@plumix/core 0.1.0

package/dist/runtime/dispatcher.js

@@ -0,0 +1,560 @@
+import { readSessionCookie } from "../auth/cookies.js";
+import { hasCsrfHeader, hasMatchingOrigin } from "../auth/csrf.js";
+import { parseOAuthPath } from "../auth/oauth/match.js";
+import { stripBasePath, withBasePath } from "../base-path.js";
+import { flushPurgeTags } from "../cache/purge.js";
+import { readThrough } from "../cache/read-through.js";
+import { pageTags } from "../cache/tags.js";
+import { interfaceEnabled } from "../config.js";
+import { withUser } from "../context/app.js";
+import { resolveLocale } from "../i18n/resolve-locale.js";
+import { matchRoute } from "../route/match.js";
+import { renderErrorThroughTheme } from "../route/render/render-template.js";
+import { resolvePublicRoute } from "../route/resolve.js";
+import { canonicalRedirectTarget } from "../seo/canonical.js";
+import { handleFeed, isPublicEntryType, publicTaxonomyByBaseSlug, } from "../seo/feed.js";
+import { handleRobotsTxt } from "../seo/robots.js";
+import { handleSitemapIndex, handleSubSitemap } from "../seo/sitemap.js";
+import { injectAdminBaseHref, rewriteAdminShellLangDir, } from "./admin-shell.js";
+import { forbidden, jsonResponse, methodNotAllowed, notFound, permanentRedirect, } from "./http.js";
+import { loadUserForPublicRequest } from "./load-user-for-public-request.js";
+const RPC_PREFIX = "/_plumix/rpc";
+const ADMIN_PREFIX = "/_plumix/admin";
+const AUTH_PREFIX = "/_plumix/auth/";
+const PLUMIX_PREFIX = "/_plumix/";
+const MCP_PATH = "/_plumix/mcp";
+const API_PREFIX = "/_plumix/api";
+const ROBOTS_PATH = "/robots.txt";
+const SITEMAP_INDEX_PATH = "/sitemap.xml";
+// `/sitemap-<scope>-<page>.xml` — greedy scope so a hyphenated name keeps its
+// hyphens and only the trailing `-<digits>` is the page.
+const SUB_SITEMAP_PATTERN = /^\/sitemap-(.+)-(\d+)\.xml$/;
+// `/feed`, `/feed/atom`, `/<type>/feed`, `/<type>/feed/atom`. The optional
+// leading segment is the entry-type scope; `/feed*` reserves these paths the
+// way WordPress does, so a page slugged "feed" can't shadow them.
+const FEED_PATTERN = /^\/(?:([^/]+)\/)?feed(\/atom)?$/;
+// `/<taxonomy>/<term>/feed` (+ `/atom`) — the term-scoped feed.
+const TERM_FEED_PATTERN = /^\/([^/]+)\/([^/]+)\/feed(\/atom)?$/;
+// MCP is cold-path-exclusive (an agent endpoint, never the public render path).
+// Dynamic-import its handler so the tool registry and the MCP SDK it pulls in
+// stay off the public render and cold-start paths, evaluating only on the first
+// MCP request per isolate.
+let mcpModule;
+// Auth-flow handlers (passkey/oauth/magic-link/device/email-change) are
+// admin-login cold paths — never the public render path. Load them via one
+// memoized dynamic import on the first auth-flow request per isolate so their
+// heavy graph (webauthn/oslo, arctic) stays off the public render cold-start
+// path; the lightweight path matchers below stay eager.
+let authFlowRoutes;
+function loadAuthFlowRoutes() {
+    return (authFlowRoutes ??= import("../auth/flow-routes.js"));
+}
+// Filenames look like `index.html`, `chunk-abc.js`, `fonts/g.woff2` — paths
+// with a dot-suffix after the last slash. Deep-link SPA routes never match.
+const ASSET_LIKE = /\.[^/]+$/;
+const POST_AUTH_ROUTES = new Map([
+    [
+        "/_plumix/auth/passkey/register/options",
+        (h) => h.handlePasskeyRegisterOptions,
+    ],
+    [
+        "/_plumix/auth/passkey/register/verify",
+        (h) => h.handlePasskeyRegisterVerify,
+    ],
+    ["/_plumix/auth/passkey/login/options", (h) => h.handlePasskeyLoginOptions],
+    ["/_plumix/auth/passkey/login/verify", (h) => h.handlePasskeyLoginVerify],
+    [
+        "/_plumix/auth/invite/register/options",
+        (h) => h.handleInviteRegisterOptions,
+    ],
+    ["/_plumix/auth/invite/register/verify", (h) => h.handleInviteRegisterVerify],
+    ["/_plumix/auth/magic-link/request", (h) => h.handleMagicLinkRequest],
+    ["/_plumix/auth/device/code", (h) => h.handleDeviceCodeRequest],
+    [
+        "/_plumix/auth/device/token",
+        (h) => (ctx) => h.handleDeviceTokenExchange(ctx),
+    ],
+    ["/_plumix/auth/signout", (h) => (ctx) => h.handleSignout(ctx)],
+]);
+const MAGIC_LINK_VERIFY_PATH = "/_plumix/auth/magic-link/verify";
+const EMAIL_CHANGE_VERIFY_PATH = "/_plumix/auth/verify-email";
+export function createPlumixDispatcher(app) {
+    return async (ctx) => {
+        try {
+            const response = await route(app, ctx);
+            // Request-end seam: fire one batched edge-cache purge for whatever
+            // entry mutations this request accumulated.
+            flushPurgeTags(ctx);
+            return response;
+        }
+        catch (error) {
+            ctx.logger.error("dispatch_failed", {
+                error,
+                url: ctx.request.url,
+                method: ctx.request.method,
+            });
+            return jsonResponse({ error: "internal_error" }, { status: 500 });
+        }
+    };
+}
+function enforcePlumixCsrf(app, ctx) {
+    if (!hasCsrfHeader(ctx.request)) {
+        return forbidden("csrf_header_missing");
+    }
+    // Defense-in-depth: the custom-header check already blocks cross-origin
+    // POSTs (a browser can't set X-Plumix-Request without a CORS preflight,
+    // which Plumix never grants). If an Origin header is present anyway,
+    // reject mismatches too — protects against a future misconfigured CORS
+    // layer or an intermediate that strips/forwards headers loosely.
+    if (ctx.request.headers.has("origin") &&
+        !hasMatchingOrigin(ctx.request, { allowed: [app.origin] })) {
+        // devCsrfLocalhost is statically false in production builds; see its
+        // declaration on RuntimeContext for why dev needs the relaxation.
+        if (app.devCsrfLocalhost && hasLocalhostOrigin(ctx.request)) {
+            return null;
+        }
+        return forbidden("csrf_origin_mismatch");
+    }
+    return null;
+}
+function hasLocalhostOrigin(request) {
+    const origin = request.headers.get("origin");
+    if (!origin)
+        return false;
+    try {
+        const { hostname } = new URL(origin);
+        // The whole 127.0.0.0/8 block is loopback, not just 127.0.0.1.
+        // WHATWG URL always compresses IPv6 loopback to `[::1]`.
+        return (hostname === "localhost" ||
+            hostname === "[::1]" ||
+            /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname));
+    }
+    catch {
+        return false;
+    }
+}
+// Strip the configured subdirectory prefix once, at the edge, by rewriting the
+// request URL to its root-relative form. Every downstream branch and sub-handler
+// (RPC, MCP, REST, auth flows, plugin routes, the public router, the admin
+// shell) then matches root-relative paths with no base awareness of its own;
+// outbound URL builders re-add the prefix via `withBasePath`. A request that
+// isn't under the base (e.g. the bare domain root when mounted at
+// `/custom-directory`) isn't part of the mounted site — 404 it. A root
+// deployment (`basePath === ""`) leaves the request untouched.
+function stripBasePathOrReject(app, ctx) {
+    if (app.basePath === "")
+        return ctx;
+    const rawUrl = new URL(ctx.request.url);
+    const stripped = stripBasePath(rawUrl.pathname, app.basePath);
+    if (stripped === null)
+        return notFound("outside-base-path");
+    rawUrl.pathname = stripped;
+    return { ...ctx, request: new Request(rawUrl, ctx.request) };
+}
+// The two interfaces mounted ahead of the CSRF gate. Both authenticate by
+// bearer token (MCP) or anonymous read (REST), so they're inherently
+// CSRF-immune — a cross-origin browser can't attach an Authorization header or
+// the X-Plumix-Request header without a CORS grant Plumix never gives. Returns
+// null for any other path so the gate below keeps protecting the cookie-authed
+// RPC/auth endpoints unchanged. Both stay default-off and 404 *before* their
+// dynamic import, so a disabled deployment never pulls the MCP SDK + tool
+// registry or the @orpc/openapi graph onto the cold-start path.
+async function tryColdInterfaces(app, ctx, pathname) {
+    if (pathname === MCP_PATH) {
+        if (!interfaceEnabled(app.config.mcp))
+            return notFound("mcp-disabled");
+        const { handleMcpRequest } = await (mcpModule ??=
+            import("../mcp/dispatch.js"));
+        return handleMcpRequest(ctx);
+    }
+    if (pathname === API_PREFIX || pathname.startsWith(`${API_PREFIX}/`)) {
+        if (!interfaceEnabled(app.config.api))
+            return notFound("api-disabled");
+        const dispatchRest = await app.loadRestHandler();
+        return dispatchRest(ctx);
+    }
+    return null;
+}
+// Everything mounted under `/_plumix/` behind the CSRF gate: RPC, the auth
+// flows (POST endpoints, OAuth, magic-link/email-change verify), the admin
+// shell, and plugin-registered raw routes. Returns null for any non-plumix path
+// so the public router below owns it; a plumix path that matches nothing 404s
+// here rather than falling through to the public map. Auth-flow handlers load
+// via one memoized dynamic import on first use, keeping their heavy
+// webauthn/oslo/arctic graph off the public render cold-start path.
+async function tryPlumixRoutes(app, ctx, pathname) {
+    if (pathname.startsWith(PLUMIX_PREFIX)) {
+        const csrfFailure = enforcePlumixCsrf(app, ctx);
+        if (csrfFailure)
+            return csrfFailure;
+    }
+    if (pathname === RPC_PREFIX || pathname.startsWith(`${RPC_PREFIX}/`)) {
+        const rpcHandler = await app.loadRpcHandler();
+        const result = await rpcHandler.handle(ctx.request, {
+            prefix: RPC_PREFIX,
+            context: ctx,
+        });
+        return result.matched
+            ? result.response
+            : notFound("rpc-procedure-not-found");
+    }
+    const authRoute = POST_AUTH_ROUTES.get(pathname);
+    if (authRoute) {
+        if (ctx.request.method !== "POST")
+            return methodNotAllowed(["POST"]);
+        const handlers = await loadAuthFlowRoutes();
+        return authRoute(handlers)(ctx, app);
+    }
+    // OAuth endpoints are top-level GET navigations from the browser, so they
+    // can't carry the X-Plumix-Request header. The CSRF gate already lets
+    // safe methods through, and the state token is the per-request CSRF
+    // anchor for the callback. Match the path *and* enforce GET here.
+    const oauth = parseOAuthPath(pathname);
+    if (oauth) {
+        if (ctx.request.method !== "GET")
+            return methodNotAllowed(["GET"]);
+        const handlers = await loadAuthFlowRoutes();
+        return oauth.tail === "start"
+            ? handlers.handleOAuthStart(ctx, app, oauth.params.providerKey)
+            : handlers.handleOAuthCallback(ctx, app, oauth.params.providerKey);
+    }
+    // Magic-link verify is the same shape — top-level GET from the user's
+    // mail client. The 192-bit single-use token in `?token=…` is the
+    // per-request CSRF anchor.
+    if (pathname === MAGIC_LINK_VERIFY_PATH) {
+        if (ctx.request.method !== "GET")
+            return methodNotAllowed(["GET"]);
+        return (await loadAuthFlowRoutes()).handleMagicLinkVerify(ctx, app);
+    }
+    // Email-change verify — same anchor model. The link goes to the
+    // user's *new* mailbox (proves they own it); clicking commits the
+    // change atomically + invalidates every session for that user.
+    if (pathname === EMAIL_CHANGE_VERIFY_PATH) {
+        if (ctx.request.method !== "GET")
+            return methodNotAllowed(["GET"]);
+        return (await loadAuthFlowRoutes()).handleEmailChangeVerify(ctx, app);
+    }
+    if (pathname === ADMIN_PREFIX || pathname.startsWith(`${ADMIN_PREFIX}/`)) {
+        return serveAdmin(ctx);
+    }
+    if (pathname.startsWith(PLUMIX_PREFIX) && !pathname.startsWith(AUTH_PREFIX)) {
+        const pluginMatch = matchPluginRawRoute(app.rawRoutes, pathname, ctx.request.method);
+        if (pluginMatch !== null) {
+            return dispatchPluginRawRoute(pluginMatch.route, ctx);
+        }
+        // Method-allowed-but-path-unmatched falls through to the 404 below;
+        // a plugin that registered only GET wouldn't want POST to 405 here
+        // because the path itself is unrecognised from the dispatcher's pov.
+    }
+    if (pathname.startsWith(PLUMIX_PREFIX)) {
+        return notFound("unknown-plumix-route");
+    }
+    return null;
+}
+async function route(app, ctx) {
+    const rebased = stripBasePathOrReject(app, ctx);
+    if (rebased instanceof Response)
+        return rebased;
+    ctx = rebased;
+    const url = new URL(ctx.request.url);
+    const { pathname } = url;
+    const cold = await tryColdInterfaces(app, ctx, pathname);
+    if (cold)
+        return cold;
+    const plumix = await tryPlumixRoutes(app, ctx, pathname);
+    if (plumix)
+        return plumix;
+    return tryPublicRoutes(app, ctx, url);
+}
+// The public site: only GET/HEAD are meaningful past this point. Core SEO asset
+// routes (robots, sitemaps, feeds) resolve ahead of the public route map so a
+// plugin rewrite rule can't shadow them, then a non-canonical URL 301s to its
+// slash-less form before the route map runs, and anything left renders through
+// the public router.
+async function tryPublicRoutes(app, ctx, url) {
+    const { pathname } = url;
+    if (ctx.request.method !== "GET" && ctx.request.method !== "HEAD") {
+        return methodNotAllowed(["GET", "HEAD"]);
+    }
+    if (pathname === ROBOTS_PATH) {
+        return handleRobotsTxt(ctx);
+    }
+    if (pathname === SITEMAP_INDEX_PATH) {
+        return handleSitemapIndex(ctx);
+    }
+    const subSitemap = SUB_SITEMAP_PATTERN.exec(pathname);
+    if (subSitemap) {
+        return handleSubSitemap(ctx, subSitemap[1] ?? "", Number(subSitemap[2]));
+    }
+    const feed = FEED_PATTERN.exec(pathname);
+    if (feed) {
+        // A scoped `/<x>/feed` is a feed only when `<x>` is a public entry type;
+        // otherwise it's a real path (e.g. a page slugged "feed") — fall through.
+        const type = feed[1];
+        if (type === undefined) {
+            return handleFeed(ctx, { kind: "site" }, feed[2] ? "atom" : "rss2");
+        }
+        if (isPublicEntryType(ctx, type)) {
+            return handleFeed(ctx, { kind: "type", type }, feed[2] ? "atom" : "rss2");
+        }
+    }
+    const termFeed = TERM_FEED_PATTERN.exec(pathname);
+    if (termFeed) {
+        // Only a public taxonomy's archive space owns `/<taxonomy>/<term>/feed`;
+        // anything else (e.g. a nested page) falls through to the public router.
+        const taxonomy = publicTaxonomyByBaseSlug(ctx, termFeed[1] ?? "");
+        if (taxonomy) {
+            return handleFeed(ctx, { kind: "term", taxonomy: taxonomy.name, term: termFeed[2] ?? "" }, termFeed[3] ? "atom" : "rss2");
+        }
+    }
+    // Normalize a public page URL to its canonical (slash-less) shape before
+    // routing — the 301 target shares `canonicalUrl` with the rel=canonical tag.
+    const canonical = canonicalRedirectTarget(ctx);
+    if (canonical !== null)
+        return permanentRedirect(canonical);
+    return dispatchPublicRoute(app, ctx, url);
+}
+// The public route intent for a resolved match: an unmatched root is the front
+// page, any other unmatched URL is a 404 (never cached).
+function publicIntent(match, url) {
+    if (match !== null)
+        return match.intent;
+    if (url.pathname === "/")
+        return { kind: "front-page" };
+    return null;
+}
+// Public, non-hierarchical entry types — the set the front page lists, and so
+// the set of `t:<type>` tags the front page is stored under.
+function frontPageEntryTypes(ctx) {
+    return Array.from(ctx.plugins.entryTypes.entries())
+        .filter(([, spec]) => spec.isPublic !== false && spec.isHierarchical !== true)
+        .map(([key]) => key);
+}
+async function dispatchPublicRoute(app, ctx, url) {
+    // Resolve the route once here and thread it into rendering so a cache miss
+    // doesn't re-run `matchRoute` on the hot public-render path.
+    const match = matchRoute(url, app.routeMap);
+    const cache = ctx.cache;
+    if (cache === undefined)
+        return renderPublicRoute(app, ctx, url, match);
+    const intent = publicIntent(match, url);
+    return readThrough({
+        request: ctx.request,
+        intentKind: intent?.kind ?? null,
+        cache,
+        defer: ctx.defer,
+        render: () => renderPublicRoute(app, ctx, url, match),
+        // Evaluated post-render so `ctx.resolvedEntity` (the entry id) is set.
+        // The source thunks run only for the intent kind that needs them.
+        tags: () => intent === null
+            ? []
+            : pageTags({
+                intent,
+                resolvedEntity: ctx.resolvedEntity,
+                frontPageEntryTypes: () => frontPageEntryTypes(ctx),
+                taxonomyEntryTypes: (taxonomy) => ctx.plugins.termTaxonomies.get(taxonomy)?.entryTypes ?? [],
+            }),
+    });
+}
+async function renderPublicRoute(app, ctx, url, match) {
+    const theme = app.config.theme;
+    const document = app.document;
+    const templateDocuments = app.templateDocuments;
+    const templateDeps = app.plugins.templateDeps;
+    const assetManifest = app.assetManifest;
+    try {
+        ctx = await loadUserForPublicRequest(ctx);
+        const response = await resolvePublicRouteOrFallback(app, ctx, url, match);
+        if (response.status === 404) {
+            const html = await renderErrorThroughTheme({
+                ctx,
+                theme,
+                document,
+                templateDocuments,
+                templateDeps,
+                assetManifest,
+                kind: "not-found",
+                data: {
+                    request: ctx.request,
+                    hint: response.headers.get("x-plumix-hint") ?? undefined,
+                },
+            });
+            const headers = new Headers(response.headers);
+            headers.set("content-type", "text/html; charset=utf-8");
+            return new Response(html, { status: 404, headers });
+        }
+        return response;
+    }
+    catch (err) {
+        ctx.logger.error("dispatch_failed", {
+            url: url.href,
+            err: err instanceof Error ? err.message : String(err),
+        });
+        try {
+            const html = await renderErrorThroughTheme({
+                ctx,
+                theme,
+                document,
+                templateDocuments,
+                templateDeps,
+                assetManifest,
+                kind: "server-error",
+                data: { request: ctx.request },
+            });
+            return new Response(html, {
+                status: 500,
+                headers: { "content-type": "text/html; charset=utf-8" },
+            });
+        }
+        catch (templateErr) {
+            ctx.logger.error("error_template_failed", {
+                url: url.href,
+                err: templateErr instanceof Error
+                    ? templateErr.message
+                    : String(templateErr),
+            });
+            return new Response("Internal Server Error", {
+                status: 500,
+                headers: { "content-type": "text/plain; charset=utf-8" },
+            });
+        }
+    }
+}
+async function resolvePublicRouteOrFallback(app, ctx, url, match) {
+    const theme = app.config.theme;
+    const document = app.document;
+    const templateDocuments = app.templateDocuments;
+    const templateDeps = app.plugins.templateDeps;
+    const assetManifest = app.assetManifest;
+    if (match !== null) {
+        return resolvePublicRoute(ctx, match, theme, document, templateDocuments, templateDeps, assetManifest);
+    }
+    if (url.pathname === "/") {
+        return resolvePublicRoute(ctx, { intent: { kind: "front-page" }, params: {} }, theme, document, templateDocuments, templateDeps, assetManifest);
+    }
+    return notFound("public-route-not-found");
+}
+export function matchPluginRawRoute(routes, pathname, method) {
+    const methodUpper = method.toUpperCase();
+    for (const route of routes) {
+        if (route.method !== "*" && route.method !== methodUpper)
+            continue;
+        const pluginPrefix = `/_plumix/${route.pluginId}`;
+        if (pathname !== pluginPrefix && !pathname.startsWith(`${pluginPrefix}/`)) {
+            continue;
+        }
+        const localPath = pathname === pluginPrefix ? "/" : pathname.slice(pluginPrefix.length);
+        if (route.path.endsWith("/*")) {
+            const prefix = route.path.slice(0, -1);
+            if (localPath === prefix.slice(0, -1) || localPath.startsWith(prefix)) {
+                return { route };
+            }
+            continue;
+        }
+        if (localPath === route.path)
+            return { route };
+    }
+    return null;
+}
+async function dispatchPluginRawRoute(route, ctx) {
+    const gate = route.auth;
+    if (gate === "public") {
+        return route.handler(ctx.request, ctx);
+    }
+    // Same authenticator the RPC layer uses — session cookie by default,
+    // operator override (e.g. `cfAccess()`) when configured. Plugin
+    // route handlers don't need to know which guard is active; they just
+    // declare `auth: "authenticated"` and the dispatcher delegates.
+    const result = await ctx.authenticator.authenticate(ctx.request, ctx.db);
+    if (!result)
+        return jsonResponse({ error: "unauthorized" }, { status: 401 });
+    const { id, email, name, role, meta } = result.user;
+    const tokenScopes = result.tokenScopes ?? null;
+    const authedCtx = withUser(ctx, { id, email, name, role, meta }, tokenScopes);
+    if (gate === "authenticated") {
+        return route.handler(authedCtx.request, authedCtx);
+    }
+    const capability = gate.capability;
+    // Read through `authedCtx.auth.can()` so tokenScopes (PAT-style
+    // narrowing) gates plugin routes the same way it gates RPC. Going
+    // direct to `app.capabilityResolver.hasCapability` would bypass the
+    // intersection check and let a token with `scopes: ["entry:post:read"]`
+    // hit a plugin route gated on `entry:post:edit_any`.
+    if (!authedCtx.auth.can(capability)) {
+        return jsonResponse({ error: "forbidden", capability }, { status: 403 });
+    }
+    return route.handler(authedCtx.request, authedCtx);
+}
+async function serveAdmin(ctx) {
+    // Admin is a static SPA — only GET/HEAD are meaningful. Reject everything
+    // else here rather than forward to env.ASSETS, whose behavior on non-GET
+    // methods is unspecified and platform-dependent.
+    if (ctx.request.method !== "GET" && ctx.request.method !== "HEAD") {
+        return methodNotAllowed(["GET", "HEAD"]);
+    }
+    if (ctx.assets === undefined) {
+        return notFound("admin-not-available");
+    }
+    const { pathname } = new URL(ctx.request.url);
+    // Asset-shaped paths (chunk-abc.js, missing.woff2) either hit the runtime's
+    // asset layer before the worker or represent a real 404. Don't mask a
+    // missing asset by returning HTML — the browser loader would choke.
+    if (ASSET_LIKE.test(pathname)) {
+        // Under a subdirectory mount the platform asset layer never matched this
+        // request — its bucket paths omit the prefix, so the (already base-stripped)
+        // request fell through to the worker. Serve it from the binding here. At
+        // the root the platform had its chance, so a miss is a genuine 404.
+        if (ctx.basePath !== "") {
+            return ctx.assets.fetch(new Request(new URL(ctx.request.url), ctx.request));
+        }
+        return notFound("admin-asset-not-found");
+    }
+    // SPA deep link: admin's client router owns routing past /_plumix/admin/.
+    // Hand the client its index.html so it can resolve the path. Fetch
+    // the prefix URL itself (which the assets binding maps to index.html
+    // with a 200) rather than `${PREFIX}/index.html` — the latter
+    // triggers a redirect to the trailing-slash version under
+    // `not_found_handling: "single-page-application"` and miniflare's
+    // local emulation.
+    const indexUrl = new URL(`${ADMIN_PREFIX}/`, ctx.request.url);
+    const upstream = await ctx.assets.fetch(new Request(indexUrl, ctx.request));
+    const contentType = upstream.headers.get("content-type")?.toLowerCase();
+    if (!contentType?.includes("text/html"))
+        return upstream;
+    // Only run the authenticator when there's actually a session cookie to
+    // validate — Bearer-only requests on the shell path would otherwise bump
+    // `api_tokens.lastUsedAt` on every cross-site GET navigation. Anonymous
+    // visitors hit the cookie + Accept-Language tiers of the resolver chain.
+    const auth = readSessionCookie(ctx.request)
+        ? await ctx.authenticator.authenticate(ctx.request, ctx.db)
+        : null;
+    const locale = resolveLocale({
+        request: ctx.request,
+        user: auth?.user ?? null,
+        i18n: ctx.i18n,
+    });
+    // Rewrite invalidates upstream body-shape headers: encoding stops applying
+    // (`upstream.text()` already decompressed), length is wrong (the new tag is
+    // longer), etag refers to the original bytes.
+    const headers = new Headers(upstream.headers);
+    headers.delete("content-encoding");
+    headers.delete("content-length");
+    headers.delete("transfer-encoding");
+    headers.delete("etag");
+    // Body varies per request locale; keep it out of shared caches.
+    headers.set("cache-control", "private, no-cache");
+    headers.append("vary", "cookie, accept-language");
+    // `<base href>` anchors the relative-based client bundle (assets, the client
+    // router's basepath, and the RPC URL) to wherever the admin is mounted, so
+    // the same precompiled admin serves correctly at the root or under any
+    // subdirectory without a rebuild.
+    const baseHref = withBasePath(`${ADMIN_PREFIX}/`, ctx.basePath);
+    const html = await upstream.text();
+    const shell = injectAdminBaseHref(rewriteAdminShellLangDir(html, locale), baseHref);
+    return new Response(shell, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers,
+    });
+}
+//# sourceMappingURL=dispatcher.js.map

package/dist/runtime/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/runtime/dispatcher.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,QAAQ,EACR,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,QAAQ,GAAG,cAAc,CAAC;AAChC,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,2EAA2E;AAC3E,6EAA6E;AAC7E,kEAAkE;AAClE,MAAM,YAAY,GAAG,iCAAiC,CAAC;AACvD,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;AAEhE,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,2BAA2B;AAC3B,IAAI,SAAkD,CAAC;AAEvD,wEAAwE;AACxE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,wDAAwD;AACxD,IAAI,cAA0D,CAAC;AAC/D,SAAS,kBAAkB;IACzB,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,UAAU,GAAG,UAAU,CAAC;AAO9B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAwB;IACtD;QACE,wCAAwC;QACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,4BAA4B;KACtC;IACD;QACE,uCAAuC;QACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,2BAA2B;KACrC;IACD,CAAC,qCAAqC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC3E,CAAC,oCAAoC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACzE;QACE,uCAAuC;QACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,2BAA2B;KACrC;IACD,CAAC,sCAAsC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC;IAC7E,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACrE,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAC/D;QACE,4BAA4B;QAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC;KACjD;IACD,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;CAChE,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AACjE,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAI9D,MAAM,UAAU,sBAAsB,CAAC,GAAc;IACnD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvC,mEAAmE;YACnE,4CAA4C;YAC5C,cAAc,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE;gBAClC,KAAK;gBACL,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;gBACpB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;aAC3B,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAc,EAAE,GAAe;IACxD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC1C,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,iEAAiE;IACjE,IACE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAC1D,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,IAAI,GAAG,CAAC,gBAAgB,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,+DAA+D;QAC/D,yDAAyD;QACzD,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,OAAO;YACpB,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAClD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,kEAAkE;AAClE,uEAAuE;AACvE,+DAA+D;AAC/D,SAAS,qBAAqB,CAC5B,GAAc,EACd,GAAe;IAEf,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,qEAAqE;AACrE,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,gEAAgE;AAChE,KAAK,UAAU,iBAAiB,CAC9B,GAAc,EACd,GAAe,EACf,QAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,SAAS;YAC3C,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAChC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,eAAe,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AACpE,oEAAoE;AACpE,KAAK,UAAU,eAAe,CAC5B,GAAc,EACd,GAAe,EACf,QAAgB;IAEhB,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;IACtC,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;YAClD,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,OAAO;YACnB,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO;YAC3B,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;YAC/D,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,2BAA2B;IAC3B,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAChE,kEAAkE;IAClE,+DAA+D;IAC/D,IAAI,QAAQ,KAAK,wBAAwB,EAAE,CAAC;QAC1C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,MAAM,WAAW,GAAG,mBAAmB,CACrC,GAAG,CAAC,SAAS,EACb,QAAQ,EACR,GAAG,CAAC,OAAO,CAAC,MAAM,CACnB,CAAC;QACF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,sBAAsB,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,oEAAoE;QACpE,mEAAmE;QACnE,qEAAqE;IACvE,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAc,EAAE,GAAe;IAClD,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,OAAO,YAAY,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,GAAG,GAAG,OAAO,CAAC;IAEd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,qBAAqB;AACrB,KAAK,UAAU,eAAe,CAC5B,GAAc,EACd,GAAe,EACf,GAAQ;IAER,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IACzB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,gBAAgB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,UAAU,CACf,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAClE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,SAAS,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE5D,OAAO,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,yDAAyD;AACzD,SAAS,YAAY,CAAC,KAAwB,EAAE,GAAQ;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,SAAS,mBAAmB,CAAC,GAAe;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;SAChD,MAAM,CACL,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,CACtE;SACA,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAc,EACd,GAAe,EACf,GAAQ;IAER,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC;QACjB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;QAChC,KAAK;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;QACrD,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,EAAE,GAAG,EAAE,CACT,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,QAAQ,CAAC;gBACP,MAAM;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,mBAAmB,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC;gBACnD,kBAAkB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC/B,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,IAAI,EAAE;aAC7D,CAAC;KACT,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAc,EACd,GAAe,EACf,GAAQ,EACR,KAAwB;IAExB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,MAAM,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAChD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IACxC,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC;gBACzC,GAAG;gBACH,KAAK;gBACL,QAAQ;gBACR,iBAAiB;gBACjB,YAAY;gBACZ,aAAa;gBACb,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE;oBACJ,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS;iBACzD;aACF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE;YAClC,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC;gBACzC,GAAG;gBACH,KAAK;gBACL,QAAQ;gBACR,iBAAiB;gBACjB,YAAY;gBACZ,aAAa;gBACb,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;aAC/B,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACxC,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,GAAG,EACD,WAAW,YAAY,KAAK;oBAC1B,CAAC,CAAC,WAAW,CAAC,OAAO;oBACrB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE;gBAC3C,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,GAAc,EACd,GAAe,EACf,GAAQ,EACR,KAAwB;IAExB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,MAAM,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAChD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,kBAAkB,CACvB,GAAG,EACH,KAAK,EACL,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,aAAa,CACd,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,kBAAkB,CACvB,GAAG,EACH,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAC9C,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,aAAa,CACd,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC;AAMD,MAAM,UAAU,mBAAmB,CACjC,MAAqC,EACrC,QAAgB,EAChB,MAAc;IAEd,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;YAAE,SAAS;QACnE,MAAM,YAAY,GAAG,YAAY,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClD,IAAI,QAAQ,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GACb,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,SAAS,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtE,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAyB,EACzB,GAAe;IAEf,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,qEAAqE;IACrE,gEAAgE;IAChE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7E,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;IAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAE9E,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,gEAAgE;IAChE,kEAAkE;IAClE,oEAAoE;IACpE,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAe;IACvC,0EAA0E;IAC1E,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,gBAAgB,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,yEAAyE;QACzE,6EAA6E;QAC7E,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CACrB,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,0EAA0E;IAC1E,mEAAmE;IACnE,qEAAqE;IACrE,8DAA8D;IAC9D,0DAA0D;IAC1D,kEAAkE;IAClE,mBAAmB;IACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;IACxE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzD,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QACzC,CAAC,CAAC,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,gEAAgE;IAChE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAElD,6EAA6E;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,YAAY,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,mBAAmB,CAC/B,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,EACtC,QAAQ,CACT,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/env-input.d.ts

@@ -0,0 +1,19 @@
+import type { PlumixEnv } from "./bindings.js";
+/**
+ * A config value that's either a literal `T`, or a resolver deriving it from the
+ * runtime `env` at request time. The resolver form is required wherever the
+ * value carries a secret that only exists per-request — notably Cloudflare
+ * Workers, where secrets arrive via the `env` binding (not `process.env`) and
+ * the config module is evaluated before any request. `env` is the augmentable
+ * {@link PlumixEnv} (the cloudflare runtime extends it with `Cloudflare.Env`),
+ * so a resolver reads bindings/secrets type-checked. Used by the secret-bearing
+ * config slots — `mailer`, OAuth `clientSecret`, R2 S3 creds — all mirroring the
+ * `libsql()` connection-config union.
+ *
+ * `T` must be a non-callable value: the literal-vs-resolver discriminator is
+ * `typeof input === "function"`, which every current slot satisfies (each `T`
+ * is an object).
+ */
+export type EnvInput<T> = T | ((env: PlumixEnv) => T);
+export declare function resolveEnvInput<T>(input: EnvInput<T>, env: PlumixEnv): T;
+//# sourceMappingURL=env-input.d.ts.map

package/dist/runtime/env-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-input.d.ts","sourceRoot":"","sources":["../../src/runtime/env-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC;AAOtD,wBAAgB,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,CAAC,CAKxE"}

package/dist/runtime/env-input.js

@@ -0,0 +1,13 @@
+// Memoize by resolver identity so a value that owns a connection (an SMTP
+// transport, a pooled client) is built once per isolate, not per request —
+// `env` is isolate-stable, the lazy-once contract `libsql()`'s client uses.
+const cache = new WeakMap();
+export function resolveEnvInput(input, env) {
+    if (typeof input !== "function")
+        return input;
+    const resolver = input;
+    if (!cache.has(resolver))
+        cache.set(resolver, resolver(env));
+    return cache.get(resolver);
+}
+//# sourceMappingURL=env-input.js.map

package/dist/runtime/env-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-input.js","sourceRoot":"","sources":["../../src/runtime/env-input.ts"],"names":[],"mappings":"AAmBA,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,KAAK,GAAG,IAAI,OAAO,EAAwC,CAAC;AAElE,MAAM,UAAU,eAAe,CAAI,KAAkB,EAAE,GAAc;IACnE,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAA8B,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAM,CAAC;AAClC,CAAC"}