@notionx/core 0.1.0

package/dist/auth/users.js

@@ -0,0 +1,558 @@
+// src/auth/passwords.ts
+var HASH_PREFIX = "pbkdf2_sha256";
+var PBKDF2_ITERATIONS = 1e5;
+var SALT_BYTES = 16;
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function base64ToBytes(input) {
+  const bin = atob(input);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+}
+async function deriveKey(password, salt, iterations) {
+  const normalizedSalt = Uint8Array.from(salt);
+  const baseKey = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const derived = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      hash: "SHA-256",
+      salt: normalizedSalt,
+      iterations
+    },
+    baseKey,
+    256
+  );
+  return new Uint8Array(derived);
+}
+async function constantTimeEqual(left, right) {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let i = 0; i < left.length; i++) {
+    diff |= left[i] ^ right[i];
+  }
+  return diff === 0;
+}
+async function hashPassword(password) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+  const derived = await deriveKey(password, salt, PBKDF2_ITERATIONS);
+  return [
+    HASH_PREFIX,
+    String(PBKDF2_ITERATIONS),
+    bytesToBase64(salt),
+    bytesToBase64(derived)
+  ].join("$");
+}
+async function verifyPassword(password, storedHash) {
+  const [prefix, iterationsStr, saltB64, hashB64] = storedHash.split("$");
+  if (prefix !== HASH_PREFIX || !iterationsStr || !saltB64 || !hashB64) {
+    return false;
+  }
+  const iterations = Number(iterationsStr);
+  if (!Number.isFinite(iterations) || iterations <= 0) return false;
+  const salt = base64ToBytes(saltB64);
+  const expected = base64ToBytes(hashB64);
+  const derived = await deriveKey(password, salt, iterations);
+  return constantTimeEqual(derived, expected);
+}
+
+// src/internal/admin/settings.ts
+import { cache } from "react";
+
+// src/util/env.ts
+import { env } from "cloudflare:workers";
+var workerEnv = env;
+
+// src/platform/runtime.ts
+function cacheRequestForKey(key) {
+  return new Request(key, { method: "GET" });
+}
+function createCloudflarePublicCacheAdapter(cache2) {
+  return {
+    kind: "cloudflare-cache",
+    async match(key) {
+      return await cache2.match(cacheRequestForKey(key)) ?? null;
+    },
+    put(key, response) {
+      return cache2.put(cacheRequestForKey(key), response);
+    },
+    delete(key) {
+      return cache2.delete(cacheRequestForKey(key));
+    }
+  };
+}
+function createCloudflareKeyValueCacheAdapter(namespace) {
+  return {
+    kind: "workers-kv",
+    async get(key, options) {
+      return await namespace.get(key, {
+        type: "json",
+        cacheTtl: options?.cacheTtl
+      });
+    },
+    async put(key, value, options) {
+      await namespace.put(key, JSON.stringify(value), {
+        expirationTtl: options?.expirationTtl,
+        metadata: options?.metadata
+      });
+    },
+    delete(key) {
+      return namespace.delete(key);
+    },
+    async list(options) {
+      const result = await namespace.list({
+        prefix: options?.prefix,
+        limit: options?.limit,
+        cursor: options?.cursor
+      });
+      return {
+        keys: result.keys.map((key) => ({ name: key.name })),
+        cursor: result.list_complete ? void 0 : result.cursor,
+        listComplete: result.list_complete
+      };
+    }
+  };
+}
+function r2ObjectToStoredObject(object) {
+  return {
+    body: object.body,
+    size: object.size,
+    etag: object.etag,
+    contentType: object.httpMetadata?.contentType
+  };
+}
+function createCloudflareRuntimePlatform(env2, options) {
+  const database = env2.DB ? {
+    kind: "d1",
+    prepare(query) {
+      return env2.DB.prepare(query);
+    },
+    async batch(statements) {
+      return await env2.DB.batch(
+        statements
+      );
+    }
+  } : null;
+  const objectStorage = env2.ASSETS_BUCKET ? {
+    kind: "r2",
+    async get(key) {
+      const object = await env2.ASSETS_BUCKET?.get(key);
+      return object ? r2ObjectToStoredObject(object) : null;
+    },
+    async put(key, value, options2) {
+      await env2.ASSETS_BUCKET?.put(key, value, {
+        httpMetadata: {
+          contentType: options2?.contentType,
+          cacheControl: options2?.cacheControl
+        },
+        customMetadata: options2?.metadata
+      });
+    },
+    async delete(key) {
+      await env2.ASSETS_BUCKET?.delete(key);
+    },
+    async list(options2) {
+      const listed = await env2.ASSETS_BUCKET?.list({
+        prefix: options2?.prefix,
+        limit: options2?.limit
+      });
+      return listed?.objects.map((object) => ({
+        key: object.key,
+        size: object.size,
+        uploaded: object.uploaded
+      })) ?? [];
+    }
+  } : null;
+  const imageTransformer = env2.IMAGES ? {
+    kind: "cloudflare-images",
+    async transform(body, options2) {
+      const result = await env2.IMAGES.input(body).transform(options2.width ? { width: options2.width } : {}).output({
+        format: options2.format,
+        quality: options2.quality
+      });
+      return {
+        body: result.image(),
+        contentType: result.contentType(),
+        response: () => result.response()
+      };
+    }
+  } : null;
+  const keyValueCache = env2.CONTENT_CACHE ? createCloudflareKeyValueCacheAdapter(env2.CONTENT_CACHE) : null;
+  return {
+    id: "cloudflare-workers",
+    database,
+    objectStorage,
+    imageTransformer,
+    keyValueCache,
+    publicCache: options?.publicCache ? createCloudflarePublicCacheAdapter(options.publicCache) : null
+  };
+}
+
+// src/platform/cloudflare-runtime.ts
+function getDefaultCloudflareCache() {
+  const globalWithCaches = globalThis;
+  return globalWithCaches.caches?.default ?? null;
+}
+function getRuntimePlatform() {
+  return createCloudflareRuntimePlatform(workerEnv, {
+    publicCache: getDefaultCloudflareCache()
+  });
+}
+
+// src/platform/current.ts
+function getRuntimePlatform2() {
+  return getRuntimePlatform();
+}
+function getDatabase() {
+  const platform = getRuntimePlatform2();
+  const database = platform.database;
+  if (!database) {
+    throw new Error(`SQL database adapter not configured for ${platform.id}`);
+  }
+  return database;
+}
+
+// src/internal/admin/settings.ts
+var DEFAULT_ADMIN_EMAIL = "zhaofilms@gmail.com";
+function rowToSettings(r) {
+  return {
+    site_title: r.site_title,
+    google_enabled: r.google_enabled === 1 ? 1 : 0,
+    google_client_id: r.google_client_id,
+    google_client_secret: r.google_client_secret,
+    google_updated_at: r.google_updated_at,
+    turnstile_enabled: r.turnstile_enabled === 1 ? 1 : 0,
+    turnstile_site_key: r.turnstile_site_key,
+    turnstile_updated_at: r.turnstile_updated_at,
+    admin_email: r.admin_email,
+    updated_at: r.updated_at
+  };
+}
+var getAppSettingsCached = cache(async () => {
+  const row = await getDatabase().prepare(
+    `SELECT site_title, google_enabled, google_client_id, google_client_secret,
+            google_updated_at, turnstile_enabled, turnstile_site_key,
+            turnstile_updated_at, admin_email, updated_at
+       FROM app_settings WHERE id = 1`
+  ).first();
+  if (!row) {
+    return {
+      site_title: "vinext Blog",
+      google_enabled: 0,
+      google_client_id: null,
+      google_client_secret: null,
+      google_updated_at: null,
+      turnstile_enabled: 0,
+      turnstile_site_key: null,
+      turnstile_updated_at: null,
+      admin_email: DEFAULT_ADMIN_EMAIL,
+      updated_at: ""
+    };
+  }
+  return rowToSettings(row);
+});
+async function getAppSettings() {
+  return getAppSettingsCached();
+}
+
+// src/internal/admin/admin.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+async function isAdminEmail(email) {
+  if (!email) return false;
+  const settings = await getAppSettings();
+  return normalizeEmail(email) === normalizeEmail(settings.admin_email);
+}
+
+// src/auth/users.ts
+function normalizeEmail2(email) {
+  return email.trim().toLowerCase();
+}
+async function defaultRoleFor(email) {
+  return await isAdminEmail(email) ? "admin" : "user";
+}
+function normalizeUserRole(role) {
+  if (role === "admin" || role === "vip") return role;
+  return "user";
+}
+function createRandomToken() {
+  return [...crypto.getRandomValues(new Uint8Array(24))].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function userToSession(user) {
+  return {
+    uid: user.id,
+    email: user.email,
+    name: user.name,
+    picture: user.picture,
+    rev: user.session_rev ?? 0
+  };
+}
+async function upsertGoogleUser(input) {
+  const db = getDatabase();
+  const email = normalizeEmail2(input.email);
+  const existing = await db.prepare(
+    `SELECT * FROM users WHERE google_sub = ? OR email = ? LIMIT 1`
+  ).bind(input.googleSub, email).first();
+  if (existing) {
+    await db.prepare(
+      `UPDATE users
+       SET email = ?, name = ?, picture = ?, google_sub = ?, email_verified = 1,
+           email_verify_token = NULL, email_verify_expires_at = NULL,
+           last_seen_at = datetime('now')
+       WHERE id = ?`
+    ).bind(email, input.name, input.picture, input.googleSub, existing.id).run();
+  } else {
+    const role = await defaultRoleFor(email);
+    await db.prepare(
+      `INSERT INTO users (
+        email, name, picture, google_sub, email_verified, role, last_seen_at
+      ) VALUES (?, ?, ?, ?, 1, ?, datetime('now'))`
+    ).bind(email, input.name, input.picture, input.googleSub, role).run();
+  }
+  if (await isAdminEmail(email)) {
+    await db.prepare(
+      `UPDATE users SET role = 'admin' WHERE email = ?`
+    ).bind(email).run();
+  }
+  const user = await getUserByEmail(email);
+  if (!user) throw new Error("User upsert failed");
+  return user;
+}
+async function createEmailUser(input) {
+  const email = normalizeEmail2(input.email);
+  const existing = await getUserByEmail(email);
+  if (existing) {
+    return { ok: false, reason: "exists" };
+  }
+  const passwordHash = await hashPassword(input.password);
+  const verifyToken = createRandomToken();
+  const verifyExpiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24).toISOString();
+  const role = await defaultRoleFor(email);
+  const db = getDatabase();
+  await db.prepare(
+    `INSERT INTO users (
+      email, password_hash, email_verified, email_verify_token,
+      email_verify_expires_at, role, last_seen_at
+    ) VALUES (?, ?, 0, ?, ?, ?, datetime('now'))`
+  ).bind(email, passwordHash, verifyToken, verifyExpiresAt, role).run();
+  if (role === "admin") {
+    await db.prepare(
+      `UPDATE users SET role = 'admin' WHERE email = ?`
+    ).bind(email).run();
+  }
+  const user = await getUserByEmail(email);
+  if (!user) throw new Error("User creation failed");
+  return { ok: true, user, verifyToken };
+}
+async function verifyEmailUser(token) {
+  const user = await getDatabase().prepare(
+    `SELECT * FROM users WHERE email_verify_token = ?`
+  ).bind(token).first();
+  if (!user || !user.email_verify_expires_at) return null;
+  if (new Date(user.email_verify_expires_at).getTime() < Date.now()) {
+    return null;
+  }
+  await getDatabase().prepare(
+    `UPDATE users
+     SET email_verified = 1,
+         email_verify_token = NULL,
+         email_verify_expires_at = NULL,
+         last_seen_at = datetime('now')
+     WHERE id = ?`
+  ).bind(user.id).run();
+  return getUserByEmail(user.email);
+}
+async function issueVerificationToken(email) {
+  const user = await getUserByEmail(email);
+  if (!user) return { ok: false, reason: "not_found" };
+  if (!user.password_hash) return { ok: false, reason: "no_password" };
+  if (user.email_verified) return { ok: false, reason: "already_verified" };
+  const verifyToken = createRandomToken();
+  const verifyExpiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24).toISOString();
+  await getDatabase().prepare(
+    `UPDATE users
+     SET email_verify_token = ?, email_verify_expires_at = ?
+     WHERE id = ?`
+  ).bind(verifyToken, verifyExpiresAt, user.id).run();
+  const updated = await getUserByEmail(email);
+  if (!updated) return { ok: false, reason: "not_found" };
+  return { ok: true, token: verifyToken, user: updated };
+}
+async function issuePasswordResetToken(email) {
+  const user = await getUserByEmail(email);
+  if (!user || !user.password_hash) {
+    return { ok: false, reason: "not_found" };
+  }
+  if (!user.email_verified) {
+    return { ok: false, reason: "unverified" };
+  }
+  const resetToken = createRandomToken();
+  const resetExpiresAt = new Date(Date.now() + 1e3 * 60 * 60).toISOString();
+  await getDatabase().prepare(
+    `UPDATE users
+     SET password_reset_token = ?, password_reset_expires_at = ?
+     WHERE id = ?`
+  ).bind(resetToken, resetExpiresAt, user.id).run();
+  const updated = await getUserByEmail(email);
+  if (!updated) return { ok: false, reason: "not_found" };
+  return { ok: true, token: resetToken, user: updated };
+}
+async function resetPasswordWithToken(input) {
+  const user = await getDatabase().prepare(
+    `SELECT * FROM users WHERE password_reset_token = ?`
+  ).bind(input.token).first();
+  if (!user || !user.password_reset_expires_at) {
+    return { ok: false, reason: "invalid" };
+  }
+  if (new Date(user.password_reset_expires_at).getTime() < Date.now()) {
+    return { ok: false, reason: "invalid" };
+  }
+  const passwordHash = await hashPassword(input.password);
+  await getDatabase().prepare(
+    `UPDATE users
+     SET password_hash = ?,
+         password_reset_token = NULL,
+         password_reset_expires_at = NULL,
+         session_rev = session_rev + 1,
+         last_seen_at = datetime('now')
+     WHERE id = ?`
+  ).bind(passwordHash, user.id).run();
+  const updated = await getUserById(user.id);
+  if (!updated) return { ok: false, reason: "invalid" };
+  return { ok: true, user: updated };
+}
+async function changeUserPassword(input) {
+  const user = await getUserById(input.userId);
+  if (!user || !user.password_hash) {
+    return { ok: false, reason: "no_password" };
+  }
+  const matches = await verifyPassword(
+    input.currentPassword,
+    user.password_hash
+  );
+  if (!matches) {
+    return { ok: false, reason: "invalid" };
+  }
+  const passwordHash = await hashPassword(input.newPassword);
+  await getDatabase().prepare(
+    `UPDATE users
+     SET password_hash = ?,
+         session_rev = session_rev + 1,
+         last_seen_at = datetime('now')
+     WHERE id = ?`
+  ).bind(passwordHash, user.id).run();
+  const updated = await getUserById(user.id);
+  if (!updated) return { ok: false, reason: "invalid" };
+  return { ok: true, user: updated };
+}
+async function authenticateEmailUser(input) {
+  const email = normalizeEmail2(input.email);
+  const user = await getUserByEmail(email);
+  if (!user || !user.password_hash) {
+    return { ok: false, reason: "invalid" };
+  }
+  const matches = await verifyPassword(input.password, user.password_hash);
+  if (!matches) {
+    return { ok: false, reason: "invalid" };
+  }
+  if (!user.email_verified) {
+    return { ok: false, reason: "unverified" };
+  }
+  await getDatabase().prepare(
+    `UPDATE users SET last_seen_at = datetime('now') WHERE id = ?`
+  ).bind(user.id).run();
+  return { ok: true, user: { ...user, email } };
+}
+async function getUserByEmail(email) {
+  return await getDatabase().prepare(`SELECT * FROM users WHERE email = ?`).bind(normalizeEmail2(email)).first();
+}
+async function getUserById(id) {
+  return await getDatabase().prepare(`SELECT * FROM users WHERE id = ?`).bind(id).first();
+}
+async function listUsers(limit = 100) {
+  const { results } = await getDatabase().prepare(
+    `SELECT * FROM users ORDER BY created_at DESC LIMIT ?`
+  ).bind(limit).all();
+  return results || [];
+}
+async function listUsersWithPostCounts(limit = 100) {
+  const { results } = await getDatabase().prepare(
+    `SELECT u.*,
+            (SELECT COUNT(*) FROM posts p WHERE p.owner_email = u.email) AS post_count
+       FROM users u
+      ORDER BY u.created_at DESC
+      LIMIT ?`
+  ).bind(limit).all();
+  return results || [];
+}
+async function revokeUserSessions(userId) {
+  const user = await getUserById(userId);
+  if (!user) return false;
+  await getDatabase().prepare(
+    `UPDATE users SET session_rev = session_rev + 1 WHERE id = ?`
+  ).bind(userId).run();
+  return true;
+}
+async function setUserRole(userId, role) {
+  const user = await getUserById(userId);
+  if (!user) return { ok: false, reason: "not_found" };
+  if (await isAdminEmail(user.email)) {
+    return { ok: false, reason: "is_admin" };
+  }
+  await getDatabase().prepare(
+    `UPDATE users
+        SET role = ?,
+            last_seen_at = datetime('now')
+      WHERE id = ?`
+  ).bind(role, userId).run();
+  const updated = await getUserById(userId);
+  if (!updated) return { ok: false, reason: "not_found" };
+  return { ok: true, user: updated };
+}
+async function deleteUserAccount(userId) {
+  const user = await getUserById(userId);
+  if (!user) return { ok: false, reason: "not_found" };
+  if (await isAdminEmail(user.email)) {
+    return { ok: false, reason: "is_admin" };
+  }
+  const settings = await getAppSettings();
+  const adminEmail = settings.admin_email;
+  const db = getDatabase();
+  await db.batch([
+    db.prepare(
+      `UPDATE posts SET owner_email = ? WHERE owner_email = ?`
+    ).bind(adminEmail, user.email),
+    db.prepare(`DELETE FROM users WHERE id = ?`).bind(userId)
+  ]);
+  return { ok: true, email: user.email };
+}
+export {
+  authenticateEmailUser,
+  changeUserPassword,
+  createEmailUser,
+  deleteUserAccount,
+  getUserByEmail,
+  getUserById,
+  issuePasswordResetToken,
+  issueVerificationToken,
+  listUsers,
+  listUsersWithPostCounts,
+  normalizeUserRole,
+  resetPasswordWithToken,
+  revokeUserSessions,
+  setUserRole,
+  upsertGoogleUser,
+  userToSession,
+  verifyEmailUser
+};
+//# sourceMappingURL=users.js.map

package/dist/auth/users.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/passwords.ts","../../src/internal/admin/settings.ts","../../src/util/env.ts","../../src/platform/runtime.ts","../../src/platform/cloudflare-runtime.ts","../../src/platform/current.ts","../../src/internal/admin/admin.ts","../../src/auth/users.ts"],"sourcesContent":["// PBKDF2-SHA256 password hashing for the email/password auth flow.\n// Cloudflare Workers WebCrypto rejects iteration counts above 100000.\n\nconst HASH_PREFIX = \"pbkdf2_sha256\";\n// Cloudflare Workers WebCrypto currently rejects PBKDF2 iteration counts above 100000.\nconst PBKDF2_ITERATIONS = 100000;\nconst SALT_BYTES = 16;\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n  let bin = \"\";\n  for (const b of bytes) bin += String.fromCharCode(b);\n  return btoa(bin);\n}\n\nfunction base64ToBytes(input: string): Uint8Array {\n  const bin = atob(input);\n  const bytes = new Uint8Array(bin.length);\n  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);\n  return bytes;\n}\n\nasync function deriveKey(\n  password: string,\n  salt: Uint8Array,\n  iterations: number\n): Promise<Uint8Array> {\n  const normalizedSalt = Uint8Array.from(salt) as unknown as BufferSource;\n  const baseKey = await crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(password),\n    \"PBKDF2\",\n    false,\n    [\"deriveBits\"]\n  );\n  const derived = await crypto.subtle.deriveBits(\n    {\n      name: \"PBKDF2\",\n      hash: \"SHA-256\",\n      salt: normalizedSalt,\n      iterations,\n    },\n    baseKey,\n    256\n  );\n  return new Uint8Array(derived);\n}\n\nasync function constantTimeEqual(\n  left: Uint8Array,\n  right: Uint8Array\n): Promise<boolean> {\n  if (left.length !== right.length) return false;\n  let diff = 0;\n  for (let i = 0; i < left.length; i++) {\n    diff |= left[i]! ^ right[i]!;\n  }\n  return diff === 0;\n}\n\nexport async function hashPassword(password: string): Promise<string> {\n  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n  const derived = await deriveKey(password, salt, PBKDF2_ITERATIONS);\n  return [\n    HASH_PREFIX,\n    String(PBKDF2_ITERATIONS),\n    bytesToBase64(salt),\n    bytesToBase64(derived),\n  ].join(\"$\");\n}\n\n/** 注册/改密时的强度校验，失败返回中文错误信息。 */\nexport function validatePasswordStrength(password: string): string | null {\n  if (password.length < 8) return \"密码至少需要 8 位\";\n  if (!/[a-zA-Z]/.test(password) || !/\\d/.test(password)) {\n    return \"密码需要同时包含字母和数字\";\n  }\n  return null;\n}\n\nexport async function verifyPassword(\n  password: string,\n  storedHash: string\n): Promise<boolean> {\n  const [prefix, iterationsStr, saltB64, hashB64] = storedHash.split(\"$\");\n  if (\n    prefix !== HASH_PREFIX ||\n    !iterationsStr ||\n    !saltB64 ||\n    !hashB64\n  ) {\n    return false;\n  }\n\n  const iterations = Number(iterationsStr);\n  if (!Number.isFinite(iterations) || iterations <= 0) return false;\n\n  const salt = base64ToBytes(saltB64);\n  const expected = base64ToBytes(hashB64);\n  const derived = await deriveKey(password, salt, iterations);\n  return constantTimeEqual(derived, expected);\n}\n","// lib/settings.ts - 读取和更新后台系统设置（单管理员模型）\n// 数据保存在 SQL 表 app_settings，目前固定为 1 行。\n//\n// Internal to the package — not exposed via package.json exports. The\n// auth helpers (turnstile.ts, users.ts) call into the read functions;\n// admin pages in the starter import the update functions through a\n// re-export shim at `apps/moviebluebook/lib/settings.ts`.\n\nimport { cache } from \"react\";\nimport { workerEnv } from \"../../util/env\";\nimport { getDatabase } from \"../../platform/current\";\nimport {\n  buildTurnstilePublicConfig,\n  DEFAULT_TURNSTILE_PUBLIC_CONFIG,\n  isSchemaDriftError,\n} from \"./schema-guard\";\n\nexport type AppSettings = {\n  site_title: string;\n  google_enabled: 0 | 1;\n  google_client_id: string | null;\n  google_client_secret: string | null;\n  google_updated_at: string | null;\n  turnstile_enabled: 0 | 1;\n  turnstile_site_key: string | null;\n  turnstile_updated_at: string | null;\n  admin_email: string;\n  updated_at: string;\n};\n\ntype Row = {\n  site_title: string;\n  google_enabled: number;\n  google_client_id: string | null;\n  google_client_secret: string | null;\n  google_updated_at: string | null;\n  turnstile_enabled: number;\n  turnstile_site_key: string | null;\n  turnstile_updated_at: string | null;\n  admin_email: string;\n  updated_at: string;\n};\n\nconst DEFAULT_ADMIN_EMAIL = \"zhaofilms@gmail.com\";\n\nfunction rowToSettings(r: Row): AppSettings {\n  return {\n    site_title: r.site_title,\n    google_enabled: r.google_enabled === 1 ? 1 : 0,\n    google_client_id: r.google_client_id,\n    google_client_secret: r.google_client_secret,\n    google_updated_at: r.google_updated_at,\n    turnstile_enabled: r.turnstile_enabled === 1 ? 1 : 0,\n    turnstile_site_key: r.turnstile_site_key,\n    turnstile_updated_at: r.turnstile_updated_at,\n    admin_email: r.admin_email,\n    updated_at: r.updated_at,\n  };\n}\n\nconst getAppSettingsCached = cache(async (): Promise<AppSettings> => {\n  const row = await getDatabase().prepare(\n    `SELECT site_title, google_enabled, google_client_id, google_client_secret,\n            google_updated_at, turnstile_enabled, turnstile_site_key,\n            turnstile_updated_at, admin_email, updated_at\n       FROM app_settings WHERE id = 1`\n  ).first<Row>();\n  if (!row) {\n    // 极端情况：迁移未执行\n    return {\n      site_title: \"vinext Blog\",\n      google_enabled: 0,\n      google_client_id: null,\n      google_client_secret: null,\n      google_updated_at: null,\n      turnstile_enabled: 0,\n      turnstile_site_key: null,\n      turnstile_updated_at: null,\n      admin_email: DEFAULT_ADMIN_EMAIL,\n      updated_at: \"\",\n    };\n  }\n  return rowToSettings(row);\n});\n\nexport async function getAppSettings(): Promise<AppSettings> {\n  return getAppSettingsCached();\n}\n\n/** Turnstile 前端可见配置（site key 公开；secret 在 env）。 */\nexport async function getTurnstilePublicConfig(): Promise<{\n  enabled: boolean;\n  siteKey: string | null;\n  secretConfigured: boolean;\n}> {\n  try {\n    const s = await getAppSettings();\n    return buildTurnstilePublicConfig(s, workerEnv);\n  } catch (error) {\n    if (isSchemaDriftError(error)) {\n      console.error(\n        \"[settings] turnstile config unavailable due to schema drift; falling back to disabled state\",\n        error\n      );\n      return { ...DEFAULT_TURNSTILE_PUBLIC_CONFIG };\n    }\n    throw error;\n  }\n}\n\nexport async function updateTurnstileConfig(input: {\n  enabled: boolean;\n  siteKey: string;\n}): Promise<void> {\n  const enabled = input.enabled ? 1 : 0;\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET turnstile_enabled = ?,\n            turnstile_site_key = ?,\n            turnstile_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  )\n    .bind(enabled, input.siteKey || null)\n    .run();\n}\n\nexport async function disableTurnstileConfig(): Promise<void> {\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET turnstile_enabled = 0,\n            turnstile_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  ).run();\n}\n\n/** Google 登录实际配置：只有 enabled 且 id+secret 都存在才认为可用 */\nexport async function getGoogleOAuthConfig(): Promise<{\n  enabled: boolean;\n  clientId: string;\n  clientSecret: string;\n} | null> {\n  const s = await getAppSettings();\n  if (!s.google_enabled) return null;\n  if (!s.google_client_id || !s.google_client_secret) return null;\n  return {\n    enabled: true,\n    clientId: s.google_client_id,\n    clientSecret: s.google_client_secret,\n  };\n}\n\nexport async function updateGoogleOAuthConfig(input: {\n  enabled: boolean;\n  clientId: string;\n  clientSecret: string;\n}): Promise<void> {\n  const enabled = input.enabled ? 1 : 0;\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET google_enabled = ?,\n            google_client_id = ?,\n            google_client_secret = ?,\n            google_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  )\n    .bind(enabled, input.clientId, input.clientSecret)\n    .run();\n}\n\nexport async function clearGoogleOAuthConfig(): Promise<void> {\n  await getDatabase().prepare(\n    `UPDATE app_settings\n        SET google_enabled = 0,\n            google_client_id = NULL,\n            google_client_secret = NULL,\n            google_updated_at = datetime('now'),\n            updated_at = datetime('now')\n      WHERE id = 1`\n  ).run();\n}\n\nexport async function updateSiteTitle(title: string): Promise<void> {\n  await getDatabase().prepare(\n    `UPDATE app_settings SET site_title = ?, updated_at = datetime('now') WHERE id = 1`\n  )\n    .bind(title)\n    .run();\n}\n","// lib/env.ts - 集中获取 Cloudflare bindings\n// 用 cloudflare:workers 模块（workerd 内置），作为平台 adapter 的绑定入口\n\n/// <reference types=\"@cloudflare/workers-types\" />\nimport { env } from \"cloudflare:workers\";\n\nexport type AppEnv = {\n  DB: D1Database;\n  ASSETS: Fetcher;\n  IMAGES: ImagesBinding;\n  ASSETS_BUCKET?: R2Bucket;\n  CONTENT_CACHE?: KVNamespace;\n  ADMIN_PASSWORD: string;\n  ADMIN_EMAIL?: string;\n  SITE_URL?: string;\n  RESEND_API_KEY?: string;\n  RESEND_FROM?: string;\n  // Google OAuth 仍然兼容 Cloudflare Secret 作为兜底。\n  // 实际生效值以 app_settings.google_client_id / google_client_secret 为准。\n  GOOGLE_CLIENT_ID?: string;\n  GOOGLE_CLIENT_SECRET?: string;\n  /** Turnstile site key fallback when not stored in app_settings */\n  TURNSTILE_SITE_KEY?: string;\n  /** Turnstile secret — set via `wrangler secret put TURNSTILE_SECRET_KEY` */\n  TURNSTILE_SECRET_KEY?: string;\n  /** Notion integration token for the blog data source */\n  NOTION_TOKEN?: string;\n  /** Notion data source ID used by dataSources.query */\n  NOTION_DATA_SOURCE_ID?: string;\n  /** Notion data source ID for the public movie catalog */\n  NOTION_MOVIES_DATA_SOURCE_ID?: string;\n  /** Notion data source ID for localized movie copy */\n  NOTION_MOVIE_TRANSLATIONS_DATA_SOURCE_ID?: string;\n  /** Optional Notion API base URL for tests or proxies */\n  NOTION_API_BASE_URL?: string;\n  /** Optional Notion edit URL for admin handoff screens */\n  NOTION_EDIT_BASE_URL?: string;\n  /** Optional webhook verification token for Notion invalidation */\n  NOTION_WEBHOOK_VERIFICATION_TOKEN?: string;\n};\n\n// 强制类型：vinext 把 env 类型放在 env.d.ts（interface VinextEnv extends Env），\n// 但 TS server 经常解析不到。运行时一定有 DB，类型断言保证编译通过。\nexport const workerEnv = env as unknown as AppEnv;\n","import type { AppEnv } from \"../util/env\";\n\nexport type PlatformBindingEnv = Pick<\n  AppEnv,\n  \"ASSETS_BUCKET\" | \"CONTENT_CACHE\" | \"DB\" | \"IMAGES\"\n>;\n\nexport type StoredObject = {\n  body: ReadableStream;\n  size: number;\n  etag?: string;\n  contentType?: string;\n};\n\nexport type ObjectStoragePutOptions = {\n  contentType?: string;\n  cacheControl?: string;\n  metadata?: Record<string, string>;\n};\n\nexport type ObjectStorageListItem = {\n  key: string;\n  size: number;\n  uploaded: Date;\n};\n\nexport type ObjectStorageAdapter = {\n  kind: \"r2\";\n  get(key: string): Promise<StoredObject | null>;\n  put(\n    key: string,\n    value: ReadableStream | ArrayBuffer | ArrayBufferView | string | Blob,\n    options?: ObjectStoragePutOptions\n  ): Promise<void>;\n  delete(key: string): Promise<void>;\n  list(\n    options?: { prefix?: string; limit?: number }\n  ): Promise<ObjectStorageListItem[]>;\n};\n\nexport type ImageTransformOptions = {\n  width?: number;\n  format: \"image/avif\" | \"image/webp\";\n  quality: number;\n};\n\nexport type ImageTransformResult = {\n  body: ReadableStream;\n  contentType: string;\n  response(): Response;\n};\n\nexport type ImageTransformerAdapter = {\n  kind: \"cloudflare-images\" | \"external\";\n  transform(\n    body: ReadableStream,\n    options: ImageTransformOptions\n  ): Promise<ImageTransformResult>;\n};\n\nexport type PublicCacheAdapter = {\n  kind: \"cloudflare-cache\" | \"noop\" | \"external\";\n  match(key: string): Promise<Response | null>;\n  put(key: string, response: Response): Promise<void>;\n  delete(key: string): Promise<boolean>;\n};\n\nexport type KeyValueCacheGetOptions = {\n  cacheTtl?: number;\n};\n\nexport type KeyValueCachePutOptions = {\n  expirationTtl?: number;\n  metadata?: Record<string, string | number | boolean | null>;\n};\n\nexport type KeyValueCacheListOptions = {\n  prefix?: string;\n  limit?: number;\n  cursor?: string;\n};\n\nexport type KeyValueCacheListResult = {\n  keys: Array<{ name: string }>;\n  cursor?: string;\n  listComplete: boolean;\n};\n\nexport type KeyValueCacheAdapter = {\n  kind: \"workers-kv\" | \"noop\" | \"external\";\n  get<T = unknown>(\n    key: string,\n    options?: KeyValueCacheGetOptions\n  ): Promise<T | null>;\n  put<T = unknown>(\n    key: string,\n    value: T,\n    options?: KeyValueCachePutOptions\n  ): Promise<void>;\n  delete(key: string): Promise<void>;\n  list(options?: KeyValueCacheListOptions): Promise<KeyValueCacheListResult>;\n};\n\nexport type SqlValue = string | number | boolean | null;\n\nexport type SqlResult<T = Record<string, unknown>> = {\n  results?: T[];\n  success?: boolean;\n  meta?: {\n    changes?: number;\n    duration?: number;\n    last_row_id?: number;\n    rows_read?: number;\n    rows_written?: number;\n    [key: string]: unknown;\n  };\n};\n\nexport type SqlPreparedStatement = {\n  bind(...values: SqlValue[]): SqlPreparedStatement;\n  all<T = Record<string, unknown>>(): Promise<SqlResult<T>>;\n  first<T = Record<string, unknown>>(columnName?: string): Promise<T | null>;\n  run<T = Record<string, unknown>>(): Promise<SqlResult<T>>;\n};\n\nexport type SqlDatabaseAdapter = {\n  kind: \"d1\";\n  prepare(query: string): SqlPreparedStatement;\n  batch<T = Record<string, unknown>>(\n    statements: SqlPreparedStatement[]\n  ): Promise<SqlResult<T>[]>;\n};\n\nexport type RuntimePlatform = {\n  id: \"cloudflare-workers\";\n  database: SqlDatabaseAdapter | null;\n  objectStorage: ObjectStorageAdapter | null;\n  imageTransformer: ImageTransformerAdapter | null;\n  publicCache: PublicCacheAdapter | null;\n  keyValueCache: KeyValueCacheAdapter | null;\n};\n\ntype CloudflareCacheLike = Pick<Cache, \"match\" | \"put\" | \"delete\">;\ntype CloudflareKvLike = Pick<KVNamespace, \"get\" | \"put\" | \"delete\" | \"list\">;\n\nfunction cacheRequestForKey(key: string) {\n  return new Request(key, { method: \"GET\" });\n}\n\nexport function createCloudflarePublicCacheAdapter(\n  cache: CloudflareCacheLike\n): PublicCacheAdapter {\n  return {\n    kind: \"cloudflare-cache\",\n    async match(key) {\n      return (await cache.match(cacheRequestForKey(key))) ?? null;\n    },\n    put(key, response) {\n      return cache.put(cacheRequestForKey(key), response);\n    },\n    delete(key) {\n      return cache.delete(cacheRequestForKey(key));\n    },\n  };\n}\n\nexport function createNoopPublicCacheAdapter(kind: \"noop\" = \"noop\"): PublicCacheAdapter {\n  return {\n    kind,\n    async match() {\n      return null;\n    },\n    async put() {},\n    async delete() {\n      return false;\n    },\n  };\n}\n\nexport function createCloudflareKeyValueCacheAdapter(\n  namespace: CloudflareKvLike\n): KeyValueCacheAdapter {\n  return {\n    kind: \"workers-kv\",\n    async get<T = unknown>(\n      key: string,\n      options?: KeyValueCacheGetOptions\n    ): Promise<T | null> {\n      return (await namespace.get(key, {\n        type: \"json\",\n        cacheTtl: options?.cacheTtl,\n      })) as T | null;\n    },\n    async put(key, value, options) {\n      await namespace.put(key, JSON.stringify(value), {\n        expirationTtl: options?.expirationTtl,\n        metadata: options?.metadata,\n      });\n    },\n    delete(key) {\n      return namespace.delete(key);\n    },\n    async list(options) {\n      const result = await namespace.list({\n        prefix: options?.prefix,\n        limit: options?.limit,\n        cursor: options?.cursor,\n      });\n      return {\n        keys: result.keys.map((key) => ({ name: key.name })),\n        cursor: result.list_complete ? undefined : result.cursor,\n        listComplete: result.list_complete,\n      };\n    },\n  };\n}\n\nexport function createNoopKeyValueCacheAdapter(\n  kind: \"noop\" = \"noop\"\n): KeyValueCacheAdapter {\n  return {\n    kind,\n    async get() {\n      return null;\n    },\n    async put() {},\n    async delete() {},\n    async list() {\n      return { keys: [], listComplete: true };\n    },\n  };\n}\n\nfunction r2ObjectToStoredObject(object: R2ObjectBody): StoredObject {\n  return {\n    body: object.body,\n    size: object.size,\n    etag: object.etag,\n    contentType: object.httpMetadata?.contentType,\n  };\n}\n\nexport function createCloudflareRuntimePlatform(\n  env: PlatformBindingEnv,\n  options?: { publicCache?: CloudflareCacheLike | null }\n): RuntimePlatform {\n  const database: SqlDatabaseAdapter | null = env.DB\n    ? ({\n        kind: \"d1\",\n        prepare(query: string) {\n          return env.DB.prepare(query) as unknown as SqlPreparedStatement;\n        },\n        async batch(statements: SqlPreparedStatement[]) {\n          return (await env.DB.batch(\n            statements as unknown as D1PreparedStatement[]\n          )) as unknown as SqlResult<Record<string, unknown>>[];\n        },\n      } as unknown as SqlDatabaseAdapter)\n    : null;\n\n  const objectStorage: ObjectStorageAdapter | null = env.ASSETS_BUCKET\n    ? {\n        kind: \"r2\",\n        async get(key) {\n          const object = await env.ASSETS_BUCKET?.get(key);\n          return object ? r2ObjectToStoredObject(object) : null;\n        },\n        async put(key, value, options) {\n          await env.ASSETS_BUCKET?.put(key, value, {\n            httpMetadata: {\n              contentType: options?.contentType,\n              cacheControl: options?.cacheControl,\n            },\n            customMetadata: options?.metadata,\n          });\n        },\n        async delete(key) {\n          await env.ASSETS_BUCKET?.delete(key);\n        },\n        async list(options) {\n          const listed = await env.ASSETS_BUCKET?.list({\n            prefix: options?.prefix,\n            limit: options?.limit,\n          });\n          return (\n            listed?.objects.map((object) => ({\n              key: object.key,\n              size: object.size,\n              uploaded: object.uploaded,\n            })) ?? []\n          );\n        },\n      }\n    : null;\n\n  const imageTransformer: ImageTransformerAdapter | null = env.IMAGES\n    ? {\n        kind: \"cloudflare-images\",\n        async transform(body, options) {\n          const result = await env.IMAGES.input(body)\n            .transform(options.width ? { width: options.width } : {})\n            .output({\n              format: options.format,\n              quality: options.quality,\n            });\n          return {\n            body: result.image(),\n            contentType: result.contentType(),\n            response: () => result.response(),\n          };\n        },\n      }\n    : null;\n\n  const keyValueCache: KeyValueCacheAdapter | null = env.CONTENT_CACHE\n    ? createCloudflareKeyValueCacheAdapter(env.CONTENT_CACHE)\n    : null;\n\n  return {\n    id: \"cloudflare-workers\",\n    database,\n    objectStorage,\n    imageTransformer,\n    keyValueCache,\n    publicCache: options?.publicCache\n      ? createCloudflarePublicCacheAdapter(options.publicCache)\n      : null,\n  };\n}\n","import { workerEnv } from \"../util/env\";\nimport {\n  createCloudflarePublicCacheAdapter,\n  createCloudflareRuntimePlatform,\n} from \"./runtime\";\n\nfunction getDefaultCloudflareCache() {\n  const globalWithCaches = globalThis as typeof globalThis & {\n    caches?: CacheStorage & { default?: Cache };\n  };\n  return globalWithCaches.caches?.default ?? null;\n}\n\nexport function getRuntimePlatform() {\n  return createCloudflareRuntimePlatform(workerEnv, {\n    publicCache: getDefaultCloudflareCache(),\n  });\n}\n\nexport function getDatabase() {\n  const database = getRuntimePlatform().database;\n  if (!database) {\n    throw new Error(\"SQL database binding not configured\");\n  }\n  return database;\n}\n\nexport function getPublicCache() {\n  const cache = getDefaultCloudflareCache();\n  if (!cache) {\n    throw new Error(\"Cloudflare cache binding not configured\");\n  }\n  return createCloudflarePublicCacheAdapter(cache);\n}\n","import {\n  getPublicCache as getCloudflarePublicCache,\n  getRuntimePlatform as getCloudflareRuntimePlatform,\n} from \"./cloudflare-runtime\";\nimport { currentRuntimeId } from \"./selection\";\n\nexport function getRuntimePlatform() {\n  return getCloudflareRuntimePlatform();\n}\n\nexport function getDatabase() {\n  const platform = getRuntimePlatform();\n  const database = platform.database;\n  if (!database) {\n    throw new Error(`SQL database adapter not configured for ${platform.id}`);\n  }\n  return database;\n}\n\nexport function getPublicCache() {\n  return getCloudflarePublicCache();\n}\n\nexport function getKeyValueCache() {\n  return getRuntimePlatform().keyValueCache;\n}\n\nexport const runtimeSelection = {\n  currentRuntimeId,\n};\n","// lib/admin.ts - 单管理员身份识别\n// 设计：固定 admin_email = app_settings.admin_email（默认 zhaofilms@gmail.com）\n// 任何登录方式下，邮箱匹配即视为管理员。\n//\n// Internal to the package — not exposed via package.json exports.\n// The auth helpers (users.ts) call `isAdminEmail` to decide whether a\n// newly registered user gets the `admin` role. The starter still\n// re-exports this through `apps/moviebluebook/lib/admin.ts` for backward\n// compatibility with its own admin pages and tests.\n\nimport { getAppSettings } from \"./settings\";\nimport { getDatabase } from \"../../platform/current\";\n\nexport const DEFAULT_ADMIN_EMAIL = \"zhaofilms@gmail.com\";\n\nexport function normalizeEmail(email: string): string {\n  return email.trim().toLowerCase();\n}\n\nexport async function isAdminEmail(email: string): Promise<boolean> {\n  if (!email) return false;\n  const settings = await getAppSettings();\n  return normalizeEmail(email) === normalizeEmail(settings.admin_email);\n}\n\n/**\n * 提升某邮箱为管理员（仅在系统启动时、且匹配 admin_email 时调用）。\n * 实际上是把 users.role 置为 'admin'，并清空其它冲突状态。\n */\nexport async function ensureAdminUser(email: string): Promise<void> {\n  const normalized = normalizeEmail(email);\n  if (!(await isAdminEmail(normalized))) return;\n  await getDatabase().prepare(\n    `UPDATE users SET role = 'admin' WHERE email = ?`\n  ).bind(normalized).run();\n}\n","// auth/users.ts - user persistence for Google OAuth and email/password auth\n//\n// Internal-only module of the auth feature. The exported functions back\n// the email/password registration flow, Google OAuth upserts, the admin\n// user-management API, and the bootstrap that creates the first admin\n// account. Table names and database binding come from the platform\n// runtime (`getDatabase`) which is configured by the consuming app.\n\nimport { hashPassword, verifyPassword } from \"./passwords\";\nimport { isAdminEmail } from \"../internal/admin/admin\";\nimport { getAppSettings } from \"../internal/admin/settings\";\nimport { getDatabase } from \"../platform/current\";\nimport type { SessionUser } from \"./session\";\n\nexport type UserRole = \"user\" | \"vip\" | \"admin\";\nexport type UserListItem = User & { post_count: number };\n\nexport type User = {\n  id: number;\n  email: string;\n  name: string | null;\n  picture: string | null;\n  google_sub: string | null;\n  password_hash: string | null;\n  email_verified: number;\n  email_verify_token: string | null;\n  email_verify_expires_at: string | null;\n  password_reset_token: string | null;\n  password_reset_expires_at: string | null;\n  session_rev: number;\n  role: UserRole | null;\n  created_at: string;\n  last_seen_at: string;\n};\n\nfunction normalizeEmail(email: string): string {\n  return email.trim().toLowerCase();\n}\n\nasync function defaultRoleFor(email: string): Promise<\"user\" | \"admin\"> {\n  return (await isAdminEmail(email)) ? \"admin\" : \"user\";\n}\n\nexport function normalizeUserRole(role: string | null | undefined): UserRole {\n  if (role === \"admin\" || role === \"vip\") return role;\n  return \"user\";\n}\n\nfunction createRandomToken(): string {\n  return [...crypto.getRandomValues(new Uint8Array(24))]\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\nexport function userToSession(user: User): SessionUser {\n  return {\n    uid: user.id,\n    email: user.email,\n    name: user.name,\n    picture: user.picture,\n    rev: user.session_rev ?? 0,\n  };\n}\n\nexport async function upsertGoogleUser(input: {\n  email: string;\n  name: string;\n  picture: string;\n  googleSub: string;\n}): Promise<User> {\n  const db = getDatabase();\n  const email = normalizeEmail(input.email);\n\n  const existing = await db.prepare(\n    `SELECT * FROM users WHERE google_sub = ? OR email = ? LIMIT 1`\n  )\n    .bind(input.googleSub, email)\n    .first<User>();\n\n  if (existing) {\n    await db.prepare(\n      `UPDATE users\n       SET email = ?, name = ?, picture = ?, google_sub = ?, email_verified = 1,\n           email_verify_token = NULL, email_verify_expires_at = NULL,\n           last_seen_at = datetime('now')\n       WHERE id = ?`\n    )\n      .bind(email, input.name, input.picture, input.googleSub, existing.id)\n      .run();\n  } else {\n    const role = await defaultRoleFor(email);\n    await db.prepare(\n      `INSERT INTO users (\n        email, name, picture, google_sub, email_verified, role, last_seen_at\n      ) VALUES (?, ?, ?, ?, 1, ?, datetime('now'))`\n    )\n      .bind(email, input.name, input.picture, input.googleSub, role)\n      .run();\n  }\n\n  if (await isAdminEmail(email)) {\n    await db.prepare(\n      `UPDATE users SET role = 'admin' WHERE email = ?`\n    ).bind(email).run();\n  }\n\n  const user = await getUserByEmail(email);\n  if (!user) throw new Error(\"User upsert failed\");\n  return user;\n}\n\nexport async function createEmailUser(input: {\n  email: string;\n  password: string;\n}): Promise<\n  | { ok: true; user: User; verifyToken: string }\n  | { ok: false; reason: \"exists\" }\n> {\n  const email = normalizeEmail(input.email);\n  const existing = await getUserByEmail(email);\n  if (existing) {\n    return { ok: false, reason: \"exists\" };\n  }\n\n  const passwordHash = await hashPassword(input.password);\n  const verifyToken = createRandomToken();\n  const verifyExpiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24).toISOString();\n\n  const role = await defaultRoleFor(email);\n  const db = getDatabase();\n  await db.prepare(\n    `INSERT INTO users (\n      email, password_hash, email_verified, email_verify_token,\n      email_verify_expires_at, role, last_seen_at\n    ) VALUES (?, ?, 0, ?, ?, ?, datetime('now'))`\n  )\n    .bind(email, passwordHash, verifyToken, verifyExpiresAt, role)\n    .run();\n\n  if (role === \"admin\") {\n    await db.prepare(\n      `UPDATE users SET role = 'admin' WHERE email = ?`\n    ).bind(email).run();\n  }\n\n  const user = await getUserByEmail(email);\n  if (!user) throw new Error(\"User creation failed\");\n  return { ok: true, user, verifyToken };\n}\n\nexport async function verifyEmailUser(token: string): Promise<User | null> {\n  const user = await getDatabase().prepare(\n    `SELECT * FROM users WHERE email_verify_token = ?`\n  )\n    .bind(token)\n    .first<User>();\n\n  if (!user || !user.email_verify_expires_at) return null;\n  if (new Date(user.email_verify_expires_at).getTime() < Date.now()) {\n    return null;\n  }\n\n  await getDatabase().prepare(\n    `UPDATE users\n     SET email_verified = 1,\n         email_verify_token = NULL,\n         email_verify_expires_at = NULL,\n         last_seen_at = datetime('now')\n     WHERE id = ?`\n  )\n    .bind(user.id)\n    .run();\n\n  return getUserByEmail(user.email);\n}\n\nexport async function issueVerificationToken(\n  email: string\n): Promise<\n  | { ok: true; token: string; user: User }\n  | { ok: false; reason: \"not_found\" | \"already_verified\" | \"no_password\" }\n> {\n  const user = await getUserByEmail(email);\n  if (!user) return { ok: false, reason: \"not_found\" };\n  if (!user.password_hash) return { ok: false, reason: \"no_password\" };\n  if (user.email_verified) return { ok: false, reason: \"already_verified\" };\n\n  const verifyToken = createRandomToken();\n  const verifyExpiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24).toISOString();\n\n  await getDatabase().prepare(\n    `UPDATE users\n     SET email_verify_token = ?, email_verify_expires_at = ?\n     WHERE id = ?`\n  )\n    .bind(verifyToken, verifyExpiresAt, user.id)\n    .run();\n\n  const updated = await getUserByEmail(email);\n  if (!updated) return { ok: false, reason: \"not_found\" };\n  return { ok: true, token: verifyToken, user: updated };\n}\n\nexport async function issuePasswordResetToken(\n  email: string\n): Promise<\n  | { ok: true; token: string; user: User }\n  | { ok: false; reason: \"not_found\" | \"no_password\" | \"unverified\" }\n> {\n  const user = await getUserByEmail(email);\n  if (!user || !user.password_hash) {\n    return { ok: false, reason: \"not_found\" };\n  }\n  if (!user.email_verified) {\n    return { ok: false, reason: \"unverified\" };\n  }\n\n  const resetToken = createRandomToken();\n  const resetExpiresAt = new Date(Date.now() + 1000 * 60 * 60).toISOString();\n\n  await getDatabase().prepare(\n    `UPDATE users\n     SET password_reset_token = ?, password_reset_expires_at = ?\n     WHERE id = ?`\n  )\n    .bind(resetToken, resetExpiresAt, user.id)\n    .run();\n\n  const updated = await getUserByEmail(email);\n  if (!updated) return { ok: false, reason: \"not_found\" };\n  return { ok: true, token: resetToken, user: updated };\n}\n\nexport async function resetPasswordWithToken(input: {\n  token: string;\n  password: string;\n}): Promise<\n  | { ok: true; user: User }\n  | { ok: false; reason: \"invalid\" }\n> {\n  const user = await getDatabase().prepare(\n    `SELECT * FROM users WHERE password_reset_token = ?`\n  )\n    .bind(input.token)\n    .first<User>();\n\n  if (!user || !user.password_reset_expires_at) {\n    return { ok: false, reason: \"invalid\" };\n  }\n  if (new Date(user.password_reset_expires_at).getTime() < Date.now()) {\n    return { ok: false, reason: \"invalid\" };\n  }\n\n  const passwordHash = await hashPassword(input.password);\n  await getDatabase().prepare(\n    `UPDATE users\n     SET password_hash = ?,\n         password_reset_token = NULL,\n         password_reset_expires_at = NULL,\n         session_rev = session_rev + 1,\n         last_seen_at = datetime('now')\n     WHERE id = ?`\n  )\n    .bind(passwordHash, user.id)\n    .run();\n\n  const updated = await getUserById(user.id);\n  if (!updated) return { ok: false, reason: \"invalid\" };\n  return { ok: true, user: updated };\n}\n\nexport async function changeUserPassword(input: {\n  userId: number;\n  currentPassword: string;\n  newPassword: string;\n}): Promise<\n  | { ok: true; user: User }\n  | { ok: false; reason: \"invalid\" | \"no_password\" }\n> {\n  const user = await getUserById(input.userId);\n  if (!user || !user.password_hash) {\n    return { ok: false, reason: \"no_password\" };\n  }\n\n  const matches = await verifyPassword(\n    input.currentPassword,\n    user.password_hash\n  );\n  if (!matches) {\n    return { ok: false, reason: \"invalid\" };\n  }\n\n  const passwordHash = await hashPassword(input.newPassword);\n  await getDatabase().prepare(\n    `UPDATE users\n     SET password_hash = ?,\n         session_rev = session_rev + 1,\n         last_seen_at = datetime('now')\n     WHERE id = ?`\n  )\n    .bind(passwordHash, user.id)\n    .run();\n\n  const updated = await getUserById(user.id);\n  if (!updated) return { ok: false, reason: \"invalid\" };\n  return { ok: true, user: updated };\n}\n\nexport async function authenticateEmailUser(input: {\n  email: string;\n  password: string;\n}): Promise<\n  | { ok: true; user: User }\n  | { ok: false; reason: \"invalid\" | \"unverified\" }\n> {\n  const email = normalizeEmail(input.email);\n  const user = await getUserByEmail(email);\n  if (!user || !user.password_hash) {\n    return { ok: false, reason: \"invalid\" };\n  }\n\n  const matches = await verifyPassword(input.password, user.password_hash);\n  if (!matches) {\n    return { ok: false, reason: \"invalid\" };\n  }\n  if (!user.email_verified) {\n    return { ok: false, reason: \"unverified\" };\n  }\n\n  await getDatabase().prepare(\n    `UPDATE users SET last_seen_at = datetime('now') WHERE id = ?`\n  )\n    .bind(user.id)\n    .run();\n\n  return { ok: true, user: { ...user, email } };\n}\n\nexport async function getUserByEmail(email: string): Promise<User | null> {\n  return await getDatabase().prepare(`SELECT * FROM users WHERE email = ?`)\n    .bind(normalizeEmail(email))\n    .first<User>();\n}\n\nexport async function getUserById(id: number): Promise<User | null> {\n  return await getDatabase().prepare(`SELECT * FROM users WHERE id = ?`)\n    .bind(id)\n    .first<User>();\n}\n\nexport async function listUsers(limit = 100): Promise<User[]> {\n  const { results } = await getDatabase().prepare(\n    `SELECT * FROM users ORDER BY created_at DESC LIMIT ?`\n  )\n    .bind(limit)\n    .all<User>();\n  return results || [];\n}\n\nexport async function listUsersWithPostCounts(\n  limit = 100\n): Promise<UserListItem[]> {\n  const { results } = await getDatabase().prepare(\n    `SELECT u.*,\n            (SELECT COUNT(*) FROM posts p WHERE p.owner_email = u.email) AS post_count\n       FROM users u\n      ORDER BY u.created_at DESC\n      LIMIT ?`\n  )\n    .bind(limit)\n    .all<UserListItem>();\n  return results || [];\n}\n\n/** 递增 session_rev，使该用户所有已签发 cookie 立即失效。 */\nexport async function revokeUserSessions(userId: number): Promise<boolean> {\n  const user = await getUserById(userId);\n  if (!user) return false;\n  await getDatabase().prepare(\n    `UPDATE users SET session_rev = session_rev + 1 WHERE id = ?`\n  )\n    .bind(userId)\n    .run();\n  return true;\n}\n\nexport async function setUserRole(\n  userId: number,\n  role: Exclude<UserRole, \"admin\">\n): Promise<\n  | { ok: true; user: User }\n  | { ok: false; reason: \"not_found\" | \"is_admin\" }\n> {\n  const user = await getUserById(userId);\n  if (!user) return { ok: false, reason: \"not_found\" };\n  if (await isAdminEmail(user.email)) {\n    return { ok: false, reason: \"is_admin\" };\n  }\n\n  await getDatabase().prepare(\n    `UPDATE users\n        SET role = ?,\n            last_seen_at = datetime('now')\n      WHERE id = ?`\n  )\n    .bind(role, userId)\n    .run();\n\n  const updated = await getUserById(userId);\n  if (!updated) return { ok: false, reason: \"not_found\" };\n  return { ok: true, user: updated };\n}\n\nexport async function deleteUserAccount(userId: number): Promise<\n  | { ok: true; email: string }\n  | { ok: false; reason: \"not_found\" | \"is_admin\" }\n> {\n  const user = await getUserById(userId);\n  if (!user) return { ok: false, reason: \"not_found\" };\n  if (await isAdminEmail(user.email)) {\n    return { ok: false, reason: \"is_admin\" };\n  }\n\n  const settings = await getAppSettings();\n  const adminEmail = settings.admin_email;\n\n  const db = getDatabase();\n  await db.batch([\n    db.prepare(\n      `UPDATE posts SET owner_email = ? WHERE owner_email = ?`\n    ).bind(adminEmail, user.email),\n    db.prepare(`DELETE FROM users WHERE id = ?`).bind(userId),\n  ]);\n\n  return { ok: true, email: user.email };\n}\n"],"mappings":";AAGA,IAAM,cAAc;AAEpB,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AAEnB,SAAS,cAAc,OAA2B;AAChD,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AACnD,SAAO,KAAK,GAAG;AACjB;AAEA,SAAS,cAAc,OAA2B;AAChD,QAAM,MAAM,KAAK,KAAK;AACtB,QAAM,QAAQ,IAAI,WAAW,IAAI,MAAM;AACvC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,OAAM,CAAC,IAAI,IAAI,WAAW,CAAC;AAChE,SAAO;AACT;AAEA,eAAe,UACb,UACA,MACA,YACqB;AACrB,QAAM,iBAAiB,WAAW,KAAK,IAAI;AAC3C,QAAM,UAAU,MAAM,OAAO,OAAO;AAAA,IAClC;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,IACjC;AAAA,IACA;AAAA,IACA,CAAC,YAAY;AAAA,EACf;AACA,QAAM,UAAU,MAAM,OAAO,OAAO;AAAA,IAClC;AAAA,MACE,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,IAAI,WAAW,OAAO;AAC/B;AAEA,eAAe,kBACb,MACA,OACkB;AAClB,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAQ,KAAK,CAAC,IAAK,MAAM,CAAC;AAAA,EAC5B;AACA,SAAO,SAAS;AAClB;AAEA,eAAsB,aAAa,UAAmC;AACpE,QAAM,OAAO,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC9D,QAAM,UAAU,MAAM,UAAU,UAAU,MAAM,iBAAiB;AACjE,SAAO;AAAA,IACL;AAAA,IACA,OAAO,iBAAiB;AAAA,IACxB,cAAc,IAAI;AAAA,IAClB,cAAc,OAAO;AAAA,EACvB,EAAE,KAAK,GAAG;AACZ;AAWA,eAAsB,eACpB,UACA,YACkB;AAClB,QAAM,CAAC,QAAQ,eAAe,SAAS,OAAO,IAAI,WAAW,MAAM,GAAG;AACtE,MACE,WAAW,eACX,CAAC,iBACD,CAAC,WACD,CAAC,SACD;AACA,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,OAAO,aAAa;AACvC,MAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc,EAAG,QAAO;AAE5D,QAAM,OAAO,cAAc,OAAO;AAClC,QAAM,WAAW,cAAc,OAAO;AACtC,QAAM,UAAU,MAAM,UAAU,UAAU,MAAM,UAAU;AAC1D,SAAO,kBAAkB,SAAS,QAAQ;AAC5C;;;AC5FA,SAAS,aAAa;;;ACJtB,SAAS,WAAW;AAuCb,IAAM,YAAY;;;ACsGzB,SAAS,mBAAmB,KAAa;AACvC,SAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,MAAM,CAAC;AAC3C;AAEO,SAAS,mCACdA,QACoB;AACpB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,MAAM,KAAK;AACf,aAAQ,MAAMA,OAAM,MAAM,mBAAmB,GAAG,CAAC,KAAM;AAAA,IACzD;AAAA,IACA,IAAI,KAAK,UAAU;AACjB,aAAOA,OAAM,IAAI,mBAAmB,GAAG,GAAG,QAAQ;AAAA,IACpD;AAAA,IACA,OAAO,KAAK;AACV,aAAOA,OAAM,OAAO,mBAAmB,GAAG,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;AAeO,SAAS,qCACd,WACsB;AACtB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,IACJ,KACA,SACmB;AACnB,aAAQ,MAAM,UAAU,IAAI,KAAK;AAAA,QAC/B,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,IAAI,KAAK,OAAO,SAAS;AAC7B,YAAM,UAAU,IAAI,KAAK,KAAK,UAAU,KAAK,GAAG;AAAA,QAC9C,eAAe,SAAS;AAAA,QACxB,UAAU,SAAS;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,IACA,OAAO,KAAK;AACV,aAAO,UAAU,OAAO,GAAG;AAAA,IAC7B;AAAA,IACA,MAAM,KAAK,SAAS;AAClB,YAAM,SAAS,MAAM,UAAU,KAAK;AAAA,QAClC,QAAQ,SAAS;AAAA,QACjB,OAAO,SAAS;AAAA,QAChB,QAAQ,SAAS;AAAA,MACnB,CAAC;AACD,aAAO;AAAA,QACL,MAAM,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,KAAK,EAAE;AAAA,QACnD,QAAQ,OAAO,gBAAgB,SAAY,OAAO;AAAA,QAClD,cAAc,OAAO;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAkBA,SAAS,uBAAuB,QAAoC;AAClE,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,MAAM,OAAO;AAAA,IACb,aAAa,OAAO,cAAc;AAAA,EACpC;AACF;AAEO,SAAS,gCACdC,MACA,SACiB;AACjB,QAAM,WAAsCA,KAAI,KAC3C;AAAA,IACC,MAAM;AAAA,IACN,QAAQ,OAAe;AACrB,aAAOA,KAAI,GAAG,QAAQ,KAAK;AAAA,IAC7B;AAAA,IACA,MAAM,MAAM,YAAoC;AAC9C,aAAQ,MAAMA,KAAI,GAAG;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF,IACA;AAEJ,QAAM,gBAA6CA,KAAI,gBACnD;AAAA,IACE,MAAM;AAAA,IACN,MAAM,IAAI,KAAK;AACb,YAAM,SAAS,MAAMA,KAAI,eAAe,IAAI,GAAG;AAC/C,aAAO,SAAS,uBAAuB,MAAM,IAAI;AAAA,IACnD;AAAA,IACA,MAAM,IAAI,KAAK,OAAOC,UAAS;AAC7B,YAAMD,KAAI,eAAe,IAAI,KAAK,OAAO;AAAA,QACvC,cAAc;AAAA,UACZ,aAAaC,UAAS;AAAA,UACtB,cAAcA,UAAS;AAAA,QACzB;AAAA,QACA,gBAAgBA,UAAS;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,IACA,MAAM,OAAO,KAAK;AAChB,YAAMD,KAAI,eAAe,OAAO,GAAG;AAAA,IACrC;AAAA,IACA,MAAM,KAAKC,UAAS;AAClB,YAAM,SAAS,MAAMD,KAAI,eAAe,KAAK;AAAA,QAC3C,QAAQC,UAAS;AAAA,QACjB,OAAOA,UAAS;AAAA,MAClB,CAAC;AACD,aACE,QAAQ,QAAQ,IAAI,CAAC,YAAY;AAAA,QAC/B,KAAK,OAAO;AAAA,QACZ,MAAM,OAAO;AAAA,QACb,UAAU,OAAO;AAAA,MACnB,EAAE,KAAK,CAAC;AAAA,IAEZ;AAAA,EACF,IACA;AAEJ,QAAM,mBAAmDD,KAAI,SACzD;AAAA,IACE,MAAM;AAAA,IACN,MAAM,UAAU,MAAMC,UAAS;AAC7B,YAAM,SAAS,MAAMD,KAAI,OAAO,MAAM,IAAI,EACvC,UAAUC,SAAQ,QAAQ,EAAE,OAAOA,SAAQ,MAAM,IAAI,CAAC,CAAC,EACvD,OAAO;AAAA,QACN,QAAQA,SAAQ;AAAA,QAChB,SAASA,SAAQ;AAAA,MACnB,CAAC;AACH,aAAO;AAAA,QACL,MAAM,OAAO,MAAM;AAAA,QACnB,aAAa,OAAO,YAAY;AAAA,QAChC,UAAU,MAAM,OAAO,SAAS;AAAA,MAClC;AAAA,IACF;AAAA,EACF,IACA;AAEJ,QAAM,gBAA6CD,KAAI,gBACnD,qCAAqCA,KAAI,aAAa,IACtD;AAEJ,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,SAAS,cAClB,mCAAmC,QAAQ,WAAW,IACtD;AAAA,EACN;AACF;;;AClUA,SAAS,4BAA4B;AACnC,QAAM,mBAAmB;AAGzB,SAAO,iBAAiB,QAAQ,WAAW;AAC7C;AAEO,SAAS,qBAAqB;AACnC,SAAO,gCAAgC,WAAW;AAAA,IAChD,aAAa,0BAA0B;AAAA,EACzC,CAAC;AACH;;;ACXO,SAASE,sBAAqB;AACnC,SAAO,mBAA6B;AACtC;AAEO,SAAS,cAAc;AAC5B,QAAM,WAAWA,oBAAmB;AACpC,QAAM,WAAW,SAAS;AAC1B,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,2CAA2C,SAAS,EAAE,EAAE;AAAA,EAC1E;AACA,SAAO;AACT;;;AJ0BA,IAAM,sBAAsB;AAE5B,SAAS,cAAc,GAAqB;AAC1C,SAAO;AAAA,IACL,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE,mBAAmB,IAAI,IAAI;AAAA,IAC7C,kBAAkB,EAAE;AAAA,IACpB,sBAAsB,EAAE;AAAA,IACxB,mBAAmB,EAAE;AAAA,IACrB,mBAAmB,EAAE,sBAAsB,IAAI,IAAI;AAAA,IACnD,oBAAoB,EAAE;AAAA,IACtB,sBAAsB,EAAE;AAAA,IACxB,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,EAChB;AACF;AAEA,IAAM,uBAAuB,MAAM,YAAkC;AACnE,QAAM,MAAM,MAAM,YAAY,EAAE;AAAA,IAC9B;AAAA;AAAA;AAAA;AAAA,EAIF,EAAE,MAAW;AACb,MAAI,CAAC,KAAK;AAER,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,gBAAgB;AAAA,MAChB,kBAAkB;AAAA,MAClB,sBAAsB;AAAA,MACtB,mBAAmB;AAAA,MACnB,mBAAmB;AAAA,MACnB,oBAAoB;AAAA,MACpB,sBAAsB;AAAA,MACtB,aAAa;AAAA,MACb,YAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,cAAc,GAAG;AAC1B,CAAC;AAED,eAAsB,iBAAuC;AAC3D,SAAO,qBAAqB;AAC9B;;;AKxEO,SAAS,eAAe,OAAuB;AACpD,SAAO,MAAM,KAAK,EAAE,YAAY;AAClC;AAEA,eAAsB,aAAa,OAAiC;AAClE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,WAAW,MAAM,eAAe;AACtC,SAAO,eAAe,KAAK,MAAM,eAAe,SAAS,WAAW;AACtE;;;ACYA,SAASC,gBAAe,OAAuB;AAC7C,SAAO,MAAM,KAAK,EAAE,YAAY;AAClC;AAEA,eAAe,eAAe,OAA0C;AACtE,SAAQ,MAAM,aAAa,KAAK,IAAK,UAAU;AACjD;AAEO,SAAS,kBAAkB,MAA2C;AAC3E,MAAI,SAAS,WAAW,SAAS,MAAO,QAAO;AAC/C,SAAO;AACT;AAEA,SAAS,oBAA4B;AACnC,SAAO,CAAC,GAAG,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,EAClD,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACZ;AAEO,SAAS,cAAc,MAAyB;AACrD,SAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,KAAK,KAAK,eAAe;AAAA,EAC3B;AACF;AAEA,eAAsB,iBAAiB,OAKrB;AAChB,QAAM,KAAK,YAAY;AACvB,QAAM,QAAQA,gBAAe,MAAM,KAAK;AAExC,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,EACF,EACG,KAAK,MAAM,WAAW,KAAK,EAC3B,MAAY;AAEf,MAAI,UAAU;AACZ,UAAM,GAAG;AAAA,MACP;AAAA;AAAA;AAAA;AAAA;AAAA,IAKF,EACG,KAAK,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,WAAW,SAAS,EAAE,EACnE,IAAI;AAAA,EACT,OAAO;AACL,UAAM,OAAO,MAAM,eAAe,KAAK;AACvC,UAAM,GAAG;AAAA,MACP;AAAA;AAAA;AAAA,IAGF,EACG,KAAK,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,WAAW,IAAI,EAC5D,IAAI;AAAA,EACT;AAEA,MAAI,MAAM,aAAa,KAAK,GAAG;AAC7B,UAAM,GAAG;AAAA,MACP;AAAA,IACF,EAAE,KAAK,KAAK,EAAE,IAAI;AAAA,EACpB;AAEA,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,oBAAoB;AAC/C,SAAO;AACT;AAEA,eAAsB,gBAAgB,OAMpC;AACA,QAAM,QAAQA,gBAAe,MAAM,KAAK;AACxC,QAAM,WAAW,MAAM,eAAe,KAAK;AAC3C,MAAI,UAAU;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS;AAAA,EACvC;AAEA,QAAM,eAAe,MAAM,aAAa,MAAM,QAAQ;AACtD,QAAM,cAAc,kBAAkB;AACtC,QAAM,kBAAkB,IAAI,KAAK,KAAK,IAAI,IAAI,MAAO,KAAK,KAAK,EAAE,EAAE,YAAY;AAE/E,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,QAAM,KAAK,YAAY;AACvB,QAAM,GAAG;AAAA,IACP;AAAA;AAAA;AAAA;AAAA,EAIF,EACG,KAAK,OAAO,cAAc,aAAa,iBAAiB,IAAI,EAC5D,IAAI;AAEP,MAAI,SAAS,SAAS;AACpB,UAAM,GAAG;AAAA,MACP;AAAA,IACF,EAAE,KAAK,KAAK,EAAE,IAAI;AAAA,EACpB;AAEA,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,sBAAsB;AACjD,SAAO,EAAE,IAAI,MAAM,MAAM,YAAY;AACvC;AAEA,eAAsB,gBAAgB,OAAqC;AACzE,QAAM,OAAO,MAAM,YAAY,EAAE;AAAA,IAC/B;AAAA,EACF,EACG,KAAK,KAAK,EACV,MAAY;AAEf,MAAI,CAAC,QAAQ,CAAC,KAAK,wBAAyB,QAAO;AACnD,MAAI,IAAI,KAAK,KAAK,uBAAuB,EAAE,QAAQ,IAAI,KAAK,IAAI,GAAG;AACjE,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMF,EACG,KAAK,KAAK,EAAE,EACZ,IAAI;AAEP,SAAO,eAAe,KAAK,KAAK;AAClC;AAEA,eAAsB,uBACpB,OAIA;AACA,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,MAAI,CAAC,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACnD,MAAI,CAAC,KAAK,cAAe,QAAO,EAAE,IAAI,OAAO,QAAQ,cAAc;AACnE,MAAI,KAAK,eAAgB,QAAO,EAAE,IAAI,OAAO,QAAQ,mBAAmB;AAExE,QAAM,cAAc,kBAAkB;AACtC,QAAM,kBAAkB,IAAI,KAAK,KAAK,IAAI,IAAI,MAAO,KAAK,KAAK,EAAE,EAAE,YAAY;AAE/E,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA;AAAA;AAAA,EAGF,EACG,KAAK,aAAa,iBAAiB,KAAK,EAAE,EAC1C,IAAI;AAEP,QAAM,UAAU,MAAM,eAAe,KAAK;AAC1C,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACtD,SAAO,EAAE,IAAI,MAAM,OAAO,aAAa,MAAM,QAAQ;AACvD;AAEA,eAAsB,wBACpB,OAIA;AACA,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,MAAI,CAAC,QAAQ,CAAC,KAAK,eAAe;AAChC,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,MAAI,CAAC,KAAK,gBAAgB;AACxB,WAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC3C;AAEA,QAAM,aAAa,kBAAkB;AACrC,QAAM,iBAAiB,IAAI,KAAK,KAAK,IAAI,IAAI,MAAO,KAAK,EAAE,EAAE,YAAY;AAEzE,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA;AAAA;AAAA,EAGF,EACG,KAAK,YAAY,gBAAgB,KAAK,EAAE,EACxC,IAAI;AAEP,QAAM,UAAU,MAAM,eAAe,KAAK;AAC1C,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACtD,SAAO,EAAE,IAAI,MAAM,OAAO,YAAY,MAAM,QAAQ;AACtD;AAEA,eAAsB,uBAAuB,OAM3C;AACA,QAAM,OAAO,MAAM,YAAY,EAAE;AAAA,IAC/B;AAAA,EACF,EACG,KAAK,MAAM,KAAK,EAChB,MAAY;AAEf,MAAI,CAAC,QAAQ,CAAC,KAAK,2BAA2B;AAC5C,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxC;AACA,MAAI,IAAI,KAAK,KAAK,yBAAyB,EAAE,QAAQ,IAAI,KAAK,IAAI,GAAG;AACnE,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxC;AAEA,QAAM,eAAe,MAAM,aAAa,MAAM,QAAQ;AACtD,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOF,EACG,KAAK,cAAc,KAAK,EAAE,EAC1B,IAAI;AAEP,QAAM,UAAU,MAAM,YAAY,KAAK,EAAE;AACzC,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AACpD,SAAO,EAAE,IAAI,MAAM,MAAM,QAAQ;AACnC;AAEA,eAAsB,mBAAmB,OAOvC;AACA,QAAM,OAAO,MAAM,YAAY,MAAM,MAAM;AAC3C,MAAI,CAAC,QAAQ,CAAC,KAAK,eAAe;AAChC,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc;AAAA,EAC5C;AAEA,QAAM,UAAU,MAAM;AAAA,IACpB,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxC;AAEA,QAAM,eAAe,MAAM,aAAa,MAAM,WAAW;AACzD,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKF,EACG,KAAK,cAAc,KAAK,EAAE,EAC1B,IAAI;AAEP,QAAM,UAAU,MAAM,YAAY,KAAK,EAAE;AACzC,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AACpD,SAAO,EAAE,IAAI,MAAM,MAAM,QAAQ;AACnC;AAEA,eAAsB,sBAAsB,OAM1C;AACA,QAAM,QAAQA,gBAAe,MAAM,KAAK;AACxC,QAAM,OAAO,MAAM,eAAe,KAAK;AACvC,MAAI,CAAC,QAAQ,CAAC,KAAK,eAAe;AAChC,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxC;AAEA,QAAM,UAAU,MAAM,eAAe,MAAM,UAAU,KAAK,aAAa;AACvE,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxC;AACA,MAAI,CAAC,KAAK,gBAAgB;AACxB,WAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC3C;AAEA,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA,EACF,EACG,KAAK,KAAK,EAAE,EACZ,IAAI;AAEP,SAAO,EAAE,IAAI,MAAM,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE;AAC9C;AAEA,eAAsB,eAAe,OAAqC;AACxE,SAAO,MAAM,YAAY,EAAE,QAAQ,qCAAqC,EACrE,KAAKA,gBAAe,KAAK,CAAC,EAC1B,MAAY;AACjB;AAEA,eAAsB,YAAY,IAAkC;AAClE,SAAO,MAAM,YAAY,EAAE,QAAQ,kCAAkC,EAClE,KAAK,EAAE,EACP,MAAY;AACjB;AAEA,eAAsB,UAAU,QAAQ,KAAsB;AAC5D,QAAM,EAAE,QAAQ,IAAI,MAAM,YAAY,EAAE;AAAA,IACtC;AAAA,EACF,EACG,KAAK,KAAK,EACV,IAAU;AACb,SAAO,WAAW,CAAC;AACrB;AAEA,eAAsB,wBACpB,QAAQ,KACiB;AACzB,QAAM,EAAE,QAAQ,IAAI,MAAM,YAAY,EAAE;AAAA,IACtC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKF,EACG,KAAK,KAAK,EACV,IAAkB;AACrB,SAAO,WAAW,CAAC;AACrB;AAGA,eAAsB,mBAAmB,QAAkC;AACzE,QAAM,OAAO,MAAM,YAAY,MAAM;AACrC,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA,EACF,EACG,KAAK,MAAM,EACX,IAAI;AACP,SAAO;AACT;AAEA,eAAsB,YACpB,QACA,MAIA;AACA,QAAM,OAAO,MAAM,YAAY,MAAM;AACrC,MAAI,CAAC,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACnD,MAAI,MAAM,aAAa,KAAK,KAAK,GAAG;AAClC,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AAEA,QAAM,YAAY,EAAE;AAAA,IAClB;AAAA;AAAA;AAAA;AAAA,EAIF,EACG,KAAK,MAAM,MAAM,EACjB,IAAI;AAEP,QAAM,UAAU,MAAM,YAAY,MAAM;AACxC,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACtD,SAAO,EAAE,IAAI,MAAM,MAAM,QAAQ;AACnC;AAEA,eAAsB,kBAAkB,QAGtC;AACA,QAAM,OAAO,MAAM,YAAY,MAAM;AACrC,MAAI,CAAC,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACnD,MAAI,MAAM,aAAa,KAAK,KAAK,GAAG;AAClC,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAAA,EACzC;AAEA,QAAM,WAAW,MAAM,eAAe;AACtC,QAAM,aAAa,SAAS;AAE5B,QAAM,KAAK,YAAY;AACvB,QAAM,GAAG,MAAM;AAAA,IACb,GAAG;AAAA,MACD;AAAA,IACF,EAAE,KAAK,YAAY,KAAK,KAAK;AAAA,IAC7B,GAAG,QAAQ,gCAAgC,EAAE,KAAK,MAAM;AAAA,EAC1D,CAAC;AAED,SAAO,EAAE,IAAI,MAAM,OAAO,KAAK,MAAM;AACvC;","names":["cache","env","options","getRuntimePlatform","normalizeEmail"]}