QAAQ,aAAa;AAAA,QACrB;AAAA,QACA,gBAAgB,QAAQ;AAAA,QACxB,UAAU,cAAc,OAAO;AAAA,MACjC,CAAC;AACD,aAAO,EAAE,MAAM,cAAc,SAAS,OAAO,QAAQ,KAAK;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,QACJ,QAAQ,SAAS,QAAQ,MAAM,KAAK,EAAE,SAAS,IAC3C,QAAQ,MAAM,KAAK,EAAE,YAAY,IACjC,eAAe,UAAU,QAAQ,cAAc;AACrD,QAAM,OAAO,WAAW,SAAS,KAAK;AACtC,QAAM,sBAAsB,MAAM;AAAA,IAChC,OAAO,WAAW,IAAI,OAAO,WAAW;AAAA,EAC1C;AAEA,QAAM,CAAC,OAAO,IAAK,MAAM,GACtB,OAAO,OAAO,EACd,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,EACF,CAAC,EACA,UAAU;AAAA,IACT,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,cAAc,QAAQ;AAAA,EACxB,CAAC;AAEH,QAAM,GAAG,OAAO,qBAAqB,EAAE,OAAO;AAAA,IAC5C,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,gBAAgB,QAAQ;AAAA,IACxB,UAAU,cAAc,OAAO;AAAA,EACjC,CAAC;AAED,SAAO,EAAE,MAAM,SAAS,SAAS,MAAM,QAAQ,KAAK;AACtD;AAEA,SAAS,cAAc,SAAgD;AACrE,QAAM,OAAgC,CAAC;AACvC,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,MAAO,MAAK,QAAQ,QAAQ;AACxC,MAAI,QAAQ,KAAM,MAAK,OAAO,QAAQ;AACtC,MAAI,QAAQ,SAAU,QAAO,OAAO,MAAM,QAAQ,QAAQ;AAC1D,SAAO;AACT;AAEA,eAAe,SACb,IACA,QAC4B;AAC5B,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,cAAc,QAAQ;AAAA,EACxB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMA,IAAG,QAAQ,IAAI,MAAM,CAAC,EAC5B,MAAM,CAAC;AACV,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,QAAQ,MAAM,0CAA0C;AAAA,EAC1E;AACA,SAAO;AACT;;;AC/LA,SAAS,OAAAC,MAAK,MAAAC,KAAI,OAAAC,YAAW;AAkD7B,IAAMC,0BAAyB;AAC/B,IAAM,kBAAkB;AACxB,IAAM,6BAA6B;AAEnC,SAASC,gBAAe,UAAkB,gBAAgC;AACxE,SAAO,GAAG,cAAc,IAAI,QAAQ,GAAGD,uBAAsB;AAC/D;AAWA,SAAS,eAAe,SAAuB,eAA+B;AAC5E,QAAM,OACH,QAAQ,YAAY,OAAO,QAAQ,SAAS,UAAU,YAAY,QAAQ,SAAS,SACpF,QAAQ,QACR,cAAc,MAAM,GAAG,EAAE,CAAC,KAC1B;AACF,QAAM,YAAY,OAAO,IAAI,EAC1B,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,QAAQ,UAAU,EAAE,EACpB,MAAM,GAAG,EAAE;AACd,QAAM,OAAO,UAAU,UAAU,IAAI,YAAY;AAIjD,QAAM,SAAS,KAAK,OAAO,EACxB,SAAS,EAAE,EACX,MAAM,GAAG,IAAI,0BAA0B;AAC1C,SAAO,GAAG,IAAI,IAAI,MAAM,GAAG,MAAM,GAAG,EAAE;AACxC;AAEA,SAAS,kBAAkB,SAAuB,eAA+B;AAC/E,MAAI,QAAQ,QAAQ,QAAQ,KAAK,KAAK,EAAE,SAAS,EAAG,QAAO,QAAQ,KAAK,KAAK;AAC7E,QAAM,YAAY,cAAc,MAAM,GAAG,EAAE,CAAC;AAC5C,SAAO,aAAa,UAAU,SAAS,IAAI,YAAY;AACzD;AAEA,SAASE,eAAc,SAAgD;AACrE,QAAM,OAAgC,CAAC;AACvC,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,MAAO,MAAK,QAAQ,QAAQ;AACxC,MAAI,QAAQ,KAAM,MAAK,OAAO,QAAQ;AACtC,MAAI,QAAQ,SAAU,QAAO,OAAO,MAAM,QAAQ,QAAQ;AAC1D,SAAO;AACT;AAEA,eAAe,WACb,IACA,UAC8B;AAC9B,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,IAClB,cAAc,UAAU;AAAA,EAC1B,CAAC,EACA,KAAK,SAAS,EACd,MAAMC,IAAG,UAAU,IAAI,QAAQ,CAAC,EAChC,MAAM,CAAC;AACV,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,UAAU,QAAQ,0CAA0C;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,eAAsB,wBACpB,OACwC;AACxC,QAAM,KAAK,MAAM;AACjB,QAAM,EAAE,UAAU,QAAQ,IAAI;AAG9B,QAAM,CAAC,YAAY,IAAK,MAAM,GAC3B,OAAO,EAAE,UAAU,mBAAmB,UAAU,YAAY,mBAAmB,GAAG,CAAC,EACnF,KAAK,kBAAkB,EACvB;AAAA,IACCC;AAAA,MACED,IAAG,mBAAmB,UAAU,QAAQ;AAAA,MACxCA,IAAG,mBAAmB,SAAS,QAAQ,cAAc;AAAA,IACvD;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,cAAc;AAChB,UAAM,GACH,OAAO,kBAAkB,EACzB,IAAI,EAAE,UAAUD,eAAc,OAAO,GAAG,WAAW,oBAAI,KAAK,EAAE,CAAC,EAC/D,MAAMC,IAAG,mBAAmB,IAAI,aAAa,UAAU,CAAC;AAC3D,UAAM,SAAS,MAAM,WAAW,IAAI,aAAa,QAAQ;AACzD,WAAO,EAAE,QAAQ,SAAS,OAAO,QAAQ,MAAM;AAAA,EACjD;AAGA,MAAI,QAAQ,OAAO;AACjB,UAAM,kBAAkB,QAAQ,MAAM,KAAK,EAAE,YAAY;AACzD,UAAM,CAAC,cAAc,IAAK,MAAM,GAC7B,OAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,OAAO,UAAU;AAAA,MACjB,QAAQ,UAAU;AAAA,MAClB,aAAa,UAAU;AAAA,MACvB,QAAQ,UAAU;AAAA,MAClB,cAAc,UAAU;AAAA,IAC1B,CAAC,EACA,KAAK,SAAS,EACd,MAAMA,IAAGE,aAAY,UAAU,KAAK,KAAK,eAAe,CAAC,EACzD,MAAM,CAAC;AAEV,QAAI,gBAAgB;AAalB,UAAI,eAAe,WAAW,UAAU;AACtC,eAAO,EAAE,QAAQ,gBAAgB,SAAS,OAAO,QAAQ,MAAM;AAAA,MACjE;AACA,YAAM,GAAG,OAAO,kBAAkB,EAAE,OAAO;AAAA,QACzC,UAAU,eAAe;AAAA,QACzB;AAAA,QACA,SAAS,QAAQ;AAAA,QACjB,OAAO,QAAQ;AAAA,QACf,UAAUH,eAAc,OAAO;AAAA,MACjC,CAAC;AACD,aAAO,EAAE,QAAQ,gBAAgB,SAAS,OAAO,QAAQ,KAAK;AAAA,IAChE;AAAA,EACF;AAeA,QAAM,WAAW,MAAM,qBAAqB;AAC5C,MAAI,CAAC,SAAS,qBAAqB;AACjC,UAAM,IAAI,iBAAiB,WAAW,UAAU;AAAA,EAClD;AAEA,QAAM,QACJ,QAAQ,SAAS,QAAQ,MAAM,KAAK,EAAE,SAAS,IAC3C,QAAQ,MAAM,KAAK,EAAE,YAAY,IACjCD,gBAAe,UAAU,QAAQ,cAAc;AACrD,QAAM,cAAc,kBAAkB,SAAS,KAAK;AACpD,QAAM,SAAS,eAAe,SAAS,KAAK;AAC5C,QAAM,sBAAsB,MAAM;AAAA,IAChC,OAAO,WAAW,IAAI,OAAO,WAAW;AAAA,EAC1C;AAEA,QAAM,CAAC,OAAO,IAAK,MAAM,GACtB,OAAO,SAAS,EAChB,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC,EACA,UAAU;AAAA,IACT,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,IAClB,cAAc,UAAU;AAAA,EAC1B,CAAC;AAEH,QAAM,GAAG,OAAO,kBAAkB,EAAE,OAAO;AAAA,IACzC,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ,SAAS;AAAA,IACxB,UAAUC,eAAc,OAAO;AAAA,EACjC,CAAC;AAED,SAAO,EAAE,QAAQ,SAAS,SAAS,MAAM,QAAQ,KAAK;AACxD;;;AC9PA,SAAS,YAAY,eAAAI,cAAa,uBAAuB;AA0BzD,IAAM,oBAAoB,mBAAmB,8BAA8B,GAAG;AAC9E,IAAM,sBAAsB;AAiB5B,SAAS,OAAO,OAAgC;AAC9C,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AAChD;AAEA,SAAS,KAAK,SAAiB,QAAwB;AACrD,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW;AACxE;AAEO,SAAS,gBAAgB,YAAoB,QAAkC;AACpF,QAAM,QAAQC,aAAY,EAAE,EAAE,SAAS,WAAW;AAClD,QAAM,eAAeA,aAAY,mBAAmB,EAAE,SAAS,WAAW;AAC1E,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AACnD,QAAM,UAA6B,EAAE,YAAY,OAAO,YAAY,aAAa;AACjF,QAAM,UAAU,OAAO,KAAK,UAAU,OAAO,CAAC;AAC9C,QAAM,MAAM,KAAK,SAAS,MAAM;AAChC,SAAO,EAAE,OAAO,GAAG,OAAO,IAAI,GAAG,IAAI,aAAa;AACpD;AAgBO,SAAS,iBACd,OACA,oBACA,QACwB;AACxB,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,SAAS,GAAG,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,QAAM,CAAC,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG;AACtC,MAAI,CAAC,WAAW,CAAC,KAAK;AACpB,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,QAAM,cAAc,KAAK,SAAS,MAAM;AACxC,QAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,QAAM,cAAc,OAAO,KAAK,WAAW;AAC3C,MAAI,OAAO,WAAW,YAAY,UAAU,CAAC,gBAAgB,QAAQ,WAAW,GAAG;AACjF,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AAEA,MACE,CAAC,WACD,OAAO,QAAQ,eAAe,YAC9B,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,eAAe,YAC9B,OAAO,QAAQ,iBAAiB,YAChC,QAAQ,aAAa,WAAW,GAChC;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AAEA,MAAI,QAAQ,eAAe,oBAAoB;AAC7C,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AAEA,MAAI,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AACvD,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxC;AAEA,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;;;ACvBO,SAAS,WACd,SACA,MACe;AACf,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,SAAS,KAAK,UAAU,CAAC;AAE/B,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,EAAE,OAAO,aAAa,aAAa,GAAG;AAC9C,YAAM,SAAS,QAAQ,WAAW;AAIlC,YAAM,MAAM,UACP,OAAO,uBAIE,OAAO,cAAc,MAAM,IACpC,OAAO,uBAGE,OAAO,MAAM;AAC3B,aAAO,IAAI,SAAS;AAAA,IACtB;AAAA,IACA,MAAM,SAAS,EAAE,MAAM,aAAa,aAAa,GAAG;AAClD,YAAM,SAAS,QAAQ,WAAW;AAClC,YAAM,SAAS,UACX,MAAO,OAAO,0BAGkB,MAAM,YAAY,IAClD,MAAO,OAAO,0BAEkB,IAAI;AACxC,aAAO,KAAK,aAAa,OAAO,YAAY,GAAG,MAAM;AAAA,IACvD;AAAA,EACF;AACF;;;AC3IA,SAAS,iBAAiB;AAE1B,SAAS,MAAAC,KAAI,OAAAC,YAAW;AAgBxB,eAAsB,OAAO,OAAgC;AAC3D,QAAM,SAAS,MAAM,UAAU,OAAO;AAAA,IACpC;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,EAChC;AAEA,SAAO,MAAM;AAAA,IAAK,IAAI,WAAW,MAAM;AAAA,IAAG,CAAC,SACzC,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EACnC,EAAE,KAAK,EAAE;AACX;AAiBA,eAAsB,gBACpB,OACA,QACA,IACA,cAA0B,UACE;AAC5B,QAAM,UAAU,MAAM,YAAY,OAAO,QAAQ,WAAW;AAC5D,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,cAAc,QAAQ;AAAA,EACxB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMC,IAAG,QAAQ,IAAI,QAAQ,GAAG,CAAC,EACjC,MAAM,CAAC;AAEV,MAAI,CAAC,QAAQ,KAAK,iBAAiB,QAAQ,KAAK;AAC9C,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,eAAsB,sBACpB,QACA,IACe;AACf,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,OAAO,EACd,IAAI;AAAA,MACH,cAAcC,OAAM,QAAQ,YAAY;AAAA,IAC1C,CAAC,EACA,MAAMD,IAAG,QAAQ,IAAI,MAAM,CAAC;AAE/B,UAAM,GAAG,OAAO,UAAU,EAAE,MAAMA,IAAG,WAAW,QAAQ,MAAM,CAAC;AAAA,EACjE,CAAC;AACH;;;ACpFA,SAAS,OAAAE,MAAK,MAAM,MAAAC,WAAU;AAgD9B,eAAe,iBAAiB,QAA+B;AAC7D,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,IAAI,QAAQ,GAAG,CAAC,EACzB,KAAK,OAAO,EACZ,MAAMC,IAAG,QAAQ,IAAI,MAAM,CAAC,EAC5B,MAAM,CAAC;AACV,MAAI,CAAC,IAAK,OAAM,IAAI,gBAAgB,QAAQ,MAAM;AACpD;AAEA,eAAe,mBAAmB,UAAiC;AACjE,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,IAAI,UAAU,GAAG,CAAC,EAC3B,KAAK,SAAS,EACd,MAAMA,IAAG,UAAU,IAAI,QAAQ,CAAC,EAChC,MAAM,CAAC;AACV,MAAI,CAAC,IAAK,OAAM,IAAI,gBAAgB,UAAU,QAAQ;AACxD;AAEA,eAAsB,mBAAmB,QAA8C;AACrF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,KAAK,MAAM;AACjB,QAAM,OAAQ,MAAM,GACjB,OAAO,EACP,KAAK,qBAAqB,EAC1B,MAAMA,IAAG,sBAAsB,QAAQ,MAAM,CAAC,EAC9C,QAAQ,KAAK,sBAAsB,SAAS,CAAC;AAChD,SAAO;AACT;AAEA,eAAsB,qBAAqB,UAAkD;AAC3F,QAAM,mBAAmB,QAAQ;AACjC,QAAM,KAAK,MAAM;AACjB,QAAM,OAAQ,MAAM,GACjB,OAAO,EACP,KAAK,kBAAkB,EACvB,MAAMA,IAAG,mBAAmB,UAAU,QAAQ,CAAC,EAC/C,QAAQ,KAAK,mBAAmB,SAAS,CAAC;AAC7C,SAAO;AACT;AAOA,eAAsB,mBACpB,QACA,YACA,OACe;AACf,QAAM,KAAK,MAAM;AAGjB,QAAM,CAAC,QAAQ,IAAK,MAAM,GACvB,OAAO,EACP,KAAK,qBAAqB,EAC1B;AAAA,IACCC;AAAA,MACED,IAAG,sBAAsB,IAAI,UAAU;AAAA,MACvCA,IAAG,sBAAsB,QAAQ,MAAM;AAAA,IACzC;AAAA,EACF,EACC,MAAM,CAAC;AACV,MAAI,CAAC,UAAU;AAIb,UAAM,IAAI,gBAAgB,YAAY,UAAU;AAAA,EAClD;AAMA,QAAM,UAAW,MAAM,GACpB,OAAO,qBAAqB,EAC5B,MAAMA,IAAG,sBAAsB,IAAI,UAAU,CAAC,EAC9C,UAAU,EAAE,IAAI,sBAAsB,GAAG,CAAC;AAC7C,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,iBAAiB;AAAA,IACrB,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,YAAY;AAAA,IAClD,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,qBACpB,UACA,YACA,OACe;AACf,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,QAAQ,IAAK,MAAM,GACvB,OAAO,EACP,KAAK,kBAAkB,EACvB;AAAA,IACCC;AAAA,MACED,IAAG,mBAAmB,IAAI,UAAU;AAAA,MACpCA,IAAG,mBAAmB,UAAU,QAAQ;AAAA,IAC1C;AAAA,EACF,EACC,MAAM,CAAC;AACV,MAAI,CAAC,SAAU,OAAM,IAAI,gBAAgB,YAAY,UAAU;AAC/D,QAAM,UAAW,MAAM,GACpB,OAAO,kBAAkB,EACzB,MAAMA,IAAG,mBAAmB,IAAI,UAAU,CAAC,EAC3C,UAAU,EAAE,IAAI,mBAAmB,GAAG,CAAC;AAC1C,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,iBAAiB;AAAA,IACrB,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,YAAY;AAAA,IAClD,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IACpB;AAAA,EACF,CAAC;AACH;;;AC/KA,SAAS,eAAAE,oBAAmB;AAE5B,SAAS,OAAAC,MAAK,MAAAC,KAAI,IAAI,WAAW,OAAAC,YAAW;AAwB5C,IAAM,sBAAsB;AAE5B,SAAS,mBAA2B;AAElC,SAAOC,aAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AASA,eAAsB,yBACpB,IACA,SAC6B;AAC7B,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK;AAErD,QAAM,GACH,OAAO,OAAO,EACd,IAAI;AAAA,IACH,wBAAwB;AAAA,IACxB,wBAAwB;AAAA,IACxB,sBAAsB,QAAQ;AAAA,IAC9B,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAMC,IAAG,QAAQ,IAAI,QAAQ,MAAM,CAAC;AAEvC,SAAO,EAAE,OAAO,WAAW,SAAS,QAAQ,QAAQ;AACtD;AAeA,eAAsB,qBACpB,IACA,OACA,OAC+B;AAC/B,QAAM,kBAAkB,MAAM,KAAK,EAAE,YAAY;AACjD,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,EAChB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMA,IAAG,QAAQ,OAAO,eAAe,CAAC,EACxC,MAAM,CAAC;AAEV,MAAI,CAAC,MAAM;AACT,WAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,OAAO,MAAM,QAAQ,KAAK;AAAA,EAC/D;AAEA,QAAM,SAAS,MAAM,yBAAyB,IAAI;AAAA,IAChD,QAAQ,KAAK;AAAA,IACb,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,KAAK,IAAI,MAAM,KAAK,MAAM,OAAO,KAAK,OAAO,OAAO;AACvE;AAsBA,eAAsB,0BACpB,IACA,SACoC;AACpC,MAAI,CAAC,QAAQ,SAAS,OAAO,QAAQ,UAAU,UAAU;AACvD,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,2BAA2B;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,QAAQ,eAAe,QAAQ,YAAY,SAAS,qBAAqB;AAC5E,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C;AAAA,QACE,OAAO;AAAA,QACP,SAAS,6BAA6B,mBAAmB;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,MAAM,OAAO,QAAQ,KAAK;AAC5C,QAAM,MAAM,oBAAI,KAAK;AAErB,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,EACnB,CAAC,EACA,KAAK,OAAO,EACZ;AAAA,IACCC;AAAA,MACED,IAAG,QAAQ,wBAAwB,SAAS;AAAA,MAC5C,UAAU,QAAQ,sBAAsB;AAAA,MACxC,GAAG,QAAQ,wBAAwB,GAAG;AAAA,IACxC;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,wCAAwC;AAAA,IACrE,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,aAAa,QAAQ,WAAW;AAO9D,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,OAAO,EACd,IAAI;AAAA,MACH,UAAU;AAAA,MACV,wBAAwB;AAAA,MACxB,wBAAwB;AAAA,MACxB,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf,WAAW;AAAA,MACX,cAAcE,OAAM,QAAQ,YAAY;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAMF,IAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;AAEhC,UAAM,GAAG,OAAO,UAAU,EAAE,MAAMA,IAAG,WAAW,QAAQ,KAAK,EAAE,CAAC;AAAA,EAClE,CAAC;AAED,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,SAAU,KAAK,WAAW;AAAA,EAC5B;AACF;;;ACrMA,SAAS,eAAAG,oBAAmB;AAC5B,SAAS,aAAAC,YAAW,WAAAC,gBAAgC;AA2CpD,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AAExB,eAAsB,gBACpB,QACA,QACA,oBAA4B,MAC5B,WAA6B,UACZ;AACjB,QAAM,YAAYA,aAAY,OAAO,MAAM;AAC3C,SAAO,IAAIC,SAAQ,EAAE,KAAK,OAAO,IAAI,KAAK,OAAO,cAAc,KAAK,SAAS,CAAC,EAC3E,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,eAAe,EAC3B,OAAOC,aAAY,EAAE,EAAE,SAAS,WAAW,CAAC,EAC5C,YAAY,EACZ,kBAAkB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,iBAAiB,EACnE,KAAK,SAAS;AACnB;AAmBA,eAAsB,kBACpB,OACA,QACA,aAC+B;AAC/B,QAAM,YAAYF,aAAY,OAAO,MAAM;AAC3C,QAAM,EAAE,QAAQ,IAAI,MAAMG,WAAU,OAAO,WAAW,EAAE,UAAU,gBAAgB,CAAC;AAGnF,QAAM,QAAQ;AAOd,MAAI,MAAM,QAAQ,YAAY,MAAM,QAAQ,WAAW;AACrD,UAAM,IAAI,YAAY,kCAAkC;AAAA,EAC1D;AACA,QAAM,MAAwB,MAAM;AACpC,MAAI,eAAe,QAAQ,aAAa;AAGtC,UAAM,IAAI;AAAA,MACR,uCAAuC,WAAW,SAAS,GAAG;AAAA,IAChE;AAAA,EACF;AACA,SAAO,EAAE,GAAG,OAAO,KAAK,iBAAiB,IAAI;AAC/C;;;AC5GA,SAAS,OAAAC,MAAK,MAAAC,KAAI,MAAAC,KAAI,OAAAC,YAAW;AAgCjC,eAAsB,0BACpB,IACA,SACA,aACiC;AACjC,QAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,IAClB,cAAc,UAAU;AAAA,EAC1B,CAAC,EACA,KAAK,SAAS,EACd,MAAMC,IAAG,UAAU,IAAI,QAAQ,GAAG,CAAC,EACnC,MAAM,CAAC;AAEV,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,iBAAiB,QAAQ,IAAK,QAAO;AAE7C,MAAI,aAAa;AACf,UAAM,YAAY,MAAM,OAAO,WAAW;AAC1C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,CAAC,OAAO,IAAK,MAAM,GACtB,OAAO,EAAE,IAAI,iBAAiB,GAAG,CAAC,EAClC,KAAK,gBAAgB,EACrB;AAAA,MACCC;AAAA,QACED,IAAG,iBAAiB,UAAU,IAAI,EAAE;AAAA,QACpCA,IAAG,iBAAiB,WAAW,SAAS;AAAA,QACxCE,IAAG,iBAAiB,WAAW,GAAG;AAAA,MACpC;AAAA,IACF,EACC,MAAM,CAAC;AACV,QAAI,CAAC,QAAS,QAAO;AAAA,EACvB;AAEA,SAAO;AACT;AAOA,eAAsB,4BACpB,IACA,UACe;AACf,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,MACH,cAAcC,OAAM,UAAU,YAAY;AAAA,MAC1C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAMH,IAAG,UAAU,IAAI,QAAQ,CAAC;AACnC,UAAM,GAAG,OAAO,gBAAgB,EAAE,MAAMA,IAAG,iBAAiB,UAAU,QAAQ,CAAC;AAAA,EACjF,CAAC;AACH;;;AC5FA,SAAS,eAAAI,oBAAmB;AAE5B,SAAS,OAAAC,MAAK,MAAAC,KAAI,MAAAC,KAAI,aAAAC,YAAW,OAAAC,YAAW;AAgB5C,IAAMC,uBAAsB;AAQ5B,SAASC,oBAA2B;AAClC,SAAOC,aAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AAIA,eAAsB,6BACpB,IACA,UACA,OAC8B;AAC9B,QAAM,QAAQD,kBAAiB;AAC/B,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK;AAE7C,QAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,IACH,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAME,IAAG,UAAU,IAAI,QAAQ,CAAC;AAEnC,SAAO,EAAE,OAAO,UAAU;AAC5B;AASA,eAAsB,8BACpB,IACA,OAC2C;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,kCAAkC;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,MAAM,oBAAI,KAAK;AAErB,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,EACzB,CAAC,EACA,KAAK,SAAS,EACd;AAAA,IACCC;AAAA,MACED,IAAG,UAAU,sBAAsB,SAAS;AAAA,MAC5CE,WAAU,UAAU,oBAAoB;AAAA,MACxCC,IAAG,UAAU,sBAAsB,GAAG;AAAA,IACxC;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,+CAA+C;AAAA,IAC5E,CAAC;AAAA,EACH;AAEA,QAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,IACH,eAAe;AAAA;AAAA;AAAA;AAAA,IAIf,QAAQC,iBAAgB,UAAU,MAAM,mCAAmC,UAAU,MAAM;AAAA,IAC3F,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,WAAW;AAAA,EACb,CAAC,EACA,MAAMJ,IAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AAEpC,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,aAAa,OAAO;AAAA,EACtB;AACF;AAWA,eAAsB,2BACpB,IACA,OACA,OACqC;AACrC,QAAM,kBAAkB,MAAM,KAAK,EAAE,YAAY;AACjD,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,EACpB,CAAC,EACA,KAAK,SAAS,EACd,MAAMA,IAAG,UAAU,OAAO,eAAe,CAAC,EAC1C,MAAM,CAAC;AAEV,MAAI,CAAC,UAAU,OAAO,WAAW,WAAW;AAC1C,WAAO,EAAE,UAAU,MAAM,aAAa,MAAM,OAAO,MAAM,QAAQ,KAAK;AAAA,EACxE;AAEA,QAAM,QAAQF,kBAAiB;AAC/B,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK;AAE7C,QAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,IACH,wBAAwB;AAAA,IACxB,wBAAwB;AAAA,IACxB,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAME,IAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AAEpC,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,aAAa,OAAO;AAAA,IACpB,OAAO,OAAO;AAAA,IACd,QAAQ,EAAE,OAAO,UAAU;AAAA,EAC7B;AACF;AAOA,eAAsB,2BACpB,IACA,OACA,aACqC;AACrC,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,2BAA2B;AAAA,IACxD,CAAC;AAAA,EACH;AACA,MAAI,CAAC,eAAe,YAAY,SAASH,sBAAqB;AAC5D,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C;AAAA,QACE,OAAO;AAAA,QACP,SAAS,6BAA6BA,oBAAmB;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,MAAM,oBAAI,KAAK;AAErB,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO,EAAE,IAAI,UAAU,IAAI,OAAO,UAAU,MAAM,CAAC,EACnD,KAAK,SAAS,EACd;AAAA,IACCI;AAAA,MACED,IAAG,UAAU,wBAAwB,SAAS;AAAA,MAC9CE,WAAU,UAAU,sBAAsB;AAAA,MAC1CC,IAAG,UAAU,wBAAwB,GAAG;AAAA,IAC1C;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,wCAAwC;AAAA,IACrE,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,aAAa,WAAW;AAEtD,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,MACH,UAAU;AAAA,MACV,wBAAwB;AAAA,MACxB,wBAAwB;AAAA,MACxB,eAAe;AAAA,MACf,WAAW;AAAA;AAAA;AAAA;AAAA,MAIX,cAAcC,OAAM,UAAU,YAAY;AAAA,MAC1C,eAAe;AAAA,MACf,QAAQA,iBAAgB,UAAU,MAAM,mCAAmC,UAAU,MAAM;AAAA,MAC3F,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAMJ,IAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AAEpC,UAAM,GAAG,OAAO,gBAAgB,EAAE,MAAMA,IAAG,iBAAiB,UAAU,OAAO,EAAE,CAAC;AAAA,EAClF,CAAC;AAED,SAAO,EAAE,UAAU,OAAO,IAAI,OAAO,OAAO,MAAM;AACpD;","names":["eq","eq","and","eq","sql","SYNTHETIC_EMAIL_SUFFIX","syntheticEmail","mergeMetadata","eq","and","sql","randomBytes","randomBytes","eq","sql","eq","sql","and","eq","eq","and","randomBytes","and","eq","sql","randomBytes","eq","and","sql","randomBytes","jwtVerify","SignJWT","textEncoder","SignJWT","randomBytes","jwtVerify","and","eq","gt","sql","eq","and","gt","sql","randomBytes","and","eq","gt","isNotNull","sql","MIN_PASSWORD_LENGTH","generateRawToken","randomBytes","eq","and","isNotNull","gt","sql"]}

package/dist/chunk-CAS4Z6IN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/community/notification-prefs.ts"],"sourcesContent":["import { eq } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npMembers } from \"../db/schema/community.js\";\nimport { NpNotFoundError, NpValidationError } from \"../errors.js\";\n\n/**\n * Phase 16.3 — per-member notification preferences.\n *\n * The persisted shape is a JSONB blob on `np_members.notification_prefs`\n * so adding fields (digest cadence in 16.4, channel toggles later)\n * stays a typescript-only change. Today we honor:\n *\n *   - `disabled: string[]` — kinds the member opted out of. The\n *     `createNotification` gate consults this and silently drops\n *     the row. Default empty (= every kind enabled).\n *\n * The vocabulary of `kinds` is defined here so the UI has a single\n * source of truth — settings page renders a toggle for each entry,\n * and the API only accepts kinds that appear in the list (so a\n * forged client can't disable arbitrary strings to bloat the JSONB).\n */\n\nexport interface NpNotificationKindMeta {\n  kind: string;\n  /** Short human label. */\n  label: string;\n  /** Description rendered next to the toggle. */\n  description: string;\n}\n\n/**\n * Closed vocabulary of toggle-able kinds. New notification kinds\n * land here when they ship; plugins that want their own\n * preferences register entries via `registerNotificationKind`.\n */\nconst builtinKinds: NpNotificationKindMeta[] = [\n  {\n    kind: \"comment.reply\",\n    label: \"Replies\",\n    description: \"Someone replied to one of your comments.\",\n  },\n  {\n    kind: \"comment.mention\",\n    label: \"Mentions in comments\",\n    description: \"Someone @-mentioned you in a comment.\",\n  },\n  {\n    kind: \"document.mention\",\n    label: \"Mentions in discussions\",\n    description: \"Someone @-mentioned you in a discussion / thread.\",\n  },\n  {\n    kind: \"reaction.received\",\n    label: \"Reactions\",\n    description: \"Someone reacted to your comment or document.\",\n  },\n  {\n    kind: \"follow.received\",\n    label: \"New followers\",\n    description: \"Someone started following you.\",\n  },\n];\n\nconst dynamicKinds: NpNotificationKindMeta[] = [];\n\n/** Plugin-extensible registration. Idempotent on `kind`. */\nexport function registerNotificationKind(meta: NpNotificationKindMeta): void {\n  if (builtinKinds.some((k) => k.kind === meta.kind)) return;\n  const idx = dynamicKinds.findIndex((k) => k.kind === meta.kind);\n  if (idx >= 0) {\n    dynamicKinds[idx] = meta;\n  } else {\n    dynamicKinds.push(meta);\n  }\n}\n\n/** Returns the union of builtin + plugin-registered kinds. */\nexport function listNotificationKinds(): NpNotificationKindMeta[] {\n  return [...builtinKinds, ...dynamicKinds];\n}\n\nexport type NpDigestCadence = \"off\" | \"daily\" | \"weekly\";\n\nconst DIGEST_CADENCES: readonly NpDigestCadence[] = [\"off\", \"daily\", \"weekly\"] as const;\n\nexport interface NpNotificationPrefs {\n  /** Kinds the member opted out of. Empty / missing = all kinds enabled. */\n  disabled: string[];\n  /**\n   * Phase 16.4 — email digest cadence. `off` (default) disables\n   * the digest. `daily` and `weekly` opt the member into a\n   * batched email of unread notifications, scheduled by the\n   * `notifications:sendDigest` recurring job.\n   */\n  digest: NpDigestCadence;\n  /**\n   * Set when the digest sweep last sent an email to this member.\n   * Used to scope each digest to \"unread since the last send\" so\n   * members aren't repeatedly emailed about the same row. Stored\n   * as ISO-8601 string in the JSONB blob; `null` for accounts\n   * that have never received a digest.\n   *\n   * Issue #218 — superseded by `lastDigestAtBySite` once a member\n   * receives a digest under the per-site fan-out path. The legacy\n   * field is preserved for forward-compat reads (single-site\n   * deploys still see + write it via the fallback chain) and as\n   * a \"any digest, ever?\" marker for analytics.\n   */\n  lastDigestAt: string | null;\n  /**\n   * Issue #218 — per-(site, cadence) timestamp map. Replaces the\n   * single `lastDigestAt` for multi-site deployments. Empty when\n   * the member has never received a digest under the site-scoped\n   * sweep.\n   */\n  lastDigestAtBySite: Record<string, Partial<Record<NpDigestCadence, string>>>;\n}\n\nconst EMPTY_PREFS: NpNotificationPrefs = {\n  disabled: [],\n  digest: \"off\",\n  lastDigestAt: null,\n  lastDigestAtBySite: {},\n};\n\nfunction normalizeDigest(raw: unknown): NpDigestCadence {\n  return DIGEST_CADENCES.includes(raw as NpDigestCadence) ? (raw as NpDigestCadence) : \"off\";\n}\n\nfunction normalizeLastDigestAt(raw: unknown): string | null {\n  return typeof raw === \"string\" && raw.length > 0 ? raw : null;\n}\n\nfunction normalizeLastDigestBySite(\n  raw: unknown,\n): Record<string, Partial<Record<NpDigestCadence, string>>> {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return {};\n  const out: Record<string, Partial<Record<NpDigestCadence, string>>> = {};\n  for (const [siteId, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (!value || typeof value !== \"object\" || Array.isArray(value)) continue;\n    const inner: Partial<Record<NpDigestCadence, string>> = {};\n    for (const [cadence, ts] of Object.entries(value as Record<string, unknown>)) {\n      if (!DIGEST_CADENCES.includes(cadence as NpDigestCadence)) continue;\n      if (typeof ts === \"string\" && ts.length > 0) {\n        inner[cadence as NpDigestCadence] = ts;\n      }\n    }\n    if (Object.keys(inner).length > 0) out[siteId] = inner;\n  }\n  return out;\n}\n\nfunction normalizePrefs(raw: unknown): NpNotificationPrefs {\n  if (!raw || typeof raw !== \"object\") return { ...EMPTY_PREFS, lastDigestAtBySite: {} };\n  const obj = raw as Record<string, unknown>;\n  const disabled = Array.isArray(obj.disabled)\n    ? obj.disabled.filter((k): k is string => typeof k === \"string\")\n    : [];\n  return {\n    disabled,\n    digest: normalizeDigest(obj.digest),\n    lastDigestAt: normalizeLastDigestAt(obj.lastDigestAt),\n    lastDigestAtBySite: normalizeLastDigestBySite(obj.lastDigestAtBySite),\n  };\n}\n\nexport async function getMemberNotificationPrefs(memberId: string): Promise<NpNotificationPrefs> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const [row] = (await db\n    .select({ prefs: npMembers.notificationPrefs })\n    .from(npMembers)\n    .where(eq(npMembers.id, memberId))\n    .limit(1)) as Array<{ prefs: Record<string, unknown> }>;\n  if (!row) throw new NpNotFoundError(\"member\", memberId);\n  return normalizePrefs(row.prefs);\n}\n\nexport interface SetMemberNotificationPrefsInput {\n  memberId: string;\n  /**\n   * Replacement deny-list. Only kinds listed in\n   * `listNotificationKinds()` are accepted; unknown strings\n   * raise NpValidationError so a forged client can't bloat the\n   * JSONB or hide future framework kinds via a stale list.\n   * Optional — when omitted the existing list is preserved.\n   */\n  disabled?: string[];\n  /**\n   * Phase 16.4 — email digest cadence. Optional; when omitted\n   * the existing setting is preserved. `off` clears the\n   * member's enrollment.\n   */\n  digest?: NpDigestCadence;\n}\n\nexport async function setMemberNotificationPrefs(\n  input: SetMemberNotificationPrefsInput,\n): Promise<NpNotificationPrefs> {\n  const known = new Set(listNotificationKinds().map((k) => k.kind));\n  let cleanedDisabled: string[] | undefined;\n  if (input.disabled !== undefined) {\n    cleanedDisabled = [];\n    const seen = new Set<string>();\n    for (const raw of input.disabled) {\n      if (typeof raw !== \"string\") {\n        throw new NpValidationError(\"Invalid input\", [\n          { field: \"disabled\", message: \"Each entry must be a string\" },\n        ]);\n      }\n      if (!known.has(raw)) {\n        throw new NpValidationError(\"Invalid input\", [\n          { field: \"disabled\", message: `Unknown notification kind: ${raw}` },\n        ]);\n      }\n      if (seen.has(raw)) continue;\n      seen.add(raw);\n      cleanedDisabled.push(raw);\n    }\n  }\n  if (input.digest !== undefined && !DIGEST_CADENCES.includes(input.digest)) {\n    throw new NpValidationError(\"Invalid input\", [\n      {\n        field: \"digest\",\n        message: `digest must be one of: ${DIGEST_CADENCES.join(\", \")}`,\n      },\n    ]);\n  }\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n\n  // Read-then-merge so we don't clobber other JSONB keys\n  // (lastDigestAt, future channel toggles, etc.).\n  const [existing] = (await db\n    .select({ prefs: npMembers.notificationPrefs })\n    .from(npMembers)\n    .where(eq(npMembers.id, input.memberId))\n    .limit(1)) as Array<{ prefs: Record<string, unknown> }>;\n  if (!existing) throw new NpNotFoundError(\"member\", input.memberId);\n\n  const merged: Record<string, unknown> = { ...(existing.prefs ?? {}) };\n  if (cleanedDisabled !== undefined) merged.disabled = cleanedDisabled;\n  if (input.digest !== undefined) merged.digest = input.digest;\n\n  await db\n    .update(npMembers)\n    .set({ notificationPrefs: merged, updatedAt: new Date() })\n    .where(eq(npMembers.id, input.memberId));\n\n  return normalizePrefs(merged);\n}\n\n/**\n * Phase 16.4 — bookkeeping helper called by the digest sweep\n * after a successful email send. Stamps `lastDigestAt` so the\n * next run scopes its query to the correct window. Read-merge\n * to preserve other JSONB keys.\n *\n * Issue #218 — when a `siteId` + `cadence` pair is supplied,\n * the per-site / per-cadence map is updated so the next sweep\n * for that tenant scopes to the correct \"since\" window. The\n * legacy single `lastDigestAt` field is also stamped for\n * forward-compat with single-site deploys (and as a \"received\n * any digest, ever?\" marker for analytics).\n */\nexport async function recordDigestSent(\n  memberId: string,\n  sentAt: Date,\n  scope?: { siteId: string; cadence: NpDigestCadence },\n): Promise<void> {\n  const db = getDb() as unknown as NodePgDatabase<Record<string, unknown>>;\n  const [existing] = (await db\n    .select({ prefs: npMembers.notificationPrefs })\n    .from(npMembers)\n    .where(eq(npMembers.id, memberId))\n    .limit(1)) as Array<{ prefs: Record<string, unknown> }>;\n  if (!existing) return;\n  const prior = existing.prefs ?? {};\n  const merged: Record<string, unknown> = {\n    ...prior,\n    lastDigestAt: sentAt.toISOString(),\n  };\n  if (scope) {\n    const priorBySite = normalizeLastDigestBySite(\n      (prior as { lastDigestAtBySite?: unknown }).lastDigestAtBySite,\n    );\n    const siteSlot = { ...(priorBySite[scope.siteId] ?? {}) };\n    siteSlot[scope.cadence] = sentAt.toISOString();\n    merged.lastDigestAtBySite = { ...priorBySite, [scope.siteId]: siteSlot };\n  }\n  await db\n    .update(npMembers)\n    .set({ notificationPrefs: merged, updatedAt: new Date() })\n    .where(eq(npMembers.id, memberId));\n}\n\n/**\n * Inbox-side gate consulted by `createNotification`. Returns\n * `false` when the recipient explicitly opted out of `kind`.\n * Errors fail-open (return `true`) so a transient DB blip\n * doesn't silently swallow notifications.\n */\nexport async function isNotificationKindEnabled(memberId: string, kind: string): Promise<boolean> {\n  try {\n    const prefs = await getMemberNotificationPrefs(memberId);\n    return !prefs.disabled.includes(kind);\n  } catch {\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,UAAU;AAqCnB,IAAM,eAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAEA,IAAM,eAAyC,CAAC;AAGzC,SAAS,yBAAyB,MAAoC;AAC3E,MAAI,aAAa,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,EAAG;AACpD,QAAM,MAAM,aAAa,UAAU,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI;AAC9D,MAAI,OAAO,GAAG;AACZ,iBAAa,GAAG,IAAI;AAAA,EACtB,OAAO;AACL,iBAAa,KAAK,IAAI;AAAA,EACxB;AACF;AAGO,SAAS,wBAAkD;AAChE,SAAO,CAAC,GAAG,cAAc,GAAG,YAAY;AAC1C;AAIA,IAAM,kBAA8C,CAAC,OAAO,SAAS,QAAQ;AAmC7E,IAAM,cAAmC;AAAA,EACvC,UAAU,CAAC;AAAA,EACX,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,oBAAoB,CAAC;AACvB;AAEA,SAAS,gBAAgB,KAA+B;AACtD,SAAO,gBAAgB,SAAS,GAAsB,IAAK,MAA0B;AACvF;AAEA,SAAS,sBAAsB,KAA6B;AAC1D,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAC3D;AAEA,SAAS,0BACP,KAC0D;AAC1D,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACnE,QAAM,MAAgE,CAAC;AACvE,aAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,GAA8B,GAAG;AAC5E,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG;AACjE,UAAM,QAAkD,CAAC;AACzD,eAAW,CAAC,SAAS,EAAE,KAAK,OAAO,QAAQ,KAAgC,GAAG;AAC5E,UAAI,CAAC,gBAAgB,SAAS,OAA0B,EAAG;AAC3D,UAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG;AAC3C,cAAM,OAA0B,IAAI;AAAA,MACtC;AAAA,IACF;AACA,QAAI,OAAO,KAAK,KAAK,EAAE,SAAS,EAAG,KAAI,MAAM,IAAI;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,eAAe,KAAmC;AACzD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,EAAE,GAAG,aAAa,oBAAoB,CAAC,EAAE;AACrF,QAAM,MAAM;AACZ,QAAM,WAAW,MAAM,QAAQ,IAAI,QAAQ,IACvC,IAAI,SAAS,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IAC7D,CAAC;AACL,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,gBAAgB,IAAI,MAAM;AAAA,IAClC,cAAc,sBAAsB,IAAI,YAAY;AAAA,IACpD,oBAAoB,0BAA0B,IAAI,kBAAkB;AAAA,EACtE;AACF;AAEA,eAAsB,2BAA2B,UAAgD;AAC/F,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,OAAO,UAAU,kBAAkB,CAAC,EAC7C,KAAK,SAAS,EACd,MAAM,GAAG,UAAU,IAAI,QAAQ,CAAC,EAChC,MAAM,CAAC;AACV,MAAI,CAAC,IAAK,OAAM,IAAI,gBAAgB,UAAU,QAAQ;AACtD,SAAO,eAAe,IAAI,KAAK;AACjC;AAoBA,eAAsB,2BACpB,OAC8B;AAC9B,QAAM,QAAQ,IAAI,IAAI,sBAAsB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAChE,MAAI;AACJ,MAAI,MAAM,aAAa,QAAW;AAChC,sBAAkB,CAAC;AACnB,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,OAAO,MAAM,UAAU;AAChC,UAAI,OAAO,QAAQ,UAAU;AAC3B,cAAM,IAAI,kBAAkB,iBAAiB;AAAA,UAC3C,EAAE,OAAO,YAAY,SAAS,8BAA8B;AAAA,QAC9D,CAAC;AAAA,MACH;AACA,UAAI,CAAC,MAAM,IAAI,GAAG,GAAG;AACnB,cAAM,IAAI,kBAAkB,iBAAiB;AAAA,UAC3C,EAAE,OAAO,YAAY,SAAS,8BAA8B,GAAG,GAAG;AAAA,QACpE,CAAC;AAAA,MACH;AACA,UAAI,KAAK,IAAI,GAAG,EAAG;AACnB,WAAK,IAAI,GAAG;AACZ,sBAAgB,KAAK,GAAG;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,MAAM,WAAW,UAAa,CAAC,gBAAgB,SAAS,MAAM,MAAM,GAAG;AACzE,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C;AAAA,QACE,OAAO;AAAA,QACP,SAAS,0BAA0B,gBAAgB,KAAK,IAAI,CAAC;AAAA,MAC/D;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,MAAM;AAIjB,QAAM,CAAC,QAAQ,IAAK,MAAM,GACvB,OAAO,EAAE,OAAO,UAAU,kBAAkB,CAAC,EAC7C,KAAK,SAAS,EACd,MAAM,GAAG,UAAU,IAAI,MAAM,QAAQ,CAAC,EACtC,MAAM,CAAC;AACV,MAAI,CAAC,SAAU,OAAM,IAAI,gBAAgB,UAAU,MAAM,QAAQ;AAEjE,QAAM,SAAkC,EAAE,GAAI,SAAS,SAAS,CAAC,EAAG;AACpE,MAAI,oBAAoB,OAAW,QAAO,WAAW;AACrD,MAAI,MAAM,WAAW,OAAW,QAAO,SAAS,MAAM;AAEtD,QAAM,GACH,OAAO,SAAS,EAChB,IAAI,EAAE,mBAAmB,QAAQ,WAAW,oBAAI,KAAK,EAAE,CAAC,EACxD,MAAM,GAAG,UAAU,IAAI,MAAM,QAAQ,CAAC;AAEzC,SAAO,eAAe,MAAM;AAC9B;AAeA,eAAsB,iBACpB,UACA,QACA,OACe;AACf,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,QAAQ,IAAK,MAAM,GACvB,OAAO,EAAE,OAAO,UAAU,kBAAkB,CAAC,EAC7C,KAAK,SAAS,EACd,MAAM,GAAG,UAAU,IAAI,QAAQ,CAAC,EAChC,MAAM,CAAC;AACV,MAAI,CAAC,SAAU;AACf,QAAM,QAAQ,SAAS,SAAS,CAAC;AACjC,QAAM,SAAkC;AAAA,IACtC,GAAG;AAAA,IACH,cAAc,OAAO,YAAY;AAAA,EACnC;AACA,MAAI,OAAO;AACT,UAAM,cAAc;AAAA,MACjB,MAA2C;AAAA,IAC9C;AACA,UAAM,WAAW,EAAE,GAAI,YAAY,MAAM,MAAM,KAAK,CAAC,EAAG;AACxD,aAAS,MAAM,OAAO,IAAI,OAAO,YAAY;AAC7C,WAAO,qBAAqB,EAAE,GAAG,aAAa,CAAC,MAAM,MAAM,GAAG,SAAS;AAAA,EACzE;AACA,QAAM,GACH,OAAO,SAAS,EAChB,IAAI,EAAE,mBAAmB,QAAQ,WAAW,oBAAI,KAAK,EAAE,CAAC,EACxD,MAAM,GAAG,UAAU,IAAI,QAAQ,CAAC;AACrC;AAQA,eAAsB,0BAA0B,UAAkB,MAAgC;AAChG,MAAI;AACF,UAAM,QAAQ,MAAM,2BAA2B,QAAQ;AACvD,WAAO,CAAC,MAAM,SAAS,SAAS,IAAI;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}