dineway 0.1.9 → 0.1.12

package/dist/{types-Cj0KMIZV.d.mts → types-Q616b2Hn.d.mts}

@@ -1,8 +1,9 @@
-import { m as FieldType } from "./types-BuMDPy5C.mjs";
+import { m as FieldType } from "./types-C0mmVRJN.mjs";
 import { z } from "astro/zod";
+import "react/jsx-runtime";
 import { JSX } from "astro/jsx-runtime";
 
-//#region ../blocks/dist/validation-BG2u9jAE.d.ts
+//#region ../blocks/dist/validation-b1zbwCOE.d.ts
 //#region src/types.d.ts
 interface ConfirmDialog {
   title: string;
@@ -99,13 +100,32 @@ interface RadioElement {
   }>;
   initial_value?: string;
 }
-type Element = ButtonElement | TextInputElement | NumberInputElement | SelectElement | ToggleElement | SecretInputElement | CheckboxElement | DateInputElement | ComboboxElement | RadioElement;
+interface MediaPickerElement {
+  type: "media_picker";
+  action_id: string;
+  label: string;
+  mime_type_filter?: string;
+  initial_value?: string;
+  placeholder?: string;
+}
+type RepeaterSubField = TextInputElement | NumberInputElement | SelectElement | ToggleElement;
+interface RepeaterElement {
+  type: "repeater";
+  action_id: string;
+  label: string;
+  item_label?: string;
+  fields: RepeaterSubField[];
+  min_items?: number;
+  max_items?: number;
+  initial_value?: Array<Record<string, unknown>>;
+}
+type Element = ButtonElement | TextInputElement | NumberInputElement | SelectElement | ToggleElement | SecretInputElement | CheckboxElement | DateInputElement | ComboboxElement | RadioElement | MediaPickerElement | RepeaterElement;
 //#endregion
 //#region src/plugins/types.d.ts
 /**
  * Plugin capabilities determine what APIs are available in context
  */
-type PluginCapability = "network:fetch" | "network:fetch:any" | "read:content" | "write:content" | "read:media" | "write:media" | "read:users" | "email:send" | "email:provide" | "email:intercept" | "page:inject";
+type PluginCapability = "network:request" | "network:request:unrestricted" | "content:read" | "content:write" | "media:read" | "media:write" | "users:read" | "email:send" | "hooks.email-transport:register" | "hooks.email-events:register" | "hooks.page-fragments:register";
 /**
  * Storage collection declaration in plugin definition
  */
@@ -354,7 +374,7 @@ interface MediaAccessWithWrite extends MediaAccess {
   delete(id: string): Promise<boolean>;
 }
 /**
- * HTTP client interface - requires network:fetch capability
+ * HTTP client interface - requires network:request capability
  */
 interface HttpAccess {
   fetch(url: string, init?: RequestInit): Promise<Response>;
@@ -391,7 +411,7 @@ interface UserInfo {
   createdAt: string;
 }
 /**
- * User access interface - requires read:users capability
+ * User access interface - requires users:read capability
  */
 interface UserAccess {
   /** Get a user by ID */
@@ -421,11 +441,11 @@ interface PluginContext<TStorage extends PluginStorageConfig = PluginStorageConf
   storage: PluginStorage<TStorage>;
   /** Key-value store for config and state */
   kv: KVAccess;
-  /** Content access - only if read:content or write:content capability */
+  /** Content access - only if content:read or content:write capability */
   content?: ContentAccess | ContentAccessWithWrite;
-  /** Media access - only if read:media or write:media capability */
+  /** Media access - only if media:read or media:write capability */
   media?: MediaAccess | MediaAccessWithWrite;
-  /** HTTP client - only if network:fetch capability */
+  /** HTTP client - only if network:request capability */
   http?: HttpAccess;
   /** Logger - always available */
   log: LogAccess;
@@ -433,7 +453,7 @@ interface PluginContext<TStorage extends PluginStorageConfig = PluginStorageConf
   site: SiteInfo;
   /** URL helper - generates absolute URLs from paths. Always available. */
   url(path: string): string;
-  /** User access - only if read:users capability */
+  /** User access - only if users:read capability */
   users?: UserAccess;
   /** Cron task scheduling - always available, scoped to plugin */
   cron?: CronAccess;
@@ -481,8 +501,8 @@ type CronHandler = (event: CronEvent, ctx: PluginContext) => Promise<void>;
  *
  * Related capabilities:
  * - `email:send` — grants ctx.email (this interface)
- * - `email:provide` — allows registering the `email:deliver` exclusive hook
- * - `email:intercept` — allows registering `email:beforeSend` / `email:afterSend` hooks
+ * - `hooks.email-transport:register` — allows registering the `email:deliver` exclusive hook
+ * - `hooks.email-events:register` — allows registering `email:beforeSend` / `email:afterSend` hooks
  */
 interface EmailAccess {
   send(message: EmailMessage): Promise<void>;
@@ -976,7 +996,7 @@ interface PluginDashboardWidget {
 /**
  * Settings field types (for admin UI generation)
  */
-type SettingFieldType = "string" | "number" | "boolean" | "select" | "secret";
+type SettingFieldType = "string" | "number" | "boolean" | "select" | "secret" | "url" | "email";
 interface BaseSettingField {
   type: SettingFieldType;
   label: string;
@@ -1008,7 +1028,17 @@ interface SelectSettingField extends BaseSettingField {
 interface SecretSettingField extends BaseSettingField {
   type: "secret";
 }
-type SettingField = StringSettingField | NumberSettingField | BooleanSettingField | SelectSettingField | SecretSettingField;
+interface UrlSettingField extends BaseSettingField {
+  type: "url";
+  default?: string;
+  placeholder?: string;
+}
+interface EmailSettingField extends BaseSettingField {
+  type: "email";
+  default?: string;
+  placeholder?: string;
+}
+type SettingField = StringSettingField | NumberSettingField | BooleanSettingField | SelectSettingField | SecretSettingField | UrlSettingField | EmailSettingField;
 /**
  * Block Kit element for block editing fields.
  * This is the `Element` discriminated union from `@dineway-ai/blocks`.
@@ -1031,6 +1061,14 @@ interface PortableTextBlockConfig {
   placeholder?: string;
   /** Block Kit form fields for the editing UI. If declared, replaces the simple URL input. */
   fields?: PortableTextBlockField[];
+  /**
+   * Optional display category in the slash menu. Defaults to "Embeds".
+   *
+   * Plugin authors should pick a meaningful category that reflects what the
+   * block actually is, for example "Sections", "Marketing", "Media",
+   * "Embeds", or "Layout".
+   */
+  category?: string;
 }
 /**
  * Configuration for a field widget type contributed by a plugin.
@@ -1074,7 +1112,7 @@ interface PluginDefinition<TStorage extends PluginStorageConfig = PluginStorageC
   version: string;
   /** Declared capabilities */
   capabilities?: PluginCapability[];
-  /** Allowed hosts for network:fetch (wildcards supported: *.example.com) */
+  /** Allowed hosts for network:request (wildcards supported: *.example.com) */
   allowedHosts?: string[];
   /** Storage collections with indexes */
   storage?: TStorage;
@@ -1206,4 +1244,4 @@ interface PluginManifest {
   admin: PluginAdminConfig;
 }
 //#endregion
-export { StandardHookEntry as $, PageMetadataContribution as A, PluginDefinition as B, MediaAccess as C, PageFragmentContribution as D, ModerationDecision as E, PluginAdminConfig as F, PortableTextBlockConfig as G, PluginManifest as H, PluginAdminExports as I, RequestMeta as J, PortableTextBlockField as K, PluginAdminPage as L, PageMetadataHandler as M, PageMetadataLinkRel as N, PageFragmentEvent as O, PagePlacement as P, RouteContext as Q, PluginCapability as R, LogAccess as S, MediaUploadEvent as T, PluginRoute as U, PluginHooks as V, PluginStorageConfig as W, ResolvedPlugin as X, ResolvedHook as Y, ResolvedPluginHooks as Z, FieldWidgetConfig as _, CommentAfterModerateEvent as a, StoredComment as at, HttpAccess as b, CommentBeforeCreateHandler as c, ContentAccess as d, StandardHookHandler as et, ContentDeleteEvent as f, EmailMessage as g, CronEvent as h, CommentAfterCreateHandler as i, StorageCollection as it, PageMetadataEvent as j, PageFragmentHandler as k, CommentModerateEvent as l, ContentPublishStateChangeEvent as m, CollectionCommentSettings as n, StandardRouteEntry as nt, CommentAfterModerateHandler as o, isStandardPluginDefinition as ot, ContentHookEvent as p, PublicPageContext as q, CommentAfterCreateEvent as r, StandardRouteHandler as rt, CommentBeforeCreateEvent as s, Element as st, BreadcrumbItem as t, StandardPluginDefinition as tt, CommentModerateHandler as u, HookConfig as v, MediaItem as w, KVAccess as x, HookName as y, PluginContext as z };
+export { StandardHookEntry as $, PageMetadataContribution as A, PluginDefinition as B, MediaAccess as C, PageFragmentContribution as D, ModerationDecision as E, PluginAdminConfig as F, PortableTextBlockConfig as G, PluginManifest as H, PluginAdminExports as I, RequestMeta as J, PortableTextBlockField as K, PluginAdminPage as L, PageMetadataHandler as M, PageMetadataLinkRel as N, PageFragmentEvent as O, PagePlacement as P, RouteContext as Q, PluginCapability as R, LogAccess as S, MediaUploadEvent as T, PluginRoute as U, PluginHooks as V, PluginStorageConfig as W, ResolvedPlugin as X, ResolvedHook as Y, ResolvedPluginHooks as Z, FieldWidgetConfig as _, CommentAfterModerateEvent as a, StorageCollectionConfig as at, HttpAccess as b, CommentBeforeCreateHandler as c, Element as ct, ContentAccess as d, StandardHookHandler as et, ContentDeleteEvent as f, EmailMessage as g, CronEvent as h, CommentAfterCreateHandler as i, StorageCollection as it, PageMetadataEvent as j, PageFragmentHandler as k, CommentModerateEvent as l, ContentPublishStateChangeEvent as m, CollectionCommentSettings as n, StandardRouteEntry as nt, CommentAfterModerateHandler as o, StoredComment as ot, ContentHookEvent as p, PublicPageContext as q, CommentAfterCreateEvent as r, StandardRouteHandler as rt, CommentBeforeCreateEvent as s, isStandardPluginDefinition as st, BreadcrumbItem as t, StandardPluginDefinition as tt, CommentModerateHandler as u, HookConfig as v, MediaItem as w, KVAccess as x, HookName as y, PluginContext as z };

package/dist/ui/client-runtime.d.mts

@@ -0,0 +1,12 @@
+//#region src/media/thumbnail.d.ts
+/**
+ * Compute thumbnail dimensions that fit within a THUMBNAIL_MAX_DIMENSION box,
+ * preserving aspect ratio. Both output dimensions are clamped to at least 1.
+ * Never upscales (scale is capped at 1).
+ */
+declare function computeThumbnailSize(width: number, height: number): {
+  width: number;
+  height: number;
+};
+//#endregion
+export { computeThumbnailSize };

package/dist/ui/client-runtime.mjs

@@ -0,0 +1,32 @@
+//#region src/media/thumbnail.ts
+/**
+* Thumbnail sizing for client-side placeholder generation.
+*
+* When the browser generates a thumbnail to send to the server for blurhash
+* generation, the thumbnail dimensions must fit within a bounded box. Naively
+* fixing one dimension and deriving the other from the aspect ratio can
+* explode for extreme aspect ratios (e.g. a 100×840000 image would produce a
+* 64×537600 canvas), defeating the purpose of the thumbnail.
+*/
+/** Max dimension (px) for client-generated upload thumbnails. */
+const THUMBNAIL_MAX_DIMENSION = 64;
+/**
+* Compute thumbnail dimensions that fit within a THUMBNAIL_MAX_DIMENSION box,
+* preserving aspect ratio. Both output dimensions are clamped to at least 1.
+* Never upscales (scale is capped at 1).
+*/
+function computeThumbnailSize(width, height) {
+	if (width <= 0 || height <= 0) return {
+		width: 1,
+		height: 1
+	};
+	const maxDim = Math.max(width, height);
+	const scale = Math.min(1, THUMBNAIL_MAX_DIMENSION / maxDim);
+	return {
+		width: Math.max(1, Math.round(width * scale)),
+		height: Math.max(1, Math.round(height * scale))
+	};
+}
+
+//#endregion
+export { computeThumbnailSize };

package/dist/ui/server-runtime.d.mts

@@ -0,0 +1,33 @@
+import "../types-DZPw8Rru.mjs";
+import { A as PageMetadataContribution, q as PublicPageContext } from "../types-Q616b2Hn.mjs";
+import { t as MediaReference } from "../types-C0mmVRJN.mjs";
+import { a as EmbedResult, i as EmbedOptions, m as MediaValue, o as ImageEmbed } from "../types-OPs5Q_sX.mjs";
+import { H as getSiteSettings, R as getComments, St as PublicComment, T as getMenu, _ as getTaxonomyTerms, ft as sanitizeHref, l as Widget, pt as getCollectionInfo, rt as getEditMeta, t as getWidgetArea, tt as getDinewayCollection } from "../index-EUAWaIxW.mjs";
+import { a as generateSiteSeoContributions, d as resolvePageMetadata, i as generateBaseSeoContributions, o as renderFragments, u as renderPageMetadata } from "../jsonld-D2gUY4kA.mjs";
+import { getPageRuntime } from "../page/index.mjs";
+import { t as getMediaProvider } from "../provider-loader-BiQ6lNmf.mjs";
+
+//#region src/utils/sanitize.d.ts
+/**
+ * Sanitize HTML content to prevent XSS attacks.
+ *
+ * Allows standard formatting tags, images, iframes (from specific providers),
+ * and basic attributes.
+ */
+declare function sanitizeContent(html: string): string;
+//#endregion
+//#region src/media/url.d.ts
+interface RenderMediaRef {
+  storageKey?: string;
+  url?: string;
+  id?: string;
+}
+declare function buildRenderMediaUrl(resolve: ((key: string) => string) | undefined, ref: RenderMediaRef): string;
+//#endregion
+//#region src/page/site-identity.d.ts
+interface SiteIdentityInput {
+  favicon?: MediaReference;
+}
+declare function renderSiteIdentity(input: SiteIdentityInput | undefined): string;
+//#endregion
+export { type EmbedOptions, type EmbedResult, type ImageEmbed, type MediaValue, type PageMetadataContribution, type PublicComment, type PublicPageContext, type Widget, buildRenderMediaUrl, generateBaseSeoContributions, generateSiteSeoContributions, getCollectionInfo, getComments, getDinewayCollection, getEditMeta, getMediaProvider, getMenu, getPageRuntime, getSiteSettings, getTaxonomyTerms, getWidgetArea, renderFragments, renderPageMetadata, renderSiteIdentity, resolvePageMetadata, sanitizeContent, sanitizeHref };

package/dist/ui/server-runtime.mjs

@@ -0,0 +1,80 @@
+import "../dialect-helpers-DhTzaUxP.mjs";
+import "../base64-Cz-aU0X1.mjs";
+import "../types-Bs6lTBBW.mjs";
+import "../media-_7Fxdu45.mjs";
+import "../comment-DFO-gWDH.mjs";
+import "../options-z8VVg1Ll.mjs";
+import "../fts-manager-B1pTNEG_.mjs";
+import "../registry-C-_hxLqa.mjs";
+import "../loader-PZnPxFLc.mjs";
+import { i as getSiteSettings, s as buildRenderMediaUrl } from "../settings-DGtLLSaz.mjs";
+import "../request-cache-DHMRr2Lf.mjs";
+import { t as getCollectionInfo } from "../query-CsbOywSY.mjs";
+import { a as getTaxonomyTerms } from "../taxonomies-D2aZGuns.mjs";
+import { n as sanitizeHref } from "../url-DNjT2abR.mjs";
+import { r as getEditMeta, t as getDinewayCollection } from "../query-B9BO5goQ.mjs";
+import { i as getComments, t as getMenu } from "../menus-DYW_UHjv.mjs";
+import { t as getWidgetArea } from "../widgets-B7DRpZvy.mjs";
+import { t as getMediaProvider } from "../provider-loader-C21b9OpH.mjs";
+import { c as escapeHtmlAttr, l as renderPageMetadata, n as generateSiteSeoContributions, o as renderFragments, t as generateBaseSeoContributions, u as resolvePageMetadata } from "../seo-contributions-B1fWCnqY.mjs";
+import { getPageRuntime } from "../page/index.mjs";
+import sanitizeHtml from "sanitize-html";
+
+//#region src/utils/sanitize.ts
+/**
+* Sanitize HTML content to prevent XSS attacks.
+*
+* Allows standard formatting tags, images, iframes (from specific providers),
+* and basic attributes.
+*/
+function sanitizeContent(html) {
+	return sanitizeHtml(html, {
+		allowedTags: [
+			...sanitizeHtml.defaults.allowedTags,
+			"img",
+			"span",
+			"iframe"
+		],
+		allowedAttributes: {
+			...sanitizeHtml.defaults.allowedAttributes,
+			"*": [
+				"class",
+				"id",
+				"data-*"
+			],
+			iframe: [
+				"src",
+				"width",
+				"height",
+				"frameborder",
+				"allow",
+				"allowfullscreen"
+			],
+			img: [
+				"src",
+				"srcset",
+				"alt",
+				"title",
+				"width",
+				"height",
+				"loading"
+			]
+		},
+		allowedIframeHostnames: ["www.youtube.com", "player.vimeo.com"]
+	});
+}
+
+//#endregion
+//#region src/page/site-identity.ts
+function renderSiteIdentity(input) {
+	if (!input) return "";
+	const favicon = input.favicon;
+	if (!favicon?.url) return "";
+	let tag = `<link rel="icon" href="${escapeHtmlAttr(favicon.url)}"`;
+	if (favicon.contentType) tag += ` type="${escapeHtmlAttr(favicon.contentType)}"`;
+	tag += ">";
+	return tag;
+}
+
+//#endregion
+export { buildRenderMediaUrl, generateBaseSeoContributions, generateSiteSeoContributions, getCollectionInfo, getComments, getDinewayCollection, getEditMeta, getMediaProvider, getMenu, getPageRuntime, getSiteSettings, getTaxonomyTerms, getWidgetArea, renderFragments, renderPageMetadata, renderSiteIdentity, resolvePageMetadata, sanitizeContent, sanitizeHref };

package/dist/url-DNjT2abR.mjs

@@ -0,0 +1,49 @@
+//#region src/utils/url.ts
+/**
+* URL scheme validation utilities
+*
+* Prevents XSS via dangerous URL schemes (javascript:, data:, vbscript:, etc.)
+* by allowlisting known-safe schemes before rendering into href attributes.
+*/
+/**
+* Matches URLs that are safe to render in href attributes.
+*
+* Allowed:
+* - http:// and https://
+* - mailto: and tel:
+* - Relative paths (starting with /)
+* - Fragment links (starting with #)
+* - Protocol-relative URLs are NOT allowed (starting with //) as they can
+*   redirect to attacker-controlled hosts.
+*/
+const SAFE_URL_SCHEME_RE = /^(https?:|mailto:|tel:|\/(?!\/)|#)/i;
+/**
+* Returns the URL unchanged if it uses a safe scheme, otherwise returns "#".
+*
+* Use this at the render layer as the primary defense against XSS via
+* dangerous URL schemes like `javascript:`, `data:`, or `vbscript:`.
+*
+* @example
+* ```ts
+* sanitizeHref("https://example.com")        // "https://example.com"
+* sanitizeHref("/about")                      // "/about"
+* sanitizeHref("#section")                    // "#section"
+* sanitizeHref("mailto:a@b.com")              // "mailto:a@b.com"
+* sanitizeHref("javascript:alert(1)")         // "#"
+* sanitizeHref("data:text/html,<script>")     // "#"
+* sanitizeHref("")                            // "#"
+* ```
+*/
+function sanitizeHref(url) {
+	if (!url) return "#";
+	return SAFE_URL_SCHEME_RE.test(url) ? url : "#";
+}
+/**
+* Returns true if the URL uses a safe scheme for rendering in href attributes.
+*/
+function isSafeHref(url) {
+	return SAFE_URL_SCHEME_RE.test(url);
+}
+
+//#endregion
+export { sanitizeHref as n, isSafeHref as t };

package/dist/user-CcXq-zoL.mjs

@@ -0,0 +1,154 @@
+import { n as decodeCursor, r as encodeCursor } from "./types-Bs6lTBBW.mjs";
+import { ulid } from "ulidx";
+
+//#region src/database/repositories/user.ts
+/**
+* User repository for CRUD operations
+*/
+var UserRepository = class UserRepository {
+	constructor(db) {
+		this.db = db;
+	}
+	/**
+	* Create a new user
+	*/
+	async create(input) {
+		const id = ulid();
+		const row = {
+			id,
+			email: input.email.toLowerCase(),
+			name: input.name ?? null,
+			role: UserRepository.resolveRole(input.role ?? 10),
+			avatar_url: input.avatarUrl ?? null,
+			email_verified: 0,
+			data: input.data ? JSON.stringify(input.data) : null
+		};
+		await this.db.insertInto("users").values(row).execute();
+		const user = await this.findById(id);
+		if (!user) throw new Error("Failed to create user");
+		return user;
+	}
+	/**
+	* Find user by ID
+	*/
+	async findById(id) {
+		const row = await this.db.selectFrom("users").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? this.rowToUser(row) : null;
+	}
+	/**
+	* Find user by email (case-insensitive)
+	*/
+	async findByEmail(email) {
+		const row = await this.db.selectFrom("users").selectAll().where("email", "=", email.toLowerCase()).executeTakeFirst();
+		return row ? this.rowToUser(row) : null;
+	}
+	/**
+	* List all users with cursor-based pagination
+	*/
+	async findMany(options = {}) {
+		const limit = Math.min(Math.max(1, options.limit || 50), 100);
+		let query = this.db.selectFrom("users").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (options.role !== void 0) query = query.where("role", "=", UserRepository.resolveRole(options.role));
+		if (options.cursor) {
+			const decoded = decodeCursor(options.cursor);
+			if (decoded) query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		const rows = await query.execute();
+		const items = rows.slice(0, limit).map((row) => this.rowToUser(row));
+		const result = { items };
+		if (rows.length > limit && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+	/**
+	* Update a user
+	*/
+	async update(id, input) {
+		if (!await this.findById(id)) return null;
+		const updates = {};
+		if (input.name !== void 0) updates.name = input.name;
+		if (input.role !== void 0) updates.role = UserRepository.resolveRole(input.role);
+		if (input.avatarUrl !== void 0) updates.avatar_url = input.avatarUrl;
+		if (input.data !== void 0) updates.data = JSON.stringify(input.data);
+		if (Object.keys(updates).length > 0) await this.db.updateTable("users").set(updates).where("id", "=", id).execute();
+		return this.findById(id);
+	}
+	/**
+	* Delete a user
+	*/
+	async delete(id) {
+		return ((await this.db.deleteFrom("users").where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0) > 0;
+	}
+	/**
+	* Count users
+	*/
+	async count(role) {
+		let query = this.db.selectFrom("users").select((eb) => eb.fn.count("id").as("count"));
+		if (role !== void 0) query = query.where("role", "=", UserRepository.resolveRole(role));
+		const result = await query.executeTakeFirst();
+		return Number(result?.count || 0);
+	}
+	/**
+	* Check if email exists
+	*/
+	async emailExists(email) {
+		return !!await this.db.selectFrom("users").select("id").where("email", "=", email.toLowerCase()).executeTakeFirst();
+	}
+	/**
+	* Convert database row to User object
+	*/
+	rowToUser(row) {
+		return {
+			id: row.id,
+			email: row.email,
+			name: row.name,
+			role: UserRepository.toRole(row.role),
+			avatarUrl: row.avatar_url,
+			emailVerified: row.email_verified === 1,
+			data: row.data ? JSON.parse(row.data) : null,
+			createdAt: row.created_at
+		};
+	}
+	/** Map of role name strings to numeric levels */
+	static ROLE_NAME_TO_LEVEL = {
+		subscriber: 10,
+		contributor: 20,
+		author: 30,
+		editor: 40,
+		admin: 50
+	};
+	/** Valid numeric role levels */
+	static VALID_LEVELS = new Set([
+		10,
+		20,
+		30,
+		40,
+		50
+	]);
+	/**
+	* Resolve a role name or number to a valid numeric UserRole.
+	* Accepts both string names ("admin") and numeric levels (50).
+	*/
+	static resolveRole(role) {
+		if (typeof role === "string") {
+			const level = UserRepository.ROLE_NAME_TO_LEVEL[role];
+			if (level === void 0) throw new Error(`Invalid role name: ${role}`);
+			return level;
+		}
+		if (!UserRepository.VALID_LEVELS.has(role)) throw new Error(`Invalid role level: ${role}`);
+		return role;
+	}
+	/**
+	* Convert a raw DB integer to a typed UserRole.
+	* Falls back to subscriber (10) for unknown values.
+	*/
+	static toRole(level) {
+		if (UserRepository.VALID_LEVELS.has(level)) return level;
+		return 10;
+	}
+};
+
+//#endregion
+export { UserRepository as t };