emdash 0.33.0 → 0.35.0

package/dist/manifest-builder-B252yQUf.mjs

@@ -0,0 +1,189 @@
+import { n as fingerprintMigrationSet } from "./identity-Ys6Dlc9C.mjs";
+import { z } from "zod";
+
+//#region src/i18n/normalize.ts
+function normalizeAstroI18n(config) {
+	if (!config) return null;
+	return {
+		defaultLocale: config.defaultLocale,
+		locales: config.locales.map((locale) => typeof locale === "string" ? locale : locale.path),
+		fallback: config.fallback ? Object.fromEntries(Object.entries(config.fallback).filter((entry) => entry[1] !== void 0)) : void 0,
+		prefixDefaultLocale: typeof config.routing === "object" ? config.routing.prefixDefaultLocale ?? false : false
+	};
+}
+
+//#endregion
+//#region src/migrations/manifest.ts
+const FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
+const MIGRATION_NAME_PATTERN = /^\d{3}_[a-z0-9_]+$/;
+const EXECUTOR_ENTRYPOINT_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/;
+const ENVIRONMENT_VARIABLE_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ENVIRONMENT_REFERENCE_KEY_PATTERN = /(?:env|envName|envVar)$/i;
+const URL_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+const SECRET_QUERY_KEY_PATTERN = /(?:auth|credential|key|password|secret|signature|token)/i;
+const SECRET_CONFIG_KEY_PATTERN = /(?:accessToken|apiKey|authToken|certificate|connectionString|password|privateKey|secret)/i;
+const SECRET_CONFIG_EXACT_KEY_PATTERN = /^(?:ca|cert|key)$/i;
+const CONNECTION_URL_PROTOCOLS = new Set([
+	"mysql:",
+	"postgres:",
+	"postgresql:"
+]);
+const i18nConfigSchema = z.object({
+	defaultLocale: z.string().min(1),
+	locales: z.array(z.string().min(1)).min(1),
+	fallback: z.record(z.string(), z.string()).optional(),
+	prefixDefaultLocale: z.boolean().optional()
+}).strict();
+const migrationManifestV1Schema = z.object({
+	schemaVersion: z.literal(1),
+	emdashVersion: z.string().min(1),
+	migrationSet: z.object({
+		names: z.array(z.string().regex(MIGRATION_NAME_PATTERN)).min(1).refine((names) => new Set(names).size === names.length),
+		fingerprint: z.string().regex(FINGERPRINT_PATTERN)
+	}).strict(),
+	i18n: i18nConfigSchema.nullable(),
+	database: z.object({
+		type: z.enum(["sqlite", "postgres"]),
+		executorEntrypoint: z.string().regex(EXECUTOR_ENTRYPOINT_PATTERN),
+		executorConfig: z.unknown()
+	}).strict()
+}).strict();
+var MigrationManifestValidationError = class extends Error {
+	constructor(message) {
+		super(`Invalid migration manifest: ${message}`);
+		this.name = "MigrationManifestValidationError";
+	}
+};
+function isEnvironmentReferenceKey(key) {
+	return ENVIRONMENT_REFERENCE_KEY_PATTERN.test(key);
+}
+function assertSafeUrl(value, path) {
+	if (!URL_SCHEME_PATTERN.test(value)) return;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new MigrationManifestValidationError(`${path} contains an invalid URL`);
+	}
+	if (CONNECTION_URL_PROTOCOLS.has(url.protocol)) throw new MigrationManifestValidationError(`${path} contains a database connection URL`);
+	if (url.username || url.password) throw new MigrationManifestValidationError(`${path} contains URL credentials`);
+	for (const key of url.searchParams.keys()) if (SECRET_QUERY_KEY_PATTERN.test(key)) throw new MigrationManifestValidationError(`${path} contains a credential query parameter`);
+}
+function cloneSecretFreeJson(value, path, ancestors) {
+	if (value === null || typeof value === "boolean") return value;
+	if (typeof value === "string") {
+		assertSafeUrl(value, path);
+		return value;
+	}
+	if (typeof value === "number") {
+		if (Number.isFinite(value)) return value;
+		throw new MigrationManifestValidationError(`${path} contains a non-finite number`);
+	}
+	if (typeof value !== "object") throw new MigrationManifestValidationError(`${path} is not JSON-serializable`);
+	if (ancestors.has(value)) throw new MigrationManifestValidationError(`${path} contains a cycle`);
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) return value.map((item, index) => cloneSecretFreeJson(item, `${path}[${index}]`, ancestors));
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null) throw new MigrationManifestValidationError(`${path} contains a non-plain object`);
+		const cloned = {};
+		for (const [key, item] of Object.entries(value)) {
+			const itemPath = `${path}.${key}`;
+			const environmentReference = isEnvironmentReferenceKey(key);
+			if (!environmentReference && (SECRET_CONFIG_KEY_PATTERN.test(key) || SECRET_CONFIG_EXACT_KEY_PATTERN.test(key))) throw new MigrationManifestValidationError(`${itemPath} is a credential-bearing field`);
+			if (environmentReference) {
+				if (typeof item !== "string" || !ENVIRONMENT_VARIABLE_PATTERN.test(item)) throw new MigrationManifestValidationError(`${itemPath} must contain an environment-variable name`);
+			}
+			cloned[key] = cloneSecretFreeJson(item, itemPath, ancestors);
+		}
+		return cloned;
+	} finally {
+		ancestors.delete(value);
+	}
+}
+function validateSecretFreeExecutorConfig(value, path = "database.executorConfig") {
+	return cloneSecretFreeJson(value, path, /* @__PURE__ */ new Set());
+}
+function identitiesMatch(manifest, expectedIdentity) {
+	return manifest.emdashVersion === expectedIdentity.emdashVersion && manifest.migrationSet.fingerprint === expectedIdentity.fingerprint && manifest.migrationSet.names.length === expectedIdentity.names.length && manifest.migrationSet.names.every((name, index) => name === expectedIdentity.names[index]);
+}
+async function validateMigrationManifest(value, expectedIdentity) {
+	const parsed = migrationManifestV1Schema.safeParse(value);
+	if (!parsed.success) throw new MigrationManifestValidationError("schema validation failed");
+	const executorConfig = validateSecretFreeExecutorConfig(parsed.data.database.executorConfig);
+	const manifest = {
+		...parsed.data,
+		database: {
+			...parsed.data.database,
+			executorConfig
+		}
+	};
+	if (await fingerprintMigrationSet(manifest.emdashVersion, manifest.migrationSet.names) !== manifest.migrationSet.fingerprint) throw new MigrationManifestValidationError("migrationSet fingerprint does not match its version and ordered names");
+	if (expectedIdentity && !identitiesMatch(manifest, expectedIdentity)) throw new MigrationManifestValidationError("manifest does not match the loaded EmDash migration identity");
+	return manifest;
+}
+function serializeMigrationManifest(manifest) {
+	return `${JSON.stringify(manifest, null, "	")}\n`;
+}
+
+//#endregion
+//#region src/migrations/integration-metadata.ts
+const MIGRATION_CONFIG_SYMBOL = Symbol.for("emdash:migration-config");
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function isMigrationIntegrationMetadata(value) {
+	if (!isRecord(value)) return false;
+	const database = value.database;
+	if (database === void 0) return true;
+	if (!isRecord(database) || database.type !== "sqlite" && database.type !== "postgres") return false;
+	const migrations = database.migrations;
+	return migrations === void 0 || isRecord(migrations) && typeof migrations.entrypoint === "string" && Object.hasOwn(migrations, "manifestConfig");
+}
+function createMigrationIntegrationMetadata(database) {
+	if (!database) return {};
+	return { database: {
+		type: database.type,
+		migrations: database.migrations ? {
+			entrypoint: database.migrations.entrypoint,
+			manifestConfig: validateSecretFreeExecutorConfig(database.migrations.manifestConfig, "database.migrations.manifestConfig")
+		} : void 0
+	} };
+}
+function getMigrationIntegrationMetadata(integration) {
+	if ((typeof integration !== "object" || integration === null) && typeof integration !== "function") return;
+	if (!Object.hasOwn(integration, MIGRATION_CONFIG_SYMBOL)) return;
+	const metadata = Reflect.get(integration, MIGRATION_CONFIG_SYMBOL);
+	return isMigrationIntegrationMetadata(metadata) ? metadata : void 0;
+}
+
+//#endregion
+//#region src/migrations/manifest-builder.ts
+var UnsupportedMigrationAdapterError = class extends Error {
+	constructor() {
+		super("The configured database adapter does not provide a deployment migration executor");
+		this.name = "UnsupportedMigrationAdapterError";
+	}
+};
+async function buildMigrationManifest({ identity, i18n, database }) {
+	if (await fingerprintMigrationSet(identity.emdashVersion, identity.names) !== identity.fingerprint) throw new MigrationManifestValidationError("loaded identity fingerprint does not match its version and ordered names");
+	if (!database.migrations) throw new UnsupportedMigrationAdapterError();
+	return validateMigrationManifest({
+		schemaVersion: 1,
+		emdashVersion: identity.emdashVersion,
+		migrationSet: {
+			names: [...identity.names],
+			fingerprint: identity.fingerprint
+		},
+		i18n,
+		database: {
+			type: database.type,
+			executorEntrypoint: database.migrations.entrypoint,
+			executorConfig: database.migrations.manifestConfig
+		}
+	}, identity);
+}
+
+//#endregion
+export { MigrationManifestValidationError as a, normalizeAstroI18n as c, getMigrationIntegrationMetadata as i, MIGRATION_CONFIG_SYMBOL as n, serializeMigrationManifest as o, createMigrationIntegrationMetadata as r, validateMigrationManifest as s, buildMigrationManifest as t };
+//# sourceMappingURL=manifest-builder-B252yQUf.mjs.map

package/dist/manifest-builder-B252yQUf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-builder-B252yQUf.mjs","names":[],"sources":["../src/i18n/normalize.ts","../src/migrations/manifest.ts","../src/migrations/integration-metadata.ts","../src/migrations/manifest-builder.ts"],"sourcesContent":["import type { I18nConfig } from \"./config.js\";\n\nexport interface AstroLocaleObject {\n\tpath: string;\n\tcodes: readonly string[];\n}\n\nexport interface AstroI18nInput {\n\tdefaultLocale: string;\n\tlocales: readonly (string | AstroLocaleObject)[];\n\tfallback?: Readonly<Record<string, string | undefined>>;\n\trouting?: string | { prefixDefaultLocale?: boolean };\n}\n\nexport function normalizeAstroI18n(config: AstroI18nInput | null | undefined): I18nConfig | null {\n\tif (!config) return null;\n\n\treturn {\n\t\tdefaultLocale: config.defaultLocale,\n\t\tlocales: config.locales.map((locale) => (typeof locale === \"string\" ? locale : locale.path)),\n\t\tfallback: config.fallback\n\t\t\t? Object.fromEntries(\n\t\t\t\t\tObject.entries(config.fallback).filter(\n\t\t\t\t\t\t(entry): entry is [string, string] => entry[1] !== undefined,\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t: undefined,\n\t\tprefixDefaultLocale:\n\t\t\ttypeof config.routing === \"object\" ? (config.routing.prefixDefaultLocale ?? false) : false,\n\t};\n}\n","import { z } from \"zod\";\n\nimport type { CoreMigrationIdentity } from \"./identity.js\";\nimport { fingerprintMigrationSet } from \"./identity.js\";\n\nconst FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;\nconst MIGRATION_NAME_PATTERN = /^\\d{3}_[a-z0-9_]+$/;\nconst EXECUTOR_ENTRYPOINT_PATTERN =\n\t/^(?:@[a-z0-9][a-z0-9._-]*\\/)?[a-z0-9][a-z0-9._-]*(?:\\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/;\nconst ENVIRONMENT_VARIABLE_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst ENVIRONMENT_REFERENCE_KEY_PATTERN = /(?:env|envName|envVar)$/i;\nconst URL_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:/;\nconst SECRET_QUERY_KEY_PATTERN = /(?:auth|credential|key|password|secret|signature|token)/i;\nconst SECRET_CONFIG_KEY_PATTERN =\n\t/(?:accessToken|apiKey|authToken|certificate|connectionString|password|privateKey|secret)/i;\nconst SECRET_CONFIG_EXACT_KEY_PATTERN = /^(?:ca|cert|key)$/i;\nconst CONNECTION_URL_PROTOCOLS = new Set([\"mysql:\", \"postgres:\", \"postgresql:\"]);\n\ntype JsonPrimitive = boolean | number | string | null;\ntype JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };\n\nconst i18nConfigSchema = z\n\t.object({\n\t\tdefaultLocale: z.string().min(1),\n\t\tlocales: z.array(z.string().min(1)).min(1),\n\t\tfallback: z.record(z.string(), z.string()).optional(),\n\t\tprefixDefaultLocale: z.boolean().optional(),\n\t})\n\t.strict();\n\nexport const migrationManifestV1Schema = z\n\t.object({\n\t\tschemaVersion: z.literal(1),\n\t\temdashVersion: z.string().min(1),\n\t\tmigrationSet: z\n\t\t\t.object({\n\t\t\t\tnames: z\n\t\t\t\t\t.array(z.string().regex(MIGRATION_NAME_PATTERN))\n\t\t\t\t\t.min(1)\n\t\t\t\t\t.refine((names) => new Set(names).size === names.length),\n\t\t\t\tfingerprint: z.string().regex(FINGERPRINT_PATTERN),\n\t\t\t})\n\t\t\t.strict(),\n\t\ti18n: i18nConfigSchema.nullable(),\n\t\tdatabase: z\n\t\t\t.object({\n\t\t\t\ttype: z.enum([\"sqlite\", \"postgres\"]),\n\t\t\t\texecutorEntrypoint: z.string().regex(EXECUTOR_ENTRYPOINT_PATTERN),\n\t\t\t\texecutorConfig: z.unknown(),\n\t\t\t})\n\t\t\t.strict(),\n\t})\n\t.strict();\n\nexport type MigrationManifestV1 = z.infer<typeof migrationManifestV1Schema>;\n\nexport class MigrationManifestValidationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(`Invalid migration manifest: ${message}`);\n\t\tthis.name = \"MigrationManifestValidationError\";\n\t}\n}\n\nfunction isEnvironmentReferenceKey(key: string): boolean {\n\treturn ENVIRONMENT_REFERENCE_KEY_PATTERN.test(key);\n}\n\nfunction assertSafeUrl(value: string, path: string): void {\n\tif (!URL_SCHEME_PATTERN.test(value)) return;\n\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(value);\n\t} catch {\n\t\tthrow new MigrationManifestValidationError(`${path} contains an invalid URL`);\n\t}\n\n\tif (CONNECTION_URL_PROTOCOLS.has(url.protocol)) {\n\t\tthrow new MigrationManifestValidationError(`${path} contains a database connection URL`);\n\t}\n\tif (url.username || url.password) {\n\t\tthrow new MigrationManifestValidationError(`${path} contains URL credentials`);\n\t}\n\tfor (const key of url.searchParams.keys()) {\n\t\tif (SECRET_QUERY_KEY_PATTERN.test(key)) {\n\t\t\tthrow new MigrationManifestValidationError(`${path} contains a credential query parameter`);\n\t\t}\n\t}\n}\n\nfunction cloneSecretFreeJson(value: unknown, path: string, ancestors: Set<object>): JsonValue {\n\tif (value === null || typeof value === \"boolean\") return value;\n\tif (typeof value === \"string\") {\n\t\tassertSafeUrl(value, path);\n\t\treturn value;\n\t}\n\tif (typeof value === \"number\") {\n\t\tif (Number.isFinite(value)) return value;\n\t\tthrow new MigrationManifestValidationError(`${path} contains a non-finite number`);\n\t}\n\tif (typeof value !== \"object\") {\n\t\tthrow new MigrationManifestValidationError(`${path} is not JSON-serializable`);\n\t}\n\tif (ancestors.has(value)) {\n\t\tthrow new MigrationManifestValidationError(`${path} contains a cycle`);\n\t}\n\n\tancestors.add(value);\n\ttry {\n\t\tif (Array.isArray(value)) {\n\t\t\treturn value.map((item, index) => cloneSecretFreeJson(item, `${path}[${index}]`, ancestors));\n\t\t}\n\n\t\tconst prototype = Object.getPrototypeOf(value);\n\t\tif (prototype !== Object.prototype && prototype !== null) {\n\t\t\tthrow new MigrationManifestValidationError(`${path} contains a non-plain object`);\n\t\t}\n\n\t\tconst cloned: Record<string, JsonValue> = {};\n\t\tfor (const [key, item] of Object.entries(value)) {\n\t\t\tconst itemPath = `${path}.${key}`;\n\t\t\tconst environmentReference = isEnvironmentReferenceKey(key);\n\t\t\tif (\n\t\t\t\t!environmentReference &&\n\t\t\t\t(SECRET_CONFIG_KEY_PATTERN.test(key) || SECRET_CONFIG_EXACT_KEY_PATTERN.test(key))\n\t\t\t) {\n\t\t\t\tthrow new MigrationManifestValidationError(`${itemPath} is a credential-bearing field`);\n\t\t\t}\n\t\t\tif (environmentReference) {\n\t\t\t\tif (typeof item !== \"string\" || !ENVIRONMENT_VARIABLE_PATTERN.test(item)) {\n\t\t\t\t\tthrow new MigrationManifestValidationError(\n\t\t\t\t\t\t`${itemPath} must contain an environment-variable name`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\t\t\tcloned[key] = cloneSecretFreeJson(item, itemPath, ancestors);\n\t\t}\n\t\treturn cloned;\n\t} finally {\n\t\tancestors.delete(value);\n\t}\n}\n\nexport function validateSecretFreeExecutorConfig(\n\tvalue: unknown,\n\tpath = \"database.executorConfig\",\n): unknown {\n\treturn cloneSecretFreeJson(value, path, new Set());\n}\n\nfunction identitiesMatch(\n\tmanifest: MigrationManifestV1,\n\texpectedIdentity: CoreMigrationIdentity,\n): boolean {\n\treturn (\n\t\tmanifest.emdashVersion === expectedIdentity.emdashVersion &&\n\t\tmanifest.migrationSet.fingerprint === expectedIdentity.fingerprint &&\n\t\tmanifest.migrationSet.names.length === expectedIdentity.names.length &&\n\t\tmanifest.migrationSet.names.every((name, index) => name === expectedIdentity.names[index])\n\t);\n}\n\nexport async function validateMigrationManifest(\n\tvalue: unknown,\n\texpectedIdentity?: CoreMigrationIdentity,\n): Promise<MigrationManifestV1> {\n\tconst parsed = migrationManifestV1Schema.safeParse(value);\n\tif (!parsed.success) {\n\t\tthrow new MigrationManifestValidationError(\"schema validation failed\");\n\t}\n\n\tconst executorConfig = validateSecretFreeExecutorConfig(parsed.data.database.executorConfig);\n\tconst manifest: MigrationManifestV1 = {\n\t\t...parsed.data,\n\t\tdatabase: { ...parsed.data.database, executorConfig },\n\t};\n\tconst fingerprint = await fingerprintMigrationSet(\n\t\tmanifest.emdashVersion,\n\t\tmanifest.migrationSet.names,\n\t);\n\tif (fingerprint !== manifest.migrationSet.fingerprint) {\n\t\tthrow new MigrationManifestValidationError(\n\t\t\t\"migrationSet fingerprint does not match its version and ordered names\",\n\t\t);\n\t}\n\tif (expectedIdentity && !identitiesMatch(manifest, expectedIdentity)) {\n\t\tthrow new MigrationManifestValidationError(\n\t\t\t\"manifest does not match the loaded EmDash migration identity\",\n\t\t);\n\t}\n\n\treturn manifest;\n}\n\nexport function serializeMigrationManifest(manifest: MigrationManifestV1): string {\n\treturn `${JSON.stringify(manifest, null, \"\\t\")}\\n`;\n}\n","import type { DatabaseDescriptor } from \"../db/adapters.js\";\nimport { validateSecretFreeExecutorConfig } from \"./manifest.js\";\n\nexport const MIGRATION_CONFIG_SYMBOL = Symbol.for(\"emdash:migration-config\");\n\nexport interface MigrationIntegrationMetadata {\n\tdatabase?: Pick<DatabaseDescriptor, \"type\" | \"migrations\">;\n}\n\nfunction isRecord(value: unknown): value is Record<PropertyKey, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction isMigrationIntegrationMetadata(value: unknown): value is MigrationIntegrationMetadata {\n\tif (!isRecord(value)) return false;\n\tconst database = value.database;\n\tif (database === undefined) return true;\n\tif (!isRecord(database) || (database.type !== \"sqlite\" && database.type !== \"postgres\")) {\n\t\treturn false;\n\t}\n\n\tconst migrations = database.migrations;\n\treturn (\n\t\tmigrations === undefined ||\n\t\t(isRecord(migrations) &&\n\t\t\ttypeof migrations.entrypoint === \"string\" &&\n\t\t\tObject.hasOwn(migrations, \"manifestConfig\"))\n\t);\n}\n\nexport function createMigrationIntegrationMetadata(\n\tdatabase?: DatabaseDescriptor,\n): MigrationIntegrationMetadata {\n\tif (!database) return {};\n\n\treturn {\n\t\tdatabase: {\n\t\t\ttype: database.type,\n\t\t\tmigrations: database.migrations\n\t\t\t\t? {\n\t\t\t\t\t\tentrypoint: database.migrations.entrypoint,\n\t\t\t\t\t\tmanifestConfig: validateSecretFreeExecutorConfig(\n\t\t\t\t\t\t\tdatabase.migrations.manifestConfig,\n\t\t\t\t\t\t\t\"database.migrations.manifestConfig\",\n\t\t\t\t\t\t),\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\t},\n\t};\n}\n\nexport function getMigrationIntegrationMetadata(\n\tintegration: unknown,\n): MigrationIntegrationMetadata | undefined {\n\tif (\n\t\t(typeof integration !== \"object\" || integration === null) &&\n\t\ttypeof integration !== \"function\"\n\t) {\n\t\treturn undefined;\n\t}\n\tif (!Object.hasOwn(integration, MIGRATION_CONFIG_SYMBOL)) {\n\t\treturn undefined;\n\t}\n\n\tconst metadata: unknown = Reflect.get(integration, MIGRATION_CONFIG_SYMBOL);\n\treturn isMigrationIntegrationMetadata(metadata) ? metadata : undefined;\n}\n","import type { DatabaseDescriptor } from \"../db/adapters.js\";\nimport type { I18nConfig } from \"../i18n/config.js\";\nimport type { CoreMigrationIdentity } from \"./identity.js\";\nimport { fingerprintMigrationSet } from \"./identity.js\";\nimport type { MigrationManifestV1 } from \"./manifest.js\";\nimport { MigrationManifestValidationError, validateMigrationManifest } from \"./manifest.js\";\n\nexport type ManifestDatabaseDescriptor = Pick<DatabaseDescriptor, \"type\" | \"migrations\">;\n\nexport interface BuildMigrationManifestOptions {\n\tidentity: CoreMigrationIdentity;\n\ti18n: I18nConfig | null;\n\tdatabase: ManifestDatabaseDescriptor;\n}\n\nexport class UnsupportedMigrationAdapterError extends Error {\n\tconstructor() {\n\t\tsuper(\"The configured database adapter does not provide a deployment migration executor\");\n\t\tthis.name = \"UnsupportedMigrationAdapterError\";\n\t}\n}\n\nexport async function buildMigrationManifest({\n\tidentity,\n\ti18n,\n\tdatabase,\n}: BuildMigrationManifestOptions): Promise<MigrationManifestV1> {\n\tconst identityFingerprint = await fingerprintMigrationSet(identity.emdashVersion, identity.names);\n\tif (identityFingerprint !== identity.fingerprint) {\n\t\tthrow new MigrationManifestValidationError(\n\t\t\t\"loaded identity fingerprint does not match its version and ordered names\",\n\t\t);\n\t}\n\tif (!database.migrations) {\n\t\tthrow new UnsupportedMigrationAdapterError();\n\t}\n\n\treturn validateMigrationManifest(\n\t\t{\n\t\t\tschemaVersion: 1,\n\t\t\temdashVersion: identity.emdashVersion,\n\t\t\tmigrationSet: {\n\t\t\t\tnames: [...identity.names],\n\t\t\t\tfingerprint: identity.fingerprint,\n\t\t\t},\n\t\t\ti18n,\n\t\t\tdatabase: {\n\t\t\t\ttype: database.type,\n\t\t\t\texecutorEntrypoint: database.migrations.entrypoint,\n\t\t\t\texecutorConfig: database.migrations.manifestConfig,\n\t\t\t},\n\t\t},\n\t\tidentity,\n\t);\n}\n"],"mappings":";;;;AAcA,SAAgB,mBAAmB,QAA8D;AAChG,KAAI,CAAC,OAAQ,QAAO;AAEpB,QAAO;EACN,eAAe,OAAO;EACtB,SAAS,OAAO,QAAQ,KAAK,WAAY,OAAO,WAAW,WAAW,SAAS,OAAO,KAAM;EAC5F,UAAU,OAAO,WACd,OAAO,YACP,OAAO,QAAQ,OAAO,SAAS,CAAC,QAC9B,UAAqC,MAAM,OAAO,OACnD,CACD,GACA;EACH,qBACC,OAAO,OAAO,YAAY,WAAY,OAAO,QAAQ,uBAAuB,QAAS;EACtF;;;;;ACxBF,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAC/B,MAAM,8BACL;AACD,MAAM,+BAA+B;AACrC,MAAM,oCAAoC;AAC1C,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,4BACL;AACD,MAAM,kCAAkC;AACxC,MAAM,2BAA2B,IAAI,IAAI;CAAC;CAAU;CAAa;CAAc,CAAC;AAKhF,MAAM,mBAAmB,EACvB,OAAO;CACP,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE;CAChC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;CAC1C,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;CACrD,qBAAqB,EAAE,SAAS,CAAC,UAAU;CAC3C,CAAC,CACD,QAAQ;AAEV,MAAa,4BAA4B,EACvC,OAAO;CACP,eAAe,EAAE,QAAQ,EAAE;CAC3B,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE;CAChC,cAAc,EACZ,OAAO;EACP,OAAO,EACL,MAAM,EAAE,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAC/C,IAAI,EAAE,CACN,QAAQ,UAAU,IAAI,IAAI,MAAM,CAAC,SAAS,MAAM,OAAO;EACzD,aAAa,EAAE,QAAQ,CAAC,MAAM,oBAAoB;EAClD,CAAC,CACD,QAAQ;CACV,MAAM,iBAAiB,UAAU;CACjC,UAAU,EACR,OAAO;EACP,MAAM,EAAE,KAAK,CAAC,UAAU,WAAW,CAAC;EACpC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,4BAA4B;EACjE,gBAAgB,EAAE,SAAS;EAC3B,CAAC,CACD,QAAQ;CACV,CAAC,CACD,QAAQ;AAIV,IAAa,mCAAb,cAAsD,MAAM;CAC3D,YAAY,SAAiB;AAC5B,QAAM,+BAA+B,UAAU;AAC/C,OAAK,OAAO;;;AAId,SAAS,0BAA0B,KAAsB;AACxD,QAAO,kCAAkC,KAAK,IAAI;;AAGnD,SAAS,cAAc,OAAe,MAAoB;AACzD,KAAI,CAAC,mBAAmB,KAAK,MAAM,CAAE;CAErC,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,MAAM;SACb;AACP,QAAM,IAAI,iCAAiC,GAAG,KAAK,0BAA0B;;AAG9E,KAAI,yBAAyB,IAAI,IAAI,SAAS,CAC7C,OAAM,IAAI,iCAAiC,GAAG,KAAK,qCAAqC;AAEzF,KAAI,IAAI,YAAY,IAAI,SACvB,OAAM,IAAI,iCAAiC,GAAG,KAAK,2BAA2B;AAE/E,MAAK,MAAM,OAAO,IAAI,aAAa,MAAM,CACxC,KAAI,yBAAyB,KAAK,IAAI,CACrC,OAAM,IAAI,iCAAiC,GAAG,KAAK,wCAAwC;;AAK9F,SAAS,oBAAoB,OAAgB,MAAc,WAAmC;AAC7F,KAAI,UAAU,QAAQ,OAAO,UAAU,UAAW,QAAO;AACzD,KAAI,OAAO,UAAU,UAAU;AAC9B,gBAAc,OAAO,KAAK;AAC1B,SAAO;;AAER,KAAI,OAAO,UAAU,UAAU;AAC9B,MAAI,OAAO,SAAS,MAAM,CAAE,QAAO;AACnC,QAAM,IAAI,iCAAiC,GAAG,KAAK,+BAA+B;;AAEnF,KAAI,OAAO,UAAU,SACpB,OAAM,IAAI,iCAAiC,GAAG,KAAK,2BAA2B;AAE/E,KAAI,UAAU,IAAI,MAAM,CACvB,OAAM,IAAI,iCAAiC,GAAG,KAAK,mBAAmB;AAGvE,WAAU,IAAI,MAAM;AACpB,KAAI;AACH,MAAI,MAAM,QAAQ,MAAM,CACvB,QAAO,MAAM,KAAK,MAAM,UAAU,oBAAoB,MAAM,GAAG,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;EAG7F,MAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,MAAI,cAAc,OAAO,aAAa,cAAc,KACnD,OAAM,IAAI,iCAAiC,GAAG,KAAK,8BAA8B;EAGlF,MAAM,SAAoC,EAAE;AAC5C,OAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,MAAM,EAAE;GAChD,MAAM,WAAW,GAAG,KAAK,GAAG;GAC5B,MAAM,uBAAuB,0BAA0B,IAAI;AAC3D,OACC,CAAC,yBACA,0BAA0B,KAAK,IAAI,IAAI,gCAAgC,KAAK,IAAI,EAEjF,OAAM,IAAI,iCAAiC,GAAG,SAAS,gCAAgC;AAExF,OAAI,sBACH;QAAI,OAAO,SAAS,YAAY,CAAC,6BAA6B,KAAK,KAAK,CACvE,OAAM,IAAI,iCACT,GAAG,SAAS,4CACZ;;AAGH,UAAO,OAAO,oBAAoB,MAAM,UAAU,UAAU;;AAE7D,SAAO;WACE;AACT,YAAU,OAAO,MAAM;;;AAIzB,SAAgB,iCACf,OACA,OAAO,2BACG;AACV,QAAO,oBAAoB,OAAO,sBAAM,IAAI,KAAK,CAAC;;AAGnD,SAAS,gBACR,UACA,kBACU;AACV,QACC,SAAS,kBAAkB,iBAAiB,iBAC5C,SAAS,aAAa,gBAAgB,iBAAiB,eACvD,SAAS,aAAa,MAAM,WAAW,iBAAiB,MAAM,UAC9D,SAAS,aAAa,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB,MAAM,OAAO;;AAI5F,eAAsB,0BACrB,OACA,kBAC+B;CAC/B,MAAM,SAAS,0BAA0B,UAAU,MAAM;AACzD,KAAI,CAAC,OAAO,QACX,OAAM,IAAI,iCAAiC,2BAA2B;CAGvE,MAAM,iBAAiB,iCAAiC,OAAO,KAAK,SAAS,eAAe;CAC5F,MAAM,WAAgC;EACrC,GAAG,OAAO;EACV,UAAU;GAAE,GAAG,OAAO,KAAK;GAAU;GAAgB;EACrD;AAKD,KAJoB,MAAM,wBACzB,SAAS,eACT,SAAS,aAAa,MACtB,KACmB,SAAS,aAAa,YACzC,OAAM,IAAI,iCACT,wEACA;AAEF,KAAI,oBAAoB,CAAC,gBAAgB,UAAU,iBAAiB,CACnE,OAAM,IAAI,iCACT,+DACA;AAGF,QAAO;;AAGR,SAAgB,2BAA2B,UAAuC;AACjF,QAAO,GAAG,KAAK,UAAU,UAAU,MAAM,IAAK,CAAC;;;;;AChMhD,MAAa,0BAA0B,OAAO,IAAI,0BAA0B;AAM5E,SAAS,SAAS,OAAuD;AACxE,QAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,+BAA+B,OAAuD;AAC9F,KAAI,CAAC,SAAS,MAAM,CAAE,QAAO;CAC7B,MAAM,WAAW,MAAM;AACvB,KAAI,aAAa,OAAW,QAAO;AACnC,KAAI,CAAC,SAAS,SAAS,IAAK,SAAS,SAAS,YAAY,SAAS,SAAS,WAC3E,QAAO;CAGR,MAAM,aAAa,SAAS;AAC5B,QACC,eAAe,UACd,SAAS,WAAW,IACpB,OAAO,WAAW,eAAe,YACjC,OAAO,OAAO,YAAY,iBAAiB;;AAI9C,SAAgB,mCACf,UAC+B;AAC/B,KAAI,CAAC,SAAU,QAAO,EAAE;AAExB,QAAO,EACN,UAAU;EACT,MAAM,SAAS;EACf,YAAY,SAAS,aAClB;GACA,YAAY,SAAS,WAAW;GAChC,gBAAgB,iCACf,SAAS,WAAW,gBACpB,qCACA;GACD,GACA;EACH,EACD;;AAGF,SAAgB,gCACf,aAC2C;AAC3C,MACE,OAAO,gBAAgB,YAAY,gBAAgB,SACpD,OAAO,gBAAgB,WAEvB;AAED,KAAI,CAAC,OAAO,OAAO,aAAa,wBAAwB,CACvD;CAGD,MAAM,WAAoB,QAAQ,IAAI,aAAa,wBAAwB;AAC3E,QAAO,+BAA+B,SAAS,GAAG,WAAW;;;;;AClD9D,IAAa,mCAAb,cAAsD,MAAM;CAC3D,cAAc;AACb,QAAM,mFAAmF;AACzF,OAAK,OAAO;;;AAId,eAAsB,uBAAuB,EAC5C,UACA,MACA,YAC+D;AAE/D,KAD4B,MAAM,wBAAwB,SAAS,eAAe,SAAS,MAAM,KACrE,SAAS,YACpC,OAAM,IAAI,iCACT,2EACA;AAEF,KAAI,CAAC,SAAS,WACb,OAAM,IAAI,kCAAkC;AAG7C,QAAO,0BACN;EACC,eAAe;EACf,eAAe,SAAS;EACxB,cAAc;GACb,OAAO,CAAC,GAAG,SAAS,MAAM;GAC1B,aAAa,SAAS;GACtB;EACD;EACA,UAAU;GACT,MAAM,SAAS;GACf,oBAAoB,SAAS,WAAW;GACxC,gBAAgB,SAAS,WAAW;GACpC;EACD,EACD,SACA"}

package/dist/{manifest-schema-Da7kj23y.mjs → manifest-schema-BXbUAHod.mjs}

@@ -298,4 +298,4 @@ function normalizeManifestRoute(entry) {
 
 //#endregion
 export { reconcileManifestAccess as a, pluginManifestSchema as i, PLUGIN_CAPABILITIES as n, normalizeManifestRoute as r, HOOK_NAMES as t };
-//# sourceMappingURL=manifest-schema-Da7kj23y.mjs.map
+//# sourceMappingURL=manifest-schema-BXbUAHod.mjs.map

package/dist/{manifest-schema-Da7kj23y.mjs.map → manifest-schema-BXbUAHod.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"manifest-schema-Da7kj23y.mjs","names":[],"sources":["../src/plugins/manifest-schema.ts"],"sourcesContent":["/**\n * Zod schema for PluginManifest validation\n *\n * Used to validate manifest.json from plugin bundles at every parse site:\n * - Client-side download (marketplace.ts extractBundle)\n * - R2 load (api/handlers/marketplace.ts loadBundleFromR2)\n * - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)\n * - Marketplace ingest extends this with publishing-specific fields\n */\n\nimport { Permissions } from \"@emdash-cms/auth\";\nimport {\n\tcapabilitiesToDeclaredAccess,\n\tdeclaredAccessToCapabilities,\n} from \"@emdash-cms/plugin-types\";\nimport { z } from \"zod\";\n\nimport type { PluginManifest } from \"./types.js\";\n\n// ── Enum values (must stay in sync with types.ts) ───────────────\n\n/**\n * Current capability names — the ones authors should use going forward.\n * See `PluginCapability` in `types.ts` for documentation of each.\n */\nexport const CURRENT_PLUGIN_CAPABILITIES = [\n\t\"network:request\",\n\t\"network:request:unrestricted\",\n\t\"content:read\",\n\t\"content:write\",\n\t\"taxonomies:read\",\n\t\"media:read\",\n\t\"media:write\",\n\t\"users:read\",\n\t\"email:send\",\n\t\"hooks.email-transport:register\",\n\t\"hooks.email-events:register\",\n\t\"hooks.page-fragments:register\",\n] as const;\n\n/**\n * Legacy capability names accepted during the deprecation window.\n * Normalized to current names via `normalizeCapability()` in types.ts\n * before reaching the runtime. Plugin authors are warned at bundle/validate\n * and hard-failed at publish.\n */\nexport const DEPRECATED_PLUGIN_CAPABILITIES = [\n\t\"network:fetch\",\n\t\"network:fetch:any\",\n\t\"read:content\",\n\t\"write:content\",\n\t\"read:media\",\n\t\"write:media\",\n\t\"read:users\",\n\t\"email:provide\",\n\t\"email:intercept\",\n\t\"page:inject\",\n] as const;\n\n/**\n * Full set of accepted capability strings — current + deprecated.\n *\n * The manifest schema accepts both during the transition. The runtime only\n * ever sees current names because `normalizeCapability()` rewrites legacy\n * names at every external boundary (definePlugin, adaptSandboxEntry).\n */\nexport const PLUGIN_CAPABILITIES = [\n\t...CURRENT_PLUGIN_CAPABILITIES,\n\t...DEPRECATED_PLUGIN_CAPABILITIES,\n] as const;\n\n/** Must stay in sync with FieldType in schema/types.ts */\nconst FIELD_TYPES = [\n\t\"string\",\n\t\"text\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"multiSelect\",\n\t\"portableText\",\n\t\"image\",\n\t\"file\",\n\t\"reference\",\n\t\"json\",\n\t\"slug\",\n\t\"repeater\",\n] as const;\n\nexport const HOOK_NAMES = [\n\t\"plugin:install\",\n\t\"plugin:activate\",\n\t\"plugin:deactivate\",\n\t\"plugin:uninstall\",\n\t\"content:beforeSave\",\n\t\"content:afterSave\",\n\t\"content:beforeDelete\",\n\t\"content:afterDelete\",\n\t\"content:afterPublish\",\n\t\"content:afterUnpublish\",\n\t\"content:afterRestore\",\n\t\"content:afterSchedule\",\n\t\"content:afterUnschedule\",\n\t\"media:beforeUpload\",\n\t\"media:afterUpload\",\n\t\"cron\",\n\t\"email:beforeSend\",\n\t\"email:deliver\",\n\t\"email:afterSend\",\n\t\"comment:beforeCreate\",\n\t\"comment:moderate\",\n\t\"comment:afterCreate\",\n\t\"comment:afterModerate\",\n\t\"page:metadata\",\n\t\"page:fragments\",\n] as const;\n\n/**\n * Structured hook entry for manifest — name plus optional metadata.\n * During a transition period, both plain strings and objects are accepted.\n */\nconst manifestHookEntrySchema = z.object({\n\tname: z.enum(HOOK_NAMES),\n\texclusive: z.boolean().optional(),\n\tpriority: z.number().int().optional(),\n\ttimeout: z.number().int().positive().optional(),\n});\n\n/**\n * Structured route entry for manifest — name plus optional metadata.\n * Both plain strings and objects are accepted; strings are normalized\n * to `{ name }` objects via `normalizeManifestRoute()`.\n */\n/** Route names must be safe path segments — alphanumeric, hyphens, underscores, forward slashes */\nconst routeNamePattern = /^[a-zA-Z0-9][a-zA-Z0-9_\\-/]*$/;\n\nconst manifestRouteEntrySchema = z.object({\n\tname: z.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\tpublic: z.boolean().optional(),\n\tpermission: z\n\t\t.string()\n\t\t.refine((permission) => permission in Permissions)\n\t\t.optional(),\n\tcacheControl: z.string().min(1).optional(),\n});\n\nconst pluginJsonSchema = z.record(z.string(), z.unknown());\nconst mcpToolNamePattern = /^[a-zA-Z0-9_-]+$/;\nconst pluginMcpConfigSchema = z.object({\n\ttools: z.array(\n\t\tz.object({\n\t\t\tname: z.string().min(1).max(64).regex(mcpToolNamePattern, \"Invalid MCP tool name\"),\n\t\t\tdescription: z.string().min(1),\n\t\t\troute: z.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\t\t\tpermission: z.string().refine((permission) => permission in Permissions),\n\t\t\tdestructive: z.boolean(),\n\t\t\tinputSchema: pluginJsonSchema,\n\t\t\toutputSchema: pluginJsonSchema.optional(),\n\t\t}),\n\t),\n});\n\n// ── Sub-schemas ─────────────────────────────────────────────────\n\n/** Index field names must be valid identifiers to prevent SQL injection via JSON path expressions */\nconst indexFieldName = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/);\n\nconst storageCollectionSchema = z.object({\n\tindexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])),\n\tuniqueIndexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])).optional(),\n});\n\nconst baseSettingFields = {\n\tlabel: z.string(),\n\tdescription: z.string().optional(),\n};\n\nconst settingFieldSchema = z.discriminatedUnion(\"type\", [\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"string\"),\n\t\tdefault: z.string().optional(),\n\t\tmultiline: z.boolean().optional(),\n\t}),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"number\"),\n\t\tdefault: z.number().optional(),\n\t\tmin: z.number().optional(),\n\t\tmax: z.number().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"boolean\"), default: z.boolean().optional() }),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"select\"),\n\t\toptions: z.array(z.object({ value: z.string(), label: z.string() })),\n\t\tdefault: z.string().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"secret\") }),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"url\"),\n\t\tdefault: z.string().optional(),\n\t\tplaceholder: z.string().optional(),\n\t}),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"email\"),\n\t\tdefault: z.string().optional(),\n\t\tplaceholder: z.string().optional(),\n\t}),\n]);\n\nconst adminPageSchema = z.object({\n\tpath: z.string(),\n\tlabel: z.string(),\n\ticon: z.string().optional(),\n});\n\nconst dashboardWidgetSchema = z.object({\n\tid: z.string(),\n\tsize: z.enum([\"full\", \"half\", \"third\"]).optional(),\n\ttitle: z.string().optional(),\n});\n\nconst pluginAdminConfigSchema = z.object({\n\tentry: z.string().optional(),\n\tsettingsSchema: z.record(z.string(), settingFieldSchema).optional(),\n\tpages: z.array(adminPageSchema).optional(),\n\twidgets: z.array(dashboardWidgetSchema).optional(),\n\tfieldWidgets: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string().min(1),\n\t\t\t\tlabel: z.string().min(1),\n\t\t\t\tfieldTypes: z.array(z.enum(FIELD_TYPES)),\n\t\t\t\telements: z\n\t\t\t\t\t.array(\n\t\t\t\t\t\tz\n\t\t\t\t\t\t\t.object({\n\t\t\t\t\t\t\t\ttype: z.string(),\n\t\t\t\t\t\t\t\taction_id: z.string(),\n\t\t\t\t\t\t\t\tlabel: z.string().optional(),\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.passthrough(),\n\t\t\t\t\t)\n\t\t\t\t\t.optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\n// ── declaredAccess ──────────────────────────────────────────────\n\n/**\n * An operation's constraint object. Open vocabulary: keys the runtime\n * recognises are enforced, others are advisory. The bundler emits `{}` for a\n * granted operation; presence (not value) signals the grant.\n */\nconst accessConstraints = z.record(z.string(), z.unknown());\n\n/**\n * Structured trust contract embedded in the bundle manifest. Mirrors\n * `DeclaredAccess` in `@emdash-cms/plugin-types`. Categories are host\n * subsystems; operations are modes of participation.\n */\nconst declaredAccessSchema = z.object({\n\tcontent: z\n\t\t.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })\n\t\t.optional(),\n\ttaxonomies: z.object({ read: accessConstraints.optional() }).optional(),\n\tmedia: z\n\t\t.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })\n\t\t.optional(),\n\tnetwork: z\n\t\t.object({\n\t\t\t// allowedHosts: absent = unrestricted; present = host-restricted. Reject\n\t\t\t// an empty array (which the decoder would otherwise have to treat as\n\t\t\t// deny-all) to match the record lexicon's `minLength: 1` and keep the\n\t\t\t// \"absent vs empty\" distinction from ever reaching enforcement ambiguous.\n\t\t\trequest: z.object({ allowedHosts: z.array(z.string()).min(1).optional() }).optional(),\n\t\t})\n\t\t.optional(),\n\temail: z\n\t\t.object({\n\t\t\tsend: accessConstraints.optional(),\n\t\t\tevents: accessConstraints.optional(),\n\t\t\ttransport: accessConstraints.optional(),\n\t\t})\n\t\t.optional(),\n\tpage: z.object({ fragments: accessConstraints.optional() }).optional(),\n\tusers: z.object({ read: accessConstraints.optional() }).optional(),\n});\n\n// ── Main schema ─────────────────────────────────────────────────\n\n/**\n * Zod schema matching the PluginManifest interface from types.ts.\n *\n * Every JSON.parse of a manifest.json should validate through this.\n *\n * `declaredAccess` is the trust contract; `capabilities`/`allowedHosts` are the\n * runtime's enforcement currency. Apply `reconcileManifestAccess` after parsing\n * to make them consistent (declaredAccess authoritative when present). Kept a\n * plain object (no `.transform`) because callers `.pick()`/`.extend()` it.\n */\nexport const pluginManifestSchema = z.object({\n\tid: z.string().min(1),\n\tversion: z.string().min(1),\n\tdeclaredAccess: declaredAccessSchema.optional(),\n\tcapabilities: z.array(z.enum(PLUGIN_CAPABILITIES)),\n\tallowedHosts: z.array(z.string()),\n\tstorage: z.record(z.string(), storageCollectionSchema),\n\t/**\n\t * Hook declarations — accepts both plain name strings (legacy) and\n\t * structured objects with exclusive/priority/timeout metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\thooks: z.array(z.union([z.enum(HOOK_NAMES), manifestHookEntrySchema])),\n\t/**\n\t * Route declarations — accepts both plain name strings and\n\t * structured objects with public metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\troutes: z.array(\n\t\tz.union([\n\t\t\tz.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\t\t\tmanifestRouteEntrySchema,\n\t\t]),\n\t),\n\tmcp: pluginMcpConfigSchema.optional(),\n\tadmin: pluginAdminConfigSchema,\n});\n\nexport type ValidatedPluginManifest = z.infer<typeof pluginManifestSchema>;\n\n/**\n * Reconcile a parsed manifest's trust contract with its enforcement currency.\n * `declaredAccess` is authoritative: when present, `capabilities`/`allowedHosts`\n * are re-derived from it so what the runtime enforces always matches what was\n * recorded and consented to. A pre-migration bundle without `declaredAccess`\n * has it derived from the legacy capability list instead. The result always\n * carries both, mutually consistent. Apply this at every bundle-parse site.\n */\nexport function reconcileManifestAccess(manifest: ValidatedPluginManifest): PluginManifest {\n\tconst reconciled: ValidatedPluginManifest = manifest.declaredAccess\n\t\t? { ...manifest, ...declaredAccessToCapabilities(manifest.declaredAccess) }\n\t\t: {\n\t\t\t\t...manifest,\n\t\t\t\tdeclaredAccess: capabilitiesToDeclaredAccess(manifest.capabilities, manifest.allowedHosts),\n\t\t\t};\n\t// Block Kit admin elements are typed as `unknown` by the Zod schema (their\n\t// Element shape is validated at render time), so the validated manifest\n\t// needs a structural cast up to the runtime PluginManifest.\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- admin elements are unknown[] in Zod; Element type checked at render time\n\treturn reconciled as unknown as PluginManifest;\n}\n\n/**\n * Normalize a manifest hook entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestHook(\n\tentry: string | { name: string; exclusive?: boolean; priority?: number; timeout?: number },\n): { name: string; exclusive?: boolean; priority?: number; timeout?: number } {\n\tif (typeof entry === \"string\") {\n\t\treturn { name: entry };\n\t}\n\treturn entry;\n}\n\n/**\n * Normalize a manifest route entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestRoute(\n\tentry: string | { name: string; public?: boolean; permission?: string; cacheControl?: string },\n): {\n\tname: string;\n\tpublic?: boolean;\n\tpermission?: string;\n\tcacheControl?: string;\n} {\n\tif (typeof entry === \"string\") {\n\t\treturn { name: entry };\n\t}\n\treturn entry;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyBA,MAAa,8BAA8B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;AAQD,MAAa,iCAAiC;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;AASD,MAAa,sBAAsB,CAClC,GAAG,6BACH,GAAG,+BACH;;AAGD,MAAM,cAAc;CACnB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAa,aAAa;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;AAMD,MAAM,0BAA0B,EAAE,OAAO;CACxC,MAAM,EAAE,KAAK,WAAW;CACxB,WAAW,EAAE,SAAS,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACrC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;CAC/C,CAAC;;;;;;;AAQF,MAAM,mBAAmB;AAEzB,MAAM,2BAA2B,EAAE,OAAO;CACzC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC;CACzF,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,YAAY,EACV,QAAQ,CACR,QAAQ,eAAe,cAAc,YAAY,CACjD,UAAU;CACZ,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CAC1C,CAAC;AAEF,MAAM,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;AAE1D,MAAM,wBAAwB,EAAE,OAAO,EACtC,OAAO,EAAE,MACR,EAAE,OAAO;CACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAJR,oBAIkC,wBAAwB;CAClF,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC9B,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC;CAC1F,YAAY,EAAE,QAAQ,CAAC,QAAQ,eAAe,cAAc,YAAY;CACxE,aAAa,EAAE,SAAS;CACxB,aAAa;CACb,cAAc,iBAAiB,UAAU;CACzC,CAAC,CACF,EACD,CAAC;;AAKF,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,0BAA0B;AAElE,MAAM,0BAA0B,EAAE,OAAO;CACxC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC;CACpE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU;CACrF,CAAC;AAEF,MAAM,oBAAoB;CACzB,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACvD,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,WAAW,EAAE,SAAS,CAAC,UAAU;EACjC,CAAC;CACF,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,UAAU;EAAE,SAAS,EAAE,SAAS,CAAC,UAAU;EAAE,CAAC;CAC/F,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,MAAM,EAAE,OAAO;GAAE,OAAO,EAAE,QAAQ;GAAE,OAAO,EAAE,QAAQ;GAAE,CAAC,CAAC;EACpE,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,SAAS;EAAE,CAAC;CAC7D,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,MAAM;EACtB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;CACF,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;CACF,CAAC;AAEF,MAAM,kBAAkB,EAAE,OAAO;CAChC,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC;AAEF,MAAM,wBAAwB,EAAE,OAAO;CACtC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAQ;EAAQ,CAAC,CAAC,UAAU;CAClD,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAM,0BAA0B,EAAE,OAAO;CACxC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,UAAU;CACnE,OAAO,EAAE,MAAM,gBAAgB,CAAC,UAAU;CAC1C,SAAS,EAAE,MAAM,sBAAsB,CAAC,UAAU;CAClD,cAAc,EACZ,MACA,EAAE,OAAO;EACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;EACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;EACxB,YAAY,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC;EACxC,UAAU,EACR,MACA,EACE,OAAO;GACP,MAAM,EAAE,QAAQ;GAChB,WAAW,EAAE,QAAQ;GACrB,OAAO,EAAE,QAAQ,CAAC,UAAU;GAC5B,CAAC,CACD,aAAa,CACf,CACA,UAAU;EACZ,CAAC,CACF,CACA,UAAU;CACZ,CAAC;;;;;;AASF,MAAM,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;;;;;;AAO3D,MAAM,uBAAuB,EAAE,OAAO;CACrC,SAAS,EACP,OAAO;EAAE,MAAM,kBAAkB,UAAU;EAAE,OAAO,kBAAkB,UAAU;EAAE,CAAC,CACnF,UAAU;CACZ,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CACvE,OAAO,EACL,OAAO;EAAE,MAAM,kBAAkB,UAAU;EAAE,OAAO,kBAAkB,UAAU;EAAE,CAAC,CACnF,UAAU;CACZ,SAAS,EACP,OAAO,EAKP,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EACrF,CAAC,CACD,UAAU;CACZ,OAAO,EACL,OAAO;EACP,MAAM,kBAAkB,UAAU;EAClC,QAAQ,kBAAkB,UAAU;EACpC,WAAW,kBAAkB,UAAU;EACvC,CAAC,CACD,UAAU;CACZ,MAAM,EAAE,OAAO,EAAE,WAAW,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CACtE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CAClE,CAAC;;;;;;;;;;;AAcF,MAAa,uBAAuB,EAAE,OAAO;CAC5C,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;CACrB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,gBAAgB,qBAAqB,UAAU;CAC/C,cAAc,EAAE,MAAM,EAAE,KAAK,oBAAoB,CAAC;CAClD,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC;CACjC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB;CAMtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,WAAW,EAAE,wBAAwB,CAAC,CAAC;CAMtE,QAAQ,EAAE,MACT,EAAE,MAAM,CACP,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC,EACnF,yBACA,CAAC,CACF;CACD,KAAK,sBAAsB,UAAU;CACrC,OAAO;CACP,CAAC;;;;;;;;;AAYF,SAAgB,wBAAwB,UAAmD;AAW1F,QAV4C,SAAS,iBAClD;EAAE,GAAG;EAAU,GAAG,6BAA6B,SAAS,eAAe;EAAE,GACzE;EACA,GAAG;EACH,gBAAgB,6BAA6B,SAAS,cAAc,SAAS,aAAa;EAC1F;;;;;AAuBJ,SAAgB,uBACf,OAMC;AACD,KAAI,OAAO,UAAU,SACpB,QAAO,EAAE,MAAM,OAAO;AAEvB,QAAO"}
+{"version":3,"file":"manifest-schema-BXbUAHod.mjs","names":[],"sources":["../src/plugins/manifest-schema.ts"],"sourcesContent":["/**\n * Zod schema for PluginManifest validation\n *\n * Used to validate manifest.json from plugin bundles at every parse site:\n * - Client-side download (marketplace.ts extractBundle)\n * - R2 load (api/handlers/marketplace.ts loadBundleFromR2)\n * - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)\n * - Marketplace ingest extends this with publishing-specific fields\n */\n\nimport { Permissions } from \"@emdash-cms/auth\";\nimport {\n\tcapabilitiesToDeclaredAccess,\n\tdeclaredAccessToCapabilities,\n} from \"@emdash-cms/plugin-types\";\nimport { z } from \"zod\";\n\nimport type { PluginManifest } from \"./types.js\";\n\n// ── Enum values (must stay in sync with types.ts) ───────────────\n\n/**\n * Current capability names — the ones authors should use going forward.\n * See `PluginCapability` in `types.ts` for documentation of each.\n */\nexport const CURRENT_PLUGIN_CAPABILITIES = [\n\t\"network:request\",\n\t\"network:request:unrestricted\",\n\t\"content:read\",\n\t\"content:write\",\n\t\"taxonomies:read\",\n\t\"media:read\",\n\t\"media:write\",\n\t\"users:read\",\n\t\"email:send\",\n\t\"hooks.email-transport:register\",\n\t\"hooks.email-events:register\",\n\t\"hooks.page-fragments:register\",\n] as const;\n\n/**\n * Legacy capability names accepted during the deprecation window.\n * Normalized to current names via `normalizeCapability()` in types.ts\n * before reaching the runtime. Plugin authors are warned at bundle/validate\n * and hard-failed at publish.\n */\nexport const DEPRECATED_PLUGIN_CAPABILITIES = [\n\t\"network:fetch\",\n\t\"network:fetch:any\",\n\t\"read:content\",\n\t\"write:content\",\n\t\"read:media\",\n\t\"write:media\",\n\t\"read:users\",\n\t\"email:provide\",\n\t\"email:intercept\",\n\t\"page:inject\",\n] as const;\n\n/**\n * Full set of accepted capability strings — current + deprecated.\n *\n * The manifest schema accepts both during the transition. The runtime only\n * ever sees current names because `normalizeCapability()` rewrites legacy\n * names at every external boundary (definePlugin, adaptSandboxEntry).\n */\nexport const PLUGIN_CAPABILITIES = [\n\t...CURRENT_PLUGIN_CAPABILITIES,\n\t...DEPRECATED_PLUGIN_CAPABILITIES,\n] as const;\n\n/** Must stay in sync with FieldType in schema/types.ts */\nconst FIELD_TYPES = [\n\t\"string\",\n\t\"text\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"multiSelect\",\n\t\"portableText\",\n\t\"image\",\n\t\"file\",\n\t\"reference\",\n\t\"json\",\n\t\"slug\",\n\t\"repeater\",\n] as const;\n\nexport const HOOK_NAMES = [\n\t\"plugin:install\",\n\t\"plugin:activate\",\n\t\"plugin:deactivate\",\n\t\"plugin:uninstall\",\n\t\"content:beforeSave\",\n\t\"content:afterSave\",\n\t\"content:beforeDelete\",\n\t\"content:afterDelete\",\n\t\"content:afterPublish\",\n\t\"content:afterUnpublish\",\n\t\"content:afterRestore\",\n\t\"content:afterSchedule\",\n\t\"content:afterUnschedule\",\n\t\"media:beforeUpload\",\n\t\"media:afterUpload\",\n\t\"cron\",\n\t\"email:beforeSend\",\n\t\"email:deliver\",\n\t\"email:afterSend\",\n\t\"comment:beforeCreate\",\n\t\"comment:moderate\",\n\t\"comment:afterCreate\",\n\t\"comment:afterModerate\",\n\t\"page:metadata\",\n\t\"page:fragments\",\n] as const;\n\n/**\n * Structured hook entry for manifest — name plus optional metadata.\n * During a transition period, both plain strings and objects are accepted.\n */\nconst manifestHookEntrySchema = z.object({\n\tname: z.enum(HOOK_NAMES),\n\texclusive: z.boolean().optional(),\n\tpriority: z.number().int().optional(),\n\ttimeout: z.number().int().positive().optional(),\n});\n\n/**\n * Structured route entry for manifest — name plus optional metadata.\n * Both plain strings and objects are accepted; strings are normalized\n * to `{ name }` objects via `normalizeManifestRoute()`.\n */\n/** Route names must be safe path segments — alphanumeric, hyphens, underscores, forward slashes */\nconst routeNamePattern = /^[a-zA-Z0-9][a-zA-Z0-9_\\-/]*$/;\n\nconst manifestRouteEntrySchema = z.object({\n\tname: z.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\tpublic: z.boolean().optional(),\n\tpermission: z\n\t\t.string()\n\t\t.refine((permission) => permission in Permissions)\n\t\t.optional(),\n\tcacheControl: z.string().min(1).optional(),\n});\n\nconst pluginJsonSchema = z.record(z.string(), z.unknown());\nconst mcpToolNamePattern = /^[a-zA-Z0-9_-]+$/;\nconst pluginMcpConfigSchema = z.object({\n\ttools: z.array(\n\t\tz.object({\n\t\t\tname: z.string().min(1).max(64).regex(mcpToolNamePattern, \"Invalid MCP tool name\"),\n\t\t\tdescription: z.string().min(1),\n\t\t\troute: z.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\t\t\tpermission: z.string().refine((permission) => permission in Permissions),\n\t\t\tdestructive: z.boolean(),\n\t\t\tinputSchema: pluginJsonSchema,\n\t\t\toutputSchema: pluginJsonSchema.optional(),\n\t\t}),\n\t),\n});\n\n// ── Sub-schemas ─────────────────────────────────────────────────\n\n/** Index field names must be valid identifiers to prevent SQL injection via JSON path expressions */\nconst indexFieldName = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/);\n\nconst storageCollectionSchema = z.object({\n\tindexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])),\n\tuniqueIndexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])).optional(),\n});\n\nconst baseSettingFields = {\n\tlabel: z.string(),\n\tdescription: z.string().optional(),\n};\n\nconst settingFieldSchema = z.discriminatedUnion(\"type\", [\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"string\"),\n\t\tdefault: z.string().optional(),\n\t\tmultiline: z.boolean().optional(),\n\t}),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"number\"),\n\t\tdefault: z.number().optional(),\n\t\tmin: z.number().optional(),\n\t\tmax: z.number().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"boolean\"), default: z.boolean().optional() }),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"select\"),\n\t\toptions: z.array(z.object({ value: z.string(), label: z.string() })),\n\t\tdefault: z.string().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"secret\") }),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"url\"),\n\t\tdefault: z.string().optional(),\n\t\tplaceholder: z.string().optional(),\n\t}),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"email\"),\n\t\tdefault: z.string().optional(),\n\t\tplaceholder: z.string().optional(),\n\t}),\n]);\n\nconst adminPageSchema = z.object({\n\tpath: z.string(),\n\tlabel: z.string(),\n\ticon: z.string().optional(),\n});\n\nconst dashboardWidgetSchema = z.object({\n\tid: z.string(),\n\tsize: z.enum([\"full\", \"half\", \"third\"]).optional(),\n\ttitle: z.string().optional(),\n});\n\nconst pluginAdminConfigSchema = z.object({\n\tentry: z.string().optional(),\n\tsettingsSchema: z.record(z.string(), settingFieldSchema).optional(),\n\tpages: z.array(adminPageSchema).optional(),\n\twidgets: z.array(dashboardWidgetSchema).optional(),\n\tfieldWidgets: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string().min(1),\n\t\t\t\tlabel: z.string().min(1),\n\t\t\t\tfieldTypes: z.array(z.enum(FIELD_TYPES)),\n\t\t\t\telements: z\n\t\t\t\t\t.array(\n\t\t\t\t\t\tz\n\t\t\t\t\t\t\t.object({\n\t\t\t\t\t\t\t\ttype: z.string(),\n\t\t\t\t\t\t\t\taction_id: z.string(),\n\t\t\t\t\t\t\t\tlabel: z.string().optional(),\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.passthrough(),\n\t\t\t\t\t)\n\t\t\t\t\t.optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\n// ── declaredAccess ──────────────────────────────────────────────\n\n/**\n * An operation's constraint object. Open vocabulary: keys the runtime\n * recognises are enforced, others are advisory. The bundler emits `{}` for a\n * granted operation; presence (not value) signals the grant.\n */\nconst accessConstraints = z.record(z.string(), z.unknown());\n\n/**\n * Structured trust contract embedded in the bundle manifest. Mirrors\n * `DeclaredAccess` in `@emdash-cms/plugin-types`. Categories are host\n * subsystems; operations are modes of participation.\n */\nconst declaredAccessSchema = z.object({\n\tcontent: z\n\t\t.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })\n\t\t.optional(),\n\ttaxonomies: z.object({ read: accessConstraints.optional() }).optional(),\n\tmedia: z\n\t\t.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })\n\t\t.optional(),\n\tnetwork: z\n\t\t.object({\n\t\t\t// allowedHosts: absent = unrestricted; present = host-restricted. Reject\n\t\t\t// an empty array (which the decoder would otherwise have to treat as\n\t\t\t// deny-all) to match the record lexicon's `minLength: 1` and keep the\n\t\t\t// \"absent vs empty\" distinction from ever reaching enforcement ambiguous.\n\t\t\trequest: z.object({ allowedHosts: z.array(z.string()).min(1).optional() }).optional(),\n\t\t})\n\t\t.optional(),\n\temail: z\n\t\t.object({\n\t\t\tsend: accessConstraints.optional(),\n\t\t\tevents: accessConstraints.optional(),\n\t\t\ttransport: accessConstraints.optional(),\n\t\t})\n\t\t.optional(),\n\tpage: z.object({ fragments: accessConstraints.optional() }).optional(),\n\tusers: z.object({ read: accessConstraints.optional() }).optional(),\n});\n\n// ── Main schema ─────────────────────────────────────────────────\n\n/**\n * Zod schema matching the PluginManifest interface from types.ts.\n *\n * Every JSON.parse of a manifest.json should validate through this.\n *\n * `declaredAccess` is the trust contract; `capabilities`/`allowedHosts` are the\n * runtime's enforcement currency. Apply `reconcileManifestAccess` after parsing\n * to make them consistent (declaredAccess authoritative when present). Kept a\n * plain object (no `.transform`) because callers `.pick()`/`.extend()` it.\n */\nexport const pluginManifestSchema = z.object({\n\tid: z.string().min(1),\n\tversion: z.string().min(1),\n\tdeclaredAccess: declaredAccessSchema.optional(),\n\tcapabilities: z.array(z.enum(PLUGIN_CAPABILITIES)),\n\tallowedHosts: z.array(z.string()),\n\tstorage: z.record(z.string(), storageCollectionSchema),\n\t/**\n\t * Hook declarations — accepts both plain name strings (legacy) and\n\t * structured objects with exclusive/priority/timeout metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\thooks: z.array(z.union([z.enum(HOOK_NAMES), manifestHookEntrySchema])),\n\t/**\n\t * Route declarations — accepts both plain name strings and\n\t * structured objects with public metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\troutes: z.array(\n\t\tz.union([\n\t\t\tz.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\t\t\tmanifestRouteEntrySchema,\n\t\t]),\n\t),\n\tmcp: pluginMcpConfigSchema.optional(),\n\tadmin: pluginAdminConfigSchema,\n});\n\nexport type ValidatedPluginManifest = z.infer<typeof pluginManifestSchema>;\n\n/**\n * Reconcile a parsed manifest's trust contract with its enforcement currency.\n * `declaredAccess` is authoritative: when present, `capabilities`/`allowedHosts`\n * are re-derived from it so what the runtime enforces always matches what was\n * recorded and consented to. A pre-migration bundle without `declaredAccess`\n * has it derived from the legacy capability list instead. The result always\n * carries both, mutually consistent. Apply this at every bundle-parse site.\n */\nexport function reconcileManifestAccess(manifest: ValidatedPluginManifest): PluginManifest {\n\tconst reconciled: ValidatedPluginManifest = manifest.declaredAccess\n\t\t? { ...manifest, ...declaredAccessToCapabilities(manifest.declaredAccess) }\n\t\t: {\n\t\t\t\t...manifest,\n\t\t\t\tdeclaredAccess: capabilitiesToDeclaredAccess(manifest.capabilities, manifest.allowedHosts),\n\t\t\t};\n\t// Block Kit admin elements are typed as `unknown` by the Zod schema (their\n\t// Element shape is validated at render time), so the validated manifest\n\t// needs a structural cast up to the runtime PluginManifest.\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- admin elements are unknown[] in Zod; Element type checked at render time\n\treturn reconciled as unknown as PluginManifest;\n}\n\n/**\n * Normalize a manifest hook entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestHook(\n\tentry: string | { name: string; exclusive?: boolean; priority?: number; timeout?: number },\n): { name: string; exclusive?: boolean; priority?: number; timeout?: number } {\n\tif (typeof entry === \"string\") {\n\t\treturn { name: entry };\n\t}\n\treturn entry;\n}\n\n/**\n * Normalize a manifest route entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestRoute(\n\tentry: string | { name: string; public?: boolean; permission?: string; cacheControl?: string },\n): {\n\tname: string;\n\tpublic?: boolean;\n\tpermission?: string;\n\tcacheControl?: string;\n} {\n\tif (typeof entry === \"string\") {\n\t\treturn { name: entry };\n\t}\n\treturn entry;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAyBA,MAAa,8BAA8B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;AAQD,MAAa,iCAAiC;CAC7C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;;;AASD,MAAa,sBAAsB,CAClC,GAAG,6BACH,GAAG,+BACH;;AAGD,MAAM,cAAc;CACnB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAa,aAAa;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;AAMD,MAAM,0BAA0B,EAAE,OAAO;CACxC,MAAM,EAAE,KAAK,WAAW;CACxB,WAAW,EAAE,SAAS,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACrC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;CAC/C,CAAC;;;;;;;AAQF,MAAM,mBAAmB;AAEzB,MAAM,2BAA2B,EAAE,OAAO;CACzC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC;CACzF,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,YAAY,EACV,QAAQ,CACR,QAAQ,eAAe,cAAc,YAAY,CACjD,UAAU;CACZ,cAAc,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CAC1C,CAAC;AAEF,MAAM,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;AAE1D,MAAM,wBAAwB,EAAE,OAAO,EACtC,OAAO,EAAE,MACR,EAAE,OAAO;CACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,MAJR,oBAIkC,wBAAwB;CAClF,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC9B,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC;CAC1F,YAAY,EAAE,QAAQ,CAAC,QAAQ,eAAe,cAAc,YAAY;CACxE,aAAa,EAAE,SAAS;CACxB,aAAa;CACb,cAAc,iBAAiB,UAAU;CACzC,CAAC,CACF,EACD,CAAC;;AAKF,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,0BAA0B;AAElE,MAAM,0BAA0B,EAAE,OAAO;CACxC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC;CACpE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU;CACrF,CAAC;AAEF,MAAM,oBAAoB;CACzB,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACvD,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,WAAW,EAAE,SAAS,CAAC,UAAU;EACjC,CAAC;CACF,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,UAAU;EAAE,SAAS,EAAE,SAAS,CAAC,UAAU;EAAE,CAAC;CAC/F,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,MAAM,EAAE,OAAO;GAAE,OAAO,EAAE,QAAQ;GAAE,OAAO,EAAE,QAAQ;GAAE,CAAC,CAAC;EACpE,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,SAAS;EAAE,CAAC;CAC7D,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,MAAM;EACtB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;CACF,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,QAAQ;EACxB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,aAAa,EAAE,QAAQ,CAAC,UAAU;EAClC,CAAC;CACF,CAAC;AAEF,MAAM,kBAAkB,EAAE,OAAO;CAChC,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC;AAEF,MAAM,wBAAwB,EAAE,OAAO;CACtC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAQ;EAAQ,CAAC,CAAC,UAAU;CAClD,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAM,0BAA0B,EAAE,OAAO;CACxC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,UAAU;CACnE,OAAO,EAAE,MAAM,gBAAgB,CAAC,UAAU;CAC1C,SAAS,EAAE,MAAM,sBAAsB,CAAC,UAAU;CAClD,cAAc,EACZ,MACA,EAAE,OAAO;EACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;EACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;EACxB,YAAY,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC;EACxC,UAAU,EACR,MACA,EACE,OAAO;GACP,MAAM,EAAE,QAAQ;GAChB,WAAW,EAAE,QAAQ;GACrB,OAAO,EAAE,QAAQ,CAAC,UAAU;GAC5B,CAAC,CACD,aAAa,CACf,CACA,UAAU;EACZ,CAAC,CACF,CACA,UAAU;CACZ,CAAC;;;;;;AASF,MAAM,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC;;;;;;AAO3D,MAAM,uBAAuB,EAAE,OAAO;CACrC,SAAS,EACP,OAAO;EAAE,MAAM,kBAAkB,UAAU;EAAE,OAAO,kBAAkB,UAAU;EAAE,CAAC,CACnF,UAAU;CACZ,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CACvE,OAAO,EACL,OAAO;EAAE,MAAM,kBAAkB,UAAU;EAAE,OAAO,kBAAkB,UAAU;EAAE,CAAC,CACnF,UAAU;CACZ,SAAS,EACP,OAAO,EAKP,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EACrF,CAAC,CACD,UAAU;CACZ,OAAO,EACL,OAAO;EACP,MAAM,kBAAkB,UAAU;EAClC,QAAQ,kBAAkB,UAAU;EACpC,WAAW,kBAAkB,UAAU;EACvC,CAAC,CACD,UAAU;CACZ,MAAM,EAAE,OAAO,EAAE,WAAW,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CACtE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,UAAU,EAAE,CAAC,CAAC,UAAU;CAClE,CAAC;;;;;;;;;;;AAcF,MAAa,uBAAuB,EAAE,OAAO;CAC5C,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;CACrB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,gBAAgB,qBAAqB,UAAU;CAC/C,cAAc,EAAE,MAAM,EAAE,KAAK,oBAAoB,CAAC;CAClD,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC;CACjC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB;CAMtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,WAAW,EAAE,wBAAwB,CAAC,CAAC;CAMtE,QAAQ,EAAE,MACT,EAAE,MAAM,CACP,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC,EACnF,yBACA,CAAC,CACF;CACD,KAAK,sBAAsB,UAAU;CACrC,OAAO;CACP,CAAC;;;;;;;;;AAYF,SAAgB,wBAAwB,UAAmD;AAW1F,QAV4C,SAAS,iBAClD;EAAE,GAAG;EAAU,GAAG,6BAA6B,SAAS,eAAe;EAAE,GACzE;EACA,GAAG;EACH,gBAAgB,6BAA6B,SAAS,cAAc,SAAS,aAAa;EAC1F;;;;;AAuBJ,SAAgB,uBACf,OAMC;AACD,KAAI,OAAO,UAAU,SACpB,QAAO,EAAE,MAAM,OAAO;AAEvB,QAAO"}

package/dist/media/image-endpoint.mjs

@@ -1,4 +1,4 @@
-import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-C-SHXmra.mjs";
+import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-Bc-s_r-a.mjs";
 
 //#region src/media/image-endpoint.ts
 /**

package/dist/media/index.d.mts

@@ -1,4 +1,4 @@
-import { _ as MediaValue, a as ComponentEmbed, b as mediaItemToValue, c as EmbedResult, d as MediaListResult, f as MediaProvider, g as MediaUploadInput, h as MediaProviderItem, i as AudioEmbed, l as ImageEmbed, m as MediaProviderDescriptor, n as generatePlaceholder, o as CreateMediaProviderFn, p as MediaProviderCapabilities, r as normalizeMediaValue, s as EmbedOptions, t as PlaceholderData, u as MediaListOptions, v as ThumbnailOptions, y as VideoEmbed } from "../placeholder-DaeNS-VG.mjs";
+import { _ as MediaValue, a as ComponentEmbed, b as mediaItemToValue, c as EmbedResult, d as MediaListResult, f as MediaProvider, g as MediaUploadInput, h as MediaProviderItem, i as AudioEmbed, l as ImageEmbed, m as MediaProviderDescriptor, n as generatePlaceholder, o as CreateMediaProviderFn, p as MediaProviderCapabilities, r as normalizeMediaValue, s as EmbedOptions, t as PlaceholderData, u as MediaListOptions, v as ThumbnailOptions, y as VideoEmbed } from "../placeholder-Dp0K3RkD.mjs";
 
 //#region src/media/enrich.d.ts
 /**

package/dist/media/index.mjs

@@ -1,5 +1,6 @@
-import { n as normalizeMediaValue } from "../normalize-C-SHXmra.mjs";
-import { n as generatePlaceholder, t as enrichImageMetadata } from "../enrich-CFJJgxs_.mjs";
+import { n as normalizeMediaValue } from "../normalize-Bc-s_r-a.mjs";
+import "../dist-D_6CKR8z.mjs";
+import { n as generatePlaceholder, t as enrichImageMetadata } from "../enrich-_ySMEvEE.mjs";
 
 //#region src/media/types.ts
 /**

package/dist/media/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/media/types.ts","../../src/media/local.ts"],"sourcesContent":["/**\n * Media Provider Types\n *\n * Media providers are pluggable sources for browsing, uploading, and embedding media.\n * They enable integration with external services (Unsplash, Cloudinary, Mux, etc.)\n * alongside the built-in local media library.\n */\n\n/**\n * Serializable media provider configuration descriptor\n * Returned by provider config functions (e.g., unsplash(), mux())\n */\nexport interface MediaProviderDescriptor<TConfig = Record<string, unknown>> {\n\t/** Unique identifier, used in MediaValue.provider */\n\tid: string;\n\n\t/** Display name for admin UI */\n\tname: string;\n\n\t/** Icon for tab UI (emoji or URL) */\n\ticon?: string;\n\n\t/** Module path exporting createMediaProvider function */\n\tentrypoint: string;\n\n\t/** Optional React component module for custom admin UI */\n\tadminModule?: string;\n\n\t/** Capability flags determine UI behavior */\n\tcapabilities: MediaProviderCapabilities;\n\n\t/** Serializable config passed to createMediaProvider at runtime */\n\tconfig: TConfig;\n}\n\n/**\n * Provider capabilities determine what UI elements to show\n */\nexport interface MediaProviderCapabilities {\n\t/** Can list/browse media */\n\tbrowse: boolean;\n\t/** Supports text search */\n\tsearch: boolean;\n\t/** Can upload new media */\n\tupload: boolean;\n\t/** Can delete media */\n\tdelete: boolean;\n}\n\n/**\n * Options for listing media\n */\nexport interface MediaListOptions {\n\t/** Pagination cursor */\n\tcursor?: string;\n\t/** Max items to return (default 20) */\n\tlimit?: number;\n\t/** Search query (if capabilities.search is true) */\n\tquery?: string;\n\t/** Filter by MIME type prefix, e.g., \"image/\", \"video/\" */\n\tmimeType?: string;\n}\n\n/**\n * Result from listing media\n */\nexport interface MediaListResult {\n\titems: MediaProviderItem[];\n\tnextCursor?: string;\n}\n\n/**\n * A media item as returned by a provider\n * This is the provider's view of the item, before it's selected\n */\nexport interface MediaProviderItem {\n\t/** Provider-specific ID */\n\tid: string;\n\t/** Original filename */\n\tfilename: string;\n\t/** MIME type */\n\tmimeType: string;\n\t/** File size in bytes (if known) */\n\tsize?: number;\n\t/** Dimensions (for images/video) */\n\twidth?: number;\n\theight?: number;\n\t/** LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\t/** Accessibility text */\n\talt?: string;\n\t/** Preview URL for admin UI thumbnail */\n\tpreviewUrl?: string;\n\t/** Provider-specific metadata */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Input for uploading media\n */\nexport interface MediaUploadInput {\n\tfile: File;\n\tfilename: string;\n\talt?: string;\n}\n\n/**\n * Options for generating embed\n */\nexport interface EmbedOptions {\n\t/** Desired width (provider may use for optimization) */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n\t/** Image format preference */\n\tformat?: \"webp\" | \"avif\" | \"jpeg\" | \"png\" | \"auto\";\n}\n\n/**\n * Embed result types\n */\nexport type EmbedResult = ImageEmbed | VideoEmbed | AudioEmbed | ComponentEmbed;\n\nexport interface ImageEmbed {\n\ttype: \"image\";\n\tsrc: string;\n\tsrcset?: string;\n\tsizes?: string;\n\twidth?: number;\n\theight?: number;\n\t/** LQIP blurhash placeholder for rendering before the image loads */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color */\n\tdominantColor?: string;\n\talt?: string;\n\t/** Base URL without transforms, for responsive image generation */\n\tcdnBaseUrl?: string;\n\t/** For providers with URL-based transforms (Cloudinary, imgix) */\n\tgetSrc?: (opts: { width?: number; height?: number; format?: string }) => string;\n}\n\nexport interface VideoEmbed {\n\ttype: \"video\";\n\t/** Single source URL */\n\tsrc?: string;\n\t/** Multiple sources for format fallback */\n\tsources?: Array<{ src: string; type: string }>;\n\t/** Poster/thumbnail image */\n\tposter?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Player controls */\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tplaysinline?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n\tcrossorigin?: \"anonymous\" | \"use-credentials\";\n}\n\nexport interface AudioEmbed {\n\ttype: \"audio\";\n\tsrc?: string;\n\tsources?: Array<{ src: string; type: string }>;\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n}\n\nexport interface ComponentEmbed {\n\ttype: \"component\";\n\t/** Package to import from, e.g., \"@mux/player-react\" */\n\tpackage: string;\n\t/** Named export (default export if not specified) */\n\texport?: string;\n\t/** Props to pass to the component */\n\tprops: Record<string, unknown>;\n}\n\n/**\n * Options for thumbnail generation\n */\nexport interface ThumbnailOptions {\n\t/** Desired width */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n}\n\n/**\n * Runtime media provider interface\n * Implemented by provider entrypoints\n */\nexport interface MediaProvider {\n\t/**\n\t * List/search media items\n\t */\n\tlist(options: MediaListOptions): Promise<MediaListResult>;\n\n\t/**\n\t * Get a single item by ID (optional, for refresh/validation)\n\t */\n\tget?(id: string): Promise<MediaProviderItem | null>;\n\n\t/**\n\t * Upload new media (if capabilities.upload is true)\n\t */\n\tupload?(input: MediaUploadInput): Promise<MediaProviderItem>;\n\n\t/**\n\t * Delete media (if capabilities.delete is true)\n\t */\n\tdelete?(id: string): Promise<void>;\n\n\t/**\n\t * Get embed information for rendering this media item\n\t * Called at runtime when rendering content\n\t */\n\tgetEmbed(value: MediaValue, options?: EmbedOptions): Promise<EmbedResult> | EmbedResult;\n\n\t/**\n\t * Get a thumbnail URL for admin display\n\t * For images: returns a resized image URL\n\t * For videos: returns a poster/thumbnail URL\n\t */\n\tgetThumbnailUrl?(id: string, mimeType?: string, options?: ThumbnailOptions): string;\n}\n\n/**\n * Function signature for provider entrypoint modules\n */\nexport type CreateMediaProviderFn<TConfig = Record<string, unknown>> = (\n\tconfig: TConfig,\n) => MediaProvider;\n\n/**\n * Media value stored in content fields\n * This is what gets persisted when media is selected\n *\n * For backwards compatibility:\n * - `provider` defaults to \"local\" if not specified\n * - `src` is supported for legacy data or external URLs\n */\nexport interface MediaValue {\n\t/** Provider ID, e.g., \"local\", \"unsplash\", \"mux\" (defaults to \"local\") */\n\tprovider?: string;\n\n\t/** Provider-specific item ID */\n\tid: string;\n\n\t/** Direct URL (for local media or legacy data) */\n\tsrc?: string;\n\n\t/** Preview URL for admin display (external providers) */\n\tpreviewUrl?: string;\n\n\t/** Cached metadata for display without runtime lookup */\n\tfilename?: string;\n\tmimeType?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Cached LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** Cached LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\talt?: string;\n\n\t/** Provider-specific data needed for embedding */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Convert a MediaProviderItem to a MediaValue for storage\n */\nexport function mediaItemToValue(providerId: string, item: MediaProviderItem): MediaValue {\n\treturn {\n\t\tprovider: providerId,\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tmeta: item.meta,\n\t};\n}\n","/**\n * Local Media Provider\n *\n * The built-in media provider that wraps the current storage adapter and media database.\n * This is the default provider and is available unless explicitly disabled.\n */\n\nimport type { MediaProviderDescriptor } from \"./types.js\";\n\nexport interface LocalMediaConfig {\n\t/** Whether the local provider is enabled (default true) */\n\tenabled?: boolean;\n}\n\n/**\n * Local media provider configuration\n *\n * @example\n * ```ts\n * import { localMedia } from \"emdash/media\";\n *\n * emdash({\n *   mediaProviders: [\n *     localMedia(), // Uses defaults\n *     // or: localMedia({ enabled: false }) to disable\n *   ],\n * })\n * ```\n */\nexport function localMedia(config: LocalMediaConfig = {}): MediaProviderDescriptor {\n\treturn {\n\t\tid: \"local\",\n\t\tname: \"Library\",\n\t\ticon: \"📁\",\n\t\tentrypoint: \"emdash/media/local-runtime\",\n\t\tcapabilities: {\n\t\t\tbrowse: true,\n\t\t\tsearch: false, // TODO: Add search support\n\t\t\tupload: true,\n\t\t\tdelete: true,\n\t\t},\n\t\tconfig: {\n\t\t\tenabled: config.enabled ?? true,\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;AAuRA,SAAgB,iBAAiB,YAAoB,MAAqC;AACzF,QAAO;EACN,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,MAAM,KAAK;EACX;;;;;;;;;;;;;;;;;;;;ACtQF,SAAgB,WAAW,SAA2B,EAAE,EAA2B;AAClF,QAAO;EACN,IAAI;EACJ,MAAM;EACN,MAAM;EACN,YAAY;EACZ,cAAc;GACb,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR;EACD,QAAQ,EACP,SAAS,OAAO,WAAW,MAC3B;EACD"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/media/types.ts","../../src/media/local.ts"],"sourcesContent":["/**\n * Media Provider Types\n *\n * Media providers are pluggable sources for browsing, uploading, and embedding media.\n * They enable integration with external services (Unsplash, Cloudinary, Mux, etc.)\n * alongside the built-in local media library.\n */\n\n/**\n * Serializable media provider configuration descriptor\n * Returned by provider config functions (e.g., unsplash(), mux())\n */\nexport interface MediaProviderDescriptor<TConfig = Record<string, unknown>> {\n\t/** Unique identifier, used in MediaValue.provider */\n\tid: string;\n\n\t/** Display name for admin UI */\n\tname: string;\n\n\t/** Icon for tab UI (emoji or URL) */\n\ticon?: string;\n\n\t/** Module path exporting createMediaProvider function */\n\tentrypoint: string;\n\n\t/** Optional React component module for custom admin UI */\n\tadminModule?: string;\n\n\t/** Capability flags determine UI behavior */\n\tcapabilities: MediaProviderCapabilities;\n\n\t/** Serializable config passed to createMediaProvider at runtime */\n\tconfig: TConfig;\n}\n\n/**\n * Provider capabilities determine what UI elements to show\n */\nexport interface MediaProviderCapabilities {\n\t/** Can list/browse media */\n\tbrowse: boolean;\n\t/** Supports text search */\n\tsearch: boolean;\n\t/** Can upload new media */\n\tupload: boolean;\n\t/** Can delete media */\n\tdelete: boolean;\n}\n\n/**\n * Options for listing media\n */\nexport interface MediaListOptions {\n\t/** Pagination cursor */\n\tcursor?: string;\n\t/** Max items to return (default 20) */\n\tlimit?: number;\n\t/** Search query (if capabilities.search is true) */\n\tquery?: string;\n\t/** Filter by MIME type prefix, e.g., \"image/\", \"video/\" */\n\tmimeType?: string;\n}\n\n/**\n * Result from listing media\n */\nexport interface MediaListResult {\n\titems: MediaProviderItem[];\n\tnextCursor?: string;\n}\n\n/**\n * A media item as returned by a provider\n * This is the provider's view of the item, before it's selected\n */\nexport interface MediaProviderItem {\n\t/** Provider-specific ID */\n\tid: string;\n\t/** Original filename */\n\tfilename: string;\n\t/** MIME type */\n\tmimeType: string;\n\t/** File size in bytes (if known) */\n\tsize?: number;\n\t/** Dimensions (for images/video) */\n\twidth?: number;\n\theight?: number;\n\t/** LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\t/** Accessibility text */\n\talt?: string;\n\t/** Preview URL for admin UI thumbnail */\n\tpreviewUrl?: string;\n\t/** Provider-specific metadata */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Input for uploading media\n */\nexport interface MediaUploadInput {\n\tfile: File;\n\tfilename: string;\n\talt?: string;\n}\n\n/**\n * Options for generating embed\n */\nexport interface EmbedOptions {\n\t/** Desired width (provider may use for optimization) */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n\t/** Image format preference */\n\tformat?: \"webp\" | \"avif\" | \"jpeg\" | \"png\" | \"auto\";\n}\n\n/**\n * Embed result types\n */\nexport type EmbedResult = ImageEmbed | VideoEmbed | AudioEmbed | ComponentEmbed;\n\nexport interface ImageEmbed {\n\ttype: \"image\";\n\tsrc: string;\n\tsrcset?: string;\n\tsizes?: string;\n\twidth?: number;\n\theight?: number;\n\t/** LQIP blurhash placeholder for rendering before the image loads */\n\tblurhash?: string;\n\t/** LQIP dominant-color placeholder, as a CSS color */\n\tdominantColor?: string;\n\talt?: string;\n\t/** Base URL without transforms, for responsive image generation */\n\tcdnBaseUrl?: string;\n\t/** For providers with URL-based transforms (Cloudinary, imgix) */\n\tgetSrc?: (opts: { width?: number; height?: number; format?: string }) => string;\n}\n\nexport interface VideoEmbed {\n\ttype: \"video\";\n\t/** Single source URL */\n\tsrc?: string;\n\t/** Multiple sources for format fallback */\n\tsources?: Array<{ src: string; type: string }>;\n\t/** Poster/thumbnail image */\n\tposter?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Player controls */\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tplaysinline?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n\tcrossorigin?: \"anonymous\" | \"use-credentials\";\n}\n\nexport interface AudioEmbed {\n\ttype: \"audio\";\n\tsrc?: string;\n\tsources?: Array<{ src: string; type: string }>;\n\tcontrols?: boolean;\n\tautoplay?: boolean;\n\tmuted?: boolean;\n\tloop?: boolean;\n\tpreload?: \"none\" | \"metadata\" | \"auto\";\n}\n\nexport interface ComponentEmbed {\n\ttype: \"component\";\n\t/** Package to import from, e.g., \"@mux/player-react\" */\n\tpackage: string;\n\t/** Named export (default export if not specified) */\n\texport?: string;\n\t/** Props to pass to the component */\n\tprops: Record<string, unknown>;\n}\n\n/**\n * Options for thumbnail generation\n */\nexport interface ThumbnailOptions {\n\t/** Desired width */\n\twidth?: number;\n\t/** Desired height */\n\theight?: number;\n}\n\n/**\n * Runtime media provider interface\n * Implemented by provider entrypoints\n */\nexport interface MediaProvider {\n\t/**\n\t * List/search media items\n\t */\n\tlist(options: MediaListOptions): Promise<MediaListResult>;\n\n\t/**\n\t * Get a single item by ID (optional, for refresh/validation)\n\t */\n\tget?(id: string): Promise<MediaProviderItem | null>;\n\n\t/**\n\t * Upload new media (if capabilities.upload is true)\n\t */\n\tupload?(input: MediaUploadInput): Promise<MediaProviderItem>;\n\n\t/**\n\t * Delete media (if capabilities.delete is true)\n\t */\n\tdelete?(id: string): Promise<void>;\n\n\t/**\n\t * Get embed information for rendering this media item\n\t * Called at runtime when rendering content\n\t */\n\tgetEmbed(value: MediaValue, options?: EmbedOptions): Promise<EmbedResult> | EmbedResult;\n\n\t/**\n\t * Get a thumbnail URL for admin display\n\t * For images: returns a resized image URL\n\t * For videos: returns a poster/thumbnail URL\n\t */\n\tgetThumbnailUrl?(id: string, mimeType?: string, options?: ThumbnailOptions): string;\n}\n\n/**\n * Function signature for provider entrypoint modules\n */\nexport type CreateMediaProviderFn<TConfig = Record<string, unknown>> = (\n\tconfig: TConfig,\n) => MediaProvider;\n\n/**\n * Media value stored in content fields\n * This is what gets persisted when media is selected\n *\n * For backwards compatibility:\n * - `provider` defaults to \"local\" if not specified\n * - `src` is supported for legacy data or external URLs\n */\nexport interface MediaValue {\n\t/** Provider ID, e.g., \"local\", \"unsplash\", \"mux\" (defaults to \"local\") */\n\tprovider?: string;\n\n\t/** Provider-specific item ID */\n\tid: string;\n\n\t/** Direct URL (for local media or legacy data) */\n\tsrc?: string;\n\n\t/** Preview URL for admin display (external providers) */\n\tpreviewUrl?: string;\n\n\t/** Cached metadata for display without runtime lookup */\n\tfilename?: string;\n\tmimeType?: string;\n\twidth?: number;\n\theight?: number;\n\t/** Cached LQIP blurhash placeholder (images only) */\n\tblurhash?: string;\n\t/** Cached LQIP dominant-color placeholder, as a CSS color (images only) */\n\tdominantColor?: string;\n\talt?: string;\n\n\t/** Provider-specific data needed for embedding */\n\tmeta?: Record<string, unknown>;\n}\n\n/**\n * Convert a MediaProviderItem to a MediaValue for storage\n */\nexport function mediaItemToValue(providerId: string, item: MediaProviderItem): MediaValue {\n\treturn {\n\t\tprovider: providerId,\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\twidth: item.width,\n\t\theight: item.height,\n\t\tblurhash: item.blurhash,\n\t\tdominantColor: item.dominantColor,\n\t\talt: item.alt,\n\t\tmeta: item.meta,\n\t};\n}\n","/**\n * Local Media Provider\n *\n * The built-in media provider that wraps the current storage adapter and media database.\n * This is the default provider and is available unless explicitly disabled.\n */\n\nimport type { MediaProviderDescriptor } from \"./types.js\";\n\nexport interface LocalMediaConfig {\n\t/** Whether the local provider is enabled (default true) */\n\tenabled?: boolean;\n}\n\n/**\n * Local media provider configuration\n *\n * @example\n * ```ts\n * import { localMedia } from \"emdash/media\";\n *\n * emdash({\n *   mediaProviders: [\n *     localMedia(), // Uses defaults\n *     // or: localMedia({ enabled: false }) to disable\n *   ],\n * })\n * ```\n */\nexport function localMedia(config: LocalMediaConfig = {}): MediaProviderDescriptor {\n\treturn {\n\t\tid: \"local\",\n\t\tname: \"Library\",\n\t\ticon: \"📁\",\n\t\tentrypoint: \"emdash/media/local-runtime\",\n\t\tcapabilities: {\n\t\t\tbrowse: true,\n\t\t\tsearch: false, // TODO: Add search support\n\t\t\tupload: true,\n\t\t\tdelete: true,\n\t\t},\n\t\tconfig: {\n\t\t\tenabled: config.enabled ?? true,\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;AAuRA,SAAgB,iBAAiB,YAAoB,MAAqC;AACzF,QAAO;EACN,UAAU;EACV,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,UAAU,KAAK;EACf,eAAe,KAAK;EACpB,KAAK,KAAK;EACV,MAAM,KAAK;EACX;;;;;;;;;;;;;;;;;;;;ACtQF,SAAgB,WAAW,SAA2B,EAAE,EAA2B;AAClF,QAAO;EACN,IAAI;EACJ,MAAM;EACN,MAAM;EACN,YAAY;EACZ,cAAc;GACb,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR;EACD,QAAQ,EACP,SAAS,OAAO,WAAW,MAC3B;EACD"}

package/dist/media/local-runtime.d.mts

@@ -1,15 +1,15 @@
-import "../options-CA4eVX6P.mjs";
-import { t as Database } from "../types-Dc4ntQjQ.mjs";
-import "../types-Cz8hNch2.mjs";
-import "../relations-G2ta7GIl.mjs";
-import { h as MediaProviderItem, o as CreateMediaProviderFn } from "../placeholder-DaeNS-VG.mjs";
-import "../index-M37iz29I.mjs";
-import "../runner-BaADli8l.mjs";
-import "../index-MGw47uWq.mjs";
-import { d as Storage } from "../types-DLG4IFEQ.mjs";
-import "../types-C8oz_ayJ.mjs";
-import "../hreflang-BaLCNcDx.mjs";
-import "../validate-C3oSmA7F.mjs";
+import "../options--hhz-jZ1.mjs";
+import { t as Database } from "../types-DQIDRKF2.mjs";
+import "../types-DrJrVCT1.mjs";
+import "../relations-BHo5A8Zf.mjs";
+import { h as MediaProviderItem, o as CreateMediaProviderFn } from "../placeholder-Dp0K3RkD.mjs";
+import "../index-BVBZj4-7.mjs";
+import "../runner-BYHZn3Jy.mjs";
+import "../index-C9KuQyO-.mjs";
+import { d as Storage } from "../types-BcqdcT-r.mjs";
+import "../types-CXnOzDe1.mjs";
+import "../hreflang-DwT2E0Sa.mjs";
+import "../validate-CTqt5nuE.mjs";
 import "../index.mjs";
 import { Kysely } from "kysely";
 

package/dist/media/local-runtime.mjs

@@ -1,13 +1,14 @@
 import "../dialect-helpers-BSbfaO3F.mjs";
+import "../config-C3EBstHi.mjs";
 import "../after-CBU2vkoO.mjs";
 import "../object-cache-71tPfV4A.mjs";
-import "../base64-B-PsqheR.mjs";
-import "../types-Cd8iuS1J.mjs";
-import { t as MediaRepository } from "../media-BP7S-nHT.mjs";
+import "../base64-CvLhUKQv.mjs";
+import "../types-CQPWhPxE.mjs";
+import { t as MediaRepository } from "../media-CzhAn2--.mjs";
 import "../options-CBXIHUoT.mjs";
 import "../request-cache-BSUptuJR.mjs";
-import "../loader-CGugY7Zl.mjs";
-import { o as invalidateSiteSettingsCache } from "../settings-kJhGiQ4z.mjs";
+import "../loader-CdG_Ci3H.mjs";
+import { o as invalidateSiteSettingsCache } from "../settings-xRdoUZr0.mjs";
 
 //#region src/media/local-runtime.ts
 /**

package/dist/media/local-runtime.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"local-runtime.mjs","names":[],"sources":["../../src/media/local-runtime.ts"],"sourcesContent":["/**\n * Local Media Provider Runtime\n *\n * This is the runtime implementation loaded by the entrypoint.\n * It wraps the existing MediaRepository and storage adapter.\n *\n * Note: This provider is special because it needs access to the database\n * and storage adapter. The createMediaProvider function receives these\n * via the config object, injected by the runtime.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { MediaRepository } from \"../database/repositories/media.js\";\nimport type { Database } from \"../database/types.js\";\nimport type { Storage } from \"../index.js\";\nimport { invalidateSiteSettingsCache } from \"../settings/index.js\";\nimport type {\n\tCreateMediaProviderFn,\n\tMediaProvider,\n\tMediaListOptions,\n\tMediaProviderItem,\n\tMediaValue,\n\tEmbedResult,\n\tEmbedOptions,\n} from \"./types.js\";\n\nexport interface LocalMediaRuntimeConfig {\n\tenabled?: boolean;\n\t// These are injected by the runtime, not from user config\n\tdb?: Kysely<Database>;\n\t/**\n\t * Resolver for the live connection, preferred over `db`. The runtime\n\t * injects it so a connection-backed adapter (Postgres over Hyperdrive)\n\t * serves provider queries from the current request-scoped connection in ALS\n\t * rather than a snapshot of the per-isolate singleton. Omitted for stateless\n\t * adapters (D1, Node SQLite), where `db` is used directly.\n\t */\n\tgetDb?: () => Kysely<Database>;\n\tstorage?: Storage;\n}\n\n/**\n * Create the local media provider\n */\nexport const createMediaProvider: CreateMediaProviderFn<LocalMediaRuntimeConfig> = (config) => {\n\tconst { db, storage } = config;\n\n\tif (!db) {\n\t\tthrow new Error(\"Local media provider requires database connection\");\n\t}\n\n\t// Resolve the connection per operation (not captured once) so a\n\t// connection-backed adapter uses the current event-scoped connection; falls\n\t// back to the injected `db` for stateless adapters.\n\tconst resolveDb = config.getDb ?? (() => db);\n\tconst repo = () => new MediaRepository(resolveDb());\n\n\tconst provider: MediaProvider = {\n\t\tasync list(options: MediaListOptions) {\n\t\t\tconst result = await repo().findMany({\n\t\t\t\tcursor: options.cursor,\n\t\t\t\tlimit: options.limit,\n\t\t\t\tmimeType: options.mimeType,\n\t\t\t\t// TODO: Add search support when capabilities.search is true\n\t\t\t});\n\n\t\t\treturn {\n\t\t\t\titems: result.items.map((item) => ({\n\t\t\t\t\tid: item.id,\n\t\t\t\t\tfilename: item.filename,\n\t\t\t\t\tmimeType: item.mimeType,\n\t\t\t\t\tsize: item.size ?? undefined,\n\t\t\t\t\twidth: item.width ?? undefined,\n\t\t\t\t\theight: item.height ?? undefined,\n\t\t\t\t\tblurhash: item.blurhash ?? undefined,\n\t\t\t\t\tdominantColor: item.dominantColor ?? undefined,\n\t\t\t\t\talt: item.alt ?? undefined,\n\t\t\t\t\tpreviewUrl: `/_emdash/api/media/file/${item.storageKey}`,\n\t\t\t\t\tmeta: {\n\t\t\t\t\t\tstorageKey: item.storageKey,\n\t\t\t\t\t\tcaption: item.caption,\n\t\t\t\t\t\tblurhash: item.blurhash,\n\t\t\t\t\t\tdominantColor: item.dominantColor,\n\t\t\t\t\t},\n\t\t\t\t})),\n\t\t\t\tnextCursor: result.nextCursor,\n\t\t\t};\n\t\t},\n\n\t\tasync get(id: string) {\n\t\t\tconst item = await repo().findById(id);\n\t\t\tif (!item) return null;\n\n\t\t\treturn {\n\t\t\t\tid: item.id,\n\t\t\t\tfilename: item.filename,\n\t\t\t\tmimeType: item.mimeType,\n\t\t\t\tsize: item.size ?? undefined,\n\t\t\t\twidth: item.width ?? undefined,\n\t\t\t\theight: item.height ?? undefined,\n\t\t\t\tblurhash: item.blurhash ?? undefined,\n\t\t\t\tdominantColor: item.dominantColor ?? undefined,\n\t\t\t\talt: item.alt ?? undefined,\n\t\t\t\tpreviewUrl: `/_emdash/api/media/file/${item.storageKey}`,\n\t\t\t\tmeta: {\n\t\t\t\t\tstorageKey: item.storageKey,\n\t\t\t\t\tcaption: item.caption,\n\t\t\t\t\tblurhash: item.blurhash,\n\t\t\t\t\tdominantColor: item.dominantColor,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\n\t\tasync upload(_input) {\n\t\t\tif (!storage) {\n\t\t\t\tthrow new Error(\"Storage not configured for local media provider\");\n\t\t\t}\n\n\t\t\t// This is handled by the existing media upload endpoint\n\t\t\t// The provider interface is used by external providers\n\t\t\t// For local, we delegate to the existing system\n\t\t\tthrow new Error(\"Local upload should use /_emdash/api/media endpoint\");\n\t\t},\n\n\t\tasync delete(id: string) {\n\t\t\tconst repoInstance = repo();\n\t\t\tconst item = await repoInstance.findById(id);\n\t\t\tif (!item) return;\n\n\t\t\t// Delete from storage if available\n\t\t\tif (storage) {\n\t\t\t\ttry {\n\t\t\t\t\tawait storage.delete(item.storageKey);\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore storage deletion errors\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait repoInstance.delete(id);\n\n\t\t\t// If this row was referenced by `logo`, `favicon`, or\n\t\t\t// `seo.defaultOgImage`, the worker-scoped settings cache now\n\t\t\t// holds a stale URL. The provider routes (and any future caller)\n\t\t\t// bypass `handleMediaDelete`, so we invalidate here too.\n\t\t\tinvalidateSiteSettingsCache();\n\t\t},\n\n\t\tgetEmbed(value: MediaValue, _options?: EmbedOptions): EmbedResult {\n\t\t\tconst storageKey =\n\t\t\t\ttypeof value.meta?.storageKey === \"string\" ? value.meta.storageKey : value.id;\n\t\t\tconst src = `/_emdash/api/media/file/${storageKey}`;\n\t\t\tconst mimeType = value.mimeType || \"\";\n\n\t\t\t// Prefer the first-class fields; fall back to `meta` for legacy snapshots\n\t\t\t// stored before LQIP was promoted off the provider-specific `meta` bag.\n\t\t\tconst blurhash =\n\t\t\t\tvalue.blurhash ??\n\t\t\t\t(typeof value.meta?.blurhash === \"string\" ? value.meta.blurhash : undefined);\n\t\t\tconst dominantColor =\n\t\t\t\tvalue.dominantColor ??\n\t\t\t\t(typeof value.meta?.dominantColor === \"string\" ? value.meta.dominantColor : undefined);\n\n\t\t\t// Determine embed type based on MIME type\n\t\t\tif (mimeType.startsWith(\"image/\")) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: \"image\",\n\t\t\t\t\tsrc,\n\t\t\t\t\twidth: value.width,\n\t\t\t\t\theight: value.height,\n\t\t\t\t\tblurhash,\n\t\t\t\t\tdominantColor,\n\t\t\t\t\talt: value.alt,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (mimeType.startsWith(\"video/\")) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: \"video\",\n\t\t\t\t\tsrc,\n\t\t\t\t\twidth: value.width,\n\t\t\t\t\theight: value.height,\n\t\t\t\t\tcontrols: true,\n\t\t\t\t\tpreload: \"metadata\",\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (mimeType.startsWith(\"audio/\")) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: \"audio\",\n\t\t\t\t\tsrc,\n\t\t\t\t\tcontrols: true,\n\t\t\t\t\tpreload: \"metadata\",\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Fallback: treat as image (for unknown types)\n\t\t\treturn {\n\t\t\t\ttype: \"image\",\n\t\t\t\tsrc,\n\t\t\t\twidth: value.width,\n\t\t\t\theight: value.height,\n\t\t\t\tblurhash,\n\t\t\t\tdominantColor,\n\t\t\t\talt: value.alt,\n\t\t\t};\n\t\t},\n\n\t\tgetThumbnailUrl(id: string, _mimeType?: string) {\n\t\t\t// For local media, return the file URL\n\t\t\treturn `/_emdash/api/media/file/${id}`;\n\t\t},\n\t};\n\n\treturn provider;\n};\n\n/**\n * Helper to convert a MediaRepository item to MediaProviderItem\n */\nexport function repoItemToProviderItem(item: {\n\tid: string;\n\tfilename: string;\n\tmimeType: string;\n\tsize: number | null;\n\twidth: number | null;\n\theight: number | null;\n\talt: string | null;\n\tcaption: string | null;\n\tstorageKey: string;\n\tblurhash: string | null;\n\tdominantColor: string | null;\n}): MediaProviderItem {\n\treturn {\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\tsize: item.size ?? undefined,\n\t\twidth: item.width ?? undefined,\n\t\theight: item.height ?? undefined,\n\t\tblurhash: item.blurhash ?? undefined,\n\t\tdominantColor: item.dominantColor ?? undefined,\n\t\talt: item.alt ?? undefined,\n\t\tpreviewUrl: `/_emdash/api/media/file/${item.storageKey}`,\n\t\tmeta: {\n\t\t\tstorageKey: item.storageKey,\n\t\t\tcaption: item.caption,\n\t\t\tblurhash: item.blurhash,\n\t\t\tdominantColor: item.dominantColor,\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;AA6CA,MAAa,uBAAuE,WAAW;CAC9F,MAAM,EAAE,IAAI,YAAY;AAExB,KAAI,CAAC,GACJ,OAAM,IAAI,MAAM,oDAAoD;CAMrE,MAAM,YAAY,OAAO,gBAAgB;CACzC,MAAM,aAAa,IAAI,gBAAgB,WAAW,CAAC;AA8JnD,QA5JgC;EAC/B,MAAM,KAAK,SAA2B;GACrC,MAAM,SAAS,MAAM,MAAM,CAAC,SAAS;IACpC,QAAQ,QAAQ;IAChB,OAAO,QAAQ;IACf,UAAU,QAAQ;IAElB,CAAC;AAEF,UAAO;IACN,OAAO,OAAO,MAAM,KAAK,UAAU;KAClC,IAAI,KAAK;KACT,UAAU,KAAK;KACf,UAAU,KAAK;KACf,MAAM,KAAK,QAAQ;KACnB,OAAO,KAAK,SAAS;KACrB,QAAQ,KAAK,UAAU;KACvB,UAAU,KAAK,YAAY;KAC3B,eAAe,KAAK,iBAAiB;KACrC,KAAK,KAAK,OAAO;KACjB,YAAY,2BAA2B,KAAK;KAC5C,MAAM;MACL,YAAY,KAAK;MACjB,SAAS,KAAK;MACd,UAAU,KAAK;MACf,eAAe,KAAK;MACpB;KACD,EAAE;IACH,YAAY,OAAO;IACnB;;EAGF,MAAM,IAAI,IAAY;GACrB,MAAM,OAAO,MAAM,MAAM,CAAC,SAAS,GAAG;AACtC,OAAI,CAAC,KAAM,QAAO;AAElB,UAAO;IACN,IAAI,KAAK;IACT,UAAU,KAAK;IACf,UAAU,KAAK;IACf,MAAM,KAAK,QAAQ;IACnB,OAAO,KAAK,SAAS;IACrB,QAAQ,KAAK,UAAU;IACvB,UAAU,KAAK,YAAY;IAC3B,eAAe,KAAK,iBAAiB;IACrC,KAAK,KAAK,OAAO;IACjB,YAAY,2BAA2B,KAAK;IAC5C,MAAM;KACL,YAAY,KAAK;KACjB,SAAS,KAAK;KACd,UAAU,KAAK;KACf,eAAe,KAAK;KACpB;IACD;;EAGF,MAAM,OAAO,QAAQ;AACpB,OAAI,CAAC,QACJ,OAAM,IAAI,MAAM,kDAAkD;AAMnE,SAAM,IAAI,MAAM,sDAAsD;;EAGvE,MAAM,OAAO,IAAY;GACxB,MAAM,eAAe,MAAM;GAC3B,MAAM,OAAO,MAAM,aAAa,SAAS,GAAG;AAC5C,OAAI,CAAC,KAAM;AAGX,OAAI,QACH,KAAI;AACH,UAAM,QAAQ,OAAO,KAAK,WAAW;WAC9B;AAKT,SAAM,aAAa,OAAO,GAAG;AAM7B,gCAA6B;;EAG9B,SAAS,OAAmB,UAAsC;GAGjE,MAAM,MAAM,2BADX,OAAO,MAAM,MAAM,eAAe,WAAW,MAAM,KAAK,aAAa,MAAM;GAE5E,MAAM,WAAW,MAAM,YAAY;GAInC,MAAM,WACL,MAAM,aACL,OAAO,MAAM,MAAM,aAAa,WAAW,MAAM,KAAK,WAAW;GACnE,MAAM,gBACL,MAAM,kBACL,OAAO,MAAM,MAAM,kBAAkB,WAAW,MAAM,KAAK,gBAAgB;AAG7E,OAAI,SAAS,WAAW,SAAS,CAChC,QAAO;IACN,MAAM;IACN;IACA,OAAO,MAAM;IACb,QAAQ,MAAM;IACd;IACA;IACA,KAAK,MAAM;IACX;AAGF,OAAI,SAAS,WAAW,SAAS,CAChC,QAAO;IACN,MAAM;IACN;IACA,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,UAAU;IACV,SAAS;IACT;AAGF,OAAI,SAAS,WAAW,SAAS,CAChC,QAAO;IACN,MAAM;IACN;IACA,UAAU;IACV,SAAS;IACT;AAIF,UAAO;IACN,MAAM;IACN;IACA,OAAO,MAAM;IACb,QAAQ,MAAM;IACd;IACA;IACA,KAAK,MAAM;IACX;;EAGF,gBAAgB,IAAY,WAAoB;AAE/C,UAAO,2BAA2B;;EAEnC;;;;;AAQF,SAAgB,uBAAuB,MAYjB;AACrB,QAAO;EACN,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,MAAM,KAAK,QAAQ;EACnB,OAAO,KAAK,SAAS;EACrB,QAAQ,KAAK,UAAU;EACvB,UAAU,KAAK,YAAY;EAC3B,eAAe,KAAK,iBAAiB;EACrC,KAAK,KAAK,OAAO;EACjB,YAAY,2BAA2B,KAAK;EAC5C,MAAM;GACL,YAAY,KAAK;GACjB,SAAS,KAAK;GACd,UAAU,KAAK;GACf,eAAe,KAAK;GACpB;EACD"}
+{"version":3,"file":"local-runtime.mjs","names":[],"sources":["../../src/media/local-runtime.ts"],"sourcesContent":["/**\n * Local Media Provider Runtime\n *\n * This is the runtime implementation loaded by the entrypoint.\n * It wraps the existing MediaRepository and storage adapter.\n *\n * Note: This provider is special because it needs access to the database\n * and storage adapter. The createMediaProvider function receives these\n * via the config object, injected by the runtime.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { MediaRepository } from \"../database/repositories/media.js\";\nimport type { Database } from \"../database/types.js\";\nimport type { Storage } from \"../index.js\";\nimport { invalidateSiteSettingsCache } from \"../settings/index.js\";\nimport type {\n\tCreateMediaProviderFn,\n\tMediaProvider,\n\tMediaListOptions,\n\tMediaProviderItem,\n\tMediaValue,\n\tEmbedResult,\n\tEmbedOptions,\n} from \"./types.js\";\n\nexport interface LocalMediaRuntimeConfig {\n\tenabled?: boolean;\n\t// These are injected by the runtime, not from user config\n\tdb?: Kysely<Database>;\n\t/**\n\t * Resolver for the live connection, preferred over `db`. The runtime\n\t * injects it so a connection-backed adapter (Postgres over Hyperdrive)\n\t * serves provider queries from the current request-scoped connection in ALS\n\t * rather than a snapshot of the per-isolate singleton. Omitted for stateless\n\t * adapters (D1, Node SQLite), where `db` is used directly.\n\t */\n\tgetDb?: () => Kysely<Database>;\n\tstorage?: Storage;\n}\n\n/**\n * Create the local media provider\n */\nexport const createMediaProvider: CreateMediaProviderFn<LocalMediaRuntimeConfig> = (config) => {\n\tconst { db, storage } = config;\n\n\tif (!db) {\n\t\tthrow new Error(\"Local media provider requires database connection\");\n\t}\n\n\t// Resolve the connection per operation (not captured once) so a\n\t// connection-backed adapter uses the current event-scoped connection; falls\n\t// back to the injected `db` for stateless adapters.\n\tconst resolveDb = config.getDb ?? (() => db);\n\tconst repo = () => new MediaRepository(resolveDb());\n\n\tconst provider: MediaProvider = {\n\t\tasync list(options: MediaListOptions) {\n\t\t\tconst result = await repo().findMany({\n\t\t\t\tcursor: options.cursor,\n\t\t\t\tlimit: options.limit,\n\t\t\t\tmimeType: options.mimeType,\n\t\t\t\t// TODO: Add search support when capabilities.search is true\n\t\t\t});\n\n\t\t\treturn {\n\t\t\t\titems: result.items.map((item) => ({\n\t\t\t\t\tid: item.id,\n\t\t\t\t\tfilename: item.filename,\n\t\t\t\t\tmimeType: item.mimeType,\n\t\t\t\t\tsize: item.size ?? undefined,\n\t\t\t\t\twidth: item.width ?? undefined,\n\t\t\t\t\theight: item.height ?? undefined,\n\t\t\t\t\tblurhash: item.blurhash ?? undefined,\n\t\t\t\t\tdominantColor: item.dominantColor ?? undefined,\n\t\t\t\t\talt: item.alt ?? undefined,\n\t\t\t\t\tpreviewUrl: `/_emdash/api/media/file/${item.storageKey}`,\n\t\t\t\t\tmeta: {\n\t\t\t\t\t\tstorageKey: item.storageKey,\n\t\t\t\t\t\tcaption: item.caption,\n\t\t\t\t\t\tblurhash: item.blurhash,\n\t\t\t\t\t\tdominantColor: item.dominantColor,\n\t\t\t\t\t},\n\t\t\t\t})),\n\t\t\t\tnextCursor: result.nextCursor,\n\t\t\t};\n\t\t},\n\n\t\tasync get(id: string) {\n\t\t\tconst item = await repo().findById(id);\n\t\t\tif (!item) return null;\n\n\t\t\treturn {\n\t\t\t\tid: item.id,\n\t\t\t\tfilename: item.filename,\n\t\t\t\tmimeType: item.mimeType,\n\t\t\t\tsize: item.size ?? undefined,\n\t\t\t\twidth: item.width ?? undefined,\n\t\t\t\theight: item.height ?? undefined,\n\t\t\t\tblurhash: item.blurhash ?? undefined,\n\t\t\t\tdominantColor: item.dominantColor ?? undefined,\n\t\t\t\talt: item.alt ?? undefined,\n\t\t\t\tpreviewUrl: `/_emdash/api/media/file/${item.storageKey}`,\n\t\t\t\tmeta: {\n\t\t\t\t\tstorageKey: item.storageKey,\n\t\t\t\t\tcaption: item.caption,\n\t\t\t\t\tblurhash: item.blurhash,\n\t\t\t\t\tdominantColor: item.dominantColor,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\n\t\tasync upload(_input) {\n\t\t\tif (!storage) {\n\t\t\t\tthrow new Error(\"Storage not configured for local media provider\");\n\t\t\t}\n\n\t\t\t// This is handled by the existing media upload endpoint\n\t\t\t// The provider interface is used by external providers\n\t\t\t// For local, we delegate to the existing system\n\t\t\tthrow new Error(\"Local upload should use /_emdash/api/media endpoint\");\n\t\t},\n\n\t\tasync delete(id: string) {\n\t\t\tconst repoInstance = repo();\n\t\t\tconst item = await repoInstance.findById(id);\n\t\t\tif (!item) return;\n\n\t\t\t// Delete from storage if available\n\t\t\tif (storage) {\n\t\t\t\ttry {\n\t\t\t\t\tawait storage.delete(item.storageKey);\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore storage deletion errors\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait repoInstance.delete(id);\n\n\t\t\t// If this row was referenced by `logo`, `favicon`, or\n\t\t\t// `seo.defaultOgImage`, the worker-scoped settings cache now\n\t\t\t// holds a stale URL. The provider routes (and any future caller)\n\t\t\t// bypass `handleMediaDelete`, so we invalidate here too.\n\t\t\tinvalidateSiteSettingsCache();\n\t\t},\n\n\t\tgetEmbed(value: MediaValue, _options?: EmbedOptions): EmbedResult {\n\t\t\tconst storageKey =\n\t\t\t\ttypeof value.meta?.storageKey === \"string\" ? value.meta.storageKey : value.id;\n\t\t\tconst src = `/_emdash/api/media/file/${storageKey}`;\n\t\t\tconst mimeType = value.mimeType || \"\";\n\n\t\t\t// Prefer the first-class fields; fall back to `meta` for legacy snapshots\n\t\t\t// stored before LQIP was promoted off the provider-specific `meta` bag.\n\t\t\tconst blurhash =\n\t\t\t\tvalue.blurhash ??\n\t\t\t\t(typeof value.meta?.blurhash === \"string\" ? value.meta.blurhash : undefined);\n\t\t\tconst dominantColor =\n\t\t\t\tvalue.dominantColor ??\n\t\t\t\t(typeof value.meta?.dominantColor === \"string\" ? value.meta.dominantColor : undefined);\n\n\t\t\t// Determine embed type based on MIME type\n\t\t\tif (mimeType.startsWith(\"image/\")) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: \"image\",\n\t\t\t\t\tsrc,\n\t\t\t\t\twidth: value.width,\n\t\t\t\t\theight: value.height,\n\t\t\t\t\tblurhash,\n\t\t\t\t\tdominantColor,\n\t\t\t\t\talt: value.alt,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (mimeType.startsWith(\"video/\")) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: \"video\",\n\t\t\t\t\tsrc,\n\t\t\t\t\twidth: value.width,\n\t\t\t\t\theight: value.height,\n\t\t\t\t\tcontrols: true,\n\t\t\t\t\tpreload: \"metadata\",\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (mimeType.startsWith(\"audio/\")) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: \"audio\",\n\t\t\t\t\tsrc,\n\t\t\t\t\tcontrols: true,\n\t\t\t\t\tpreload: \"metadata\",\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Fallback: treat as image (for unknown types)\n\t\t\treturn {\n\t\t\t\ttype: \"image\",\n\t\t\t\tsrc,\n\t\t\t\twidth: value.width,\n\t\t\t\theight: value.height,\n\t\t\t\tblurhash,\n\t\t\t\tdominantColor,\n\t\t\t\talt: value.alt,\n\t\t\t};\n\t\t},\n\n\t\tgetThumbnailUrl(id: string, _mimeType?: string) {\n\t\t\t// For local media, return the file URL\n\t\t\treturn `/_emdash/api/media/file/${id}`;\n\t\t},\n\t};\n\n\treturn provider;\n};\n\n/**\n * Helper to convert a MediaRepository item to MediaProviderItem\n */\nexport function repoItemToProviderItem(item: {\n\tid: string;\n\tfilename: string;\n\tmimeType: string;\n\tsize: number | null;\n\twidth: number | null;\n\theight: number | null;\n\talt: string | null;\n\tcaption: string | null;\n\tstorageKey: string;\n\tblurhash: string | null;\n\tdominantColor: string | null;\n}): MediaProviderItem {\n\treturn {\n\t\tid: item.id,\n\t\tfilename: item.filename,\n\t\tmimeType: item.mimeType,\n\t\tsize: item.size ?? undefined,\n\t\twidth: item.width ?? undefined,\n\t\theight: item.height ?? undefined,\n\t\tblurhash: item.blurhash ?? undefined,\n\t\tdominantColor: item.dominantColor ?? undefined,\n\t\talt: item.alt ?? undefined,\n\t\tpreviewUrl: `/_emdash/api/media/file/${item.storageKey}`,\n\t\tmeta: {\n\t\t\tstorageKey: item.storageKey,\n\t\t\tcaption: item.caption,\n\t\t\tblurhash: item.blurhash,\n\t\t\tdominantColor: item.dominantColor,\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6CA,MAAa,uBAAuE,WAAW;CAC9F,MAAM,EAAE,IAAI,YAAY;AAExB,KAAI,CAAC,GACJ,OAAM,IAAI,MAAM,oDAAoD;CAMrE,MAAM,YAAY,OAAO,gBAAgB;CACzC,MAAM,aAAa,IAAI,gBAAgB,WAAW,CAAC;AA8JnD,QA5JgC;EAC/B,MAAM,KAAK,SAA2B;GACrC,MAAM,SAAS,MAAM,MAAM,CAAC,SAAS;IACpC,QAAQ,QAAQ;IAChB,OAAO,QAAQ;IACf,UAAU,QAAQ;IAElB,CAAC;AAEF,UAAO;IACN,OAAO,OAAO,MAAM,KAAK,UAAU;KAClC,IAAI,KAAK;KACT,UAAU,KAAK;KACf,UAAU,KAAK;KACf,MAAM,KAAK,QAAQ;KACnB,OAAO,KAAK,SAAS;KACrB,QAAQ,KAAK,UAAU;KACvB,UAAU,KAAK,YAAY;KAC3B,eAAe,KAAK,iBAAiB;KACrC,KAAK,KAAK,OAAO;KACjB,YAAY,2BAA2B,KAAK;KAC5C,MAAM;MACL,YAAY,KAAK;MACjB,SAAS,KAAK;MACd,UAAU,KAAK;MACf,eAAe,KAAK;MACpB;KACD,EAAE;IACH,YAAY,OAAO;IACnB;;EAGF,MAAM,IAAI,IAAY;GACrB,MAAM,OAAO,MAAM,MAAM,CAAC,SAAS,GAAG;AACtC,OAAI,CAAC,KAAM,QAAO;AAElB,UAAO;IACN,IAAI,KAAK;IACT,UAAU,KAAK;IACf,UAAU,KAAK;IACf,MAAM,KAAK,QAAQ;IACnB,OAAO,KAAK,SAAS;IACrB,QAAQ,KAAK,UAAU;IACvB,UAAU,KAAK,YAAY;IAC3B,eAAe,KAAK,iBAAiB;IACrC,KAAK,KAAK,OAAO;IACjB,YAAY,2BAA2B,KAAK;IAC5C,MAAM;KACL,YAAY,KAAK;KACjB,SAAS,KAAK;KACd,UAAU,KAAK;KACf,eAAe,KAAK;KACpB;IACD;;EAGF,MAAM,OAAO,QAAQ;AACpB,OAAI,CAAC,QACJ,OAAM,IAAI,MAAM,kDAAkD;AAMnE,SAAM,IAAI,MAAM,sDAAsD;;EAGvE,MAAM,OAAO,IAAY;GACxB,MAAM,eAAe,MAAM;GAC3B,MAAM,OAAO,MAAM,aAAa,SAAS,GAAG;AAC5C,OAAI,CAAC,KAAM;AAGX,OAAI,QACH,KAAI;AACH,UAAM,QAAQ,OAAO,KAAK,WAAW;WAC9B;AAKT,SAAM,aAAa,OAAO,GAAG;AAM7B,gCAA6B;;EAG9B,SAAS,OAAmB,UAAsC;GAGjE,MAAM,MAAM,2BADX,OAAO,MAAM,MAAM,eAAe,WAAW,MAAM,KAAK,aAAa,MAAM;GAE5E,MAAM,WAAW,MAAM,YAAY;GAInC,MAAM,WACL,MAAM,aACL,OAAO,MAAM,MAAM,aAAa,WAAW,MAAM,KAAK,WAAW;GACnE,MAAM,gBACL,MAAM,kBACL,OAAO,MAAM,MAAM,kBAAkB,WAAW,MAAM,KAAK,gBAAgB;AAG7E,OAAI,SAAS,WAAW,SAAS,CAChC,QAAO;IACN,MAAM;IACN;IACA,OAAO,MAAM;IACb,QAAQ,MAAM;IACd;IACA;IACA,KAAK,MAAM;IACX;AAGF,OAAI,SAAS,WAAW,SAAS,CAChC,QAAO;IACN,MAAM;IACN;IACA,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,UAAU;IACV,SAAS;IACT;AAGF,OAAI,SAAS,WAAW,SAAS,CAChC,QAAO;IACN,MAAM;IACN;IACA,UAAU;IACV,SAAS;IACT;AAIF,UAAO;IACN,MAAM;IACN;IACA,OAAO,MAAM;IACb,QAAQ,MAAM;IACd;IACA;IACA,KAAK,MAAM;IACX;;EAGF,gBAAgB,IAAY,WAAoB;AAE/C,UAAO,2BAA2B;;EAEnC;;;;;AAQF,SAAgB,uBAAuB,MAYjB;AACrB,QAAO;EACN,IAAI,KAAK;EACT,UAAU,KAAK;EACf,UAAU,KAAK;EACf,MAAM,KAAK,QAAQ;EACnB,OAAO,KAAK,SAAS;EACrB,QAAQ,KAAK,UAAU;EACvB,UAAU,KAAK,YAAY;EAC3B,eAAe,KAAK,iBAAiB;EACrC,KAAK,KAAK,OAAO;EACjB,YAAY,2BAA2B,KAAK;EAC5C,MAAM;GACL,YAAY,KAAK;GACjB,SAAS,KAAK;GACd,UAAU,KAAK;GACf,eAAe,KAAK;GACpB;EACD"}