@nexpress/core 0.3.7 → 0.3.8

package/dist/chunk-TIWJVQOO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/access.ts","../src/auth/token.ts","../src/auth/users.ts","../src/auth/password.ts","../src/auth/csrf.ts","../src/auth/oauth-providers.ts","../src/auth/oauth-resolve.ts","../src/auth/oauth-resolve-member.ts","../src/auth/oauth-state.ts","../src/auth/oauth-arctic.ts","../src/auth/session.ts","../src/auth/identities-admin.ts","../src/auth/reset-token.ts","../src/auth/member-token.ts","../src/auth/member-session.ts","../src/auth/member-credentials.ts"],"sourcesContent":["import { type NpAccessFunction } from \"./types.js\";\n\nexport const authenticated: NpAccessFunction = ({ user }) => !!user;\n\nexport const isAdmin: NpAccessFunction = ({ user }) => user?.role === \"admin\";\n\nexport const isEditorOrAbove: NpAccessFunction = ({ user }) =>\n  !!user && (user.role === \"admin\" || user.role === \"editor\");\n\nexport const isOwnerOrAdmin: NpAccessFunction = ({ user, doc }) =>\n  user?.role === \"admin\" || doc?.createdBy === user?.id;\n","import { randomBytes } from \"node:crypto\";\nimport { jwtVerify, SignJWT, errors as joseErrors, type JWTPayload } from \"jose\";\n\nimport type { NpUserRole } from \"../config/types.js\";\nimport { NpAuthError } from \"../errors.js\";\n\n/**\n * Staff-side JWT helpers. Both access (`np-session`) and refresh\n * (`np-refresh`) cookies are signed with this module; the\n * `use: \"access\" | \"refresh\"` claim separates them so a stolen\n * refresh JWT cannot be replayed as a session cookie. Without this\n * separation a leaked 7-day refresh became a 7-day admin bearer\n * because both cookies decoded to the same `{ sub, role, ver }`\n * payload through `verifyToken` (#94).\n *\n * The fix mirrors the member-side fix from #92/#93: the `use` claim\n * is required, no legacy fallback for tokens missing the claim. The\n * cost is one forced re-login for staff sessions issued before the\n * deploy; bounded by the 7-day refresh TTL.\n */\nexport type NpTokenUse = \"access\" | \"refresh\";\n\nexport interface NpTokenPayload {\n  sub: string;\n  role: NpUserRole;\n  ver: number;\n  /** Required. `verifyToken` refuses tokens missing this claim so\n   *  legacy refresh JWTs cannot be smuggled into the session\n   *  cookie path. */\n  use: NpTokenUse;\n  /** Random per-token id — needed if rotation lands on the staff\n   *  side (mirrors the member-side `jti` for #45). Optional today\n   *  but populated on every newly-minted token. */\n  jti?: string;\n  iat: number;\n  exp: number;\n}\n\nconst textEncoder = new TextEncoder();\n\nexport async function signToken(\n  user: { id: string; role: NpUserRole; tokenVersion: number },\n  secret: string,\n  expirationSeconds: number = 7200,\n  tokenUse: NpTokenUse = \"access\",\n): Promise<string> {\n  const secretKey = textEncoder.encode(secret);\n\n  return new SignJWT({\n    sub: user.id,\n    role: user.role,\n    ver: user.tokenVersion,\n    use: tokenUse,\n  })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setJti(randomBytes(16).toString(\"base64url\"))\n    .setIssuedAt()\n    .setExpirationTime(Math.floor(Date.now() / 1000) + expirationSeconds)\n    .sign(secretKey);\n}\n\n/**\n * Verify a staff JWT. When `expectedUse` is provided, refuses tokens\n * whose `use` claim doesn't match — that's how `getSessionUser`\n * rejects a refresh token used as a session cookie and how the\n * refresh route rejects an access token as a refresh trigger.\n *\n * Tokens minted before the `use` claim landed have NO `use` payload\n * field. We refuse those outright rather than treating them as\n * `access` — the prior fallback would let still-live legacy refresh\n * JWTs be smuggled into the session cookie and pass the access\n * check. Cost: staff logged in before this deploy must log in once.\n * Bounded by the refresh-token TTL (default 7 days).\n */\nexport async function verifyToken(\n  token: string,\n  secret: string,\n  expectedUse?: NpTokenUse,\n): Promise<NpTokenPayload> {\n  const secretKey = textEncoder.encode(secret);\n  const { payload } = await jwtVerify(token, secretKey);\n  const typed = payload as JWTPayload & {\n    sub: string;\n    role: NpUserRole;\n    ver: number;\n    iat: number;\n    exp: number;\n    use?: NpTokenUse;\n  };\n  if (typed.use !== \"access\" && typed.use !== \"refresh\") {\n    throw new NpAuthError(\"Staff token missing `use` claim\");\n  }\n  const use: NpTokenUse = typed.use;\n  if (expectedUse && use !== expectedUse) {\n    throw new NpAuthError(\n      `Staff token use mismatch: expected ${expectedUse}, got ${use}`,\n    );\n  }\n  return { ...typed, use };\n}\n\n/**\n * True when `err` represents a token-verification failure rather than\n * an unrelated runtime fault (DB outage, misconfiguration, …). Auth\n * helpers use this to keep the existing \"bad token → 401\" behavior\n * silent while letting infrastructure failures surface as 5xx.\n *\n * Covers:\n *   - `NpAuthError` — `verifyToken` / `verifyMemberToken` rejecting a\n *     missing or wrong `use` claim, or `verifyCsrf` failing.\n *   - `jose.errors.JOSEError` — every JWT signature / format /\n *     expiration failure, including subclasses like `JWTExpired`,\n *     `JWSSignatureVerificationFailed`, `JWTInvalid`.\n */\nexport function isTokenVerificationError(err: unknown): boolean {\n  if (err instanceof NpAuthError) return true;\n  if (err instanceof joseErrors.JOSEError) return true;\n  return false;\n}\n","import { eq } from \"drizzle-orm\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npUsers } from \"../db/schema/system.js\";\n\n/**\n * Minimal public projection of a user row — `id` + `name` + `email`.\n * Themes / plugins reach for this when they need to display a byline\n * (post.author → user) without pulling in session machinery. Password\n * hash + tokenVersion + reset state stay private to the auth module.\n */\nexport interface NpUserBasic {\n  id: string;\n  name: string;\n  email: string;\n}\n\n/**\n * Look up a user by id. Returns `null` when the id doesn't exist\n * (caller handles missing-author UI). UUID validation lives at the\n * caller — Postgres rejects malformed ids inside `eq()` and the\n * surfacing error is already informative.\n *\n * This is the supported entry point for theme code that needs to\n * render a byline from `posts.author: relationTo(\"users\")`. Direct\n * drizzle reads against `np_users` are private to the framework.\n */\nexport async function getUserById(id: string): Promise<NpUserBasic | null> {\n  const db = getDb();\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      name: npUsers.name,\n      email: npUsers.email,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.id, id))\n    .limit(1);\n  return user ?? null;\n}\n","import { hash, verify, type Options } from \"@node-rs/argon2\";\n\nexport const ARGON2_OPTIONS: Options = {\n  memoryCost: 19456,\n  timeCost: 2,\n  outputLen: 32,\n  parallelism: 1,\n};\n\n// Test-only weak params — drops a hash from ~75ms to <1ms. Only kicks in\n// when NP_TEST_FAST_HASH=1 is explicitly set (vitest's setup-env.ts does\n// this) so production / dev never see weakened security.\nconst TEST_ARGON2_OPTIONS: Options = {\n  memoryCost: 8,\n  timeCost: 1,\n  outputLen: 32,\n  parallelism: 1,\n};\n\nexport function hashPassword(password: string): Promise<string> {\n  return hash(\n    password,\n    process.env.NP_TEST_FAST_HASH === \"1\" ? TEST_ARGON2_OPTIONS : ARGON2_OPTIONS,\n  );\n}\n\nexport function verifyPassword(\n  passwordHash: string,\n  password: string,\n): Promise<boolean> {\n  return verify(passwordHash, password);\n}\n","const SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\nexport function verifyCsrf(\n  method: string,\n  cookieToken: string | undefined,\n  headerToken: string | undefined,\n): boolean {\n  if (SAFE_METHODS.has(method.toUpperCase())) {\n    return true;\n  }\n\n  return Boolean(cookieToken && headerToken && cookieToken === headerToken);\n}\n","/**\n * OAuth provider registry — extension point for SSO. A provider plugin\n * (e.g. `@nexpress/plugin-oauth-github`) registers itself at startup\n * via `registerOAuthProvider()`; the framework's `/api/auth/oauth/{id}`\n * routes look it up by id.\n *\n * The provider is responsible for:\n *  - Building the authorize URL (`authorize`).\n *  - Exchanging the callback code for a normalized profile (`exchange`).\n *\n * The framework owns state-cookie signing, identity ↔ user resolution,\n * session minting, and audit. Providers must NOT touch cookies, the DB,\n * or response objects directly.\n */\n\n/**\n * Profile returned from a successful `exchange()`. The framework uses\n * `providerUserId` as the durable identifier — `email` may change at the\n * provider but `providerUserId` should not. If the provider doesn't\n * surface `email`, the framework falls back to creating a synthetic\n * placeholder (`<providerUserId>@<provider>.oauth.local`) so the\n * `np_users.email NOT NULL UNIQUE` constraint is still satisfied.\n */\nexport interface OAuthProfile {\n  /** Stable per-user id from the provider. Required. */\n  providerUserId: string;\n  /** Optional — falls back to synthetic if missing. */\n  email?: string | null;\n  /** Optional — defaults to email local-part on user creation. */\n  name?: string | null;\n  /** Optional — written into `np_user_oauth_identities.metadata`. */\n  avatarUrl?: string | null;\n  /** Optional — full payload the provider wants to remember (e.g. scopes). */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Inputs the provider receives at the two callback boundaries. The\n * framework picks `redirectUri` from `SITE_URL` (or the request origin\n * in dev) so the provider doesn't have to know its own deployment URL.\n */\nexport interface OAuthAuthorizeParams {\n  state: string;\n  redirectUri: string;\n  /**\n   * PKCE code verifier (32+ char URL-safe random). The framework\n   * generates one for every login and threads it through the state\n   * cookie. Providers that don't support PKCE (e.g. GitHub) ignore it;\n   * providers that require it (e.g. Google) hash it into the\n   * `code_challenge` query param.\n   */\n  codeVerifier: string;\n}\n\nexport interface OAuthExchangeParams {\n  code: string;\n  state: string;\n  redirectUri: string;\n  /** Same verifier minted at /start, recovered from the state cookie. */\n  codeVerifier: string;\n}\n\nexport interface OAuthProvider {\n  /** Stable id used in route paths and `np_user_oauth_identities.provider`. */\n  id: string;\n  /** Human-readable label for admin UI / login buttons. */\n  label?: string;\n  /**\n   * Returns a fully-qualified URL the framework should redirect the\n   * browser to. Async to allow providers that need to mint per-request\n   * client credentials.\n   */\n  authorize(params: OAuthAuthorizeParams): Promise<string> | string;\n  /**\n   * Validates the callback and returns the normalized profile.\n   * Throwing here aborts the login with `OAUTH_EXCHANGE_FAILED`.\n   */\n  exchange(params: OAuthExchangeParams): Promise<OAuthProfile>;\n}\n\nconst providers = new Map<string, OAuthProvider>();\n\n/**\n * Register a provider. Idempotent: re-registering with the same id\n * overwrites — useful in dev when a plugin's `setup()` runs again on\n * reload.\n */\nexport function registerOAuthProvider(provider: OAuthProvider): void {\n  if (!provider.id || typeof provider.id !== \"string\") {\n    throw new Error(\"OAuth provider must have a non-empty string id\");\n  }\n  if (typeof provider.authorize !== \"function\" || typeof provider.exchange !== \"function\") {\n    throw new Error(\n      `OAuth provider \"${provider.id}\" must implement authorize() and exchange()`,\n    );\n  }\n  providers.set(provider.id, provider);\n}\n\nexport function getOAuthProvider(id: string): OAuthProvider | undefined {\n  return providers.get(id);\n}\n\nexport function listOAuthProviders(): OAuthProvider[] {\n  return Array.from(providers.values());\n}\n\n/** Reset the registry — tests use this between cases. Not for runtime use. */\nexport function resetOAuthProviders(): void {\n  providers.clear();\n}\n","import { eq, and, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npUserOAuthIdentities, npUsers } from \"../db/schema/system.js\";\nimport type { NpUserRole } from \"../config/types.js\";\n\nimport { hashPassword } from \"./password.js\";\nimport type { OAuthProfile } from \"./oauth-providers.js\";\n\n/**\n * Resolves an `OAuthProfile` to a real `np_users` row, in this order:\n *\n *  1. Lookup by `(provider, provider_user_id)` — the durable link. This\n *     is the only path that survives an email change at the provider.\n *  2. Email-match — if the provider gave us an email and an existing\n *     user has it, link the OAuth identity to that user. Lets a staff\n *     member who originally signed up with a password later \"sign in\n *     with Google\" and have it just work, without an explicit linking\n *     UI.\n *  3. Create — auto-provision a new user with the provider's profile,\n *     default role `viewer`. The password column is filled with an\n *     unrecoverable Argon2 hash of a random secret so the column\n *     constraints are satisfied; the user can later run the\n *     forgot-password flow to set a real password if they want one.\n *\n * Side effects: writes a row into `np_user_oauth_identities` for paths\n * 2 and 3, updates `metadata` for path 1.\n */\nexport interface ResolveOAuthLoginResult {\n  user: ResolvedOAuthUser;\n  /** Tells the caller whether this login created the underlying user. */\n  created: boolean;\n  /** Tells the caller whether this login linked a new identity row. */\n  linked: boolean;\n}\n\nexport interface ResolvedOAuthUser {\n  id: string;\n  email: string;\n  name: string;\n  role: NpUserRole;\n  tokenVersion: number;\n}\n\nexport interface ResolveOAuthLoginInput {\n  provider: string;\n  profile: OAuthProfile;\n  /** Default role for auto-created users. Defaults to `\"viewer\"`. */\n  defaultRole?: NpUserRole;\n}\n\nconst SYNTHETIC_EMAIL_SUFFIX = \".oauth.local\";\n\nfunction syntheticEmail(provider: string, providerUserId: string): string {\n  // Stable, namespaced, doesn't collide with real provider domains.\n  return `${providerUserId}@${provider}${SYNTHETIC_EMAIL_SUFFIX}`;\n}\n\nfunction deriveName(profile: OAuthProfile, fallbackEmail: string): string {\n  if (profile.name && profile.name.trim().length > 0) return profile.name.trim();\n  const localPart = fallbackEmail.split(\"@\")[0];\n  return localPart && localPart.length > 0 ? localPart : \"Member\";\n}\n\nexport async function resolveOAuthLogin(\n  input: ResolveOAuthLoginInput,\n): Promise<ResolveOAuthLoginResult> {\n  const db = getDb();\n  const provider = input.provider;\n  const profile = input.profile;\n  const role: NpUserRole = input.defaultRole ?? \"viewer\";\n\n  // Step 1: lookup by durable provider link.\n  const [existingLink] = (await db\n    .select({\n      userId: npUserOAuthIdentities.userId,\n      identityId: npUserOAuthIdentities.id,\n    })\n    .from(npUserOAuthIdentities)\n    .where(\n      and(\n        eq(npUserOAuthIdentities.provider, provider),\n        eq(npUserOAuthIdentities.providerUserId, profile.providerUserId),\n      ),\n    )\n    .limit(1)) as Array<{ userId: string; identityId: string }>;\n\n  if (existingLink) {\n    // Refresh metadata so the most recent provider info is captured.\n    const metadata = mergeMetadata(profile);\n    await db\n      .update(npUserOAuthIdentities)\n      .set({ metadata, updatedAt: new Date() })\n      .where(eq(npUserOAuthIdentities.id, existingLink.identityId));\n\n    const user = await loadUser(db, existingLink.userId);\n    return { user, created: false, linked: false };\n  }\n\n  // Step 2: email match. Skipped when the provider doesn't surface an\n  // email — we can't risk linking by guesswork.\n  if (profile.email) {\n    const normalizedEmail = profile.email.trim().toLowerCase();\n    const [existingUser] = (await db\n      .select({\n        id: npUsers.id,\n        email: npUsers.email,\n        name: npUsers.name,\n        role: npUsers.role,\n        tokenVersion: npUsers.tokenVersion,\n      })\n      .from(npUsers)\n      .where(eq(sql`lower(${npUsers.email})`, normalizedEmail))\n      .limit(1)) as ResolvedOAuthUser[];\n\n    if (existingUser) {\n      await db.insert(npUserOAuthIdentities).values({\n        userId: existingUser.id,\n        provider,\n        providerUserId: profile.providerUserId,\n        metadata: mergeMetadata(profile),\n      });\n      return { user: existingUser, created: false, linked: true };\n    }\n  }\n\n  // Step 3: auto-provision.\n  const email =\n    profile.email && profile.email.trim().length > 0\n      ? profile.email.trim().toLowerCase()\n      : syntheticEmail(provider, profile.providerUserId);\n  const name = deriveName(profile, email);\n  const placeholderPassword = await hashPassword(\n    crypto.randomUUID() + crypto.randomUUID(),\n  );\n\n  const [created] = (await db\n    .insert(npUsers)\n    .values({\n      email,\n      name,\n      password: placeholderPassword,\n      role,\n    })\n    .returning({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n      role: npUsers.role,\n      tokenVersion: npUsers.tokenVersion,\n    })) as ResolvedOAuthUser[];\n\n  await db.insert(npUserOAuthIdentities).values({\n    userId: created.id,\n    provider,\n    providerUserId: profile.providerUserId,\n    metadata: mergeMetadata(profile),\n  });\n\n  return { user: created, created: true, linked: true };\n}\n\nfunction mergeMetadata(profile: OAuthProfile): Record<string, unknown> {\n  const base: Record<string, unknown> = {};\n  if (profile.avatarUrl) base.avatarUrl = profile.avatarUrl;\n  if (profile.email) base.email = profile.email;\n  if (profile.name) base.name = profile.name;\n  if (profile.metadata) Object.assign(base, profile.metadata);\n  return base;\n}\n\nasync function loadUser(\n  db: NodePgDatabase<Record<string, unknown>>,\n  userId: string,\n): Promise<ResolvedOAuthUser> {\n  const [row] = (await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n      role: npUsers.role,\n      tokenVersion: npUsers.tokenVersion,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.id, userId))\n    .limit(1)) as ResolvedOAuthUser[];\n  if (!row) {\n    throw new Error(`User ${userId} referenced by oauth identity is missing`);\n  }\n  return row;\n}\n","import { and, eq, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { getCommunitySettings } from \"../community/settings.js\";\nimport { npMemberIdentities, npMembers } from \"../db/schema/community.js\";\nimport { NpForbiddenError } from \"../errors.js\";\n\nimport { hashPassword } from \"./password.js\";\nimport type { OAuthProfile } from \"./oauth-providers.js\";\n\n/**\n * Member-side mirror of `resolveOAuthLogin` (the staff resolver in\n * `oauth-resolve.ts`). Walks the same three-step ladder:\n *\n *   1. Lookup by `(provider, subject)` in `np_member_identities` —\n *      durable provider link.\n *   2. Email match — if the profile carries an email, link the\n *      identity to the existing `np_members` row.\n *   3. Auto-provision a new member with status=`active`, default\n *      password = unrecoverable Argon2 of a random secret. The user\n *      can later run forgot-password to set a real password if they\n *      want one (or stay SSO-only).\n *\n * Members are kept distinct from staff users at every layer\n * (different table, different cookies, different audience claim on\n * the JWT). This resolver intentionally never touches `np_users`.\n */\nexport interface ResolvedOAuthMember {\n  id: string;\n  email: string;\n  handle: string;\n  displayName: string;\n  status: \"active\" | \"pending\" | \"suspended\" | \"deleted\";\n  tokenVersion: number;\n}\n\nexport interface ResolveMemberOAuthLoginInput {\n  provider: string;\n  profile: OAuthProfile;\n}\n\nexport interface ResolveMemberOAuthLoginResult {\n  member: ResolvedOAuthMember;\n  /** True when this login auto-provisioned the underlying member. */\n  created: boolean;\n  /** True when this login linked a new identity row (covers steps 2 + 3). */\n  linked: boolean;\n}\n\nconst SYNTHETIC_EMAIL_SUFFIX = \".oauth.local\";\nconst HANDLE_FALLBACK = \"user\";\nconst HANDLE_RANDOM_SUFFIX_BYTES = 4;\n\nfunction syntheticEmail(provider: string, providerUserId: string): string {\n  return `${providerUserId}@${provider}${SYNTHETIC_EMAIL_SUFFIX}`;\n}\n\n/**\n * Members have a unique `handle` field. Build a candidate from the\n * provider's profile, sanitize to the project's handle regex, and add\n * a short random suffix to dodge collisions on common values like\n * \"alice\" / \"octocat\".\n *\n * Handle regex (per `register/route.ts`):\n *   /^[a-z0-9][a-z0-9_-]{2,29}$/\n */\nfunction generateHandle(profile: OAuthProfile, fallbackEmail: string): string {\n  const seed =\n    (profile.metadata && typeof profile.metadata.login === \"string\" && profile.metadata.login) ||\n    profile.name ||\n    fallbackEmail.split(\"@\")[0] ||\n    HANDLE_FALLBACK;\n  const sanitized = String(seed)\n    .toLowerCase()\n    .replace(/[^a-z0-9_-]/g, \"-\")\n    .replace(/^[-_]+/, \"\")\n    .slice(0, 20);\n  const base = sanitized.length >= 3 ? sanitized : HANDLE_FALLBACK;\n  // Random suffix keeps handles unique across the OAuth user pool —\n  // accept the cost of \"alice-9k2x\" rather than fighting a tight loop\n  // of insert-and-retry on every collision.\n  const suffix = Math.random()\n    .toString(36)\n    .slice(2, 2 + HANDLE_RANDOM_SUFFIX_BYTES);\n  return `${base}-${suffix}`.slice(0, 30);\n}\n\nfunction deriveDisplayName(profile: OAuthProfile, fallbackEmail: string): string {\n  if (profile.name && profile.name.trim().length > 0) return profile.name.trim();\n  const localPart = fallbackEmail.split(\"@\")[0];\n  return localPart && localPart.length > 0 ? localPart : \"Member\";\n}\n\nfunction mergeMetadata(profile: OAuthProfile): Record<string, unknown> {\n  const base: Record<string, unknown> = {};\n  if (profile.avatarUrl) base.avatarUrl = profile.avatarUrl;\n  if (profile.email) base.email = profile.email;\n  if (profile.name) base.name = profile.name;\n  if (profile.metadata) Object.assign(base, profile.metadata);\n  return base;\n}\n\nasync function loadMember(\n  db: NodePgDatabase<Record<string, unknown>>,\n  memberId: string,\n): Promise<ResolvedOAuthMember> {\n  const [row] = (await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n      tokenVersion: npMembers.tokenVersion,\n    })\n    .from(npMembers)\n    .where(eq(npMembers.id, memberId))\n    .limit(1)) as ResolvedOAuthMember[];\n  if (!row) {\n    throw new Error(`Member ${memberId} referenced by oauth identity is missing`);\n  }\n  return row;\n}\n\nexport async function resolveMemberOAuthLogin(\n  input: ResolveMemberOAuthLoginInput,\n): Promise<ResolveMemberOAuthLoginResult> {\n  const db = getDb();\n  const { provider, profile } = input;\n\n  // Step 1: durable lookup.\n  const [existingLink] = (await db\n    .select({ memberId: npMemberIdentities.memberId, identityId: npMemberIdentities.id })\n    .from(npMemberIdentities)\n    .where(\n      and(\n        eq(npMemberIdentities.provider, provider),\n        eq(npMemberIdentities.subject, profile.providerUserId),\n      ),\n    )\n    .limit(1)) as Array<{ memberId: string; identityId: string }>;\n\n  if (existingLink) {\n    await db\n      .update(npMemberIdentities)\n      .set({ metadata: mergeMetadata(profile), updatedAt: new Date() })\n      .where(eq(npMemberIdentities.id, existingLink.identityId));\n    const member = await loadMember(db, existingLink.memberId);\n    return { member, created: false, linked: false };\n  }\n\n  // Step 2: email match.\n  if (profile.email) {\n    const normalizedEmail = profile.email.trim().toLowerCase();\n    const [existingMember] = (await db\n      .select({\n        id: npMembers.id,\n        email: npMembers.email,\n        handle: npMembers.handle,\n        displayName: npMembers.displayName,\n        status: npMembers.status,\n        tokenVersion: npMembers.tokenVersion,\n      })\n      .from(npMembers)\n      .where(eq(sql`lower(${npMembers.email})`, normalizedEmail))\n      .limit(1)) as ResolvedOAuthMember[];\n\n    if (existingMember) {\n      // Refuse to auto-link an OAuth identity to a non-active member.\n      // Without this guard an attacker who controls an OAuth account\n      // with a victim's email could pre-link an identity to the\n      // victim's pending (unverified) row; once the victim later\n      // activates, the attacker's identity is already attached and\n      // they can sign in as the victim. The callback would still\n      // refuse the immediate login (status check below), but the\n      // dangling link would persist.\n      //\n      // Active members are the only ones we'll cross-link\n      // automatically — pending / suspended / deleted are returned\n      // as-is and the route's status check refuses the login.\n      if (existingMember.status !== \"active\") {\n        return { member: existingMember, created: false, linked: false };\n      }\n      await db.insert(npMemberIdentities).values({\n        memberId: existingMember.id,\n        provider,\n        subject: profile.providerUserId,\n        email: profile.email,\n        metadata: mergeMetadata(profile),\n      });\n      return { member: existingMember, created: false, linked: true };\n    }\n  }\n\n  // Step 3: auto-provision a brand-new member account. This is the\n  // step the `community.registrationEnabled` site setting gates —\n  // an invite-only site that disables password sign-up via\n  // `/api/members/register` would otherwise be joined through OAuth\n  // (the password endpoint and OAuth callback both create new\n  // member rows from an unauthenticated request, so they're the\n  // same surface from a policy point of view).\n  //\n  // Steps 1 and 2 are NOT gated: durable links and email matches\n  // log an EXISTING member back in, which isn't a new\n  // registration. An admin who flips `registrationEnabled = false`\n  // expects existing members to keep working — only new accounts\n  // should be refused.\n  const settings = await getCommunitySettings();\n  if (!settings.registrationEnabled) {\n    throw new NpForbiddenError(\"members\", \"register\");\n  }\n\n  const email =\n    profile.email && profile.email.trim().length > 0\n      ? profile.email.trim().toLowerCase()\n      : syntheticEmail(provider, profile.providerUserId);\n  const displayName = deriveDisplayName(profile, email);\n  const handle = generateHandle(profile, email);\n  const placeholderPassword = await hashPassword(\n    crypto.randomUUID() + crypto.randomUUID(),\n  );\n\n  const [created] = (await db\n    .insert(npMembers)\n    .values({\n      email,\n      handle,\n      displayName,\n      password: placeholderPassword,\n      // OAuth verifies the address out-of-band (the provider showed the\n      // user a real login screen for it), so skip the email-verify\n      // dance that password registration goes through.\n      emailVerified: true,\n      status: \"active\",\n    })\n    .returning({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n      tokenVersion: npMembers.tokenVersion,\n    })) as ResolvedOAuthMember[];\n\n  await db.insert(npMemberIdentities).values({\n    memberId: created.id,\n    provider,\n    subject: profile.providerUserId,\n    email: profile.email ?? null,\n    metadata: mergeMetadata(profile),\n  });\n\n  return { member: created, created: true, linked: true };\n}\n","import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\n\nimport { readEnvPositiveInt } from \"../config/env.js\";\n\n/**\n * HMAC-signed state tokens for the OAuth start ↔ callback handshake.\n * The framework (not the provider) issues + verifies these — providers\n * only see them as opaque strings.\n *\n * Token shape: `<base64url(payload)>.<base64url(hmac)>` where payload is\n * JSON `{ providerId, nonce, expSeconds, codeVerifier }`. Using an HMAC\n * instead of a JWT keeps this self-contained — no jose import, no key\n * rotation surface — and the payload stays comfortably under the\n * cookie size cap.\n *\n * The `codeVerifier` is a 32-byte URL-safe random string that providers\n * supporting PKCE (Google, etc.) hash into the authorize URL. Providers\n * that don't use PKCE (GitHub) ignore it. We always generate one so the\n * flow is uniform.\n *\n * Default state TTL is 10 minutes — long enough for slow IdP redirects\n * (corporate SSO with MFA prompts), short enough that a stale state\n * cookie doesn't sit around forever. Override via\n * `NP_OAUTH_STATE_TTL_SECONDS`.\n */\n\nconst STATE_TTL_SECONDS = readEnvPositiveInt(\"NP_OAUTH_STATE_TTL_SECONDS\", 600);\nconst CODE_VERIFIER_BYTES = 32;\n\nexport interface OAuthStatePayload {\n  providerId: string;\n  nonce: string;\n  expSeconds: number;\n  codeVerifier: string;\n}\n\nexport interface IssuedOAuthState {\n  /** The serialized state token (cookie + redirect query value). */\n  token: string;\n  /** The PKCE verifier — also embedded in the token, surfaced here so\n   *  the route can pass it to `provider.authorize()` without re-parsing. */\n  codeVerifier: string;\n}\n\nfunction b64url(input: string | Buffer): string {\n  return Buffer.from(input).toString(\"base64url\");\n}\n\nfunction sign(payload: string, secret: string): string {\n  return createHmac(\"sha256\", secret).update(payload).digest(\"base64url\");\n}\n\nexport function issueOAuthState(providerId: string, secret: string): IssuedOAuthState {\n  const nonce = randomBytes(16).toString(\"base64url\");\n  const codeVerifier = randomBytes(CODE_VERIFIER_BYTES).toString(\"base64url\");\n  const expSeconds = Math.floor(Date.now() / 1000) + STATE_TTL_SECONDS;\n  const payload: OAuthStatePayload = { providerId, nonce, expSeconds, codeVerifier };\n  const encoded = b64url(JSON.stringify(payload));\n  const sig = sign(encoded, secret);\n  return { token: `${encoded}.${sig}`, codeVerifier };\n}\n\nexport interface VerifyOAuthStateResult {\n  ok: boolean;\n  payload?: OAuthStatePayload;\n  reason?: \"format\" | \"signature\" | \"expired\";\n}\n\n/**\n * Strict verification:\n *  - Format must be `<payload>.<sig>` with two segments.\n *  - HMAC must match (constant-time compare).\n *  - `expSeconds` must be in the future.\n *  - `providerId` in the payload must match the route's expected provider.\n *  - `codeVerifier` must be a non-empty string.\n */\nexport function verifyOAuthState(\n  token: string,\n  expectedProviderId: string,\n  secret: string,\n): VerifyOAuthStateResult {\n  if (typeof token !== \"string\" || !token.includes(\".\")) {\n    return { ok: false, reason: \"format\" };\n  }\n  const [encoded, sig] = token.split(\".\") as [string, string];\n  if (!encoded || !sig) {\n    return { ok: false, reason: \"format\" };\n  }\n  const expectedSig = sign(encoded, secret);\n  const sigBuf = Buffer.from(sig);\n  const expectedBuf = Buffer.from(expectedSig);\n  if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {\n    return { ok: false, reason: \"signature\" };\n  }\n\n  let payload: OAuthStatePayload;\n  try {\n    payload = JSON.parse(Buffer.from(encoded, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return { ok: false, reason: \"format\" };\n  }\n\n  if (\n    !payload ||\n    typeof payload.providerId !== \"string\" ||\n    typeof payload.nonce !== \"string\" ||\n    typeof payload.expSeconds !== \"number\" ||\n    typeof payload.codeVerifier !== \"string\" ||\n    payload.codeVerifier.length === 0\n  ) {\n    return { ok: false, reason: \"format\" };\n  }\n\n  if (payload.providerId !== expectedProviderId) {\n    return { ok: false, reason: \"signature\" };\n  }\n\n  if (payload.expSeconds <= Math.floor(Date.now() / 1000)) {\n    return { ok: false, reason: \"expired\" };\n  }\n\n  return { ok: true, payload };\n}\n","import type { OAuthProfile, OAuthProvider } from \"./oauth-providers.js\";\n\n/**\n * Adapter that bridges any [arctic](https://arctic.js.org/) provider\n * (`new GitHub(...)`, `new Google(...)`, `new Apple(...)`, etc.) to\n * NexPress's `OAuthProvider` interface.\n *\n * Why this exists: arctic ships ~25 maintained providers and handles\n * the OAuth dance — token exchange, PKCE hashing, refresh-token\n * support — so plugin authors only have to write the **profile fetch**\n * (the part that varies most by provider). Our framework still owns\n * state cookies, identity ↔ user resolution, and session minting; this\n * adapter just lets users skip the boilerplate token POST.\n *\n * Usage from a plugin:\n *\n *   import { Apple } from \"arctic\";\n *   import { fromArctic, registerOAuthProvider } from \"@nexpress/core\";\n *\n *   registerOAuthProvider(fromArctic(\n *     // Factory: framework calls this each request with the freshly-\n *     // resolved redirectUri (matters in dev when Next.js may bind a\n *     // non-default port).\n *     (redirectUri) => new Apple(clientId, teamId, keyId, privateKey, redirectUri),\n *     {\n *       id: \"apple\",\n *       scopes: [\"name\", \"email\"],\n *       fetchProfile: async (accessToken, tokens) => {\n *         // Apple returns the user payload INSIDE the token response\n *         // (not a separate userinfo endpoint) — pull it from\n *         // `tokens.idToken()` here and parse the JWT body.\n *         return { providerUserId: parseAppleSub(tokens.idToken()), email: null };\n *       },\n *     },\n *   ));\n */\n\n/**\n * Minimal slice of arctic's provider classes that the adapter actually\n * needs. Both `GitHub` (no PKCE) and `Google` (PKCE-required) match\n * this — the third positional arg is \"second positional\" for\n * non-PKCE providers (just unused) and \"code verifier\" for PKCE ones.\n *\n * Declared structurally so we don't drag arctic into the public type\n * graph of `@nexpress/core`. Plugins that import a real arctic class\n * pass it directly; the structural match keeps the signature lined up.\n */\nexport interface ArcticLikeProvider {\n  createAuthorizationURL(state: string, ...rest: never[]): URL;\n  validateAuthorizationCode(code: string, ...rest: never[]): Promise<ArcticLikeTokens>;\n}\n\nexport interface ArcticLikeTokens {\n  accessToken(): string;\n  hasRefreshToken?(): boolean;\n  refreshToken?(): string;\n  idToken?(): string;\n}\n\nexport interface FromArcticOptions {\n  /** Provider id used in route paths and `np_user_oauth_identities.provider`. */\n  id: string;\n  /** Human label for admin UI / login buttons. */\n  label?: string;\n  /** Scopes passed to `createAuthorizationURL`. Most providers default\n   *  to nothing useful — set this. */\n  scopes?: string[];\n  /**\n   * Whether the underlying arctic provider expects a PKCE code verifier\n   * as the second arg to `createAuthorizationURL` and\n   * `validateAuthorizationCode`. Default `true` (Google, Apple, etc.).\n   * Set `false` for non-PKCE providers like GitHub.\n   */\n  pkce?: boolean;\n  /**\n   * Turns an access token (and the full token response, useful for\n   * providers like Apple that return the profile in the token) into the\n   * normalized `OAuthProfile` consumed by `resolveOAuthLogin`.\n   *\n   * Throwing aborts the login with `oauth_error=exchange_failed`.\n   */\n  fetchProfile: (\n    accessToken: string,\n    tokens: ArcticLikeTokens,\n  ) => Promise<OAuthProfile>;\n}\n\n/**\n * Wraps an arctic provider into the framework's `OAuthProvider`\n * shape. The framework calls `authorize` and `exchange`; this adapter\n * builds a fresh arctic instance per request via `factory(redirectUri)`\n * so the redirect URI always matches what the framework computed for\n * THIS request — critical in dev where Next.js may fall back to a\n * non-3000 port and a setup-time-frozen redirectUri would diverge.\n *\n * Arctic provider classes are cheap to construct (just hold the three\n * credential strings), so the per-request factory call has no\n * meaningful cost.\n */\nexport function fromArctic(\n  factory: (redirectUri: string) => ArcticLikeProvider,\n  opts: FromArcticOptions,\n): OAuthProvider {\n  const usePkce = opts.pkce !== false;\n  const scopes = opts.scopes ?? [];\n\n  return {\n    id: opts.id,\n    label: opts.label,\n    authorize({ state, redirectUri, codeVerifier }) {\n      const arctic = factory(redirectUri);\n      // Arctic's signatures vary: `(state, scopes)` for non-PKCE,\n      // `(state, codeVerifier, scopes)` for PKCE. The structural type\n      // hides this; do the dispatch here so plugin code stays clean.\n      const url = usePkce\n        ? (arctic.createAuthorizationURL as unknown as (\n            state: string,\n            verifier: string,\n            scopes: string[],\n          ) => URL)(state, codeVerifier, scopes)\n        : (arctic.createAuthorizationURL as unknown as (\n            state: string,\n            scopes: string[],\n          ) => URL)(state, scopes);\n      return url.toString();\n    },\n    async exchange({ code, redirectUri, codeVerifier }) {\n      const arctic = factory(redirectUri);\n      const tokens = usePkce\n        ? await (arctic.validateAuthorizationCode as unknown as (\n            code: string,\n            verifier: string,\n          ) => Promise<ArcticLikeTokens>)(code, codeVerifier)\n        : await (arctic.validateAuthorizationCode)(code);\n      return opts.fetchProfile(tokens.accessToken(), tokens);\n    },\n  };\n}\n","import { webcrypto } from \"node:crypto\";\n\nimport { eq, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport type { NpAuthUser } from \"../config/types.js\";\nimport { verifyToken, type NpTokenUse } from \"./token.js\";\nimport { npSessions, npUsers } from \"../db/schema/system.js\";\n\n/**\n * Loose Drizzle handle type — every staff-auth caller passes\n * the same NodePgDatabase, but TS over-narrows when the\n * generated schema record is folded in. Using\n * `Record<string, unknown>` keeps the helper portable across\n * schema generations without surfacing as `any`.\n */\ntype SessionDb = NodePgDatabase<Record<string, unknown>>;\n\nexport async function sha256(input: string): Promise<string> {\n  const digest = await webcrypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(input),\n  );\n\n  return Array.from(new Uint8Array(digest), (byte) =>\n    byte.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n}\n\n/**\n * Verify a staff JWT and resolve the active user.\n *\n * `expectedUse` defaults to `\"access\"` because every caller of this\n * helper outside the rotation endpoint reads `np-session` (server\n * components, route handlers, the bootstrap layout). Defaulting\n * means a fresh route or RSC page can't accidentally tolerate a\n * refresh JWT in the session cookie just by forgetting the\n * argument. The rotation route explicitly passes `\"refresh\"` for\n * its `np-refresh` read.\n *\n * Tokens missing the `use` claim throw via `verifyToken`; we let\n * that propagate so a `NpAuthError` surfaces as 401 at the API\n * layer.\n */\nexport async function verifyTokenFull(\n  token: string,\n  secret: string,\n  db: SessionDb,\n  expectedUse: NpTokenUse = \"access\",\n): Promise<NpAuthUser | null> {\n  const payload = await verifyToken(token, secret, expectedUse);\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n      role: npUsers.role,\n      tokenVersion: npUsers.tokenVersion,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.id, payload.sub))\n    .limit(1);\n\n  if (!user || user.tokenVersion !== payload.ver) {\n    return null;\n  }\n\n  return user;\n}\n\nexport async function invalidateAllSessions(\n  userId: string,\n  db: SessionDb,\n): Promise<void> {\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npUsers)\n      .set({\n        tokenVersion: sql`${npUsers.tokenVersion} + 1`,\n      })\n      .where(eq(npUsers.id, userId));\n\n    await tx.delete(npSessions).where(eq(npSessions.userId, userId));\n  });\n}\n","import { and, desc, eq } from \"drizzle-orm\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { recordAuditEvent } from \"../community/audit.js\";\nimport {\n  npMemberIdentities,\n  npMembers,\n} from \"../db/schema/community.js\";\nimport { npUserOAuthIdentities, npUsers } from \"../db/schema/system.js\";\nimport { NpNotFoundError } from \"../errors.js\";\n\n/**\n * Admin-side helpers for listing and revoking OAuth identity links.\n * Both staff (`np_user_oauth_identities`) and member\n * (`np_member_identities`) tables use the same shape: one row per\n * (account, provider) pair, holding the durable provider subject\n * plus arbitrary metadata. These helpers are the source of truth for\n * `/api/admin/users/[id]/identities` and the member equivalent.\n *\n * Revoking does not invalidate sessions — the user / member can\n * re-link by signing in via OAuth again, which creates a fresh\n * identity row through the resolver. Revocation is intentionally\n * reversible because the durable link is the only thing dropped;\n * the underlying account remains.\n */\n\nexport interface NpUserIdentityRow {\n  id: string;\n  userId: string;\n  provider: string;\n  providerUserId: string;\n  metadata: Record<string, unknown>;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\nexport interface NpMemberIdentityRow {\n  id: string;\n  memberId: string;\n  provider: string;\n  subject: string;\n  email: string | null;\n  metadata: Record<string, unknown>;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\nasync function assertUserExists(userId: string): Promise<void> {\n  const db = getDb();\n  const [row] = (await db\n    .select({ id: npUsers.id })\n    .from(npUsers)\n    .where(eq(npUsers.id, userId))\n    .limit(1)) as Array<{ id: string }>;\n  if (!row) throw new NpNotFoundError(\"user\", userId);\n}\n\nasync function assertMemberExists(memberId: string): Promise<void> {\n  const db = getDb();\n  const [row] = (await db\n    .select({ id: npMembers.id })\n    .from(npMembers)\n    .where(eq(npMembers.id, memberId))\n    .limit(1)) as Array<{ id: string }>;\n  if (!row) throw new NpNotFoundError(\"member\", memberId);\n}\n\nexport async function listUserIdentities(userId: string): Promise<NpUserIdentityRow[]> {\n  await assertUserExists(userId);\n  const db = getDb();\n  const rows = (await db\n    .select()\n    .from(npUserOAuthIdentities)\n    .where(eq(npUserOAuthIdentities.userId, userId))\n    .orderBy(desc(npUserOAuthIdentities.createdAt))) as NpUserIdentityRow[];\n  return rows;\n}\n\nexport async function listMemberIdentities(memberId: string): Promise<NpMemberIdentityRow[]> {\n  await assertMemberExists(memberId);\n  const db = getDb();\n  const rows = (await db\n    .select()\n    .from(npMemberIdentities)\n    .where(eq(npMemberIdentities.memberId, memberId))\n    .orderBy(desc(npMemberIdentities.createdAt))) as NpMemberIdentityRow[];\n  return rows;\n}\n\nexport interface RevokeIdentityInput {\n  /** Staff user id whose identity is being revoked (`actorKind: \"staff\"`). */\n  staffUserId: string;\n}\n\nexport async function revokeUserIdentity(\n  userId: string,\n  identityId: string,\n  actor: RevokeIdentityInput,\n): Promise<void> {\n  const db = getDb();\n  // Fetch the row first so the audit event captures the provider /\n  // subject — once deleted we'd lose the forensic context.\n  const [existing] = (await db\n    .select()\n    .from(npUserOAuthIdentities)\n    .where(\n      and(\n        eq(npUserOAuthIdentities.id, identityId),\n        eq(npUserOAuthIdentities.userId, userId),\n      ),\n    )\n    .limit(1)) as NpUserIdentityRow[];\n  if (!existing) {\n    // Either the identity doesn't exist or it belongs to a different\n    // user — both surface as 404 to avoid leaking cross-user\n    // existence to staff who don't have the right grants.\n    throw new NpNotFoundError(\"identity\", identityId);\n  }\n  // Use `.returning()` so we can tell whether OUR call did the\n  // delete. Two concurrent revokes both pass the select check\n  // above; if we record an audit event unconditionally we'd\n  // double-log the revocation. The second caller's delete returns\n  // zero rows — we skip the audit there.\n  const deleted = (await db\n    .delete(npUserOAuthIdentities)\n    .where(eq(npUserOAuthIdentities.id, identityId))\n    .returning({ id: npUserOAuthIdentities.id })) as Array<{ id: string }>;\n  if (deleted.length === 0) return;\n  await recordAuditEvent({\n    actor: { kind: \"staff\", userId: actor.staffUserId },\n    action: \"user.identity.revoke\",\n    targetType: \"user\",\n    targetId: userId,\n    payload: {\n      identityId,\n      provider: existing.provider,\n      providerUserId: existing.providerUserId,\n    },\n  });\n}\n\nexport async function revokeMemberIdentity(\n  memberId: string,\n  identityId: string,\n  actor: RevokeIdentityInput,\n): Promise<void> {\n  const db = getDb();\n  const [existing] = (await db\n    .select()\n    .from(npMemberIdentities)\n    .where(\n      and(\n        eq(npMemberIdentities.id, identityId),\n        eq(npMemberIdentities.memberId, memberId),\n      ),\n    )\n    .limit(1)) as NpMemberIdentityRow[];\n  if (!existing) throw new NpNotFoundError(\"identity\", identityId);\n  const deleted = (await db\n    .delete(npMemberIdentities)\n    .where(eq(npMemberIdentities.id, identityId))\n    .returning({ id: npMemberIdentities.id })) as Array<{ id: string }>;\n  if (deleted.length === 0) return;\n  await recordAuditEvent({\n    actor: { kind: \"staff\", userId: actor.staffUserId },\n    action: \"member.identity.revoke\",\n    targetType: \"member\",\n    targetId: memberId,\n    payload: {\n      identityId,\n      provider: existing.provider,\n      subject: existing.subject,\n    },\n  });\n}\n","import { randomBytes } from \"node:crypto\";\n\nimport { and, eq, gt, isNotNull, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { NpValidationError } from \"../errors.js\";\nimport { npSessions, npUsers } from \"../db/schema/system.js\";\nimport { hashPassword } from \"./password.js\";\nimport { sha256 } from \"./session.js\";\n\nexport type NpPasswordResetPurpose = \"invite\" | \"reset\";\n\nexport interface NpIssuedResetToken {\n  /** The raw token — deliver to the user, never persist. */\n  token: string;\n  /** Matches `np_users.password_reset_expires_at`. */\n  expiresAt: Date;\n  purpose: NpPasswordResetPurpose;\n}\n\nexport interface NpCreateResetTokenOptions {\n  userId: string;\n  purpose: NpPasswordResetPurpose;\n  ttlMs: number;\n}\n\nconst MIN_PASSWORD_LENGTH = 8;\n\nfunction generateRawToken(): string {\n  // 32 bytes → 64 hex chars. Wide enough that brute force is hopeless.\n  return randomBytes(32).toString(\"hex\");\n}\n\n/**\n * Issues a new password reset token for `userId`. Stores the **hash** of the\n * token in the `np_users` row alongside the expiry and purpose, then returns\n * the raw token for the caller to deliver (email/link).\n *\n * Any previously-outstanding reset token for the user is replaced.\n */\nexport async function createPasswordResetToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  options: NpCreateResetTokenOptions,\n): Promise<NpIssuedResetToken> {\n  const token = generateRawToken();\n  const tokenHash = await sha256(token);\n  const expiresAt = new Date(Date.now() + options.ttlMs);\n\n  await db\n    .update(npUsers)\n    .set({\n      passwordResetTokenHash: tokenHash,\n      passwordResetExpiresAt: expiresAt,\n      passwordResetPurpose: options.purpose,\n      updatedAt: new Date(),\n    })\n    .where(eq(npUsers.id, options.userId));\n\n  return { token, expiresAt, purpose: options.purpose };\n}\n\nexport interface NpResetRequestResult {\n  userId: string | null;\n  name: string | null;\n  email: string | null;\n  issued: NpIssuedResetToken | null;\n}\n\n/**\n * Handles the \"forgot password\" flow. If the email matches a user, issues a\n * reset token and returns their name so the mailer can personalise the email.\n * If not, silently returns nulls so callers can respond with a constant\n * message and avoid email enumeration.\n */\nexport async function requestPasswordReset(\n  db: NodePgDatabase<Record<string, unknown>>,\n  email: string,\n  ttlMs: number,\n): Promise<NpResetRequestResult> {\n  const normalizedEmail = email.trim().toLowerCase();\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      name: npUsers.name,\n    })\n    .from(npUsers)\n    .where(eq(npUsers.email, normalizedEmail))\n    .limit(1);\n\n  if (!user) {\n    return { userId: null, name: null, email: null, issued: null };\n  }\n\n  const issued = await createPasswordResetToken(db, {\n    userId: user.id,\n    purpose: \"reset\",\n    ttlMs,\n  });\n\n  return { userId: user.id, name: user.name, email: user.email, issued };\n}\n\nexport interface NpConsumeResetTokenOptions {\n  token: string;\n  newPassword: string;\n}\n\nexport interface NpConsumeResetTokenResult {\n  userId: string;\n  email: string;\n  purpose: NpPasswordResetPurpose;\n}\n\n/**\n * Verifies a password reset token and atomically:\n * - sets the new password hash\n * - bumps `tokenVersion` and deletes all sessions (force logout everywhere)\n * - clears the reset columns on the user row\n *\n * Throws `NpValidationError` when the token is unknown, expired, or the\n * password is too short. Uses a single DB transaction for atomicity.\n */\nexport async function consumePasswordResetToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  options: NpConsumeResetTokenOptions,\n): Promise<NpConsumeResetTokenResult> {\n  if (!options.token || typeof options.token !== \"string\") {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset token is required.\" },\n    ]);\n  }\n\n  if (!options.newPassword || options.newPassword.length < MIN_PASSWORD_LENGTH) {\n    throw new NpValidationError(\"Invalid input\", [\n      {\n        field: \"password\",\n        message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`,\n      },\n    ]);\n  }\n\n  const tokenHash = await sha256(options.token);\n  const now = new Date();\n\n  const [user] = await db\n    .select({\n      id: npUsers.id,\n      email: npUsers.email,\n      purpose: npUsers.passwordResetPurpose,\n    })\n    .from(npUsers)\n    .where(\n      and(\n        eq(npUsers.passwordResetTokenHash, tokenHash),\n        isNotNull(npUsers.passwordResetExpiresAt),\n        gt(npUsers.passwordResetExpiresAt, now),\n      ),\n    )\n    .limit(1);\n\n  if (!user) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset link is invalid or has expired.\" },\n    ]);\n  }\n\n  const newPasswordHash = await hashPassword(options.newPassword);\n\n  // We inline the tokenVersion bump + session delete instead of calling\n  // invalidateAllSessions because we need them to land in the same\n  // transaction as the password write + reset-column clear. Splitting into\n  // two transactions could leave the user with a new password but still-\n  // valid old JWTs if the second call failed.\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npUsers)\n      .set({\n        password: newPasswordHash,\n        passwordResetTokenHash: null,\n        passwordResetExpiresAt: null,\n        passwordResetPurpose: null,\n        loginAttempts: 0,\n        lockUntil: null,\n        tokenVersion: sql`${npUsers.tokenVersion} + 1`,\n        updatedAt: new Date(),\n      })\n      .where(eq(npUsers.id, user.id));\n\n    await tx.delete(npSessions).where(eq(npSessions.userId, user.id));\n  });\n\n  return {\n    userId: user.id,\n    email: user.email,\n    purpose: (user.purpose ?? \"reset\"),\n  };\n}\n","import { randomBytes } from \"node:crypto\";\nimport { jwtVerify, SignJWT, type JWTPayload } from \"jose\";\n\nimport { NpAuthError } from \"../errors.js\";\n\n/**\n * Member-side JWT helpers. Mirrors `signToken` / `verifyToken` for\n * staff but adds a fixed `aud: \"member\"` claim so a forged JWT signed\n * for a staff user can't be replayed against member-only routes (and\n * vice-versa).\n *\n * The signing secret is the same `NP_SECRET`; rotating it invalidates\n * both staff and member sessions, which is the desired behavior.\n *\n * Every token gets a random `jti` so two tokens minted within the\n * same second for the same member produce DIFFERENT JWT strings —\n * needed for refresh-token rotation: without it, the rotated token\n * hash would collide with the prior token hash and revocation by\n * tokenHash would still resolve the rotated row.\n *\n * `use: \"access\" | \"refresh\"` separates the two token purposes. A\n * refresh JWT cannot be presented as the `np-mb-session` cookie and\n * a session JWT cannot drive the rotation endpoint — without this\n * separation a leaked refresh token effectively became a long-lived\n * bearer access token because both kinds were stored as fungible\n * rows in `np_member_sessions` with no row-level kind column.\n */\nexport type NpMemberTokenUse = \"access\" | \"refresh\";\n\nexport interface NpMemberTokenPayload {\n  sub: string;\n  aud: \"member\";\n  ver: number;\n  /** Required. `verifyMemberToken` refuses tokens missing this claim\n   *  so legacy refresh JWTs from before #92 cannot be smuggled into\n   *  the session cookie path (#91 reopen). */\n  use: NpMemberTokenUse;\n  /** Optional only for the deploy window; new tokens always carry\n   *  one. */\n  jti?: string;\n  iat: number;\n  exp: number;\n}\n\nconst textEncoder = new TextEncoder();\nconst MEMBER_AUDIENCE = \"member\";\n\nexport async function signMemberToken(\n  member: { id: string; tokenVersion: number },\n  secret: string,\n  expirationSeconds: number = 7200,\n  tokenUse: NpMemberTokenUse = \"access\",\n): Promise<string> {\n  const secretKey = textEncoder.encode(secret);\n  return new SignJWT({ sub: member.id, ver: member.tokenVersion, use: tokenUse })\n    .setProtectedHeader({ alg: \"HS256\" })\n    .setAudience(MEMBER_AUDIENCE)\n    .setJti(randomBytes(16).toString(\"base64url\"))\n    .setIssuedAt()\n    .setExpirationTime(Math.floor(Date.now() / 1000) + expirationSeconds)\n    .sign(secretKey);\n}\n\n/**\n * Verify a member JWT and return the parsed payload. When\n * `expectedUse` is provided, refuses tokens whose `use` claim doesn't\n * match — that's how `getSessionMember` rejects a refresh token used\n * as a session cookie and how the refresh route rejects an access\n * token as a refresh trigger.\n *\n * Tokens minted before the `use` claim landed have NO `use` payload\n * field. We refuse those outright rather than treating them as\n * `access` — the prior fallback let still-live legacy refresh JWTs\n * (already persisted in `np_member_sessions` per #45's fix) be\n * smuggled into the session cookie and pass the access check (#91\n * reopen). The cost: members logged in before this deploy must log\n * in once. That's bounded by the access-token TTL (default 2h);\n * legacy session rows that don't match a new login age out via\n * `expiresAt` within 7 days regardless.\n */\nexport async function verifyMemberToken(\n  token: string,\n  secret: string,\n  expectedUse?: NpMemberTokenUse,\n): Promise<NpMemberTokenPayload> {\n  const secretKey = textEncoder.encode(secret);\n  const { payload } = await jwtVerify(token, secretKey, { audience: MEMBER_AUDIENCE });\n  // jwtVerify already validated `aud === MEMBER_AUDIENCE`; cast through\n  // JWTPayload to lock in the fields we know land on member tokens.\n  const typed = payload as JWTPayload & {\n    sub: string;\n    ver: number;\n    iat: number;\n    exp: number;\n    use?: NpMemberTokenUse;\n  };\n  if (typed.use !== \"access\" && typed.use !== \"refresh\") {\n    throw new NpAuthError(\"Member token missing `use` claim\");\n  }\n  const use: NpMemberTokenUse = typed.use;\n  if (expectedUse && use !== expectedUse) {\n    // Throw `NpAuthError` so the response mapper emits 401 instead of\n    // a plain 500 — this is an auth failure, not a server failure.\n    throw new NpAuthError(\n      `Member token use mismatch: expected ${expectedUse}, got ${use}`,\n    );\n  }\n  return { ...typed, aud: MEMBER_AUDIENCE, use };\n}\n","import { and, eq, gt, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { npMemberSessions, npMembers } from \"../db/schema/community.js\";\nimport { sha256 } from \"./session.js\";\n\n/**\n * Member-side session lookups, mirroring the staff helpers in session.ts\n * but for `np_members` / `np_member_sessions`. The sha256 helper is\n * reused (sessions store hashed tokens regardless of the principal kind).\n */\n\nexport interface NpMemberAuthRow {\n  id: string;\n  email: string;\n  handle: string;\n  displayName: string;\n  status: \"active\" | \"pending\" | \"suspended\" | \"deleted\";\n  tokenVersion: number;\n}\n\n/**\n * Resolve a member from a verified JWT payload AND the raw access\n * token. We hash the token and require a live row in\n * `np_member_sessions` — without that row check, deleting a session in\n * `/api/members/logout` had no effect and a stolen token kept working\n * until JWT expiry. (#45)\n *\n * Backward-compat: when no `accessToken` is passed (legacy callers in\n * tests / older routes), we fall back to the previous tokenVersion\n * check only. New paths should always pass the token.\n */\nexport async function getMemberFromTokenPayload(\n  db: NodePgDatabase<Record<string, unknown>>,\n  payload: { sub: string; ver: number },\n  accessToken?: string,\n): Promise<NpMemberAuthRow | null> {\n  const [row] = await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n      tokenVersion: npMembers.tokenVersion,\n    })\n    .from(npMembers)\n    .where(eq(npMembers.id, payload.sub))\n    .limit(1);\n\n  if (!row) return null;\n  if (row.tokenVersion !== payload.ver) return null;\n\n  if (accessToken) {\n    const tokenHash = await sha256(accessToken);\n    const now = new Date();\n    const [session] = (await db\n      .select({ id: npMemberSessions.id })\n      .from(npMemberSessions)\n      .where(\n        and(\n          eq(npMemberSessions.memberId, row.id),\n          eq(npMemberSessions.tokenHash, tokenHash),\n          gt(npMemberSessions.expiresAt, now),\n        ),\n      )\n      .limit(1)) as Array<{ id: string }>;\n    if (!session) return null;\n  }\n\n  return row as NpMemberAuthRow;\n}\n\n/**\n * Bumps a member's tokenVersion + drops every session row, force-logging\n * them out everywhere. Call inside the same transaction as a password\n * change / soft-delete so a leaked old JWT can't outlive the change.\n */\nexport async function invalidateAllMemberSessions(\n  db: NodePgDatabase<Record<string, unknown>>,\n  memberId: string,\n): Promise<void> {\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npMembers)\n      .set({\n        tokenVersion: sql`${npMembers.tokenVersion} + 1`,\n        updatedAt: new Date(),\n      })\n      .where(eq(npMembers.id, memberId));\n    await tx.delete(npMemberSessions).where(eq(npMemberSessions.memberId, memberId));\n  });\n}\n","import { randomBytes } from \"node:crypto\";\n\nimport { and, eq, gt, isNotNull, sql } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { NpValidationError } from \"../errors.js\";\nimport { npMemberSessions, npMembers } from \"../db/schema/community.js\";\nimport { hashPassword } from \"./password.js\";\nimport { sha256 } from \"./session.js\";\n\n/**\n * Member-side credential flows: email verification on registration,\n * password reset, password change. Mirrors the staff equivalents in\n * `reset-token.ts` but writes to `np_members` and uses dedicated\n * verify columns (`email_verify_token_hash` / `email_verify_expires_at`)\n * so a verify and a reset can coexist on the same member row.\n */\n\nconst MIN_PASSWORD_LENGTH = 8;\n\nexport interface NpIssuedMemberToken {\n  /** The raw token to ship to the user. Never persist. */\n  token: string;\n  expiresAt: Date;\n}\n\nfunction generateRawToken(): string {\n  return randomBytes(32).toString(\"hex\");\n}\n\n// ── Email verification ────────────────────────────────────────────────\n\nexport async function createMemberEmailVerifyToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  memberId: string,\n  ttlMs: number,\n): Promise<NpIssuedMemberToken> {\n  const token = generateRawToken();\n  const tokenHash = await sha256(token);\n  const expiresAt = new Date(Date.now() + ttlMs);\n\n  await db\n    .update(npMembers)\n    .set({\n      emailVerifyTokenHash: tokenHash,\n      emailVerifyExpiresAt: expiresAt,\n      updatedAt: new Date(),\n    })\n    .where(eq(npMembers.id, memberId));\n\n  return { token, expiresAt };\n}\n\nexport interface NpConsumeMemberEmailVerifyResult {\n  memberId: string;\n  email: string;\n  handle: string;\n  displayName: string;\n}\n\nexport async function consumeMemberEmailVerifyToken(\n  db: NodePgDatabase<Record<string, unknown>>,\n  token: string,\n): Promise<NpConsumeMemberEmailVerifyResult> {\n  if (!token || typeof token !== \"string\") {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Verification token is required.\" },\n    ]);\n  }\n  const tokenHash = await sha256(token);\n  const now = new Date();\n\n  const [member] = await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n    })\n    .from(npMembers)\n    .where(\n      and(\n        eq(npMembers.emailVerifyTokenHash, tokenHash),\n        isNotNull(npMembers.emailVerifyExpiresAt),\n        gt(npMembers.emailVerifyExpiresAt, now),\n      ),\n    )\n    .limit(1);\n\n  if (!member) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Verification link is invalid or has expired.\" },\n    ]);\n  }\n\n  await db\n    .update(npMembers)\n    .set({\n      emailVerified: true,\n      // Pending → active on first verify so login can succeed afterwards.\n      // Suspended/deleted members stay where they are; the mod UI flips\n      // those statuses, never the verify endpoint.\n      status: sql`case when ${npMembers.status} = 'pending' then 'active' else ${npMembers.status} end`,\n      emailVerifyTokenHash: null,\n      emailVerifyExpiresAt: null,\n      updatedAt: now,\n    })\n    .where(eq(npMembers.id, member.id));\n\n  return {\n    memberId: member.id,\n    email: member.email,\n    handle: member.handle,\n    displayName: member.displayName,\n  };\n}\n\n// ── Password reset ────────────────────────────────────────────────────\n\nexport interface NpMemberResetRequestResult {\n  memberId: string | null;\n  displayName: string | null;\n  email: string | null;\n  issued: NpIssuedMemberToken | null;\n}\n\nexport async function requestMemberPasswordReset(\n  db: NodePgDatabase<Record<string, unknown>>,\n  email: string,\n  ttlMs: number,\n): Promise<NpMemberResetRequestResult> {\n  const normalizedEmail = email.trim().toLowerCase();\n  const [member] = await db\n    .select({\n      id: npMembers.id,\n      email: npMembers.email,\n      displayName: npMembers.displayName,\n      status: npMembers.status,\n    })\n    .from(npMembers)\n    .where(eq(npMembers.email, normalizedEmail))\n    .limit(1);\n\n  if (!member || member.status === \"deleted\") {\n    return { memberId: null, displayName: null, email: null, issued: null };\n  }\n\n  const token = generateRawToken();\n  const tokenHash = await sha256(token);\n  const expiresAt = new Date(Date.now() + ttlMs);\n\n  await db\n    .update(npMembers)\n    .set({\n      passwordResetTokenHash: tokenHash,\n      passwordResetExpiresAt: expiresAt,\n      updatedAt: new Date(),\n    })\n    .where(eq(npMembers.id, member.id));\n\n  return {\n    memberId: member.id,\n    displayName: member.displayName,\n    email: member.email,\n    issued: { token, expiresAt },\n  };\n}\n\nexport interface NpConsumeMemberResetResult {\n  memberId: string;\n  email: string;\n}\n\nexport async function consumeMemberPasswordReset(\n  db: NodePgDatabase<Record<string, unknown>>,\n  token: string,\n  newPassword: string,\n): Promise<NpConsumeMemberResetResult> {\n  if (!token || typeof token !== \"string\") {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset token is required.\" },\n    ]);\n  }\n  if (!newPassword || newPassword.length < MIN_PASSWORD_LENGTH) {\n    throw new NpValidationError(\"Invalid input\", [\n      {\n        field: \"password\",\n        message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`,\n      },\n    ]);\n  }\n\n  const tokenHash = await sha256(token);\n  const now = new Date();\n\n  const [member] = await db\n    .select({ id: npMembers.id, email: npMembers.email })\n    .from(npMembers)\n    .where(\n      and(\n        eq(npMembers.passwordResetTokenHash, tokenHash),\n        isNotNull(npMembers.passwordResetExpiresAt),\n        gt(npMembers.passwordResetExpiresAt, now),\n      ),\n    )\n    .limit(1);\n\n  if (!member) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"token\", message: \"Reset link is invalid or has expired.\" },\n    ]);\n  }\n\n  const newPasswordHash = await hashPassword(newPassword);\n\n  await db.transaction(async (tx) => {\n    await tx\n      .update(npMembers)\n      .set({\n        password: newPasswordHash,\n        passwordResetTokenHash: null,\n        passwordResetExpiresAt: null,\n        loginAttempts: 0,\n        lockUntil: null,\n        // Bump tokenVersion in-place so existing JWTs are invalidated. Also\n        // mark email as verified — completing a reset on an unverified\n        // account is itself proof of email ownership.\n        tokenVersion: sql`${npMembers.tokenVersion} + 1`,\n        emailVerified: true,\n        status: sql`case when ${npMembers.status} = 'pending' then 'active' else ${npMembers.status} end`,\n        updatedAt: new Date(),\n      })\n      .where(eq(npMembers.id, member.id));\n\n    await tx.delete(npMemberSessions).where(eq(npMemberSessions.memberId, member.id));\n  });\n\n  return { memberId: member.id, email: member.email };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEO,IAAM,gBAAkC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;AAExD,IAAM,UAA4B,CAAC,EAAE,KAAK,MAAM,MAAM,SAAS;AAE/D,IAAM,kBAAoC,CAAC,EAAE,KAAK,MACvD,CAAC,CAAC,SAAS,KAAK,SAAS,WAAW,KAAK,SAAS;AAE7C,IAAM,iBAAmC,CAAC,EAAE,MAAM,IAAI,MAC3D,MAAM,SAAS,WAAW,KAAK,cAAc,MAAM;;;ACVrD,SAAS,mBAAmB;AAC5B,SAAS,WAAW,SAAS,UAAU,kBAAmC;AAqC1E,IAAM,cAAc,IAAI,YAAY;AAEpC,eAAsB,UACpB,MACA,QACA,oBAA4B,MAC5B,WAAuB,UACN;AACjB,QAAM,YAAY,YAAY,OAAO,MAAM;AAE3C,SAAO,IAAI,QAAQ;AAAA,IACjB,KAAK,KAAK;AAAA,IACV,MAAM,KAAK;AAAA,IACX,KAAK,KAAK;AAAA,IACV,KAAK;AAAA,EACP,CAAC,EACE,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW,CAAC,EAC5C,YAAY,EACZ,kBAAkB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,iBAAiB,EACnE,KAAK,SAAS;AACnB;AAeA,eAAsB,YACpB,OACA,QACA,aACyB;AACzB,QAAM,YAAY,YAAY,OAAO,MAAM;AAC3C,QAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,SAAS;AACpD,QAAM,QAAQ;AAQd,MAAI,MAAM,QAAQ,YAAY,MAAM,QAAQ,WAAW;AACrD,UAAM,IAAI,YAAY,iCAAiC;AAAA,EACzD;AACA,QAAM,MAAkB,MAAM;AAC9B,MAAI,eAAe,QAAQ,aAAa;AACtC,UAAM,IAAI;AAAA,MACR,sCAAsC,WAAW,SAAS,GAAG;AAAA,IAC/D;AAAA,EACF;AACA,SAAO,EAAE,GAAG,OAAO,IAAI;AACzB;AAeO,SAAS,yBAAyB,KAAuB;AAC9D,MAAI,eAAe,YAAa,QAAO;AACvC,MAAI,eAAe,WAAW,UAAW,QAAO;AAChD,SAAO;AACT;;;ACtHA,SAAS,UAAU;AA2BnB,eAAsB,YAAY,IAAyC;AACzE,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,MAAM,QAAQ;AAAA,IACd,OAAO,QAAQ;AAAA,EACjB,CAAC,EACA,KAAK,OAAO,EACZ,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC,EACxB,MAAM,CAAC;AACV,SAAO,QAAQ;AACjB;;;ACvCA,SAAS,MAAM,cAA4B;AAEpC,IAAM,iBAA0B;AAAA,EACrC,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,WAAW;AAAA,EACX,aAAa;AACf;AAKA,IAAM,sBAA+B;AAAA,EACnC,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,WAAW;AAAA,EACX,aAAa;AACf;AAEO,SAAS,aAAa,UAAmC;AAC9D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,IAAI,sBAAsB,MAAM,sBAAsB;AAAA,EAChE;AACF;AAEO,SAAS,eACd,cACA,UACkB;AAClB,SAAO,OAAO,cAAc,QAAQ;AACtC;;;AC/BA,IAAM,eAAe,oBAAI,IAAI,CAAC,OAAO,QAAQ,SAAS,CAAC;AAEhD,SAAS,WACd,QACA,aACA,aACS;AACT,MAAI,aAAa,IAAI,OAAO,YAAY,CAAC,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,eAAe,eAAe,gBAAgB,WAAW;AAC1E;;;ACoEA,IAAM,YAAY,oBAAI,IAA2B;AAO1C,SAAS,sBAAsB,UAA+B;AACnE,MAAI,CAAC,SAAS,MAAM,OAAO,SAAS,OAAO,UAAU;AACnD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,OAAO,SAAS,cAAc,cAAc,OAAO,SAAS,aAAa,YAAY;AACvF,UAAM,IAAI;AAAA,MACR,mBAAmB,SAAS,EAAE;AAAA,IAChC;AAAA,EACF;AACA,YAAU,IAAI,SAAS,IAAI,QAAQ;AACrC;AAEO,SAAS,iBAAiB,IAAuC;AACtE,SAAO,UAAU,IAAI,EAAE;AACzB;AAEO,SAAS,qBAAsC;AACpD,SAAO,MAAM,KAAK,UAAU,OAAO,CAAC;AACtC;AAGO,SAAS,sBAA4B;AAC1C,YAAU,MAAM;AAClB;;;AC9GA,SAAS,MAAAA,KAAI,KAAK,WAAW;AAoD7B,IAAM,yBAAyB;AAE/B,SAAS,eAAe,UAAkB,gBAAgC;AAExE,SAAO,GAAG,cAAc,IAAI,QAAQ,GAAG,sBAAsB;AAC/D;AAEA,SAAS,WAAW,SAAuB,eAA+B;AACxE,MAAI,QAAQ,QAAQ,QAAQ,KAAK,KAAK,EAAE,SAAS,EAAG,QAAO,QAAQ,KAAK,KAAK;AAC7E,QAAM,YAAY,cAAc,MAAM,GAAG,EAAE,CAAC;AAC5C,SAAO,aAAa,UAAU,SAAS,IAAI,YAAY;AACzD;AAEA,eAAsB,kBACpB,OACkC;AAClC,QAAM,KAAK,MAAM;AACjB,QAAM,WAAW,MAAM;AACvB,QAAM,UAAU,MAAM;AACtB,QAAM,OAAmB,MAAM,eAAe;AAG9C,QAAM,CAAC,YAAY,IAAK,MAAM,GAC3B,OAAO;AAAA,IACN,QAAQ,sBAAsB;AAAA,IAC9B,YAAY,sBAAsB;AAAA,EACpC,CAAC,EACA,KAAK,qBAAqB,EAC1B;AAAA,IACC;AAAA,MACEC,IAAG,sBAAsB,UAAU,QAAQ;AAAA,MAC3CA,IAAG,sBAAsB,gBAAgB,QAAQ,cAAc;AAAA,IACjE;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,cAAc;AAEhB,UAAM,WAAW,cAAc,OAAO;AACtC,UAAM,GACH,OAAO,qBAAqB,EAC5B,IAAI,EAAE,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC,EACvC,MAAMA,IAAG,sBAAsB,IAAI,aAAa,UAAU,CAAC;AAE9D,UAAM,OAAO,MAAM,SAAS,IAAI,aAAa,MAAM;AACnD,WAAO,EAAE,MAAM,SAAS,OAAO,QAAQ,MAAM;AAAA,EAC/C;AAIA,MAAI,QAAQ,OAAO;AACjB,UAAM,kBAAkB,QAAQ,MAAM,KAAK,EAAE,YAAY;AACzD,UAAM,CAAC,YAAY,IAAK,MAAM,GAC3B,OAAO;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,cAAc,QAAQ;AAAA,IACxB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMA,IAAG,YAAY,QAAQ,KAAK,KAAK,eAAe,CAAC,EACvD,MAAM,CAAC;AAEV,QAAI,cAAc;AAChB,YAAM,GAAG,OAAO,qBAAqB,EAAE,OAAO;AAAA,QAC5C,QAAQ,aAAa;AAAA,QACrB;AAAA,QACA,gBAAgB,QAAQ;AAAA,QACxB,UAAU,cAAc,OAAO;AAAA,MACjC,CAAC;AACD,aAAO,EAAE,MAAM,cAAc,SAAS,OAAO,QAAQ,KAAK;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,QACJ,QAAQ,SAAS,QAAQ,MAAM,KAAK,EAAE,SAAS,IAC3C,QAAQ,MAAM,KAAK,EAAE,YAAY,IACjC,eAAe,UAAU,QAAQ,cAAc;AACrD,QAAM,OAAO,WAAW,SAAS,KAAK;AACtC,QAAM,sBAAsB,MAAM;AAAA,IAChC,OAAO,WAAW,IAAI,OAAO,WAAW;AAAA,EAC1C;AAEA,QAAM,CAAC,OAAO,IAAK,MAAM,GACtB,OAAO,OAAO,EACd,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,EACF,CAAC,EACA,UAAU;AAAA,IACT,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,cAAc,QAAQ;AAAA,EACxB,CAAC;AAEH,QAAM,GAAG,OAAO,qBAAqB,EAAE,OAAO;AAAA,IAC5C,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,gBAAgB,QAAQ;AAAA,IACxB,UAAU,cAAc,OAAO;AAAA,EACjC,CAAC;AAED,SAAO,EAAE,MAAM,SAAS,SAAS,MAAM,QAAQ,KAAK;AACtD;AAEA,SAAS,cAAc,SAAgD;AACrE,QAAM,OAAgC,CAAC;AACvC,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,MAAO,MAAK,QAAQ,QAAQ;AACxC,MAAI,QAAQ,KAAM,MAAK,OAAO,QAAQ;AACtC,MAAI,QAAQ,SAAU,QAAO,OAAO,MAAM,QAAQ,QAAQ;AAC1D,SAAO;AACT;AAEA,eAAe,SACb,IACA,QAC4B;AAC5B,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,cAAc,QAAQ;AAAA,EACxB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMA,IAAG,QAAQ,IAAI,MAAM,CAAC,EAC5B,MAAM,CAAC;AACV,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,QAAQ,MAAM,0CAA0C;AAAA,EAC1E;AACA,SAAO;AACT;;;AC/LA,SAAS,OAAAC,MAAK,MAAAC,KAAI,OAAAC,YAAW;AAkD7B,IAAMC,0BAAyB;AAC/B,IAAM,kBAAkB;AACxB,IAAM,6BAA6B;AAEnC,SAASC,gBAAe,UAAkB,gBAAgC;AACxE,SAAO,GAAG,cAAc,IAAI,QAAQ,GAAGD,uBAAsB;AAC/D;AAWA,SAAS,eAAe,SAAuB,eAA+B;AAC5E,QAAM,OACH,QAAQ,YAAY,OAAO,QAAQ,SAAS,UAAU,YAAY,QAAQ,SAAS,SACpF,QAAQ,QACR,cAAc,MAAM,GAAG,EAAE,CAAC,KAC1B;AACF,QAAM,YAAY,OAAO,IAAI,EAC1B,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,QAAQ,UAAU,EAAE,EACpB,MAAM,GAAG,EAAE;AACd,QAAM,OAAO,UAAU,UAAU,IAAI,YAAY;AAIjD,QAAM,SAAS,KAAK,OAAO,EACxB,SAAS,EAAE,EACX,MAAM,GAAG,IAAI,0BAA0B;AAC1C,SAAO,GAAG,IAAI,IAAI,MAAM,GAAG,MAAM,GAAG,EAAE;AACxC;AAEA,SAAS,kBAAkB,SAAuB,eAA+B;AAC/E,MAAI,QAAQ,QAAQ,QAAQ,KAAK,KAAK,EAAE,SAAS,EAAG,QAAO,QAAQ,KAAK,KAAK;AAC7E,QAAM,YAAY,cAAc,MAAM,GAAG,EAAE,CAAC;AAC5C,SAAO,aAAa,UAAU,SAAS,IAAI,YAAY;AACzD;AAEA,SAASE,eAAc,SAAgD;AACrE,QAAM,OAAgC,CAAC;AACvC,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,MAAO,MAAK,QAAQ,QAAQ;AACxC,MAAI,QAAQ,KAAM,MAAK,OAAO,QAAQ;AACtC,MAAI,QAAQ,SAAU,QAAO,OAAO,MAAM,QAAQ,QAAQ;AAC1D,SAAO;AACT;AAEA,eAAe,WACb,IACA,UAC8B;AAC9B,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,IAClB,cAAc,UAAU;AAAA,EAC1B,CAAC,EACA,KAAK,SAAS,EACd,MAAMC,IAAG,UAAU,IAAI,QAAQ,CAAC,EAChC,MAAM,CAAC;AACV,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,UAAU,QAAQ,0CAA0C;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,eAAsB,wBACpB,OACwC;AACxC,QAAM,KAAK,MAAM;AACjB,QAAM,EAAE,UAAU,QAAQ,IAAI;AAG9B,QAAM,CAAC,YAAY,IAAK,MAAM,GAC3B,OAAO,EAAE,UAAU,mBAAmB,UAAU,YAAY,mBAAmB,GAAG,CAAC,EACnF,KAAK,kBAAkB,EACvB;AAAA,IACCC;AAAA,MACED,IAAG,mBAAmB,UAAU,QAAQ;AAAA,MACxCA,IAAG,mBAAmB,SAAS,QAAQ,cAAc;AAAA,IACvD;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,cAAc;AAChB,UAAM,GACH,OAAO,kBAAkB,EACzB,IAAI,EAAE,UAAUD,eAAc,OAAO,GAAG,WAAW,oBAAI,KAAK,EAAE,CAAC,EAC/D,MAAMC,IAAG,mBAAmB,IAAI,aAAa,UAAU,CAAC;AAC3D,UAAM,SAAS,MAAM,WAAW,IAAI,aAAa,QAAQ;AACzD,WAAO,EAAE,QAAQ,SAAS,OAAO,QAAQ,MAAM;AAAA,EACjD;AAGA,MAAI,QAAQ,OAAO;AACjB,UAAM,kBAAkB,QAAQ,MAAM,KAAK,EAAE,YAAY;AACzD,UAAM,CAAC,cAAc,IAAK,MAAM,GAC7B,OAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,OAAO,UAAU;AAAA,MACjB,QAAQ,UAAU;AAAA,MAClB,aAAa,UAAU;AAAA,MACvB,QAAQ,UAAU;AAAA,MAClB,cAAc,UAAU;AAAA,IAC1B,CAAC,EACA,KAAK,SAAS,EACd,MAAMA,IAAGE,aAAY,UAAU,KAAK,KAAK,eAAe,CAAC,EACzD,MAAM,CAAC;AAEV,QAAI,gBAAgB;AAalB,UAAI,eAAe,WAAW,UAAU;AACtC,eAAO,EAAE,QAAQ,gBAAgB,SAAS,OAAO,QAAQ,MAAM;AAAA,MACjE;AACA,YAAM,GAAG,OAAO,kBAAkB,EAAE,OAAO;AAAA,QACzC,UAAU,eAAe;AAAA,QACzB;AAAA,QACA,SAAS,QAAQ;AAAA,QACjB,OAAO,QAAQ;AAAA,QACf,UAAUH,eAAc,OAAO;AAAA,MACjC,CAAC;AACD,aAAO,EAAE,QAAQ,gBAAgB,SAAS,OAAO,QAAQ,KAAK;AAAA,IAChE;AAAA,EACF;AAeA,QAAM,WAAW,MAAM,qBAAqB;AAC5C,MAAI,CAAC,SAAS,qBAAqB;AACjC,UAAM,IAAI,iBAAiB,WAAW,UAAU;AAAA,EAClD;AAEA,QAAM,QACJ,QAAQ,SAAS,QAAQ,MAAM,KAAK,EAAE,SAAS,IAC3C,QAAQ,MAAM,KAAK,EAAE,YAAY,IACjCD,gBAAe,UAAU,QAAQ,cAAc;AACrD,QAAM,cAAc,kBAAkB,SAAS,KAAK;AACpD,QAAM,SAAS,eAAe,SAAS,KAAK;AAC5C,QAAM,sBAAsB,MAAM;AAAA,IAChC,OAAO,WAAW,IAAI,OAAO,WAAW;AAAA,EAC1C;AAEA,QAAM,CAAC,OAAO,IAAK,MAAM,GACtB,OAAO,SAAS,EAChB,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA;AAAA;AAAA;AAAA,IAIV,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC,EACA,UAAU;AAAA,IACT,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,IAClB,cAAc,UAAU;AAAA,EAC1B,CAAC;AAEH,QAAM,GAAG,OAAO,kBAAkB,EAAE,OAAO;AAAA,IACzC,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ,SAAS;AAAA,IACxB,UAAUC,eAAc,OAAO;AAAA,EACjC,CAAC;AAED,SAAO,EAAE,QAAQ,SAAS,SAAS,MAAM,QAAQ,KAAK;AACxD;;;AC9PA,SAAS,YAAY,eAAAI,cAAa,uBAAuB;AA0BzD,IAAM,oBAAoB,mBAAmB,8BAA8B,GAAG;AAC9E,IAAM,sBAAsB;AAiB5B,SAAS,OAAO,OAAgC;AAC9C,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AAChD;AAEA,SAAS,KAAK,SAAiB,QAAwB;AACrD,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW;AACxE;AAEO,SAAS,gBAAgB,YAAoB,QAAkC;AACpF,QAAM,QAAQC,aAAY,EAAE,EAAE,SAAS,WAAW;AAClD,QAAM,eAAeA,aAAY,mBAAmB,EAAE,SAAS,WAAW;AAC1E,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AACnD,QAAM,UAA6B,EAAE,YAAY,OAAO,YAAY,aAAa;AACjF,QAAM,UAAU,OAAO,KAAK,UAAU,OAAO,CAAC;AAC9C,QAAM,MAAM,KAAK,SAAS,MAAM;AAChC,SAAO,EAAE,OAAO,GAAG,OAAO,IAAI,GAAG,IAAI,aAAa;AACpD;AAgBO,SAAS,iBACd,OACA,oBACA,QACwB;AACxB,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,SAAS,GAAG,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,QAAM,CAAC,SAAS,GAAG,IAAI,MAAM,MAAM,GAAG;AACtC,MAAI,CAAC,WAAW,CAAC,KAAK;AACpB,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AACA,QAAM,cAAc,KAAK,SAAS,MAAM;AACxC,QAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,QAAM,cAAc,OAAO,KAAK,WAAW;AAC3C,MAAI,OAAO,WAAW,YAAY,UAAU,CAAC,gBAAgB,QAAQ,WAAW,GAAG;AACjF,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EACzE,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AAEA,MACE,CAAC,WACD,OAAO,QAAQ,eAAe,YAC9B,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,eAAe,YAC9B,OAAO,QAAQ,iBAAiB,YAChC,QAAQ,aAAa,WAAW,GAChC;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AAEA,MAAI,QAAQ,eAAe,oBAAoB;AAC7C,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AAEA,MAAI,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AACvD,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxC;AAEA,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;;;ACvBO,SAAS,WACd,SACA,MACe;AACf,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,SAAS,KAAK,UAAU,CAAC;AAE/B,SAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,EAAE,OAAO,aAAa,aAAa,GAAG;AAC9C,YAAM,SAAS,QAAQ,WAAW;AAIlC,YAAM,MAAM,UACP,OAAO,uBAIE,OAAO,cAAc,MAAM,IACpC,OAAO,uBAGE,OAAO,MAAM;AAC3B,aAAO,IAAI,SAAS;AAAA,IACtB;AAAA,IACA,MAAM,SAAS,EAAE,MAAM,aAAa,aAAa,GAAG;AAClD,YAAM,SAAS,QAAQ,WAAW;AAClC,YAAM,SAAS,UACX,MAAO,OAAO,0BAGkB,MAAM,YAAY,IAClD,MAAO,OAAO,0BAA2B,IAAI;AACjD,aAAO,KAAK,aAAa,OAAO,YAAY,GAAG,MAAM;AAAA,IACvD;AAAA,EACF;AACF;;;ACzIA,SAAS,iBAAiB;AAE1B,SAAS,MAAAC,KAAI,OAAAC,YAAW;AAgBxB,eAAsB,OAAO,OAAgC;AAC3D,QAAM,SAAS,MAAM,UAAU,OAAO;AAAA,IACpC;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,EAChC;AAEA,SAAO,MAAM;AAAA,IAAK,IAAI,WAAW,MAAM;AAAA,IAAG,CAAC,SACzC,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EACnC,EAAE,KAAK,EAAE;AACX;AAiBA,eAAsB,gBACpB,OACA,QACA,IACA,cAA0B,UACE;AAC5B,QAAM,UAAU,MAAM,YAAY,OAAO,QAAQ,WAAW;AAC5D,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,MAAM,QAAQ;AAAA,IACd,cAAc,QAAQ;AAAA,EACxB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMC,IAAG,QAAQ,IAAI,QAAQ,GAAG,CAAC,EACjC,MAAM,CAAC;AAEV,MAAI,CAAC,QAAQ,KAAK,iBAAiB,QAAQ,KAAK;AAC9C,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,eAAsB,sBACpB,QACA,IACe;AACf,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,OAAO,EACd,IAAI;AAAA,MACH,cAAcC,OAAM,QAAQ,YAAY;AAAA,IAC1C,CAAC,EACA,MAAMD,IAAG,QAAQ,IAAI,MAAM,CAAC;AAE/B,UAAM,GAAG,OAAO,UAAU,EAAE,MAAMA,IAAG,WAAW,QAAQ,MAAM,CAAC;AAAA,EACjE,CAAC;AACH;;;ACpFA,SAAS,OAAAE,MAAK,MAAM,MAAAC,WAAU;AA+C9B,eAAe,iBAAiB,QAA+B;AAC7D,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,IAAI,QAAQ,GAAG,CAAC,EACzB,KAAK,OAAO,EACZ,MAAMC,IAAG,QAAQ,IAAI,MAAM,CAAC,EAC5B,MAAM,CAAC;AACV,MAAI,CAAC,IAAK,OAAM,IAAI,gBAAgB,QAAQ,MAAM;AACpD;AAEA,eAAe,mBAAmB,UAAiC;AACjE,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,IAAI,UAAU,GAAG,CAAC,EAC3B,KAAK,SAAS,EACd,MAAMA,IAAG,UAAU,IAAI,QAAQ,CAAC,EAChC,MAAM,CAAC;AACV,MAAI,CAAC,IAAK,OAAM,IAAI,gBAAgB,UAAU,QAAQ;AACxD;AAEA,eAAsB,mBAAmB,QAA8C;AACrF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,KAAK,MAAM;AACjB,QAAM,OAAQ,MAAM,GACjB,OAAO,EACP,KAAK,qBAAqB,EAC1B,MAAMA,IAAG,sBAAsB,QAAQ,MAAM,CAAC,EAC9C,QAAQ,KAAK,sBAAsB,SAAS,CAAC;AAChD,SAAO;AACT;AAEA,eAAsB,qBAAqB,UAAkD;AAC3F,QAAM,mBAAmB,QAAQ;AACjC,QAAM,KAAK,MAAM;AACjB,QAAM,OAAQ,MAAM,GACjB,OAAO,EACP,KAAK,kBAAkB,EACvB,MAAMA,IAAG,mBAAmB,UAAU,QAAQ,CAAC,EAC/C,QAAQ,KAAK,mBAAmB,SAAS,CAAC;AAC7C,SAAO;AACT;AAOA,eAAsB,mBACpB,QACA,YACA,OACe;AACf,QAAM,KAAK,MAAM;AAGjB,QAAM,CAAC,QAAQ,IAAK,MAAM,GACvB,OAAO,EACP,KAAK,qBAAqB,EAC1B;AAAA,IACCC;AAAA,MACED,IAAG,sBAAsB,IAAI,UAAU;AAAA,MACvCA,IAAG,sBAAsB,QAAQ,MAAM;AAAA,IACzC;AAAA,EACF,EACC,MAAM,CAAC;AACV,MAAI,CAAC,UAAU;AAIb,UAAM,IAAI,gBAAgB,YAAY,UAAU;AAAA,EAClD;AAMA,QAAM,UAAW,MAAM,GACpB,OAAO,qBAAqB,EAC5B,MAAMA,IAAG,sBAAsB,IAAI,UAAU,CAAC,EAC9C,UAAU,EAAE,IAAI,sBAAsB,GAAG,CAAC;AAC7C,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,iBAAiB;AAAA,IACrB,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,YAAY;AAAA,IAClD,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,qBACpB,UACA,YACA,OACe;AACf,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,QAAQ,IAAK,MAAM,GACvB,OAAO,EACP,KAAK,kBAAkB,EACvB;AAAA,IACCC;AAAA,MACED,IAAG,mBAAmB,IAAI,UAAU;AAAA,MACpCA,IAAG,mBAAmB,UAAU,QAAQ;AAAA,IAC1C;AAAA,EACF,EACC,MAAM,CAAC;AACV,MAAI,CAAC,SAAU,OAAM,IAAI,gBAAgB,YAAY,UAAU;AAC/D,QAAM,UAAW,MAAM,GACpB,OAAO,kBAAkB,EACzB,MAAMA,IAAG,mBAAmB,IAAI,UAAU,CAAC,EAC3C,UAAU,EAAE,IAAI,mBAAmB,GAAG,CAAC;AAC1C,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,iBAAiB;AAAA,IACrB,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,YAAY;AAAA,IAClD,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IACpB;AAAA,EACF,CAAC;AACH;;;AC9KA,SAAS,eAAAE,oBAAmB;AAE5B,SAAS,OAAAC,MAAK,MAAAC,KAAI,IAAI,WAAW,OAAAC,YAAW;AAwB5C,IAAM,sBAAsB;AAE5B,SAAS,mBAA2B;AAElC,SAAOC,aAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AASA,eAAsB,yBACpB,IACA,SAC6B;AAC7B,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK;AAErD,QAAM,GACH,OAAO,OAAO,EACd,IAAI;AAAA,IACH,wBAAwB;AAAA,IACxB,wBAAwB;AAAA,IACxB,sBAAsB,QAAQ;AAAA,IAC9B,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAMC,IAAG,QAAQ,IAAI,QAAQ,MAAM,CAAC;AAEvC,SAAO,EAAE,OAAO,WAAW,SAAS,QAAQ,QAAQ;AACtD;AAeA,eAAsB,qBACpB,IACA,OACA,OAC+B;AAC/B,QAAM,kBAAkB,MAAM,KAAK,EAAE,YAAY;AACjD,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,EAChB,CAAC,EACA,KAAK,OAAO,EACZ,MAAMA,IAAG,QAAQ,OAAO,eAAe,CAAC,EACxC,MAAM,CAAC;AAEV,MAAI,CAAC,MAAM;AACT,WAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,OAAO,MAAM,QAAQ,KAAK;AAAA,EAC/D;AAEA,QAAM,SAAS,MAAM,yBAAyB,IAAI;AAAA,IAChD,QAAQ,KAAK;AAAA,IACb,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,KAAK,IAAI,MAAM,KAAK,MAAM,OAAO,KAAK,OAAO,OAAO;AACvE;AAsBA,eAAsB,0BACpB,IACA,SACoC;AACpC,MAAI,CAAC,QAAQ,SAAS,OAAO,QAAQ,UAAU,UAAU;AACvD,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,2BAA2B;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,QAAQ,eAAe,QAAQ,YAAY,SAAS,qBAAqB;AAC5E,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C;AAAA,QACE,OAAO;AAAA,QACP,SAAS,6BAA6B,mBAAmB;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,MAAM,OAAO,QAAQ,KAAK;AAC5C,QAAM,MAAM,oBAAI,KAAK;AAErB,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO;AAAA,IACN,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,EACnB,CAAC,EACA,KAAK,OAAO,EACZ;AAAA,IACCC;AAAA,MACED,IAAG,QAAQ,wBAAwB,SAAS;AAAA,MAC5C,UAAU,QAAQ,sBAAsB;AAAA,MACxC,GAAG,QAAQ,wBAAwB,GAAG;AAAA,IACxC;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,wCAAwC;AAAA,IACrE,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,aAAa,QAAQ,WAAW;AAO9D,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,OAAO,EACd,IAAI;AAAA,MACH,UAAU;AAAA,MACV,wBAAwB;AAAA,MACxB,wBAAwB;AAAA,MACxB,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf,WAAW;AAAA,MACX,cAAcE,OAAM,QAAQ,YAAY;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAMF,IAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;AAEhC,UAAM,GAAG,OAAO,UAAU,EAAE,MAAMA,IAAG,WAAW,QAAQ,KAAK,EAAE,CAAC;AAAA,EAClE,CAAC;AAED,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,SAAU,KAAK,WAAW;AAAA,EAC5B;AACF;;;ACrMA,SAAS,eAAAG,oBAAmB;AAC5B,SAAS,aAAAC,YAAW,WAAAC,gBAAgC;AA2CpD,IAAMC,eAAc,IAAI,YAAY;AACpC,IAAM,kBAAkB;AAExB,eAAsB,gBACpB,QACA,QACA,oBAA4B,MAC5B,WAA6B,UACZ;AACjB,QAAM,YAAYA,aAAY,OAAO,MAAM;AAC3C,SAAO,IAAIC,SAAQ,EAAE,KAAK,OAAO,IAAI,KAAK,OAAO,cAAc,KAAK,SAAS,CAAC,EAC3E,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,eAAe,EAC3B,OAAOC,aAAY,EAAE,EAAE,SAAS,WAAW,CAAC,EAC5C,YAAY,EACZ,kBAAkB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,iBAAiB,EACnE,KAAK,SAAS;AACnB;AAmBA,eAAsB,kBACpB,OACA,QACA,aAC+B;AAC/B,QAAM,YAAYF,aAAY,OAAO,MAAM;AAC3C,QAAM,EAAE,QAAQ,IAAI,MAAMG,WAAU,OAAO,WAAW,EAAE,UAAU,gBAAgB,CAAC;AAGnF,QAAM,QAAQ;AAOd,MAAI,MAAM,QAAQ,YAAY,MAAM,QAAQ,WAAW;AACrD,UAAM,IAAI,YAAY,kCAAkC;AAAA,EAC1D;AACA,QAAM,MAAwB,MAAM;AACpC,MAAI,eAAe,QAAQ,aAAa;AAGtC,UAAM,IAAI;AAAA,MACR,uCAAuC,WAAW,SAAS,GAAG;AAAA,IAChE;AAAA,EACF;AACA,SAAO,EAAE,GAAG,OAAO,KAAK,iBAAiB,IAAI;AAC/C;;;AC5GA,SAAS,OAAAC,MAAK,MAAAC,KAAI,MAAAC,KAAI,OAAAC,YAAW;AAgCjC,eAAsB,0BACpB,IACA,SACA,aACiC;AACjC,QAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,IAClB,cAAc,UAAU;AAAA,EAC1B,CAAC,EACA,KAAK,SAAS,EACd,MAAMC,IAAG,UAAU,IAAI,QAAQ,GAAG,CAAC,EACnC,MAAM,CAAC;AAEV,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,iBAAiB,QAAQ,IAAK,QAAO;AAE7C,MAAI,aAAa;AACf,UAAM,YAAY,MAAM,OAAO,WAAW;AAC1C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,CAAC,OAAO,IAAK,MAAM,GACtB,OAAO,EAAE,IAAI,iBAAiB,GAAG,CAAC,EAClC,KAAK,gBAAgB,EACrB;AAAA,MACCC;AAAA,QACED,IAAG,iBAAiB,UAAU,IAAI,EAAE;AAAA,QACpCA,IAAG,iBAAiB,WAAW,SAAS;AAAA,QACxCE,IAAG,iBAAiB,WAAW,GAAG;AAAA,MACpC;AAAA,IACF,EACC,MAAM,CAAC;AACV,QAAI,CAAC,QAAS,QAAO;AAAA,EACvB;AAEA,SAAO;AACT;AAOA,eAAsB,4BACpB,IACA,UACe;AACf,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,MACH,cAAcC,OAAM,UAAU,YAAY;AAAA,MAC1C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAMH,IAAG,UAAU,IAAI,QAAQ,CAAC;AACnC,UAAM,GAAG,OAAO,gBAAgB,EAAE,MAAMA,IAAG,iBAAiB,UAAU,QAAQ,CAAC;AAAA,EACjF,CAAC;AACH;;;AC5FA,SAAS,eAAAI,oBAAmB;AAE5B,SAAS,OAAAC,MAAK,MAAAC,KAAI,MAAAC,KAAI,aAAAC,YAAW,OAAAC,YAAW;AAgB5C,IAAMC,uBAAsB;AAQ5B,SAASC,oBAA2B;AAClC,SAAOC,aAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AAIA,eAAsB,6BACpB,IACA,UACA,OAC8B;AAC9B,QAAM,QAAQD,kBAAiB;AAC/B,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK;AAE7C,QAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,IACH,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAME,IAAG,UAAU,IAAI,QAAQ,CAAC;AAEnC,SAAO,EAAE,OAAO,UAAU;AAC5B;AASA,eAAsB,8BACpB,IACA,OAC2C;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,kCAAkC;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,MAAM,oBAAI,KAAK;AAErB,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,EACzB,CAAC,EACA,KAAK,SAAS,EACd;AAAA,IACCC;AAAA,MACED,IAAG,UAAU,sBAAsB,SAAS;AAAA,MAC5CE,WAAU,UAAU,oBAAoB;AAAA,MACxCC,IAAG,UAAU,sBAAsB,GAAG;AAAA,IACxC;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,+CAA+C;AAAA,IAC5E,CAAC;AAAA,EACH;AAEA,QAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,IACH,eAAe;AAAA;AAAA;AAAA;AAAA,IAIf,QAAQC,iBAAgB,UAAU,MAAM,mCAAmC,UAAU,MAAM;AAAA,IAC3F,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,IACtB,WAAW;AAAA,EACb,CAAC,EACA,MAAMJ,IAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AAEpC,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,aAAa,OAAO;AAAA,EACtB;AACF;AAWA,eAAsB,2BACpB,IACA,OACA,OACqC;AACrC,QAAM,kBAAkB,MAAM,KAAK,EAAE,YAAY;AACjD,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO;AAAA,IACN,IAAI,UAAU;AAAA,IACd,OAAO,UAAU;AAAA,IACjB,aAAa,UAAU;AAAA,IACvB,QAAQ,UAAU;AAAA,EACpB,CAAC,EACA,KAAK,SAAS,EACd,MAAMA,IAAG,UAAU,OAAO,eAAe,CAAC,EAC1C,MAAM,CAAC;AAEV,MAAI,CAAC,UAAU,OAAO,WAAW,WAAW;AAC1C,WAAO,EAAE,UAAU,MAAM,aAAa,MAAM,OAAO,MAAM,QAAQ,KAAK;AAAA,EACxE;AAEA,QAAM,QAAQF,kBAAiB;AAC/B,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK;AAE7C,QAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,IACH,wBAAwB;AAAA,IACxB,wBAAwB;AAAA,IACxB,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAME,IAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AAEpC,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,aAAa,OAAO;AAAA,IACpB,OAAO,OAAO;AAAA,IACd,QAAQ,EAAE,OAAO,UAAU;AAAA,EAC7B;AACF;AAOA,eAAsB,2BACpB,IACA,OACA,aACqC;AACrC,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,2BAA2B;AAAA,IACxD,CAAC;AAAA,EACH;AACA,MAAI,CAAC,eAAe,YAAY,SAASH,sBAAqB;AAC5D,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C;AAAA,QACE,OAAO;AAAA,QACP,SAAS,6BAA6BA,oBAAmB;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,MAAM,OAAO,KAAK;AACpC,QAAM,MAAM,oBAAI,KAAK;AAErB,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO,EAAE,IAAI,UAAU,IAAI,OAAO,UAAU,MAAM,CAAC,EACnD,KAAK,SAAS,EACd;AAAA,IACCI;AAAA,MACED,IAAG,UAAU,wBAAwB,SAAS;AAAA,MAC9CE,WAAU,UAAU,sBAAsB;AAAA,MAC1CC,IAAG,UAAU,wBAAwB,GAAG;AAAA,IAC1C;AAAA,EACF,EACC,MAAM,CAAC;AAEV,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,SAAS,SAAS,wCAAwC;AAAA,IACrE,CAAC;AAAA,EACH;AAEA,QAAM,kBAAkB,MAAM,aAAa,WAAW;AAEtD,QAAM,GAAG,YAAY,OAAO,OAAO;AACjC,UAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,MACH,UAAU;AAAA,MACV,wBAAwB;AAAA,MACxB,wBAAwB;AAAA,MACxB,eAAe;AAAA,MACf,WAAW;AAAA;AAAA;AAAA;AAAA,MAIX,cAAcC,OAAM,UAAU,YAAY;AAAA,MAC1C,eAAe;AAAA,MACf,QAAQA,iBAAgB,UAAU,MAAM,mCAAmC,UAAU,MAAM;AAAA,MAC3F,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAMJ,IAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AAEpC,UAAM,GAAG,OAAO,gBAAgB,EAAE,MAAMA,IAAG,iBAAiB,UAAU,OAAO,EAAE,CAAC;AAAA,EAClF,CAAC;AAED,SAAO,EAAE,UAAU,OAAO,IAAI,OAAO,OAAO,MAAM;AACpD;","names":["eq","eq","and","eq","sql","SYNTHETIC_EMAIL_SUFFIX","syntheticEmail","mergeMetadata","eq","and","sql","randomBytes","randomBytes","eq","sql","eq","sql","and","eq","eq","and","randomBytes","and","eq","sql","randomBytes","eq","and","sql","randomBytes","jwtVerify","SignJWT","textEncoder","SignJWT","randomBytes","jwtVerify","and","eq","gt","sql","eq","and","gt","sql","randomBytes","and","eq","gt","isNotNull","sql","MIN_PASSWORD_LENGTH","generateRawToken","randomBytes","eq","and","isNotNull","gt","sql"]}

package/dist/{chunk-L6VG7IK6.js → chunk-VBVLYFSZ.js}

@@ -1,6 +1,6 @@
 import {
   getLogger
-} from "./chunk-NFHS7CFV.js";
+} from "./chunk-Q7MK5ZKG.js";
 import {
   getDb
 } from "./chunk-XANPEOJC.js";
@@ -72,4 +72,4 @@ export {
   resetReputationAdapter,
   applyReputation
 };
-//# sourceMappingURL=chunk-L6VG7IK6.js.map
+//# sourceMappingURL=chunk-VBVLYFSZ.js.map

package/dist/chunk-VBVLYFSZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/community/reputation.ts","../src/community/reputation-adapter.ts"],"sourcesContent":["import { eq, sql } from \"drizzle-orm\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npMembers } from \"../db/schema/community.js\";\nimport { getLogger } from \"../observability/logger.js\";\n\nimport {\n  getReputationAdapter,\n  type NpReputationEvent,\n} from \"./reputation-adapter.js\";\n\n/**\n * Calls the registered reputation adapter for `event`, then applies\n * the returned delta to the affected member's reputation atomically:\n *\n *     UPDATE np_members SET reputation = reputation + $delta\n *     WHERE id = $memberId\n *\n * Failure modes are intentionally fail-soft — a buggy adapter that\n * throws, returns a non-finite value, or hits a transient DB error\n * MUST NOT block the underlying community write (comment insert,\n * reaction toggle, etc.). The caller's transactional state is not\n * touched; we just log + skip.\n */\nexport async function applyReputation(\n  memberId: string,\n  event: NpReputationEvent,\n): Promise<void> {\n  let delta: number;\n  try {\n    delta = await getReputationAdapter().apply(event);\n  } catch (err) {\n    getLogger().warn(\"reputation adapter threw — skipping update\", {\n      error: err instanceof Error ? err.message : String(err),\n      kind: event.kind,\n      memberId,\n    });\n    return;\n  }\n\n  if (!Number.isFinite(delta)) {\n    getLogger().warn(\"reputation adapter returned non-finite delta\", {\n      kind: event.kind,\n      memberId,\n      delta,\n    });\n    return;\n  }\n  const truncated = Math.trunc(delta);\n  if (truncated === 0) return;\n\n  const db = getDb();\n  try {\n    await db\n      .update(npMembers)\n      .set({\n        reputation: sql`${npMembers.reputation} + ${truncated}`,\n        updatedAt: new Date(),\n      })\n      .where(eq(npMembers.id, memberId));\n  } catch (err) {\n    getLogger().warn(\"reputation update failed — skipping\", {\n      error: err instanceof Error ? err.message : String(err),\n      kind: event.kind,\n      memberId,\n      delta: truncated,\n    });\n  }\n}\n","/**\n * Pluggable reputation-rules hook. Sites install an adapter via\n * `setReputationAdapter()` to compute reputation deltas in response\n * to community events; the framework then atomically applies the\n * delta to `np_members.reputation`.\n *\n * Default adapter is \"no-op\" (every event returns 0) — existing\n * sites' reputation values stay at zero until they opt in.\n *\n * Adapter is single-method by design: a tagged-union `event` is the\n * only argument, the return value is a signed integer delta. This\n * keeps the API surface small while letting sites encode arbitrary\n * weighting (e.g. \"+5 for a like on a comment, −10 for a moderator\n * hide, −0 if the reactor is a brand-new account, etc.\").\n *\n * Adapters can be sync or async — the framework awaits the result.\n * Throwing aborts only the reputation update, not the underlying\n * community write (fail-soft via observability hook, same pattern\n * as the spam adapter).\n */\nexport type NpReputationEvent =\n  /** A new visible comment was inserted. Flagged / hidden / deleted\n   *  comments do NOT emit this event. */\n  | {\n      kind: \"comment.created\";\n      commentId: string;\n      memberId: string;\n      targetType: string;\n      targetId: string;\n    }\n  /** Mod (or member with the right grant) hid a comment. Adapters\n   *  typically penalize the author. */\n  | {\n      kind: \"comment.hidden\";\n      commentId: string;\n      memberId: string;\n      byStaff: boolean;\n      reason?: string | null;\n    }\n  /** Mod-side hard delete (`staffDeleteComment`). The body is wiped;\n   *  this is harsher than `hidden` and adapters usually penalize\n   *  more. */\n  | {\n      kind: \"comment.deleted\";\n      commentId: string;\n      memberId: string;\n      byStaff: boolean;\n    }\n  /** Someone reacted to the recipient's content (comment / thread /\n   *  reply). `recipientId` is the content author; `reactorId` is the\n   *  member who clicked the reaction. Self-reactions are filtered\n   *  before the event fires. */\n  | {\n      kind: \"reaction.received\";\n      reactionKind: string;\n      recipientId: string;\n      reactorId: string;\n      targetType: string;\n      targetId: string;\n    }\n  /** Reactor undid their reaction. Symmetric to `reaction.received`;\n   *  adapters typically return the negative of the corresponding\n   *  positive delta. */\n  | {\n      kind: \"reaction.removed\";\n      reactionKind: string;\n      recipientId: string;\n      reactorId: string;\n      targetType: string;\n      targetId: string;\n    }\n  /** A member created a top-level document in a collection that\n   *  opted into `community.memberWrite.create` (Phase 9.7a). Fires\n   *  after the row + revision are persisted; adapters can credit\n   *  reputation for thread / post creation just like comments. */\n  | {\n      kind: \"document.created\";\n      collectionSlug: string;\n      documentId: string;\n      memberId: string;\n    }\n  /** Author deleted their own document (`memberWrite.delete`,\n   *  Phase 9.7b). Symmetric to `document.created`; adapters\n   *  typically debit the original credit so a member can't farm\n   *  reputation by churn-creating and deleting threads. Mod-side\n   *  deletes are NOT covered here — those go through the staff\n   *  path which doesn't emit this event. */\n  | {\n      kind: \"document.deleted\";\n      collectionSlug: string;\n      documentId: string;\n      memberId: string;\n    };\n\nexport interface NpReputationAdapter {\n  /** Returns the integer delta to apply to the affected member's\n   *  reputation. Sign matters: positive credits, negative debits.\n   *  Non-integer values are truncated; non-finite (NaN/Infinity)\n   *  values are skipped. Returning 0 is the no-op path. */\n  apply(event: NpReputationEvent): number | Promise<number>;\n}\n\nconst NOOP_ADAPTER: NpReputationAdapter = { apply: () => 0 };\nlet currentAdapter: NpReputationAdapter = NOOP_ADAPTER;\n\nexport function setReputationAdapter(adapter: NpReputationAdapter): void {\n  if (typeof adapter?.apply !== \"function\") {\n    throw new Error(\"setReputationAdapter: adapter must implement apply()\");\n  }\n  currentAdapter = adapter;\n}\n\nexport function getReputationAdapter(): NpReputationAdapter {\n  return currentAdapter;\n}\n\n/** Reset to the no-op adapter. Tests use this between cases. */\nexport function resetReputationAdapter(): void {\n  currentAdapter = NOOP_ADAPTER;\n}\n"],"mappings":";;;;;;;;;;;AAAA,SAAS,IAAI,WAAW;;;ACsGxB,IAAM,eAAoC,EAAE,OAAO,MAAM,EAAE;AAC3D,IAAI,iBAAsC;AAEnC,SAAS,qBAAqB,SAAoC;AACvE,MAAI,OAAO,SAAS,UAAU,YAAY;AACxC,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,mBAAiB;AACnB;AAEO,SAAS,uBAA4C;AAC1D,SAAO;AACT;AAGO,SAAS,yBAA+B;AAC7C,mBAAiB;AACnB;;;AD/FA,eAAsB,gBACpB,UACA,OACe;AACf,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,qBAAqB,EAAE,MAAM,KAAK;AAAA,EAClD,SAAS,KAAK;AACZ,cAAU,EAAE,KAAK,mDAA8C;AAAA,MAC7D,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACtD,MAAM,MAAM;AAAA,MACZ;AAAA,IACF,CAAC;AACD;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAU,EAAE,KAAK,gDAAgD;AAAA,MAC/D,MAAM,MAAM;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AACD;AAAA,EACF;AACA,QAAM,YAAY,KAAK,MAAM,KAAK;AAClC,MAAI,cAAc,EAAG;AAErB,QAAM,KAAK,MAAM;AACjB,MAAI;AACF,UAAM,GACH,OAAO,SAAS,EAChB,IAAI;AAAA,MACH,YAAY,MAAM,UAAU,UAAU,MAAM,SAAS;AAAA,MACrD,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAM,GAAG,UAAU,IAAI,QAAQ,CAAC;AAAA,EACrC,SAAS,KAAK;AACZ,cAAU,EAAE,KAAK,4CAAuC;AAAA,MACtD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACtD,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/{chunk-PUV3VZPD.js → chunk-VX3HM5TF.js}

@@ -1,6 +1,6 @@
 import {
   findDocuments
-} from "./chunk-MLXKZK6G.js";
+} from "./chunk-CD74WQK7.js";
 import {
   getI18nConfig
 } from "./chunk-4ZLMEKFX.js";
@@ -597,4 +597,4 @@ export {
   buildDiscussionForumPostingJsonLd,
   buildPersonJsonLd
 };
-//# sourceMappingURL=chunk-PUV3VZPD.js.map
+//# sourceMappingURL=chunk-VX3HM5TF.js.map

package/dist/{chunk-RDTTK27V.js → chunk-XPD7EQML.js}

@@ -24,7 +24,7 @@ import { inArray as inArray2 } from "drizzle-orm";
 import { and, count, desc, eq, isNull, inArray } from "drizzle-orm";
 async function createNotification(input) {
   if (input.actorMemberId && input.actorMemberId !== input.memberId) {
-    const { isMuted } = await import("./mutes-MNQP6ACF.js");
+    const { isMuted } = await import("./mutes-PQA6U5X7.js");
     const muted = await isMuted({
       memberId: input.memberId,
       targetId: input.actorMemberId
@@ -32,7 +32,7 @@ async function createNotification(input) {
     if (muted) return null;
   }
   {
-    const { isNotificationKindEnabled } = await import("./notification-prefs-H4HFVCL7.js");
+    const { isNotificationKindEnabled } = await import("./notification-prefs-62NX2GBF.js");
     const enabled = await isNotificationKindEnabled(input.memberId, input.kind);
     if (!enabled) return null;
   }
@@ -219,4 +219,4 @@ export {
   resolveMentionedMembers,
   fanOutMentionNotifications
 };
-//# sourceMappingURL=chunk-RDTTK27V.js.map
+//# sourceMappingURL=chunk-XPD7EQML.js.map

package/dist/chunk-XPD7EQML.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/community/mentions.ts","../src/community/notifications.ts"],"sourcesContent":["import { inArray } from \"drizzle-orm\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npMembers } from \"../db/schema/community.js\";\n\nimport { createNotification } from \"./notifications.js\";\n\n/**\n * Phase 16.2 — @mention extraction + notification fan-out.\n *\n * The mention vocabulary mirrors the handle constraint enforced\n * during registration (`/^[a-z0-9][a-z0-9_-]{2,29}$/`). The matcher\n * uses a negative lookbehind so `email@host.com` doesn't trigger a\n * mention, plus a negative lookahead so `@alice-` (handle followed\n * by a hyphen that's not part of the handle) is rejected — handles\n * end at non-handle characters, never mid-symbol.\n *\n * Fan-out semantics:\n *  - Self-mentions are skipped (the author already knows).\n *  - Caller-supplied `exclude` set lets the comment write path\n *    skip the parent author so they don't get both `comment.reply`\n *    AND `comment.mention`.\n *  - Caller-supplied `previousHandles` lets the edit path only\n *    notify newly-added mentions (otherwise toggling a single\n *    other word in a comment would re-notify everyone).\n *  - Inactive / banned / deleted members are filtered out at\n *    resolve time.\n *  - Mute is enforced inside `createNotification` (the\n *    recipient's mute list drops actor-keyed notifications).\n */\n\n/** Source-of-truth handle pattern, kept in sync with `apps/web` register routes. */\nexport const MENTION_HANDLE_RE = /^[a-z0-9][a-z0-9_-]{2,29}$/;\n\nconst MENTION_PATTERN = /(?<![A-Za-z0-9_])@([a-z0-9][a-z0-9_-]{2,29})(?![A-Za-z0-9_-])/g;\n\nexport interface NpMentionTarget {\n  id: string;\n  handle: string;\n}\n\n/**\n * Extract unique mention handles from plain text or markdown source.\n * Order is preserved (first appearance wins) so a UI that wants to\n * display \"you mentioned @alice and @bob\" gets the same order as\n * the body text.\n */\nexport function extractMentionHandles(source: string): string[] {\n  if (!source) return [];\n  const seen = new Set<string>();\n  const out: string[] = [];\n  for (const match of source.matchAll(MENTION_PATTERN)) {\n    const handle = match[1]?.toLowerCase();\n    if (!handle || seen.has(handle)) continue;\n    seen.add(handle);\n    out.push(handle);\n  }\n  return out;\n}\n\n/**\n * Walk a Lexical-shaped rich-text payload, concatenate its text\n * nodes, and run the mention extractor over the joined result.\n * Mirrors the search-index walker (`collections/search.ts`) so a\n * mention split across two adjacent text spans (e.g. `@` and\n * `alice` in different runs because of formatting toggles) still\n * resolves correctly — text nodes are joined without separators.\n */\nexport function extractMentionHandlesFromRichText(content: unknown): string[] {\n  if (!content || typeof content !== \"object\") return [];\n  const root = (content as { root?: { children?: unknown } }).root;\n  if (!root || !Array.isArray(root.children)) return [];\n  const parts: string[] = [];\n  walkRichTextNodes(root.children, parts);\n  return extractMentionHandles(parts.join(\"\"));\n}\n\nfunction walkRichTextNodes(nodes: unknown[], parts: string[]): void {\n  for (const node of nodes) {\n    if (!node || typeof node !== \"object\") continue;\n    const n = node as Record<string, unknown>;\n    if (typeof n.text === \"string\") parts.push(n.text);\n    if (Array.isArray(n.children)) walkRichTextNodes(n.children, parts);\n  }\n}\n\n/**\n * Scan a collection-document data payload (the same shape passed\n * to `createMemberDocument` / `updateMemberDocument`) and pull\n * out every mention handle it contains. String values are scanned\n * with the markdown extractor; object values shaped like Lexical\n * rich text (`{ root: { children: [...] } }`) are walked. Other\n * values are ignored.\n *\n * Field names are not assumed: any string or rich-text field\n * contributes. The mention pattern is anchored to `@<handle>`\n * with handle-shape constraints, so unrelated string fields\n * (`category: \"news\"`) won't trigger false positives.\n */\nexport function extractMentionHandlesFromDocData(data: Record<string, unknown>): string[] {\n  if (!data || typeof data !== \"object\") return [];\n  const seen = new Set<string>();\n  for (const value of Object.values(data)) {\n    if (typeof value === \"string\") {\n      for (const h of extractMentionHandles(value)) seen.add(h);\n      continue;\n    }\n    if (value && typeof value === \"object\") {\n      const root = (value as { root?: { children?: unknown } }).root;\n      if (root && Array.isArray(root.children)) {\n        for (const h of extractMentionHandlesFromRichText(value)) seen.add(h);\n      }\n    }\n  }\n  return Array.from(seen);\n}\n\n/**\n * Resolve handles to active member ids. Inactive / banned /\n * deleted members are filtered out so a mention of an account\n * the site no longer wants to notify is silently dropped (rather\n * than raising an error to the writer — the writer can't tell the\n * difference between \"typo\" and \"account closed\", and either way\n * the right behaviour is \"no notification\").\n *\n * Lookups are case-insensitive on the handle (the storage column\n * stores the canonical lowercased form).\n */\nexport async function resolveMentionedMembers(handles: string[]): Promise<NpMentionTarget[]> {\n  if (handles.length === 0) return [];\n  const lower = Array.from(new Set(handles.map((h) => h.toLowerCase())));\n  const db = getDb();\n  const rows = (await db\n    .select({ id: npMembers.id, handle: npMembers.handle, status: npMembers.status })\n    .from(npMembers)\n    .where(inArray(npMembers.handle, lower))) as Array<{\n    id: string;\n    handle: string;\n    status: string;\n  }>;\n  return rows.filter((r) => r.status === \"active\").map((r) => ({ id: r.id, handle: r.handle }));\n}\n\nexport interface FanOutMentionsInput {\n  /** The author whose write triggered the fan-out. Self-mentions are skipped. */\n  actorMemberId: string;\n  /** Notification `kind` (e.g. `\"comment.mention\"`, `\"discussion.mention\"`). */\n  kind: string;\n  /**\n   * Plain text or markdown to scan. Either `source` or `content`\n   * (or both) must be provided; if both are set the handles are\n   * unioned.\n   */\n  source?: string;\n  /** Lexical-shaped rich-text JSON to scan. */\n  content?: unknown;\n  /**\n   * Collection-document data payload to scan. All string +\n   * rich-text fields contribute. Useful for the\n   * `createMemberDocument` / `updateMemberDocument` paths.\n   */\n  data?: Record<string, unknown>;\n  /**\n   * Recipients that already received a notification for this same\n   * event (e.g. the parent author got `comment.reply`). They are\n   * skipped to avoid the \"two pings for one comment\" pattern.\n   */\n  exclude?: ReadonlySet<string>;\n  /** Merged into the notification payload. `mentionedMemberId` is added automatically. */\n  payload?: Record<string, unknown>;\n  /**\n   * Edit path: handles that were present in the prior revision\n   * are skipped so toggling unrelated words doesn't re-notify\n   * everyone already mentioned.\n   */\n  previousHandles?: ReadonlySet<string>;\n}\n\n/**\n * Fan-out mention notifications. Returns the number of\n * notifications actually inserted (mute / inactive / self / dedup\n * exclusions all reduce the count).\n */\nexport async function fanOutMentionNotifications(input: FanOutMentionsInput): Promise<number> {\n  const handles = new Set<string>();\n  if (input.source) {\n    for (const h of extractMentionHandles(input.source)) handles.add(h);\n  }\n  if (input.content !== undefined) {\n    for (const h of extractMentionHandlesFromRichText(input.content)) handles.add(h);\n  }\n  if (input.data) {\n    for (const h of extractMentionHandlesFromDocData(input.data)) handles.add(h);\n  }\n  if (input.previousHandles) {\n    for (const prev of input.previousHandles) handles.delete(prev);\n  }\n  if (handles.size === 0) return 0;\n\n  const targets = await resolveMentionedMembers(Array.from(handles));\n  let fired = 0;\n  for (const t of targets) {\n    if (t.id === input.actorMemberId) continue;\n    if (input.exclude?.has(t.id)) continue;\n    const row = await createNotification({\n      memberId: t.id,\n      kind: input.kind,\n      actorMemberId: input.actorMemberId,\n      payload: {\n        ...(input.payload ?? {}),\n        mentionedMemberId: t.id,\n        mentionedHandle: t.handle,\n      },\n    });\n    if (row) fired += 1;\n  }\n  return fired;\n}\n","import { and, count, desc, eq, isNull, inArray } from \"drizzle-orm\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npNotifications } from \"../db/schema/community.js\";\nimport { NpForbiddenError, NpValidationError } from \"../errors.js\";\nimport { getCurrentSiteId, requireSiteId } from \"../sites/context.js\";\nimport { NP_DEFAULT_SITE_ID } from \"../sites/registry.js\";\n\n/**\n * Per-member notification inbox. v1 is synchronous: every event that\n * generates a notification writes a row immediately. The inbox is\n * in-app only — email fan-out and per-member frequency preferences\n * are out of scope for the shipped roadmap.\n *\n * `kind` is a free-form string. The current vocabulary:\n *  - `comment.reply`        — your comment got a reply\n *  - `reaction.received`    — someone reacted to your content\n *  - `follow.received`      — someone followed you\n * Plugins can write their own kinds; the recipient UI fans them out\n * to whichever rendering it knows.\n */\n\nexport interface NpNotificationRow {\n  id: string;\n  memberId: string;\n  kind: string;\n  payload: Record<string, unknown>;\n  readAt: Date | null;\n  createdAt: Date;\n}\n\nexport interface CreateNotificationInput {\n  /** The recipient — whose inbox this lands in. */\n  memberId: string;\n  kind: string;\n  payload?: Record<string, unknown>;\n  /**\n   * Phase 16.1 — the member whose action triggered the\n   * notification (e.g. the comment author, the reactor, the\n   * follower). When set, the recipient's mute list is\n   * consulted: if the recipient has muted the actor, the\n   * notification is silently dropped. Returns `null` from\n   * the call site.\n   *\n   * Optional because some kinds are actor-less (system\n   * notices, scheduled reminders).\n   */\n  actorMemberId?: string | null;\n}\n\nexport async function createNotification(\n  input: CreateNotificationInput,\n): Promise<NpNotificationRow | null> {\n  // Mute check — defer the import to avoid a notifications →\n  // mutes circular at module load. Mutes module imports\n  // nothing back from here, but TypeScript sometimes flags\n  // the cycle anyway depending on resolver order.\n  if (input.actorMemberId && input.actorMemberId !== input.memberId) {\n    const { isMuted } = await import(\"./mutes.js\");\n    const muted = await isMuted({\n      memberId: input.memberId,\n      targetId: input.actorMemberId,\n    });\n    if (muted) return null;\n  }\n\n  // Phase 16.3 — recipient-controlled kind toggle. Fails open\n  // on read error (transient DB blip shouldn't silently swallow\n  // notifications). Deferred import for the same reason as\n  // mutes.\n  {\n    const { isNotificationKindEnabled } = await import(\"./notification-prefs.js\");\n    const enabled = await isNotificationKindEnabled(input.memberId, input.kind);\n    if (!enabled) return null;\n  }\n\n  const db = getDb();\n  // Phase 18 — site comes from the request resolver. The\n  // notification belongs to the tenant where the actor's\n  // action happened (a reaction on tenant A → notification\n  // shows up in the recipient's tenant-A inbox).\n  // #272 — write: must NOT silently fall through; an actor on\n  // tenant A would otherwise create a notification on the\n  // default tenant.\n  const siteId = await requireSiteId();\n  const [row] = (await db\n    .insert(npNotifications)\n    .values({\n      memberId: input.memberId,\n      kind: input.kind,\n      payload: input.payload ?? {},\n      siteId,\n    })\n    .returning()) as NpNotificationRow[];\n  if (!row) throw new Error(\"Notification insert returned no row\");\n  return row;\n}\n\nexport interface ListNotificationsOptions {\n  /** Default 50, max 200. */\n  limit?: number;\n  /** Default 0. */\n  offset?: number;\n  /** When true, returns only unread. */\n  unreadOnly?: boolean;\n}\n\nexport interface NpNotificationListResult {\n  notifications: NpNotificationRow[];\n  totalDocs: number;\n  unread: number;\n}\n\nexport async function listNotifications(\n  memberId: string,\n  options: ListNotificationsOptions = {},\n): Promise<NpNotificationListResult> {\n  const db = getDb();\n  const limit = Math.min(Math.max(options.limit ?? 50, 1), 200);\n  const offset = Math.max(options.offset ?? 0, 0);\n\n  // Phase 18 — inbox is per-site. A member who's active on\n  // multiple tenants sees a separate notification list on each.\n  const siteId = (await getCurrentSiteId()) ?? NP_DEFAULT_SITE_ID;\n  const baseWhere = and(eq(npNotifications.memberId, memberId), eq(npNotifications.siteId, siteId));\n  const where = options.unreadOnly ? and(baseWhere, isNull(npNotifications.readAt)) : baseWhere;\n\n  const rows = (await db\n    .select()\n    .from(npNotifications)\n    .where(where)\n    .orderBy(desc(npNotifications.createdAt))\n    .limit(limit)\n    .offset(offset)) as NpNotificationRow[];\n\n  const [totalRow] = (await db\n    .select({ total: count() })\n    .from(npNotifications)\n    .where(where)) as Array<{ total: number | string }>;\n\n  const [unreadRow] = (await db\n    .select({ total: count() })\n    .from(npNotifications)\n    .where(and(baseWhere, isNull(npNotifications.readAt)))) as Array<{\n    total: number | string;\n  }>;\n\n  return {\n    notifications: rows,\n    totalDocs: Number(totalRow?.total ?? 0),\n    unread: Number(unreadRow?.total ?? 0),\n  };\n}\n\nexport async function unreadNotificationCount(memberId: string): Promise<number> {\n  const db = getDb();\n  // Phase 18 — count only notifications on the current site.\n  const siteId = (await getCurrentSiteId()) ?? NP_DEFAULT_SITE_ID;\n  const [row] = (await db\n    .select({ total: count() })\n    .from(npNotifications)\n    .where(\n      and(\n        eq(npNotifications.memberId, memberId),\n        eq(npNotifications.siteId, siteId),\n        isNull(npNotifications.readAt),\n      ),\n    )) as Array<{ total: number | string }>;\n  return Number(row?.total ?? 0);\n}\n\nexport interface MarkReadInput {\n  memberId: string;\n  notificationIds: string[];\n}\n\nexport async function markNotificationsRead(input: MarkReadInput): Promise<number> {\n  if (input.notificationIds.length === 0) return 0;\n  if (input.notificationIds.length > 200) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"notificationIds\", message: \"Up to 200 ids per request\" },\n    ]);\n  }\n  const db = getDb();\n  // Issue #219 — scope the update to the current site so a member\n  // active on multiple tenants can't mark IDs read across tenants\n  // by passing a site-A request that names site-B notification ids.\n  // The caller's existing `memberId` predicate covered ownership\n  // but not tenant; without this, unread counts on the other site\n  // would silently drop. Using `returning({ id })` also gives us\n  // an exact count instead of a follow-up SELECT — replaces the\n  // pre-existing best-effort COUNT round trip.\n  // #272 — write: must NOT silently fall through.\n  const siteId = await requireSiteId();\n  const updated = (await db\n    .update(npNotifications)\n    .set({ readAt: new Date() })\n    .where(\n      and(\n        eq(npNotifications.memberId, input.memberId),\n        eq(npNotifications.siteId, siteId),\n        inArray(npNotifications.id, input.notificationIds),\n        isNull(npNotifications.readAt),\n      ),\n    )\n    .returning({ id: npNotifications.id })) as Array<{ id: string }>;\n  return updated.length;\n}\n\nexport async function markAllNotificationsRead(memberId: string): Promise<number> {\n  const db = getDb();\n  // Phase 18 — \"mark all read\" only marks the current site's\n  // inbox so a member doesn't accidentally clear another\n  // tenant's unread count when toggling on this one.\n  // #272 — write: must NOT silently fall through.\n  const siteId = await requireSiteId();\n  const before = await unreadNotificationCount(memberId);\n  await db\n    .update(npNotifications)\n    .set({ readAt: new Date() })\n    .where(\n      and(\n        eq(npNotifications.memberId, memberId),\n        eq(npNotifications.siteId, siteId),\n        isNull(npNotifications.readAt),\n      ),\n    );\n  return before;\n}\n\n/**\n * Internal sanity check used by the API: throws when one principal\n * tries to read another member's notification. Centralised here\n * because every per-id route gets the same rule.\n */\nexport async function assertOwnsNotification(\n  memberId: string,\n  notificationId: string,\n): Promise<void> {\n  const db = getDb();\n  const [row] = (await db\n    .select({ memberId: npNotifications.memberId })\n    .from(npNotifications)\n    .where(eq(npNotifications.id, notificationId))\n    .limit(1)) as Array<{ memberId: string }>;\n  if (!row || row.memberId !== memberId) {\n    throw new NpForbiddenError(\"notification\", \"read\");\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,WAAAA,gBAAe;;;ACAxB,SAAS,KAAK,OAAO,MAAM,IAAI,QAAQ,eAAe;AAkDtD,eAAsB,mBACpB,OACmC;AAKnC,MAAI,MAAM,iBAAiB,MAAM,kBAAkB,MAAM,UAAU;AACjE,UAAM,EAAE,QAAQ,IAAI,MAAM,OAAO,qBAAY;AAC7C,UAAM,QAAQ,MAAM,QAAQ;AAAA,MAC1B,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,IAClB,CAAC;AACD,QAAI,MAAO,QAAO;AAAA,EACpB;AAMA;AACE,UAAM,EAAE,0BAA0B,IAAI,MAAM,OAAO,kCAAyB;AAC5E,UAAM,UAAU,MAAM,0BAA0B,MAAM,UAAU,MAAM,IAAI;AAC1E,QAAI,CAAC,QAAS,QAAO;AAAA,EACvB;AAEA,QAAM,KAAK,MAAM;AAQjB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,eAAe,EACtB,OAAO;AAAA,IACN,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM,WAAW,CAAC;AAAA,IAC3B;AAAA,EACF,CAAC,EACA,UAAU;AACb,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,qCAAqC;AAC/D,SAAO;AACT;AAiBA,eAAsB,kBACpB,UACA,UAAoC,CAAC,GACF;AACnC,QAAM,KAAK,MAAM;AACjB,QAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,QAAQ,SAAS,IAAI,CAAC,GAAG,GAAG;AAC5D,QAAM,SAAS,KAAK,IAAI,QAAQ,UAAU,GAAG,CAAC;AAI9C,QAAM,SAAU,MAAM,iBAAiB,KAAM;AAC7C,QAAM,YAAY,IAAI,GAAG,gBAAgB,UAAU,QAAQ,GAAG,GAAG,gBAAgB,QAAQ,MAAM,CAAC;AAChG,QAAM,QAAQ,QAAQ,aAAa,IAAI,WAAW,OAAO,gBAAgB,MAAM,CAAC,IAAI;AAEpF,QAAM,OAAQ,MAAM,GACjB,OAAO,EACP,KAAK,eAAe,EACpB,MAAM,KAAK,EACX,QAAQ,KAAK,gBAAgB,SAAS,CAAC,EACvC,MAAM,KAAK,EACX,OAAO,MAAM;AAEhB,QAAM,CAAC,QAAQ,IAAK,MAAM,GACvB,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,EACzB,KAAK,eAAe,EACpB,MAAM,KAAK;AAEd,QAAM,CAAC,SAAS,IAAK,MAAM,GACxB,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,EACzB,KAAK,eAAe,EACpB,MAAM,IAAI,WAAW,OAAO,gBAAgB,MAAM,CAAC,CAAC;AAIvD,SAAO;AAAA,IACL,eAAe;AAAA,IACf,WAAW,OAAO,UAAU,SAAS,CAAC;AAAA,IACtC,QAAQ,OAAO,WAAW,SAAS,CAAC;AAAA,EACtC;AACF;AAEA,eAAsB,wBAAwB,UAAmC;AAC/E,QAAM,KAAK,MAAM;AAEjB,QAAM,SAAU,MAAM,iBAAiB,KAAM;AAC7C,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,EACzB,KAAK,eAAe,EACpB;AAAA,IACC;AAAA,MACE,GAAG,gBAAgB,UAAU,QAAQ;AAAA,MACrC,GAAG,gBAAgB,QAAQ,MAAM;AAAA,MACjC,OAAO,gBAAgB,MAAM;AAAA,IAC/B;AAAA,EACF;AACF,SAAO,OAAO,KAAK,SAAS,CAAC;AAC/B;AAOA,eAAsB,sBAAsB,OAAuC;AACjF,MAAI,MAAM,gBAAgB,WAAW,EAAG,QAAO;AAC/C,MAAI,MAAM,gBAAgB,SAAS,KAAK;AACtC,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,mBAAmB,SAAS,4BAA4B;AAAA,IACnE,CAAC;AAAA,EACH;AACA,QAAM,KAAK,MAAM;AAUjB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAW,MAAM,GACpB,OAAO,eAAe,EACtB,IAAI,EAAE,QAAQ,oBAAI,KAAK,EAAE,CAAC,EAC1B;AAAA,IACC;AAAA,MACE,GAAG,gBAAgB,UAAU,MAAM,QAAQ;AAAA,MAC3C,GAAG,gBAAgB,QAAQ,MAAM;AAAA,MACjC,QAAQ,gBAAgB,IAAI,MAAM,eAAe;AAAA,MACjD,OAAO,gBAAgB,MAAM;AAAA,IAC/B;AAAA,EACF,EACC,UAAU,EAAE,IAAI,gBAAgB,GAAG,CAAC;AACvC,SAAO,QAAQ;AACjB;AAEA,eAAsB,yBAAyB,UAAmC;AAChF,QAAM,KAAK,MAAM;AAKjB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAS,MAAM,wBAAwB,QAAQ;AACrD,QAAM,GACH,OAAO,eAAe,EACtB,IAAI,EAAE,QAAQ,oBAAI,KAAK,EAAE,CAAC,EAC1B;AAAA,IACC;AAAA,MACE,GAAG,gBAAgB,UAAU,QAAQ;AAAA,MACrC,GAAG,gBAAgB,QAAQ,MAAM;AAAA,MACjC,OAAO,gBAAgB,MAAM;AAAA,IAC/B;AAAA,EACF;AACF,SAAO;AACT;AAOA,eAAsB,uBACpB,UACA,gBACe;AACf,QAAM,KAAK,MAAM;AACjB,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,UAAU,gBAAgB,SAAS,CAAC,EAC7C,KAAK,eAAe,EACpB,MAAM,GAAG,gBAAgB,IAAI,cAAc,CAAC,EAC5C,MAAM,CAAC;AACV,MAAI,CAAC,OAAO,IAAI,aAAa,UAAU;AACrC,UAAM,IAAI,iBAAiB,gBAAgB,MAAM;AAAA,EACnD;AACF;;;ADxNO,IAAM,oBAAoB;AAEjC,IAAM,kBAAkB;AAajB,SAAS,sBAAsB,QAA0B;AAC9D,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,OAAO,SAAS,eAAe,GAAG;AACpD,UAAM,SAAS,MAAM,CAAC,GAAG,YAAY;AACrC,QAAI,CAAC,UAAU,KAAK,IAAI,MAAM,EAAG;AACjC,SAAK,IAAI,MAAM;AACf,QAAI,KAAK,MAAM;AAAA,EACjB;AACA,SAAO;AACT;AAUO,SAAS,kCAAkC,SAA4B;AAC5E,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO,CAAC;AACrD,QAAM,OAAQ,QAA8C;AAC5D,MAAI,CAAC,QAAQ,CAAC,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO,CAAC;AACpD,QAAM,QAAkB,CAAC;AACzB,oBAAkB,KAAK,UAAU,KAAK;AACtC,SAAO,sBAAsB,MAAM,KAAK,EAAE,CAAC;AAC7C;AAEA,SAAS,kBAAkB,OAAkB,OAAuB;AAClE,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,IAAI;AACV,QAAI,OAAO,EAAE,SAAS,SAAU,OAAM,KAAK,EAAE,IAAI;AACjD,QAAI,MAAM,QAAQ,EAAE,QAAQ,EAAG,mBAAkB,EAAE,UAAU,KAAK;AAAA,EACpE;AACF;AAeO,SAAS,iCAAiC,MAAyC;AACxF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,CAAC;AAC/C,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,OAAO,OAAO,IAAI,GAAG;AACvC,QAAI,OAAO,UAAU,UAAU;AAC7B,iBAAW,KAAK,sBAAsB,KAAK,EAAG,MAAK,IAAI,CAAC;AACxD;AAAA,IACF;AACA,QAAI,SAAS,OAAO,UAAU,UAAU;AACtC,YAAM,OAAQ,MAA4C;AAC1D,UAAI,QAAQ,MAAM,QAAQ,KAAK,QAAQ,GAAG;AACxC,mBAAW,KAAK,kCAAkC,KAAK,EAAG,MAAK,IAAI,CAAC;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAaA,eAAsB,wBAAwB,SAA+C;AAC3F,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAClC,QAAM,QAAQ,MAAM,KAAK,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,QAAM,KAAK,MAAM;AACjB,QAAM,OAAQ,MAAM,GACjB,OAAO,EAAE,IAAI,UAAU,IAAI,QAAQ,UAAU,QAAQ,QAAQ,UAAU,OAAO,CAAC,EAC/E,KAAK,SAAS,EACd,MAAMC,SAAQ,UAAU,QAAQ,KAAK,CAAC;AAKzC,SAAO,KAAK,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,OAAO,EAAE;AAC9F;AA0CA,eAAsB,2BAA2B,OAA6C;AAC5F,QAAM,UAAU,oBAAI,IAAY;AAChC,MAAI,MAAM,QAAQ;AAChB,eAAW,KAAK,sBAAsB,MAAM,MAAM,EAAG,SAAQ,IAAI,CAAC;AAAA,EACpE;AACA,MAAI,MAAM,YAAY,QAAW;AAC/B,eAAW,KAAK,kCAAkC,MAAM,OAAO,EAAG,SAAQ,IAAI,CAAC;AAAA,EACjF;AACA,MAAI,MAAM,MAAM;AACd,eAAW,KAAK,iCAAiC,MAAM,IAAI,EAAG,SAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,MAAI,MAAM,iBAAiB;AACzB,eAAW,QAAQ,MAAM,gBAAiB,SAAQ,OAAO,IAAI;AAAA,EAC/D;AACA,MAAI,QAAQ,SAAS,EAAG,QAAO;AAE/B,QAAM,UAAU,MAAM,wBAAwB,MAAM,KAAK,OAAO,CAAC;AACjE,MAAI,QAAQ;AACZ,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,OAAO,MAAM,cAAe;AAClC,QAAI,MAAM,SAAS,IAAI,EAAE,EAAE,EAAG;AAC9B,UAAM,MAAM,MAAM,mBAAmB;AAAA,MACnC,UAAU,EAAE;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,eAAe,MAAM;AAAA,MACrB,SAAS;AAAA,QACP,GAAI,MAAM,WAAW,CAAC;AAAA,QACtB,mBAAmB,EAAE;AAAA,QACrB,iBAAiB,EAAE;AAAA,MACrB;AAAA,IACF,CAAC;AACD,QAAI,IAAK,UAAS;AAAA,EACpB;AACA,SAAO;AACT;","names":["inArray","inArray"]}

package/dist/{chunk-RJ76SKWQ.js → chunk-XU2GJJ6Z.js}

@@ -176,4 +176,4 @@ export {
   withMemberWrite,
   memberCan
 };
-//# sourceMappingURL=chunk-RJ76SKWQ.js.map
+//# sourceMappingURL=chunk-XU2GJJ6Z.js.map

package/dist/chunk-XU2GJJ6Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/community/can.ts","../src/community/roles.ts"],"sourcesContent":["import { and, eq, gt, isNull, or } from \"drizzle-orm\";\nimport type { NodePgDatabase } from \"drizzle-orm/node-postgres\";\n\nimport { NpForbiddenError } from \"../errors.js\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npBans, npMemberRoles } from \"../db/schema/community.js\";\nimport { getCurrentSiteId } from \"../sites/context.js\";\nimport { NP_DEFAULT_SITE_ID } from \"../sites/registry.js\";\nimport { type CommunityCapability, type CommunityScope, getCommunityRole } from \"./roles.js\";\n\n/**\n * Active-ban probe shared by `memberCan` and direct write-path\n * callers. The community write services (`createComment`,\n * `addReaction`, `fileReport`, `follow`) call `assertNotBanned`\n * straight away — they never went through `memberCan`, so without\n * this gate banned members could still write community content\n * even though their bans were recorded. (#53)\n *\n * Ban-match rules:\n *  - `site` ban → blocks every write.\n *  - `category` / `collection` ban → blocks when the action's scope\n *    chain contains the matching scope.\n *\n * The `or()` helper is required for the `expires_at IS NULL OR\n * expires_at > now` clause; the previous raw `sql` template let\n * Postgres' AND-binds-tighter-than-OR rule re-associate and leak\n * other members' bans (same precedence trap as #006 in 9.5\n * postmortem).\n */\nexport async function isMemberBanned(\n  memberId: string,\n  scopes: ReadonlyArray<{ type: CommunityScope; id: string }> = [],\n  db?: NodePgDatabase<Record<string, unknown>>,\n  now: Date = new Date(),\n): Promise<boolean> {\n  const handle = db ?? (getDb());\n  // Phase 18 — bans are tenant-scoped. A site-wide ban on\n  // tenant A doesn't block writes on tenant B; the ban row\n  // includes `site_id` and we filter by the resolver's\n  // current value.\n  const siteId = (await getCurrentSiteId()) ?? NP_DEFAULT_SITE_ID;\n  const bans = (await handle\n    .select({\n      scopeType: npBans.scopeType,\n      scopeId: npBans.scopeId,\n    })\n    .from(npBans)\n    .where(\n      and(\n        eq(npBans.memberId, memberId),\n        eq(npBans.siteId, siteId),\n        or(isNull(npBans.expiresAt), gt(npBans.expiresAt, now)),\n      ),\n    )) as Array<{\n    scopeType: \"site\" | \"category\" | \"collection\";\n    scopeId: string | null;\n  }>;\n\n  return bans.some((ban) => {\n    if (ban.scopeType === \"site\") return true;\n    return scopes.some((s) => s.type === ban.scopeType && s.id === ban.scopeId);\n  });\n}\n\n/**\n * Throws `NpForbiddenError` if the member is currently banned for any\n * scope in the chain. Used at the top of community write services\n * before any DB mutation. Pre-existing `memberCan` enforces the same\n * rule for permission-based actions; this helper is the catch-all\n * for write paths that don't go through capability checks.\n */\nexport async function assertNotBanned(\n  memberId: string,\n  scopes: ReadonlyArray<{ type: CommunityScope; id: string }> = [],\n): Promise<void> {\n  if (await isMemberBanned(memberId, scopes)) {\n    throw new NpForbiddenError(\"community\", \"banned\");\n  }\n}\n\n/**\n * Structural enforcement of the ban-check gate (#311). Every\n * community write service should run inside this wrapper — the ban\n * check fires before `fn` and a service author can't accidentally\n * ship a new write path that skips it.\n *\n * Pre-validation that doesn't write (input shape, target lookup\n * existence) can run *before* this call; the gate is specifically\n * for the moment between \"we know enough to attempt the write\" and\n * the first DB mutation.\n *\n * `scopes` is the same chain `assertNotBanned` accepts — pass\n * `[{ type: \"collection\", id: targetType }]` for collection-scoped\n * actions, leave empty for site-wide-only enforcement (e.g. follows,\n * polymorphic-target reactions where no obvious scope chain exists).\n */\nexport async function withMemberWrite<T>(\n  memberId: string,\n  scopes: ReadonlyArray<{ type: CommunityScope; id: string }>,\n  fn: () => Promise<T>,\n): Promise<T> {\n  await assertNotBanned(memberId, scopes);\n  return fn();\n}\n\n/**\n * Action a member is attempting. Most actions are real\n * `CommunityCapability` literals — those map 1:1 to a role's\n * capability list. The two exceptions are `\"edit-own\"` and\n * `\"delete-own\"`, which short-circuit on ownership without consulting\n * grants at all.\n */\nexport type MemberAction = CommunityCapability | \"edit-own\" | \"delete-own\";\n\n/**\n * Caller-provided context for a permission check. The caller — the\n * comment service, a future thread service, etc. — provides the\n * target's ownership + scope chain rather than `memberCan` looking\n * it up via a polymorphic join. This keeps the resolver decoupled\n * from the per-target table layout, and lets the surface evolve\n * without touching this resolver.\n */\nexport interface MemberCanTarget {\n  /** Free-form target type — `\"comment\" | \"thread\" | \"reply\" | \"category\" | \"report\" | \"member\"`. */\n  type: string;\n  /** Stable id for logs / future denial reasons. */\n  id: string;\n  /** Member id of the target's author. Required for own-action checks. */\n  ownerId?: string;\n  /**\n   * Scope chain from most specific to least specific. A reply might\n   * provide `[{ type: \"thread\", id: \"<threadId>\" }, { type: \"category\",\n   * id: \"<categoryId>\" }]`; the resolver also checks site-wide grants\n   * regardless of what's in the chain.\n   */\n  scopes?: ReadonlyArray<{ type: CommunityScope; id: string }>;\n}\n\ninterface MemberCanOptions {\n  /** Override the DB handle (tests). Defaults to `getDb()`. */\n  db?: NodePgDatabase<Record<string, unknown>>;\n  /** Reference time for ban/grant expiry checks. Defaults to `new Date()`. */\n  now?: Date;\n}\n\n/**\n * Returns true when `memberId` is allowed to perform `action` on\n * `target`. Walk order:\n *\n *   1. Active scoped ban → deny everything.\n *   2. `edit-own` / `delete-own` → allow only when `target.ownerId === memberId`.\n *   3. Site-wide grants whose role's capability list includes `action`.\n *   4. Scoped grants matching any element of `target.scopes`, whose role\n *      includes `action`.\n *   5. Otherwise deny.\n *\n * The resolver ignores staff (`np_users`) entirely. Staff bypass is the\n * caller's responsibility — typically `principalCan(principal, …)` at\n * the API layer, which routes to `memberCan` only when the principal\n * is a member.\n */\nexport async function memberCan(\n  memberId: string,\n  action: MemberAction,\n  target: MemberCanTarget,\n  options: MemberCanOptions = {},\n): Promise<boolean> {\n  const db = options.db ?? (getDb());\n  const now = options.now ?? new Date();\n  const scopes = target.scopes ?? [];\n\n  // Step 1: ban check. Site-wide bans always apply; scoped bans match\n  // when the target's scope chain contains the ban's scope.\n  const isBanned = await isMemberBanned(memberId, scopes, db, now);\n  if (isBanned) return false;\n\n  // Step 2: ownership shortcut for own-content actions.\n  if (action === \"edit-own\" || action === \"delete-own\") {\n    return Boolean(target.ownerId) && target.ownerId === memberId;\n  }\n\n  // Step 3+4: walk grants. Pull the member's unexpired grants\n  // on the current tenant only — a community-mod on tenant A\n  // shouldn't authorize actions on tenant B. Site-wide grants\n  // (scope_type='site') still match every action on the\n  // resolved tenant.\n  const siteId = (await getCurrentSiteId()) ?? NP_DEFAULT_SITE_ID;\n  const grants = (await db\n    .select({\n      role: npMemberRoles.role,\n      scopeType: npMemberRoles.scopeType,\n      scopeId: npMemberRoles.scopeId,\n    })\n    .from(npMemberRoles)\n    .where(\n      and(\n        eq(npMemberRoles.memberId, memberId),\n        eq(npMemberRoles.siteId, siteId),\n        or(isNull(npMemberRoles.expiresAt), gt(npMemberRoles.expiresAt, now)),\n      ),\n    )) as Array<{\n    role: string;\n    scopeType: CommunityScope;\n    scopeId: string | null;\n  }>;\n\n  for (const grant of grants) {\n    const def = getCommunityRole(grant.role, grant.scopeType);\n    if (!def) continue;\n    if (!def.capabilities.includes(action)) continue;\n\n    if (grant.scopeType === \"site\") {\n      return true;\n    }\n    const matchesTargetScope = scopes.some(\n      (s) => s.type === grant.scopeType && s.id === grant.scopeId,\n    );\n    if (matchesTargetScope) return true;\n  }\n\n  return false;\n}\n","/**\n * Community role registry. Maps a role name + scope type to the\n * capabilities a grant of that role unlocks. Plugins extend the registry\n * via `registerCommunityRole(...)` (gated by the `members:write` or\n * `community:moderate` capability — enforced at registration time, not\n * here).\n *\n * The capability vocabulary is the single source of truth for \"what\n * actions exist in the community.\" `memberCan()` (../community/can.ts)\n * looks up grants and matches their roles' capability lists against the\n * requested action.\n */\n\nexport type CommunityScope = \"site\" | \"category\" | \"collection\" | \"thread\";\n\n/**\n * Action vocabulary. Adding new actions later is fine, but rename with\n * care — built-in role definitions reference these literals and a\n * silent typo widens permissions instead of narrowing them.\n */\nexport type CommunityCapability =\n  | \"hide-comment\"\n  | \"restore-comment\"\n  | \"edit-any-comment\"\n  | \"delete-any-comment\"\n  | \"hide-thread\"\n  | \"restore-thread\"\n  | \"lock-thread\"\n  | \"unlock-thread\"\n  | \"pin-thread\"\n  | \"unpin-thread\"\n  | \"edit-any-thread\"\n  | \"delete-any-thread\"\n  | \"edit-own-thread\"\n  | \"lock-own-thread\"\n  | \"ban-member\"\n  | \"unban-member\"\n  | \"resolve-report\"\n  | \"manage-category\"\n  | \"view-staff-tools\";\n\nexport interface CommunityRoleDefinition {\n  /** e.g. `\"category-mod\"`. Plugins can ship custom roles like `\"tag-mod\"`. */\n  role: string;\n  /** What kind of scope a grant of this role applies to. */\n  scopeType: CommunityScope;\n  /** Capabilities a grant of this role unlocks within its scope. */\n  capabilities: readonly CommunityCapability[];\n  /**\n   * Human-readable label for admin UIs that surface a role picker. Falls\n   * back to `role` when omitted.\n   */\n  label?: string;\n  /** Optional plugin id that registered this role; null for built-ins. */\n  source?: string;\n}\n\nconst ALL_MOD_CAPS: readonly CommunityCapability[] = [\n  \"hide-comment\",\n  \"restore-comment\",\n  \"edit-any-comment\",\n  \"delete-any-comment\",\n  \"hide-thread\",\n  \"restore-thread\",\n  \"lock-thread\",\n  \"unlock-thread\",\n  \"pin-thread\",\n  \"unpin-thread\",\n  \"edit-any-thread\",\n  \"delete-any-thread\",\n  \"ban-member\",\n  \"unban-member\",\n  \"resolve-report\",\n  \"view-staff-tools\",\n];\n\nconst builtInRoles: CommunityRoleDefinition[] = [\n  {\n    role: \"community-mod\",\n    scopeType: \"site\",\n    label: \"Community moderator\",\n    capabilities: [...ALL_MOD_CAPS, \"manage-category\"],\n  },\n  {\n    role: \"category-mod\",\n    scopeType: \"category\",\n    label: \"Category moderator\",\n    capabilities: ALL_MOD_CAPS,\n  },\n  {\n    role: \"collection-mod\",\n    scopeType: \"collection\",\n    label: \"Collection moderator\",\n    // Collection-mods only have authority over the comments under a\n    // collection's documents. Thread-only capabilities don't apply, so\n    // they're omitted on purpose.\n    capabilities: [\n      \"hide-comment\",\n      \"restore-comment\",\n      \"edit-any-comment\",\n      \"delete-any-comment\",\n      \"ban-member\",\n      \"unban-member\",\n      \"resolve-report\",\n      \"view-staff-tools\",\n    ],\n  },\n  {\n    role: \"thread-author\",\n    scopeType: \"thread\",\n    label: \"Thread author\",\n    // Auto-granted on thread create. Lets the OP edit / lock their own\n    // thread without giving them broader powers.\n    capabilities: [\"edit-own-thread\", \"lock-own-thread\"],\n  },\n];\n\nconst customRoles: CommunityRoleDefinition[] = [];\n\nfunction key(role: string, scopeType: CommunityScope): string {\n  return `${scopeType}:${role}`;\n}\n\n/**\n * Plugins call this from setup() to add their own role kinds. Throws\n * when the (role, scopeType) pair is already registered to keep the\n * registry deterministic — a plugin overriding a built-in role would\n * silently widen permissions and is almost always a mistake.\n */\nexport function registerCommunityRole(definition: CommunityRoleDefinition): void {\n  const composite = key(definition.role, definition.scopeType);\n  if (\n    builtInRoles.some((b) => key(b.role, b.scopeType) === composite) ||\n    customRoles.some((c) => key(c.role, c.scopeType) === composite)\n  ) {\n    throw new Error(\n      `[community] role \"${definition.role}\" already registered for scope \"${definition.scopeType}\".`,\n    );\n  }\n  customRoles.push({ ...definition });\n}\n\n/** Look up a role by `(role, scopeType)`. Returns undefined when unknown. */\nexport function getCommunityRole(\n  role: string,\n  scopeType: CommunityScope,\n): CommunityRoleDefinition | undefined {\n  const composite = key(role, scopeType);\n  return (\n    builtInRoles.find((b) => key(b.role, b.scopeType) === composite) ??\n    customRoles.find((c) => key(c.role, c.scopeType) === composite)\n  );\n}\n\n/**\n * Returns every role currently registered, built-ins first then\n * plugin-defined. Used by the admin role picker to render selectable\n * options for a given scope.\n */\nexport function listCommunityRoles(scopeType?: CommunityScope): CommunityRoleDefinition[] {\n  const all = [...builtInRoles, ...customRoles];\n  return scopeType ? all.filter((r) => r.scopeType === scopeType) : all;\n}\n\n/** Tests reset state between cases; production callers should never need this. */\nexport function resetCommunityRoles(): void {\n  customRoles.length = 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,KAAK,IAAI,IAAI,QAAQ,UAAU;;;ACyDxC,IAAM,eAA+C;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAA0C;AAAA,EAC9C;AAAA,IACE,MAAM;AAAA,IACN,WAAW;AAAA,IACX,OAAO;AAAA,IACP,cAAc,CAAC,GAAG,cAAc,iBAAiB;AAAA,EACnD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,WAAW;AAAA,IACX,OAAO;AAAA,IACP,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,WAAW;AAAA,IACX,OAAO;AAAA;AAAA;AAAA;AAAA,IAIP,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,WAAW;AAAA,IACX,OAAO;AAAA;AAAA;AAAA,IAGP,cAAc,CAAC,mBAAmB,iBAAiB;AAAA,EACrD;AACF;AAEA,IAAM,cAAyC,CAAC;AAEhD,SAAS,IAAI,MAAc,WAAmC;AAC5D,SAAO,GAAG,SAAS,IAAI,IAAI;AAC7B;AAQO,SAAS,sBAAsB,YAA2C;AAC/E,QAAM,YAAY,IAAI,WAAW,MAAM,WAAW,SAAS;AAC3D,MACE,aAAa,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,SAAS,KAC/D,YAAY,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,SAAS,GAC9D;AACA,UAAM,IAAI;AAAA,MACR,qBAAqB,WAAW,IAAI,mCAAmC,WAAW,SAAS;AAAA,IAC7F;AAAA,EACF;AACA,cAAY,KAAK,EAAE,GAAG,WAAW,CAAC;AACpC;AAGO,SAAS,iBACd,MACA,WACqC;AACrC,QAAM,YAAY,IAAI,MAAM,SAAS;AACrC,SACE,aAAa,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,SAAS,KAC/D,YAAY,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,SAAS;AAElE;AAOO,SAAS,mBAAmB,WAAuD;AACxF,QAAM,MAAM,CAAC,GAAG,cAAc,GAAG,WAAW;AAC5C,SAAO,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS,IAAI;AACpE;AAGO,SAAS,sBAA4B;AAC1C,cAAY,SAAS;AACvB;;;ADzIA,eAAsB,eACpB,UACA,SAA8D,CAAC,GAC/D,IACA,MAAY,oBAAI,KAAK,GACH;AAClB,QAAM,SAAS,MAAO,MAAM;AAK5B,QAAM,SAAU,MAAM,iBAAiB,KAAM;AAC7C,QAAM,OAAQ,MAAM,OACjB,OAAO;AAAA,IACN,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,EAClB,CAAC,EACA,KAAK,MAAM,EACX;AAAA,IACC;AAAA,MACE,GAAG,OAAO,UAAU,QAAQ;AAAA,MAC5B,GAAG,OAAO,QAAQ,MAAM;AAAA,MACxB,GAAG,OAAO,OAAO,SAAS,GAAG,GAAG,OAAO,WAAW,GAAG,CAAC;AAAA,IACxD;AAAA,EACF;AAKF,SAAO,KAAK,KAAK,CAAC,QAAQ;AACxB,QAAI,IAAI,cAAc,OAAQ,QAAO;AACrC,WAAO,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,aAAa,EAAE,OAAO,IAAI,OAAO;AAAA,EAC5E,CAAC;AACH;AASA,eAAsB,gBACpB,UACA,SAA8D,CAAC,GAChD;AACf,MAAI,MAAM,eAAe,UAAU,MAAM,GAAG;AAC1C,UAAM,IAAI,iBAAiB,aAAa,QAAQ;AAAA,EAClD;AACF;AAkBA,eAAsB,gBACpB,UACA,QACA,IACY;AACZ,QAAM,gBAAgB,UAAU,MAAM;AACtC,SAAO,GAAG;AACZ;AA0DA,eAAsB,UACpB,UACA,QACA,QACA,UAA4B,CAAC,GACX;AAClB,QAAM,KAAK,QAAQ,MAAO,MAAM;AAChC,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,SAAS,OAAO,UAAU,CAAC;AAIjC,QAAM,WAAW,MAAM,eAAe,UAAU,QAAQ,IAAI,GAAG;AAC/D,MAAI,SAAU,QAAO;AAGrB,MAAI,WAAW,cAAc,WAAW,cAAc;AACpD,WAAO,QAAQ,OAAO,OAAO,KAAK,OAAO,YAAY;AAAA,EACvD;AAOA,QAAM,SAAU,MAAM,iBAAiB,KAAM;AAC7C,QAAM,SAAU,MAAM,GACnB,OAAO;AAAA,IACN,MAAM,cAAc;AAAA,IACpB,WAAW,cAAc;AAAA,IACzB,SAAS,cAAc;AAAA,EACzB,CAAC,EACA,KAAK,aAAa,EAClB;AAAA,IACC;AAAA,MACE,GAAG,cAAc,UAAU,QAAQ;AAAA,MACnC,GAAG,cAAc,QAAQ,MAAM;AAAA,MAC/B,GAAG,OAAO,cAAc,SAAS,GAAG,GAAG,cAAc,WAAW,GAAG,CAAC;AAAA,IACtE;AAAA,EACF;AAMF,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,iBAAiB,MAAM,MAAM,MAAM,SAAS;AACxD,QAAI,CAAC,IAAK;AACV,QAAI,CAAC,IAAI,aAAa,SAAS,MAAM,EAAG;AAExC,QAAI,MAAM,cAAc,QAAQ;AAC9B,aAAO;AAAA,IACT;AACA,UAAM,qBAAqB,OAAO;AAAA,MAChC,CAAC,MAAM,EAAE,SAAS,MAAM,aAAa,EAAE,OAAO,MAAM;AAAA,IACtD;AACA,QAAI,mBAAoB,QAAO;AAAA,EACjC;AAEA,SAAO;AACT;","names":[]}

package/dist/{chunk-WJJ5MBH5.js → chunk-YEOQJ7WW.js}

@@ -98,4 +98,4 @@ export {
   getMutedTargetIds,
   listMutes
 };
-//# sourceMappingURL=chunk-WJJ5MBH5.js.map
+//# sourceMappingURL=chunk-YEOQJ7WW.js.map

package/dist/chunk-YEOQJ7WW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/community/mutes.ts"],"sourcesContent":["import { and, desc, eq } from \"drizzle-orm\";\n\nimport { getDb } from \"../db/runtime.js\";\nimport { npMemberMutes, npMembers } from \"../db/schema/community.js\";\nimport { NpNotFoundError, NpValidationError } from \"../errors.js\";\nimport { getCurrentSiteId, requireSiteId } from \"../sites/context.js\";\nimport { NP_DEFAULT_SITE_ID } from \"../sites/registry.js\";\n\n/**\n * Phase 16.1 — member-to-member mute. One-directional: A\n * muting B hides B from A's surfaces (comments, notification\n * fan-out). B keeps posting normally.\n *\n * Distinct from `np_bans` (staff-issued, global write block).\n * Mutes are always self-service: a member calls these helpers\n * for their own mute list, never for someone else's.\n */\n\nexport interface NpMemberMuteRow {\n  memberId: string;\n  targetId: string;\n  createdAt: Date;\n}\n\nexport interface MuteMemberInput {\n  /** The muter — the current member taking the action. */\n  memberId: string;\n  /** The muted — whose content should disappear. */\n  targetId: string;\n}\n\nexport async function muteMember(input: MuteMemberInput): Promise<void> {\n  if (input.memberId === input.targetId) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"targetId\", message: \"Cannot mute yourself.\" },\n    ]);\n  }\n  const db = getDb();\n\n  // Confirm both rows exist — otherwise the FK violation\n  // surfaces as an opaque 500. NotFound is the right shape:\n  // a deleted member shouldn't be muteable.\n  const [muter] = (await db\n    .select({ id: npMembers.id })\n    .from(npMembers)\n    .where(eq(npMembers.id, input.memberId))\n    .limit(1)) as Array<{ id: string }>;\n  if (!muter) throw new NpNotFoundError(\"member\", input.memberId);\n  const [target] = (await db\n    .select({ id: npMembers.id, status: npMembers.status })\n    .from(npMembers)\n    .where(eq(npMembers.id, input.targetId))\n    .limit(1)) as Array<{ id: string; status: string }>;\n  if (!target) throw new NpNotFoundError(\"member\", input.targetId);\n\n  // Phase 18 — site_id is part of the PK so the same muter can\n  // hold a separate \"muted-on-site-A\" / \"muted-on-site-B\" set.\n  // Idempotent: muting twice on the same site doesn't error.\n  // #272 — write: must NOT silently fall through to default site.\n  const siteId = await requireSiteId();\n  await db\n    .insert(npMemberMutes)\n    .values({\n      memberId: input.memberId,\n      targetId: input.targetId,\n      siteId,\n    })\n    .onConflictDoNothing();\n}\n\nexport async function unmuteMember(input: MuteMemberInput): Promise<boolean> {\n  if (input.memberId === input.targetId) {\n    throw new NpValidationError(\"Invalid input\", [\n      { field: \"targetId\", message: \"Cannot unmute yourself.\" },\n    ]);\n  }\n  const db = getDb();\n  // #272 — write: must NOT silently fall through to default site.\n  const siteId = await requireSiteId();\n  const result = (await db\n    .delete(npMemberMutes)\n    .where(\n      and(\n        eq(npMemberMutes.memberId, input.memberId),\n        eq(npMemberMutes.targetId, input.targetId),\n        eq(npMemberMutes.siteId, siteId),\n      ),\n    )\n    .returning({ memberId: npMemberMutes.memberId })) as Array<{\n    memberId: string;\n  }>;\n  return result.length > 0;\n}\n\n/**\n * `true` when `memberId` has muted `targetId` on the current\n * site. Used by comment listing + notification fan-out to\n * filter views and skip alerts.\n */\nexport async function isMuted(input: MuteMemberInput): Promise<boolean> {\n  if (input.memberId === input.targetId) return false;\n  const db = getDb();\n  const siteId = (await getCurrentSiteId()) ?? NP_DEFAULT_SITE_ID;\n  const [row] = (await db\n    .select({ memberId: npMemberMutes.memberId })\n    .from(npMemberMutes)\n    .where(\n      and(\n        eq(npMemberMutes.memberId, input.memberId),\n        eq(npMemberMutes.targetId, input.targetId),\n        eq(npMemberMutes.siteId, siteId),\n      ),\n    )\n    .limit(1)) as Array<{ memberId: string }>;\n  return !!row;\n}\n\n/**\n * Returns the set of `targetId`s the given member has muted on\n * the current site. Used to filter listComments output in one\n * DB round-trip rather than `isMuted()` per row.\n */\nexport async function getMutedTargetIds(memberId: string): Promise<Set<string>> {\n  const db = getDb();\n  const siteId = (await getCurrentSiteId()) ?? NP_DEFAULT_SITE_ID;\n  const rows = (await db\n    .select({ targetId: npMemberMutes.targetId })\n    .from(npMemberMutes)\n    .where(and(eq(npMemberMutes.memberId, memberId), eq(npMemberMutes.siteId, siteId)))) as Array<{\n    targetId: string;\n  }>;\n  return new Set(rows.map((r) => r.targetId));\n}\n\nexport interface NpMemberMuteSummary {\n  targetId: string;\n  handle: string;\n  displayName: string;\n  createdAt: string;\n}\n\nexport interface ListMutesOptions {\n  /** Default 50, max 200. */\n  limit?: number;\n}\n\n/**\n * Surfaces the muter's list with the muted member's display\n * info joined in, so the settings UI doesn't have to round-\n * trip through `/api/members/[handle]` for every row.\n */\nexport async function listMutes(\n  memberId: string,\n  options: ListMutesOptions = {},\n): Promise<NpMemberMuteSummary[]> {\n  const db = getDb();\n  const limit = Math.min(Math.max(options.limit ?? 50, 1), 200);\n  // Phase 18 — settings list is per-site. The same muter can\n  // see different lists on different tenants.\n  const siteId = (await getCurrentSiteId()) ?? NP_DEFAULT_SITE_ID;\n  const rows = (await db\n    .select({\n      targetId: npMemberMutes.targetId,\n      handle: npMembers.handle,\n      displayName: npMembers.displayName,\n      createdAt: npMemberMutes.createdAt,\n    })\n    .from(npMemberMutes)\n    .innerJoin(npMembers, eq(npMemberMutes.targetId, npMembers.id))\n    .where(and(eq(npMemberMutes.memberId, memberId), eq(npMemberMutes.siteId, siteId)))\n    .orderBy(desc(npMemberMutes.createdAt))\n    .limit(limit)) as Array<{\n    targetId: string;\n    handle: string;\n    displayName: string;\n    createdAt: Date;\n  }>;\n  return rows.map((r) => ({\n    targetId: r.targetId,\n    handle: r.handle,\n    displayName: r.displayName,\n    createdAt: r.createdAt.toISOString(),\n  }));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,KAAK,MAAM,UAAU;AA+B9B,eAAsB,WAAW,OAAuC;AACtE,MAAI,MAAM,aAAa,MAAM,UAAU;AACrC,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,YAAY,SAAS,wBAAwB;AAAA,IACxD,CAAC;AAAA,EACH;AACA,QAAM,KAAK,MAAM;AAKjB,QAAM,CAAC,KAAK,IAAK,MAAM,GACpB,OAAO,EAAE,IAAI,UAAU,GAAG,CAAC,EAC3B,KAAK,SAAS,EACd,MAAM,GAAG,UAAU,IAAI,MAAM,QAAQ,CAAC,EACtC,MAAM,CAAC;AACV,MAAI,CAAC,MAAO,OAAM,IAAI,gBAAgB,UAAU,MAAM,QAAQ;AAC9D,QAAM,CAAC,MAAM,IAAK,MAAM,GACrB,OAAO,EAAE,IAAI,UAAU,IAAI,QAAQ,UAAU,OAAO,CAAC,EACrD,KAAK,SAAS,EACd,MAAM,GAAG,UAAU,IAAI,MAAM,QAAQ,CAAC,EACtC,MAAM,CAAC;AACV,MAAI,CAAC,OAAQ,OAAM,IAAI,gBAAgB,UAAU,MAAM,QAAQ;AAM/D,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,GACH,OAAO,aAAa,EACpB,OAAO;AAAA,IACN,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB;AAAA,EACF,CAAC,EACA,oBAAoB;AACzB;AAEA,eAAsB,aAAa,OAA0C;AAC3E,MAAI,MAAM,aAAa,MAAM,UAAU;AACrC,UAAM,IAAI,kBAAkB,iBAAiB;AAAA,MAC3C,EAAE,OAAO,YAAY,SAAS,0BAA0B;AAAA,IAC1D,CAAC;AAAA,EACH;AACA,QAAM,KAAK,MAAM;AAEjB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAU,MAAM,GACnB,OAAO,aAAa,EACpB;AAAA,IACC;AAAA,MACE,GAAG,cAAc,UAAU,MAAM,QAAQ;AAAA,MACzC,GAAG,cAAc,UAAU,MAAM,QAAQ;AAAA,MACzC,GAAG,cAAc,QAAQ,MAAM;AAAA,IACjC;AAAA,EACF,EACC,UAAU,EAAE,UAAU,cAAc,SAAS,CAAC;AAGjD,SAAO,OAAO,SAAS;AACzB;AAOA,eAAsB,QAAQ,OAA0C;AACtE,MAAI,MAAM,aAAa,MAAM,SAAU,QAAO;AAC9C,QAAM,KAAK,MAAM;AACjB,QAAM,SAAU,MAAM,iBAAiB,KAAM;AAC7C,QAAM,CAAC,GAAG,IAAK,MAAM,GAClB,OAAO,EAAE,UAAU,cAAc,SAAS,CAAC,EAC3C,KAAK,aAAa,EAClB;AAAA,IACC;AAAA,MACE,GAAG,cAAc,UAAU,MAAM,QAAQ;AAAA,MACzC,GAAG,cAAc,UAAU,MAAM,QAAQ;AAAA,MACzC,GAAG,cAAc,QAAQ,MAAM;AAAA,IACjC;AAAA,EACF,EACC,MAAM,CAAC;AACV,SAAO,CAAC,CAAC;AACX;AAOA,eAAsB,kBAAkB,UAAwC;AAC9E,QAAM,KAAK,MAAM;AACjB,QAAM,SAAU,MAAM,iBAAiB,KAAM;AAC7C,QAAM,OAAQ,MAAM,GACjB,OAAO,EAAE,UAAU,cAAc,SAAS,CAAC,EAC3C,KAAK,aAAa,EAClB,MAAM,IAAI,GAAG,cAAc,UAAU,QAAQ,GAAG,GAAG,cAAc,QAAQ,MAAM,CAAC,CAAC;AAGpF,SAAO,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAC5C;AAmBA,eAAsB,UACpB,UACA,UAA4B,CAAC,GACG;AAChC,QAAM,KAAK,MAAM;AACjB,QAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,QAAQ,SAAS,IAAI,CAAC,GAAG,GAAG;AAG5D,QAAM,SAAU,MAAM,iBAAiB,KAAM;AAC7C,QAAM,OAAQ,MAAM,GACjB,OAAO;AAAA,IACN,UAAU,cAAc;AAAA,IACxB,QAAQ,UAAU;AAAA,IAClB,aAAa,UAAU;AAAA,IACvB,WAAW,cAAc;AAAA,EAC3B,CAAC,EACA,KAAK,aAAa,EAClB,UAAU,WAAW,GAAG,cAAc,UAAU,UAAU,EAAE,CAAC,EAC7D,MAAM,IAAI,GAAG,cAAc,UAAU,QAAQ,GAAG,GAAG,cAAc,QAAQ,MAAM,CAAC,CAAC,EACjF,QAAQ,KAAK,cAAc,SAAS,CAAC,EACrC,MAAM,KAAK;AAMd,SAAO,KAAK,IAAI,CAAC,OAAO;AAAA,IACtB,UAAU,EAAE;AAAA,IACZ,QAAQ,EAAE;AAAA,IACV,aAAa,EAAE;AAAA,IACf,WAAW,EAAE,UAAU,YAAY;AAAA,EACrC,EAAE;AACJ;","names":[]}

package/dist/community.js

@@ -33,12 +33,12 @@ import {
   unfollow,
   unresolvedReportCount,
   updateComment
-} from "./chunk-HNX7COHQ.js";
-import "./chunk-PW43RCJK.js";
+} from "./chunk-6PFUXZJ6.js";
+import "./chunk-PPUHXOWZ.js";
 import {
   buildDigestEmail,
   runDigestSweep
-} from "./chunk-LN6NTH6E.js";
+} from "./chunk-K4CJ3KXB.js";
 import {
   assertNotBanned,
   getCommunityRole,
@@ -47,14 +47,14 @@ import {
   registerCommunityRole,
   resetCommunityRoles,
   withMemberWrite
-} from "./chunk-RJ76SKWQ.js";
+} from "./chunk-XU2GJJ6Z.js";
 import {
   getMutedTargetIds,
   isMuted,
   listMutes,
   muteMember,
   unmuteMember
-} from "./chunk-WJJ5MBH5.js";
+} from "./chunk-YEOQJ7WW.js";
 import {
   getMemberNotificationPrefs,
   isNotificationKindEnabled,
@@ -62,7 +62,7 @@ import {
   recordDigestSent,
   registerNotificationKind,
   setMemberNotificationPrefs
-} from "./chunk-CAS4Z6IN.js";
+} from "./chunk-I4FSVEJK.js";
 import {
   MENTION_HANDLE_RE,
   assertOwnsNotification,
@@ -76,13 +76,13 @@ import {
   markNotificationsRead,
   resolveMentionedMembers,
   unreadNotificationCount
-} from "./chunk-RDTTK27V.js";
+} from "./chunk-XPD7EQML.js";
 import {
   applyReputation,
   getReputationAdapter,
   resetReputationAdapter,
   setReputationAdapter
-} from "./chunk-L6VG7IK6.js";
+} from "./chunk-VBVLYFSZ.js";
 import {
   getSpamAdapter,
   resetSpamAdapter,
@@ -93,20 +93,20 @@ import {
   resetProfanityAdapter,
   setProfanityAdapter
 } from "./chunk-KU5M27ZC.js";
-import "./chunk-2N53KKIL.js";
-import "./chunk-MLXKZK6G.js";
-import "./chunk-2VZZ7M26.js";
+import "./chunk-EWVXP3GP.js";
+import "./chunk-CD74WQK7.js";
+import "./chunk-EAYUAXW3.js";
 import "./chunk-EQ2Z3KMD.js";
 import {
   listAuditEvents,
   recordAuditEvent
-} from "./chunk-ML2E3P3X.js";
+} from "./chunk-5C22NDW4.js";
 import {
   DEFAULT_COMMUNITY_SETTINGS,
   getCommunitySettings,
   updateCommunitySettings,
   validateCommunitySettingsPatch
-} from "./chunk-RKM4GDWM.js";
+} from "./chunk-6MRTH734.js";
 import "./chunk-EFZH6UPY.js";
 import "./chunk-4ZLMEKFX.js";
 import "./chunk-U4QCCLAW.js";
@@ -116,7 +116,7 @@ import "./chunk-LSHHRDVR.js";
 import "./chunk-V2UNHGAP.js";
 import "./chunk-WV272MPW.js";
 import "./chunk-OROPGO65.js";
-import "./chunk-NFHS7CFV.js";
+import "./chunk-Q7MK5ZKG.js";
 import "./chunk-XANPEOJC.js";
 import "./chunk-X7K5F2UI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/{config-YHUEYQ66.js → config-2CV7KZ3D.js}

@@ -5,9 +5,9 @@ import {
   isVersionedPluginConfig,
   pluginConfigCacheTag,
   setPluginConfig
-} from "./chunk-OMGQZ4Q5.js";
-import "./chunk-MLXKZK6G.js";
-import "./chunk-2VZZ7M26.js";
+} from "./chunk-JKTU67A7.js";
+import "./chunk-CD74WQK7.js";
+import "./chunk-EAYUAXW3.js";
 import "./chunk-LMPYQLMH.js";
 import "./chunk-2KNG5KMM.js";
 import "./chunk-EFZH6UPY.js";
@@ -18,7 +18,7 @@ import "./chunk-ZCINJSS4.js";
 import "./chunk-V2UNHGAP.js";
 import "./chunk-WV272MPW.js";
 import "./chunk-OROPGO65.js";
-import "./chunk-NFHS7CFV.js";
+import "./chunk-Q7MK5ZKG.js";
 import "./chunk-XANPEOJC.js";
 import "./chunk-X7K5F2UI.js";
 import "./chunk-PZ5AY32C.js";
@@ -30,4 +30,4 @@ export {
   pluginConfigCacheTag,
   setPluginConfig
 };
-//# sourceMappingURL=config-YHUEYQ66.js.map
+//# sourceMappingURL=config-2CV7KZ3D.js.map

package/dist/{digest-ZODDTXA2.js → digest-IWHMJPXI.js}

@@ -1,12 +1,12 @@
 import {
   buildDigestEmail,
   runDigestSweep
-} from "./chunk-LN6NTH6E.js";
-import "./chunk-CAS4Z6IN.js";
+} from "./chunk-K4CJ3KXB.js";
+import "./chunk-I4FSVEJK.js";
 import "./chunk-U4QCCLAW.js";
 import "./chunk-ZCINJSS4.js";
 import "./chunk-LSHHRDVR.js";
-import "./chunk-NFHS7CFV.js";
+import "./chunk-Q7MK5ZKG.js";
 import "./chunk-XANPEOJC.js";
 import "./chunk-X7K5F2UI.js";
 import "./chunk-PZ5AY32C.js";
@@ -14,4 +14,4 @@ export {
   buildDigestEmail,
   runDigestSweep
 };
-//# sourceMappingURL=digest-ZODDTXA2.js.map
+//# sourceMappingURL=digest-IWHMJPXI.js.map

package/dist/{host-XBGYIQEE.js → host-C5PGUXX7.js}

@@ -16,8 +16,8 @@ import {
   runHookAndCollect,
   runPluginScheduledTask,
   schedulePluginTask
-} from "./chunk-MLXKZK6G.js";
-import "./chunk-2VZZ7M26.js";
+} from "./chunk-CD74WQK7.js";
+import "./chunk-EAYUAXW3.js";
 import "./chunk-EFZH6UPY.js";
 import "./chunk-4ZLMEKFX.js";
 import "./chunk-U4QCCLAW.js";
@@ -26,7 +26,7 @@ import "./chunk-ZCINJSS4.js";
 import "./chunk-V2UNHGAP.js";
 import "./chunk-WV272MPW.js";
 import "./chunk-OROPGO65.js";
-import "./chunk-NFHS7CFV.js";
+import "./chunk-Q7MK5ZKG.js";
 import "./chunk-XANPEOJC.js";
 import "./chunk-X7K5F2UI.js";
 import "./chunk-PZ5AY32C.js";
@@ -49,4 +49,4 @@ export {
   runPluginScheduledTask,
   schedulePluginTask
 };
-//# sourceMappingURL=host-XBGYIQEE.js.map
+//# sourceMappingURL=host-C5PGUXX7.js.map