emdash 0.37.0 → 0.38.0

package/dist/{api-tokens-BSsQACNe.mjs → api-tokens-xpGqMHrC.mjs}

@@ -1,4 +1,4 @@
-import { a as hashApiToken, r as generatePrefixedToken } from "./api-tokens-BfYts-sq.mjs";
+import { a as hashApiToken, r as generatePrefixedToken } from "./api-tokens-B_lfpmH3.mjs";
 import { ulid } from "ulidx";
 
 //#region src/api/handlers/api-tokens.ts
@@ -160,4 +160,4 @@ async function resolveOAuthToken(db, rawToken) {
 
 //#endregion
 export { resolveApiToken as a, handleApiTokenRevoke as i, handleApiTokenCreate as n, resolveOAuthToken as o, handleApiTokenList as r, deleteApiTokensByName as t };
-//# sourceMappingURL=api-tokens-BSsQACNe.mjs.map
+//# sourceMappingURL=api-tokens-xpGqMHrC.mjs.map

package/dist/{api-tokens-BSsQACNe.mjs.map → api-tokens-xpGqMHrC.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"api-tokens-BSsQACNe.mjs","names":[],"sources":["../src/api/handlers/api-tokens.ts"],"sourcesContent":["/**\n * API token management handlers.\n *\n * Creates, lists, and revokes Personal Access Tokens (PATs).\n * Token format: ec_pat_<base64url>\n * Only the SHA-256 hash is stored — raw token shown once at creation.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { hashApiToken, generatePrefixedToken } from \"../../auth/api-tokens.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface ApiTokenInfo {\n\tid: string;\n\tname: string;\n\tprefix: string;\n\tscopes: string[];\n\tuserId: string;\n\texpiresAt: string | null;\n\tlastUsedAt: string | null;\n\tcreatedAt: string;\n}\n\nexport interface ApiTokenCreateResult {\n\t/** The raw token — shown once, never stored */\n\ttoken: string;\n\t/** Token metadata */\n\tinfo: ApiTokenInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new API token for a user.\n */\nexport async function handleApiTokenCreate(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tinput: {\n\t\tname: string;\n\t\tscopes: string[];\n\t\texpiresAt?: string;\n\t},\n): Promise<ApiResult<ApiTokenCreateResult>> {\n\ttry {\n\t\tconst id = ulid();\n\t\tconst { raw, hash, prefix } = generatePrefixedToken(\"ec_pat_\");\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_api_tokens\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\ttoken_hash: hash,\n\t\t\t\tprefix,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(input.scopes),\n\t\t\t\texpires_at: input.expiresAt ?? null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tconst info: ApiTokenInfo = {\n\t\t\tid,\n\t\t\tname: input.name,\n\t\t\tprefix,\n\t\t\tscopes: input.scopes,\n\t\t\tuserId,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tlastUsedAt: null,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\n\t\treturn { success: true, data: { token: raw, info } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all API tokens for a user (never returns the raw token or hash).\n */\nexport async function handleApiTokenList(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<ApiResult<{ items: ApiTokenInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t\t.select([\n\t\t\t\t\"id\",\n\t\t\t\t\"name\",\n\t\t\t\t\"prefix\",\n\t\t\t\t\"scopes\",\n\t\t\t\t\"user_id\",\n\t\t\t\t\"expires_at\",\n\t\t\t\t\"last_used_at\",\n\t\t\t\t\"created_at\",\n\t\t\t])\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: ApiTokenInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tprefix: row.prefix,\n\t\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t\tuserId: row.user_id,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list API tokens\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Revoke (delete) an API token.\n */\nexport async function handleApiTokenRevoke(\n\tdb: Kysely<Database>,\n\ttokenId: string,\n\tuserId: string,\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t\t.where(\"id\", \"=\", tokenId)\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Token not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete every token with the given name for a user, returning how many were\n * removed. Token names aren't unique, so this is a bulk delete — used by the\n * dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new\n * one on every reset.\n */\nexport async function deleteApiTokensByName(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tname: string,\n): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t.where(\"user_id\", \"=\", userId)\n\t\t.where(\"name\", \"=\", name)\n\t\t.executeTakeFirst();\n\treturn Number(result.numDeletedRows ?? 0n);\n}\n\n/**\n * Resolve a raw API token (ec_pat_...) to a user ID and scopes.\n * Updates last_used_at on successful lookup.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveApiToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<{ userId: string; scopes: string[] } | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t.select([\"id\", \"user_id\", \"scopes\", \"expires_at\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (row.expires_at && new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\t// Update last_used_at (fire-and-forget, don't block the request)\n\tdb.updateTable(\"_emdash_api_tokens\")\n\t\t.set({ last_used_at: new Date().toISOString() })\n\t\t.where(\"id\", \"=\", row.id)\n\t\t.execute()\n\t\t.catch(() => {}); // Non-critical, swallow errors\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t};\n}\n\n/**\n * Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveOAuthToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<{ userId: string; scopes: string[] } | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t.select([\"user_id\", \"scopes\", \"expires_at\", \"token_type\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t};\n}\n"],"mappings":";;;;;;;AA4CA,eAAsB,qBACrB,IACA,QACA,OAK2C;AAC3C,KAAI;EACH,MAAM,KAAK,MAAM;EACjB,MAAM,EAAE,KAAK,MAAM,WAAW,sBAAsB,UAAU;AAE9D,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP;GACA,MAAM,MAAM;GACZ,YAAY;GACZ;GACA,SAAS;GACT,QAAQ,KAAK,UAAU,MAAM,OAAO;GACpC,YAAY,MAAM,aAAa;GAC/B,CAAC,CACD,SAAS;AAaX,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE,OAAO;IAAK,MAXjB;KAC1B;KACA,MAAM,MAAM;KACZ;KACA,QAAQ,MAAM;KACd;KACA,WAAW,MAAM,aAAa;KAC9B,YAAY;KACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;KACnC;IAEiD;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,mBACrB,IACA,QACgD;AAChD,KAAI;AA4BH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QA3BnB,MAAM,GACjB,WAAW,qBAAqB,CAChC,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC,CACD,MAAM,WAAW,KAAK,OAAO,CAC7B,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAEwB,KAAK,SAAS;IAChD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;IAC9B,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,QAC2C;AAC3C,KAAI;AAOH,OANe,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,WAAW,KAAK,OAAO,CAC7B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAmB;GACxD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,sBACrB,IACA,QACA,MACkB;CAClB,MAAM,SAAS,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,WAAW,KAAK,OAAO,CAC7B,MAAM,QAAQ,KAAK,KAAK,CACxB,kBAAkB;AACpB,QAAO,OAAO,OAAO,kBAAkB,GAAG;;;;;;;AAQ3C,eAAsB,gBACrB,IACA,UACuD;CACvD,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,qBAAqB,CAChC,OAAO;EAAC;EAAM;EAAW;EAAU;EAAa,CAAC,CACjD,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CAC1D,QAAO;AAIR,IAAG,YAAY,qBAAqB,CAClC,IAAI,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE,CAAC,CAC/C,MAAM,MAAM,KAAK,IAAI,GAAG,CACxB,SAAS,CACT,YAAY,GAAG;AAEjB,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B;;;;;;AAOF,eAAsB,kBACrB,IACA,UACuD;CACvD,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;EAAC;EAAW;EAAU;EAAc;EAAa,CAAC,CACzD,MAAM,cAAc,KAAK,KAAK,CAC9B,MAAM,cAAc,KAAK,SAAS,CAClC,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;AAGR,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B"}
+{"version":3,"file":"api-tokens-xpGqMHrC.mjs","names":[],"sources":["../src/api/handlers/api-tokens.ts"],"sourcesContent":["/**\n * API token management handlers.\n *\n * Creates, lists, and revokes Personal Access Tokens (PATs).\n * Token format: ec_pat_<base64url>\n * Only the SHA-256 hash is stored — raw token shown once at creation.\n */\n\nimport type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { hashApiToken, generatePrefixedToken } from \"../../auth/api-tokens.js\";\nimport type { Database } from \"../../database/types.js\";\nimport type { ApiResult } from \"../types.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport interface ApiTokenInfo {\n\tid: string;\n\tname: string;\n\tprefix: string;\n\tscopes: string[];\n\tuserId: string;\n\texpiresAt: string | null;\n\tlastUsedAt: string | null;\n\tcreatedAt: string;\n}\n\nexport interface ApiTokenCreateResult {\n\t/** The raw token — shown once, never stored */\n\ttoken: string;\n\t/** Token metadata */\n\tinfo: ApiTokenInfo;\n}\n\n// ---------------------------------------------------------------------------\n// Handlers\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new API token for a user.\n */\nexport async function handleApiTokenCreate(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tinput: {\n\t\tname: string;\n\t\tscopes: string[];\n\t\texpiresAt?: string;\n\t},\n): Promise<ApiResult<ApiTokenCreateResult>> {\n\ttry {\n\t\tconst id = ulid();\n\t\tconst { raw, hash, prefix } = generatePrefixedToken(\"ec_pat_\");\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_api_tokens\")\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tname: input.name,\n\t\t\t\ttoken_hash: hash,\n\t\t\t\tprefix,\n\t\t\t\tuser_id: userId,\n\t\t\t\tscopes: JSON.stringify(input.scopes),\n\t\t\t\texpires_at: input.expiresAt ?? null,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tconst info: ApiTokenInfo = {\n\t\t\tid,\n\t\t\tname: input.name,\n\t\t\tprefix,\n\t\t\tscopes: input.scopes,\n\t\t\tuserId,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tlastUsedAt: null,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\n\t\treturn { success: true, data: { token: raw, info } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_CREATE_ERROR\",\n\t\t\t\tmessage: \"Failed to create API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * List all API tokens for a user (never returns the raw token or hash).\n */\nexport async function handleApiTokenList(\n\tdb: Kysely<Database>,\n\tuserId: string,\n): Promise<ApiResult<{ items: ApiTokenInfo[] }>> {\n\ttry {\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t\t.select([\n\t\t\t\t\"id\",\n\t\t\t\t\"name\",\n\t\t\t\t\"prefix\",\n\t\t\t\t\"scopes\",\n\t\t\t\t\"user_id\",\n\t\t\t\t\"expires_at\",\n\t\t\t\t\"last_used_at\",\n\t\t\t\t\"created_at\",\n\t\t\t])\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.orderBy(\"created_at\", \"desc\")\n\t\t\t.execute();\n\n\t\tconst items: ApiTokenInfo[] = rows.map((row) => ({\n\t\t\tid: row.id,\n\t\t\tname: row.name,\n\t\t\tprefix: row.prefix,\n\t\t\tscopes: JSON.parse(row.scopes) as string[],\n\t\t\tuserId: row.user_id,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tcreatedAt: row.created_at,\n\t\t}));\n\n\t\treturn { success: true, data: { items } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_LIST_ERROR\",\n\t\t\t\tmessage: \"Failed to list API tokens\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Revoke (delete) an API token.\n */\nexport async function handleApiTokenRevoke(\n\tdb: Kysely<Database>,\n\ttokenId: string,\n\tuserId: string,\n): Promise<ApiResult<{ revoked: boolean }>> {\n\ttry {\n\t\tconst result = await db\n\t\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t\t.where(\"id\", \"=\", tokenId)\n\t\t\t.where(\"user_id\", \"=\", userId)\n\t\t\t.executeTakeFirst();\n\n\t\tif (result.numDeletedRows === 0n) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: { code: \"NOT_FOUND\", message: \"Token not found\" },\n\t\t\t};\n\t\t}\n\n\t\treturn { success: true, data: { revoked: true } };\n\t} catch {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"TOKEN_REVOKE_ERROR\",\n\t\t\t\tmessage: \"Failed to revoke API token\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n/**\n * Delete every token with the given name for a user, returning how many were\n * removed. Token names aren't unique, so this is a bulk delete — used by the\n * dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new\n * one on every reset.\n */\nexport async function deleteApiTokensByName(\n\tdb: Kysely<Database>,\n\tuserId: string,\n\tname: string,\n): Promise<number> {\n\tconst result = await db\n\t\t.deleteFrom(\"_emdash_api_tokens\")\n\t\t.where(\"user_id\", \"=\", userId)\n\t\t.where(\"name\", \"=\", name)\n\t\t.executeTakeFirst();\n\treturn Number(result.numDeletedRows ?? 0n);\n}\n\n/**\n * Resolve a raw API token (ec_pat_...) to a user ID and scopes.\n * Updates last_used_at on successful lookup.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveApiToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<{ userId: string; scopes: string[] } | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_api_tokens\")\n\t\t.select([\"id\", \"user_id\", \"scopes\", \"expires_at\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (row.expires_at && new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\t// Update last_used_at (fire-and-forget, don't block the request)\n\tdb.updateTable(\"_emdash_api_tokens\")\n\t\t.set({ last_used_at: new Date().toISOString() })\n\t\t.where(\"id\", \"=\", row.id)\n\t\t.execute()\n\t\t.catch(() => {}); // Non-critical, swallow errors\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t};\n}\n\n/**\n * Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.\n * Returns null if the token is invalid or expired.\n */\nexport async function resolveOAuthToken(\n\tdb: Kysely<Database>,\n\trawToken: string,\n): Promise<{ userId: string; scopes: string[] } | null> {\n\tconst hash = hashApiToken(rawToken);\n\n\tconst row = await db\n\t\t.selectFrom(\"_emdash_oauth_tokens\")\n\t\t.select([\"user_id\", \"scopes\", \"expires_at\", \"token_type\"])\n\t\t.where(\"token_hash\", \"=\", hash)\n\t\t.where(\"token_type\", \"=\", \"access\")\n\t\t.executeTakeFirst();\n\n\tif (!row) return null;\n\n\t// Check expiry\n\tif (new Date(row.expires_at) < new Date()) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tuserId: row.user_id,\n\t\tscopes: JSON.parse(row.scopes) as string[],\n\t};\n}\n"],"mappings":";;;;;;;AA4CA,eAAsB,qBACrB,IACA,QACA,OAK2C;AAC3C,KAAI;EACH,MAAM,KAAK,MAAM;EACjB,MAAM,EAAE,KAAK,MAAM,WAAW,sBAAsB,UAAU;AAE9D,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP;GACA,MAAM,MAAM;GACZ,YAAY;GACZ;GACA,SAAS;GACT,QAAQ,KAAK,UAAU,MAAM,OAAO;GACpC,YAAY,MAAM,aAAa;GAC/B,CAAC,CACD,SAAS;AAaX,SAAO;GAAE,SAAS;GAAM,MAAM;IAAE,OAAO;IAAK,MAXjB;KAC1B;KACA,MAAM,MAAM;KACZ;KACA,QAAQ,MAAM;KACd;KACA,WAAW,MAAM,aAAa;KAC9B,YAAY;KACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;KACnC;IAEiD;GAAE;SAC7C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,mBACrB,IACA,QACgD;AAChD,KAAI;AA4BH,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,QA3BnB,MAAM,GACjB,WAAW,qBAAqB,CAChC,OAAO;IACP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,CAAC,CACD,MAAM,WAAW,KAAK,OAAO,CAC7B,QAAQ,cAAc,OAAO,CAC7B,SAAS,EAEwB,KAAK,SAAS;IAChD,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;IAC9B,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,EAAE,EAEoC;GAAE;SAClC;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;AAOH,eAAsB,qBACrB,IACA,SACA,QAC2C;AAC3C,KAAI;AAOH,OANe,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,MAAM,KAAK,QAAQ,CACzB,MAAM,WAAW,KAAK,OAAO,CAC7B,kBAAkB,EAET,mBAAmB,GAC7B,QAAO;GACN,SAAS;GACT,OAAO;IAAE,MAAM;IAAa,SAAS;IAAmB;GACxD;AAGF,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,SAAS,MAAM;GAAE;SAC1C;AACP,SAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS;IACT;GACD;;;;;;;;;AAUH,eAAsB,sBACrB,IACA,QACA,MACkB;CAClB,MAAM,SAAS,MAAM,GACnB,WAAW,qBAAqB,CAChC,MAAM,WAAW,KAAK,OAAO,CAC7B,MAAM,QAAQ,KAAK,KAAK,CACxB,kBAAkB;AACpB,QAAO,OAAO,OAAO,kBAAkB,GAAG;;;;;;;AAQ3C,eAAsB,gBACrB,IACA,UACuD;CACvD,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,qBAAqB,CAChC,OAAO;EAAC;EAAM;EAAW;EAAU;EAAa,CAAC,CACjD,MAAM,cAAc,KAAK,KAAK,CAC9B,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,cAAc,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CAC1D,QAAO;AAIR,IAAG,YAAY,qBAAqB,CAClC,IAAI,EAAE,+BAAc,IAAI,MAAM,EAAC,aAAa,EAAE,CAAC,CAC/C,MAAM,MAAM,KAAK,IAAI,GAAG,CACxB,SAAS,CACT,YAAY,GAAG;AAEjB,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B;;;;;;AAOF,eAAsB,kBACrB,IACA,UACuD;CACvD,MAAM,OAAO,aAAa,SAAS;CAEnC,MAAM,MAAM,MAAM,GAChB,WAAW,uBAAuB,CAClC,OAAO;EAAC;EAAW;EAAU;EAAc;EAAa,CAAC,CACzD,MAAM,cAAc,KAAK,KAAK,CAC9B,MAAM,cAAc,KAAK,SAAS,CAClC,kBAAkB;AAEpB,KAAI,CAAC,IAAK,QAAO;AAGjB,KAAI,IAAI,KAAK,IAAI,WAAW,mBAAG,IAAI,MAAM,CACxC,QAAO;AAGR,QAAO;EACN,QAAQ,IAAI;EACZ,QAAQ,KAAK,MAAM,IAAI,OAAO;EAC9B"}

package/dist/{apply-B4SIOxR1.mjs → apply-DLmM3R7f.mjs}

@@ -1,18 +1,18 @@
-import { c as __exportAll } from "./runner-BLIDKpmA.mjs";
+import { c as __exportAll } from "./runner-nEzvnogG.mjs";
 import { a as resolveConfiguredLocale, r as getI18nConfig } from "./config-C3EBstHi.mjs";
-import { i as RevisionRepository, t as ContentRepository } from "./content-DjvM0T92.mjs";
+import { i as RevisionRepository, t as ContentRepository } from "./content-CNfMWuhY.mjs";
 import { t as MediaRepository } from "./media-BBm8Wg3f.mjs";
 import { t as withTransaction } from "./transaction-0KOpOyMu.mjs";
-import { t as TaxonomyRepository } from "./taxonomy-tJepplLL.mjs";
-import { t as RedirectRepository } from "./redirect-CZkbozu9.mjs";
-import { t as BylineRepository } from "./byline-DuhF7NWl.mjs";
-import { t as imageSize } from "./dist-89xCrGqi.mjs";
-import { t as FTSManager } from "./fts-manager-Do1BlW2r.mjs";
-import { l as markContentMediaUsageCollectionStaleSafely } from "./content-refresh-Bwp-8yGy.mjs";
-import { n as SchemaRegistry } from "./registry-AZAsRsor.mjs";
-import { c as setSiteSettings } from "./settings--wobrkkC.mjs";
-import { a as ssrfSafeFetch, s as validateExternalUrl } from "./ssrf-5sIM5jzl.mjs";
-import { t as validateSeed } from "./validate-DE_LRwo9.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-DP1vny4K.mjs";
+import { t as RedirectRepository } from "./redirect-DId44BS1.mjs";
+import { t as BylineRepository } from "./byline-Vdi85CsZ.mjs";
+import { t as imageSize } from "./dist-BAsh8dbf.mjs";
+import { t as FTSManager } from "./fts-manager-iddym8cd.mjs";
+import { l as markContentMediaUsageCollectionStaleSafely } from "./content-refresh-GTMyi2Xy.mjs";
+import { n as SchemaRegistry } from "./registry-DTqaqxed.mjs";
+import { c as setSiteSettings } from "./settings-DcMjREe5.mjs";
+import { a as ssrfSafeFetch, s as validateExternalUrl } from "./ssrf-gl4gFNhw.mjs";
+import { t as validateSeed } from "./validate-D8VPn4Hv.mjs";
 import { ulid } from "ulidx";
 import mime from "mime/lite";
 
@@ -152,7 +152,9 @@ async function applySeed(db, seed, options = {}) {
 						routable: collection.routable,
 						hidden: collection.hidden,
 						sortOrder: collection.sortOrder,
-						commentsEnabled: collection.commentsEnabled
+						group: collection.group,
+						commentsEnabled: collection.commentsEnabled,
+						editLocking: collection.editLocking
 					});
 					result.collections.updated++;
 					for (const field of collection.fields) if (await registry.getField(collection.slug, field.slug)) {
@@ -217,7 +219,9 @@ async function applySeed(db, seed, options = {}) {
 				routable: collection.routable,
 				hidden: collection.hidden,
 				sortOrder: collection.sortOrder,
-				commentsEnabled: collection.commentsEnabled
+				group: collection.group,
+				commentsEnabled: collection.commentsEnabled,
+				editLocking: collection.editLocking
 			}, fields);
 			await applyDisplayDateFields(registry, collection);
 			result.collections.created++;
@@ -298,7 +302,7 @@ async function applySeed(db, seed, options = {}) {
 				}
 			}
 		}
-		const { invalidateTaxonomyDefsCache } = await import("./taxonomies-Wfy_Lg12.mjs").then((n) => n.f);
+		const { invalidateTaxonomyDefsCache } = await import("./taxonomies-NcFDq5Gg.mjs").then((n) => n.f);
 		invalidateTaxonomyDefsCache();
 	}
 	if (includeContent && seed.bylines) {
@@ -589,9 +593,9 @@ async function applySeed(db, seed, options = {}) {
 			}
 		}
 	}
-	const { invalidateBylineCache } = await import("./bylines-CJ5nd6Lw.mjs").then((n) => n.t);
-	const { invalidateRedirectCache } = await import("./cache-BF5Kvn59.mjs").then((n) => n.t);
-	const { invalidateUrlPatternCache } = await import("./query-BZKZcG5b.mjs").then((n) => n.o);
+	const { invalidateBylineCache } = await import("./bylines-BX8QhcTk.mjs").then((n) => n.t);
+	const { invalidateRedirectCache } = await import("./cache--7HKu5Xm.mjs").then((n) => n.t);
+	const { invalidateUrlPatternCache } = await import("./query-DygOte9M.mjs").then((n) => n.o);
 	invalidateBylineCache();
 	invalidateRedirectCache();
 	invalidateUrlPatternCache();
@@ -677,7 +681,7 @@ async function applyContentTaxonomies(db, collectionSlug, contentId, entry, isUp
 	if (isUpdate) await termRepo.clearEntryTerms(collectionSlug, contentId);
 	if (!entry.taxonomies) {
 		if (isUpdate) {
-			const { invalidateTermCache } = await import("./taxonomies-Wfy_Lg12.mjs").then((n) => n.f);
+			const { invalidateTermCache } = await import("./taxonomies-NcFDq5Gg.mjs").then((n) => n.f);
 			invalidateTermCache();
 		}
 		return;
@@ -686,7 +690,7 @@ async function applyContentTaxonomies(db, collectionSlug, contentId, entry, isUp
 		const term = await termRepo.findBySlug(taxonomyName, termSlug);
 		if (term) await termRepo.attachToEntry(collectionSlug, contentId, term.id);
 	}
-	const { invalidateTermCache } = await import("./taxonomies-Wfy_Lg12.mjs").then((n) => n.f);
+	const { invalidateTermCache } = await import("./taxonomies-NcFDq5Gg.mjs").then((n) => n.f);
 	invalidateTermCache();
 }
 /**
@@ -977,4 +981,4 @@ function getImageDimensions(buffer) {
 
 //#endregion
 export { apply_exports as n, applySeed as t };
-//# sourceMappingURL=apply-B4SIOxR1.mjs.map
+//# sourceMappingURL=apply-DLmM3R7f.mjs.map

package/dist/apply-DLmM3R7f.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-DLmM3R7f.mjs","names":[],"sources":["../src/seed/apply.ts"],"sourcesContent":["/**\n * Seed engine - applies seed files to database\n *\n * This is the core implementation that bootstraps an EmDash site from a seed file.\n * Apply order is critical for foreign keys and references.\n */\n\nimport { imageSize } from \"image-size\";\nimport type { Kysely } from \"kysely\";\nimport mime from \"mime/lite\";\nimport { ulid } from \"ulidx\";\n\nimport { BylineRepository } from \"../database/repositories/byline.js\";\nimport { ContentRepository } from \"../database/repositories/content.js\";\nimport { MediaRepository } from \"../database/repositories/media.js\";\nimport { RedirectRepository } from \"../database/repositories/redirect.js\";\nimport { RevisionRepository } from \"../database/repositories/revision.js\";\nimport { TaxonomyRepository } from \"../database/repositories/taxonomy.js\";\nimport { withTransaction } from \"../database/transaction.js\";\nimport type { Database } from \"../database/types.js\";\nimport type { MediaValue } from \"../fields/types.js\";\nimport { getI18nConfig, resolveConfiguredLocale } from \"../i18n/config.js\";\nimport { ssrfSafeFetch, validateExternalUrl } from \"../import/ssrf.js\";\nimport { markContentMediaUsageCollectionStaleSafely } from \"../media/usage/content-refresh.js\";\nimport { SchemaRegistry } from \"../schema/registry.js\";\nimport { FTSManager } from \"../search/fts-manager.js\";\nimport { setSiteSettings } from \"../settings/index.js\";\nimport type { Storage } from \"../storage/types.js\";\nimport type {\n\tSeedFile,\n\tSeedApplyOptions,\n\tSeedApplyResult,\n\tSeedCollection,\n\tSeedTaxonomyTerm,\n\tSeedMenuItem,\n\tSeedWidget,\n\tSeedMediaReference,\n\tSeedBylineAvatar,\n} from \"./types.js\";\n\n/**\n * Set a collection's `titleField`/`dateField`: a separate write run after the\n * fields exist, so `updateCollection` can validate them. No-op when neither is set.\n */\nasync function applyDisplayDateFields(\n\tregistry: SchemaRegistry,\n\tcollection: SeedCollection,\n): Promise<void> {\n\tif (collection.titleField === undefined && collection.dateField === undefined) return;\n\tawait registry.updateCollection(collection.slug, {\n\t\ttitleField: collection.titleField,\n\t\tdateField: collection.dateField,\n\t});\n}\n\nconst FILE_EXTENSION_PATTERN = /\\.([a-z0-9]+)(?:\\?|$)/i;\nimport { validateSeed } from \"./validate.js\";\n\n/** Pattern to remove file extensions */\nconst EXTENSION_PATTERN = /\\.[^.]+$/;\n\n/** Pattern to remove query parameters */\nconst QUERY_PARAM_PATTERN = /\\?.*$/;\n\n/** Pattern to remove non-alphanumeric characters (except dash and underscore) */\nconst SANITIZE_PATTERN = /[^a-zA-Z0-9_-]/g;\n\n/** Pattern to collapse multiple hyphens */\nconst MULTIPLE_HYPHENS_PATTERN = /-+/g;\n\n/**\n * Apply a seed file to the database\n *\n * This function is idempotent - safe to run multiple times.\n *\n * @param db - Kysely database instance\n * @param seed - Seed file to apply\n * @param options - Application options\n * @returns Result summary\n */\nexport async function applySeed(\n\tdb: Kysely<Database>,\n\tseed: SeedFile,\n\toptions: SeedApplyOptions = {},\n): Promise<SeedApplyResult> {\n\t// Validate seed first\n\tconst validation = validateSeed(seed);\n\tif (!validation.valid) {\n\t\tthrow new Error(`Invalid seed file:\\n${validation.errors.join(\"\\n\")}`);\n\t}\n\n\tconst {\n\t\tincludeContent = false,\n\t\tstorage,\n\t\tskipMediaDownload = false,\n\t\tonConflict = \"skip\",\n\t} = options;\n\n\t// Result counters\n\tconst result: SeedApplyResult = {\n\t\tcollections: { created: 0, skipped: 0, updated: 0 },\n\t\tfields: { created: 0, skipped: 0, updated: 0 },\n\t\ttaxonomies: { created: 0, terms: 0 },\n\t\tbylines: { created: 0, skipped: 0, updated: 0 },\n\t\tmenus: { created: 0, items: 0 },\n\t\tredirects: { created: 0, skipped: 0, updated: 0 },\n\t\twidgetAreas: { created: 0, widgets: 0 },\n\t\tsections: { created: 0, skipped: 0, updated: 0 },\n\t\tsettings: { applied: 0 },\n\t\tcontent: { created: 0, skipped: 0, updated: 0 },\n\t\tmedia: { created: 0, skipped: 0 },\n\t};\n\n\t// Media context for $media resolution\n\tconst mediaContext: MediaContext = {\n\t\tdb,\n\t\tstorage: storage ?? null,\n\t\tskipMediaDownload,\n\t\tmediaCache: new Map(), // Cache downloaded media by URL to avoid re-downloading\n\t};\n\n\t// Apply order (critical for foreign keys and references):\n\t// 1. Site settings\n\t// 2. Collections + Fields\n\t// 3. Taxonomy definitions + Terms\n\t// 4. Content (so menu refs can resolve)\n\t// 5. Menus + Menu items (can now resolve content refs)\n\t// 6. Redirects\n\t// 7. Widget areas + Widgets\n\n\t// Track seed content IDs for reference resolution (shared across content and menus)\n\tconst seedIdMap = new Map<string, string>(); // seed id -> real entry id\n\tconst seedBylineIdMap = new Map<string, string>(); // seed byline id -> real byline id\n\tconst staleMarkedContentCollections = new Set<string>();\n\tconst failedStaleContentCollections = new Set<string>();\n\n\t// Fallback locale for rows that omit an explicit `locale`. Prefer the runtime\n\t// config (runtime-driven seeds), then the seed's self-described `defaultLocale`\n\t// (CLI exports run outside the runtime), and only then `en`. Without the\n\t// seed-carried default, a non-`en` single-locale project would be rewritten to\n\t// `en` on apply (#1421).\n\tconst defaultLocale = getI18nConfig()?.defaultLocale ?? seed.defaultLocale ?? \"en\";\n\tconst markSeedContentCollectionStale = async (collectionSlug: string): Promise<void> => {\n\t\tif (staleMarkedContentCollections.has(collectionSlug)) return;\n\t\tconst marked = await markContentMediaUsageCollectionStaleSafely(\n\t\t\tdb,\n\t\t\tcollectionSlug,\n\t\t\t\"CONTENT_USAGE_STALE\",\n\t\t);\n\t\tif (marked) {\n\t\t\tstaleMarkedContentCollections.add(collectionSlug);\n\t\t\tfailedStaleContentCollections.delete(collectionSlug);\n\t\t} else {\n\t\t\tfailedStaleContentCollections.add(collectionSlug);\n\t\t}\n\t};\n\tconst retryFailedSeedContentStaleMarks = async (): Promise<void> => {\n\t\tfor (const collectionSlug of failedStaleContentCollections) {\n\t\t\tconst marked = await markContentMediaUsageCollectionStaleSafely(\n\t\t\t\tdb,\n\t\t\t\tcollectionSlug,\n\t\t\t\t\"CONTENT_USAGE_STALE\",\n\t\t\t);\n\t\t\tif (marked) {\n\t\t\t\tstaleMarkedContentCollections.add(collectionSlug);\n\t\t\t\tfailedStaleContentCollections.delete(collectionSlug);\n\t\t\t}\n\t\t}\n\t};\n\n\t// 1. Site settings\n\tif (seed.settings) {\n\t\tawait setSiteSettings(seed.settings, db);\n\t\tresult.settings.applied = Object.keys(seed.settings).length;\n\t}\n\n\t// 2-3. Collections and Fields\n\tif (seed.collections) {\n\t\tconst registry = new SchemaRegistry(db);\n\n\t\tfor (const collection of seed.collections) {\n\t\t\t// Check if collection exists\n\t\t\tconst existing = await registry.getCollection(collection.slug);\n\n\t\t\tif (existing) {\n\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\tthrow new Error(`Conflict: collection \"${collection.slug}\" already exists`);\n\t\t\t\t}\n\n\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\tawait registry.updateCollection(collection.slug, {\n\t\t\t\t\t\tlabel: collection.label,\n\t\t\t\t\t\tlabelSingular: collection.labelSingular,\n\t\t\t\t\t\tdescription: collection.description,\n\t\t\t\t\t\ticon: collection.icon,\n\t\t\t\t\t\tadmin: collection.admin,\n\t\t\t\t\t\tsupports: collection.supports || [],\n\t\t\t\t\t\turlPattern: collection.urlPattern,\n\t\t\t\t\t\troutable: collection.routable,\n\t\t\t\t\t\thidden: collection.hidden,\n\t\t\t\t\t\tsortOrder: collection.sortOrder,\n\t\t\t\t\t\tgroup: collection.group,\n\t\t\t\t\t\tcommentsEnabled: collection.commentsEnabled,\n\t\t\t\t\t\teditLocking: collection.editLocking,\n\t\t\t\t\t});\n\t\t\t\t\tresult.collections.updated++;\n\n\t\t\t\t\t// Update or create fields\n\t\t\t\t\tfor (const field of collection.fields) {\n\t\t\t\t\t\tconst existingField = await registry.getField(collection.slug, field.slug);\n\t\t\t\t\t\tif (existingField) {\n\t\t\t\t\t\t\tawait registry.updateField(collection.slug, field.slug, {\n\t\t\t\t\t\t\t\tlabel: field.label,\n\t\t\t\t\t\t\t\ttype: field.type,\n\t\t\t\t\t\t\t\trequired: field.required || false,\n\t\t\t\t\t\t\t\tunique: field.unique || false,\n\t\t\t\t\t\t\t\tsearchable: field.searchable || false,\n\t\t\t\t\t\t\t\tindexed: field.indexed || false,\n\t\t\t\t\t\t\t\tdefaultValue: field.defaultValue,\n\t\t\t\t\t\t\t\tvalidation: field.validation,\n\t\t\t\t\t\t\t\twidget: field.widget,\n\t\t\t\t\t\t\t\toptions: field.options,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tresult.fields.updated++;\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tawait registry.createField(collection.slug, {\n\t\t\t\t\t\t\t\tslug: field.slug,\n\t\t\t\t\t\t\t\tlabel: field.label,\n\t\t\t\t\t\t\t\ttype: field.type,\n\t\t\t\t\t\t\t\trequired: field.required || false,\n\t\t\t\t\t\t\t\tunique: field.unique || false,\n\t\t\t\t\t\t\t\tsearchable: field.searchable || false,\n\t\t\t\t\t\t\t\tindexed: field.indexed || false,\n\t\t\t\t\t\t\t\tdefaultValue: field.defaultValue,\n\t\t\t\t\t\t\t\tvalidation: field.validation,\n\t\t\t\t\t\t\t\twidget: field.widget,\n\t\t\t\t\t\t\t\toptions: field.options,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tresult.fields.created++;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\t// Second write: display/date fields, now that fields exist.\n\t\t\t\t\tawait applyDisplayDateFields(registry, collection);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// skip\n\t\t\t\tresult.collections.skipped++;\n\t\t\t\tresult.fields.skipped += collection.fields.length;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst fields = collection.fields.map((field) => ({\n\t\t\t\tslug: field.slug,\n\t\t\t\tlabel: field.label,\n\t\t\t\ttype: field.type,\n\t\t\t\trequired: field.required || false,\n\t\t\t\tunique: field.unique || false,\n\t\t\t\tsearchable: field.searchable || false,\n\t\t\t\tindexed: field.indexed || false,\n\t\t\t\tdefaultValue: field.defaultValue,\n\t\t\t\tvalidation: field.validation,\n\t\t\t\twidget: field.widget,\n\t\t\t\toptions: field.options,\n\t\t\t}));\n\n\t\t\t// Create a fresh seed schema in bulk to stay within D1's query budget.\n\t\t\tawait registry.createSeedCollection(\n\t\t\t\t{\n\t\t\t\t\tslug: collection.slug,\n\t\t\t\t\tlabel: collection.label,\n\t\t\t\t\tlabelSingular: collection.labelSingular,\n\t\t\t\t\tdescription: collection.description,\n\t\t\t\t\ticon: collection.icon,\n\t\t\t\t\tadmin: collection.admin,\n\t\t\t\t\tsupports: collection.supports || [],\n\t\t\t\t\turlPattern: collection.urlPattern,\n\t\t\t\t\troutable: collection.routable,\n\t\t\t\t\thidden: collection.hidden,\n\t\t\t\t\tsortOrder: collection.sortOrder,\n\t\t\t\t\tgroup: collection.group,\n\t\t\t\t\tcommentsEnabled: collection.commentsEnabled,\n\t\t\t\t\teditLocking: collection.editLocking,\n\t\t\t\t},\n\t\t\t\tfields,\n\t\t\t);\n\t\t\t// titleField/dateField reference existing fields, so set them after\n\t\t\t// the schema exists.\n\t\t\tawait applyDisplayDateFields(registry, collection);\n\t\t\tresult.collections.created++;\n\t\t\tresult.fields.created += fields.length;\n\t\t}\n\t}\n\n\t// 4-5. Taxonomies\n\tif (seed.taxonomies) {\n\t\t// seed-local id -> resolved info, used to wire `translationOf` refs.\n\t\tconst defSeedIdMap = new Map<string, { id: string; translationGroup: string }>();\n\t\tconst termSeedIdMap = new Map<string, string>();\n\n\t\tfor (const taxonomy of seed.taxonomies) {\n\t\t\tconst defLocale = resolveConfiguredLocale(taxonomy.locale ?? defaultLocale);\n\n\t\t\t// (name, locale) is the UNIQUE key after migration 036.\n\t\t\tconst existingDef = await db\n\t\t\t\t.selectFrom(\"_emdash_taxonomy_defs\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"name\", \"=\", taxonomy.name)\n\t\t\t\t.where(\"locale\", \"=\", defLocale)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tlet defId: string;\n\t\t\tlet defTranslationGroup: string;\n\n\t\t\tif (existingDef) {\n\t\t\t\tdefId = existingDef.id;\n\t\t\t\tdefTranslationGroup = existingDef.translation_group ?? existingDef.id;\n\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\tthrow new Error(`Conflict: taxonomy \"${taxonomy.name}\" (${defLocale}) already exists`);\n\t\t\t\t}\n\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\tawait db\n\t\t\t\t\t\t.updateTable(\"_emdash_taxonomy_defs\")\n\t\t\t\t\t\t.set({\n\t\t\t\t\t\t\tlabel: taxonomy.label,\n\t\t\t\t\t\t\tlabel_singular: taxonomy.labelSingular ?? null,\n\t\t\t\t\t\t\thierarchical: taxonomy.hierarchical ? 1 : 0,\n\t\t\t\t\t\t\tcollections: JSON.stringify(taxonomy.collections),\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.where(\"id\", \"=\", existingDef.id)\n\t\t\t\t\t\t.execute();\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tdefId = ulid();\n\t\t\t\tdefTranslationGroup = defId;\n\t\t\t\tif (taxonomy.translationOf) {\n\t\t\t\t\tconst source = defSeedIdMap.get(taxonomy.translationOf);\n\t\t\t\t\tif (source) defTranslationGroup = source.translationGroup;\n\t\t\t\t\telse\n\t\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\t`taxonomy \"${taxonomy.name}\" (${defLocale}): translationOf \"${taxonomy.translationOf}\" not found yet; minting a fresh group.`,\n\t\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait db\n\t\t\t\t\t.insertInto(\"_emdash_taxonomy_defs\")\n\t\t\t\t\t.values({\n\t\t\t\t\t\tid: defId,\n\t\t\t\t\t\tname: taxonomy.name,\n\t\t\t\t\t\tlabel: taxonomy.label,\n\t\t\t\t\t\tlabel_singular: taxonomy.labelSingular ?? null,\n\t\t\t\t\t\thierarchical: taxonomy.hierarchical ? 1 : 0,\n\t\t\t\t\t\tcollections: JSON.stringify(taxonomy.collections),\n\t\t\t\t\t\tlocale: defLocale,\n\t\t\t\t\t\ttranslation_group: defTranslationGroup,\n\t\t\t\t\t})\n\t\t\t\t\t.execute();\n\t\t\t\tresult.taxonomies.created++;\n\t\t\t}\n\n\t\t\tif (taxonomy.id)\n\t\t\t\tdefSeedIdMap.set(taxonomy.id, { id: defId, translationGroup: defTranslationGroup });\n\n\t\t\t// Create terms (if provided)\n\t\t\tif (includeContent && taxonomy.terms && taxonomy.terms.length > 0) {\n\t\t\t\tconst termRepo = new TaxonomyRepository(db);\n\n\t\t\t\tif (taxonomy.hierarchical) {\n\t\t\t\t\tawait applyHierarchicalTerms(\n\t\t\t\t\t\ttermRepo,\n\t\t\t\t\t\ttaxonomy.name,\n\t\t\t\t\t\tdefLocale,\n\t\t\t\t\t\ttaxonomy.terms,\n\t\t\t\t\t\ttermSeedIdMap,\n\t\t\t\t\t\tresult,\n\t\t\t\t\t\tonConflict,\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\tfor (const term of taxonomy.terms) {\n\t\t\t\t\t\tconst termLocale = resolveConfiguredLocale(term.locale ?? defLocale);\n\t\t\t\t\t\tconst existing = await termRepo.findBySlug(taxonomy.name, term.slug, termLocale);\n\t\t\t\t\t\tif (existing) {\n\t\t\t\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t\t`Conflict: taxonomy term \"${term.slug}\" in \"${taxonomy.name}\" (${termLocale}) already exists`,\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\t\t\t\tawait termRepo.update(existing.id, {\n\t\t\t\t\t\t\t\t\tlabel: term.label,\n\t\t\t\t\t\t\t\t\tdata: term.description ? { description: term.description } : {},\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\tresult.taxonomies.terms++;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (term.id) termSeedIdMap.set(term.id, existing.id);\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tconst translationOf = term.translationOf\n\t\t\t\t\t\t\t\t? termSeedIdMap.get(term.translationOf)\n\t\t\t\t\t\t\t\t: undefined;\n\t\t\t\t\t\t\tconst created = await termRepo.create({\n\t\t\t\t\t\t\t\tname: taxonomy.name,\n\t\t\t\t\t\t\t\tslug: term.slug,\n\t\t\t\t\t\t\t\tlabel: term.label,\n\t\t\t\t\t\t\t\tdata: term.description ? { description: term.description } : undefined,\n\t\t\t\t\t\t\t\tlocale: termLocale,\n\t\t\t\t\t\t\t\ttranslationOf,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tif (term.id) termSeedIdMap.set(term.id, created.id);\n\t\t\t\t\t\t\tresult.taxonomies.terms++;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Seeded/updated defs change which taxonomies exist — clear the\n\t\t// isolate-wide defs + names caches so later reads in this isolate\n\t\t// (e.g. an auto-seed triggered mid-request) reflect them immediately.\n\t\tconst { invalidateTaxonomyDefsCache } = await import(\"../taxonomies/index.js\");\n\t\tinvalidateTaxonomyDefsCache();\n\t}\n\n\t// 6. Bylines\n\tif (includeContent && seed.bylines) {\n\t\tconst bylineRepo = new BylineRepository(db);\n\t\tfor (const byline of seed.bylines) {\n\t\t\tconst existing = await bylineRepo.findBySlug(byline.slug);\n\t\t\tif (existing) {\n\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\tthrow new Error(`Conflict: byline \"${byline.slug}\" already exists`);\n\t\t\t\t}\n\n\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\t// Resolve the avatar (reusing an existing media row by storage\n\t\t\t\t\t// key, so re-running an update stays idempotent). Only relink\n\t\t\t\t\t// when the seed supplies an avatar; otherwise leave the existing\n\t\t\t\t\t// one untouched.\n\t\t\t\t\tconst avatar = byline.avatar ? await resolveSeedBylineAvatar(db, byline.avatar) : null;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst updated = await bylineRepo.update(existing.id, {\n\t\t\t\t\t\t\tdisplayName: byline.displayName,\n\t\t\t\t\t\t\tbio: byline.bio ?? null,\n\t\t\t\t\t\t\twebsiteUrl: byline.websiteUrl ?? null,\n\t\t\t\t\t\t\tisGuest: byline.isGuest,\n\t\t\t\t\t\t\t...(avatar ? { avatarMediaId: avatar.id } : {}),\n\t\t\t\t\t\t});\n\t\t\t\t\t\t// update() returns null (no throw) if the row vanished between\n\t\t\t\t\t\t// findBySlug and here; treat that as a failure so the catch\n\t\t\t\t\t\t// cleans up any freshly-created avatar media instead of leaking it.\n\t\t\t\t\t\tif (!updated) {\n\t\t\t\t\t\t\tthrow new Error(`Byline \"${byline.slug}\" disappeared during update`);\n\t\t\t\t\t\t}\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\t// withTransaction is a no-op on D1, so undo a freshly-created\n\t\t\t\t\t\t// media row by hand to avoid orphaning it.\n\t\t\t\t\t\tif (avatar?.created) await deleteMediaRow(db, avatar.id);\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t\tseedBylineIdMap.set(byline.id, existing.id);\n\t\t\t\t\tresult.bylines.updated++;\n\t\t\t\t\tif (avatar?.created) result.media.created++;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// skip\n\t\t\t\tseedBylineIdMap.set(byline.id, existing.id);\n\t\t\t\tresult.bylines.skipped++;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst avatar = byline.avatar ? await resolveSeedBylineAvatar(db, byline.avatar) : null;\n\t\t\tlet createdId: string;\n\t\t\ttry {\n\t\t\t\tconst created = await bylineRepo.create({\n\t\t\t\t\tslug: byline.slug,\n\t\t\t\t\tdisplayName: byline.displayName,\n\t\t\t\t\tbio: byline.bio ?? null,\n\t\t\t\t\twebsiteUrl: byline.websiteUrl ?? null,\n\t\t\t\t\tisGuest: byline.isGuest,\n\t\t\t\t\tavatarMediaId: avatar?.id ?? null,\n\t\t\t\t});\n\t\t\t\tcreatedId = created.id;\n\t\t\t} catch (error) {\n\t\t\t\tif (avatar?.created) await deleteMediaRow(db, avatar.id);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tseedBylineIdMap.set(byline.id, createdId);\n\t\t\tresult.bylines.created++;\n\t\t\tif (avatar?.created) result.media.created++;\n\t\t}\n\t}\n\n\t// 7. Content (created before menus so refs can resolve)\n\tif (includeContent && seed.content) {\n\t\tconst contentRepo = new ContentRepository(db);\n\t\tconst schemaRegistry = new SchemaRegistry(db);\n\n\t\ttry {\n\t\t\t// Create content entries\n\t\t\tfor (const [collectionSlug, entries] of Object.entries(seed.content)) {\n\t\t\t\tconst collectionRoutable =\n\t\t\t\t\t(await schemaRegistry.getCollection(collectionSlug))?.routable !== false;\n\t\t\t\tfor (const entry of entries) {\n\t\t\t\t\tconst entrySlug =\n\t\t\t\t\t\ttypeof entry.slug === \"string\" && entry.slug.trim().length > 0 ? entry.slug : null;\n\t\t\t\t\t// Resolve the entry's locale up front so a non-`en` single-locale\n\t\t\t\t\t// export (which omits `locale`) is filed under the project default\n\t\t\t\t\t// rather than `en` (#1421).\n\t\t\t\t\tconst entryLocale = resolveConfiguredLocale(entry.locale ?? defaultLocale);\n\n\t\t\t\t\t// Slugful entries use the existing locale-aware key. Slugless seed\n\t\t\t\t\t// entries persist their seed ID, which keeps re-application idempotent.\n\t\t\t\t\tconst existing = entrySlug\n\t\t\t\t\t\t? await contentRepo.findBySlug(collectionSlug, entrySlug, entryLocale)\n\t\t\t\t\t\t: await contentRepo.findById(collectionSlug, entry.id);\n\n\t\t\t\t\tif (existing) {\n\t\t\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t`Conflict: content \"${entrySlug ?? entry.id}\" in \"${collectionSlug}\" already exists`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\t\t\t// Resolve $ref and $media in data\n\t\t\t\t\t\t\tconst resolvedData = await resolveReferences(\n\t\t\t\t\t\t\t\tentry.data,\n\t\t\t\t\t\t\t\tseedIdMap,\n\t\t\t\t\t\t\t\tmediaContext,\n\t\t\t\t\t\t\t\tresult,\n\t\t\t\t\t\t\t);\n\n\t\t\t\t\t\t\t// Update content + bylines + taxonomies atomically\n\t\t\t\t\t\t\tconst status = entry.status || \"published\";\n\t\t\t\t\t\t\tlet contentMutated = false;\n\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\tawait withTransaction(db, async (trx) => {\n\t\t\t\t\t\t\t\t\tconst trxContentRepo = new ContentRepository(trx);\n\t\t\t\t\t\t\t\t\tconst trxBylineRepo = new BylineRepository(trx);\n\t\t\t\t\t\t\t\t\tconst trxRevisionRepo = new RevisionRepository(trx);\n\n\t\t\t\t\t\t\t\t\tawait trxContentRepo.update(collectionSlug, existing.id, {\n\t\t\t\t\t\t\t\t\t\tstatus,\n\t\t\t\t\t\t\t\t\t\tdata: resolvedData,\n\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\tcontentMutated = true;\n\n\t\t\t\t\t\t\t\t\tawait applyContentBylines(\n\t\t\t\t\t\t\t\t\t\ttrxBylineRepo,\n\t\t\t\t\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t\t\t\t\t\texisting.id,\n\t\t\t\t\t\t\t\t\t\tentry,\n\t\t\t\t\t\t\t\t\t\tseedBylineIdMap,\n\t\t\t\t\t\t\t\t\t\ttrue,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\tawait applyContentTaxonomies(trx, collectionSlug, existing.id, entry, true);\n\n\t\t\t\t\t\t\t\t\t// Seed is declarative — when status is \"published\", promote to a live\n\t\t\t\t\t\t\t\t\t// revision so the admin UI shows \"Unpublish\" instead of \"Save & Publish\"\n\t\t\t\t\t\t\t\t\t// and `live_revision_id` is populated for downstream queries.\n\t\t\t\t\t\t\t\t\t//\n\t\t\t\t\t\t\t\t\t// Create a fresh revision from the updated data and stage it as the\n\t\t\t\t\t\t\t\t\t// draft so `publish()` picks it up instead of re-syncing stale data\n\t\t\t\t\t\t\t\t\t// from an existing live revision.\n\t\t\t\t\t\t\t\t\tif (status === \"published\") {\n\t\t\t\t\t\t\t\t\t\tconst draft = await trxRevisionRepo.create({\n\t\t\t\t\t\t\t\t\t\t\tcollection: collectionSlug,\n\t\t\t\t\t\t\t\t\t\t\tentryId: existing.id,\n\t\t\t\t\t\t\t\t\t\t\tdata: resolvedData,\n\t\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\t\t\t\tawait trxContentRepo.setDraftRevision(collectionSlug, existing.id, draft.id);\n\t\t\t\t\t\t\t\t\t\t\tawait trxContentRepo.publish(\n\t\t\t\t\t\t\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t\t\t\t\t\t\t\texisting.id,\n\t\t\t\t\t\t\t\t\t\t\t\tundefined,\n\t\t\t\t\t\t\t\t\t\t\t\tfalse,\n\t\t\t\t\t\t\t\t\t\t\t\tundefined,\n\t\t\t\t\t\t\t\t\t\t\t\ttrue,\n\t\t\t\t\t\t\t\t\t\t\t\tcollectionRoutable,\n\t\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\t\t\t\t\tawait trxRevisionRepo.deleteIfUnreferenced(\n\t\t\t\t\t\t\t\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t\t\t\t\t\t\t\t\texisting.id,\n\t\t\t\t\t\t\t\t\t\t\t\t\tdraft.id,\n\t\t\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t\t\t} catch (cleanupError) {\n\t\t\t\t\t\t\t\t\t\t\t\tconsole.error(\n\t\t\t\t\t\t\t\t\t\t\t\t\t`[seed] Failed to clean up unstaged revision ${draft.id}:`,\n\t\t\t\t\t\t\t\t\t\t\t\t\tcleanupError,\n\t\t\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t\tthrow error;\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\t\t\tif (contentMutated) await markSeedContentCollectionStale(collectionSlug);\n\t\t\t\t\t\t\t\tthrow error;\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tseedIdMap.set(entry.id, existing.id);\n\t\t\t\t\t\t\tresult.content.updated++;\n\t\t\t\t\t\t\tawait markSeedContentCollectionStale(collectionSlug);\n\t\t\t\t\t\t\tcontinue;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// skip\n\t\t\t\t\t\tresult.content.skipped++;\n\t\t\t\t\t\tseedIdMap.set(entry.id, existing.id);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\n\t\t\t\t\t// Resolve $ref and $media in data\n\t\t\t\t\tconst resolvedData = await resolveReferences(entry.data, seedIdMap, mediaContext, result);\n\n\t\t\t\t\t// Resolve translationOf: map from seed-local ID to real EmDash ID\n\t\t\t\t\tlet translationOf: string | undefined;\n\t\t\t\t\tif (entry.translationOf) {\n\t\t\t\t\t\tconst sourceId = seedIdMap.get(entry.translationOf);\n\t\t\t\t\t\tif (!sourceId) {\n\t\t\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\t\t`content.${collectionSlug}: translationOf \"${entry.translationOf}\" not found (not yet created or missing). Skipping translation link.`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\ttranslationOf = sourceId;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\t// Create entry + bylines + taxonomies atomically\n\t\t\t\t\tconst status = entry.status || \"published\";\n\t\t\t\t\tlet contentMutated = false;\n\t\t\t\t\tlet created: Awaited<ReturnType<ContentRepository[\"create\"]>>;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tcreated = await withTransaction(db, async (trx) => {\n\t\t\t\t\t\t\tconst trxContentRepo = new ContentRepository(trx);\n\t\t\t\t\t\t\tconst trxBylineRepo = new BylineRepository(trx);\n\n\t\t\t\t\t\t\tconst item = await trxContentRepo.create({\n\t\t\t\t\t\t\t\t...(entrySlug ? {} : { id: entry.id }),\n\t\t\t\t\t\t\t\ttype: collectionSlug,\n\t\t\t\t\t\t\t\tslug: entrySlug,\n\t\t\t\t\t\t\t\tstatus,\n\t\t\t\t\t\t\t\tdata: resolvedData,\n\t\t\t\t\t\t\t\tlocale: entryLocale,\n\t\t\t\t\t\t\t\ttranslationOf,\n\t\t\t\t\t\t\t\tpublishedAt: status === \"published\" ? new Date().toISOString() : null,\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tcontentMutated = true;\n\n\t\t\t\t\t\t\tawait applyContentBylines(\n\t\t\t\t\t\t\t\ttrxBylineRepo,\n\t\t\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t\t\t\titem.id,\n\t\t\t\t\t\t\t\tentry,\n\t\t\t\t\t\t\t\tseedBylineIdMap,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tawait applyContentTaxonomies(trx, collectionSlug, item.id, entry, false);\n\n\t\t\t\t\t\t\t// Seed is declarative — when status is \"published\", promote to a live\n\t\t\t\t\t\t\t// revision so the admin UI shows \"Unpublish\" instead of \"Save & Publish\"\n\t\t\t\t\t\t\t// and `live_revision_id` is populated for downstream queries.\n\t\t\t\t\t\t\tif (status === \"published\") {\n\t\t\t\t\t\t\t\tawait trxContentRepo.publish(\n\t\t\t\t\t\t\t\t\tcollectionSlug,\n\t\t\t\t\t\t\t\t\titem.id,\n\t\t\t\t\t\t\t\t\tundefined,\n\t\t\t\t\t\t\t\t\tfalse,\n\t\t\t\t\t\t\t\t\tundefined,\n\t\t\t\t\t\t\t\t\ttrue,\n\t\t\t\t\t\t\t\t\tcollectionRoutable,\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\treturn item;\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tif (contentMutated) await markSeedContentCollectionStale(collectionSlug);\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\n\t\t\t\t\tseedIdMap.set(entry.id, created.id);\n\t\t\t\t\tresult.content.created++;\n\t\t\t\t\tawait markSeedContentCollectionStale(collectionSlug);\n\t\t\t\t}\n\t\t\t}\n\t\t} finally {\n\t\t\tawait retryFailedSeedContentStaleMarks();\n\t\t}\n\t}\n\n\t// 8. Menus and Menu Items (after content so refs can resolve)\n\tif (seed.menus) {\n\t\t// seed-local id -> resolved info, used to wire `translationOf` refs.\n\t\tconst menuSeedIdMap = new Map<string, { id: string; translationGroup: string }>();\n\t\t// Shared across menus: translated items reference anchor items in sibling menus.\n\t\tconst itemSeedIdMap = new Map<string, { id: string; translationGroup: string }>();\n\n\t\tfor (const menu of seed.menus) {\n\t\t\tconst locale = resolveConfiguredLocale(menu.locale ?? defaultLocale);\n\t\t\tlet lookup = db\n\t\t\t\t.selectFrom(\"_emdash_menus\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"name\", \"=\", menu.name)\n\t\t\t\t.where(\"locale\", \"=\", locale);\n\t\t\tconst existingMenu = await lookup.executeTakeFirst();\n\n\t\t\tlet menuId: string;\n\t\t\tlet translationGroup: string;\n\n\t\t\tif (existingMenu) {\n\t\t\t\tmenuId = existingMenu.id;\n\t\t\t\ttranslationGroup = existingMenu.translation_group ?? existingMenu.id;\n\t\t\t\t// Clear existing items (menus are recreated)\n\t\t\t\tawait db.deleteFrom(\"_emdash_menu_items\").where(\"menu_id\", \"=\", menuId).execute();\n\t\t\t} else {\n\t\t\t\tmenuId = ulid();\n\t\t\t\t// Resolve translationOf to the source menu's translation_group.\n\t\t\t\ttranslationGroup = menuId;\n\t\t\t\tif (menu.translationOf) {\n\t\t\t\t\tconst source = menuSeedIdMap.get(menu.translationOf);\n\t\t\t\t\tif (source) translationGroup = source.translationGroup;\n\t\t\t\t\telse\n\t\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\t`menu \"${menu.name}\" (${locale}): translationOf \"${menu.translationOf}\" not found yet; minting a fresh group.`,\n\t\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait db\n\t\t\t\t\t.insertInto(\"_emdash_menus\")\n\t\t\t\t\t.values({\n\t\t\t\t\t\tid: menuId,\n\t\t\t\t\t\tname: menu.name,\n\t\t\t\t\t\tlabel: menu.label,\n\t\t\t\t\t\tcreated_at: new Date().toISOString(),\n\t\t\t\t\t\tupdated_at: new Date().toISOString(),\n\t\t\t\t\t\tlocale,\n\t\t\t\t\t\ttranslation_group: translationGroup,\n\t\t\t\t\t})\n\t\t\t\t\t.execute();\n\t\t\t\tresult.menus.created++;\n\t\t\t}\n\n\t\t\tif (menu.id) menuSeedIdMap.set(menu.id, { id: menuId, translationGroup });\n\n\t\t\t// Create menu items\n\t\t\tconst itemCount = await applyMenuItems(\n\t\t\t\tdb,\n\t\t\t\tmenuId,\n\t\t\t\tlocale,\n\t\t\t\tmenu.items,\n\t\t\t\tnull, // parent_id\n\t\t\t\t0, // sort_order\n\t\t\t\tseedIdMap,\n\t\t\t\titemSeedIdMap,\n\t\t\t);\n\t\t\tresult.menus.items += itemCount;\n\t\t}\n\t}\n\n\t// 9. Redirects\n\tif (seed.redirects) {\n\t\tconst redirectRepo = new RedirectRepository(db);\n\n\t\tfor (const redirect of seed.redirects) {\n\t\t\tconst existing = await redirectRepo.findBySource(redirect.source);\n\t\t\tif (existing) {\n\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\tthrow new Error(`Conflict: redirect \"${redirect.source}\" already exists`);\n\t\t\t\t}\n\n\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\tawait redirectRepo.update(existing.id, {\n\t\t\t\t\t\tdestination: redirect.destination,\n\t\t\t\t\t\ttype: redirect.type,\n\t\t\t\t\t\tenabled: redirect.enabled,\n\t\t\t\t\t\tgroupName: redirect.groupName,\n\t\t\t\t\t});\n\t\t\t\t\tresult.redirects.updated++;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// skip\n\t\t\t\tresult.redirects.skipped++;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tawait redirectRepo.create({\n\t\t\t\tsource: redirect.source,\n\t\t\t\tdestination: redirect.destination,\n\t\t\t\ttype: redirect.type,\n\t\t\t\tenabled: redirect.enabled,\n\t\t\t\tgroupName: redirect.groupName,\n\t\t\t});\n\t\t\tresult.redirects.created++;\n\t\t}\n\t}\n\n\t// 10. Widget Areas and Widgets\n\tif (seed.widgetAreas) {\n\t\tfor (const area of seed.widgetAreas) {\n\t\t\t// Check if area exists\n\t\t\tconst existingArea = await db\n\t\t\t\t.selectFrom(\"_emdash_widget_areas\")\n\t\t\t\t.selectAll()\n\t\t\t\t.where(\"name\", \"=\", area.name)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tlet areaId: string;\n\n\t\t\tif (existingArea) {\n\t\t\t\tareaId = existingArea.id;\n\t\t\t\t// Clear existing widgets (areas are recreated)\n\t\t\t\tawait db.deleteFrom(\"_emdash_widgets\").where(\"area_id\", \"=\", areaId).execute();\n\t\t\t} else {\n\t\t\t\t// Create area\n\t\t\t\tareaId = ulid();\n\t\t\t\tawait db\n\t\t\t\t\t.insertInto(\"_emdash_widget_areas\")\n\t\t\t\t\t.values({\n\t\t\t\t\t\tid: areaId,\n\t\t\t\t\t\tname: area.name,\n\t\t\t\t\t\tlabel: area.label,\n\t\t\t\t\t\tdescription: area.description ?? null,\n\t\t\t\t\t})\n\t\t\t\t\t.execute();\n\t\t\t\tresult.widgetAreas.created++;\n\t\t\t}\n\n\t\t\t// Create widgets\n\t\t\tfor (let i = 0; i < area.widgets.length; i++) {\n\t\t\t\tconst widget = area.widgets[i];\n\t\t\t\tawait applyWidget(db, areaId, widget, i);\n\t\t\t\tresult.widgetAreas.widgets++;\n\t\t\t}\n\t\t}\n\t}\n\n\t// 11. Sections\n\tif (seed.sections) {\n\t\tfor (const section of seed.sections) {\n\t\t\t// Check if section exists\n\t\t\tconst existing = await db\n\t\t\t\t.selectFrom(\"_emdash_sections\")\n\t\t\t\t.select(\"id\")\n\t\t\t\t.where(\"slug\", \"=\", section.slug)\n\t\t\t\t.executeTakeFirst();\n\n\t\t\tif (existing) {\n\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\tthrow new Error(`Conflict: section \"${section.slug}\" already exists`);\n\t\t\t\t}\n\n\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\tawait db\n\t\t\t\t\t\t.updateTable(\"_emdash_sections\")\n\t\t\t\t\t\t.set({\n\t\t\t\t\t\t\ttitle: section.title,\n\t\t\t\t\t\t\tdescription: section.description ?? null,\n\t\t\t\t\t\t\tkeywords: section.keywords ? JSON.stringify(section.keywords) : null,\n\t\t\t\t\t\t\tcontent: JSON.stringify(section.content),\n\t\t\t\t\t\t\tsource: section.source || \"theme\",\n\t\t\t\t\t\t\tupdated_at: new Date().toISOString(),\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.where(\"id\", \"=\", existing.id)\n\t\t\t\t\t\t.execute();\n\t\t\t\t\tresult.sections.updated++;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// skip\n\t\t\t\tresult.sections.skipped++;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst id = ulid();\n\t\t\tconst now = new Date().toISOString();\n\n\t\t\tawait db\n\t\t\t\t.insertInto(\"_emdash_sections\")\n\t\t\t\t.values({\n\t\t\t\t\tid,\n\t\t\t\t\tslug: section.slug,\n\t\t\t\t\ttitle: section.title,\n\t\t\t\t\tdescription: section.description ?? null,\n\t\t\t\t\tkeywords: section.keywords ? JSON.stringify(section.keywords) : null,\n\t\t\t\t\tcontent: JSON.stringify(section.content),\n\t\t\t\t\tpreview_media_id: null,\n\t\t\t\t\tsource: section.source || \"theme\",\n\t\t\t\t\ttheme_id: section.source === \"theme\" ? section.slug : null,\n\t\t\t\t\tcreated_at: now,\n\t\t\t\t\tupdated_at: now,\n\t\t\t\t})\n\t\t\t\t.execute();\n\n\t\t\tresult.sections.created++;\n\t\t}\n\t}\n\n\t// 11. Enable search for collections that have `search` in supports\n\tif (seed.collections) {\n\t\tconst ftsManager = new FTSManager(db);\n\n\t\tfor (const collection of seed.collections) {\n\t\t\tif (collection.supports?.includes(\"search\")) {\n\t\t\t\t// Check if there are searchable fields\n\t\t\t\tconst searchableFields = await ftsManager.getSearchableFields(collection.slug);\n\t\t\t\tif (searchableFields.length > 0) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait ftsManager.enableSearch(collection.slug);\n\t\t\t\t\t} catch (err) {\n\t\t\t\t\t\t// Log but don't fail - search can be enabled manually later\n\t\t\t\t\t\tconsole.warn(`Failed to enable search for ${collection.slug}:`, err);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// Invalidate caches that may have been affected by seed data.\n\t// Seed creates bylines, redirects, and collections, all of which\n\t// have module-level caches in the hot path.\n\tconst { invalidateBylineCache } = await import(\"../bylines/index.js\");\n\tconst { invalidateRedirectCache } = await import(\"../redirects/cache.js\");\n\tconst { invalidateUrlPatternCache } = await import(\"../query.js\");\n\tinvalidateBylineCache();\n\tinvalidateRedirectCache();\n\tinvalidateUrlPatternCache();\n\n\treturn result;\n}\n\n/**\n * Apply hierarchical taxonomy terms (parents before children)\n */\nasync function applyHierarchicalTerms(\n\ttermRepo: TaxonomyRepository,\n\ttaxonomyName: string,\n\tdefLocale: string,\n\tterms: SeedTaxonomyTerm[],\n\ttermSeedIdMap: Map<string, string>,\n\tresult: SeedApplyResult,\n\tonConflict: \"skip\" | \"update\" | \"error\" = \"skip\",\n): Promise<void> {\n\t// \"locale::slug\" -> id, so the same slug can resolve per locale.\n\tconst slugToId = new Map<string, string>();\n\tconst resolveTermLocale = (term: SeedTaxonomyTerm) =>\n\t\tresolveConfiguredLocale(term.locale ?? defLocale);\n\n\t// Multiple passes — handles deep nesting and translationOf forward refs.\n\tlet remaining = [...terms];\n\tlet maxPasses = 10;\n\n\twhile (remaining.length > 0 && maxPasses > 0) {\n\t\tconst processedThisPass: string[] = [];\n\n\t\tfor (const term of remaining) {\n\t\t\tconst termLocale = resolveTermLocale(term);\n\t\t\tconst parentReady = !term.parent || slugToId.has(`${termLocale}::${term.parent}`);\n\t\t\tconst translationReady = !term.translationOf || termSeedIdMap.has(term.translationOf);\n\n\t\t\tif (!parentReady || !translationReady) continue;\n\n\t\t\tconst parentId = term.parent ? slugToId.get(`${termLocale}::${term.parent}`) : undefined;\n\t\t\tconst translationOf = term.translationOf ? termSeedIdMap.get(term.translationOf) : undefined;\n\n\t\t\tconst existing = await termRepo.findBySlug(taxonomyName, term.slug, termLocale);\n\t\t\tif (existing) {\n\t\t\t\tif (onConflict === \"error\") {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Conflict: taxonomy term \"${term.slug}\" in \"${taxonomyName}\" (${termLocale}) already exists`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (onConflict === \"update\") {\n\t\t\t\t\tawait termRepo.update(existing.id, {\n\t\t\t\t\t\tlabel: term.label,\n\t\t\t\t\t\tparentId,\n\t\t\t\t\t\tdata: term.description ? { description: term.description } : {},\n\t\t\t\t\t});\n\t\t\t\t\tresult.taxonomies.terms++;\n\t\t\t\t}\n\t\t\t\tslugToId.set(`${termLocale}::${term.slug}`, existing.id);\n\t\t\t\tif (term.id) termSeedIdMap.set(term.id, existing.id);\n\t\t\t} else {\n\t\t\t\tconst created = await termRepo.create({\n\t\t\t\t\tname: taxonomyName,\n\t\t\t\t\tslug: term.slug,\n\t\t\t\t\tlabel: term.label,\n\t\t\t\t\tparentId,\n\t\t\t\t\tdata: term.description ? { description: term.description } : undefined,\n\t\t\t\t\tlocale: termLocale,\n\t\t\t\t\ttranslationOf,\n\t\t\t\t});\n\t\t\t\tslugToId.set(`${termLocale}::${term.slug}`, created.id);\n\t\t\t\tif (term.id) termSeedIdMap.set(term.id, created.id);\n\t\t\t\tresult.taxonomies.terms++;\n\t\t\t}\n\n\t\t\tprocessedThisPass.push(term.slug + \"::\" + termLocale);\n\t\t}\n\n\t\tremaining = remaining.filter(\n\t\t\t(term) => !processedThisPass.includes(term.slug + \"::\" + resolveTermLocale(term)),\n\t\t);\n\t\tmaxPasses--;\n\t}\n\n\tif (remaining.length > 0) {\n\t\tconsole.warn(`Could not process ${remaining.length} terms due to missing parents/translations`);\n\t}\n}\n\n/**\n * Apply byline credits to a content entry.\n * In update mode, clears existing credits even if the seed has none.\n */\nasync function applyContentBylines(\n\tbylineRepo: BylineRepository,\n\tcollectionSlug: string,\n\tcontentId: string,\n\tentry: {\n\t\tid: string;\n\t\tslug?: string | null;\n\t\tbylines?: Array<{ byline: string; roleLabel?: string }>;\n\t},\n\tseedBylineIdMap: Map<string, string>,\n\tisUpdate = false,\n): Promise<void> {\n\tif (!entry.bylines || entry.bylines.length === 0) {\n\t\t// In update mode, clear existing bylines when the seed entry has none\n\t\tif (isUpdate) {\n\t\t\tawait bylineRepo.setContentBylines(collectionSlug, contentId, []);\n\t\t}\n\t\treturn;\n\t}\n\n\tconst credits = entry.bylines\n\t\t.map((credit) => {\n\t\t\tconst bylineId = seedBylineIdMap.get(credit.byline);\n\t\t\tif (!bylineId) return null;\n\t\t\treturn {\n\t\t\t\tbylineId,\n\t\t\t\troleLabel: credit.roleLabel ?? null,\n\t\t\t};\n\t\t})\n\t\t.filter((credit): credit is { bylineId: string; roleLabel: string | null } => Boolean(credit));\n\n\tif (credits.length !== entry.bylines.length) {\n\t\tconsole.warn(\n\t\t\t`content.${collectionSlug}.${entry.slug ?? entry.id}: one or more byline refs could not be resolved`,\n\t\t);\n\t}\n\n\t// In update mode, always call setContentBylines (even with empty credits)\n\t// to clear stale assignments when all byline refs fail to resolve.\n\t// In create mode, only call if there are credits to assign.\n\tif (credits.length > 0 || isUpdate) {\n\t\tawait bylineRepo.setContentBylines(collectionSlug, contentId, credits);\n\t}\n}\n\n/**\n * Apply taxonomy term assignments to a content entry.\n * In update mode, clears existing assignments before re-attaching.\n */\nasync function applyContentTaxonomies(\n\tdb: Kysely<Database>,\n\tcollectionSlug: string,\n\tcontentId: string,\n\tentry: { taxonomies?: Record<string, string[]> },\n\tisUpdate: boolean,\n): Promise<void> {\n\tconst termRepo = new TaxonomyRepository(db);\n\t// In update mode, clear existing taxonomy assignments first\n\tif (isUpdate) {\n\t\tawait termRepo.clearEntryTerms(collectionSlug, contentId);\n\t}\n\n\tif (!entry.taxonomies) {\n\t\t// In update mode we may have just deleted rows above; invalidate so\n\t\t// hydration doesn't serve stale \"has terms\" cached value.\n\t\tif (isUpdate) {\n\t\t\tconst { invalidateTermCache } = await import(\"../taxonomies/index.js\");\n\t\t\tinvalidateTermCache();\n\t\t}\n\t\treturn;\n\t}\n\n\tfor (const [taxonomyName, termSlugs] of Object.entries(entry.taxonomies)) {\n\t\tfor (const termSlug of termSlugs) {\n\t\t\tconst term = await termRepo.findBySlug(taxonomyName, termSlug);\n\t\t\tif (term) {\n\t\t\t\tawait termRepo.attachToEntry(collectionSlug, contentId, term.id);\n\t\t\t}\n\t\t}\n\t}\n\n\t// Seed writes directly to content_taxonomies. Clear the cache so\n\t// the worker lifetime cached \"has any term assignments\" probe\n\t// re-runs on the next read.\n\tconst { invalidateTermCache } = await import(\"../taxonomies/index.js\");\n\tinvalidateTermCache();\n}\n\n/**\n * Apply menu items recursively.\n *\n * When a `SeedMenuItem` carries `id`/`translationOf`, the import resolves the\n * source item's `translation_group` so cross-locale \"same nav entry\" links\n * survive export → apply. Items without `translationOf` get a fresh group\n * (= their own id).\n */\nasync function applyMenuItems(\n\tdb: Kysely<Database>,\n\tmenuId: string,\n\tlocale: string,\n\titems: SeedMenuItem[],\n\tparentId: string | null,\n\tstartOrder: number,\n\tseedIdMap: Map<string, string>,\n\titemSeedIdMap: Map<string, { id: string; translationGroup: string }>,\n): Promise<number> {\n\tlet count = 0;\n\tlet order = startOrder;\n\n\tfor (const item of items) {\n\t\tconst itemId = ulid();\n\t\tconst itemLocale = item.locale ?? locale;\n\n\t\t// Resolve reference if needed\n\t\tlet referenceId: string | null = null;\n\t\tlet referenceCollection: string | null = null;\n\n\t\tif (item.type === \"page\" || item.type === \"post\") {\n\t\t\t// Try to resolve from seedIdMap\n\t\t\tif (item.ref && seedIdMap.has(item.ref)) {\n\t\t\t\treferenceId = seedIdMap.get(item.ref)!;\n\t\t\t\t// Default to plural collection name (pages/posts) if not specified\n\t\t\t\treferenceCollection = item.collection || `${item.type}s`;\n\t\t\t}\n\t\t\t// If not in map, the content might not exist yet (will be broken link)\n\t\t}\n\n\t\tlet translationGroup = itemId;\n\t\tif (item.translationOf) {\n\t\t\tconst source = itemSeedIdMap.get(item.translationOf);\n\t\t\tif (source) translationGroup = source.translationGroup;\n\t\t\telse\n\t\t\t\tconsole.warn(\n\t\t\t\t\t`menu item \"${item.label ?? item.url ?? item.ref ?? \"(unlabeled)\"}\" (${itemLocale}): translationOf \"${item.translationOf}\" not found yet; minting a fresh group.`,\n\t\t\t\t);\n\t\t}\n\n\t\tawait db\n\t\t\t.insertInto(\"_emdash_menu_items\")\n\t\t\t.values({\n\t\t\t\tid: itemId,\n\t\t\t\tmenu_id: menuId,\n\t\t\t\tparent_id: parentId,\n\t\t\t\tsort_order: order,\n\t\t\t\ttype: item.type,\n\t\t\t\treference_collection: referenceCollection,\n\t\t\t\treference_id: referenceId,\n\t\t\t\tcustom_url: item.url ?? null,\n\t\t\t\tlabel: item.label || \"\",\n\t\t\t\ttitle_attr: item.titleAttr ?? null,\n\t\t\t\ttarget: item.target ?? null,\n\t\t\t\tcss_classes: item.cssClasses ?? null,\n\t\t\t\tcreated_at: new Date().toISOString(),\n\t\t\t\tlocale: itemLocale,\n\t\t\t\ttranslation_group: translationGroup,\n\t\t\t})\n\t\t\t.execute();\n\n\t\tif (item.id) itemSeedIdMap.set(item.id, { id: itemId, translationGroup });\n\n\t\tcount++;\n\t\torder++;\n\n\t\tif (item.children && item.children.length > 0) {\n\t\t\tconst childCount = await applyMenuItems(\n\t\t\t\tdb,\n\t\t\t\tmenuId,\n\t\t\t\titemLocale,\n\t\t\t\titem.children,\n\t\t\t\titemId,\n\t\t\t\t0,\n\t\t\t\tseedIdMap,\n\t\t\t\titemSeedIdMap,\n\t\t\t);\n\t\t\tcount += childCount;\n\t\t}\n\t}\n\n\treturn count;\n}\n\n/**\n * Apply a widget\n */\nasync function applyWidget(\n\tdb: Kysely<Database>,\n\tareaId: string,\n\twidget: SeedWidget,\n\tsortOrder: number,\n): Promise<void> {\n\tawait db\n\t\t.insertInto(\"_emdash_widgets\")\n\t\t.values({\n\t\t\tid: ulid(),\n\t\t\tarea_id: areaId,\n\t\t\tsort_order: sortOrder,\n\t\t\ttype: widget.type,\n\t\t\ttitle: widget.title ?? null,\n\t\t\t// `widget.content` is Portable Text for content-type widgets;\n\t\t\t// for other widget kinds it's null.\n\t\t\tcontent: widget.content ? JSON.stringify(widget.content) : null,\n\t\t\tmenu_name: widget.menuName ?? null,\n\t\t\tcomponent_id: widget.componentId ?? null,\n\t\t\tcomponent_props: widget.props ? JSON.stringify(widget.props) : null,\n\t\t})\n\t\t.execute();\n}\n\n/**\n * Context for media resolution during seed application\n */\ninterface MediaContext {\n\tdb: Kysely<Database>;\n\tstorage: Storage | null;\n\tskipMediaDownload: boolean;\n\tmediaCache: Map<string, MediaValue>; // URL -> resolved MediaValue\n}\n\n/**\n * Type guard for $media reference\n */\nfunction isSeedMediaReference(value: unknown): value is SeedMediaReference {\n\tif (typeof value !== \"object\" || value === null || !(\"$media\" in value)) {\n\t\treturn false;\n\t}\n\tconst media = (value as Record<string, unknown>).$media;\n\treturn (\n\t\ttypeof media === \"object\" &&\n\t\tmedia !== null &&\n\t\t\"url\" in media &&\n\t\ttypeof (media as Record<string, unknown>).url === \"string\"\n\t);\n}\n\n/**\n * Resolve $ref: and $media references in content data\n */\nasync function resolveReferences(\n\tdata: Record<string, unknown>,\n\tseedIdMap: Map<string, string>,\n\tmediaContext: MediaContext,\n\tresult: SeedApplyResult,\n): Promise<Record<string, unknown>> {\n\tconst resolved: Record<string, unknown> = {};\n\n\tfor (const [key, value] of Object.entries(data)) {\n\t\tresolved[key] = await resolveValue(value, seedIdMap, mediaContext, result);\n\t}\n\n\treturn resolved;\n}\n\n/**\n * Resolve a single value recursively\n */\nasync function resolveValue(\n\tvalue: unknown,\n\tseedIdMap: Map<string, string>,\n\tmediaContext: MediaContext,\n\tresult: SeedApplyResult,\n): Promise<unknown> {\n\t// Handle $ref: syntax\n\tif (typeof value === \"string\" && value.startsWith(\"$ref:\")) {\n\t\tconst seedId = value.slice(5);\n\t\treturn seedIdMap.get(seedId) ?? value; // Return unresolved if not found\n\t}\n\n\t// Handle $media syntax\n\tif (isSeedMediaReference(value)) {\n\t\treturn resolveMedia(value, mediaContext, result);\n\t}\n\n\t// Handle arrays\n\tif (Array.isArray(value)) {\n\t\treturn Promise.all(value.map((item) => resolveValue(item, seedIdMap, mediaContext, result)));\n\t}\n\n\t// Handle objects recursively\n\tif (typeof value === \"object\" && value !== null) {\n\t\tconst resolved: Record<string, unknown> = {};\n\t\tfor (const [k, v] of Object.entries(value)) {\n\t\t\tresolved[k] = await resolveValue(v, seedIdMap, mediaContext, result);\n\t\t}\n\t\treturn resolved;\n\t}\n\n\treturn value;\n}\n\n/**\n * Resolve a seeded byline avatar to a `media` row id. The file is assumed to\n * already exist in storage (the caller supplies its `storageKey`), so nothing\n * is downloaded or uploaded.\n *\n * Idempotent: if a media row with the same `storageKey` already exists it is\n * reused rather than duplicated, so re-applying a seed in `update` mode does\n * not leak rows. `created` reports whether a new row was inserted, so the\n * caller can both account for it and delete it if the subsequent byline write\n * fails (the only cross-dialect way to avoid an orphan — `withTransaction`\n * is a no-op on D1).\n */\nasync function resolveSeedBylineAvatar(\n\tdb: Kysely<Database>,\n\tavatar: SeedBylineAvatar,\n): Promise<{ id: string; created: boolean }> {\n\t// `media.storage_key` has no unique constraint, so order deterministically\n\t// to reuse the same row across runs if duplicates already exist. (Concurrent\n\t// seed applies against one DB are out of scope; seeding is a single-shot\n\t// init operation.)\n\tconst existing = await db\n\t\t.selectFrom(\"media\")\n\t\t.select(\"id\")\n\t\t.where(\"storage_key\", \"=\", avatar.storageKey)\n\t\t.orderBy(\"id\", \"asc\")\n\t\t.executeTakeFirst();\n\tif (existing) return { id: existing.id, created: false };\n\n\tconst basename = avatar.storageKey.split(\"/\").pop();\n\tconst filename =\n\t\tavatar.filename ?? (basename && basename.length > 0 ? basename : avatar.storageKey);\n\tconst created = await new MediaRepository(db).create({\n\t\tfilename,\n\t\tmimeType: avatar.mimeType ?? \"image/jpeg\",\n\t\tstorageKey: avatar.storageKey,\n\t\talt: avatar.alt,\n\t\twidth: avatar.width,\n\t\theight: avatar.height,\n\t\tstatus: \"ready\",\n\t});\n\treturn { id: created.id, created: true };\n}\n\n/**\n * Delete a media row by id. Best-effort cleanup for a failed byline write: a\n * failure here must not mask the original error that triggered the cleanup, so\n * it is logged and swallowed rather than thrown.\n */\nasync function deleteMediaRow(db: Kysely<Database>, id: string): Promise<void> {\n\ttry {\n\t\tawait db.deleteFrom(\"media\").where(\"id\", \"=\", id).execute();\n\t} catch (error) {\n\t\tconsole.warn(`[seed] failed to clean up orphaned avatar media ${id}:`, error);\n\t}\n}\n\n/**\n * Resolve a $media reference by downloading and uploading the media\n */\nasync function resolveMedia(\n\tref: SeedMediaReference,\n\tctx: MediaContext,\n\tresult: SeedApplyResult,\n): Promise<MediaValue | null> {\n\tconst { url, alt, filename, caption } = ref.$media;\n\n\t// Check cache first\n\tconst cached = ctx.mediaCache.get(url);\n\tif (cached) {\n\t\tresult.media.skipped++;\n\t\treturn { ...cached, alt: alt ?? cached.alt };\n\t}\n\n\t// When skipMediaDownload is set, resolve $media to an external URL reference\n\t// without downloading or storing anything. Used by playground mode.\n\tif (ctx.skipMediaDownload) {\n\t\tconst mediaValue: MediaValue = {\n\t\t\tprovider: \"external\",\n\t\t\tid: ulid(),\n\t\t\tsrc: url,\n\t\t\talt: alt ?? undefined,\n\t\t\tfilename: filename ?? undefined,\n\t\t};\n\t\tctx.mediaCache.set(url, mediaValue);\n\t\tresult.media.created++;\n\t\treturn mediaValue;\n\t}\n\n\t// Storage is required for $media resolution\n\tif (!ctx.storage) {\n\t\tconsole.warn(`Skipping $media reference (no storage configured): ${url}`);\n\t\tresult.media.skipped++;\n\t\treturn null;\n\t}\n\n\ttry {\n\t\t// SSRF protection: validate URL before downloading\n\t\tvalidateExternalUrl(url);\n\n\t\t// Download the media (ssrfSafeFetch re-validates redirect targets)\n\t\tconsole.log(`  📥 Downloading: ${url}`);\n\t\tconst response = await ssrfSafeFetch(url, {\n\t\t\theaders: {\n\t\t\t\t// Some services like Unsplash require a user-agent\n\t\t\t\t\"User-Agent\": \"EmDash-CMS/1.0\",\n\t\t\t},\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconsole.warn(`  ⚠️ Failed to download ${url}: ${response.status}`);\n\t\t\tresult.media.skipped++;\n\t\t\treturn null;\n\t\t}\n\n\t\t// Get content type and determine extension\n\t\tconst contentType = response.headers.get(\"content-type\") || \"application/octet-stream\";\n\t\tconst ext = getExtensionFromContentType(contentType) || getExtensionFromUrl(url) || \".bin\";\n\n\t\t// Generate filename and storage key\n\t\tconst storageId = ulid();\n\t\tconst finalFilename = filename || generateFilename(url, ext);\n\t\tconst storageKey = `${storageId}${ext}`;\n\n\t\t// Get the body as buffer\n\t\tconst arrayBuffer = await response.arrayBuffer();\n\t\tconst body = new Uint8Array(arrayBuffer);\n\n\t\t// Get image dimensions if it's an image\n\t\tlet width: number | undefined;\n\t\tlet height: number | undefined;\n\t\tif (contentType.startsWith(\"image/\")) {\n\t\t\tconst dimensions = getImageDimensions(body);\n\t\t\twidth = dimensions?.width;\n\t\t\theight = dimensions?.height;\n\t\t}\n\n\t\t// Upload to storage\n\t\tawait ctx.storage.upload({\n\t\t\tkey: storageKey,\n\t\t\tbody,\n\t\t\tcontentType,\n\t\t});\n\n\t\t// Create media record\n\t\tconst mediaRepo = new MediaRepository(ctx.db);\n\t\tconst media = await mediaRepo.create({\n\t\t\tfilename: finalFilename,\n\t\t\tmimeType: contentType,\n\t\t\tsize: body.length,\n\t\t\twidth,\n\t\t\theight,\n\t\t\talt,\n\t\t\tcaption,\n\t\t\tstorageKey,\n\t\t\tstatus: \"ready\",\n\t\t});\n\n\t\t// Create the MediaValue - only store id, URL is built at runtime by EmDashMedia\n\t\tconst mediaValue: MediaValue = {\n\t\t\tprovider: \"local\",\n\t\t\tid: media.id,\n\t\t\talt: alt ?? undefined,\n\t\t\twidth,\n\t\t\theight,\n\t\t\tmimeType: contentType,\n\t\t\tfilename: finalFilename,\n\t\t\tmeta: { storageKey },\n\t\t};\n\n\t\t// Cache for reuse\n\t\tctx.mediaCache.set(url, mediaValue);\n\t\tresult.media.created++;\n\n\t\tconsole.log(`  ✅ Uploaded: ${finalFilename}`);\n\t\treturn mediaValue;\n\t} catch (error) {\n\t\tconsole.warn(\n\t\t\t`  ⚠️ Error processing $media ${url}:`,\n\t\t\terror instanceof Error ? error.message : error,\n\t\t);\n\t\tresult.media.skipped++;\n\t\treturn null;\n\t}\n}\n\n/**\n * Get file extension from content type\n */\nfunction getExtensionFromContentType(contentType: string): string | null {\n\t// Handle content-type with parameters like \"image/jpeg; charset=utf-8\"\n\tconst baseMime = contentType.split(\";\")[0].trim();\n\tconst ext = mime.getExtension(baseMime);\n\treturn ext ? `.${ext}` : null;\n}\n\n/**\n * Get file extension from URL\n */\nfunction getExtensionFromUrl(url: string): string | null {\n\ttry {\n\t\tconst pathname = new URL(url).pathname;\n\t\tconst match = pathname.match(FILE_EXTENSION_PATTERN);\n\t\treturn match ? `.${match[1]}` : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Generate a filename from URL\n */\nfunction generateFilename(url: string, ext: string): string {\n\ttry {\n\t\tconst pathname = new URL(url).pathname;\n\t\tconst basename = pathname.split(\"/\").pop() || \"media\";\n\t\t// Remove any existing extension and query params\n\t\tconst name = basename.replace(EXTENSION_PATTERN, \"\").replace(QUERY_PARAM_PATTERN, \"\");\n\t\t// Sanitize: only alphanumeric, dash, underscore\n\t\tconst sanitized = name.replace(SANITIZE_PATTERN, \"-\").replace(MULTIPLE_HYPHENS_PATTERN, \"-\");\n\t\treturn `${sanitized || \"media\"}${ext}`;\n\t} catch {\n\t\treturn `media${ext}`;\n\t}\n}\n\n/**\n * Get image dimensions from buffer using image-size.\n * Supports PNG, JPEG, GIF, WebP, AVIF, SVG, TIFF, and more.\n */\nfunction getImageDimensions(buffer: Uint8Array): { width: number; height: number } | null {\n\ttry {\n\t\tconst result = imageSize(buffer);\n\t\tif (result.width != null && result.height != null) {\n\t\t\treturn { width: result.width, height: result.height };\n\t\t}\n\t\treturn null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,eAAe,uBACd,UACA,YACgB;AAChB,KAAI,WAAW,eAAe,UAAa,WAAW,cAAc,OAAW;AAC/E,OAAM,SAAS,iBAAiB,WAAW,MAAM;EAChD,YAAY,WAAW;EACvB,WAAW,WAAW;EACtB,CAAC;;AAGH,MAAM,yBAAyB;;AAI/B,MAAM,oBAAoB;;AAG1B,MAAM,sBAAsB;;AAG5B,MAAM,mBAAmB;;AAGzB,MAAM,2BAA2B;;;;;;;;;;;AAYjC,eAAsB,UACrB,IACA,MACA,UAA4B,EAAE,EACH;CAE3B,MAAM,aAAa,aAAa,KAAK;AACrC,KAAI,CAAC,WAAW,MACf,OAAM,IAAI,MAAM,uBAAuB,WAAW,OAAO,KAAK,KAAK,GAAG;CAGvE,MAAM,EACL,iBAAiB,OACjB,SACA,oBAAoB,OACpB,aAAa,WACV;CAGJ,MAAM,SAA0B;EAC/B,aAAa;GAAE,SAAS;GAAG,SAAS;GAAG,SAAS;GAAG;EACnD,QAAQ;GAAE,SAAS;GAAG,SAAS;GAAG,SAAS;GAAG;EAC9C,YAAY;GAAE,SAAS;GAAG,OAAO;GAAG;EACpC,SAAS;GAAE,SAAS;GAAG,SAAS;GAAG,SAAS;GAAG;EAC/C,OAAO;GAAE,SAAS;GAAG,OAAO;GAAG;EAC/B,WAAW;GAAE,SAAS;GAAG,SAAS;GAAG,SAAS;GAAG;EACjD,aAAa;GAAE,SAAS;GAAG,SAAS;GAAG;EACvC,UAAU;GAAE,SAAS;GAAG,SAAS;GAAG,SAAS;GAAG;EAChD,UAAU,EAAE,SAAS,GAAG;EACxB,SAAS;GAAE,SAAS;GAAG,SAAS;GAAG,SAAS;GAAG;EAC/C,OAAO;GAAE,SAAS;GAAG,SAAS;GAAG;EACjC;CAGD,MAAM,eAA6B;EAClC;EACA,SAAS,WAAW;EACpB;EACA,4BAAY,IAAI,KAAK;EACrB;CAYD,MAAM,4BAAY,IAAI,KAAqB;CAC3C,MAAM,kCAAkB,IAAI,KAAqB;CACjD,MAAM,gDAAgC,IAAI,KAAa;CACvD,MAAM,gDAAgC,IAAI,KAAa;CAOvD,MAAM,gBAAgB,eAAe,EAAE,iBAAiB,KAAK,iBAAiB;CAC9E,MAAM,iCAAiC,OAAO,mBAA0C;AACvF,MAAI,8BAA8B,IAAI,eAAe,CAAE;AAMvD,MALe,MAAM,2CACpB,IACA,gBACA,sBACA,EACW;AACX,iCAA8B,IAAI,eAAe;AACjD,iCAA8B,OAAO,eAAe;QAEpD,+BAA8B,IAAI,eAAe;;CAGnD,MAAM,mCAAmC,YAA2B;AACnE,OAAK,MAAM,kBAAkB,8BAM5B,KALe,MAAM,2CACpB,IACA,gBACA,sBACA,EACW;AACX,iCAA8B,IAAI,eAAe;AACjD,iCAA8B,OAAO,eAAe;;;AAMvD,KAAI,KAAK,UAAU;AAClB,QAAM,gBAAgB,KAAK,UAAU,GAAG;AACxC,SAAO,SAAS,UAAU,OAAO,KAAK,KAAK,SAAS,CAAC;;AAItD,KAAI,KAAK,aAAa;EACrB,MAAM,WAAW,IAAI,eAAe,GAAG;AAEvC,OAAK,MAAM,cAAc,KAAK,aAAa;AAI1C,OAFiB,MAAM,SAAS,cAAc,WAAW,KAAK,EAEhD;AACb,QAAI,eAAe,QAClB,OAAM,IAAI,MAAM,yBAAyB,WAAW,KAAK,kBAAkB;AAG5E,QAAI,eAAe,UAAU;AAC5B,WAAM,SAAS,iBAAiB,WAAW,MAAM;MAChD,OAAO,WAAW;MAClB,eAAe,WAAW;MAC1B,aAAa,WAAW;MACxB,MAAM,WAAW;MACjB,OAAO,WAAW;MAClB,UAAU,WAAW,YAAY,EAAE;MACnC,YAAY,WAAW;MACvB,UAAU,WAAW;MACrB,QAAQ,WAAW;MACnB,WAAW,WAAW;MACtB,OAAO,WAAW;MAClB,iBAAiB,WAAW;MAC5B,aAAa,WAAW;MACxB,CAAC;AACF,YAAO,YAAY;AAGnB,UAAK,MAAM,SAAS,WAAW,OAE9B,KADsB,MAAM,SAAS,SAAS,WAAW,MAAM,MAAM,KAAK,EACvD;AAClB,YAAM,SAAS,YAAY,WAAW,MAAM,MAAM,MAAM;OACvD,OAAO,MAAM;OACb,MAAM,MAAM;OACZ,UAAU,MAAM,YAAY;OAC5B,QAAQ,MAAM,UAAU;OACxB,YAAY,MAAM,cAAc;OAChC,SAAS,MAAM,WAAW;OAC1B,cAAc,MAAM;OACpB,YAAY,MAAM;OAClB,QAAQ,MAAM;OACd,SAAS,MAAM;OACf,CAAC;AACF,aAAO,OAAO;YACR;AACN,YAAM,SAAS,YAAY,WAAW,MAAM;OAC3C,MAAM,MAAM;OACZ,OAAO,MAAM;OACb,MAAM,MAAM;OACZ,UAAU,MAAM,YAAY;OAC5B,QAAQ,MAAM,UAAU;OACxB,YAAY,MAAM,cAAc;OAChC,SAAS,MAAM,WAAW;OAC1B,cAAc,MAAM;OACpB,YAAY,MAAM;OAClB,QAAQ,MAAM;OACd,SAAS,MAAM;OACf,CAAC;AACF,aAAO,OAAO;;AAKhB,WAAM,uBAAuB,UAAU,WAAW;AAClD;;AAID,WAAO,YAAY;AACnB,WAAO,OAAO,WAAW,WAAW,OAAO;AAC3C;;GAGD,MAAM,SAAS,WAAW,OAAO,KAAK,WAAW;IAChD,MAAM,MAAM;IACZ,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,UAAU,MAAM,YAAY;IAC5B,QAAQ,MAAM,UAAU;IACxB,YAAY,MAAM,cAAc;IAChC,SAAS,MAAM,WAAW;IAC1B,cAAc,MAAM;IACpB,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,EAAE;AAGH,SAAM,SAAS,qBACd;IACC,MAAM,WAAW;IACjB,OAAO,WAAW;IAClB,eAAe,WAAW;IAC1B,aAAa,WAAW;IACxB,MAAM,WAAW;IACjB,OAAO,WAAW;IAClB,UAAU,WAAW,YAAY,EAAE;IACnC,YAAY,WAAW;IACvB,UAAU,WAAW;IACrB,QAAQ,WAAW;IACnB,WAAW,WAAW;IACtB,OAAO,WAAW;IAClB,iBAAiB,WAAW;IAC5B,aAAa,WAAW;IACxB,EACD,OACA;AAGD,SAAM,uBAAuB,UAAU,WAAW;AAClD,UAAO,YAAY;AACnB,UAAO,OAAO,WAAW,OAAO;;;AAKlC,KAAI,KAAK,YAAY;EAEpB,MAAM,+BAAe,IAAI,KAAuD;EAChF,MAAM,gCAAgB,IAAI,KAAqB;AAE/C,OAAK,MAAM,YAAY,KAAK,YAAY;GACvC,MAAM,YAAY,wBAAwB,SAAS,UAAU,cAAc;GAG3E,MAAM,cAAc,MAAM,GACxB,WAAW,wBAAwB,CACnC,WAAW,CACX,MAAM,QAAQ,KAAK,SAAS,KAAK,CACjC,MAAM,UAAU,KAAK,UAAU,CAC/B,kBAAkB;GAEpB,IAAI;GACJ,IAAI;AAEJ,OAAI,aAAa;AAChB,YAAQ,YAAY;AACpB,0BAAsB,YAAY,qBAAqB,YAAY;AACnE,QAAI,eAAe,QAClB,OAAM,IAAI,MAAM,uBAAuB,SAAS,KAAK,KAAK,UAAU,kBAAkB;AAEvF,QAAI,eAAe,SAClB,OAAM,GACJ,YAAY,wBAAwB,CACpC,IAAI;KACJ,OAAO,SAAS;KAChB,gBAAgB,SAAS,iBAAiB;KAC1C,cAAc,SAAS,eAAe,IAAI;KAC1C,aAAa,KAAK,UAAU,SAAS,YAAY;KACjD,CAAC,CACD,MAAM,MAAM,KAAK,YAAY,GAAG,CAChC,SAAS;UAEN;AACN,YAAQ,MAAM;AACd,0BAAsB;AACtB,QAAI,SAAS,eAAe;KAC3B,MAAM,SAAS,aAAa,IAAI,SAAS,cAAc;AACvD,SAAI,OAAQ,uBAAsB,OAAO;SAExC,SAAQ,KACP,aAAa,SAAS,KAAK,KAAK,UAAU,oBAAoB,SAAS,cAAc,yCACrF;;AAEH,UAAM,GACJ,WAAW,wBAAwB,CACnC,OAAO;KACP,IAAI;KACJ,MAAM,SAAS;KACf,OAAO,SAAS;KAChB,gBAAgB,SAAS,iBAAiB;KAC1C,cAAc,SAAS,eAAe,IAAI;KAC1C,aAAa,KAAK,UAAU,SAAS,YAAY;KACjD,QAAQ;KACR,mBAAmB;KACnB,CAAC,CACD,SAAS;AACX,WAAO,WAAW;;AAGnB,OAAI,SAAS,GACZ,cAAa,IAAI,SAAS,IAAI;IAAE,IAAI;IAAO,kBAAkB;IAAqB,CAAC;AAGpF,OAAI,kBAAkB,SAAS,SAAS,SAAS,MAAM,SAAS,GAAG;IAClE,MAAM,WAAW,IAAI,mBAAmB,GAAG;AAE3C,QAAI,SAAS,aACZ,OAAM,uBACL,UACA,SAAS,MACT,WACA,SAAS,OACT,eACA,QACA,WACA;QAED,MAAK,MAAM,QAAQ,SAAS,OAAO;KAClC,MAAM,aAAa,wBAAwB,KAAK,UAAU,UAAU;KACpE,MAAM,WAAW,MAAM,SAAS,WAAW,SAAS,MAAM,KAAK,MAAM,WAAW;AAChF,SAAI,UAAU;AACb,UAAI,eAAe,QAClB,OAAM,IAAI,MACT,4BAA4B,KAAK,KAAK,QAAQ,SAAS,KAAK,KAAK,WAAW,kBAC5E;AAEF,UAAI,eAAe,UAAU;AAC5B,aAAM,SAAS,OAAO,SAAS,IAAI;QAClC,OAAO,KAAK;QACZ,MAAM,KAAK,cAAc,EAAE,aAAa,KAAK,aAAa,GAAG,EAAE;QAC/D,CAAC;AACF,cAAO,WAAW;;AAEnB,UAAI,KAAK,GAAI,eAAc,IAAI,KAAK,IAAI,SAAS,GAAG;YAC9C;MACN,MAAM,gBAAgB,KAAK,gBACxB,cAAc,IAAI,KAAK,cAAc,GACrC;MACH,MAAM,UAAU,MAAM,SAAS,OAAO;OACrC,MAAM,SAAS;OACf,MAAM,KAAK;OACX,OAAO,KAAK;OACZ,MAAM,KAAK,cAAc,EAAE,aAAa,KAAK,aAAa,GAAG;OAC7D,QAAQ;OACR;OACA,CAAC;AACF,UAAI,KAAK,GAAI,eAAc,IAAI,KAAK,IAAI,QAAQ,GAAG;AACnD,aAAO,WAAW;;;;;EAUvB,MAAM,EAAE,gCAAgC,MAAM,OAAO;AACrD,+BAA6B;;AAI9B,KAAI,kBAAkB,KAAK,SAAS;EACnC,MAAM,aAAa,IAAI,iBAAiB,GAAG;AAC3C,OAAK,MAAM,UAAU,KAAK,SAAS;GAClC,MAAM,WAAW,MAAM,WAAW,WAAW,OAAO,KAAK;AACzD,OAAI,UAAU;AACb,QAAI,eAAe,QAClB,OAAM,IAAI,MAAM,qBAAqB,OAAO,KAAK,kBAAkB;AAGpE,QAAI,eAAe,UAAU;KAK5B,MAAM,SAAS,OAAO,SAAS,MAAM,wBAAwB,IAAI,OAAO,OAAO,GAAG;AAClF,SAAI;AAWH,UAAI,CAVY,MAAM,WAAW,OAAO,SAAS,IAAI;OACpD,aAAa,OAAO;OACpB,KAAK,OAAO,OAAO;OACnB,YAAY,OAAO,cAAc;OACjC,SAAS,OAAO;OAChB,GAAI,SAAS,EAAE,eAAe,OAAO,IAAI,GAAG,EAAE;OAC9C,CAAC,CAKD,OAAM,IAAI,MAAM,WAAW,OAAO,KAAK,6BAA6B;cAE7D,OAAO;AAGf,UAAI,QAAQ,QAAS,OAAM,eAAe,IAAI,OAAO,GAAG;AACxD,YAAM;;AAEP,qBAAgB,IAAI,OAAO,IAAI,SAAS,GAAG;AAC3C,YAAO,QAAQ;AACf,SAAI,QAAQ,QAAS,QAAO,MAAM;AAClC;;AAID,oBAAgB,IAAI,OAAO,IAAI,SAAS,GAAG;AAC3C,WAAO,QAAQ;AACf;;GAGD,MAAM,SAAS,OAAO,SAAS,MAAM,wBAAwB,IAAI,OAAO,OAAO,GAAG;GAClF,IAAI;AACJ,OAAI;AASH,iBARgB,MAAM,WAAW,OAAO;KACvC,MAAM,OAAO;KACb,aAAa,OAAO;KACpB,KAAK,OAAO,OAAO;KACnB,YAAY,OAAO,cAAc;KACjC,SAAS,OAAO;KAChB,eAAe,QAAQ,MAAM;KAC7B,CAAC,EACkB;YACZ,OAAO;AACf,QAAI,QAAQ,QAAS,OAAM,eAAe,IAAI,OAAO,GAAG;AACxD,UAAM;;AAEP,mBAAgB,IAAI,OAAO,IAAI,UAAU;AACzC,UAAO,QAAQ;AACf,OAAI,QAAQ,QAAS,QAAO,MAAM;;;AAKpC,KAAI,kBAAkB,KAAK,SAAS;EACnC,MAAM,cAAc,IAAI,kBAAkB,GAAG;EAC7C,MAAM,iBAAiB,IAAI,eAAe,GAAG;AAE7C,MAAI;AAEH,QAAK,MAAM,CAAC,gBAAgB,YAAY,OAAO,QAAQ,KAAK,QAAQ,EAAE;IACrE,MAAM,sBACJ,MAAM,eAAe,cAAc,eAAe,GAAG,aAAa;AACpE,SAAK,MAAM,SAAS,SAAS;KAC5B,MAAM,YACL,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,OAAO;KAI/E,MAAM,cAAc,wBAAwB,MAAM,UAAU,cAAc;KAI1E,MAAM,WAAW,YACd,MAAM,YAAY,WAAW,gBAAgB,WAAW,YAAY,GACpE,MAAM,YAAY,SAAS,gBAAgB,MAAM,GAAG;AAEvD,SAAI,UAAU;AACb,UAAI,eAAe,QAClB,OAAM,IAAI,MACT,sBAAsB,aAAa,MAAM,GAAG,QAAQ,eAAe,kBACnE;AAGF,UAAI,eAAe,UAAU;OAE5B,MAAM,eAAe,MAAM,kBAC1B,MAAM,MACN,WACA,cACA,OACA;OAGD,MAAM,SAAS,MAAM,UAAU;OAC/B,IAAI,iBAAiB;AACrB,WAAI;AACH,cAAM,gBAAgB,IAAI,OAAO,QAAQ;SACxC,MAAM,iBAAiB,IAAI,kBAAkB,IAAI;SACjD,MAAM,gBAAgB,IAAI,iBAAiB,IAAI;SAC/C,MAAM,kBAAkB,IAAI,mBAAmB,IAAI;AAEnD,eAAM,eAAe,OAAO,gBAAgB,SAAS,IAAI;UACxD;UACA,MAAM;UACN,CAAC;AACF,0BAAiB;AAEjB,eAAM,oBACL,eACA,gBACA,SAAS,IACT,OACA,iBACA,KACA;AACD,eAAM,uBAAuB,KAAK,gBAAgB,SAAS,IAAI,OAAO,KAAK;AAS3E,aAAI,WAAW,aAAa;UAC3B,MAAM,QAAQ,MAAM,gBAAgB,OAAO;WAC1C,YAAY;WACZ,SAAS,SAAS;WAClB,MAAM;WACN,CAAC;AACF,cAAI;AACH,iBAAM,eAAe,iBAAiB,gBAAgB,SAAS,IAAI,MAAM,GAAG;AAC5E,iBAAM,eAAe,QACpB,gBACA,SAAS,IACT,QACA,OACA,QACA,MACA,mBACA;mBACO,OAAO;AACf,eAAI;AACH,kBAAM,gBAAgB,qBACrB,gBACA,SAAS,IACT,MAAM,GACN;oBACO,cAAc;AACtB,oBAAQ,MACP,+CAA+C,MAAM,GAAG,IACxD,aACA;;AAEF,iBAAM;;;UAGP;gBACM,OAAO;AACf,YAAI,eAAgB,OAAM,+BAA+B,eAAe;AACxE,cAAM;;AAGP,iBAAU,IAAI,MAAM,IAAI,SAAS,GAAG;AACpC,cAAO,QAAQ;AACf,aAAM,+BAA+B,eAAe;AACpD;;AAID,aAAO,QAAQ;AACf,gBAAU,IAAI,MAAM,IAAI,SAAS,GAAG;AACpC;;KAID,MAAM,eAAe,MAAM,kBAAkB,MAAM,MAAM,WAAW,cAAc,OAAO;KAGzF,IAAI;AACJ,SAAI,MAAM,eAAe;MACxB,MAAM,WAAW,UAAU,IAAI,MAAM,cAAc;AACnD,UAAI,CAAC,SACJ,SAAQ,KACP,WAAW,eAAe,mBAAmB,MAAM,cAAc,sEACjE;UAED,iBAAgB;;KAKlB,MAAM,SAAS,MAAM,UAAU;KAC/B,IAAI,iBAAiB;KACrB,IAAI;AACJ,SAAI;AACH,gBAAU,MAAM,gBAAgB,IAAI,OAAO,QAAQ;OAClD,MAAM,iBAAiB,IAAI,kBAAkB,IAAI;OACjD,MAAM,gBAAgB,IAAI,iBAAiB,IAAI;OAE/C,MAAM,OAAO,MAAM,eAAe,OAAO;QACxC,GAAI,YAAY,EAAE,GAAG,EAAE,IAAI,MAAM,IAAI;QACrC,MAAM;QACN,MAAM;QACN;QACA,MAAM;QACN,QAAQ;QACR;QACA,aAAa,WAAW,+BAAc,IAAI,MAAM,EAAC,aAAa,GAAG;QACjE,CAAC;AACF,wBAAiB;AAEjB,aAAM,oBACL,eACA,gBACA,KAAK,IACL,OACA,gBACA;AACD,aAAM,uBAAuB,KAAK,gBAAgB,KAAK,IAAI,OAAO,MAAM;AAKxE,WAAI,WAAW,YACd,OAAM,eAAe,QACpB,gBACA,KAAK,IACL,QACA,OACA,QACA,MACA,mBACA;AAGF,cAAO;QACN;cACM,OAAO;AACf,UAAI,eAAgB,OAAM,+BAA+B,eAAe;AACxE,YAAM;;AAGP,eAAU,IAAI,MAAM,IAAI,QAAQ,GAAG;AACnC,YAAO,QAAQ;AACf,WAAM,+BAA+B,eAAe;;;YAG7C;AACT,SAAM,kCAAkC;;;AAK1C,KAAI,KAAK,OAAO;EAEf,MAAM,gCAAgB,IAAI,KAAuD;EAEjF,MAAM,gCAAgB,IAAI,KAAuD;AAEjF,OAAK,MAAM,QAAQ,KAAK,OAAO;GAC9B,MAAM,SAAS,wBAAwB,KAAK,UAAU,cAAc;GAMpE,MAAM,eAAe,MALR,GACX,WAAW,gBAAgB,CAC3B,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,KAAK,CAC7B,MAAM,UAAU,KAAK,OAAO,CACI,kBAAkB;GAEpD,IAAI;GACJ,IAAI;AAEJ,OAAI,cAAc;AACjB,aAAS,aAAa;AACtB,uBAAmB,aAAa,qBAAqB,aAAa;AAElE,UAAM,GAAG,WAAW,qBAAqB,CAAC,MAAM,WAAW,KAAK,OAAO,CAAC,SAAS;UAC3E;AACN,aAAS,MAAM;AAEf,uBAAmB;AACnB,QAAI,KAAK,eAAe;KACvB,MAAM,SAAS,cAAc,IAAI,KAAK,cAAc;AACpD,SAAI,OAAQ,oBAAmB,OAAO;SAErC,SAAQ,KACP,SAAS,KAAK,KAAK,KAAK,OAAO,oBAAoB,KAAK,cAAc,yCACtE;;AAEH,UAAM,GACJ,WAAW,gBAAgB,CAC3B,OAAO;KACP,IAAI;KACJ,MAAM,KAAK;KACX,OAAO,KAAK;KACZ,6BAAY,IAAI,MAAM,EAAC,aAAa;KACpC,6BAAY,IAAI,MAAM,EAAC,aAAa;KACpC;KACA,mBAAmB;KACnB,CAAC,CACD,SAAS;AACX,WAAO,MAAM;;AAGd,OAAI,KAAK,GAAI,eAAc,IAAI,KAAK,IAAI;IAAE,IAAI;IAAQ;IAAkB,CAAC;GAGzE,MAAM,YAAY,MAAM,eACvB,IACA,QACA,QACA,KAAK,OACL,MACA,GACA,WACA,cACA;AACD,UAAO,MAAM,SAAS;;;AAKxB,KAAI,KAAK,WAAW;EACnB,MAAM,eAAe,IAAI,mBAAmB,GAAG;AAE/C,OAAK,MAAM,YAAY,KAAK,WAAW;GACtC,MAAM,WAAW,MAAM,aAAa,aAAa,SAAS,OAAO;AACjE,OAAI,UAAU;AACb,QAAI,eAAe,QAClB,OAAM,IAAI,MAAM,uBAAuB,SAAS,OAAO,kBAAkB;AAG1E,QAAI,eAAe,UAAU;AAC5B,WAAM,aAAa,OAAO,SAAS,IAAI;MACtC,aAAa,SAAS;MACtB,MAAM,SAAS;MACf,SAAS,SAAS;MAClB,WAAW,SAAS;MACpB,CAAC;AACF,YAAO,UAAU;AACjB;;AAID,WAAO,UAAU;AACjB;;AAGD,SAAM,aAAa,OAAO;IACzB,QAAQ,SAAS;IACjB,aAAa,SAAS;IACtB,MAAM,SAAS;IACf,SAAS,SAAS;IAClB,WAAW,SAAS;IACpB,CAAC;AACF,UAAO,UAAU;;;AAKnB,KAAI,KAAK,YACR,MAAK,MAAM,QAAQ,KAAK,aAAa;EAEpC,MAAM,eAAe,MAAM,GACzB,WAAW,uBAAuB,CAClC,WAAW,CACX,MAAM,QAAQ,KAAK,KAAK,KAAK,CAC7B,kBAAkB;EAEpB,IAAI;AAEJ,MAAI,cAAc;AACjB,YAAS,aAAa;AAEtB,SAAM,GAAG,WAAW,kBAAkB,CAAC,MAAM,WAAW,KAAK,OAAO,CAAC,SAAS;SACxE;AAEN,YAAS,MAAM;AACf,SAAM,GACJ,WAAW,uBAAuB,CAClC,OAAO;IACP,IAAI;IACJ,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,aAAa,KAAK,eAAe;IACjC,CAAC,CACD,SAAS;AACX,UAAO,YAAY;;AAIpB,OAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,QAAQ,KAAK;GAC7C,MAAM,SAAS,KAAK,QAAQ;AAC5B,SAAM,YAAY,IAAI,QAAQ,QAAQ,EAAE;AACxC,UAAO,YAAY;;;AAMtB,KAAI,KAAK,SACR,MAAK,MAAM,WAAW,KAAK,UAAU;EAEpC,MAAM,WAAW,MAAM,GACrB,WAAW,mBAAmB,CAC9B,OAAO,KAAK,CACZ,MAAM,QAAQ,KAAK,QAAQ,KAAK,CAChC,kBAAkB;AAEpB,MAAI,UAAU;AACb,OAAI,eAAe,QAClB,OAAM,IAAI,MAAM,sBAAsB,QAAQ,KAAK,kBAAkB;AAGtE,OAAI,eAAe,UAAU;AAC5B,UAAM,GACJ,YAAY,mBAAmB,CAC/B,IAAI;KACJ,OAAO,QAAQ;KACf,aAAa,QAAQ,eAAe;KACpC,UAAU,QAAQ,WAAW,KAAK,UAAU,QAAQ,SAAS,GAAG;KAChE,SAAS,KAAK,UAAU,QAAQ,QAAQ;KACxC,QAAQ,QAAQ,UAAU;KAC1B,6BAAY,IAAI,MAAM,EAAC,aAAa;KACpC,CAAC,CACD,MAAM,MAAM,KAAK,SAAS,GAAG,CAC7B,SAAS;AACX,WAAO,SAAS;AAChB;;AAID,UAAO,SAAS;AAChB;;EAGD,MAAM,KAAK,MAAM;EACjB,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;AAEpC,QAAM,GACJ,WAAW,mBAAmB,CAC9B,OAAO;GACP;GACA,MAAM,QAAQ;GACd,OAAO,QAAQ;GACf,aAAa,QAAQ,eAAe;GACpC,UAAU,QAAQ,WAAW,KAAK,UAAU,QAAQ,SAAS,GAAG;GAChE,SAAS,KAAK,UAAU,QAAQ,QAAQ;GACxC,kBAAkB;GAClB,QAAQ,QAAQ,UAAU;GAC1B,UAAU,QAAQ,WAAW,UAAU,QAAQ,OAAO;GACtD,YAAY;GACZ,YAAY;GACZ,CAAC,CACD,SAAS;AAEX,SAAO,SAAS;;AAKlB,KAAI,KAAK,aAAa;EACrB,MAAM,aAAa,IAAI,WAAW,GAAG;AAErC,OAAK,MAAM,cAAc,KAAK,YAC7B,KAAI,WAAW,UAAU,SAAS,SAAS,EAG1C;QADyB,MAAM,WAAW,oBAAoB,WAAW,KAAK,EACzD,SAAS,EAC7B,KAAI;AACH,UAAM,WAAW,aAAa,WAAW,KAAK;YACtC,KAAK;AAEb,YAAQ,KAAK,+BAA+B,WAAW,KAAK,IAAI,IAAI;;;;CAUzE,MAAM,EAAE,0BAA0B,MAAM,OAAO;CAC/C,MAAM,EAAE,4BAA4B,MAAM,OAAO;CACjD,MAAM,EAAE,8BAA8B,MAAM,OAAO;AACnD,wBAAuB;AACvB,0BAAyB;AACzB,4BAA2B;AAE3B,QAAO;;;;;AAMR,eAAe,uBACd,UACA,cACA,WACA,OACA,eACA,QACA,aAA0C,QAC1B;CAEhB,MAAM,2BAAW,IAAI,KAAqB;CAC1C,MAAM,qBAAqB,SAC1B,wBAAwB,KAAK,UAAU,UAAU;CAGlD,IAAI,YAAY,CAAC,GAAG,MAAM;CAC1B,IAAI,YAAY;AAEhB,QAAO,UAAU,SAAS,KAAK,YAAY,GAAG;EAC7C,MAAM,oBAA8B,EAAE;AAEtC,OAAK,MAAM,QAAQ,WAAW;GAC7B,MAAM,aAAa,kBAAkB,KAAK;GAC1C,MAAM,cAAc,CAAC,KAAK,UAAU,SAAS,IAAI,GAAG,WAAW,IAAI,KAAK,SAAS;GACjF,MAAM,mBAAmB,CAAC,KAAK,iBAAiB,cAAc,IAAI,KAAK,cAAc;AAErF,OAAI,CAAC,eAAe,CAAC,iBAAkB;GAEvC,MAAM,WAAW,KAAK,SAAS,SAAS,IAAI,GAAG,WAAW,IAAI,KAAK,SAAS,GAAG;GAC/E,MAAM,gBAAgB,KAAK,gBAAgB,cAAc,IAAI,KAAK,cAAc,GAAG;GAEnF,MAAM,WAAW,MAAM,SAAS,WAAW,cAAc,KAAK,MAAM,WAAW;AAC/E,OAAI,UAAU;AACb,QAAI,eAAe,QAClB,OAAM,IAAI,MACT,4BAA4B,KAAK,KAAK,QAAQ,aAAa,KAAK,WAAW,kBAC3E;AAEF,QAAI,eAAe,UAAU;AAC5B,WAAM,SAAS,OAAO,SAAS,IAAI;MAClC,OAAO,KAAK;MACZ;MACA,MAAM,KAAK,cAAc,EAAE,aAAa,KAAK,aAAa,GAAG,EAAE;MAC/D,CAAC;AACF,YAAO,WAAW;;AAEnB,aAAS,IAAI,GAAG,WAAW,IAAI,KAAK,QAAQ,SAAS,GAAG;AACxD,QAAI,KAAK,GAAI,eAAc,IAAI,KAAK,IAAI,SAAS,GAAG;UAC9C;IACN,MAAM,UAAU,MAAM,SAAS,OAAO;KACrC,MAAM;KACN,MAAM,KAAK;KACX,OAAO,KAAK;KACZ;KACA,MAAM,KAAK,cAAc,EAAE,aAAa,KAAK,aAAa,GAAG;KAC7D,QAAQ;KACR;KACA,CAAC;AACF,aAAS,IAAI,GAAG,WAAW,IAAI,KAAK,QAAQ,QAAQ,GAAG;AACvD,QAAI,KAAK,GAAI,eAAc,IAAI,KAAK,IAAI,QAAQ,GAAG;AACnD,WAAO,WAAW;;AAGnB,qBAAkB,KAAK,KAAK,OAAO,OAAO,WAAW;;AAGtD,cAAY,UAAU,QACpB,SAAS,CAAC,kBAAkB,SAAS,KAAK,OAAO,OAAO,kBAAkB,KAAK,CAAC,CACjF;AACD;;AAGD,KAAI,UAAU,SAAS,EACtB,SAAQ,KAAK,qBAAqB,UAAU,OAAO,4CAA4C;;;;;;AAQjG,eAAe,oBACd,YACA,gBACA,WACA,OAKA,iBACA,WAAW,OACK;AAChB,KAAI,CAAC,MAAM,WAAW,MAAM,QAAQ,WAAW,GAAG;AAEjD,MAAI,SACH,OAAM,WAAW,kBAAkB,gBAAgB,WAAW,EAAE,CAAC;AAElE;;CAGD,MAAM,UAAU,MAAM,QACpB,KAAK,WAAW;EAChB,MAAM,WAAW,gBAAgB,IAAI,OAAO,OAAO;AACnD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;GACN;GACA,WAAW,OAAO,aAAa;GAC/B;GACA,CACD,QAAQ,WAAqE,QAAQ,OAAO,CAAC;AAE/F,KAAI,QAAQ,WAAW,MAAM,QAAQ,OACpC,SAAQ,KACP,WAAW,eAAe,GAAG,MAAM,QAAQ,MAAM,GAAG,iDACpD;AAMF,KAAI,QAAQ,SAAS,KAAK,SACzB,OAAM,WAAW,kBAAkB,gBAAgB,WAAW,QAAQ;;;;;;AAQxE,eAAe,uBACd,IACA,gBACA,WACA,OACA,UACgB;CAChB,MAAM,WAAW,IAAI,mBAAmB,GAAG;AAE3C,KAAI,SACH,OAAM,SAAS,gBAAgB,gBAAgB,UAAU;AAG1D,KAAI,CAAC,MAAM,YAAY;AAGtB,MAAI,UAAU;GACb,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,wBAAqB;;AAEtB;;AAGD,MAAK,MAAM,CAAC,cAAc,cAAc,OAAO,QAAQ,MAAM,WAAW,CACvE,MAAK,MAAM,YAAY,WAAW;EACjC,MAAM,OAAO,MAAM,SAAS,WAAW,cAAc,SAAS;AAC9D,MAAI,KACH,OAAM,SAAS,cAAc,gBAAgB,WAAW,KAAK,GAAG;;CAQnE,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,sBAAqB;;;;;;;;;;AAWtB,eAAe,eACd,IACA,QACA,QACA,OACA,UACA,YACA,WACA,eACkB;CAClB,IAAI,QAAQ;CACZ,IAAI,QAAQ;AAEZ,MAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,SAAS,MAAM;EACrB,MAAM,aAAa,KAAK,UAAU;EAGlC,IAAI,cAA6B;EACjC,IAAI,sBAAqC;AAEzC,MAAI,KAAK,SAAS,UAAU,KAAK,SAAS,QAEzC;OAAI,KAAK,OAAO,UAAU,IAAI,KAAK,IAAI,EAAE;AACxC,kBAAc,UAAU,IAAI,KAAK,IAAI;AAErC,0BAAsB,KAAK,cAAc,GAAG,KAAK,KAAK;;;EAKxD,IAAI,mBAAmB;AACvB,MAAI,KAAK,eAAe;GACvB,MAAM,SAAS,cAAc,IAAI,KAAK,cAAc;AACpD,OAAI,OAAQ,oBAAmB,OAAO;OAErC,SAAQ,KACP,cAAc,KAAK,SAAS,KAAK,OAAO,KAAK,OAAO,cAAc,KAAK,WAAW,oBAAoB,KAAK,cAAc,yCACzH;;AAGH,QAAM,GACJ,WAAW,qBAAqB,CAChC,OAAO;GACP,IAAI;GACJ,SAAS;GACT,WAAW;GACX,YAAY;GACZ,MAAM,KAAK;GACX,sBAAsB;GACtB,cAAc;GACd,YAAY,KAAK,OAAO;GACxB,OAAO,KAAK,SAAS;GACrB,YAAY,KAAK,aAAa;GAC9B,QAAQ,KAAK,UAAU;GACvB,aAAa,KAAK,cAAc;GAChC,6BAAY,IAAI,MAAM,EAAC,aAAa;GACpC,QAAQ;GACR,mBAAmB;GACnB,CAAC,CACD,SAAS;AAEX,MAAI,KAAK,GAAI,eAAc,IAAI,KAAK,IAAI;GAAE,IAAI;GAAQ;GAAkB,CAAC;AAEzE;AACA;AAEA,MAAI,KAAK,YAAY,KAAK,SAAS,SAAS,GAAG;GAC9C,MAAM,aAAa,MAAM,eACxB,IACA,QACA,YACA,KAAK,UACL,QACA,GACA,WACA,cACA;AACD,YAAS;;;AAIX,QAAO;;;;;AAMR,eAAe,YACd,IACA,QACA,QACA,WACgB;AAChB,OAAM,GACJ,WAAW,kBAAkB,CAC7B,OAAO;EACP,IAAI,MAAM;EACV,SAAS;EACT,YAAY;EACZ,MAAM,OAAO;EACb,OAAO,OAAO,SAAS;EAGvB,SAAS,OAAO,UAAU,KAAK,UAAU,OAAO,QAAQ,GAAG;EAC3D,WAAW,OAAO,YAAY;EAC9B,cAAc,OAAO,eAAe;EACpC,iBAAiB,OAAO,QAAQ,KAAK,UAAU,OAAO,MAAM,GAAG;EAC/D,CAAC,CACD,SAAS;;;;;AAgBZ,SAAS,qBAAqB,OAA6C;AAC1E,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,YAAY,OAChE,QAAO;CAER,MAAM,QAAS,MAAkC;AACjD,QACC,OAAO,UAAU,YACjB,UAAU,QACV,SAAS,SACT,OAAQ,MAAkC,QAAQ;;;;;AAOpD,eAAe,kBACd,MACA,WACA,cACA,QACmC;CACnC,MAAM,WAAoC,EAAE;AAE5C,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,CAC9C,UAAS,OAAO,MAAM,aAAa,OAAO,WAAW,cAAc,OAAO;AAG3E,QAAO;;;;;AAMR,eAAe,aACd,OACA,WACA,cACA,QACmB;AAEnB,KAAI,OAAO,UAAU,YAAY,MAAM,WAAW,QAAQ,EAAE;EAC3D,MAAM,SAAS,MAAM,MAAM,EAAE;AAC7B,SAAO,UAAU,IAAI,OAAO,IAAI;;AAIjC,KAAI,qBAAqB,MAAM,CAC9B,QAAO,aAAa,OAAO,cAAc,OAAO;AAIjD,KAAI,MAAM,QAAQ,MAAM,CACvB,QAAO,QAAQ,IAAI,MAAM,KAAK,SAAS,aAAa,MAAM,WAAW,cAAc,OAAO,CAAC,CAAC;AAI7F,KAAI,OAAO,UAAU,YAAY,UAAU,MAAM;EAChD,MAAM,WAAoC,EAAE;AAC5C,OAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,CACzC,UAAS,KAAK,MAAM,aAAa,GAAG,WAAW,cAAc,OAAO;AAErE,SAAO;;AAGR,QAAO;;;;;;;;;;;;;;AAeR,eAAe,wBACd,IACA,QAC4C;CAK5C,MAAM,WAAW,MAAM,GACrB,WAAW,QAAQ,CACnB,OAAO,KAAK,CACZ,MAAM,eAAe,KAAK,OAAO,WAAW,CAC5C,QAAQ,MAAM,MAAM,CACpB,kBAAkB;AACpB,KAAI,SAAU,QAAO;EAAE,IAAI,SAAS;EAAI,SAAS;EAAO;CAExD,MAAM,WAAW,OAAO,WAAW,MAAM,IAAI,CAAC,KAAK;CACnD,MAAM,WACL,OAAO,aAAa,YAAY,SAAS,SAAS,IAAI,WAAW,OAAO;AAUzE,QAAO;EAAE,KATO,MAAM,IAAI,gBAAgB,GAAG,CAAC,OAAO;GACpD;GACA,UAAU,OAAO,YAAY;GAC7B,YAAY,OAAO;GACnB,KAAK,OAAO;GACZ,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,QAAQ;GACR,CAAC,EACmB;EAAI,SAAS;EAAM;;;;;;;AAQzC,eAAe,eAAe,IAAsB,IAA2B;AAC9E,KAAI;AACH,QAAM,GAAG,WAAW,QAAQ,CAAC,MAAM,MAAM,KAAK,GAAG,CAAC,SAAS;UACnD,OAAO;AACf,UAAQ,KAAK,mDAAmD,GAAG,IAAI,MAAM;;;;;;AAO/E,eAAe,aACd,KACA,KACA,QAC6B;CAC7B,MAAM,EAAE,KAAK,KAAK,UAAU,YAAY,IAAI;CAG5C,MAAM,SAAS,IAAI,WAAW,IAAI,IAAI;AACtC,KAAI,QAAQ;AACX,SAAO,MAAM;AACb,SAAO;GAAE,GAAG;GAAQ,KAAK,OAAO,OAAO;GAAK;;AAK7C,KAAI,IAAI,mBAAmB;EAC1B,MAAM,aAAyB;GAC9B,UAAU;GACV,IAAI,MAAM;GACV,KAAK;GACL,KAAK,OAAO;GACZ,UAAU,YAAY;GACtB;AACD,MAAI,WAAW,IAAI,KAAK,WAAW;AACnC,SAAO,MAAM;AACb,SAAO;;AAIR,KAAI,CAAC,IAAI,SAAS;AACjB,UAAQ,KAAK,sDAAsD,MAAM;AACzE,SAAO,MAAM;AACb,SAAO;;AAGR,KAAI;AAEH,sBAAoB,IAAI;AAGxB,UAAQ,IAAI,qBAAqB,MAAM;EACvC,MAAM,WAAW,MAAM,cAAc,KAAK,EACzC,SAAS,EAER,cAAc,kBACd,EACD,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;AACjB,WAAQ,KAAK,2BAA2B,IAAI,IAAI,SAAS,SAAS;AAClE,UAAO,MAAM;AACb,UAAO;;EAIR,MAAM,cAAc,SAAS,QAAQ,IAAI,eAAe,IAAI;EAC5D,MAAM,MAAM,4BAA4B,YAAY,IAAI,oBAAoB,IAAI,IAAI;EAGpF,MAAM,YAAY,MAAM;EACxB,MAAM,gBAAgB,YAAY,iBAAiB,KAAK,IAAI;EAC5D,MAAM,aAAa,GAAG,YAAY;EAGlC,MAAM,cAAc,MAAM,SAAS,aAAa;EAChD,MAAM,OAAO,IAAI,WAAW,YAAY;EAGxC,IAAI;EACJ,IAAI;AACJ,MAAI,YAAY,WAAW,SAAS,EAAE;GACrC,MAAM,aAAa,mBAAmB,KAAK;AAC3C,WAAQ,YAAY;AACpB,YAAS,YAAY;;AAItB,QAAM,IAAI,QAAQ,OAAO;GACxB,KAAK;GACL;GACA;GACA,CAAC;EAiBF,MAAM,aAAyB;GAC9B,UAAU;GACV,KAfa,MADI,IAAI,gBAAgB,IAAI,GAAG,CACf,OAAO;IACpC,UAAU;IACV,UAAU;IACV,MAAM,KAAK;IACX;IACA;IACA;IACA;IACA;IACA,QAAQ;IACR,CAAC,EAKS;GACV,KAAK,OAAO;GACZ;GACA;GACA,UAAU;GACV,UAAU;GACV,MAAM,EAAE,YAAY;GACpB;AAGD,MAAI,WAAW,IAAI,KAAK,WAAW;AACnC,SAAO,MAAM;AAEb,UAAQ,IAAI,iBAAiB,gBAAgB;AAC7C,SAAO;UACC,OAAO;AACf,UAAQ,KACP,gCAAgC,IAAI,IACpC,iBAAiB,QAAQ,MAAM,UAAU,MACzC;AACD,SAAO,MAAM;AACb,SAAO;;;;;;AAOT,SAAS,4BAA4B,aAAoC;CAExE,MAAM,WAAW,YAAY,MAAM,IAAI,CAAC,GAAG,MAAM;CACjD,MAAM,MAAM,KAAK,aAAa,SAAS;AACvC,QAAO,MAAM,IAAI,QAAQ;;;;;AAM1B,SAAS,oBAAoB,KAA4B;AACxD,KAAI;EAEH,MAAM,QADW,IAAI,IAAI,IAAI,CAAC,SACP,MAAM,uBAAuB;AACpD,SAAO,QAAQ,IAAI,MAAM,OAAO;SACzB;AACP,SAAO;;;;;;AAOT,SAAS,iBAAiB,KAAa,KAAqB;AAC3D,KAAI;AAOH,SAAO,IANU,IAAI,IAAI,IAAI,CAAC,SACJ,MAAM,IAAI,CAAC,KAAK,IAAI,SAExB,QAAQ,mBAAmB,GAAG,CAAC,QAAQ,qBAAqB,GAAG,CAE9D,QAAQ,kBAAkB,IAAI,CAAC,QAAQ,0BAA0B,IAAI,IACrE,UAAU;SAC1B;AACP,SAAO,QAAQ;;;;;;;AAQjB,SAAS,mBAAmB,QAA8D;AACzF,KAAI;EACH,MAAM,SAAS,UAAU,OAAO;AAChC,MAAI,OAAO,SAAS,QAAQ,OAAO,UAAU,KAC5C,QAAO;GAAE,OAAO,OAAO;GAAO,QAAQ,OAAO;GAAQ;AAEtD,SAAO;SACA;AACP,SAAO"}

package/dist/{config-it29yDLA.mjs → artifact-fetch-P2JXVwOq.mjs}

@@ -1,6 +1,5 @@
-import { i as resolveAndValidateExternalUrlTarget, t as SsrfError } from "./ssrf-5sIM5jzl.mjs";
+import { i as resolveAndValidateExternalUrlTarget, t as SsrfError } from "./ssrf-gl4gFNhw.mjs";
 import { RECORD_SCOPED_BLOB_CACHE_TYPE } from "@emdash-cms/registry-lexicons";
-import { isDid } from "@atcute/lexicons/syntax";
 
 //#region ../registry-verification/dist/auth-B730dpJ4.js
 const UNSUPPORTED_AUTH_MESSAGE = "This release requires an authentication method the client does not support.";
@@ -167,7 +166,7 @@ const DIGITS = /^\d+$/;
 const IPV4_LITERAL = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 const IPV4_PART = /^\d{1,3}$/;
 const IPV6_PART = /^[0-9a-f]{1,4}$/i;
-const TRAILING_DOT$2 = /\.+$/;
+const TRAILING_DOT$1 = /\.+$/;
 const DEFAULT_FETCH_LIMITS = {
 	headerTimeoutMs: 1e4,
 	totalTimeoutMs: 3e4,
@@ -237,7 +236,7 @@ function parseAndValidateUrl(value, base, allowHttpLocalhost = false) {
 }
 function isAllowedLoopback(url, enabled) {
 	if (!enabled || url.protocol !== "http:" && url.protocol !== "https:") return false;
-	const hostname = url.hostname.toLowerCase().replace(TRAILING_DOT$2, "");
+	const hostname = url.hostname.toLowerCase().replace(TRAILING_DOT$1, "");
 	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
 }
 async function validateHost(url, resolver, timeoutMs) {
@@ -620,7 +619,7 @@ function isSafePathSegment(value) {
 
 //#endregion
 //#region src/registry/artifact-fetch.ts
-const TRAILING_DOT$1 = /\.+$/;
+const TRAILING_DOT = /\.+$/;
 const HEADER_END = new Uint8Array([
 	13,
 	10,
@@ -642,7 +641,7 @@ const LOCALHOST_HOSTNAMES = new Set([
 ]);
 let defaultTransport = null;
 function isLocalhostHostname(hostname) {
-	const normalized = hostname.toLowerCase().replace(TRAILING_DOT$1, "");
+	const normalized = hostname.toLowerCase().replace(TRAILING_DOT, "");
 	return LOCALHOST_HOSTNAMES.has(normalized) || normalized.endsWith(".localhost") || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]" || normalized.startsWith("::ffff:127.") || normalized.startsWith("::ffff:7f00:");
 }
 async function resolveSafeArtifactTarget(urlString) {
@@ -654,7 +653,7 @@ async function resolveSafeArtifactTarget(urlString) {
 	}
 	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`Artifact URL protocol not allowed: ${url.protocol}`);
 	if (url.username || url.password) throw new Error("Artifact URL must not contain embedded credentials");
-	const hostname = stripIpv6Brackets(url.hostname.toLowerCase().replace(TRAILING_DOT$1, ""));
+	const hostname = stripIpv6Brackets(url.hostname.toLowerCase().replace(TRAILING_DOT, ""));
 	const localhost = isLocalhostHostname(hostname);
 	if (!import.meta.env.DEV) {
 		if (url.protocol === "http:") throw new Error("Artifact URL must use https");
@@ -969,195 +968,5 @@ async function abortable(operation, signal, onAbort) {
 }
 
 //#endregion
-//#region src/registry/config.ts
-/**
-* Helpers for normalizing the experimental registry integration option
-* (`config.experimental.registry` in `astro.config.mjs`) into the shape
-* exposed on the admin manifest.
-*
-* The integration option accepts a human-friendly duration string for
-* `policy.minimumReleaseAge` (`"48h"`, `"7d"`); the manifest exposes
-* seconds so the browser doesn't need a duration parser.
-*/
-/**
-* Canonicalize a capabilities list for set-style comparison.
-*
-* Capabilities (the legacy declared-access shape used by the current
-* sandbox enforcer) are conceptually a *set*: order, duplicates, and
-* non-string entries don't carry meaning. The install handler's drift
-* check compares the admin's acknowledged set against the bundle
-* manifest's set; both sides pass through this canonicalizer first so
-* an aggregator-supplied array with unstable order or junk entries
-* can't cause a spurious drift rejection.
-*
-* Filters non-strings, deduplicates, and sorts lexically. Named to
-* avoid shadowing `@emdash-cms/plugin-types`'s existing
-* `normalizeCapabilities` (which dedupes + applies the deprecated →
-* current alias map but does not filter junk or sort).
-*
-* Exported so the same shape is produced by the browser before sending
-* the `acknowledgedDeclaredAccess` payload and by the server before
-* comparing against the bundle.
-*/
-function canonicalCapabilitiesForDriftCheck(value) {
-	if (!Array.isArray(value)) return [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of value) if (typeof entry === "string" && entry.length > 0) seen.add(entry);
-	return [...seen].toSorted();
-}
-/**
-* Returns whether a `(publisher_did, slug)` pair is on the
-* minimum-release-age exemption list. Exported so the same matcher is
-* used by the browser policy filter and the server-side install
-* enforcement.
-*
-* Matching is DID-only. Handles are aggregator-supplied envelope data
-* (mutable, controlled by an attacker who compromises the aggregator)
-* and cannot be used as a trust input -- a compromised aggregator
-* could claim any handle for any package and bypass the holdback. DIDs
-* are part of the AT URI of the package record and are independently
-* resolvable, so even a compromised aggregator can't lie about the
-* publisher DID without also breaking checksum verification downstream.
-*
-* Entries from config are already lowercased at manifest-build time.
-* Runtime values are lowercased here at compare time.
-*/
-function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
-	if (!exclude || exclude.length === 0) return false;
-	const didLower = publisherDid.toLowerCase();
-	const fullDid = `${didLower}/${slug.toLowerCase()}`;
-	for (const entry of exclude) {
-		if (entry === didLower) return true;
-		if (entry === fullDid) return true;
-	}
-	return false;
-}
-const DURATION_PATTERN = /^(\d+)(s|m|h|d|w)$/;
-/** Trailing slashes on the aggregator URL, stripped during normalization. */
-const TRAILING_SLASHES = /\/+$/;
-/** Trailing dot on a hostname, stripped before URL host comparisons. */
-const TRAILING_DOT = /\.$/;
-const REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
-/**
-* Parse a duration string or raw second count into a non-negative
-* integer count of seconds. Throws on unrecognised input so config
-* mistakes fail at startup rather than silently disabling the policy.
-*/
-function parseDurationSeconds(duration) {
-	if (typeof duration === "number") {
-		if (!Number.isFinite(duration) || duration < 0) throw new Error(`Invalid duration: ${duration} (must be a non-negative finite number)`);
-		return Math.floor(duration);
-	}
-	const match = duration.match(DURATION_PATTERN);
-	if (!match) throw new Error(`Invalid duration format: "${duration}". Use a duration string like "48h", "7d", "30m", or a number of seconds.`);
-	const value = parseInt(match[1], 10);
-	const unit = match[2];
-	switch (unit) {
-		case "s": return value;
-		case "m": return value * 60;
-		case "h": return value * 60 * 60;
-		case "d": return value * 24 * 60 * 60;
-		case "w": return value * 7 * 24 * 60 * 60;
-		default: throw new Error(`Unknown duration unit: ${unit}`);
-	}
-}
-/**
-* Validate that `aggregatorUrl` is a safe outbound target for the
-* registry's XRPC calls. Same posture as artifact downloads: HTTPS
-* required in production; `http://localhost` allowed only in dev.
-*
-* The aggregator's responses are the trust source for release records,
-* checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST
-* verification lands). Allowing plain HTTP here would let a network
-* attacker swap a release record and point the artifact URL at their
-* own HTTPS bundle, defeating the checksum trust chain because the
-* attacker controls the unsigned transport that supplied the checksum.
-*/
-function validateAggregatorUrl(aggregatorUrl) {
-	let parsed;
-	try {
-		parsed = new URL(aggregatorUrl);
-	} catch {
-		throw new Error(`registry.aggregatorUrl is not a valid URL: ${aggregatorUrl}`);
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`registry.aggregatorUrl must use http or https: ${aggregatorUrl}`);
-	if (parsed.username || parsed.password) throw new Error("registry.aggregatorUrl must not contain embedded credentials (user:pass@)");
-	const rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, "");
-	const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
-	const isLocalhost = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1" || hostname.startsWith("::ffff:127.") || hostname.startsWith("::ffff:7f00:");
-	if (!import.meta.env.DEV) {
-		if (parsed.protocol === "http:") throw new Error(`registry.aggregatorUrl must use https in production: ${aggregatorUrl}`);
-		if (isLocalhost) throw new Error(`registry.aggregatorUrl points at localhost; allowed only in dev: ${aggregatorUrl}`);
-	} else if (parsed.protocol === "http:" && !isLocalhost) throw new Error(`registry.aggregatorUrl must use https (http allowed only for localhost in dev): ${aggregatorUrl}`);
-	return parsed;
-}
-/**
-* Expand the `RegistryConfigInput` shorthand into the full
-* `RegistryConfig` object shape.
-*
-* Users can pass a bare aggregator URL string for the common case
-* (`experimental.registry: "https://registry.emdashcms.com"`); the
-* normalizer handles either form transparently.
-*
-* Returns `undefined` for `undefined` input so callers can chain with
-* optional chaining.
-*/
-function coerceRegistryConfig(input) {
-	if (input === void 0) return void 0;
-	if (typeof input === "string") return { aggregatorUrl: input };
-	return input;
-}
-/**
-* Normalize the user-supplied `RegistryConfigInput` into the shape that
-* ships to the admin browser via the manifest endpoint.
-*
-* Accepts either the shorthand string form
-* (`"https://registry.emdashcms.com"`) or the full `RegistryConfig`
-* object. Returns `null` when `input` is undefined so callers can
-* spread the result directly into the manifest object.
-*
-* Throws if the aggregator URL is malformed, points at a forbidden host,
-* or `policy.minimumReleaseAge` is unparseable. These surface at
-* runtime startup as 500s from the manifest endpoint -- intended,
-* because the alternative is silently disabling the registry on
-* misconfigured sites.
-*
-* TODO: switch to a Zod schema for richer per-field error messages and
-* to surface misconfigurations to the admin UI as a banner instead of
-* a manifest 500.
-*/
-function normalizeRegistryConfig(input) {
-	const config = coerceRegistryConfig(input);
-	if (!config) return null;
-	const aggregatorUrl = config.aggregatorUrl?.trim();
-	if (!aggregatorUrl) throw new Error("registry.aggregatorUrl is required when registry is configured");
-	validateAggregatorUrl(aggregatorUrl);
-	const out = { aggregatorUrl: aggregatorUrl.replace(TRAILING_SLASHES, "") };
-	if (config.acceptLabelers) out.acceptLabelers = config.acceptLabelers;
-	const policy = {};
-	let hasPolicy = false;
-	if (config.policy?.minimumReleaseAge !== void 0) {
-		policy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);
-		hasPolicy = true;
-	}
-	if (config.policy?.minimumReleaseAgeExclude !== void 0) {
-		const list = config.policy.minimumReleaseAgeExclude.map((entry) => {
-			const trimmed = entry.trim();
-			if (!trimmed) throw new Error("registry.policy.minimumReleaseAgeExclude entries cannot be empty");
-			const lower = trimmed.toLowerCase();
-			const [did, slug, ...extra] = lower.split("/");
-			if (!did || !isDid(did) || extra.length > 0 || slug !== void 0 && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug)) throw new Error(`registry.policy.minimumReleaseAgeExclude entry must be a DID or <did>/<slug>: ${trimmed}`);
-			return lower;
-		});
-		if (list.length > 0) {
-			policy.minimumReleaseAgeExclude = list;
-			hasPolicy = true;
-		}
-	}
-	if (hasPolicy) out.policy = policy;
-	return out;
-}
-
-//#endregion
-export { releaseExemptFromMinimumAge as a, fetchReleaseArtifact as c, fetchVerifiedResource as d, computeArtifactDigestCandidates as f, verificationError as h, parseDurationSeconds as i, recordScopedImageCacheUrl as l, verifyMultihash as m, coerceRegistryConfig as n, validateAggregatorUrl as o, multihashFromBlobCid as p, normalizeRegistryConfig as r, fetchRegistryArtifactUrl as s, canonicalCapabilitiesForDriftCheck as t, resolvePublisherPdsEndpoint as u };
-//# sourceMappingURL=config-it29yDLA.mjs.map
+export { fetchVerifiedResource as a, verifyMultihash as c, resolvePublisherPdsEndpoint as i, verificationError as l, fetchReleaseArtifact as n, computeArtifactDigestCandidates as o, recordScopedImageCacheUrl as r, multihashFromBlobCid as s, fetchRegistryArtifactUrl as t };
+//# sourceMappingURL=artifact-fetch-P2JXVwOq.mjs.map