andesine 0.4.0 → 0.5.0

package/dist/cli.js

@@ -1,21 +1,30 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { Command, Option } from "@commander-js/extra-typings";
-import { chmod, cp, link, lstat, mkdir, open, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { access, chmod, cp, link, lstat, mkdir, open, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import * as z from "zod";
 import { homedir } from "node:os";
-import { promisify, styleText } from "node:util";
+import { promisify, stripVTControlCharacters, styleText } from "node:util";
 import { confirm, intro, isCancel, log, multiselect, note, select, spinner, text } from "@clack/prompts";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
-import { constants } from "node:fs";
-import { setTimeout } from "node:timers/promises";
+import { constants, watch } from "node:fs";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import lockfile from "proper-lockfile";
 import { AndesineAPIError, AndesineStreamProtocolError, createClient, paginate, paginatePages } from "@andesine/sdk";
 import openBrowser from "open";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import basex from "base-x";
+import { JSON_SCHEMA_REGISTRY } from "@orpc/zod/zod4";
+import { transformAsync } from "@babel/core";
+import { build } from "rolldown";
+import { transformSync } from "rolldown/utils";
+import { createGenerator, definePreset, presetIcons, presetWind3 } from "unocss";
+import { colors } from "unocss/preset-wind3";
+import { FileSystemIconLoader } from "@iconify/utils/lib/loader/node-loaders";
 import { CommanderError } from "commander";
 //#region src/errors.ts
 /** Process exit codes shared by commands and the executable. */
@@ -42,7 +51,7 @@ var CancelledError = class extends CLIError {
 };
 //#endregion
 //#region package.json
-var version = "0.4.0";
+var version = "0.5.0";
 //#endregion
 //#region src/config/files.ts
 /** Read declarative JSON only. Missing optional files are distinct from invalid files. */
@@ -478,7 +487,7 @@ const withStateLock = async (name, signal, run) => {
 		} catch (error) {
 			if (error.code !== "ELOCKED") throw new CLIError("Cannot lock CLI storage.");
 			if (Date.now() >= deadline) throw new CLIError("Another CLI process is using these credentials. Try again later.");
-			await setTimeout(100, void 0, { signal });
+			await setTimeout$1(100, void 0, { signal });
 		}
 	}
 	const assertOwned = () => {
@@ -593,7 +602,7 @@ const startDeviceLogin = async (baseURL, signal) => {
 const pollDeviceLogin = async (baseURL, device, expiresAt, signal) => {
 	let interval = device.interval * 1e3;
 	while (Date.now() < expiresAt) {
-		await setTimeout(Math.min(interval, Math.max(expiresAt - Date.now(), 0)), void 0, { signal });
+		await setTimeout$1(Math.min(interval, Math.max(expiresAt - Date.now(), 0)), void 0, { signal });
 		if (Date.now() >= expiresAt) break;
 		try {
 			return parseResponse(tokenResponseSchema, await oauthRequest(baseURL, "oauth2/token", {
@@ -634,35 +643,12 @@ const revokeAccess = async (baseURL, refreshToken, signal) => {
 };
 //#endregion
 //#region src/auth/client.ts
-/** Select one credential source explicitly; never fall back after an authentication error. */
-const authenticatedClient = async (context) => {
+/** The saved OAuth access token of the selected profile, refreshed when it expires soon. */
+const getAccessToken = async (context) => {
 	const { config, signal } = context;
-	const apiKey = process.env.ANDESINE_API_KEY;
-	const headers = config.workspaceID ? { "x-workspace-id": config.workspaceID } : void 0;
-	const fetcher = (input, init) => fetch(input, {
-		...init,
-		redirect: "error",
-		signal: AbortSignal.any([
-			signal,
-			...init?.signal ? [init.signal] : [],
-			...input instanceof Request ? [input.signal] : []
-		])
-	});
-	if (apiKey !== void 0) {
-		if (!apiKey.trim()) throw new CLIError("ANDESINE_API_KEY is empty. Set it or remove it before using saved credentials.");
-		return {
-			client: createClient({
-				baseURL: config.baseURL,
-				apiKey,
-				headers,
-				fetch: fetcher
-			}),
-			source: "environment"
-		};
-	}
 	const reference = config.profile?.credentialRef;
 	if (!reference) throw new CLIError("No credentials for this instance. Run andesine auth login or set ANDESINE_API_KEY.");
-	const accessToken = await withStateLock(reference, signal, async (assertOwned) => {
+	return withStateLock(reference, signal, async (assertOwned) => {
 		const store = await credentialStore(reference, signal);
 		const credentials = await store.get();
 		if (!credentials) throw new CLIError("Saved credentials were not found. Run auth login again.");
@@ -692,6 +678,35 @@ const authenticatedClient = async (context) => {
 			throw new CLIError("Could not complete the token exchange. Run auth login again; the previous refresh token will not be reused.");
 		}
 	});
+};
+/** Select one credential source explicitly; never fall back after an authentication error. */
+const authenticatedClient = async (context) => {
+	const { config, signal } = context;
+	const apiKey = process.env.ANDESINE_API_KEY;
+	const headers = config.workspaceID ? { "x-workspace-id": config.workspaceID } : void 0;
+	const fetcher = (input, init) => fetch(input, {
+		...init,
+		redirect: "error",
+		signal: AbortSignal.any([
+			signal,
+			...init?.signal ? [init.signal] : [],
+			...input instanceof Request ? [input.signal] : []
+		])
+	});
+	if (apiKey !== void 0) {
+		if (!apiKey.trim()) throw new CLIError("ANDESINE_API_KEY is empty. Set it or remove it before using saved credentials.");
+		return {
+			client: createClient({
+				baseURL: config.baseURL,
+				apiKey,
+				headers,
+				fetch: fetcher
+			}),
+			source: "environment"
+		};
+	}
+	const accessToken = await getAccessToken(context);
+	const reference = config.profile.credentialRef;
 	return {
 		client: createClient({
 			baseURL: config.baseURL,
@@ -1259,7 +1274,7 @@ const json = (value) => JSON.stringify(value).replace(/\u2028/g, "\\u2028").repl
 const literal = (value) => json(value);
 const union = (values) => [...new Set(values)].sort(compare).join(" | ") || "never";
 const tuple = (values) => `[${values.join(", ")}]`;
-const hash = (value) => createHash("sha256").update(value).digest("hex");
+const hash$1 = (value) => createHash("sha256").update(value).digest("hex");
 const identifier = (label) => {
 	const name = (label.normalize("NFKC").match(/[\p{L}\p{N}\p{M}]+/gu) ?? []).map((word) => {
 		const [first, ...rest] = Array.from(word);
@@ -1279,7 +1294,7 @@ const names = (items, suffix) => {
 	}
 	for (const item of sorted) {
 		const base = `${identifier(item.label)}${suffix}`;
-		const digest = hash(item.key);
+		const digest = hash$1(item.key);
 		let name = counts.get(base) === 1 ? base : `${base}_${digest.slice(0, 8)}`;
 		let length = 8;
 		while (used.has(name)) {
@@ -1485,7 +1500,7 @@ const generateTypes = (metadata, options = {}) => {
 		const revision = revisions.get(id);
 		if (!revision) throw new Error(`Missing schema revision ${literal(id)}.`);
 		const fields = schemaFields(revision);
-		const shapeName = `SchemaFields_${hash(fields)}`;
+		const shapeName = `SchemaFields_${hash$1(fields)}`;
 		const revisionName = revisionNames.get(id);
 		shapes.set(shapeName, fields);
 		interfaces.push(`export interface ${revisionName} extends ${shapeName} {
@@ -1730,7 +1745,7 @@ const executeTypes = async (context, options = {}, emitResult = true) => {
 			}
 			first = false;
 		}
-		await setTimeout(Math.min(delay, 2147483647), void 0, { signal });
+		await setTimeout$1(Math.min(delay, 2147483647), void 0, { signal });
 	}
 };
 //#endregion
@@ -1869,7 +1884,6 @@ const init = async (options, signal) => {
 };
 //#endregion
 //#region src/pages/init.ts
-const templateDirectory = fileURLToPath(new URL("./templates/pages/", import.meta.url));
 const isEmptyDirectory = async (directory) => {
 	try {
 		return (await readdir(directory)).length === 0;
@@ -1879,24 +1893,33 @@ const isEmptyDirectory = async (directory) => {
 	}
 };
 /** Package names allow lowercase letters, digits, and `-._~` only. */
-const toPackageName = (directory) => {
-	return path.basename(directory).toLowerCase().replace(/[^a-z\d._~-]+/g, "-").replace(/^[._-]+|[-]+$/g, "") || "andesine-pages-site";
+const toPackageName = (directory, fallback) => {
+	return path.basename(directory).toLowerCase().replace(/[^a-z\d._~-]+/g, "-").replace(/^[._-]+|[-]+$/g, "") || fallback;
 };
-/** Creates an Andesine Pages site from the template in an empty directory. */
-const initPages = async (directory, output) => {
+/**
+* Copies a template that the build places next to the bundled CLI (see `scripts/templates.ts`)
+* into a new or empty directory, named after the directory.
+*/
+const copyTemplate = async (template, directory, output) => {
+	const source = fileURLToPath(new URL(`./templates/${template}/`, import.meta.url));
 	const target = path.resolve(directory);
-	const manifestPath = path.join(target, "package.json");
 	if (!await isEmptyDirectory(target)) throw new CLIError(`${directory} is not empty. Choose a new or empty directory.`, exitCodes.usage);
 	await output.progress("Copying the template", async () => {
-		const manifest = JSON.parse(await readFile(path.join(templateDirectory, "package.template.json"), "utf8"));
-		await cp(templateDirectory, target, { recursive: true });
+		const manifest = JSON.parse(await readFile(path.join(source, "package.template.json"), "utf8"));
+		const name = toPackageName(target, manifest.name);
+		await cp(source, target, { recursive: true });
 		await rename(path.join(target, "gitignore"), path.join(target, ".gitignore"));
 		await rm(path.join(target, "package.template.json"));
-		await writeFile(manifestPath, `${JSON.stringify({
+		await writeFile(path.join(target, "package.json"), `${JSON.stringify({
 			...manifest,
-			name: toPackageName(target)
+			name
 		}, null, 2)}\n`);
 	}, "Template copied");
+	return target;
+};
+/** Creates an Andesine Pages site from the template in an empty directory. */
+const initPages = async (directory, output) => {
+	const target = await copyTemplate("pages", directory, output);
 	await output.note("Next steps", {
 		"Open the site": `cd ${path.relative(process.cwd(), target) || "."}`,
 		"Install": "npm install",
@@ -8606,6 +8629,7 @@ const schemas = {
 			"roles",
 			"webhooks",
 			"read:webhooks",
+			"extensions",
 			"workspace"
 		],
 		type: "string"
@@ -9024,6 +9048,2465 @@ const registerTypes = (program, signal) => {
 		await executeTypes(await createCommandContext(globals, signal), options);
 	});
 };
+basex("0123456789abcdef");
+basex("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
+//#endregion
+//#region ../../private/contracts/src/primitives/id.ts
+const ID_REGEX = /^(?:\w+?_[A-Za-z\d]{1,22})$/;
+const id = (options) => {
+	return z.string().regex(ID_REGEX, {
+		error: "invalid id",
+		...options
+	});
+};
+const publicID = (prefix, options) => {
+	return z.string().regex(new RegExp(`^${prefix}_[A-Za-z\\d]{1,22}$`), {
+		error: `invalid ${prefix} id`,
+		...options
+	});
+};
+//#endregion
+//#region ../../private/contracts/src/primitives/unique.ts
+/** Whether every value is distinct. */
+const uniqueItems = (values) => new Set(values).size === values.length;
+//#endregion
+//#region ../../private/contracts/src/webhooks/catalog-definitions.ts
+const webhookEventNames = [
+	"entry.created",
+	"entry.updated",
+	"entry.content_saved",
+	"entry.moved",
+	"entry.deleted",
+	"entry.restored",
+	"collection.created",
+	"collection.updated",
+	"collection.moved",
+	"collection.deleted",
+	"collection.restored",
+	"publishing.channel_advanced",
+	"publishing.channel_created",
+	"publishing.channel_deleted"
+];
+const webhookReadPermissions = [
+	"read:entries",
+	"read:collections",
+	"read:publishing"
+];
+const webhookEventDefinitions = {
+	"entry.created": {
+		label: "Entry created",
+		description: "An entry and its initial content were saved. Matches the committed collection.",
+		category: "entries",
+		requiredPermissions: ["read:entries"],
+		filters: ["collections"]
+	},
+	"entry.updated": {
+		label: "Entry metadata updated",
+		description: "Entry metadata changed. Content and location changes have separate events.",
+		category: "entries",
+		requiredPermissions: ["read:entries"],
+		filters: ["collections"]
+	},
+	"entry.content_saved": {
+		label: "Entry content saved",
+		description: "Changed content was saved and is available through the API. No-op saves do not qualify.",
+		category: "entries",
+		requiredPermissions: ["read:entries"],
+		filters: ["collections"]
+	},
+	"entry.moved": {
+		label: "Entry moved",
+		description: "An entry was moved or reordered, directly or with an ancestor. Matches either location; unauthorized location details are hidden.",
+		category: "entries",
+		requiredPermissions: ["read:entries"],
+		filters: ["collections"]
+	},
+	"entry.deleted": {
+		label: "Entry deleted",
+		description: "An entry was logically deleted. Matches its former collection; physical cleanup emits no event.",
+		category: "entries",
+		requiredPermissions: ["read:entries"],
+		filters: ["collections"]
+	},
+	"entry.restored": {
+		label: "Entry restored",
+		description: "A deleted entry was restored. Matches its restored collection.",
+		category: "entries",
+		requiredPermissions: ["read:entries"],
+		filters: ["collections"]
+	},
+	"collection.created": {
+		label: "Collection created",
+		description: "A collection was created. A selected subtree includes its root collection.",
+		category: "collections",
+		requiredPermissions: ["read:collections"],
+		filters: ["collections"]
+	},
+	"collection.updated": {
+		label: "Collection updated",
+		description: "Collection metadata changed. Matches the committed subtree and its current access restrictions.",
+		category: "collections",
+		requiredPermissions: ["read:collections"],
+		filters: ["collections"]
+	},
+	"collection.moved": {
+		label: "Collection moved",
+		description: "A collection was moved or reordered. Affected descendants have their own events; either location can match.",
+		category: "collections",
+		requiredPermissions: ["read:collections"],
+		filters: ["collections"]
+	},
+	"collection.deleted": {
+		label: "Collection deleted",
+		description: "A collection was logically deleted. Matches its former subtree; deleted descendants have their own events.",
+		category: "collections",
+		requiredPermissions: ["read:collections"],
+		filters: ["collections"]
+	},
+	"collection.restored": {
+		label: "Collection restored",
+		description: "A deleted collection was restored. Matches its restored subtree.",
+		category: "collections",
+		requiredPermissions: ["read:collections"],
+		filters: ["collections"]
+	},
+	"publishing.channel_advanced": {
+		label: "Channel snapshot advanced",
+		description: "One channel snapshot changed. Matches changes inside the webhook scope in either snapshot, including removals, and the channel filter. Snapshot references do not grant content access.",
+		category: "publishing",
+		requiredPermissions: ["read:publishing"],
+		filters: ["collections", "channels"]
+	},
+	"publishing.channel_created": {
+		label: "Channel created",
+		description: "A channel and its initial snapshot were created. The collection scope does not apply.",
+		category: "publishing",
+		requiredPermissions: ["read:publishing"],
+		filters: ["channels"]
+	},
+	"publishing.channel_deleted": {
+		label: "Channel deleted",
+		description: "A channel was deleted. The collection scope does not apply; its final snapshot retains the existing workspace expiry policy.",
+		category: "publishing",
+		requiredPermissions: ["read:publishing"],
+		filters: ["channels"]
+	}
+};
+//#endregion
+//#region ../../private/contracts/src/webhooks/events.ts
+const webhookChannelCodeType = z.string().min(1).max(50);
+z.enum(webhookReadPermissions);
+const nameType = z.string().min(1).max(300);
+const parentType = publicID("coll").nullable();
+const contentHashType = z.string().regex(/^[a-f\d]{64}$/);
+const entrySubjectType = z.strictObject({
+	kind: z.literal("entry"),
+	id: publicID("ent")
+});
+const collectionSubjectType = z.strictObject({
+	kind: z.literal("collection"),
+	id: publicID("coll")
+});
+const channelSubjectType = z.strictObject({
+	kind: z.literal("channel"),
+	code: webhookChannelCodeType
+});
+const envelopeType = z.strictObject({
+	id: publicID("whevt"),
+	operationID: publicID("whop"),
+	schemaVersion: z.literal(1),
+	occurredAt: z.iso.datetime(),
+	workspaceID: publicID("ws"),
+	test: z.boolean()
+});
+const visibleLocationType = z.strictObject({
+	visibility: z.literal("visible"),
+	parentID: parentType.describe("Null means the workspace root, never a hidden parent"),
+	order: z.string().min(1).max(255).optional()
+});
+const hiddenLocationType = z.strictObject({ visibility: z.literal("hidden") });
+const moveReasonType = z.enum([
+	"direct",
+	"ancestor_moved",
+	"reordered"
+]);
+const moveDataType = z.discriminatedUnion("scopeTransition", [
+	z.strictObject({
+		scopeTransition: z.literal("within"),
+		reason: moveReasonType,
+		from: visibleLocationType,
+		to: visibleLocationType
+	}),
+	z.strictObject({
+		scopeTransition: z.literal("entered"),
+		reason: moveReasonType,
+		from: hiddenLocationType,
+		to: visibleLocationType
+	}),
+	z.strictObject({
+		scopeTransition: z.literal("left"),
+		reason: moveReasonType,
+		from: visibleLocationType,
+		to: hiddenLocationType
+	})
+]);
+const entryDataType = z.strictObject({
+	name: nameType,
+	collectionID: parentType
+});
+const collectionDataType = z.strictObject({
+	name: nameType,
+	parentID: parentType
+});
+const entryEventType = envelopeType.extend({ subject: entrySubjectType });
+const collectionEventType = envelopeType.extend({ subject: collectionSubjectType });
+const channelEventType = envelopeType.extend({ subject: channelSubjectType });
+const webhookEventSchemas = {
+	"entry.created": entryEventType.extend({
+		type: z.literal("entry.created"),
+		data: entryDataType.extend({ contentHash: contentHashType.optional() })
+	}),
+	"entry.updated": entryEventType.extend({
+		type: z.literal("entry.updated"),
+		data: z.strictObject({
+			collectionID: parentType,
+			changedFields: z.array(z.literal("name")).length(1)
+		})
+	}),
+	"entry.content_saved": entryEventType.extend({
+		type: z.literal("entry.content_saved"),
+		data: z.strictObject({
+			collectionID: parentType,
+			contentHash: contentHashType,
+			savedAt: z.iso.datetime()
+		})
+	}),
+	"entry.moved": entryEventType.extend({
+		type: z.literal("entry.moved"),
+		data: moveDataType
+	}),
+	"entry.deleted": entryEventType.extend({
+		type: z.literal("entry.deleted"),
+		data: entryDataType.extend({ deletedAt: z.iso.datetime() })
+	}),
+	"entry.restored": entryEventType.extend({
+		type: z.literal("entry.restored"),
+		data: entryDataType
+	}),
+	"collection.created": collectionEventType.extend({
+		type: z.literal("collection.created"),
+		data: collectionDataType
+	}),
+	"collection.updated": collectionEventType.extend({
+		type: z.literal("collection.updated"),
+		data: z.strictObject({
+			parentID: parentType,
+			changedFields: z.array(z.enum([
+				"name",
+				"restricted",
+				"publishingEnabled"
+			])).min(1).max(3).refine(uniqueItems, "Changed fields must be unique").register(JSON_SCHEMA_REGISTRY, { uniqueItems: true })
+		})
+	}),
+	"collection.moved": collectionEventType.extend({
+		type: z.literal("collection.moved"),
+		data: moveDataType
+	}),
+	"collection.deleted": collectionEventType.extend({
+		type: z.literal("collection.deleted"),
+		data: collectionDataType.extend({ deletedAt: z.iso.datetime() })
+	}),
+	"collection.restored": collectionEventType.extend({
+		type: z.literal("collection.restored"),
+		data: collectionDataType
+	}),
+	"publishing.channel_advanced": channelEventType.extend({
+		type: z.literal("publishing.channel_advanced"),
+		data: z.strictObject({
+			previousSnapshotID: publicID("snp"),
+			snapshotID: publicID("snp"),
+			reason: z.enum(["publish", "unpublish"])
+		})
+	}),
+	"publishing.channel_created": channelEventType.extend({
+		type: z.literal("publishing.channel_created"),
+		data: z.strictObject({
+			name: z.string().min(1).max(50),
+			builtIn: z.boolean(),
+			snapshotID: publicID("snp")
+		})
+	}),
+	"publishing.channel_deleted": channelEventType.extend({
+		type: z.literal("publishing.channel_deleted"),
+		data: z.strictObject({
+			name: z.string().min(1).max(50),
+			snapshotID: publicID("snp")
+		})
+	})
+};
+const webhookEventNameType = z.enum(webhookEventNames);
+const webhookEventType = z.discriminatedUnion("type", [
+	webhookEventSchemas["entry.created"],
+	webhookEventSchemas["entry.updated"],
+	webhookEventSchemas["entry.content_saved"],
+	webhookEventSchemas["entry.moved"],
+	webhookEventSchemas["entry.deleted"],
+	webhookEventSchemas["entry.restored"],
+	webhookEventSchemas["collection.created"],
+	webhookEventSchemas["collection.updated"],
+	webhookEventSchemas["collection.moved"],
+	webhookEventSchemas["collection.deleted"],
+	webhookEventSchemas["collection.restored"],
+	webhookEventSchemas["publishing.channel_advanced"],
+	webhookEventSchemas["publishing.channel_created"],
+	webhookEventSchemas["publishing.channel_deleted"]
+]);
+//#endregion
+//#region ../../private/contracts/src/entities/keys.ts
+const keyPermissionType = z.enum([
+	"entries",
+	"read:entries",
+	"versions",
+	"read:versions",
+	"publishing",
+	"read:publishing",
+	"collections",
+	"read:collections",
+	"memberships",
+	"read:memberships",
+	"roles",
+	"read:roles",
+	"webhooks",
+	"read:webhooks",
+	"ai-answers"
+]);
+/** A secret key stays on servers; a publishable key is safe in browsers, for published content. */
+const keyKindType = z.enum(["secret", "publishable"]);
+z.enum(["read:publishing", "ai-answers"]);
+z.string().regex(/^https?:\/\/[a-z\d.-]+(?::\d{1,5})?$/i, "Use an origin, e.g. https://docs.example.com").transform((origin) => origin.toLowerCase());
+z.object({
+	id: id().describe("The ID of the API key"),
+	name: z.string().describe("The name for the API key"),
+	kind: keyKindType.describe("Secret keys stay on servers; publishable keys work in browsers"),
+	permissions: z.array(keyPermissionType).describe("The permissions of the API key"),
+	collectionIDs: z.array(publicID("coll")).describe("Publishable keys: the collections, with their descendants, that the key can read; none for all"),
+	allowedOrigins: z.array(z.string()).describe("Publishable keys: the browser origins that can use the key, with localhost"),
+	value: z.string().nullable().describe("Publishable keys: the raw key, which is public; null for secret keys"),
+	prefix: z.string().describe("The first characters of the raw key"),
+	createdAt: z.iso.datetime().describe("The creation date"),
+	updatedAt: z.iso.datetime().describe("The last update date"),
+	expiresAt: z.iso.datetime().nullable().describe("The expiration date")
+});
+//#endregion
+//#region ../../private/contracts/src/permissions/requirements.ts
+const parsePermission = (permission) => {
+	const [accessOrResource, readResource] = permission.split(":");
+	return readResource ? {
+		resource: readResource,
+		access: accessOrResource
+	} : {
+		resource: accessOrResource,
+		access: "write"
+	};
+};
+const hasPermission = (granted, required) => {
+	const grantedPermission = parsePermission(granted);
+	const requiredPermission = parsePermission(required);
+	if (grantedPermission.resource !== requiredPermission.resource) return false;
+	return grantedPermission.access === "write" || requiredPermission.access === "read";
+};
+//#endregion
+//#region ../../private/contracts/src/extensions/configuration.ts
+const JSON_SCHEMA_DIALECT = "https://json-schema.org/draft/2020-12/schema";
+const MAX_CONFIGURATION_STRING_LENGTH = 1e4;
+const MAX_CONFIGURATION_ARRAY_ITEMS = 100;
+const MAX_CONFIGURATION_ENUM_VALUES = 100;
+const MAX_CONFIGURATION_PATTERN_LENGTH = 500;
+const isValidPattern = (pattern) => {
+	try {
+		new RegExp(pattern);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const fieldKeyType = z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/, "Use a letter, then letters, digits, or underscores");
+const lengthType = z.int().min(0).max(MAX_CONFIGURATION_STRING_LENGTH);
+const metadata = {
+	title: z.string().min(1).max(100).optional(),
+	description: z.string().min(1).max(500).optional()
+};
+const stringItemType = z.strictObject({
+	type: z.literal("string"),
+	minLength: lengthType.optional(),
+	maxLength: lengthType.optional(),
+	pattern: z.string().min(1).max(MAX_CONFIGURATION_PATTERN_LENGTH).refine(isValidPattern, "Use a valid regular expression").optional(),
+	format: z.enum(["uri", "email"]).optional()
+});
+const enumItemType = z.strictObject({
+	type: z.literal("string"),
+	enum: z.array(z.string().min(1).max(200)).min(1).max(MAX_CONFIGURATION_ENUM_VALUES).refine(uniqueItems, "Options must be unique")
+});
+const numberItemType = z.strictObject({
+	type: z.enum(["number", "integer"]),
+	minimum: z.number().optional(),
+	maximum: z.number().optional(),
+	exclusiveMinimum: z.number().optional(),
+	exclusiveMaximum: z.number().optional(),
+	multipleOf: z.number().positive().optional()
+});
+const booleanItemType = z.strictObject({ type: z.literal("boolean") });
+const stringFormatTypes = {
+	uri: z.url(),
+	email: z.email()
+};
+const itemType = z.union([
+	stringItemType,
+	enumItemType,
+	numberItemType,
+	booleanItemType
+]);
+const fieldType = z.union([
+	stringItemType.extend({
+		...metadata,
+		default: z.string().optional(),
+		secret: z.literal(true).optional(),
+		control: z.literal("textarea").optional()
+	}),
+	enumItemType.extend({
+		...metadata,
+		default: z.string().optional()
+	}),
+	numberItemType.extend({
+		...metadata,
+		default: z.number().optional()
+	}),
+	booleanItemType.extend({
+		...metadata,
+		default: z.boolean().optional()
+	}),
+	z.strictObject({
+		...metadata,
+		type: z.literal("array"),
+		items: itemType,
+		minItems: z.int().min(0).max(MAX_CONFIGURATION_ARRAY_ITEMS).optional(),
+		maxItems: z.int().min(0).max(MAX_CONFIGURATION_ARRAY_ITEMS).optional(),
+		uniqueItems: z.boolean().optional(),
+		default: z.array(z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		])).optional()
+	})
+]);
+/** Flat JSON Schema (draft 2020-12) subset that the host validates without running extension code. */
+const extensionConfigurationType = z.strictObject({
+	$schema: z.literal(JSON_SCHEMA_DIALECT).optional(),
+	type: z.literal("object"),
+	properties: z.record(fieldKeyType, fieldType).refine((properties) => Object.keys(properties).length <= 50, `Use at most 50 fields`),
+	required: z.array(fieldKeyType).refine(uniqueItems, "Fields must be unique").optional(),
+	additionalProperties: z.literal(false)
+}).superRefine((configuration, context) => {
+	for (const [index, key] of (configuration.required || []).entries()) if (!configuration.properties[key]) context.addIssue({
+		code: "custom",
+		path: ["required", index],
+		message: "Unknown field"
+	});
+	for (const [key, field] of Object.entries(configuration.properties)) if ("secret" in field && field.secret && field.default !== void 0) context.addIssue({
+		code: "custom",
+		path: [
+			"properties",
+			key,
+			"default"
+		],
+		message: "Secret fields cannot have defaults"
+	});
+	else if (field.default !== void 0) {
+		if (!createConfigurationValueType(field).safeParse(field.default).success) context.addIssue({
+			code: "custom",
+			path: [
+				"properties",
+				key,
+				"default"
+			],
+			message: "The default does not match the field"
+		});
+	}
+});
+const createConfigurationValueType = (field) => {
+	if (field.type === "boolean") return z.boolean();
+	if (field.type === "array") {
+		const maxItems = Math.min(field.maxItems ?? MAX_CONFIGURATION_ARRAY_ITEMS, MAX_CONFIGURATION_ARRAY_ITEMS);
+		const items = z.array(createConfigurationValueType(field.items)).min(field.minItems ?? 0).max(maxItems);
+		return field.uniqueItems ? items.refine(uniqueItems, "Values must be unique") : items;
+	}
+	if ("enum" in field) return z.enum(field.enum);
+	if (field.type === "string") {
+		const maxLength = Math.min(field.maxLength ?? MAX_CONFIGURATION_STRING_LENGTH, MAX_CONFIGURATION_STRING_LENGTH);
+		const value = (field.format ? stringFormatTypes[field.format] : z.string()).min(field.minLength ?? 0).max(maxLength);
+		return field.pattern ? value.regex(new RegExp(field.pattern)) : value;
+	}
+	let value = field.type === "integer" ? z.int() : z.number();
+	if (field.minimum !== void 0) value = value.gte(field.minimum);
+	if (field.maximum !== void 0) value = value.lte(field.maximum);
+	if (field.exclusiveMinimum !== void 0) value = value.gt(field.exclusiveMinimum);
+	if (field.exclusiveMaximum !== void 0) value = value.lt(field.exclusiveMaximum);
+	if (field.multipleOf !== void 0) value = value.multipleOf(field.multipleOf);
+	return value;
+};
+//#endregion
+//#region ../../private/document/src/element.ts
+const ELEMENT_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/;
+const ELEMENT_TAG_NAME = /^[A-Za-z][A-Za-z0-9_-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)*$/;
+const OBJECT_KEY = /^[$_\p{ID_Start}][$\u200c\u200d_\p{ID_Continue}]*$/u;
+const parseElementValue = (source) => {
+	const json = source.replace(/"(?:\\[\s\S]|[^"\\])*"|[$_\p{ID_Start}][$\u200c\u200d_\p{ID_Continue}]*/gu, (token, offset) => {
+		if (!token.startsWith("\"") && /^\s*:/.test(source.slice(offset + token.length))) return JSON.stringify(token);
+		return token;
+	});
+	return JSON.parse(json);
+};
+const ELEMENT_BLOCKS = [
+	"paragraph",
+	"heading",
+	"blockquote",
+	"bulletList",
+	"orderedList",
+	"taskList",
+	"horizontalRule",
+	"codeBlock",
+	"table",
+	"image",
+	"element"
+];
+const ELEMENT_STRUCTURE = [
+	"listItem",
+	"taskItem",
+	"tableRow",
+	"tableCell",
+	"tableHeader",
+	"text",
+	"hardBreak"
+];
+const isElementValue = (value) => {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return Array.from(value).every(isElementValue);
+	if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) return false;
+	return Object.values(value).every(isElementValue);
+};
+const getElementData = (attrs) => {
+	const { name, props, selfClosing } = attrs;
+	if (typeof name !== "string" || !ELEMENT_TAG_NAME.test(name)) throw new Error("Invalid Element name");
+	if (!props || Array.isArray(props) || typeof props !== "object" || !isElementValue(props)) throw new Error("Element props must be a JSON object");
+	if (Object.keys(props).some((key) => !ELEMENT_NAME.test(key))) throw new Error("Invalid Element prop name");
+	if (typeof selfClosing !== "boolean") throw new Error("Invalid Element closing state");
+	return {
+		name,
+		props,
+		selfClosing
+	};
+};
+const parseElement = (source) => {
+	const props = {};
+	const fail = () => {
+		throw new Error("Invalid opening tag");
+	};
+	let position = 0;
+	const whitespace = () => {
+		while (/\s/.test(source[position] || "") && position < source.length) position += 1;
+	};
+	const identifier = (tag = false) => {
+		const start = position;
+		while ((tag ? /[A-Za-z0-9_.-]/ : /[A-Za-z0-9_-]/).test(source[position] || "") && position < source.length) position += 1;
+		const value = source.slice(start, position);
+		if (!(tag ? ELEMENT_TAG_NAME : ELEMENT_NAME).test(value)) fail();
+		return value;
+	};
+	const quoted = () => {
+		const start = position++;
+		let escaped = false;
+		while (position < source.length) {
+			const character = source[position++];
+			if (escaped) {
+				escaped = false;
+				continue;
+			}
+			if (character === "\\") {
+				escaped = true;
+				continue;
+			}
+			if (character === "\"") return JSON.parse(source.slice(start, position));
+		}
+		return fail();
+	};
+	whitespace();
+	if (source[position++] !== "<") fail();
+	const name = identifier(true);
+	while (position < source.length) {
+		const beforeSpace = position;
+		whitespace();
+		if (source[position] === ">" || source.slice(position, position + 2) === "/>") break;
+		if (position === beforeSpace) fail();
+		const key = identifier();
+		let value = true;
+		const afterKey = position;
+		whitespace();
+		if (source[position] === "=") {
+			position += 1;
+			whitespace();
+			if (source[position] === "\"") value = quoted();
+			else if (source[position] === "{") {
+				const start = ++position;
+				const delimiters = ["}"];
+				while (position < source.length && delimiters.length) {
+					const character = source[position];
+					if (character === "\"") {
+						quoted();
+						continue;
+					}
+					if (character === "{") delimiters.push("}");
+					if (character === "[") delimiters.push("]");
+					if (character === "}" || character === "]") {
+						if (delimiters.pop() !== character) fail();
+						if (!delimiters.length) break;
+					}
+					position += 1;
+				}
+				if (delimiters.length || source[position] !== "}") fail();
+				value = parseElementValue(source.slice(start, position));
+				position += 1;
+			} else fail();
+		} else position = afterKey;
+		if (Object.prototype.hasOwnProperty.call(props, key)) throw new Error(`Duplicate prop "${key}"`);
+		Object.defineProperty(props, key, {
+			value,
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+	}
+	const selfClosing = source.slice(position, position + 2) === "/>";
+	if (source[position] !== ">" && !selfClosing) fail();
+	position += selfClosing ? 2 : 1;
+	whitespace();
+	if (position !== source.length) fail();
+	return getElementData({
+		name,
+		props,
+		selfClosing
+	});
+};
+const canonicalElementValue = (value) => {
+	if (Array.isArray(value)) return `[${value.map(canonicalElementValue).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalElementValue(item)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+};
+const formatElement = (data, width = 80) => {
+	const closing = data.selfClosing ? " />" : ">";
+	const formatProp = (key, value, multiline = false) => {
+		const json = JSON.stringify(value, null, multiline ? 2 : void 0).replace(/"(?:\\[\s\S]|[^"\\])*"/g, (token, offset, source) => {
+			const key = JSON.parse(token);
+			return OBJECT_KEY.test(key) && /^\s*:/.test(source.slice(offset + token.length)) ? key : token;
+		});
+		if (value === true) return key;
+		if (typeof value === "string" && !/[\n\r"\\]/.test(value)) return `${key}=${json}`;
+		return `${key}={${json}}`;
+	};
+	const entries = Object.entries(data.props);
+	const hasStructuredValues = entries.some(([, value]) => value !== null && typeof value === "object" && Object.keys(value).length > 0);
+	const compact = `<${data.name}${entries.map(([key, value]) => ` ${formatProp(key, value)}`).join("")}${closing}`;
+	if (!hasStructuredValues && compact.length <= width || !entries.length) return compact;
+	const lines = entries.map(([key, value]) => {
+		return formatProp(key, value, true).split("\n").map((line) => `  ${line}`).join("\n");
+	});
+	return `<${data.name}\n${lines.join("\n")}\n${closing.trimStart()}`;
+};
+const normalizeElementAttributes = (attrs) => {
+	const data = getElementData(attrs);
+	if (typeof attrs.source === "string") try {
+		if (canonicalElementValue(parseElement(attrs.source)) === canonicalElementValue(data)) return {
+			...attrs,
+			...data
+		};
+	} catch {}
+	return {
+		...attrs,
+		...data,
+		source: formatElement(data)
+	};
+};
+const findDisallowedElementBlock = (nodes, allowed, nested = false) => {
+	for (const node of nodes) {
+		if (!ELEMENT_BLOCKS.includes(node.type) && (!nested || !ELEMENT_STRUCTURE.includes(node.type))) return node.type;
+		if (ELEMENT_BLOCKS.includes(node.type) && node.type !== "paragraph" && !allowed.includes(node.type)) return node.type;
+		const invalid = findDisallowedElementBlock(node.content || [], allowed, true);
+		if (invalid) return invalid;
+	}
+	return null;
+};
+//#endregion
+//#region ../../private/document/src/elements.ts
+const normalizeContentElements = (node) => {
+	const content = node.content?.map(normalizeContentElements);
+	const attrs = node.type === "element" ? normalizeElementAttributes(node.attrs || {}) : node.attrs;
+	if (node.type === "codeBlock") {
+		if (content?.some((child) => child.type !== "text" || typeof child.text !== "string" || !child.text || child.marks?.length || child.content?.length)) throw new Error("Code blocks can only contain plain text");
+		if (attrs?.language != null && typeof attrs.language !== "string") throw new Error("Code block language must be a string");
+	}
+	if (node.type === "element") {
+		const data = getElementData(attrs);
+		const invalid = findDisallowedElementBlock(content || [], ELEMENT_BLOCKS);
+		if (data.selfClosing && content?.length) throw new Error("Self-closing Elements cannot contain blocks");
+		if (content?.some((child) => !ELEMENT_BLOCKS.includes(child.type)) || invalid) throw new Error("Elements can only contain regular editor blocks");
+	}
+	if (node.type === "fragment" && Array.isArray(attrs?.allowedBlocks)) {
+		const invalid = findDisallowedElementBlock(content || [], attrs.allowedBlocks);
+		if (invalid) throw new Error(`Fragment does not allow ${invalid} blocks`);
+	}
+	return {
+		...node,
+		...attrs ? { attrs } : {},
+		...content ? { content } : {}
+	};
+};
+//#endregion
+//#region ../../private/document/src/validation.ts
+const contentMarkType = z.object({
+	type: z.string(),
+	attrs: z.record(z.string(), z.unknown()).optional()
+});
+const contentNodeType = z.lazy(() => {
+	return z.object({
+		type: z.string(),
+		attrs: z.record(z.string(), z.unknown()).optional(),
+		content: z.array(contentNodeType).optional(),
+		marks: z.array(contentMarkType).optional(),
+		text: z.string().optional()
+	}).superRefine((node, context) => {
+		if (node.type !== "element" && node.type !== "fragment" && node.type !== "codeBlock") return;
+		try {
+			normalizeContentElements(node);
+		} catch (error) {
+			context.addIssue({
+				code: "custom",
+				message: error instanceof Error ? error.message : "Invalid Element content"
+			});
+		}
+	});
+});
+//#endregion
+//#region ../../private/contracts/src/extensions/contributions.ts
+const extensionContributionLimits = {
+	elementViews: 50,
+	blockActions: 20,
+	panelsPerSide: 2,
+	settingsSections: 5
+};
+/** Stable across versions; settings and managed records are keyed by it. */
+const extensionStableIDType = z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, "Use a letter, then letters, digits, - or _");
+const extensionEntryType = z.string().regex(/^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/, "Use the name of an exported view").describe("The export of the frontend bundle that renders this contribution");
+/**
+* An icon class of the UnoCSS icons preset, e.g. `i-lucide:rocket`, or `i-acme:logo?bg` for a
+* colored icon. Sets come from the extension build (default, installed, or custom); the build
+* checks that each icon exists.
+*/
+const extensionIconType = z.string().max(120).regex(/^i-[a-z\d]+(?:-[a-z\d]+)*:[a-z\d]+(?:-[a-z\d]+)*(?:\?(?:bg|mask))?$/, "Use an icon class, e.g. i-lucide:rocket");
+const labelType = z.string().min(1).max(60);
+const elementNameType = z.string().max(100).regex(ELEMENT_TAG_NAME, "Use an element name, e.g. Accordion");
+/**
+* A root element view. `descendants` render elements of those names inside the root's content
+* (nearest root first), before their own root registrations.
+*/
+const extensionElementViewType = z.strictObject({
+	id: extensionStableIDType,
+	name: labelType,
+	element: elementNameType,
+	entry: extensionEntryType,
+	descendants: z.array(z.strictObject({
+		element: elementNameType,
+		entry: extensionEntryType
+	})).max(20).refine((descendants) => uniqueItems(descendants.map(({ element }) => element.toLowerCase())), "Use one view per descendant element").default([])
+});
+const extensionBlockActionType = z.strictObject({
+	id: extensionStableIDType,
+	label: labelType,
+	icon: extensionIconType.optional(),
+	blocks: z.array(z.string().refine((block) => ELEMENT_BLOCKS.includes(block), "Unknown block type")).min(1).max(ELEMENT_BLOCKS.length).refine(uniqueItems, "Blocks must be unique"),
+	entry: extensionEntryType
+});
+const panelType = {
+	id: extensionStableIDType,
+	name: labelType,
+	icon: extensionIconType
+};
+const extensionPanelType = z.discriminatedUnion("side", [z.strictObject({
+	...panelType,
+	side: z.literal("left"),
+	entry: extensionEntryType
+}), z.strictObject({
+	...panelType,
+	side: z.literal("right"),
+	context: z.enum([
+		"workspace",
+		"collection",
+		"entry"
+	]),
+	entry: extensionEntryType
+})]);
+const extensionSettingsSectionType = z.strictObject({
+	id: extensionStableIDType,
+	heading: labelType,
+	entry: extensionEntryType
+});
+const extensionContributionsType = {
+	elementViews: z.array(extensionElementViewType).max(extensionContributionLimits.elementViews).refine((views) => uniqueItems(views.map(({ element }) => element.toLowerCase())), "Use one view per element").default([]),
+	blockActions: z.array(extensionBlockActionType).max(extensionContributionLimits.blockActions).default([]),
+	panels: z.array(extensionPanelType).refine((panels) => {
+		return ["left", "right"].every((side) => {
+			return panels.filter((panel) => panel.side === side).length <= extensionContributionLimits.panelsPerSide;
+		});
+	}, `Use at most ${extensionContributionLimits.panelsPerSide} panels per side`).default([]),
+	settingsSections: z.array(extensionSettingsSectionType).max(extensionContributionLimits.settingsSections).default([])
+};
+//#endregion
+//#region ../../private/contracts/src/api/schemas/webhooks.ts
+const webhookCollectionScopeType = z.discriminatedUnion("mode", [z.strictObject({ mode: z.literal("all") }), z.strictObject({
+	mode: z.literal("selected"),
+	roots: z.array(publicID("coll")).min(1).max(100).refine(uniqueItems, "Roots must be unique")
+})]);
+const webhookChannelScopeType = z.discriminatedUnion("mode", [z.strictObject({ mode: z.literal("all") }), z.strictObject({
+	mode: z.literal("selected"),
+	codes: z.array(webhookChannelCodeType).min(1).max(100).refine(uniqueItems, "Channels must be unique")
+})]);
+const webhookURLType = z.url({ protocol: /^https?$/ }).max(2048).refine((value) => {
+	if (!URL.canParse(value)) return false;
+	const url = new URL(value);
+	return !url.username && !url.password && !value.includes("#");
+}, "Webhook URLs cannot include credentials or a fragment");
+const webhookConfigurationType = z.strictObject({
+	name: z.string().trim().min(1).max(100),
+	url: webhookURLType,
+	enabled: z.boolean(),
+	eventTypes: z.array(webhookEventNameType).min(1).max(webhookEventNameType.options.length).refine(uniqueItems, "Event types must be unique"),
+	schemaVersion: z.literal(1),
+	collections: webhookCollectionScopeType,
+	channels: webhookChannelScopeType,
+	restrictedContent: z.boolean().describe("Include restricted collections, including ones restricted later")
+});
+webhookConfigurationType.extend({ enabled: z.boolean().default(true) });
+const webhookRevisionInputType = z.strictObject({
+	id: publicID("wh"),
+	expectedRevision: z.number().int().positive()
+});
+z.strictObject({ webhooks: z.array(webhookRevisionInputType).min(1).max(10).refine((items) => uniqueItems(items.map(({ id }) => id)), "Webhooks must be unique") }).extend({ enabled: z.boolean() });
+webhookConfigurationType.partial().extend(webhookRevisionInputType.shape).refine((value) => Object.keys(value).some((key) => key !== "id" && key !== "expectedRevision"), "Supply at least one configuration change");
+const webhookFailureCategoryType = z.enum([
+	"http_status",
+	"timeout",
+	"network",
+	"destination_policy",
+	"internal"
+]);
+const webhookEndpointType = webhookConfigurationType.extend({
+	id: publicID("wh"),
+	workspaceID: publicID("ws"),
+	revision: z.number().int().positive(),
+	destinationRevision: z.number().int().positive(),
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime(),
+	disabledReason: z.enum(["manual", "failures"]).nullable(),
+	health: z.strictObject({
+		consecutiveFailures: z.number().int().nonnegative(),
+		firstFailureAt: z.iso.datetime().nullable(),
+		lastFailureAt: z.iso.datetime().nullable(),
+		lastFailureCategory: webhookFailureCategoryType.nullable(),
+		lastSuccessAt: z.iso.datetime().nullable(),
+		pendingCount: z.number().int().nonnegative(),
+		failedCount: z.number().int().nonnegative()
+	}),
+	signing: z.strictObject({
+		rotatedAt: z.iso.datetime(),
+		previousSecretExpiresAt: z.iso.datetime().nullable()
+	})
+});
+const webhookSecretType = z.string().regex(/^whsec_[A-Za-z\d+/]{43}=$/).describe("One-time signing secret. Never returned by configuration or history reads.");
+const webhookSecretResultType = z.strictObject({
+	endpoint: webhookEndpointType,
+	secret: webhookSecretType
+});
+z.discriminatedUnion("secretChanged", [z.strictObject({
+	secretChanged: z.literal(false),
+	endpoint: webhookEndpointType
+}), webhookSecretResultType.extend({ secretChanged: z.literal(true) })]);
+//#endregion
+//#region ../../private/contracts/src/webhooks/outbound.ts
+/** Delivered only to the webhooks of the extension they describe; they need no permission. */
+const extensionLifecycleEventNames = [
+	"extension.installed",
+	"extension.enabled",
+	"extension.disabled",
+	"extension.updated",
+	"extension.configured",
+	"extension.uninstalled"
+];
+const versionType = z.string().min(1).max(64);
+const lifecycleEventType = envelopeType.extend({ subject: z.strictObject({
+	kind: z.literal("extension"),
+	id: publicID("ext")
+}) });
+const versionDataType = z.strictObject({ version: versionType });
+const extensionLifecycleEventSchemas = {
+	"extension.installed": lifecycleEventType.extend({
+		type: z.literal("extension.installed"),
+		data: versionDataType
+	}),
+	"extension.enabled": lifecycleEventType.extend({
+		type: z.literal("extension.enabled"),
+		data: versionDataType
+	}),
+	"extension.disabled": lifecycleEventType.extend({
+		type: z.literal("extension.disabled"),
+		data: versionDataType.extend({ reason: z.enum([
+			"manual",
+			"approval_required",
+			"configuration_required",
+			"revoked"
+		]) })
+	}),
+	"extension.updated": lifecycleEventType.extend({
+		type: z.literal("extension.updated"),
+		data: versionDataType.extend({ previousVersion: versionType })
+	}),
+	"extension.configured": lifecycleEventType.extend({
+		type: z.literal("extension.configured"),
+		data: versionDataType.extend({ changedFields: z.array(z.string().max(64)).max(100).describe("Keys only, never values") })
+	}),
+	"extension.uninstalled": lifecycleEventType.extend({
+		type: z.literal("extension.uninstalled"),
+		data: versionDataType
+	})
+};
+const outboundEventNameType = z.enum([...webhookEventNames, ...extensionLifecycleEventNames]);
+z.discriminatedUnion("type", [
+	...webhookEventType.options,
+	extensionLifecycleEventSchemas["extension.installed"],
+	extensionLifecycleEventSchemas["extension.enabled"],
+	extensionLifecycleEventSchemas["extension.disabled"],
+	extensionLifecycleEventSchemas["extension.updated"],
+	extensionLifecycleEventSchemas["extension.configured"],
+	extensionLifecycleEventSchemas["extension.uninstalled"]
+]);
+webhookConfigurationType.extend({ eventTypes: z.array(outboundEventNameType).min(1).max(outboundEventNameType.options.length).refine(uniqueItems, "Event types must be unique") });
+//#endregion
+//#region ../../private/contracts/src/extensions/webhooks.ts
+const extensionWebhookEventNameType = z.enum([...webhookEventNames, ...extensionLifecycleEventNames]);
+const supportsChannels = (event) => {
+	if (event.startsWith("extension.")) return false;
+	return webhookEventDefinitions[event].filters.some((filter) => {
+		return filter === "channels";
+	});
+};
+/** A path appended to the backend URL; segments cannot be empty, `.` or `..`. */
+const extensionWebhookPathType = z.string().max(200).regex(/^\/(?:[A-Za-z\d_~-][A-Za-z\d._~-]*\/?)*$/, "Use a path, e.g. /webhooks");
+const extensionWebhookType = z.strictObject({
+	events: z.array(extensionWebhookEventNameType).min(1).max(extensionWebhookEventNameType.options.length).refine(uniqueItems, "Events must be unique"),
+	path: extensionWebhookPathType,
+	channels: z.array(webhookChannelCodeType).max(50).refine(uniqueItems, "Channels must be unique").describe("Publishing channels to match; empty for all channels").default([])
+}).refine(({ events, channels }) => !channels.length || events.some(supportsChannels), {
+	message: "Channel filters need an event that supports them",
+	path: ["channels"]
+});
+const MAX_EXTENSION_REQUEST_URLS = 10;
+const MAX_EXTENSION_BACKEND_KEYS = 3;
+/** Approving it requires workspace-wide restricted-content read authority. */
+const RESTRICTED_CONTENT_PERMISSION = "read:restricted_collections";
+const extensionPermissionType = z.enum([...keyPermissionType.options, RESTRICTED_CONTENT_PERMISSION]);
+const extensionNameType = z.string().regex(/^[a-z\d][a-z\d-]{0,38}\/[a-z\d][a-z\d-]{0,62}$/, "Use scope/name, e.g. acme/publish");
+const extensionVersionType = z.string().max(64).regex(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[\dA-Za-z-]+(?:\.[\dA-Za-z-]+)*)?$/, "Use a semantic version without build metadata, e.g. 1.4.0");
+const base64URLType = z.string().regex(/^[A-Za-z\d_-]{43}$/, "Use a base64url 32-byte value");
+const extensionBackendKeyIDType = z.string().regex(/^[A-Za-z\d._-]{1,64}$/, "Use a key ID");
+/** Public JWKs only; strict objects reject private key members. */
+const extensionBackendKeyType = z.discriminatedUnion("alg", [z.strictObject({
+	kid: extensionBackendKeyIDType,
+	kty: z.literal("OKP"),
+	alg: z.literal("EdDSA"),
+	crv: z.literal("Ed25519"),
+	x: base64URLType
+}), z.strictObject({
+	kid: extensionBackendKeyIDType,
+	kty: z.literal("EC"),
+	alg: z.literal("ES256"),
+	crv: z.literal("P-256"),
+	x: base64URLType,
+	y: base64URLType
+})]);
+/** Canonical URL with an optional path prefix and no credentials, query, or fragment. */
+const createURLType = (protocols) => {
+	return z.string().max(2048).refine((value) => {
+		if (!URL.canParse(value)) return false;
+		const url = new URL(value);
+		const isCanonical = value === url.href || url.pathname === "/" && value === url.origin;
+		const hasExtraParts = url.username || url.password || url.search || url.hash;
+		return protocols.includes(url.protocol) && isCanonical && !hasExtraParts;
+	}, `Use a canonical ${protocols.join(" or ")} URL, e.g. https://api.example.com/v1/`);
+};
+const createManifestType = (protocols) => {
+	const urlType = createURLType(protocols);
+	return z.strictObject({
+		name: extensionNameType,
+		version: extensionVersionType,
+		displayName: z.string().min(1).max(60),
+		description: z.string().min(1).max(300),
+		/** The logo or main icon, shown in the catalog, extension list, and settings. */
+		icon: extensionIconType.optional(),
+		apiVersion: z.literal(1),
+		permissions: z.array(extensionPermissionType).refine(uniqueItems, "Permissions must be unique").default([]),
+		requests: z.array(urlType).max(MAX_EXTENSION_REQUEST_URLS).refine(uniqueItems, "Request URLs must be unique").describe("URLs that the frontend can request, besides the backend").default([]),
+		backend: z.strictObject({
+			url: urlType,
+			keys: z.array(extensionBackendKeyType).min(1).max(MAX_EXTENSION_BACKEND_KEYS).refine((keys) => uniqueItems(keys.map(({ kid }) => kid)), "Key IDs must be unique")
+		}).optional(),
+		webhooks: z.record(extensionStableIDType, extensionWebhookType).refine((webhooks) => Object.keys(webhooks).length <= 10, `Use at most 10 webhooks`).default({}),
+		configuration: extensionConfigurationType.optional(),
+		...extensionContributionsType
+	}).superRefine((manifest, context) => {
+		const contributionIDs = [
+			...manifest.elementViews,
+			...manifest.blockActions,
+			...manifest.panels,
+			...manifest.settingsSections
+		].map(({ id }) => id);
+		const isGranted = (required) => {
+			return manifest.permissions.some((permission) => hasPermission(permission, required));
+		};
+		const readsRestrictableContent = isGranted("read:entries") || isGranted("read:collections");
+		const hasUnusedRestrictedGrant = manifest.permissions.includes("read:restricted_collections") && !readsRestrictableContent;
+		if (!uniqueItems(contributionIDs)) context.addIssue({
+			code: "custom",
+			message: "Contribution IDs must be unique"
+		});
+		if (hasUnusedRestrictedGrant) context.addIssue({
+			code: "custom",
+			path: ["permissions"],
+			message: "Restricted content needs read:entries or read:collections"
+		});
+		for (const [id, webhook] of Object.entries(manifest.webhooks)) {
+			if (!manifest.backend) context.addIssue({
+				code: "custom",
+				path: ["webhooks", id],
+				message: "Webhooks need a backend"
+			});
+			for (const [index, event] of webhook.events.entries()) {
+				const missing = webhookEventDefinitions[event]?.requiredPermissions.filter((required) => !isGranted(required));
+				if (missing?.length) context.addIssue({
+					code: "custom",
+					path: [
+						"webhooks",
+						id,
+						"events",
+						index
+					],
+					message: `The event needs ${missing.join(", ")}`
+				});
+			}
+		}
+	});
+};
+const extensionURLType = createURLType(["https:"]);
+const extensionManifestType = createManifestType(["https:"]);
+/** Development extensions run on a fully local stack, so their URLs can use HTTP. */
+const developmentExtensionManifestType = createManifestType(["https:", "http:"]);
+//#endregion
+//#region ../../private/contracts/src/extensions/registry.ts
+const splitVersion = (version) => {
+	const separator = version.indexOf("-");
+	const core = separator < 0 ? version : version.slice(0, separator);
+	const prerelease = separator < 0 ? [] : version.slice(separator + 1).split(".");
+	return [core.split(".").map(Number), prerelease];
+};
+const compareIdentifiers = (a, b) => {
+	const isNumericA = /^\d+$/.test(a);
+	const isNumericB = /^\d+$/.test(b);
+	if (isNumericA && isNumericB) return Number(a) - Number(b);
+	if (isNumericA !== isNumericB) return isNumericA ? -1 : 1;
+	return a < b ? -1 : Number(a > b);
+};
+/** Semantic version precedence: negative when `a` is older, positive when it is newer. */
+const compareExtensionVersions = (a, b) => {
+	const [coreA, prereleaseA] = splitVersion(a);
+	const [coreB, prereleaseB] = splitVersion(b);
+	const coreDifference = coreA.map((part, index) => part - coreB[index]).find(Boolean);
+	if (coreDifference) return coreDifference;
+	if (!prereleaseA.length || !prereleaseB.length) return prereleaseB.length - prereleaseA.length;
+	for (let index = 0; index < Math.min(prereleaseA.length, prereleaseB.length); index += 1) {
+		const difference = compareIdentifiers(prereleaseA[index], prereleaseB[index]);
+		if (difference) return difference;
+	}
+	return prereleaseA.length - prereleaseB.length;
+};
+const MAX_EXTENSION_ARTIFACT_SIZE = 5242880;
+const MAX_REGISTRY_EXTENSIONS = 1e3;
+const MAX_REGISTRY_VERSIONS = 500;
+const keySetShape = {
+	keys: z.array(extensionBackendKeyType).max(10),
+	revokedKeys: z.array(extensionBackendKeyIDType).max(100).default([])
+};
+const refineKeySet = ({ keys, revokedKeys }, context) => {
+	if (!uniqueItems([...keys.map(({ kid }) => kid), ...revokedKeys])) context.addIssue({
+		code: "custom",
+		path: ["keys"],
+		message: "Key IDs must be unique and revoked keys cannot be listed as keys"
+	});
+};
+/** The keys of a registry entry; extension projects keep them in `andesine.keys.json`. */
+const extensionKeySetType = z.object(keySetShape).superRefine(refineKeySet);
+const extensionArtifactType = z.strictObject({
+	url: extensionURLType,
+	sha256: z.string().regex(/^[a-f\d]{64}$/, "Use a lowercase hex SHA-256 digest"),
+	size: z.int().positive().max(MAX_EXTENSION_ARTIFACT_SIZE)
+});
+/** An immutable registry version: the reviewed manifest and its build output. */
+const extensionVersionManifestType = z.strictObject({
+	manifest: extensionManifestType,
+	sourceCommit: z.string().regex(/^[a-f\d]{40}$/, "Use a full commit SHA"),
+	artifacts: z.strictObject({
+		frontend: extensionArtifactType,
+		/** CSS for the extension views. */
+		styles: extensionArtifactType.optional(),
+		/** CSS for the manifest icons, which the host shows outside the extension views. */
+		icons: extensionArtifactType.optional()
+	}),
+	publishedAt: z.iso.datetime()
+});
+const extensionRevocationType = z.strictObject({
+	name: extensionNameType,
+	version: extensionVersionType,
+	reason: z.string().min(1).max(500),
+	replacement: extensionVersionType.optional(),
+	recordedAt: z.iso.datetime()
+});
+const extensionRegistryEntryType = z.object({
+	name: extensionNameType,
+	publisher: z.object({
+		name: z.string().min(1).max(100),
+		url: extensionURLType.optional()
+	}),
+	...keySetShape,
+	versions: z.array(z.unknown()).max(MAX_REGISTRY_VERSIONS)
+}).superRefine(refineKeySet);
+const extensionRegistryIndexType = z.object({
+	formatVersion: z.literal(1),
+	generatedAt: z.iso.datetime(),
+	extensions: z.array(extensionRegistryEntryType).max(MAX_REGISTRY_EXTENSIONS),
+	revocations: z.array(extensionRevocationType).default([])
+}).refine(({ extensions }) => uniqueItems(extensions.map(({ name }) => name)), "Extension names must be unique");
+z.enum([
+	"manual",
+	"approval_required",
+	"configuration_required",
+	"revoked"
+]);
+//#endregion
+//#region src/extensions/frontend.ts
+const ENTRY_ID = "\0andesine-extension-entry";
+const require = createRequire(import.meta.url);
+/** The view entries that the manifest names, in manifest order. */
+const getEntries = (manifest) => {
+	const entries = [
+		...manifest.elementViews.flatMap((view) => [view.entry, ...view.descendants.map(({ entry }) => entry)]),
+		...manifest.blockActions.map(({ entry }) => entry),
+		...manifest.panels.map(({ entry }) => entry),
+		...manifest.settingsSections.map(({ entry }) => entry)
+	];
+	return [...new Set(entries)];
+};
+/** Generates the `startExtension` call; a missing export fails the build. */
+const createEntryPlugin = (module, entries) => {
+	const imports = entries.map((entry, index) => `${entry} as view${index}`).join(", ");
+	const views = entries.map((entry, index) => `${entry}: view${index}`).join(", ");
+	return {
+		name: "andesine-extension-entry",
+		resolveId: (id) => id === ENTRY_ID ? id : null,
+		load: (id) => {
+			if (id !== ENTRY_ID) return null;
+			return [
+				entries.length ? `import { ${imports} } from ${JSON.stringify(module)};` : "",
+				`import { startExtension } from "@andesine/extensions/solid";`,
+				`startExtension({ ${views} });`
+			].join("\n");
+		}
+	};
+};
+/** Strips TypeScript, then compiles JSX for the extension renderer. */
+const solidPlugin = {
+	name: "andesine-extension-solid",
+	transform: {
+		filter: { id: /\.[jt]sx$/ },
+		handler: async (code, id) => {
+			const stripped = transformSync(id, code, { jsx: "preserve" });
+			if (stripped.errors.length) throw stripped.errors[0];
+			return { code: (await transformAsync(stripped.code, {
+				filename: id,
+				babelrc: false,
+				configFile: false,
+				presets: [[require.resolve("babel-preset-solid"), {
+					generate: "universal",
+					moduleName: "@andesine/extensions/solid"
+				}]]
+			}))?.code ?? "" };
+		}
+	}
+};
+/** Bundles the frontend into one classic script for the extension worker. */
+const bundleFrontend = async (root, manifest, frontend, onWarning) => {
+	const entries = getEntries(manifest);
+	const module = path.resolve(root, frontend);
+	const { output } = await build({
+		cwd: root,
+		input: ENTRY_ID,
+		platform: "browser",
+		plugins: [createEntryPlugin(module, entries), solidPlugin],
+		transform: { define: { "process.env.NODE_ENV": JSON.stringify("production") } },
+		write: false,
+		onLog: (level, log, handler) => {
+			if (log.code === "UNRESOLVED_IMPORT") handler("error", log);
+			else if (level === "warn") onWarning(log.message);
+		},
+		output: {
+			format: "iife",
+			codeSplitting: false,
+			minify: true
+		}
+	}).catch((error) => {
+		throw new CLIError(`The frontend build failed:\n${(error.errors?.map(({ message }) => message) ?? [error.message]).map(stripVTControlCharacters).join("\n")}`, exitCodes.failure);
+	});
+	const [chunk] = output;
+	const isProjectModule = (id) => {
+		return id.startsWith(root + path.sep) && !id.includes(`${path.sep}node_modules${path.sep}`);
+	};
+	const sources = Object.entries(chunk.modules).filter(([id]) => isProjectModule(id)).map(([, rendered]) => rendered.code ?? "");
+	return {
+		code: chunk.code,
+		sources: sources.join("\n")
+	};
+};
+//#endregion
+//#region src/extensions/project.ts
+const CONFIG_FILE = "andesine.config.ts";
+const KEYS_FILE = "andesine.keys.json";
+/** Build output and private keys; the template ignores it in Git. */
+const WORK_DIRECTORY = ".andesine";
+const extensionBuildOptionsType = z.strictObject({
+	frontend: z.string().min(1).optional(),
+	icons: z.record(z.string().regex(/^[a-z\d]+(?:-[a-z\d]+)*$/), z.string().min(1)).optional()
+}).default({});
+const exists = async (file) => {
+	return access(file).then(() => true, () => false);
+};
+const formatError = (subject, issues) => {
+	return new CLIError(`${subject} is invalid:\n${issues.map(({ path: at, message }) => {
+		return `- ${at.length ? `${at.map(String).join(".")}: ` : ""}${message}`;
+	}).join("\n")}`, exitCodes.usage);
+};
+/** Bundles the config into the work directory, so its imports resolve from the project. */
+const importConfig = async (root) => {
+	const file = path.join(root, WORK_DIRECTORY, "config.mjs");
+	await build({
+		cwd: root,
+		input: path.join(root, CONFIG_FILE),
+		platform: "node",
+		external: (id) => !id.startsWith(".") && !path.isAbsolute(id),
+		logLevel: "silent",
+		output: {
+			file,
+			format: "esm"
+		}
+	});
+	return import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+};
+/**
+* Loads and validates the manifest and build options of the extension in `root`. In
+* development, the manifest's backend uses the development keys and URL, and may use local HTTP.
+*/
+const loadExtensionProject = async (root, development) => {
+	if (!await exists(path.join(root, CONFIG_FILE))) throw new CLIError(`No ${CONFIG_FILE} in ${root}.`, exitCodes.usage);
+	const config = await importConfig(root);
+	const input = config.default;
+	const developmentBackend = input?.backend && {
+		...input.backend,
+		keys: development?.keys,
+		...development?.backendURL && { url: development.backendURL }
+	};
+	const manifest = development ? developmentExtensionManifestType.safeParse({
+		...input,
+		backend: developmentBackend
+	}) : extensionManifestType.safeParse(input);
+	const buildOptions = extensionBuildOptionsType.safeParse(config.build);
+	if (!manifest.success) throw formatError("The manifest", manifest.error.issues);
+	if (!buildOptions.success) throw formatError("The build options", buildOptions.error.issues);
+	return {
+		root,
+		manifest: manifest.data,
+		build: buildOptions.data
+	};
+};
+const readExtensionKeys = async (root) => {
+	const file = path.join(root, KEYS_FILE);
+	if (!await exists(file)) return {
+		keys: [],
+		revokedKeys: []
+	};
+	const keys = extensionKeySetType.safeParse(JSON.parse(await readFile(file, "utf8")));
+	if (!keys.success) throw formatError(KEYS_FILE, keys.error.issues);
+	return keys.data;
+};
+const writeExtensionKeys = async (root, keys) => {
+	await writeFile(path.join(root, KEYS_FILE), `${JSON.stringify(keys, null, 2)}\n`);
+};
+const ALLOWED_AT_RULES = /* @__PURE__ */ new Set(["media", "supports"]);
+const DATA_SVG_URL = /url\(\s*(?:"data:image\/svg\+xml[^"]*"|'data:image\/svg\+xml[^']*')\s*\)/gi;
+const FORBIDDEN_VALUE = /url\(|\bsrc\(|\bimage\(|image-set\(|expression\(|-moz-binding|behavior\s*:|\\|@|[{}<]/i;
+const NEWLINE = /[\n\r\f]/;
+var ExtensionStyleError = class extends Error {};
+/** Host-owned content slots inside element views; extension CSS stops at them. */
+const EXTENSION_SLOT_SELECTOR = "[data-content-slot]";
+/** Views render inside `data-extension`; manifest icons inside `data-extension-icon`. */
+const getExtensionScope = (name, kind = "view") => {
+	return `[${kind === "view" ? "data-extension" : "data-extension-icon"}="${name}"]`;
+};
+/** The `@scope` prelude of view CSS: the view down to, but not into, its content slots. */
+const getViewScopePrelude = (name) => {
+	return `(${getExtensionScope(name)}) to (${EXTENSION_SLOT_SELECTOR})`;
+};
+const fail = (message) => {
+	throw new ExtensionStyleError(message);
+};
+/**
+* Removes comments outside strings. Escapes and strings are read like the browser reads them,
+* and a raw newline in a string fails, so the validated text cannot differ from what applies.
+*/
+const stripComments = (css) => {
+	let result = "";
+	let quote = "";
+	for (let index = 0; index < css.length; index += 1) {
+		const char = css[index];
+		if (char === "\\") {
+			result += css.slice(index, index + 2);
+			index += 1;
+		} else if (quote) {
+			if (NEWLINE.test(char)) fail("Unterminated CSS string");
+			if (char === quote) quote = "";
+			result += char;
+		} else if (char === "/" && css[index + 1] === "*") {
+			const end = css.indexOf("*/", index + 2);
+			if (end < 0) fail("Unterminated CSS comment");
+			result += " ";
+			index = end + 1;
+		} else {
+			if (char === "\"" || char === "'") quote = char;
+			result += char;
+		}
+	}
+	return quote ? fail("Unterminated CSS string") : result;
+};
+/** Finds the next `stops` character outside strings, escapes, parentheses, and brackets, or -1. */
+const scan = (css, start, stops) => {
+	let depth = 0;
+	let quote = "";
+	for (let index = start; index < css.length; index += 1) {
+		const char = css[index];
+		if (char === "\\") index += 1;
+		else if (quote) {
+			if (char === quote) quote = "";
+		} else if (char === "\"" || char === "'") quote = char;
+		else if (char === "(" || char === "[") depth += 1;
+		else if (char === ")" || char === "]") depth -= 1;
+		else if (depth === 0 && stops.includes(char)) return index;
+	}
+	return -1;
+};
+const readUntil = (css, start, stops) => {
+	const index = scan(css, start, stops);
+	return index < 0 ? fail("Unterminated CSS block") : index;
+};
+/** Finds the `}` that closes the block opened at `open`, counting nested blocks. */
+const findBlockEnd = (css, open) => {
+	let depth = 1;
+	let index = open;
+	while (depth > 0) {
+		index = readUntil(css, index + 1, "{}");
+		depth += css[index] === "{" ? 1 : -1;
+	}
+	return index;
+};
+const splitSelectors = (prelude) => {
+	const selectors = [];
+	let start = 0;
+	for (let end = scan(prelude, 0, ","); end >= 0; end = scan(prelude, start, ",")) {
+		selectors.push(prelude.slice(start, end).trim());
+		start = end + 1;
+	}
+	selectors.push(prelude.slice(start).trim());
+	return selectors;
+};
+/** Every selector starts with `prefix` and a descendant combinator, never the prefix alone. */
+const isScopedSelectorList = (selectors, prefix) => {
+	return splitSelectors(selectors).every((selector) => {
+		return selector.startsWith(`${prefix} `) && selector.trim().length > prefix.length;
+	});
+};
+/** Values load nothing (only inline SVG icon URLs) and contain no escapes or nested blocks. */
+const isSafeCSSValue = (value) => {
+	return !FORBIDDEN_VALUE.test(value.replace(DATA_SVG_URL, ""));
+};
+/** `prefix` is null at the top level of view CSS, where only the `@scope` rule is allowed. */
+const validateBlock = (css, start, end, prefix, scopePrelude) => {
+	let index = start;
+	while (index < end) {
+		while (index < end && /\s/.test(css[index])) index += 1;
+		if (index >= end) return;
+		const open = readUntil(css, index, "{;");
+		if (css[open] === ";") fail("CSS statements must be rules");
+		const prelude = css.slice(index, open).trim();
+		const close = findBlockEnd(css, open);
+		if (scan(prelude, 0, "}") >= 0) fail("Unexpected CSS block end");
+		if (close > end) fail("Unterminated CSS block");
+		if (prelude.startsWith("@")) {
+			const atRule = (/^@([\w-]+)/.exec(prelude)?.[1] ?? "").toLowerCase();
+			const condition = prelude.slice(atRule.length + 1).trim();
+			const isViewScope = atRule === "scope" && prefix === null && condition === scopePrelude;
+			const isCondition = ALLOWED_AT_RULES.has(atRule) && prefix !== null;
+			if (!isViewScope && !isCondition) fail(`CSS at-rule not allowed here: @${atRule}`);
+			if (!isSafeCSSValue(condition)) fail("Unsafe CSS condition");
+			validateBlock(css, open + 1, close, isViewScope ? ":scope" : prefix, scopePrelude);
+		} else {
+			if (prefix === null) fail("Extension view CSS must be inside its @scope rule");
+			if (!isScopedSelectorList(prelude, prefix)) fail(`CSS selector outside the scope: ${prelude}`);
+			if (!isSafeCSSValue(css.slice(open + 1, close))) fail("CSS values cannot load resources or use escapes");
+		}
+		index = close + 1;
+	}
+};
+/**
+* View CSS is one `@scope (<view>) to (<content slot>)` rule, so it never reaches host-owned
+* content in slots; icon CSS rules start with the icon scope. Inside, only style rules
+* (optionally in `@media`/`@supports`) without escapes in values or URL-bearing values other
+* than inline SVG icons. The host also checks the browser-parsed rules before applying them.
+*/
+const validateExtensionCSS = (css, name, kind = "view") => {
+	if (css.length > 262144) fail("Extension CSS is too large");
+	const withoutComments = stripComments(css);
+	const prefix = kind === "view" ? null : getExtensionScope(name, kind);
+	validateBlock(withoutComments, 0, withoutComments.length, prefix, getViewScopePrelude(name));
+};
+//#endregion
+//#region ../../private/uno-preset/src/index.ts
+const andesineTheme = { colors: {
+	primary: "#ff3617",
+	secondary: "#f88f52",
+	tertiary: "#fc6335",
+	gray: {
+		...colors,
+		850: "#1b2534",
+		950: "#0e1422"
+	}
+} };
+const andesineRules = [[/^mask-edge-fading-(?:\[side=(t|b|r|l)\]|(t|b|r|l))-(\d+)$/, ([, bracketSide, shortSide, value]) => {
+	const side = bracketSide || shortSide;
+	const rem = Number(value) / 4;
+	return {
+		"mask-image": `linear-gradient(${{
+			t: "to bottom",
+			b: "to top",
+			r: "to left",
+			l: "to right"
+		}[side]}, transparent 0%, black ${rem}rem, black 100%)`,
+		"mask-repeat": "no-repeat"
+	};
+}], [/^mask-edge-fading-(\d+)$/, ([, value]) => {
+	const rem = Number(value) / 4;
+	return {
+		"mask-image": [
+			`linear-gradient(to top, black 0%, black 100%)`,
+			`linear-gradient(to top, transparent 0%, black 100%)`,
+			`linear-gradient(to right, transparent 0%, black 100%)`,
+			`linear-gradient(to bottom, transparent 0%, black 100%)`,
+			`linear-gradient(to left, transparent 0%, black 100%)`
+		].join(", "),
+		"mask-position": `center, top, right, bottom, left`,
+		"mask-size": `100% 100%, 100% ${rem}rem, ${rem}rem 100%, 100% ${rem}rem, ${rem}rem 100%`,
+		"mask-repeat": "no-repeat, no-repeat, no-repeat, no-repeat, no-repeat",
+		"mask-composite": "subtract, add, add, add"
+	};
+}]];
+/** Andesine theme tokens and rules, shared by the web app, landing, and extension builds. */
+const presetAndesine = definePreset(() => ({
+	name: "andesine",
+	theme: andesineTheme,
+	rules: andesineRules
+}));
+//#endregion
+//#region ../../private/uno-preset/src/extensions.ts
+/** Icon sets that the extension build provides without installation. */
+const DEFAULT_ICON_SETS = ["lucide", "tabler"];
+const createExtensionGenerator = (icons) => {
+	return createGenerator({
+		presets: [
+			presetWind3({ preflight: false }),
+			presetIcons({
+				collections: icons,
+				processor: (css) => {
+					delete css.width;
+					delete css.height;
+				}
+			}),
+			presetAndesine()
+		],
+		blocklist: [/^animate-/]
+	});
+};
+/**
+* Generates the CSS of the extension views at build time: utility and icon classes found in the
+* code, in one `@scope` rule from the views down to their content slots, without preflights
+* (the host has them). Throws if the result is invalid, for example when an arbitrary value
+* loads a URL.
+*/
+const generateExtensionCSS = async (options) => {
+	const { css: rules } = await (await createExtensionGenerator(options.icons)).generate(options.code, {
+		preflights: false,
+		scope: ":scope"
+	});
+	const css = rules.trim() ? `@scope ${getViewScopePrelude(options.name)} {\n${rules}\n}\n` : "";
+	validateExtensionCSS(css, options.name);
+	return css;
+};
+/** Generates the CSS of the manifest icons, which the host shows outside the views. */
+const generateExtensionIconCSS = async (options) => {
+	const { css, matched } = await (await createExtensionGenerator(options.icons)).generate(options.classes.join(" "), {
+		preflights: false,
+		scope: getExtensionScope(options.name, "icon")
+	});
+	const missing = options.classes.filter((icon) => !matched.has(icon));
+	if (missing.length) throw new ExtensionStyleError(`Unknown icons: ${missing.join(", ")}`);
+	validateExtensionCSS(css, options.name, "icon");
+	return css;
+};
+//#endregion
+//#region src/extensions/styles.ts
+const ICON_SET_PACKAGE = "@iconify-json/";
+const readJSON$1 = async (file) => JSON.parse(await readFile(file, "utf8"));
+/** Sets of a package resolver, loaded when the CSS uses them. */
+const loadPackageSets = (sets, require) => {
+	return Object.fromEntries(sets.map((set) => [set, () => readJSON$1(require.resolve(`${ICON_SET_PACKAGE}${set}/icons.json`))]));
+};
+/** Default sets from the CLI, sets installed in the project, then custom SVG directories. */
+const loadIconCollections = async (root, custom = {}) => {
+	const manifestPath = path.join(root, "package.json");
+	const manifest = await exists(manifestPath) ? await readJSON$1(manifestPath) : {};
+	const installed = Object.keys({
+		...manifest.dependencies,
+		...manifest.devDependencies
+	}).filter((name) => name.startsWith(ICON_SET_PACKAGE)).map((name) => name.slice(14));
+	return {
+		...loadPackageSets(DEFAULT_ICON_SETS, createRequire(import.meta.url)),
+		...loadPackageSets(installed, createRequire(manifestPath)),
+		...Object.fromEntries(Object.entries(custom).map(([set, directory]) => {
+			return [set, FileSystemIconLoader(path.resolve(root, directory))];
+		}))
+	};
+};
+const getManifestIcons = (manifest) => {
+	const icons = [
+		manifest.icon,
+		...manifest.panels.map(({ icon }) => icon),
+		...manifest.blockActions.map(({ icon }) => icon)
+	];
+	return [...new Set(icons.filter((icon) => icon !== void 0))];
+};
+/** The view CSS from the project's code, and the CSS of the manifest icons. */
+const generateExtensionStyles = async (root, manifest, sources, custom) => {
+	const icons = await loadIconCollections(root, custom);
+	const classes = getManifestIcons(manifest);
+	try {
+		return {
+			styles: await generateExtensionCSS({
+				name: manifest.name,
+				icons,
+				code: sources
+			}),
+			icons: classes.length ? await generateExtensionIconCSS({
+				name: manifest.name,
+				icons,
+				classes
+			}) : ""
+		};
+	} catch (error) {
+		if (error instanceof ExtensionStyleError) throw new CLIError(error.message, exitCodes.usage);
+		throw error;
+	}
+};
+//#endregion
+//#region src/extensions/build.ts
+const OUTPUT_DIRECTORY = "dist";
+const DEFAULT_FRONTEND = "src/frontend/index.tsx";
+const artifactFiles = {
+	frontend: "frontend.js",
+	styles: "styles.css",
+	icons: "icons.css"
+};
+const describeArtifact = (file, content) => {
+	const size = Buffer.byteLength(content);
+	if (size > 5242880) throw new CLIError(`${file} is larger than ${MAX_EXTENSION_ARTIFACT_SIZE / 1024 / 1024} MB.`);
+	return {
+		file,
+		sha256: createHash("sha256").update(content).digest("hex"),
+		size
+	};
+};
+/** Bundles the frontend and generates its CSS; empty CSS is an empty string. */
+const compileExtension = async (project, output) => {
+	const { root, manifest } = project;
+	const bundle = await output.progress("Bundling the frontend", () => {
+		return bundleFrontend(root, manifest, project.build.frontend ?? DEFAULT_FRONTEND, (message) => {
+			output.warning(message);
+		});
+	}, "Frontend bundled");
+	const css = await output.progress("Generating the CSS", () => generateExtensionStyles(root, manifest, bundle.sources, project.build.icons), "CSS generated");
+	return {
+		frontend: bundle.code,
+		styles: css.styles,
+		icons: css.icons
+	};
+};
+/** Validates the manifest, then writes the frontend, CSS, and metadata to `dist`. */
+const buildExtension = async (directory, output) => {
+	const root = path.resolve(directory);
+	const target = path.join(root, OUTPUT_DIRECTORY);
+	const project = await output.progress("Loading the manifest", () => loadExtensionProject(root), "Manifest valid");
+	const { manifest } = project;
+	const contents = await compileExtension(project, output);
+	const metadata = {
+		manifest,
+		artifacts: {}
+	};
+	await mkdir(target, { recursive: true });
+	for (const [name, file] of Object.entries(artifactFiles)) {
+		const content = contents[name];
+		if (!content) {
+			await rm(path.join(target, file), { force: true });
+			continue;
+		}
+		metadata.artifacts[name] = describeArtifact(file, content);
+		await writeFile(path.join(target, file), content);
+	}
+	await writeFile(path.join(target, "extension.json"), `${JSON.stringify(metadata, null, 2)}\n`);
+	return metadata;
+};
+//#endregion
+//#region src/extensions/dev/client.ts
+/** A failure that the instance reported, as opposed to a failed build. */
+var InstanceError = class extends CLIError {};
+const LOCAL_HOSTS = [
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+];
+const LOCAL_DOMAINS = [
+	".localhost",
+	".local",
+	".test"
+];
+const isLocalInstance = (baseURL) => {
+	const { hostname } = new URL(baseURL);
+	return LOCAL_HOSTS.includes(hostname) || LOCAL_DOMAINS.some((domain) => hostname.endsWith(domain));
+};
+const describeFailure = (status, body) => {
+	const message = body?.message;
+	if (status === 404 && (body === null || message === "Not Found")) return "The instance has no development endpoints. Set PUBLIC_EXTENSIONS_ENABLED=true and EXTENSIONS_DEVELOPMENT_ENABLED=true on the local backend.";
+	return typeof message === "string" ? message : `The request failed (HTTP ${status}).`;
+};
+/**
+* A client for the development operations of a local instance. They are not in the public API,
+* so the SDK has no methods for them; they need the signed-in member of a CLI profile.
+*/
+const createDevelopmentClient = (context) => {
+	const { baseURL, workspaceID } = context.config;
+	if (!isLocalInstance(baseURL)) throw new CLIError(`${baseURL} is not a local instance. Extension development needs a local stack (localhost, *.localhost, *.local, or *.test); use --base-url.`, exitCodes.usage);
+	if (process.env.ANDESINE_API_KEY !== void 0) throw new CLIError("API keys cannot develop extensions. Unset ANDESINE_API_KEY and run andesine auth login.", exitCodes.usage);
+	if (!workspaceID) throw new CLIError("Select a workspace with --workspace or ANDESINE_WORKSPACE_ID.", exitCodes.usage);
+	const request = async (method, path, body, signal = context.signal) => {
+		const response = await fetch(`${baseURL}/extensions${path}`, {
+			method,
+			redirect: "error",
+			signal,
+			headers: {
+				"authorization": `Bearer ${await getAccessToken({
+					...context,
+					signal
+				})}`,
+				"x-workspace-id": workspaceID,
+				...body === void 0 ? {} : { "content-type": "application/json" }
+			},
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		});
+		const result = await response.json().catch(() => null);
+		if (!response.ok) throw new InstanceError(describeFailure(response.status, result));
+		return result;
+	};
+	const webhookPath = (extensionID, webhookID) => {
+		return `/${extensionID}/webhooks/${encodeURIComponent(webhookID)}`;
+	};
+	return {
+		workspaceID,
+		upload: (input) => request("PUT", "/development", input),
+		stop: (extensionID, signal) => {
+			return request("POST", `/development/${extensionID}/stop`, void 0, signal);
+		},
+		remove: (extensionID) => request("DELETE", `/development/${extensionID}`),
+		sendTest: (extensionID, webhookID, type) => {
+			return request("POST", `${webhookPath(extensionID, webhookID)}/test`, { type });
+		},
+		getDelivery: (extensionID, webhookID, deliveryID) => {
+			return request("GET", `${webhookPath(extensionID, webhookID)}/deliveries/${deliveryID}`);
+		}
+	};
+};
+//#endregion
+//#region src/extensions/dev/state.ts
+const getStateFile = (root) => path.join(root, WORK_DIRECTORY, "development.json");
+const saveDevelopmentState = async (root, state) => {
+	await writeFile(getStateFile(root), `${JSON.stringify(state, null, 2)}\n`);
+};
+/** The recorded development extension for the selected instance and workspace. */
+const readDevelopmentState = async (root, context) => {
+	const file = getStateFile(root);
+	const state = await exists(file) ? JSON.parse(await readFile(file, "utf8")) : null;
+	if (!(state?.baseURL === context.config.baseURL && state.workspaceID === context.config.workspaceID)) throw new CLIError("No development extension for this instance and workspace. Run andesine extensions dev first.", exitCodes.usage);
+	return state;
+};
+const clearDevelopmentState = async (root) => {
+	await rm(getStateFile(root), { force: true });
+};
+//#endregion
+//#region src/extensions/dev/remove.ts
+/** Uninstalls the project's development extension, which deletes its development state. */
+const removeDevelopment = async (context, root) => {
+	const directory = path.resolve(root);
+	const client = createDevelopmentClient(context);
+	const { extensionID } = await readDevelopmentState(directory, context);
+	await context.output.progress("Removing the development extension", () => client.remove(extensionID), "Development extension removed");
+	await clearDevelopmentState(directory);
+	await context.output.success("The development extension and its state are removed.");
+};
+//#endregion
+//#region src/extensions/keys.ts
+const MAX_KEYS = 3;
+const KEY_ENVIRONMENT_VARIABLE = "ANDESINE_EXTENSION_KEY";
+const runFile$1 = promisify(execFile);
+const createKeyID = (taken) => {
+	const base = `key-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`;
+	let kid = base;
+	for (let index = 2; taken.includes(kid); index += 1) kid = `${base}-${index}`;
+	return kid;
+};
+const isIgnored$1 = async (root, file) => {
+	try {
+		await runFile$1("git", [
+			"check-ignore",
+			"--quiet",
+			file
+		], { cwd: root });
+		return true;
+	} catch (error) {
+		return error.code !== 1;
+	}
+};
+const parsePrivateKey = (source) => {
+	try {
+		const key = JSON.parse(source);
+		if (key.d && key.kid) return key;
+	} catch {}
+	throw new CLIError("The private key must be a private JSON Web Key with a kid.", exitCodes.usage);
+};
+const toPublicKey = (privateKey) => {
+	const jwk = createPublicKey(createPrivateKey({
+		key: privateKey,
+		format: "jwk"
+	})).export({ format: "jwk" });
+	const alg = jwk.crv === "Ed25519" ? "EdDSA" : "ES256";
+	const key = extensionBackendKeyType.safeParse({
+		kid: privateKey.kid,
+		alg,
+		...jwk
+	});
+	if (!key.success) throw new CLIError("Use an Ed25519 or P-256 private key.", exitCodes.usage);
+	return key.data;
+};
+const describeKey$1 = (key) => {
+	return [
+		key.kid,
+		key.alg,
+		key.x,
+		"y" in key ? key.y : ""
+	].join(" ");
+};
+const isSameKey = (left, right) => {
+	return describeKey$1(left) === describeKey$1(right);
+};
+/** Generates an Ed25519 key: the public JWK goes to the keys file, the private one stays local. */
+const generateExtensionKey = async (root, options = {}) => {
+	const keys = await readExtensionKeys(root);
+	const taken = [...keys.keys.map(({ kid }) => kid), ...keys.revokedKeys];
+	const kid = options.kid ?? createKeyID(taken);
+	const directory = path.join(root, WORK_DIRECTORY, "keys");
+	const file = path.join(directory, `${kid}.json`);
+	const isNewKeyID = extensionBackendKeyIDType.safeParse(kid).success && !taken.includes(kid);
+	if (keys.keys.length >= MAX_KEYS) throw new CLIError(`${KEYS_FILE} has ${MAX_KEYS} keys. Revoke one first.`, exitCodes.usage);
+	if (!isNewKeyID) throw new CLIError(`Use a new key ID of letters, digits, ".", "_" or "-".`, exitCodes.usage);
+	const { privateKey } = generateKeyPairSync("ed25519");
+	const privateJWK = {
+		kid,
+		alg: "EdDSA",
+		...privateKey.export({ format: "jwk" })
+	};
+	const serialized = JSON.stringify(privateJWK);
+	if (!options.print) {
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		await writeFile(file, `${serialized}\n`, {
+			mode: 384,
+			flag: "wx"
+		});
+	}
+	await writeExtensionKeys(root, {
+		...keys,
+		keys: [...keys.keys, toPublicKey(privateJWK)]
+	});
+	if (options.print) return {
+		kid,
+		privateKey: serialized,
+		ignored: true
+	};
+	return {
+		kid,
+		privateKey: serialized,
+		file,
+		ignored: await isIgnored$1(root, file)
+	};
+};
+/**
+* Checks that a private key matches a current key of the manifest and, with a registry URL, of
+* the registry entry, which Andesine instances trust.
+*/
+const checkExtensionKey = async (root, options = {}) => {
+	const source = options.key ? await readFile(path.resolve(options.key), "utf8") : process.env[KEY_ENVIRONMENT_VARIABLE];
+	if (!source) throw new CLIError(`Set ${KEY_ENVIRONMENT_VARIABLE} or use --key <file>.`, exitCodes.usage);
+	const publicKey = toPublicKey(parsePrivateKey(source));
+	const { manifest } = await loadExtensionProject(root);
+	const { revokedKeys } = await readExtensionKeys(root);
+	const manifestKey = manifest.backend?.keys.find(({ kid }) => kid === publicKey.kid);
+	if (revokedKeys.includes(publicKey.kid)) throw new CLIError(`Key ${publicKey.kid} is revoked.`, exitCodes.failure);
+	if (!manifestKey || !isSameKey(manifestKey, publicKey)) throw new CLIError(`Key ${publicKey.kid} is not a key of the manifest.`, exitCodes.failure);
+	if (!options.registry) return {
+		kid: publicKey.kid,
+		name: manifest.name
+	};
+	const response = await fetch(options.registry);
+	if (!response.ok) throw new CLIError(`The registry returned HTTP ${response.status}.`, exitCodes.failure);
+	const index = extensionRegistryIndexType.safeParse(await response.json());
+	if (!index.success) throw new CLIError("The registry index is invalid.", exitCodes.failure);
+	const entry = index.data.extensions.find(({ name }) => name === manifest.name);
+	const registryKey = entry?.keys.find(({ kid }) => kid === publicKey.kid);
+	const isTrusted = Boolean(registryKey && isSameKey(registryKey, publicKey));
+	if (!entry) throw new CLIError(`The registry has no ${manifest.name}.`, exitCodes.failure);
+	if (!isTrusted) throw new CLIError(`The registry does not trust key ${publicKey.kid}.`, exitCodes.failure);
+	return {
+		kid: publicKey.kid,
+		name: manifest.name,
+		registry: options.registry
+	};
+};
+/** Removes a public key from the manifest keys and records its ID as revoked. */
+const revokeExtensionKey = async (root, kid) => {
+	const keys = await readExtensionKeys(root);
+	if (!keys.keys.some((key) => key.kid === kid)) throw new CLIError(`${KEYS_FILE} has no key ${kid}.`, exitCodes.usage);
+	await writeExtensionKeys(root, {
+		keys: keys.keys.filter((key) => key.kid !== kid),
+		revokedKeys: [...keys.revokedKeys, kid]
+	});
+};
+//#endregion
+//#region src/extensions/dev/environment.ts
+const KEY_ID = "development";
+const INSTANCES_VARIABLE = "ANDESINE_INSTANCES";
+/**
+* The project's development key pair, created once. The local instance gets only the public
+* key; the private key stays in the work directory and the backend's environment file.
+*/
+const getDevelopmentKey = async (root) => {
+	const directory = path.join(root, WORK_DIRECTORY, "keys");
+	const file = path.join(directory, `${KEY_ID}.json`);
+	if (!await exists(file)) {
+		const { privateKey } = generateKeyPairSync("ed25519");
+		const jwk = {
+			kid: KEY_ID,
+			alg: "EdDSA",
+			...privateKey.export({ format: "jwk" })
+		};
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		await writeFile(file, `${JSON.stringify(jwk)}\n`, { mode: 384 });
+	}
+	const privateKey = (await readFile(file, "utf8")).trim();
+	const { x } = JSON.parse(privateKey);
+	return {
+		privateKey,
+		publicKey: {
+			kid: KEY_ID,
+			kty: "OKP",
+			alg: "EdDSA",
+			crv: "Ed25519",
+			x
+		}
+	};
+};
+/** Sets a variable of an environment file, replacing its line or adding one. */
+const setVariable = (source, name, value) => {
+	const line = `${name}=${value}`;
+	const pattern = new RegExp(`^${name}=.*$`, "m");
+	if (pattern.test(source)) return source.replace(pattern, () => line);
+	return `${source}${source && !source.endsWith("\n") ? "\n" : ""}${line}\n`;
+};
+/**
+* Points the local backend at the development key and trusts the local instance, in its
+* environment file (created from `.env.example` when missing). Other variables stay.
+*/
+const writeDevelopmentEnvironment = async (root, file, key, baseURL) => {
+	const target = path.resolve(root, file);
+	const example = path.join(root, ".env.example");
+	const sourceFile = await exists(target) ? target : example;
+	const source = await exists(sourceFile) ? await readFile(sourceFile, "utf8") : "";
+	const instances = new RegExp(`^${INSTANCES_VARIABLE}=(.*)$`, "m").exec(source)?.[1]?.split(",").filter(Boolean);
+	const trusted = [.../* @__PURE__ */ new Set([...instances ?? [], baseURL])].join(",");
+	const updated = setVariable(setVariable(source, KEY_ENVIRONMENT_VARIABLE, `'${key.privateKey}'`), INSTANCES_VARIABLE, trusted);
+	await writeFile(target, updated, { mode: 384 });
+};
+//#endregion
+//#region src/extensions/dev/watch.ts
+const DEBOUNCE = 200;
+const IGNORED_DIRECTORIES = [
+	"node_modules",
+	"dist",
+	WORK_DIRECTORY,
+	".git"
+];
+const isIgnored = (file) => {
+	const [directory] = file.split(path.sep);
+	return IGNORED_DIRECTORIES.includes(directory) || path.basename(file).startsWith(".env");
+};
+/** Watches the project recursively until the signal aborts. */
+const watchChanges = (root, signal) => {
+	let changed = false;
+	let notify = null;
+	let timer;
+	watch(root, {
+		recursive: true,
+		signal
+	}, (_event, file) => {
+		if (!file || isIgnored(file)) return;
+		clearTimeout(timer);
+		timer = setTimeout(() => {
+			changed = true;
+			notify?.();
+		}, DEBOUNCE);
+	}).on("error", () => {});
+	return { next: () => {
+		return new Promise((resolve, reject) => {
+			const abort = () => reject(signal.reason);
+			notify = () => {
+				notify = null;
+				changed = false;
+				signal.removeEventListener("abort", abort);
+				resolve();
+			};
+			if (signal.aborted) abort();
+			else if (changed) notify();
+			else signal.addEventListener("abort", abort, { once: true });
+		});
+	} };
+};
+//#endregion
+//#region src/extensions/dev/run.ts
+const STOP_TIMEOUT = 1e4;
+const disabledHints = {
+	approval_required: "approve its new permissions or URLs in Settings → Extensions",
+	configuration_required: "fill in its required configuration in Settings → Extensions",
+	manual: "enable it in Settings → Extensions"
+};
+const getErrorMessage = (error) => error instanceof Error ? error.message : String(error);
+/** Builds the project with the development key and uploads it, which installs or reloads it. */
+const uploadBuild = async (root, context, client, development) => {
+	const project = await loadExtensionProject(root, development);
+	const { frontend, styles, icons } = await compileExtension(project, context.output);
+	const result = await context.output.progress("Uploading the build", () => {
+		return client.upload({
+			manifest: project.manifest,
+			artifacts: {
+				frontend,
+				styles: styles || void 0,
+				icons: icons || void 0
+			}
+		});
+	}, "Build uploaded");
+	const { name, version } = project.manifest;
+	await saveDevelopmentState(root, {
+		baseURL: context.config.baseURL,
+		workspaceID: client.workspaceID,
+		extensionID: result.id
+	});
+	if (result.state === "active") await context.output.success(`${name}@${version} is running (${result.id}).`);
+	else await context.output.warning(`${name}@${version} is disabled: ${disabledHints[result.disabledReason ?? "manual"]}.`);
+	return result;
+};
+/**
+* Runs an extension on the local instance for the signed-in member: uploads each build, reloads
+* it on file changes, and stops it on exit, keeping its configuration and storage.
+*/
+const runDevelopment = async (context, options) => {
+	const { output, signal } = context;
+	const root = path.resolve(options.root);
+	const client = createDevelopmentClient(context);
+	const key = await getDevelopmentKey(root);
+	const development = {
+		keys: [key.publicKey],
+		backendURL: options.backend
+	};
+	let extensionID = null;
+	await writeDevelopmentEnvironment(root, options.envFile, key, context.config.baseURL);
+	await output.note("Local backend", {
+		Environment: `${options.envFile} (development key and trusted instance)`,
+		Instance: context.config.baseURL
+	});
+	try {
+		extensionID = (await uploadBuild(root, context, client, development)).id;
+	} catch (error) {
+		if (signal.aborted || error instanceof InstanceError) throw error;
+		await output.error(getErrorMessage(error));
+	}
+	const changes = watchChanges(root, signal);
+	try {
+		await output.diagnostic("Watching for changes. Press Ctrl+C to stop the extension.");
+		while (true) {
+			await changes.next();
+			try {
+				extensionID = (await uploadBuild(root, context, client, development)).id;
+			} catch (error) {
+				if (signal.aborted) throw error;
+				await output.error(getErrorMessage(error));
+			}
+		}
+	} finally {
+		if (extensionID) await client.stop(extensionID, AbortSignal.timeout(STOP_TIMEOUT)).then(() => output.diagnostic("Development extension stopped; its state is kept.")).catch(() => output.warning("Could not stop the development extension."));
+	}
+};
+//#endregion
+//#region src/extensions/dev/test-event.ts
+const POLL_INTERVAL = 1e3;
+const POLL_LIMIT = 30;
+const describeAttempt = ({ delivery }) => {
+	const result = delivery.lastHTTPStatus ? `HTTP ${delivery.lastHTTPStatus}` : delivery.lastFailureCategory ?? "no response";
+	return `${delivery.attemptCount} attempt(s), last: ${result}`;
+};
+/** Waits for the first attempt to finish, or the delivery to end. */
+const waitForResult = async (context, read) => {
+	let details = await read();
+	for (let poll = 0; poll < POLL_LIMIT; poll += 1) {
+		const { state, attemptCount } = details.delivery;
+		if (!(state === "in_flight" || state === "pending" && attemptCount === 0)) return details;
+		await setTimeout$1(POLL_INTERVAL, void 0, { signal: context.signal });
+		details = await read();
+	}
+	return details;
+};
+/** Sends a sample event to a webhook of the development extension and reports the result. */
+const sendTestEvent = async (context, options) => {
+	const root = path.resolve(options.root);
+	const client = createDevelopmentClient(context);
+	const { extensionID } = await readDevelopmentState(root, context);
+	const { deliveryID } = await client.sendTest(extensionID, options.webhookID, options.type);
+	const details = await context.output.progress(`Sending ${options.type} to ${options.webhookID}`, () => {
+		return waitForResult(context, () => {
+			return client.getDelivery(extensionID, options.webhookID, deliveryID);
+		});
+	}, "Delivery attempted");
+	const { state, nextAttemptAt } = details.delivery;
+	const retry = nextAttemptAt ? `; next attempt at ${nextAttemptAt}` : "";
+	if (state !== "succeeded") throw new CLIError(`Not delivered: ${state}, ${describeAttempt(details)}${retry}.`);
+	await context.output.success(`Delivered (${describeAttempt(details)}).`);
+};
+//#endregion
+//#region src/extensions/registry/repository.ts
+const EXTENSIONS_DIRECTORY = "extensions";
+/** The registry entry data of a project that its manifest does not have. */
+const PUBLISHER_FILE = "andesine.registry.json";
+const REVOCATIONS_FILE = "registry/revocations.json";
+const INDEX_FILE = "index.json";
+const readJSON = async (file, label) => {
+	try {
+		return JSON.parse(await readFile(file, "utf8"));
+	} catch {
+		throw new CLIError(`${label} is not valid JSON.`, exitCodes.usage);
+	}
+};
+const listDirectories = async (directory) => {
+	if (!await exists(directory)) return [];
+	return (await readdir(directory, { withFileTypes: true })).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map(({ name }) => name).sort();
+};
+/** Loads every extension project with the registry rules for manifests (HTTPS URLs). */
+const readRegistryProjects = async (repository) => {
+	const root = path.join(repository, EXTENSIONS_DIRECTORY);
+	const projects = [];
+	for (const scope of await listDirectories(root)) for (const name of await listDirectories(path.join(root, scope))) {
+		const projectRoot = path.join(root, scope, name);
+		const directoryName = `${scope}/${name}`;
+		const publisherFile = path.join(projectRoot, PUBLISHER_FILE);
+		if (!await exists(publisherFile)) throw new CLIError(`${directoryName} has no ${PUBLISHER_FILE}.`, exitCodes.usage);
+		const data = await readJSON(publisherFile, `${directoryName}/${PUBLISHER_FILE}`);
+		const publisher = extensionRegistryEntryType.shape.publisher.safeParse(data.publisher);
+		if (!publisher.success) throw new CLIError(`${directoryName}/${PUBLISHER_FILE} has no valid publisher.`, exitCodes.usage);
+		projects.push({
+			directoryName,
+			project: await loadExtensionProject(projectRoot),
+			keys: await readExtensionKeys(projectRoot),
+			publisher: publisher.data
+		});
+	}
+	return projects;
+};
+const readRevocations = async (repository) => {
+	const file = path.join(repository, REVOCATIONS_FILE);
+	if (!await exists(file)) return [];
+	const revocations = extensionRevocationType.array().safeParse(await readJSON(file, REVOCATIONS_FILE));
+	if (!revocations.success) throw new CLIError(`${REVOCATIONS_FILE} is invalid.`, exitCodes.usage);
+	return revocations.data;
+};
+/** The published index, if the site has one; every published version must be valid. */
+const readPublishedRegistry = async (directory) => {
+	const file = path.join(directory, INDEX_FILE);
+	const versions = /* @__PURE__ */ new Map();
+	if (!await exists(file)) return {
+		index: null,
+		versions
+	};
+	const index = extensionRegistryIndexType.safeParse(await readJSON(file, INDEX_FILE));
+	if (!index.success) throw new CLIError(`The published ${INDEX_FILE} is invalid.`);
+	for (const entry of index.data.extensions) {
+		const parsed = entry.versions.map((version) => extensionVersionManifestType.safeParse(version));
+		if (parsed.some((result) => !result.success)) throw new CLIError(`A published version of ${entry.name} is invalid.`);
+		versions.set(entry.name, parsed.map((result) => result.data));
+	}
+	return {
+		index: index.data,
+		versions
+	};
+};
+//#endregion
+//#region src/extensions/registry/check.ts
+const hash = (content) => createHash("sha256").update(content).digest("hex");
+const describeKey = (key) => JSON.stringify(key, Object.keys(key).sort());
+const withoutKeys = (manifest) => {
+	return JSON.stringify({
+		...manifest,
+		backend: manifest.backend && {
+			...manifest.backend,
+			keys: []
+		}
+	});
+};
+const findVersion = (versions, version) => {
+	return versions.find(({ manifest }) => manifest.version === version);
+};
+/** Keys belong to the extension: published keys never change, revoked keys stay revoked. */
+const checkKeys = (entry, published) => {
+	const { name, backend } = entry.project.manifest;
+	const previous = published.index?.extensions.find((item) => item.name === name);
+	const current = new Map(entry.keys.keys.map((key) => [key.kid, describeKey(key)]));
+	const errors = [];
+	for (const key of backend?.keys ?? []) if (current.get(key.kid) !== describeKey(key)) errors.push(`${name}: manifest key ${key.kid} is not a current key of the extension`);
+	for (const key of previous?.keys ?? []) if (current.has(key.kid) && current.get(key.kid) !== describeKey(key)) errors.push(`${name}: published key ${key.kid} cannot change`);
+	for (const kid of previous?.revokedKeys ?? []) if (!entry.keys.revokedKeys.includes(kid)) errors.push(`${name}: revoked key ${kid} must stay revoked`);
+	return errors;
+};
+/** A version is new and newer than every published one, or identical to the published one. */
+const checkVersion = (entry, versions, contents) => {
+	const { manifest } = entry.project;
+	const published = findVersion(versions, manifest.version);
+	if (!published) {
+		const newer = versions.find(({ manifest: item }) => {
+			return compareExtensionVersions(item.version, manifest.version) > 0;
+		});
+		return newer ? [`${manifest.name}@${manifest.version}: versions publish in order; ${newer.manifest.version} is published`] : [];
+	}
+	const errors = [];
+	const styles = contents.styles ? hash(contents.styles) : void 0;
+	if (withoutKeys(published.manifest) !== withoutKeys(manifest)) errors.push(`${manifest.name}@${manifest.version}: published versions cannot change; use a new version`);
+	if (styles !== published.artifacts.styles?.sha256) errors.push(`${manifest.name}@${manifest.version}: the rebuilt styles differ from the published styles`);
+	return errors;
+};
+/** Revocations are permanent and name published (or new) versions and replacements. */
+const checkRevocations = (revocations, published, available) => {
+	const errors = [];
+	const isRevoked = (name, version) => {
+		return revocations.some((item) => item.name === name && item.version === version);
+	};
+	for (const previous of published.index?.revocations ?? []) if (!isRevoked(previous.name, previous.version)) errors.push(`${previous.name}@${previous.version}: revocations are permanent`);
+	for (const revocation of revocations) {
+		const versions = available.get(revocation.name) ?? [];
+		const label = `${revocation.name}@${revocation.version}`;
+		const isReplacementValid = !revocation.replacement || versions.includes(revocation.replacement) && !isRevoked(revocation.name, revocation.replacement);
+		if (!versions.includes(revocation.version)) errors.push(`${label}: no such version`);
+		if (!isReplacementValid) errors.push(`${label}: the replacement is not available`);
+	}
+	return errors;
+};
+/**
+* Checks the registry repository against the published site with the same rules that Andesine
+* instances apply on ingestion, and builds each project (its dependencies must be installed).
+*/
+const checkRegistry = async (repository, publishedDirectory, output) => {
+	const projects = await readRegistryProjects(repository);
+	const published = await readPublishedRegistry(publishedDirectory);
+	const revocations = await readRevocations(repository);
+	const available = /* @__PURE__ */ new Map();
+	const newVersions = [];
+	const errors = [];
+	for (const entry of projects) {
+		const { name, version } = entry.project.manifest;
+		const versions = published.versions.get(name) ?? [];
+		if (entry.directoryName !== name) errors.push(`${entry.directoryName}: the directory must match the name ${name}`);
+		await output.diagnostic(`Building ${name}@${version}`);
+		const contents = await compileExtension(entry.project, output);
+		const versionErrors = checkVersion(entry, versions, contents);
+		errors.push(...checkKeys(entry, published), ...versionErrors);
+		available.set(name, [...versions.map(({ manifest }) => manifest.version), version]);
+		if (!findVersion(versions, version) && !versionErrors.length) newVersions.push({
+			entry,
+			contents
+		});
+	}
+	for (const name of published.versions.keys()) if (!projects.some((entry) => entry.project.manifest.name === name)) errors.push(`${name}: published extensions cannot be removed; revoke their versions`);
+	errors.push(...checkRevocations(revocations, published, available));
+	return {
+		projects,
+		published,
+		revocations,
+		newVersions,
+		errors
+	};
+};
+//#endregion
+//#region src/extensions/registry/build.ts
+const VERSION_FILE = "version.json";
+const runFile = promisify(execFile);
+const getCommit = async (repository, commit) => {
+	const sha = commit ?? (await runFile("git", ["rev-parse", "HEAD"], { cwd: repository })).stdout.trim();
+	if (!/^[a-f\d]{40}$/.test(sha)) throw new CLIError("Use a full commit SHA.", exitCodes.usage);
+	return sha;
+};
+const getSiteURL = (siteURL) => {
+	const url = URL.canParse(siteURL) ? new URL(siteURL) : null;
+	if (url?.protocol !== "https:") throw new CLIError("Use an HTTPS base URL.", exitCodes.usage);
+	return url.href.replace(/\/$/, "");
+};
+/** Writes a new version's files, which are never overwritten, and returns its manifest. */
+const writeVersion = async (published, siteURL, version, sourceCommit) => {
+	const { manifest } = version.entry.project;
+	const relative = path.posix.join(EXTENSIONS_DIRECTORY, manifest.name, manifest.version);
+	const directory = path.join(published, relative);
+	const artifacts = {};
+	if (await exists(directory)) throw new CLIError(`${manifest.name}@${manifest.version} is already published.`);
+	await mkdir(directory, { recursive: true });
+	for (const [name, file] of Object.entries(artifactFiles)) {
+		const content = version.contents[name];
+		if (!content) continue;
+		const { sha256, size } = describeArtifact(file, content);
+		artifacts[name] = {
+			url: `${siteURL}/${relative}/${file}`,
+			sha256,
+			size
+		};
+		await writeFile(path.join(directory, file), content);
+	}
+	const versionManifest = extensionVersionManifestType.parse({
+		manifest,
+		sourceCommit,
+		artifacts,
+		publishedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	await writeFile(path.join(directory, VERSION_FILE), `${JSON.stringify(versionManifest, null, 2)}\n`);
+	return versionManifest;
+};
+/**
+* Checks the registry, writes the files of new versions, then the index, which instances read;
+* the index comes last, so it never names files that are not published yet.
+*/
+const buildRegistry = async (options, output) => {
+	const siteURL = getSiteURL(options.siteURL);
+	const check = await checkRegistry(options.repository, options.published, output);
+	const sourceCommit = await getCommit(options.repository, options.commit);
+	const added = /* @__PURE__ */ new Map();
+	if (check.errors.length) return {
+		published: [],
+		errors: check.errors
+	};
+	for (const version of check.newVersions) {
+		const { name } = version.entry.project.manifest;
+		added.set(name, await writeVersion(options.published, siteURL, version, sourceCommit));
+	}
+	const index = extensionRegistryIndexType.parse({
+		formatVersion: 1,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		extensions: check.projects.map(({ project, keys, publisher }) => {
+			const { name } = project.manifest;
+			const versions = check.published.versions.get(name) ?? [];
+			const version = added.get(name);
+			return {
+				name,
+				publisher,
+				keys: keys.keys,
+				revokedKeys: keys.revokedKeys,
+				versions: version ? [...versions, version] : versions
+			};
+		}),
+		revocations: check.revocations
+	});
+	await writeFile(path.join(options.published, INDEX_FILE), `${JSON.stringify(index, null, 2)}\n`);
+	return {
+		published: [...added.values()].map(({ manifest }) => `${manifest.name}@${manifest.version}`),
+		errors: []
+	};
+};
+//#endregion
+//#region src/extensions/init.ts
+const TEMPLATE_NAME = "example/hello";
+const namedFiles = ["andesine.config.ts", "src/backend/server.ts"];
+const rename$1 = async (target, name) => {
+	for (const file of namedFiles) {
+		const source = await readFile(path.join(target, file), "utf8");
+		await writeFile(path.join(target, file), source.replaceAll(`"${TEMPLATE_NAME}"`, `"${name}"`));
+	}
+};
+/** `.env` for the local backend, with the private key; Git ignores it. */
+const writeEnvironment = async (target, key) => {
+	const example = await readFile(path.join(target, ".env.example"), "utf8");
+	await writeFile(path.join(target, ".env"), example.replace(`${KEY_ENVIRONMENT_VARIABLE}=`, `${KEY_ENVIRONMENT_VARIABLE}='${key}'`), { mode: 384 });
+};
+/** Creates an extension from the template, with a backend key pair. */
+const initExtension = async (directory, options, output) => {
+	if (options.name && !extensionNameType.safeParse(options.name).success) throw new CLIError("Use scope/name for the extension name, e.g. acme/publish.", exitCodes.usage);
+	const target = await copyTemplate("extension", directory, output);
+	const key = await generateExtensionKey(target);
+	if (options.name) await rename$1(target, options.name);
+	await writeEnvironment(target, key.privateKey);
+	await output.note("Next steps", {
+		"Open the extension": `cd ${path.relative(process.cwd(), target) || "."}`,
+		"Install": "npm install",
+		"Build": "npm run build",
+		"Start the backend": "npm run backend",
+		"Backend key": `${key.kid} (private key in ${path.relative(target, key.file)} and .env)`
+	});
+};
+//#endregion
+//#region src/extensions/register.ts
+const formatVersions = (manifests) => {
+	return manifests.map(({ name, version }) => `${name}@${version}`).join(", ");
+};
+const reportRegistryErrors = async (output, errors) => {
+	if (!errors.length) return;
+	for (const error of errors) await output.error(error);
+	throw new CLIError(`The registry has ${errors.length} problem(s).`);
+};
+const ROOT_DESCRIPTION = "Extension directory (default: current directory)";
+const registerExtensions = (program, signal) => {
+	const getOutput = (command) => {
+		return createOutput(command.optsWithGlobals().interactive, signal);
+	};
+	const extensions = program.command("extensions").description("Create and build extensions");
+	const keys = extensions.command("keys").description("Manage the extension backend keys");
+	extensions.command("init").description("Create an extension with a backend from the template in a new or empty directory").argument("[directory]", "Directory of the new extension", "extension").option("--name <scope/name>", "Registry name of the extension (default: example/hello)").action(async (directory, options, command) => {
+		await initExtension(directory, options, getOutput(command));
+	});
+	extensions.command("build").description("Validate the manifest, then build the frontend, CSS, and dist/extension.json").option("--root <directory>", ROOT_DESCRIPTION, ".").action(async (options, command) => {
+		const output = getOutput(command);
+		const { manifest, artifacts } = await buildExtension(options.root, output);
+		await output.note(`${manifest.name}@${manifest.version}`, {
+			Frontend: `${artifacts.frontend?.size} bytes`,
+			Styles: artifacts.styles && `${artifacts.styles.size} bytes`,
+			Icons: artifacts.icons && `${artifacts.icons.size} bytes`
+		});
+	});
+	extensions.command("dev").description("Run the extension on a local instance for you: upload each build, reload on changes, stop on exit").option("--root <directory>", ROOT_DESCRIPTION, ".").option("--env-file <file>", "The local backend's environment file", ".env").option("--backend <url>", "Local backend URL in place of the manifest's, e.g. http://localhost:3000").option("--remove", "Uninstall the development extension and delete its development state").addHelpText("after", "\nNeeds a local instance with EXTENSIONS_DEVELOPMENT_ENABLED=true, andesine auth login, and a\nworkspace. The backend's environment file gets the development key and the instance URL.").action(async (options, command) => {
+		const context = await createCommandContext(command.optsWithGlobals(), signal);
+		if (options.remove) await removeDevelopment(context, options.root);
+		else await runDevelopment(context, options);
+	});
+	extensions.command("test-event").description("Send a sample event to a webhook of the development extension").argument("<webhook>", "Webhook ID from the manifest").argument("<type>", "Event type, e.g. entry.created").option("--root <directory>", ROOT_DESCRIPTION, ".").action(async (webhookID, type, options, command) => {
+		const context = await createCommandContext(command.optsWithGlobals(), signal);
+		await sendTestEvent(context, {
+			root: options.root,
+			webhookID,
+			type
+		});
+	});
+	const registry = extensions.command("registry").description("Check and build an extension registry repository (for its CI)");
+	registry.command("check").description("Check every extension of the repository against the published registry").option("--repository <directory>", "Registry repository", ".").requiredOption("--published <directory>", "Checkout of the published registry site").action(async (options, command) => {
+		const output = getOutput(command);
+		const result = await checkRegistry(path.resolve(options.repository), path.resolve(options.published), output);
+		await reportRegistryErrors(output, result.errors);
+		await output.success(`The registry is valid; new versions: ${formatVersions(result.newVersions.map(({ entry }) => entry.project.manifest)) || "none"}.`);
+	});
+	registry.command("build").description("Write new versions and the index to the published registry site").option("--repository <directory>", "Registry repository", ".").requiredOption("--published <directory>", "Checkout of the published registry site").requiredOption("--site-url <url>", "HTTPS URL that serves the published site").option("--commit <sha>", "Repository commit of the build (default: HEAD)").action(async (options, command) => {
+		const output = getOutput(command);
+		const result = await buildRegistry({
+			repository: path.resolve(options.repository),
+			published: path.resolve(options.published),
+			siteURL: options.siteUrl,
+			commit: options.commit
+		}, output);
+		await reportRegistryErrors(output, result.errors);
+		await output.success(`Published: ${result.published.join(", ") || "no new versions"}.`);
+	});
+	keys.command("generate").description(`Generate an Ed25519 key; add its public key to ${KEYS_FILE}`).option("--root <directory>", ROOT_DESCRIPTION, ".").option("--kid <id>", "Key ID (default: key-<date>)").option("--print", "Print the private JWK for a secret manager instead of saving it").action(async (options, command) => {
+		const output = getOutput(command);
+		const root = path.resolve(options.root);
+		const key = await generateExtensionKey(root, options);
+		if (!key.file) {
+			await output.text(`${key.privateKey}\n`);
+			return;
+		}
+		const file = path.relative(process.cwd(), key.file);
+		if (!key.ignored) await output.warning(`Git does not ignore ${file}. Never commit it.`);
+		await output.note(`Key ${key.kid}`, {
+			"Private key": file,
+			"Backend": `Set ${KEY_ENVIRONMENT_VARIABLE} to the file content`
+		});
+	});
+	keys.command("check").description(`Check that the private key in ${KEY_ENVIRONMENT_VARIABLE} or --key matches a current key`).option("--root <directory>", ROOT_DESCRIPTION, ".").option("--key <file>", "Private JWK file").option("--registry <url>", "Also check the key in this registry index").action(async (options, command) => {
+		const output = getOutput(command);
+		const result = await checkExtensionKey(path.resolve(options.root), options);
+		await output.success(`Key ${result.kid} is a current key of ${result.name}${result.registry ? " in the registry" : ""}.`);
+	});
+	keys.command("revoke").description(`Remove a key from ${KEYS_FILE} and list it as revoked`).argument("<kid>", "Key ID").option("--root <directory>", ROOT_DESCRIPTION, ".").action(async (kid, options, command) => {
+		const output = getOutput(command);
+		await revokeExtensionKey(path.resolve(options.root), kid);
+		await output.success(`Key ${kid} is revoked. Publish a new version to stop using it.`);
+	});
+};
 //#endregion
 //#region src/program.ts
 /** Register custom commands and the generated public API group. */
@@ -9052,6 +11535,7 @@ const createProgram = (signal) => {
 	});
 	registerAPI(program, signal);
 	registerTypes(program, signal);
+	registerExtensions(program, signal);
 	program.action(() => {
 		program.outputHelp();
 	});