@zvndev/darkmown 2.12.2 → 2.12.3

package/src/cli.js

@@ -16,7 +16,8 @@ import {
   devClientPath,
   devClientScript,
   devEventsPath,
-  injectDevClient
+  injectDevClient,
+  refuseLocalRequest
 } from "./dev.js";
 import { createDispatcher, serveMcp } from "./mcp.js";
 import { mcpConfig } from "./mcp-tools.js";
@@ -421,6 +422,7 @@ function startDevServer({ cwd, log, warn, error }) {
 
   const apiDir = path.join(cwd, "api");
   const server = http.createServer((req, res) => {
+    if (refuseForeign(req, res, host)) return;
     const url = req.url || "/";
     if (url.split("?")[0] === devEventsPath) {
       res.writeHead(200, {
@@ -486,6 +488,25 @@ function startDevServer({ cwd, log, warn, error }) {
   });
 }
 
+/**
+ * Answer 403 when `refuseLocalRequest` rejects the request (DNS rebinding or a
+ * cross-site call into `api/`). Shared by `dev` and `serve`.
+ * @param {import("node:http").IncomingMessage} req
+ * @param {import("node:http").ServerResponse} res
+ * @param {string} bindHost
+ * @returns {boolean} true when the request was refused and answered
+ */
+function refuseForeign(req, res, bindHost) {
+  const reason = refuseLocalRequest(req, {
+    bindHost,
+    allowedHosts: process.env.DARKMOWN_ALLOWED_HOSTS || ""
+  });
+  if (!reason) return false;
+  res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+  res.end(`${reason}\n`);
+  return true;
+}
+
 /**
  * Start the static preview server for an existing `dist/`. Throws `CliError`
  * when there is nothing built to serve.
@@ -510,6 +531,7 @@ function startPreviewServer({ cwd, log, error }) {
   }
   const apiDir = path.join(cwd, "api");
   const server = http.createServer((req, res) => {
+    if (refuseForeign(req, res, host)) return;
     const acceptEncoding = req.headers["accept-encoding"];
     // Serverless parity, exactly as in dev: run a project api/*.js function when
     // the path matches; otherwise serve static (compressed when negotiated).

package/src/compiler/format.js

@@ -67,8 +67,9 @@ const dateOnlyTZ = (v) =>
 export const AGGREGATES = {
   sum: (list, f) => nums(list, f || "").reduce((a, n) => a + n, 0),
   avg: (list, f) => (list.length ? AGGREGATES.sum(list, f) / list.length : 0),
-  min: (list, f) => (list.length ? Math.min(...nums(list, f || "")) : 0),
-  max: (list, f) => (list.length ? Math.max(...nums(list, f || "")) : 0),
+  // reduce, not spread: `Math.max(...list)` throws RangeError past ~100k items.
+  min: (list, f) => (list.length ? nums(list, f || "").reduce((a, n) => Math.min(a, n)) : 0),
+  max: (list, f) => (list.length ? nums(list, f || "").reduce((a, n) => Math.max(a, n)) : 0),
   count: (list) => list.length
 };
 

package/src/compiler/frontmatter.js

@@ -56,7 +56,8 @@ export function parseFrontmatter(raw, file) {
   const quotedKeys = new Set();
   for (const line of front.split("\n")) {
     const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (!match) continue;
+    // `__proto__: [a]` would swap meta's prototype rather than set a key.
+    if (!match || match[1] === "__proto__") continue;
     const parsed = parseFrontmatterValue(match[2]);
     meta[match[1]] = parsed.value;
     if (parsed.quoted) quotedKeys.add(match[1]);

package/src/compiler/markdown.js

@@ -11,6 +11,7 @@ import { highlightCode } from "../highlight.js";
 import { LOOP_META, lineOf, recordRead, wdError } from "./context.js";
 import { applyPipeline, fmtAttr, validatePipes } from "./format.js";
 import { imageSize } from "./image-size.js";
+import { isAllowedInclude } from "./includes.js";
 import {
   escapeHtml,
   getPath,
@@ -487,11 +488,14 @@ function buildSrcset(src, ctx) {
     return null;
   }
   const reader = ctx.comp.reader;
+  // Same sandbox as measureImage/@include: a data-driven `/../../x.png` must not
+  // probe (or read the header of) files outside site/pages and site/_.
+  if (!isAllowedInclude(path.join(root, `${relBase}${ext}`), ctx.context, reader)) return null;
   /** @type {{ href: string, width: number }[]} */
   const candidates = [];
   for (const width of VARIANT_WIDTHS) {
     const abs = path.join(root, `${relBase}@${width}${ext}`);
-    if (!reader.exists(abs)) continue;
+    if (!isAllowedInclude(abs, ctx.context, reader) || !reader.exists(abs)) continue;
     candidates.push({ href: `${base}@${width}${ext}`, width: measureWidth(abs, reader) ?? width });
   }
   // Builder-generated variants (2.9.0): resized into dist by the pre-pass, so
@@ -681,8 +685,24 @@ function rawHtmlPlugin(mdInstance) {
 // happened to resolve to. Escaping is no defense here: `href` and friends
 // resolve `javascript:` without any quote breakout, and unlike a markdown
 // destination nothing upstream vets an author's own raw `<a href="…">`.
-const URL_ATTR_TAIL =
-  /\b(?:href|src|action|formaction|xlink:href)\s*=\s*(?:"([^"]*)|'([^']*)|([^\s>"']*))$/i;
+const URL_ATTRS = new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "xlink:href",
+  "data",
+  "poster",
+  "cite",
+  "background",
+  "ping"
+]);
+
+// The tag a fragment is inside of, as far as it has been written (no `>` yet),
+// and within it the attribute whose value is open: name, then the value so far
+// as group 2 ("…), 3 ('…) or 4 (unquoted).
+const OPEN_TAG = /<[A-Za-z][^<>]*$/;
+const OPEN_ATTR = /\s([^\s"'<>/=]+)\s*=\s*(?:"([^"]*)|'([^']*)|([^\s"'=<>`]*))$/;
 
 /**
  * Warn that a value in URL position carries a scheme the browser would execute.
@@ -698,6 +718,22 @@ function warnUnsafeUrl(ctx, index, expr) {
   );
 }
 
+/**
+ * Warn that a value landed where HTML escaping cannot contain it (an event
+ * handler, `srcdoc`, or bare tag position), so it was dropped.
+ * @param {Ctx} ctx
+ * @param {number} index 0-based line index, for `file:line`.
+ * @param {string} expr
+ * @param {string} where
+ * @returns {void}
+ */
+function warnUnsafeSlot(ctx, index, expr, where) {
+  ctx.comp.warnings.push(
+    `${ctx.file}:${lineOf(ctx, index)}: "{ ${expr} }" sits ${where}, where escaping cannot stop a value from running as code, so it is emitted empty. ` +
+      `Put the value in a quoted attribute such as data-*, or render it as text, and read it from a colocated .js file.`
+  );
+}
+
 /**
  * Substitute every `{ expr }` in a raw-HTML fragment with its escaped value.
  *
@@ -736,14 +772,32 @@ function fillRawHtml(html, ctx, index) {
       continue;
     }
     if (found.kind === "state") warnUnbindable(ctx, index, expr, true);
-    const open = URL_ATTR_TAIL.exec(out);
-    const head = open ? (open[1] ?? open[2] ?? open[3]) : "";
-    if (open && unsafeUrlValue(head + found.text)) {
+    // Escaping only holds inside a quoted attribute or text. In a script-valued
+    // attribute the browser entity-decodes `&#39;` back into a live quote, and
+    // in bare tag position (`<div { x }>`) the value IS markup.
+    const tag = OPEN_TAG.exec(out);
+    const open = tag && OPEN_ATTR.exec(tag[0]);
+    const name = open ? open[1].toLowerCase() : "";
+    if (tag && !open) {
+      warnUnsafeSlot(ctx, index, expr, "inside a tag but outside any attribute value");
+      continue;
+    }
+    if (name.startsWith("on") || name === "srcdoc") {
+      warnUnsafeSlot(ctx, index, expr, `in the ${name}= attribute`);
+      continue;
+    }
+    const head = open ? (open[2] ?? open[3] ?? open[4]) : "";
+    if (URL_ATTRS.has(name) && unsafeUrlValue(head + found.text)) {
       warnUnsafeUrl(ctx, index, expr);
       out = out.slice(0, out.length - head.length); // the head belongs to the refused value
       continue;
     }
-    out += escapeHtml(found.text);
+    // An unquoted value ends at whitespace, so `x onmouseover=…` would open a
+    // new attribute. Entities keep it one value and decode back to the text.
+    out +=
+      open?.[4] !== undefined
+        ? escapeHtml(found.text).replace(/[\s=`]/g, (c) => `&#${c.charCodeAt(0)};`)
+        : escapeHtml(found.text);
   }
   return out + html.slice(last);
 }

package/src/dev.js

@@ -1,8 +1,71 @@
+import { isIP } from "node:net";
 import { escapeHtml } from "./compiler.js";
 
 export const devClientPath = "/__wd/dev-client.js";
 export const devEventsPath = "/__wd/dev-events";
 
+/** @param {string} h */
+const isLoopbackName = (h) =>
+  h === "localhost" || h.endsWith(".localhost") || h === "::1" || /^127\.\d+\.\d+\.\d+$/.test(h);
+
+/** `Host`/`Origin` → bare lowercase hostname (`[::1]:5173` → `::1`), or null. @param {string} value */
+function hostnameOf(value) {
+  try {
+    return new URL(value.includes("://") ? value : `http://${value}`).hostname
+      .toLowerCase()
+      .replace(/^\[|\]$/g, "");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The local dev/preview servers bind to loopback, but loopback alone does not
+ * keep a website you are visiting out. Two attacks reach it from a browser:
+ *
+ * - DNS rebinding: `evil.example` re-resolves to 127.0.0.1, after which the
+ *   page can READ every response (drafts, the dep map, the SSE stream, and
+ *   `api/*` handlers, which run with the full `process.env`). The browser still
+ *   sends `Host: evil.example`, so only hostnames that cannot be rebound pass:
+ *   `localhost`/`*.localhost`, IP literals (a rebinding needs a domain), the
+ *   bind address, and the `DARKMOWN_ALLOWED_HOSTS` list (a tunnel's domain).
+ * - Cross-site requests: any page can fire a simple POST at
+ *   `http://127.0.0.1:5173/api/x` without reading the reply, so the handler's
+ *   side effects run. `/api/*` therefore also refuses `Sec-Fetch-Site:
+ *   cross-site` and an `Origin` that is not loopback, the request's own host,
+ *   or allow-listed.
+ *
+ * `DARKMOWN_ALLOWED_HOSTS=*` turns the guard off.
+ * @param {{ url?: string, headers: Record<string, string | string[] | undefined> }} req
+ * @param {{ bindHost?: string, allowedHosts?: string }} [options]
+ * @returns {string | null} why the request is refused, or null to serve it
+ */
+export function refuseLocalRequest(req, { bindHost = "", allowedHosts = "" } = {}) {
+  const allowed = allowedHosts
+    .split(",")
+    .map((h) => hostnameOf(h.trim()) ?? "")
+    .filter(Boolean);
+  if (allowedHosts.split(",").some((h) => h.trim() === "*")) return null;
+  const bind = hostnameOf(bindHost) ?? "";
+  const host = hostnameOf(String(req.headers.host ?? ""));
+  if (!host || !(isLoopbackName(host) || isIP(host) || host === bind || allowed.includes(host))) {
+    return `Host "${req.headers.host ?? ""}" is not allowed. Set DARKMOWN_ALLOWED_HOSTS to permit it.`;
+  }
+  if (!(req.url || "/").startsWith("/api/")) return null;
+  if (req.headers["sec-fetch-site"] === "cross-site") return "Cross-site request to /api/ refused.";
+  const origin = req.headers.origin;
+  if (origin !== undefined) {
+    const from = origin === "null" ? null : hostnameOf(String(origin));
+    if (
+      !from ||
+      !(isLoopbackName(from) || from === host || from === bind || allowed.includes(from))
+    ) {
+      return `Origin "${origin}" may not call /api/ on this server.`;
+    }
+  }
+  return null;
+}
+
 /**
  * Serialize the dev server's rebuilds: at most ONE child build runs at a time.
  * Every build read-modify-writes the dependency map (`dist/.wd-dev-deps.json`),

package/src/feeds.js

@@ -27,14 +27,23 @@ import { wdError } from "./compiler/context.js";
  * @property {string} lastmod ISO date (`yyyy-mm-dd`).
  */
 
+// Characters XML 1.0 cannot carry (see escapeXml).
+const XML_INVALID =
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: these are exactly the characters being removed.
+  /[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+
 /**
  * XML-escape a text value for use inside an element or attribute. Covers the
- * five predefined XML entities — the same set RSS/sitemap consumers expect.
+ * five predefined XML entities — the same set RSS/sitemap consumers expect —
+ * and drops the characters XML 1.0 cannot carry at all (C0 controls other than
+ * tab/LF/CR, U+FFFE/U+FFFF, lone surrogates): one in a single post title makes
+ * the whole feed malformed, and readers reject it outright.
  * @param {string} value
  * @returns {string}
  */
 export function escapeXml(value) {
   return String(value)
+    .replace(XML_INVALID, "")
     .replaceAll("&", "&amp;")
     .replaceAll("<", "&lt;")
     .replaceAll(">", "&gt;")
@@ -174,14 +183,20 @@ export function firstParagraph(body) {
   /** @type {string[]} */
   const collected = [];
   for (let j = i; j < lines.length && lines[j].trim(); j++) collected.push(lines[j].trim());
-  return collected
-    .join(" ")
-    .replace(/`([^`]+)`/g, "$1") // inline code → its text
-    .replace(/\*\*([^*]+)\*\*/g, "$1") // bold
-    .replace(/\*([^*]+)\*/g, "$1") // italic
-    .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1") // [text](url) → text
-    .replace(/\s+/g, " ")
-    .trim();
+  return (
+    collected
+      .join(" ")
+      .replace(/`([^`]+)`/g, "$1") // inline code → its text
+      .replace(/\*\*([^*]+)\*\*/g, "$1") // bold
+      .replace(/\*([^*]+)\*/g, "$1") // italic
+      // [text](url) → text. The classes also exclude the OPENING bracket/paren:
+      // with `[^\]]*` a body of 200k `[` rescans to the end from every `[`
+      // (quadratic, 17 s per call), and any one collection author can write it.
+      // One level of parens is kept for URLs like `/wiki/Foo_(bar)`.
+      .replace(/\[([^[\]]*)\]\([^()]*(?:\([^()]*\)[^()]*)*\)/g, "$1")
+      .replace(/\s+/g, " ")
+      .trim()
+  );
 }
 
 /**

package/src/headers.js

@@ -147,14 +147,20 @@ export function routeCsp(reactive, embedHosts = []) {
 }
 
 /**
- * Baseline security headers applied to every HTML response, independent of the
+ * Baseline security headers applied to every response, independent of the
  * CSP. CSP is added per-route (static vs reactive) by the helpers below.
+ *
+ * HSTS is one year WITHOUT `includeSubDomains`/`preload`: those pin every
+ * sibling subdomain to HTTPS, which only the domain owner can safely decide.
+ * Browsers ignore the header over plain HTTP, so local `serve` is unaffected.
+ * Cloudflare custom domains send no HSTS unless the zone enables it.
  * @type {Record<string, string>}
  */
 export const BASE_SECURITY_HEADERS = {
   "X-Content-Type-Options": "nosniff",
   "Referrer-Policy": "strict-origin-when-cross-origin",
-  "X-Frame-Options": "SAMEORIGIN"
+  "X-Frame-Options": "SAMEORIGIN",
+  "Strict-Transport-Security": "max-age=31536000"
 };
 
 /**

package/src/image-variant-resize.js

@@ -33,7 +33,12 @@ export async function runJobsFile(jobsFile, resultsFile) {
   /** @type {any} */
   let sharp;
   try {
-    sharp = (await import(process.env.WD_SHARP_MODULE || "sharp")).default;
+    // The env override is a test seam pointed at a stub FILE; a dynamic import
+    // needs a file URL on Windows ("D:\..." parses as a scheme). Plain module
+    // specifiers (like a deliberately nonexistent package name) pass through.
+    const spec = process.env.WD_SHARP_MODULE;
+    const target = spec && /[/\\]/.test(spec) ? pathToFileURL(spec).href : spec || "sharp";
+    sharp = (await import(target)).default;
   } catch {
     write({ unavailable: true, failed: [] });
     return;

package/src/router.js

@@ -41,7 +41,10 @@ export function discoverRoutes(routesRoot, options = {}) {
   /** @param {string} dir */
   function walk(dir) {
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      if (isHiddenName(entry.name)) continue;
+      // A symlinked page would compile (and, with md sources on, publish) a
+      // file from anywhere on the machine: CI keys, a contributor's `.env`.
+      // Assets/images/fonts already skip symlinks; pages must too.
+      if (isHiddenName(entry.name) || entry.isSymbolicLink()) continue;
       const abs = path.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(abs);

package/src/runtime.js

@@ -158,8 +158,8 @@ window.addEventListener("popstate", () => {
 window.addEventListener("storage", (event) => {
   const name = event.key && event.key.startsWith("wd:store:") ? event.key.slice(9) : "";
   if (!storeKeys.has(name) || event.newValue == null) return;
-  let next;
-  try { next = JSON.parse(event.newValue); } catch { return; }
+  const next = jsonOr(event.newValue);
+  if (next === undefined) return;
   if (JSON.stringify(next) === JSON.stringify(state[name])) return;
   state[name] = next;
   render();
@@ -225,11 +225,17 @@ function isEmpty(v) {
  * Parse JSON, or undefined when the text is not JSON. `undefined` is a safe
  * sentinel: no JSON document parses to it, so a body of literal `null` is still
  * distinguishable from "not JSON at all".
+ *
+ * Every UNTRUSTED document (a fetch body, a `from-url` param, localStorage, a
+ * cross-tab storage event) enters through here. The reviver drops own
+ * `toString`/`valueOf` keys: `{"toString":1}` is an object `String()` cannot
+ * convert, so it would throw on every render that paints it, and a persisted
+ * copy would keep the page dead after a reload of the clean URL.
  * @param {string} text
  * @returns {any}
  */
 function jsonOr(text) {
-  try { return JSON.parse(text); } catch { return undefined; }
+  try { return JSON.parse(text, (k, v) => (k === "toString" || k === "valueOf" ? undefined : v)); } catch { return undefined; }
 }
 
 // The characters a value must not carry into a URL, mirroring `DEST_UNSAFE`
@@ -334,8 +340,9 @@ const FMT = {
   default: (v, [fb = ""]) => (v == null || v === "" || (Array.isArray(v) && !v.length) ? String(fb) : v),
   sum: (v, [f]) => fmtNums(fmtList(v), f).reduce((a, n) => a + n, 0),
   avg: (v, [f]) => { const l = fmtList(v); return l.length ? FMT.sum(l, [f]) / l.length : 0; },
-  min: (v, [f]) => { const l = fmtList(v); return l.length ? Math.min(...fmtNums(l, f)) : 0; },
-  max: (v, [f]) => { const l = fmtList(v); return l.length ? Math.max(...fmtNums(l, f)) : 0; },
+  // reduce, not spread: `Math.max(...list)` throws RangeError past ~100k items.
+  min: (v, [f]) => { const l = fmtList(v); return l.length ? fmtNums(l, f).reduce((a, n) => Math.min(a, n)) : 0; },
+  max: (v, [f]) => { const l = fmtList(v); return l.length ? fmtNums(l, f).reduce((a, n) => Math.max(a, n)) : 0; },
   count: (v) => fmtList(v).length,
   join: (v, [sep = ", ", f]) => fmtList(v).map((r) => fmtPick(r, f)).join(String(sep))
 };
@@ -1080,7 +1087,10 @@ function startFetch(node) {
   let missing = false;
   const url = g("url").replace(/\{\s*([\w$.]+)\s*\}/g, (_, p) => {
     const v = getPath(state, p);
-    if (v == null || v === "") missing = true;
+    // `.`/`..` survive encodeURIComponent and the URL parser resolves them, so
+    // `?id=..` would retarget `/api/users/{ id }/x` (headers and body included)
+    // at `/api/x`. Treat them as missing, like an empty value.
+    if (v == null || v === "" || v === "." || v === "..") missing = true;
     return encodeURIComponent(String(v ?? ""));
   });
   if (missing) return set("_loading", false);

package/src/runtime.min.js

@@ -1,2 +1,2 @@
-var a={},ft=new Set,nt=new Set,T=new Set,M={};function J(t,e){try{return e===void 0?localStorage.getItem(t):e===null?localStorage.removeItem(t):localStorage.setItem(t,e)}catch{return null}}var X=t=>t.replace(":",".");function mt(){for(let t of document.querySelectorAll("script[data-wd-state],script[data-wd-store]")){let e=t.getAttribute("data-wd-store"),n=JSON.parse(t.textContent||"null");for(let[r,o]of e?[[e,n]]:Object.entries(n||{})){if(r in a)continue;if(a[r]=structuredClone(M[r]=o),e?!t.hasAttribute("data-wd-store-ephemeral"):t.getAttribute("data-wd-persist")===r){(e?nt:ft).add(r);let c=(e?"wd:store:":"wd:")+r,i=J(c);i===null?e&&J(c,JSON.stringify(o??null)):D(i)===void 0?J(c,null):a[r]=D(i)}t.getAttribute("data-wd-url")===r&&(T.add(r),pt(!1,[r]))}}}function xt(){if(!T.size)return;let t=new URLSearchParams(location.search);for(let r of T){let o=a[r];JSON.stringify(o??null)===JSON.stringify(M[r]??null)?t.delete(X(r)):t.set(X(r),typeof o=="string"?o:JSON.stringify(o))}let e=t.toString(),n=location.pathname+(e?`?${e}`:"")+location.hash;if(n!==location.pathname+location.search+location.hash)try{history.replaceState(history.state,"",n)}catch{}}function pt(t,e){let n=new URLSearchParams(location.search);for(let r of e||T){let o=n.get(X(r)),s=M[r];o==null?t&&(a[r]=structuredClone(s)):a[r]=typeof s=="string"?o:D(o)??o}}function b(){for(let t of ft)J(`wd:${t}`,JSON.stringify(a[t]??null));for(let t of nt)J(`wd:store:${t}`,JSON.stringify(a[t]??null));xt()}mt();window.addEventListener("popstate",()=>{T.size&&(pt(!0),b(),g())});window.addEventListener("storage",t=>{let e=t.key&&t.key.startsWith("wd:store:")?t.key.slice(9):"";if(!nt.has(e)||t.newValue==null)return;let n;try{n=JSON.parse(t.newValue)}catch{return}JSON.stringify(n)!==JSON.stringify(a[e])&&(a[e]=n,g())});var Y=t=>t==="__proto__"||t==="constructor"||t==="prototype";function f(t,e){if(!e)return t;let n=t;for(let r of e.split(".")){if(n==null||Y(r))return;n=n[r]}return n}function Ct(t,e,n){let r=e.split("."),o=r.pop()||"",s=t;for(let c of r){if(Y(c))return;(s[c]==null||typeof s[c]!="object")&&(s[c]={}),s=s[c]}Y(o)||(s[o]=n)}function Jt(t){return t==null||typeof t=="object"&&(Array.isArray(t)?t.length:Object.keys(t).length)===0}function D(t){try{return JSON.parse(t)}catch{return}}var Tt=/[\u0000-\u0020()<>"'`\\\u007F]/g,I=(t,e)=>t.matches(e)?[t,...t.querySelectorAll(e)]:[...t.querySelectorAll(e)];function wt(t,e,n,r){if(!e)return;let o;try{o=JSON.parse(e)}catch{return}let s="",c="";for(let i=1;i<o.length;i++){let u=o[i];if(typeof u=="string"){s+=u,c+=u;continue}let l=String((u[0]==="s"?f(a[u[1]],u[2]):u[0]==="m"?r[u[1]]:f(n,u[1]))??"");c+=l,s+=l.replace(Tt,m=>`%${m.charCodeAt(0).toString(16).toUpperCase().padStart(2,"0")}`)}o[0]!=="href"&&o[0]!=="src"||t.setAttribute(o[0],/^(javascript|data|vbscript):/i.test(c.replace(/[\u0000-\u0020\u007F]+/g,""))?"":s)}var q=t=>{let e=typeof t=="number"?t:Number.parseFloat(t);return Number.isFinite(e)?e:0},_=t=>Array.isArray(t)?t:t==null?[]:[t],gt=(t,e)=>e!=null&&e!==""?t?.[e]:t,z=(t,e)=>t.map(n=>q(gt(n,e))),B=t=>{if(t instanceof Date)return t;if(typeof t=="number")return new Date(t);let e=String(t).trim();return/^-?\d+$/.test(e)?new Date(Number(e)):new Date(e)},W=(t,e,n)=>Number.isNaN(t.getTime())?String(n):new Intl.DateTimeFormat(void 0,e).format(t),H=t=>typeof t=="string"&&/^\d{4}-\d{2}-\d{2}$/.test(t.trim())?{timeZone:"UTC"}:void 0,F={money:(t,[e="USD",n])=>new Intl.NumberFormat(n||void 0,{style:"currency",currency:String(e||"USD")}).format(q(t)),number:(t,[e])=>new Intl.NumberFormat(void 0,e==null?{}:{minimumFractionDigits:+e,maximumFractionDigits:+e}).format(q(t)),percent:(t,[e=0])=>new Intl.NumberFormat(void 0,{style:"percent",minimumFractionDigits:+e,maximumFractionDigits:+e}).format(q(t)),round:(t,[e=0])=>{let n=10**+e;return Math.round(q(t)*n)/n},date:(t,[e="medium"])=>W(B(t),{dateStyle:e,...H(t)},t),time:(t,[e="short"])=>W(B(t),{timeStyle:e,...H(t)},t),datetime:(t,[e="medium",n="short"])=>W(B(t),{dateStyle:e,timeStyle:n,...H(t)},t),upper:t=>String(t??"").toUpperCase(),lower:t=>String(t??"").toLowerCase(),capitalize:t=>{let e=String(t??"");return e&&e[0].toUpperCase()+e.slice(1)},truncate:(t,[e=50,n="…"])=>{let r=String(t??"");return r.length>+e?r.slice(0,+e).trimEnd()+String(n):r},trim:t=>String(t??"").trim(),pluralize:(t,[e="",n])=>{let r=q(t);return`${new Intl.NumberFormat().format(r)} ${Math.abs(r)===1?String(e):n!=null?String(n):`${e}s`}`},default:(t,[e=""])=>t==null||t===""||Array.isArray(t)&&!t.length?String(e):t,sum:(t,[e])=>z(_(t),e).reduce((n,r)=>n+r,0),avg:(t,[e])=>{let n=_(t);return n.length?F.sum(n,[e])/n.length:0},min:(t,[e])=>{let n=_(t);return n.length?Math.min(...z(n,e)):0},max:(t,[e])=>{let n=_(t);return n.length?Math.max(...z(n,e)):0},count:t=>_(t).length,join:(t,[e=", ",n])=>_(t).map(r=>gt(r,n)).join(String(e))};function tt(t,e){let n=t.getAttribute("data-wd-fmt");if(!n)return e;let r;try{r=JSON.parse(n)}catch{return e}let o=e;for(let[s,c]of r)F[s]&&(o=F[s](o,c||[]));return o}var Ft=(t,e,n)=>F[t]?F[t](e,n==null?[]:[n]):void 0;async function rt(t,e){let n=await fetch(t,e),r=await n.text(),o=D(r);if(!n.ok){let s=o&&[o.error,o.message].find(i=>typeof i=="string"&&i),c=new Error(s||`HTTP ${n.status}`);throw c.status=n.status,c.body=o??null,c}return o===void 0?{status:n.status,body:r}:o}function x(t,e){a[t+"_error"]=e?e.message||String(e):null,a[t+"_error_body"]=(e&&e.body)??null}function yt(t){let e=t.__wdGen=(t.__wdGen||0)+1;return()=>e!==t.__wdGen}var O=!0;function P(t,e){let n=window.wd;n&&n.debug&&console.warn(`[wd] expression failed: ${t}`,e)}function Et(){for(let t of document.querySelectorAll("[data-wd-computed]")){let e=t.getAttribute("data-wd-computed-key")||"",n=t.getAttribute("data-wd-computed-expr")||"null";try{a[e]=ht(U(n),void 0)}catch(r){a[e]=void 0,P(n,r)}}}var It=(t,e)=>String(t??"").toLowerCase().includes(String(e??"").toLowerCase());function ht(t,e){let n=r=>{switch(r[0]){case"L":return r[1];case"S":return f(a[r[1]],r[2]??null);case"I":return f(e,r[1]??null);case"C":return It(n(r[1]),n(r[2]));case"A":return Ft(r[1],n(r[2]),r[3]);case"!":return!n(r[1]);case"u-":return-n(r[1]);case"&&":return n(r[1])&&n(r[2]);case"||":return n(r[1])||n(r[2]);case"==":return n(r[1])==n(r[2]);case"!=":return n(r[1])!=n(r[2]);case">":return n(r[1])>n(r[2]);case"<":return n(r[1])<n(r[2]);case">=":return n(r[1])>=n(r[2]);case"<=":return n(r[1])<=n(r[2]);case"+":return n(r[1])+n(r[2]);case"-":return n(r[1])-n(r[2]);case"*":return n(r[1])*n(r[2]);case"/":return n(r[1])/n(r[2]);case"%":return n(r[1])%n(r[2])}throw new Error(`wd: unknown op ${r[0]}`)};return n(t)}var it=new Map;function U(t){let e=it.get(t);if(e)return e;let n=JSON.parse(t);return it.set(t,n),n}function K(t,e){try{return!!ht(t,e)}catch(n){return P(t,n),!1}}function bt(t,e,n){if(!e)return;let r;try{r=JSON.parse(e)}catch{return}for(let[o,s]of r)t.classList.toggle(o,K(s,n))}function $t(t,e){let n=String(t&&typeof t=="object"?t.id??t.key??JSON.stringify(t):t).replace(/#/g,"##"),r=e.get(n)||0;return e.set(n,r+1),r?`${n}#${r}`:n}function St(t,e,n={}){let r=t.querySelectorAll("[data-wd-loop-item]"),o=s=>r.length&&s.closest("[data-wd-loop-item]");for(let s of t.querySelectorAll("[data-wd-each-if]")){if(o(s))continue;let c=s.getAttribute("data-wd-if-expr"),i=s.getAttribute("data-wd-meta"),u=c?K(U(c),e):i?n[i]:f(e,s.getAttribute("data-wd-path")),l=s.querySelector("[data-wd-each-if-out]");l&&(At(s,l,u,"wd-if"),St(l,e,n))}r=t.querySelectorAll("[data-wd-loop-item]");for(let s of I(t,"[data-wd-each]"))o(s)||(s.textContent=tt(s,f(e,s.getAttribute("data-wd-path")))??"");for(let s of t.querySelectorAll("[data-wd-each-meta]"))o(s)||(s.textContent=tt(s,n[s.getAttribute("data-wd-each-meta")||""])??"");for(let s of I(t,"[data-wd-each-class]"))o(s)||bt(s,s.getAttribute("data-wd-each-class"),e);for(let s of I(t,"[data-wd-each-attr]"))o(s)||wt(s,s.getAttribute("data-wd-each-attr"),e,n);for(let s of r)Ot(s,f(e,s.getAttribute("data-wd-loop-item")))}function at(t,e){let n=t.getAttribute(e);return n==null?null:n.startsWith("key:")?Number(a[n.slice(4)]??0):Number(n)}function Dt(t,e){let n=e.getAttribute("data-wd-loop-sort");if(n!=null){let s=n.startsWith("key:"),c=s?String(a[n.slice(4)]??""):n;if(!s||c){let i=e.getAttribute("data-wd-loop-sort-dir")||"asc";i.startsWith("key:")&&(i=String(a[i.slice(4)]??"asc"));let u=i==="desc"?-1:1;t=t.map((l,m)=>({value:l,index:m})).sort((l,m)=>{let h=f(l.value,c||null),d=f(m.value,c||null),p=typeof h=="number"&&typeof d=="number"?h-d:String(h).localeCompare(String(d));return p?p*u:l.index-m.index}).map(l=>l.value)}}e.hasAttribute("data-wd-loop-reverse")&&t.reverse();let r=at(e,"data-wd-loop-offset");r&&(t=t.slice(r));let o=at(e,"data-wd-loop-limit");return o!=null&&(t=t.slice(0,o)),t}function At(t,e,n,r){let o=String(!!n);if(t.getAttribute("data-wd-if-active")===o)return!1;t.setAttribute("data-wd-if-active",o);let s=t.querySelector(`template[data-${r}-${o}]`);return $(e),e.innerHTML=s?.innerHTML||"",O=!0}function Nt(t){let e=t.getAttribute("data-wd-if-expr"),n=e?K(U(e),void 0):f(a[t.getAttribute("data-wd-if")||""],t.getAttribute("data-wd-path")),r=t.querySelector("[data-wd-if-out]");if(!(!r||!At(t,r,n,"wd")))for(let o of r.querySelectorAll("[data-wd-if]"))Nt(o)}function Ot(t,e){let n=t.querySelector("template[data-wd-loop-template]"),r=t.querySelector("[data-wd-loop-out]");if(!n||!r)return;let o=Array.isArray(e)?e.slice():[],s=t.getAttribute("data-wd-loop-where");if(s){let d=U(s);o=o.filter(p=>K(d,p))}o=Dt(o,t);let c=t.querySelector("template[data-wd-loop-empty]");if(!o.length&&c){if(r.getAttribute("data-wd-empty")!=="1"){$(r),r.textContent="";for(let d of[...c.content.children])r.appendChild(d.cloneNode(!0));r.setAttribute("data-wd-empty","1"),O=!0}return}r.getAttribute("data-wd-empty")==="1"&&($(r),r.textContent="",r.removeAttribute("data-wd-empty"));let i=new Map;for(let d of[...r.children])i.set(d.getAttribute("data-wd-loop-key")||"",d);let u=new Map,l=new Set,m=o.length,h=!1;for(let d=0;d<m;d++){let p=o[d],S=$t(p,u),w=i.get(S);if(!w||l.has(S)){if(w=n.content.firstElementChild?.cloneNode(!0),!w)continue;w.setAttribute("data-wd-loop-key",S),O=!0}l.add(S),St(w,p,{index:d,number:d+1,first:d===0,last:d===m-1,count:m}),w.__wdItem=p,(h||r.children[d]!==w)&&(h=!0,r.appendChild(w))}for(let[d,p]of i)l.has(d)||($(p),p.remove())}var ct=0;function R(){for(let t=0;t<3;t++){O&&Pt(),O=!1,Et();for(let e of document.querySelectorAll("[data-wd-if]"))Nt(e);for(let e of document.querySelectorAll("[data-wd-class]"))bt(e,e.getAttribute("data-wd-class"),void 0);for(let e of document.querySelectorAll("[data-wd-loop]")){let n=e.getAttribute("data-wd-loop"),r=e.getAttribute("data-wd-loop-data"),o=n?n.indexOf("."):-1;Ot(e,n?o<0?a[n]:f(a[n.slice(0,o)],n.slice(o+1)):r?JSON.parse(r):[])}if(!O)break}O&&++ct<10?(window.wd?.debug&&console.warn("[wd] render did not settle; scheduling another pass"),g()):ct=0;for(let t of document.querySelectorAll("[data-wd-bind]"))t.textContent=tt(t,f(a[t.getAttribute("data-wd-bind")||""],t.getAttribute("data-wd-path")))??"";for(let t of document.querySelectorAll("[data-wd-attr]"))wt(t,t.getAttribute("data-wd-attr"),void 0,{});for(let t of document.querySelectorAll("[data-wd-bind-input]")){let e=a[t.getAttribute("data-wd-bind-input")||""]??"";t.type==="checkbox"?t.checked=!!e:t.type==="radio"?t.checked=t.value===String(e):document.activeElement!==t&&(t.value=e)}Lt(),vt(),j.size&&Kt()}function Lt(){for(let t of document.querySelectorAll("[data-wd-theme]")){let e=a[t.getAttribute("data-wd-theme")||""],n=document.documentElement;e==null||e===""||e==="auto"?n.removeAttribute("data-theme"):n.setAttribute("data-theme",String(e))}}var L=[],V=0;function vt(){if(!L.length)return;let t=!1;for(let e of L){let n=JSON.stringify(f(a,e.watch)??null);n!==e.last&&(e.last=n,kt(e.actions),t=!0)}if(!t){V=0;return}if(b(),++V>=10){V=0,console.warn("effect did not settle");return}R()}var jt=typeof requestAnimationFrame=="function"?requestAnimationFrame:queueMicrotask,Z=!1;function g(){Z||(Z=!0,jt(()=>{Z=!1,R()}))}document.addEventListener("input",t=>{let e=t.target?.closest("[data-wd-bind-input]");e&&(a[e.getAttribute("data-wd-bind-input")||""]=e.type==="range"?e.valueAsNumber:e.type==="checkbox"?e.checked:e.value,b(),g(),G())});function ut(t){if(!t)return null;let e=t.closest("[data-wd-loop-key]"),n=t.closest("[data-wd-loop]");return!e||!n?null:{srcKey:n.getAttribute("data-wd-loop"),item:e.__wdItem}}function et(t,e,n,r){let o=i=>Ct(a,n,i),s=f(a,n),c=()=>Array.isArray(s)?s:[];if(e==="inc"&&o(Number(s??0)+1),e==="dec"&&o(Number(s??0)-1),e==="add"&&o(Number(s??0)+Number(r)),e==="sub"&&o(Number(s??0)-Number(r)),e==="toggle"&&o(!s),e==="set"&&o(r),e==="append"&&o([...c(),r]),e==="prepend"&&o([r,...c()]),e==="member-toggle"&&o(c().includes(r)?c().filter(i=>i!==r):[...c(),r]),e==="remove-value"&&o(c().filter(i=>i!==r)),e==="clear"&&o(Array.isArray(s)?[]:{}),e==="merge"&&o({...s&&typeof s=="object"?s:{},...typeof r=="string"?f(a,r):r}),e==="delete"&&s&&typeof s=="object"&&(delete s[r],o(s)),e==="reset"&&o(structuredClone(f(M,n))),e==="refetch"){let i=document.querySelector(`[data-wd-fetch-key="${n}"]`);i&&v(i)}if(e==="remove"){let i=ut(t);i&&i.srcKey&&(a[i.srcKey]=(Array.isArray(a[i.srcKey])?a[i.srcKey]:[]).filter(u=>u!==i.item))}if(e==="append-row"){let i=ut(t);if(i&&i.item!==void 0){let u=i.item&&typeof i.item=="object"?structuredClone(i.item):i.item;o([...c(),u])}}}var kt=t=>{for(let e of t)et(null,e.op,e.target||"",structuredClone(e.value))};document.addEventListener("click",t=>{let e=t.target?.closest("[data-wd-action],[data-wd-actions]");if(!e)return;let n=e.getAttribute("data-wd-actions");if(n)for(let r of JSON.parse(n))et(e,r.op,r.target||"",r.value);else{let r=e.getAttribute("data-wd-value");et(e,e.getAttribute("data-wd-action")||"",e.getAttribute("data-wd-target")||"",r===null?void 0:JSON.parse(r))}b(),g(),G()});document.addEventListener("submit",t=>{let e=t.target?.closest("[data-wd-form]");if(!e)return;t.preventDefault();let n=e.getAttribute("data-wd-form")||"",r=e.getAttribute("action");if(!r){let i=new FormData(e),u=Object.fromEntries(i);for(let l of e.querySelectorAll("[data-wd-multi]")){let m=l.getAttribute("data-wd-multi");m&&(u[m]=i.getAll(m))}a[n]=u,b(),g();return}let o=yt(e);x(n),g();let s=new FormData(e);for(let i of e.querySelectorAll("[data-wd-bind-input]")){let u=i.getAttribute("data-wd-bind-input");u&&!i.getAttribute("name")&&!s.has(u)&&s.append(u,a[u]??"")}let c=e.querySelector("input[type=file]");rt(r,{method:e.getAttribute("method")||"post",headers:c?void 0:{"content-type":"application/x-www-form-urlencoded"},body:c?s:new URLSearchParams(s).toString()}).then(i=>{o()||(a[n]=i,x(n),b(),g())}).catch(i=>{o()||(x(n,i),g())})});function v(t){let e=yt(t),n=y=>t.getAttribute("data-wd-fetch-"+y)||"",r=n("key"),o=(y,A)=>{a[r+y]=A,g()},s=!1,c=n("url").replace(/\{\s*([\w$.]+)\s*\}/g,(y,A)=>{let k=f(a,A);return(k==null||k==="")&&(s=!0),encodeURIComponent(String(k??""))});if(s)return o("_loading",!1);let i=n("headers"),u=n("body"),l=n("refresh"),m=n("method")||"GET",h=Number(n("timeout")),d=Number(n("retry")),p=!1;x(r),o("_loading",!0);let S=y=>{x(r,y),o("_loading",!1)},w=()=>{let y={method:m};i&&(y.headers=a[i]||{}),u&&m!=="GET"&&(y.body=JSON.stringify(a[u]??null));let A=typeof AbortController=="function"?new AbortController:null;A&&(y.signal=A.signal);let k=h&&A?setTimeout(()=>A.abort(),h):0;rt(c,y).then(N=>{clearTimeout(k),!e()&&(a[r]=N,a[r+"_empty"]=Jt(N),x(r),o("_loading",!1))}).catch(N=>{if(clearTimeout(k),e())return;let st=N&&N.status===401;if(st&&l&&i&&!p)return p=!0,void Mt(l,i).then(qt=>{e()||(qt?w():S(N))});if(st&&p)return void S(N);if(d-- >0)return void setTimeout(w,200);S(N)})};w()}var Q=new Map;function Mt(t,e){let n=Q.get(t);if(n)return n;let r=rt(t,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a[e]??{})}).then(o=>o&&typeof o=="object"?(a[e]=o,b(),!0):!1).catch(()=>!1).finally(()=>Q.delete(t));return Q.set(t,r),r}var ot=[],_t=t=>(t.getAttribute("data-wd-fetch-deps")||"").split(",").filter(Boolean).map(e=>JSON.stringify(f(a,e))).join("|"),dt=0,C=new Set;function G(){for(let t of ot){let e=_t(t);e&&e!==t.__wdSnap&&(t.__wdSnap=e,C.add(t))}C.size&&(clearTimeout(dt),dt=setTimeout(()=>{for(let t of C)v(t);C.clear()},150))}function $(t){for(let e of I(t,"[data-wd-fetch],[data-wd-effect],[data-wd-every]")){C.delete(e);for(let n of[ot,L,E])for(let r=n.length-1;r>=0;r--)(n[r].node||n[r])===e&&(n[r].t&&clearInterval(n[r].t),n.splice(r,1))}}function Pt(){mt();for(let t of document.querySelectorAll("[data-wd-fetch],[data-wd-effect],[data-wd-every]"))if(!t.__wdReg){if(t.__wdReg=1,t.hasAttribute("data-wd-effect")){let e=JSON.parse(t.textContent||"{}");L.push({node:t,watch:e.watch,actions:e.actions||[],last:JSON.stringify(f(a,e.watch)??null)})}if(t.hasAttribute("data-wd-every")&&(E.length||document.addEventListener("visibilitychange",()=>document.hidden?Ut():lt()),E.push({...JSON.parse(t.textContent||"{}"),node:t}),lt()),t.hasAttribute("data-wd-fetch"))if(ot.push(t),t.__wdSnap=_t(t),t.getAttribute("data-wd-fetch-when")==="visible"&&"IntersectionObserver"in window){let e=new IntersectionObserver(n=>{n.some(r=>r.isIntersecting)&&(e.disconnect(),v(t))});e.observe(t)}else v(t)}}var E=[];function lt(){if(!document.hidden)for(let t of E)t.t||!t.ms||!t.actions||(t.t=setInterval(()=>{kt(t.actions),b(),g(),G()},t.ms))}function Ut(){for(let t of E)clearInterval(t.t),t.t=0}var j=new Map;function Kt(){for(let[t,e]of j){let n=JSON.stringify(a[t]??null);if(n!==e.last){e.last=n;for(let r of e.cbs)try{r(a[t])}catch(o){P(`subscribe ${t}`,o)}}}}window.wd={state:a,debug:!1,get:t=>a[t],set:(t,e)=>{a[t]=e,b(),g(),G()},subscribe:(t,e)=>{let n=j.get(t);n||(n={cbs:new Set,last:JSON.stringify(a[t]??null)},j.set(t,n)),n.cbs.add(e);try{e(a[t])}catch(r){P(`subscribe ${t}`,r)}return()=>n.cbs.delete(e)},render:R};R();
+var a={},ft=new Set,nt=new Set,T=new Set,M={};function J(t,e){try{return e===void 0?localStorage.getItem(t):e===null?localStorage.removeItem(t):localStorage.setItem(t,e)}catch{return null}}var X=t=>t.replace(":",".");function mt(){for(let t of document.querySelectorAll("script[data-wd-state],script[data-wd-store]")){let e=t.getAttribute("data-wd-store"),n=JSON.parse(t.textContent||"null");for(let[r,o]of e?[[e,n]]:Object.entries(n||{})){if(r in a)continue;if(a[r]=structuredClone(M[r]=o),e?!t.hasAttribute("data-wd-store-ephemeral"):t.getAttribute("data-wd-persist")===r){(e?nt:ft).add(r);let c=(e?"wd:store:":"wd:")+r,i=J(c);i===null?e&&J(c,JSON.stringify(o??null)):F(i)===void 0?J(c,null):a[r]=F(i)}t.getAttribute("data-wd-url")===r&&(T.add(r),pt(!1,[r]))}}}function xt(){if(!T.size)return;let t=new URLSearchParams(location.search);for(let r of T){let o=a[r];JSON.stringify(o??null)===JSON.stringify(M[r]??null)?t.delete(X(r)):t.set(X(r),typeof o=="string"?o:JSON.stringify(o))}let e=t.toString(),n=location.pathname+(e?`?${e}`:"")+location.hash;if(n!==location.pathname+location.search+location.hash)try{history.replaceState(history.state,"",n)}catch{}}function pt(t,e){let n=new URLSearchParams(location.search);for(let r of e||T){let o=n.get(X(r)),s=M[r];o==null?t&&(a[r]=structuredClone(s)):a[r]=typeof s=="string"?o:F(o)??o}}function b(){for(let t of ft)J(`wd:${t}`,JSON.stringify(a[t]??null));for(let t of nt)J(`wd:store:${t}`,JSON.stringify(a[t]??null));xt()}mt();window.addEventListener("popstate",()=>{T.size&&(pt(!0),b(),g())});window.addEventListener("storage",t=>{let e=t.key&&t.key.startsWith("wd:store:")?t.key.slice(9):"";if(!nt.has(e)||t.newValue==null)return;let n=F(t.newValue);n!==void 0&&JSON.stringify(n)!==JSON.stringify(a[e])&&(a[e]=n,g())});var Y=t=>t==="__proto__"||t==="constructor"||t==="prototype";function f(t,e){if(!e)return t;let n=t;for(let r of e.split(".")){if(n==null||Y(r))return;n=n[r]}return n}function Ct(t,e,n){let r=e.split("."),o=r.pop()||"",s=t;for(let c of r){if(Y(c))return;(s[c]==null||typeof s[c]!="object")&&(s[c]={}),s=s[c]}Y(o)||(s[o]=n)}function Jt(t){return t==null||typeof t=="object"&&(Array.isArray(t)?t.length:Object.keys(t).length)===0}function F(t){try{return JSON.parse(t,(e,n)=>e==="toString"||e==="valueOf"?void 0:n)}catch{return}}var Tt=/[\u0000-\u0020()<>"'`\\\u007F]/g,$=(t,e)=>t.matches(e)?[t,...t.querySelectorAll(e)]:[...t.querySelectorAll(e)];function wt(t,e,n,r){if(!e)return;let o;try{o=JSON.parse(e)}catch{return}let s="",c="";for(let i=1;i<o.length;i++){let u=o[i];if(typeof u=="string"){s+=u,c+=u;continue}let l=String((u[0]==="s"?f(a[u[1]],u[2]):u[0]==="m"?r[u[1]]:f(n,u[1]))??"");c+=l,s+=l.replace(Tt,m=>`%${m.charCodeAt(0).toString(16).toUpperCase().padStart(2,"0")}`)}o[0]!=="href"&&o[0]!=="src"||t.setAttribute(o[0],/^(javascript|data|vbscript):/i.test(c.replace(/[\u0000-\u0020\u007F]+/g,""))?"":s)}var q=t=>{let e=typeof t=="number"?t:Number.parseFloat(t);return Number.isFinite(e)?e:0},k=t=>Array.isArray(t)?t:t==null?[]:[t],gt=(t,e)=>e!=null&&e!==""?t?.[e]:t,z=(t,e)=>t.map(n=>q(gt(n,e))),B=t=>{if(t instanceof Date)return t;if(typeof t=="number")return new Date(t);let e=String(t).trim();return/^-?\d+$/.test(e)?new Date(Number(e)):new Date(e)},W=(t,e,n)=>Number.isNaN(t.getTime())?String(n):new Intl.DateTimeFormat(void 0,e).format(t),H=t=>typeof t=="string"&&/^\d{4}-\d{2}-\d{2}$/.test(t.trim())?{timeZone:"UTC"}:void 0,E={money:(t,[e="USD",n])=>new Intl.NumberFormat(n||void 0,{style:"currency",currency:String(e||"USD")}).format(q(t)),number:(t,[e])=>new Intl.NumberFormat(void 0,e==null?{}:{minimumFractionDigits:+e,maximumFractionDigits:+e}).format(q(t)),percent:(t,[e=0])=>new Intl.NumberFormat(void 0,{style:"percent",minimumFractionDigits:+e,maximumFractionDigits:+e}).format(q(t)),round:(t,[e=0])=>{let n=10**+e;return Math.round(q(t)*n)/n},date:(t,[e="medium"])=>W(B(t),{dateStyle:e,...H(t)},t),time:(t,[e="short"])=>W(B(t),{timeStyle:e,...H(t)},t),datetime:(t,[e="medium",n="short"])=>W(B(t),{dateStyle:e,timeStyle:n,...H(t)},t),upper:t=>String(t??"").toUpperCase(),lower:t=>String(t??"").toLowerCase(),capitalize:t=>{let e=String(t??"");return e&&e[0].toUpperCase()+e.slice(1)},truncate:(t,[e=50,n="…"])=>{let r=String(t??"");return r.length>+e?r.slice(0,+e).trimEnd()+String(n):r},trim:t=>String(t??"").trim(),pluralize:(t,[e="",n])=>{let r=q(t);return`${new Intl.NumberFormat().format(r)} ${Math.abs(r)===1?String(e):n!=null?String(n):`${e}s`}`},default:(t,[e=""])=>t==null||t===""||Array.isArray(t)&&!t.length?String(e):t,sum:(t,[e])=>z(k(t),e).reduce((n,r)=>n+r,0),avg:(t,[e])=>{let n=k(t);return n.length?E.sum(n,[e])/n.length:0},min:(t,[e])=>{let n=k(t);return n.length?z(n,e).reduce((r,o)=>Math.min(r,o)):0},max:(t,[e])=>{let n=k(t);return n.length?z(n,e).reduce((r,o)=>Math.max(r,o)):0},count:t=>k(t).length,join:(t,[e=", ",n])=>k(t).map(r=>gt(r,n)).join(String(e))};function tt(t,e){let n=t.getAttribute("data-wd-fmt");if(!n)return e;let r;try{r=JSON.parse(n)}catch{return e}let o=e;for(let[s,c]of r)E[s]&&(o=E[s](o,c||[]));return o}var Ft=(t,e,n)=>E[t]?E[t](e,n==null?[]:[n]):void 0;async function rt(t,e){let n=await fetch(t,e),r=await n.text(),o=F(r);if(!n.ok){let s=o&&[o.error,o.message].find(i=>typeof i=="string"&&i),c=new Error(s||`HTTP ${n.status}`);throw c.status=n.status,c.body=o??null,c}return o===void 0?{status:n.status,body:r}:o}function x(t,e){a[t+"_error"]=e?e.message||String(e):null,a[t+"_error_body"]=(e&&e.body)??null}function yt(t){let e=t.__wdGen=(t.__wdGen||0)+1;return()=>e!==t.__wdGen}var _=!0;function P(t,e){let n=window.wd;n&&n.debug&&console.warn(`[wd] expression failed: ${t}`,e)}function Et(){for(let t of document.querySelectorAll("[data-wd-computed]")){let e=t.getAttribute("data-wd-computed-key")||"",n=t.getAttribute("data-wd-computed-expr")||"null";try{a[e]=ht(U(n),void 0)}catch(r){a[e]=void 0,P(n,r)}}}var It=(t,e)=>String(t??"").toLowerCase().includes(String(e??"").toLowerCase());function ht(t,e){let n=r=>{switch(r[0]){case"L":return r[1];case"S":return f(a[r[1]],r[2]??null);case"I":return f(e,r[1]??null);case"C":return It(n(r[1]),n(r[2]));case"A":return Ft(r[1],n(r[2]),r[3]);case"!":return!n(r[1]);case"u-":return-n(r[1]);case"&&":return n(r[1])&&n(r[2]);case"||":return n(r[1])||n(r[2]);case"==":return n(r[1])==n(r[2]);case"!=":return n(r[1])!=n(r[2]);case">":return n(r[1])>n(r[2]);case"<":return n(r[1])<n(r[2]);case">=":return n(r[1])>=n(r[2]);case"<=":return n(r[1])<=n(r[2]);case"+":return n(r[1])+n(r[2]);case"-":return n(r[1])-n(r[2]);case"*":return n(r[1])*n(r[2]);case"/":return n(r[1])/n(r[2]);case"%":return n(r[1])%n(r[2])}throw new Error(`wd: unknown op ${r[0]}`)};return n(t)}var it=new Map;function U(t){let e=it.get(t);if(e)return e;let n=JSON.parse(t);return it.set(t,n),n}function K(t,e){try{return!!ht(t,e)}catch(n){return P(t,n),!1}}function bt(t,e,n){if(!e)return;let r;try{r=JSON.parse(e)}catch{return}for(let[o,s]of r)t.classList.toggle(o,K(s,n))}function $t(t,e){let n=String(t&&typeof t=="object"?t.id??t.key??JSON.stringify(t):t).replace(/#/g,"##"),r=e.get(n)||0;return e.set(n,r+1),r?`${n}#${r}`:n}function St(t,e,n={}){let r=t.querySelectorAll("[data-wd-loop-item]"),o=s=>r.length&&s.closest("[data-wd-loop-item]");for(let s of t.querySelectorAll("[data-wd-each-if]")){if(o(s))continue;let c=s.getAttribute("data-wd-if-expr"),i=s.getAttribute("data-wd-meta"),u=c?K(U(c),e):i?n[i]:f(e,s.getAttribute("data-wd-path")),l=s.querySelector("[data-wd-each-if-out]");l&&(At(s,l,u,"wd-if"),St(l,e,n))}r=t.querySelectorAll("[data-wd-loop-item]");for(let s of $(t,"[data-wd-each]"))o(s)||(s.textContent=tt(s,f(e,s.getAttribute("data-wd-path")))??"");for(let s of t.querySelectorAll("[data-wd-each-meta]"))o(s)||(s.textContent=tt(s,n[s.getAttribute("data-wd-each-meta")||""])??"");for(let s of $(t,"[data-wd-each-class]"))o(s)||bt(s,s.getAttribute("data-wd-each-class"),e);for(let s of $(t,"[data-wd-each-attr]"))o(s)||wt(s,s.getAttribute("data-wd-each-attr"),e,n);for(let s of r)Ot(s,f(e,s.getAttribute("data-wd-loop-item")))}function at(t,e){let n=t.getAttribute(e);return n==null?null:n.startsWith("key:")?Number(a[n.slice(4)]??0):Number(n)}function vt(t,e){let n=e.getAttribute("data-wd-loop-sort");if(n!=null){let s=n.startsWith("key:"),c=s?String(a[n.slice(4)]??""):n;if(!s||c){let i=e.getAttribute("data-wd-loop-sort-dir")||"asc";i.startsWith("key:")&&(i=String(a[i.slice(4)]??"asc"));let u=i==="desc"?-1:1;t=t.map((l,m)=>({value:l,index:m})).sort((l,m)=>{let h=f(l.value,c||null),d=f(m.value,c||null),p=typeof h=="number"&&typeof d=="number"?h-d:String(h).localeCompare(String(d));return p?p*u:l.index-m.index}).map(l=>l.value)}}e.hasAttribute("data-wd-loop-reverse")&&t.reverse();let r=at(e,"data-wd-loop-offset");r&&(t=t.slice(r));let o=at(e,"data-wd-loop-limit");return o!=null&&(t=t.slice(0,o)),t}function At(t,e,n,r){let o=String(!!n);if(t.getAttribute("data-wd-if-active")===o)return!1;t.setAttribute("data-wd-if-active",o);let s=t.querySelector(`template[data-${r}-${o}]`);return v(e),e.innerHTML=s?.innerHTML||"",_=!0}function Nt(t){let e=t.getAttribute("data-wd-if-expr"),n=e?K(U(e),void 0):f(a[t.getAttribute("data-wd-if")||""],t.getAttribute("data-wd-path")),r=t.querySelector("[data-wd-if-out]");if(!(!r||!At(t,r,n,"wd")))for(let o of r.querySelectorAll("[data-wd-if]"))Nt(o)}function Ot(t,e){let n=t.querySelector("template[data-wd-loop-template]"),r=t.querySelector("[data-wd-loop-out]");if(!n||!r)return;let o=Array.isArray(e)?e.slice():[],s=t.getAttribute("data-wd-loop-where");if(s){let d=U(s);o=o.filter(p=>K(d,p))}o=vt(o,t);let c=t.querySelector("template[data-wd-loop-empty]");if(!o.length&&c){if(r.getAttribute("data-wd-empty")!=="1"){v(r),r.textContent="";for(let d of[...c.content.children])r.appendChild(d.cloneNode(!0));r.setAttribute("data-wd-empty","1"),_=!0}return}r.getAttribute("data-wd-empty")==="1"&&(v(r),r.textContent="",r.removeAttribute("data-wd-empty"));let i=new Map;for(let d of[...r.children])i.set(d.getAttribute("data-wd-loop-key")||"",d);let u=new Map,l=new Set,m=o.length,h=!1;for(let d=0;d<m;d++){let p=o[d],S=$t(p,u),w=i.get(S);if(!w||l.has(S)){if(w=n.content.firstElementChild?.cloneNode(!0),!w)continue;w.setAttribute("data-wd-loop-key",S),_=!0}l.add(S),St(w,p,{index:d,number:d+1,first:d===0,last:d===m-1,count:m}),w.__wdItem=p,(h||r.children[d]!==w)&&(h=!0,r.appendChild(w))}for(let[d,p]of i)l.has(d)||(v(p),p.remove())}var ct=0;function R(){for(let t=0;t<3;t++){_&&Pt(),_=!1,Et();for(let e of document.querySelectorAll("[data-wd-if]"))Nt(e);for(let e of document.querySelectorAll("[data-wd-class]"))bt(e,e.getAttribute("data-wd-class"),void 0);for(let e of document.querySelectorAll("[data-wd-loop]")){let n=e.getAttribute("data-wd-loop"),r=e.getAttribute("data-wd-loop-data"),o=n?n.indexOf("."):-1;Ot(e,n?o<0?a[n]:f(a[n.slice(0,o)],n.slice(o+1)):r?JSON.parse(r):[])}if(!_)break}_&&++ct<10?(window.wd?.debug&&console.warn("[wd] render did not settle; scheduling another pass"),g()):ct=0;for(let t of document.querySelectorAll("[data-wd-bind]"))t.textContent=tt(t,f(a[t.getAttribute("data-wd-bind")||""],t.getAttribute("data-wd-path")))??"";for(let t of document.querySelectorAll("[data-wd-attr]"))wt(t,t.getAttribute("data-wd-attr"),void 0,{});for(let t of document.querySelectorAll("[data-wd-bind-input]")){let e=a[t.getAttribute("data-wd-bind-input")||""]??"";t.type==="checkbox"?t.checked=!!e:t.type==="radio"?t.checked=t.value===String(e):document.activeElement!==t&&(t.value=e)}Dt(),Lt(),j.size&&Kt()}function Dt(){for(let t of document.querySelectorAll("[data-wd-theme]")){let e=a[t.getAttribute("data-wd-theme")||""],n=document.documentElement;e==null||e===""||e==="auto"?n.removeAttribute("data-theme"):n.setAttribute("data-theme",String(e))}}var D=[],V=0;function Lt(){if(!D.length)return;let t=!1;for(let e of D){let n=JSON.stringify(f(a,e.watch)??null);n!==e.last&&(e.last=n,_t(e.actions),t=!0)}if(!t){V=0;return}if(b(),++V>=10){V=0,console.warn("effect did not settle");return}R()}var jt=typeof requestAnimationFrame=="function"?requestAnimationFrame:queueMicrotask,Z=!1;function g(){Z||(Z=!0,jt(()=>{Z=!1,R()}))}document.addEventListener("input",t=>{let e=t.target?.closest("[data-wd-bind-input]");e&&(a[e.getAttribute("data-wd-bind-input")||""]=e.type==="range"?e.valueAsNumber:e.type==="checkbox"?e.checked:e.value,b(),g(),G())});function ut(t){if(!t)return null;let e=t.closest("[data-wd-loop-key]"),n=t.closest("[data-wd-loop]");return!e||!n?null:{srcKey:n.getAttribute("data-wd-loop"),item:e.__wdItem}}function et(t,e,n,r){let o=i=>Ct(a,n,i),s=f(a,n),c=()=>Array.isArray(s)?s:[];if(e==="inc"&&o(Number(s??0)+1),e==="dec"&&o(Number(s??0)-1),e==="add"&&o(Number(s??0)+Number(r)),e==="sub"&&o(Number(s??0)-Number(r)),e==="toggle"&&o(!s),e==="set"&&o(r),e==="append"&&o([...c(),r]),e==="prepend"&&o([r,...c()]),e==="member-toggle"&&o(c().includes(r)?c().filter(i=>i!==r):[...c(),r]),e==="remove-value"&&o(c().filter(i=>i!==r)),e==="clear"&&o(Array.isArray(s)?[]:{}),e==="merge"&&o({...s&&typeof s=="object"?s:{},...typeof r=="string"?f(a,r):r}),e==="delete"&&s&&typeof s=="object"&&(delete s[r],o(s)),e==="reset"&&o(structuredClone(f(M,n))),e==="refetch"){let i=document.querySelector(`[data-wd-fetch-key="${n}"]`);i&&L(i)}if(e==="remove"){let i=ut(t);i&&i.srcKey&&(a[i.srcKey]=(Array.isArray(a[i.srcKey])?a[i.srcKey]:[]).filter(u=>u!==i.item))}if(e==="append-row"){let i=ut(t);if(i&&i.item!==void 0){let u=i.item&&typeof i.item=="object"?structuredClone(i.item):i.item;o([...c(),u])}}}var _t=t=>{for(let e of t)et(null,e.op,e.target||"",structuredClone(e.value))};document.addEventListener("click",t=>{let e=t.target?.closest("[data-wd-action],[data-wd-actions]");if(!e)return;let n=e.getAttribute("data-wd-actions");if(n)for(let r of JSON.parse(n))et(e,r.op,r.target||"",r.value);else{let r=e.getAttribute("data-wd-value");et(e,e.getAttribute("data-wd-action")||"",e.getAttribute("data-wd-target")||"",r===null?void 0:JSON.parse(r))}b(),g(),G()});document.addEventListener("submit",t=>{let e=t.target?.closest("[data-wd-form]");if(!e)return;t.preventDefault();let n=e.getAttribute("data-wd-form")||"",r=e.getAttribute("action");if(!r){let i=new FormData(e),u=Object.fromEntries(i);for(let l of e.querySelectorAll("[data-wd-multi]")){let m=l.getAttribute("data-wd-multi");m&&(u[m]=i.getAll(m))}a[n]=u,b(),g();return}let o=yt(e);x(n),g();let s=new FormData(e);for(let i of e.querySelectorAll("[data-wd-bind-input]")){let u=i.getAttribute("data-wd-bind-input");u&&!i.getAttribute("name")&&!s.has(u)&&s.append(u,a[u]??"")}let c=e.querySelector("input[type=file]");rt(r,{method:e.getAttribute("method")||"post",headers:c?void 0:{"content-type":"application/x-www-form-urlencoded"},body:c?s:new URLSearchParams(s).toString()}).then(i=>{o()||(a[n]=i,x(n),b(),g())}).catch(i=>{o()||(x(n,i),g())})});function L(t){let e=yt(t),n=y=>t.getAttribute("data-wd-fetch-"+y)||"",r=n("key"),o=(y,A)=>{a[r+y]=A,g()},s=!1,c=n("url").replace(/\{\s*([\w$.]+)\s*\}/g,(y,A)=>{let N=f(a,A);return(N==null||N===""||N==="."||N==="..")&&(s=!0),encodeURIComponent(String(N??""))});if(s)return o("_loading",!1);let i=n("headers"),u=n("body"),l=n("refresh"),m=n("method")||"GET",h=Number(n("timeout")),d=Number(n("retry")),p=!1;x(r),o("_loading",!0);let S=y=>{x(r,y),o("_loading",!1)},w=()=>{let y={method:m};i&&(y.headers=a[i]||{}),u&&m!=="GET"&&(y.body=JSON.stringify(a[u]??null));let A=typeof AbortController=="function"?new AbortController:null;A&&(y.signal=A.signal);let N=h&&A?setTimeout(()=>A.abort(),h):0;rt(c,y).then(O=>{clearTimeout(N),!e()&&(a[r]=O,a[r+"_empty"]=Jt(O),x(r),o("_loading",!1))}).catch(O=>{if(clearTimeout(N),e())return;let st=O&&O.status===401;if(st&&l&&i&&!p)return p=!0,void Mt(l,i).then(qt=>{e()||(qt?w():S(O))});if(st&&p)return void S(O);if(d-- >0)return void setTimeout(w,200);S(O)})};w()}var Q=new Map;function Mt(t,e){let n=Q.get(t);if(n)return n;let r=rt(t,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(a[e]??{})}).then(o=>o&&typeof o=="object"?(a[e]=o,b(),!0):!1).catch(()=>!1).finally(()=>Q.delete(t));return Q.set(t,r),r}var ot=[],kt=t=>(t.getAttribute("data-wd-fetch-deps")||"").split(",").filter(Boolean).map(e=>JSON.stringify(f(a,e))).join("|"),dt=0,C=new Set;function G(){for(let t of ot){let e=kt(t);e&&e!==t.__wdSnap&&(t.__wdSnap=e,C.add(t))}C.size&&(clearTimeout(dt),dt=setTimeout(()=>{for(let t of C)L(t);C.clear()},150))}function v(t){for(let e of $(t,"[data-wd-fetch],[data-wd-effect],[data-wd-every]")){C.delete(e);for(let n of[ot,D,I])for(let r=n.length-1;r>=0;r--)(n[r].node||n[r])===e&&(n[r].t&&clearInterval(n[r].t),n.splice(r,1))}}function Pt(){mt();for(let t of document.querySelectorAll("[data-wd-fetch],[data-wd-effect],[data-wd-every]"))if(!t.__wdReg){if(t.__wdReg=1,t.hasAttribute("data-wd-effect")){let e=JSON.parse(t.textContent||"{}");D.push({node:t,watch:e.watch,actions:e.actions||[],last:JSON.stringify(f(a,e.watch)??null)})}if(t.hasAttribute("data-wd-every")&&(I.length||document.addEventListener("visibilitychange",()=>document.hidden?Ut():lt()),I.push({...JSON.parse(t.textContent||"{}"),node:t}),lt()),t.hasAttribute("data-wd-fetch"))if(ot.push(t),t.__wdSnap=kt(t),t.getAttribute("data-wd-fetch-when")==="visible"&&"IntersectionObserver"in window){let e=new IntersectionObserver(n=>{n.some(r=>r.isIntersecting)&&(e.disconnect(),L(t))});e.observe(t)}else L(t)}}var I=[];function lt(){if(!document.hidden)for(let t of I)t.t||!t.ms||!t.actions||(t.t=setInterval(()=>{_t(t.actions),b(),g(),G()},t.ms))}function Ut(){for(let t of I)clearInterval(t.t),t.t=0}var j=new Map;function Kt(){for(let[t,e]of j){let n=JSON.stringify(a[t]??null);if(n!==e.last){e.last=n;for(let r of e.cbs)try{r(a[t])}catch(o){P(`subscribe ${t}`,o)}}}}window.wd={state:a,debug:!1,get:t=>a[t],set:(t,e)=>{a[t]=e,b(),g(),G()},subscribe:(t,e)=>{let n=j.get(t);n||(n={cbs:new Set,last:JSON.stringify(a[t]??null)},j.set(t,n)),n.cbs.add(e);try{e(a[t])}catch(r){P(`subscribe ${t}`,r)}return()=>n.cbs.delete(e)},render:R};R();
 //# sourceMappingURL=runtime.js.map