emdash 0.37.0 → 0.39.0

package/dist/artifact-fetch-COiMhVgk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-fetch-COiMhVgk.mjs","names":["TRAILING_DOT"],"sources":["../../registry-verification/dist/fetch-B66dZAfm.js","../../registry-verification/dist/artifact.js","../src/registry/artifact-fetch.ts"],"sourcesContent":["import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/fetch.ts\nconst DIGITS = /^\\d+$/;\nconst IPV4_LITERAL = /^\\d{1,3}(?:\\.\\d{1,3}){3}$/;\nconst IPV4_PART = /^\\d{1,3}$/;\nconst IPV6_PART = /^[0-9a-f]{1,4}$/i;\nconst TRAILING_DOT = /\\.+$/;\nconst DEFAULT_FETCH_LIMITS = {\n\theaderTimeoutMs: 1e4,\n\ttotalTimeoutMs: 3e4,\n\tmaxBytes: 25 * 1024 * 1024,\n\tmaxRedirects: 3\n};\nasync function fetchVerifiedResource(value, options) {\n\tconst limits = {\n\t\theaderTimeoutMs: options.headerTimeoutMs ?? DEFAULT_FETCH_LIMITS.headerTimeoutMs,\n\t\ttotalTimeoutMs: options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs,\n\t\tmaxBytes: options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes,\n\t\tmaxRedirects: options.maxRedirects ?? DEFAULT_FETCH_LIMITS.maxRedirects\n\t};\n\tif (!areValidLimits(limits)) return verificationError(\"INVALID_URL\", \"Fetch limits must be positive integers.\");\n\tconst startedAt = Date.now();\n\tlet currentUrl = parseAndValidateUrl(value, void 0, options.allowHttpLocalhost === true);\n\tif (!currentUrl.success) return currentUrl;\n\tfor (let redirects = 0;; redirects += 1) {\n\t\tconst remaining = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remaining <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst host = isAllowedLoopback(currentUrl.value, options.allowHttpLocalhost === true) ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t} : await validateHost(currentUrl.value, options.resolveHostname, remaining);\n\t\tif (!host.success) return host;\n\t\tconst remainingAfterResolution = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remainingAfterResolution <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst response = await fetchResponse(options.fetch, currentUrl.value, Math.min(remainingAfterResolution, limits.headerTimeoutMs));\n\t\tif (!response.success) return response;\n\t\tif (isRedirect(response.value.status)) {\n\t\t\tif (redirects >= limits.maxRedirects) return verificationError(\"REDIRECT_LIMIT_EXCEEDED\", \"The resource exceeded the redirect limit.\");\n\t\t\tconst location = response.value.headers.get(\"location\");\n\t\t\tif (location === null) return verificationError(\"REDIRECT_LOCATION_MISSING\", \"The redirect response has no location header.\");\n\t\t\tcurrentUrl = parseAndValidateUrl(location, currentUrl.value, options.allowHttpLocalhost === true);\n\t\t\tif (!currentUrl.success) return currentUrl;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!response.value.ok && !options.allowedStatuses?.includes(response.value.status)) return verificationError(\"RESOURCE_STATUS_ERROR\", `The resource returned HTTP ${response.value.status}.`);\n\t\tconst contentLength = response.value.headers.get(\"content-length\");\n\t\tif (contentLength !== null && (!DIGITS.test(contentLength) || Number(contentLength) > limits.maxBytes)) return verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\tconst bytes = await readResponse(response.value, limits.maxBytes, startedAt, limits.totalTimeoutMs);\n\t\tif (!bytes.success) return bytes;\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: {\n\t\t\t\tbytes: bytes.value,\n\t\t\t\turl: currentUrl.value,\n\t\t\t\tstatus: response.value.status,\n\t\t\t\theaders: response.value.headers\n\t\t\t}\n\t\t};\n\t}\n}\nfunction parseAndValidateUrl(value, base, allowHttpLocalhost = false) {\n\tlet url;\n\ttry {\n\t\turl = new URL(value, base);\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The resource URL is invalid.\");\n\t}\n\tif (url.protocol !== \"https:\" && !isAllowedLoopback(url, allowHttpLocalhost) || url.username !== \"\" || url.password !== \"\") return verificationError(\"INVALID_URL\", \"Resource URLs must use HTTPS and cannot include credentials.\");\n\tif (!isAllowedLoopback(url, allowHttpLocalhost) && (isIpLiteral(url.hostname) || isLocalHostname(url.hostname))) return verificationError(\"HOST_REJECTED\", \"The resource host is not permitted.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nfunction isAllowedLoopback(url, enabled) {\n\tif (!enabled || url.protocol !== \"http:\" && url.protocol !== \"https:\") return false;\n\tconst hostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn hostname === \"localhost\" || hostname.endsWith(\".localhost\") || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\nasync function validateHost(url, resolver, timeoutMs) {\n\ttry {\n\t\tconst addresses = await withTimeout(Promise.resolve().then(() => resolver(url.hostname)), timeoutMs);\n\t\tif (addresses.length === 0 || addresses.some(isForbiddenAddress)) return verificationError(\"HOST_REJECTED\", \"The resource host resolved to a forbidden address.\");\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"HOST_REJECTED\", \"The resource host could not be validated.\");\n\t}\n}\nasync function fetchResponse(fetchImplementation, url, timeoutMs) {\n\tconst controller = new AbortController();\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => fetchImplementation(url, {\n\t\t\t\tmethod: \"GET\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: controller.signal\n\t\t\t})), timeoutMs, () => controller.abort())\n\t\t};\n\t} catch (error) {\n\t\tif (controller.signal.aborted || isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource response headers timed out.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource request failed.\");\n\t}\n}\nasync function readResponse(response, maximumBytes, startedAt, totalTimeoutMs) {\n\tif (response.body === null) return {\n\t\tsuccess: true,\n\t\tvalue: new Uint8Array()\n\t};\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet length = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst remaining = totalTimeoutMs - (Date.now() - startedAt);\n\t\t\tif (remaining <= 0) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\t\t}\n\t\t\tconst chunk = await readWithTimeout(reader, remaining);\n\t\t\tif (!chunk.success) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn chunk;\n\t\t\t}\n\t\t\tif (chunk.value.done) break;\n\t\t\tconst value = chunk.value.value;\n\t\t\tlength += value.length;\n\t\t\tif (length > maximumBytes) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch {\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst output = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\toutput.set(chunk, offset);\n\t\toffset += chunk.length;\n\t}\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: output\n\t};\n}\nasync function readWithTimeout(reader, timeoutMs) {\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => reader.read()), timeoutMs)\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t}\n}\n/**\n* Every operation has both fulfillment and rejection handlers, so an operation\n* that loses the timeout race cannot later become an unhandled rejection.\n*/\nfunction withTimeout(operation, timeoutMs, onTimeout) {\n\treturn new Promise((resolve, reject) => {\n\t\tlet settled = false;\n\t\tconst timeout = setTimeout(() => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tonTimeout?.();\n\t\t\treject(new DOMException(\"Timed out\", \"AbortError\"));\n\t\t}, timeoutMs);\n\t\toperation.then((value) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\tresolve(value);\n\t\t}, (error) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\treject(error);\n\t\t});\n\t});\n}\nfunction areValidLimits(limits) {\n\treturn Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);\n}\nfunction isRedirect(status) {\n\treturn status === 301 || status === 302 || status === 303 || status === 307 || status === 308;\n}\nfunction isAbortError(error) {\n\treturn error instanceof DOMException && error.name === \"AbortError\";\n}\nfunction isIpLiteral(hostname) {\n\treturn IPV4_LITERAL.test(hostname) || hostname.includes(\":\");\n}\nfunction isLocalHostname(hostname) {\n\tconst normalized = hostname.toLowerCase();\n\treturn normalized === \"localhost\" || normalized.endsWith(\".localhost\") || normalized.endsWith(\".local\") || normalized.endsWith(\".internal\");\n}\nfunction isForbiddenAddress(address) {\n\tconst ipv4 = parseIpv4(address);\n\tif (ipv4 !== null) {\n\t\tconst [a, b] = ipv4;\n\t\treturn a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;\n\t}\n\tconst ipv6 = parseIpv6(address);\n\tif (ipv6 === null) return true;\n\tconst first = ipv6[0];\n\tconst isUnspecified = ipv6.every((part) => part === 0);\n\tconst isLoopback = ipv6.slice(0, 7).every((part) => part === 0) && ipv6[7] === 1;\n\tconst isPrivate = (first & 65024) === 64512;\n\tconst isLinkLocal = (first & 65472) === 65152;\n\tconst isMulticast = (first & 65280) === 65280;\n\tif (ipv6.slice(0, 5).every((part) => part === 0) && ipv6[5] === 65535) return isForbiddenAddress(`${ipv6[6] >>> 8}.${ipv6[6] & 255}.${ipv6[7] >>> 8}.${ipv6[7] & 255}`);\n\treturn isUnspecified || isLoopback || isPrivate || isLinkLocal || isMulticast;\n}\nfunction parseIpv4(value) {\n\tconst parts = value.split(\".\");\n\tif (parts.length !== 4) return null;\n\tconst numbers = parts.map((part) => IPV4_PART.test(part) ? Number(part) : NaN);\n\tif (numbers.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;\n\treturn [\n\t\tnumbers[0],\n\t\tnumbers[1],\n\t\tnumbers[2],\n\t\tnumbers[3]\n\t];\n}\nfunction parseIpv6(value) {\n\tif (value.includes(\":::\") || value.split(\"::\").length > 2) return null;\n\tconst [before = \"\", after = \"\"] = value.split(\"::\");\n\tconst head = before === \"\" ? [] : before.split(\":\");\n\tconst tail = after === \"\" ? [] : after.split(\":\");\n\tconst parts = [...head, ...tail];\n\tif (parts.some((part) => !IPV6_PART.test(part)) || parts.length > 8) return null;\n\tif (!value.includes(\"::\") && parts.length !== 8) return null;\n\tconst zeroes = value.includes(\"::\") ? 8 - parts.length : 0;\n\treturn [\n\t\t...head,\n\t\t...Array.from({ length: zeroes }).fill(\"0\"),\n\t\t...tail\n\t].map((part) => Number.parseInt(part, 16));\n}\n\n//#endregion\nexport { fetchVerifiedResource as n, DEFAULT_FETCH_LIMITS as t };\n//# sourceMappingURL=fetch-B66dZAfm.js.map","import { n as unsupportedAuthDetails, t as UNSUPPORTED_AUTH_MESSAGE } from \"./auth-B730dpJ4.js\";\nimport { n as verificationError } from \"./errors-D3_zxvwe.js\";\nimport { multihashFromBlobCid, verifyMultihash } from \"./checksum.js\";\nimport { n as fetchVerifiedResource, t as DEFAULT_FETCH_LIMITS } from \"./fetch-B66dZAfm.js\";\nimport { RECORD_SCOPED_BLOB_CACHE_TYPE } from \"@emdash-cms/registry-lexicons\";\n\n//#region src/artifact.ts\nconst DID_DOCUMENT_MAX_BYTES = 256 * 1024;\nconst PLC_DID_PATTERN = /^did:plc:[a-z2-7]{24}$/;\nconst CID_PATTERN = /^b[a-z2-7]+$/;\nconst UNSAFE_PATH_SEGMENT = /[/\\\\?#]/;\nasync function fetchReleaseArtifact(input, options) {\n\tconst deadline = Date.now() + (options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs);\n\tconst { artifact } = input;\n\tif (!artifact.blob && !artifact.url) return verificationError(\"RELEASE_ARTIFACT_SOURCE_MISSING\", \"The release artifact must provide a blob or URL.\");\n\tif (artifact.requiresAuth === true || input.auth !== void 0) return unsupportedAuth(input.auth);\n\tconst blobCid = modernBlobCid(artifact.blob);\n\tconst blobMetadata = blobCid && artifact.blob && \"ref\" in artifact.blob ? artifact.blob : void 0;\n\tif (artifact.blob && !blobCid) return verificationError(\"BLOB_REF_INVALID\", \"Legacy blob references are not supported.\");\n\tif (blobCid) {\n\t\tconst expected = multihashFromBlobCid(blobCid);\n\t\tif (!expected.success) return expected;\n\t\tif (expected.value !== artifact.checksum) return verificationError(\"CHECKSUM_MISMATCH\", \"The artifact checksum does not match its blob reference CID.\");\n\t}\n\tlet lastError;\n\tfor (const cache of input.artifactCaches ?? []) {\n\t\tconst serviceEndpoint = recordScopedCacheEndpoint(cache);\n\t\tif (!serviceEndpoint || !blobCid) continue;\n\t\tconst cacheUrl = recordScopedBlobCacheUrl(serviceEndpoint, input.record, blobCid);\n\t\tif (!cacheUrl.success) {\n\t\t\tlastError = cacheUrl.error;\n\t\t\tcontinue;\n\t\t}\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"artifact-cache\", cacheUrl.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\tif (blobCid) {\n\t\tconst resolutionOptions = withinDeadline(options, deadline);\n\t\tif (!resolutionOptions) return timedOut();\n\t\tconst pds = input.pdsEndpoint ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: input.pdsEndpoint\n\t\t} : await resolvePublisherPdsEndpoint(input.record.did, resolutionOptions);\n\t\tif (pds.success) {\n\t\t\tconst url = blobUrl(pds.value, input.record.did, blobCid);\n\t\t\tif (url.success) {\n\t\t\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\t\t\tif (!attemptOptions) return timedOut();\n\t\t\t\tconst result = await fetchAndVerify(\"blob\", url.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\t\t\tif (result.success) return result;\n\t\t\t\tlastError = result.error;\n\t\t\t} else lastError = url.error;\n\t\t} else lastError = pds.error;\n\t}\n\tif (artifact.url) {\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"url\", artifact.url, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\treturn lastError ? {\n\t\tsuccess: false,\n\t\terror: lastError\n\t} : verificationError(\"FETCH_FAILED\", \"The release artifact could not be fetched.\");\n}\nfunction recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid) {\n\ttry {\n\t\tconst endpoint = new URL(serviceEndpoint);\n\t\tif (endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password || endpoint.pathname !== \"/\" || endpoint.search || endpoint.hash) throw new Error();\n\t\tconst segments = [\n\t\t\t\"r\",\n\t\t\trecord.did,\n\t\t\trecord.collection,\n\t\t\trecord.rkey,\n\t\t\trecord.cid,\n\t\t\tblobCid\n\t\t];\n\t\tif (!CID_PATTERN.test(record.cid) || !CID_PATTERN.test(blobCid) || segments.some((segment) => !isSafePathSegment(segment))) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new URL(segments.join(\"/\"), endpoint)\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The record-scoped blob cache endpoint is invalid.\");\n\t}\n}\nfunction recordScopedImageCacheUrl(serviceEndpoint, preset, record, blobCid) {\n\tconst raw = recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid);\n\tif (!raw.success) return raw;\n\tconst url = new URL(raw.value);\n\turl.pathname = `/img/${preset}${url.pathname}`;\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nasync function resolvePublisherPdsEndpoint(publisherDid, options) {\n\tconst documentUrl = didDocumentUrl(publisherDid);\n\tif (!documentUrl) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID is not supported.\");\n\tconst fetched = await fetchVerifiedResource(documentUrl, {\n\t\t...options,\n\t\tmaxBytes: DID_DOCUMENT_MAX_BYTES\n\t});\n\tif (!fetched.success) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document could not be fetched.\");\n\tlet document;\n\ttry {\n\t\tdocument = JSON.parse(new TextDecoder().decode(fetched.value.bytes));\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document is malformed.\");\n\t}\n\tif (!isRecord(document) || document.id !== publisherDid || !Array.isArray(document.service)) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\tconst service = document.service.find((value) => isRecord(value) && (value.id === `${publisherDid}#atproto_pds` || value.id === \"#atproto_pds\") && value.type === \"AtprotoPersonalDataServer\" && typeof value.serviceEndpoint === \"string\");\n\tif (!isRecord(service) || typeof service.serviceEndpoint !== \"string\") return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\ttry {\n\t\tconst endpoint = new URL(service.serviceEndpoint);\n\t\tif (!(options.allowHttpLocalhost === true && endpoint.protocol === \"http:\" && (endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\")) && endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: endpoint.href\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\t}\n}\nasync function fetchAndVerify(source, url, checksum, options, blobMetadata) {\n\tconst fetched = await fetchVerifiedResource(url, options);\n\tif (!fetched.success) return blobMetadata && fetched.error.code === \"RESOURCE_SIZE_EXCEEDED\" ? verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact size does not match its signed blob metadata.\") : fetched;\n\tconst verified = await verifyMultihash(fetched.value.bytes, checksum);\n\tif (!verified.success) return verified;\n\tconst contentType = fetched.value.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim();\n\tif (blobMetadata && (fetched.value.bytes.byteLength !== blobMetadata.size || contentType !== void 0 && contentType !== blobMetadata.mimeType)) return verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact does not match its signed blob metadata.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\tbytes: fetched.value.bytes,\n\t\t\tsource,\n\t\t\turl: fetched.value.url\n\t\t}\n\t};\n}\nfunction withBlobSizeLimit(options, blobMetadata) {\n\tif (!blobMetadata) return options;\n\treturn {\n\t\t...options,\n\t\tmaxBytes: Math.min(options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes, blobMetadata.size)\n\t};\n}\nfunction blobUrl(pdsEndpoint, publisherDid, cid) {\n\ttry {\n\t\tconst url = new URL(\"/xrpc/com.atproto.sync.getBlob\", pdsEndpoint);\n\t\turl.searchParams.set(\"did\", publisherDid);\n\t\turl.searchParams.set(\"cid\", cid);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: url\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher PDS endpoint is invalid.\");\n\t}\n}\nfunction didDocumentUrl(did) {\n\tif (PLC_DID_PATTERN.test(did)) return `https://plc.directory/${encodeURIComponent(did)}`;\n\tif (!did.startsWith(\"did:web:\")) return null;\n\ttry {\n\t\tconst parts = did.slice(8).split(\":\").map(decodeURIComponent);\n\t\tconst host = parts.shift();\n\t\tif (!host || parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) return null;\n\t\tconst path = parts.length === 0 ? \"/.well-known/did.json\" : `/${parts.join(\"/\")}/did.json`;\n\t\treturn new URL(path, `https://${host}`).href;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction unsupportedAuth(auth) {\n\treturn verificationError(\"AUTH_METHOD_UNSUPPORTED\", UNSUPPORTED_AUTH_MESSAGE, unsupportedAuthDetails(auth));\n}\nfunction withinDeadline(options, deadline) {\n\tconst remaining = deadline - Date.now();\n\tif (remaining <= 0) return null;\n\treturn {\n\t\t...options,\n\t\ttotalTimeoutMs: remaining\n\t};\n}\nfunction timedOut() {\n\treturn verificationError(\"RESOURCE_TIMEOUT\", \"Artifact retrieval exceeded its total timeout.\");\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction modernBlobCid(blob) {\n\tif (!blob || !(\"ref\" in blob) || typeof blob.ref?.$link !== \"string\") return null;\n\treturn blob.ref.$link;\n}\nfunction recordScopedCacheEndpoint(value) {\n\tif (!isRecord(value) || value.$type !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;\n\treturn typeof value.serviceEndpoint === \"string\" ? value.serviceEndpoint : null;\n}\nfunction isSafePathSegment(value) {\n\tif (value.length === 0 || UNSAFE_PATH_SEGMENT.test(value)) return false;\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return false;\n\t}\n\treturn true;\n}\n\n//#endregion\nexport { fetchReleaseArtifact, recordScopedBlobCacheUrl, recordScopedImageCacheUrl, resolvePublisherPdsEndpoint };\n//# sourceMappingURL=artifact.js.map","import { resolveAndValidateExternalUrlTarget, SsrfError } from \"../security/ssrf.js\";\n\nconst TRAILING_DOT = /\\.+$/;\nconst HEADER_END = new Uint8Array([13, 10, 13, 10]);\nconst CRLF = new Uint8Array([13, 10]);\nconst STATUS_LINE_RE = /^HTTP\\/1\\.[01] ([2-5][0-9]{2})(?: .*)?$/;\nconst HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;\nconst FOLDED_HEADER_RE = /^[ \\t]/;\nconst CONTENT_LENGTH_RE = /^(0|[1-9][0-9]*)$/;\nconst CHUNK_SIZE_RE = /^[0-9A-Fa-f]+$/;\nconst MAX_HEADER_BYTES = 32 * 1024;\nconst LOCALHOST_HOSTNAMES = new Set([\n\t\"localhost\",\n\t\"localhost.localdomain\",\n\t\"ip6-localhost\",\n\t\"ip6-loopback\",\n]);\n\nexport interface RegistryArtifactTransportInput {\n\turl: URL;\n\tallowedAddresses: readonly string[];\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nexport interface RegistryArtifactTransport {\n\tfetch(input: RegistryArtifactTransportInput): Promise<{\n\t\tresponse: Response;\n\t\tconnectedAddress: string;\n\t}>;\n}\n\nexport interface RegistryArtifactFetchOptions {\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nlet defaultTransport: RegistryArtifactTransport | null = null;\n\nexport function setDefaultRegistryArtifactTransport(\n\ttransport: RegistryArtifactTransport | null,\n): RegistryArtifactTransport | null {\n\tconst previous = defaultTransport;\n\tdefaultTransport = transport;\n\treturn previous;\n}\n\nfunction isLocalhostHostname(hostname: string): boolean {\n\tconst normalized = hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn (\n\t\tLOCALHOST_HOSTNAMES.has(normalized) ||\n\t\tnormalized.endsWith(\".localhost\") ||\n\t\tnormalized === \"127.0.0.1\" ||\n\t\tnormalized === \"::1\" ||\n\t\tnormalized === \"[::1]\" ||\n\t\tnormalized.startsWith(\"::ffff:127.\") ||\n\t\tnormalized.startsWith(\"::ffff:7f00:\")\n\t);\n}\n\nasync function resolveSafeArtifactTarget(urlString: string): Promise<{\n\turl: URL;\n\taddresses: readonly string[];\n}> {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(urlString);\n\t} catch {\n\t\tthrow new Error(`Invalid artifact URL: ${urlString}`);\n\t}\n\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n\t\tthrow new Error(`Artifact URL protocol not allowed: ${url.protocol}`);\n\t}\n\tif (url.username || url.password) {\n\t\tthrow new Error(\"Artifact URL must not contain embedded credentials\");\n\t}\n\n\tconst rawHostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname = stripIpv6Brackets(rawHostname);\n\tconst localhost = isLocalhostHostname(hostname);\n\n\tif (!import.meta.env.DEV) {\n\t\tif (url.protocol === \"http:\") {\n\t\t\tthrow new Error(\"Artifact URL must use https\");\n\t\t}\n\t\tif (localhost) {\n\t\t\tthrow new Error(`Artifact URL points to localhost: ${hostname}`);\n\t\t}\n\t} else if (url.protocol === \"http:\" && !localhost) {\n\t\tthrow new Error(\"Artifact URL must use https (http allowed only for localhost in dev)\");\n\t}\n\n\tif (localhost) {\n\t\treturn { url, addresses: [] };\n\t}\n\n\ttry {\n\t\treturn await resolveAndValidateExternalUrlTarget(url.href);\n\t} catch (error) {\n\t\tif (error instanceof SsrfError) {\n\t\t\tthrow new Error(`Artifact URL rejected: ${error.message}`, { cause: error });\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport async function assertSafeArtifactUrl(urlString: string): Promise<URL> {\n\treturn (await resolveSafeArtifactTarget(urlString)).url;\n}\n\nexport async function fetchRegistryArtifactUrl(\n\turlString: string,\n\toptions: RegistryArtifactFetchOptions,\n): Promise<Response> {\n\tif (!Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 0) {\n\t\tthrow new TypeError(\"Registry artifact response limit is invalid\");\n\t}\n\tconst target = await resolveSafeArtifactTarget(urlString);\n\tif (target.addresses.length === 0) {\n\t\treturn globalThis.fetch(target.url, { redirect: \"manual\", signal: options.signal });\n\t}\n\n\tconst transport = defaultTransport ?? (await createRuntimeRegistryArtifactTransport());\n\tconst result = await transport.fetch({\n\t\turl: target.url,\n\t\tallowedAddresses: target.addresses,\n\t\tsignal: options.signal,\n\t\tmaxResponseBytes: options.maxResponseBytes,\n\t});\n\tif (!target.addresses.includes(result.connectedAddress)) {\n\t\tawait result.response.body?.cancel().catch(() => undefined);\n\t\tthrow new Error(\"Registry artifact transport connected outside the validated address set\");\n\t}\n\treturn result.response;\n}\n\nasync function createRuntimeRegistryArtifactTransport(): Promise<RegistryArtifactTransport> {\n\ttry {\n\t\t// @ts-ignore - virtual module\n\t\tconst sockets: unknown = await import(\"cloudflare:sockets\");\n\t\tconst connect = objectProperty(sockets, \"connect\");\n\t\tif (!isWorkerSocketConnect(connect)) throw new TypeError(\"Workers socket binding is invalid\");\n\t\treturn createWorkersRegistryArtifactTransport(connect);\n\t} catch {\n\t\treturn createNodeRegistryArtifactTransport();\n\t}\n}\n\nexport interface RegistryArtifactWorkerSocket {\n\treadonly opened: Promise<unknown>;\n\treadonly readable: ReadableStream<Uint8Array>;\n\treadonly writable: WritableStream<Uint8Array>;\n\tstartTls(options: { expectedServerHostname: string }): RegistryArtifactWorkerSocket;\n\tclose(): Promise<void>;\n}\n\nexport type RegistryArtifactWorkerSocketConnect = (\n\taddress: { hostname: string; port: number },\n\toptions: { secureTransport: \"starttls\"; allowHalfOpen: false },\n) => RegistryArtifactWorkerSocket;\n\nexport function createWorkersRegistryArtifactTransport(\n\tconnect: RegistryArtifactWorkerSocketConnect,\n): RegistryArtifactTransport {\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tlet lastError: unknown;\n\t\t\tfor (const address of input.allowedAddresses) {\n\t\t\t\tif (input.signal.aborted) throw new Error(\"Registry artifact request was aborted\");\n\t\t\t\tlet socket: RegistryArtifactWorkerSocket | undefined;\n\t\t\t\tlet tls: RegistryArtifactWorkerSocket | undefined;\n\t\t\t\ttry {\n\t\t\t\t\tsocket = connect(\n\t\t\t\t\t\t{ hostname: address, port: parseHttpsPort(input.url) },\n\t\t\t\t\t\t{ secureTransport: \"starttls\", allowHalfOpen: false },\n\t\t\t\t\t);\n\t\t\t\t\tawait abortable(socket.opened, input.signal, () => socket?.close());\n\t\t\t\t\ttls = socket.startTls({\n\t\t\t\t\t\texpectedServerHostname: stripIpv6Brackets(input.url.hostname),\n\t\t\t\t\t});\n\t\t\t\t\tawait abortable(tls.opened, input.signal, () => tls?.close());\n\t\t\t\t\tconst writer = tls.writable.getWriter();\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait abortable(writer.write(buildHttpRequest(input.url)), input.signal, () =>\n\t\t\t\t\t\t\ttls?.close(),\n\t\t\t\t\t\t);\n\t\t\t\t\t} finally {\n\t\t\t\t\t\twriter.releaseLock();\n\t\t\t\t\t}\n\t\t\t\t\tconst bytes = await readWorkerSocketResponse(\n\t\t\t\t\t\ttls,\n\t\t\t\t\t\tinput.maxResponseBytes + MAX_HEADER_BYTES,\n\t\t\t\t\t\tinput.signal,\n\t\t\t\t\t);\n\t\t\t\t\tawait tls.close().catch(() => undefined);\n\t\t\t\t\treturn {\n\t\t\t\t\t\tresponse: parsedResponseToWebResponse(\n\t\t\t\t\t\t\tparsePinnedHttpResponse(bytes, input.maxResponseBytes),\n\t\t\t\t\t\t),\n\t\t\t\t\t\tconnectedAddress: address,\n\t\t\t\t\t};\n\t\t\t\t} catch (error) {\n\t\t\t\t\tawait Promise.all([\n\t\t\t\t\t\ttls?.close().catch(() => undefined),\n\t\t\t\t\t\tsocket?.close().catch(() => undefined),\n\t\t\t\t\t]);\n\t\t\t\t\tif (input.signal.aborted) throw error;\n\t\t\t\t\tlastError = error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow new Error(\"Registry artifact transport could not connect to an approved address\", {\n\t\t\t\tcause: lastError,\n\t\t\t});\n\t\t},\n\t};\n}\n\nasync function createNodeRegistryArtifactTransport(): Promise<RegistryArtifactTransport> {\n\tconst { request } = await import(\"node:https\");\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tlet lastError: unknown;\n\t\t\tfor (const address of input.allowedAddresses) {\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await new Promise<Response>((resolve, reject) => {\n\t\t\t\t\t\tconst chunks: Uint8Array[] = [];\n\t\t\t\t\t\tlet total = 0;\n\t\t\t\t\t\tconst req = request(\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tprotocol: \"https:\",\n\t\t\t\t\t\t\t\thostname: stripIpv6Brackets(input.url.hostname),\n\t\t\t\t\t\t\t\tport: parseHttpsPort(input.url),\n\t\t\t\t\t\t\t\tpath: `${input.url.pathname}${input.url.search}`,\n\t\t\t\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\t\t\t\t// A pooled socket may have been opened for the same hostname\n\t\t\t\t\t\t\t\t// before this address set was resolved.\n\t\t\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\t\tHost: input.url.host,\n\t\t\t\t\t\t\t\t\tConnection: \"close\",\n\t\t\t\t\t\t\t\t\t\"Accept-Encoding\": \"identity\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tlookup: (_hostname, _options, callback) => {\n\t\t\t\t\t\t\t\t\tcallback(null, address, address.includes(\":\") ? 6 : 4);\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tsignal: input.signal,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t(upstream) => {\n\t\t\t\t\t\t\t\tconst contentEncoding = upstream.headers[\"content-encoding\"];\n\t\t\t\t\t\t\t\tif (contentEncoding && contentEncoding.toLowerCase() !== \"identity\") {\n\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\tnew Error(\"Registry artifact response content encoding is unsupported\"),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tupstream.on(\"data\", (chunk: Uint8Array) => {\n\t\t\t\t\t\t\t\t\ttotal += chunk.byteLength;\n\t\t\t\t\t\t\t\t\tif (total > input.maxResponseBytes) {\n\t\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\t\tnew RangeError(\"Registry artifact response exceeds its byte limit\"),\n\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tchunks.push(new Uint8Array(chunk));\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\tupstream.once(\"error\", reject);\n\t\t\t\t\t\t\t\tupstream.once(\"end\", () => {\n\t\t\t\t\t\t\t\t\tconst bytes = concatBytes(chunks, total);\n\t\t\t\t\t\t\t\t\tconst headers = new Headers();\n\t\t\t\t\t\t\t\t\tfor (let index = 0; index < upstream.rawHeaders.length; index += 2) {\n\t\t\t\t\t\t\t\t\t\theaders.append(upstream.rawHeaders[index], upstream.rawHeaders[index + 1]);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tresolve(\n\t\t\t\t\t\t\t\t\t\tparsedResponseToWebResponse({\n\t\t\t\t\t\t\t\t\t\t\tstatus: upstream.statusCode ?? 502,\n\t\t\t\t\t\t\t\t\t\t\theaders,\n\t\t\t\t\t\t\t\t\t\t\tbody: bytes,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t\treq.once(\"error\", reject);\n\t\t\t\t\t\treq.end();\n\t\t\t\t\t});\n\t\t\t\t\treturn { response, connectedAddress: address };\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (input.signal.aborted) throw error;\n\t\t\t\t\tlastError = error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow new Error(\"Registry artifact transport could not connect to an approved address\", {\n\t\t\t\tcause: lastError,\n\t\t\t});\n\t\t},\n\t};\n}\n\ninterface ParsedHttpResponse {\n\tstatus: number;\n\theaders: Headers;\n\tbody: Uint8Array;\n}\n\nfunction parsePinnedHttpResponse(bytes: Uint8Array, maxResponseBytes: number): ParsedHttpResponse {\n\tconst headerEnd = findSequence(bytes, HEADER_END, 0);\n\tif (headerEnd === -1 || headerEnd > MAX_HEADER_BYTES) {\n\t\tthrow new Error(\"Registry artifact response headers are invalid or too large\");\n\t}\n\tconst headerText = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes.subarray(0, headerEnd));\n\tconst lines = headerText.split(\"\\r\\n\");\n\tconst statusMatch = STATUS_LINE_RE.exec(lines.shift() ?? \"\");\n\tif (!statusMatch) throw new Error(\"Registry artifact response status line is invalid\");\n\tconst headers = new Headers();\n\tconst rawHeaders = new Map<string, string[]>();\n\tfor (const line of lines) {\n\t\tif (FOLDED_HEADER_RE.test(line)) {\n\t\t\tthrow new Error(\"Registry artifact response uses folded headers\");\n\t\t}\n\t\tconst separator = line.indexOf(\":\");\n\t\tif (separator < 1) throw new Error(\"Registry artifact response header is invalid\");\n\t\tconst name = line.slice(0, separator);\n\t\tconst value = line.slice(separator + 1).trim();\n\t\tif (!HEADER_NAME_RE.test(name) || containsInvalidHeaderValue(value)) {\n\t\t\tthrow new Error(\"Registry artifact response header is invalid\");\n\t\t}\n\t\tconst normalized = name.toLowerCase();\n\t\tconst values = rawHeaders.get(normalized) ?? [];\n\t\tvalues.push(value);\n\t\trawHeaders.set(normalized, values);\n\t\theaders.append(name, value);\n\t}\n\tconst contentEncoding = rawHeaders.get(\"content-encoding\");\n\tif (\n\t\tcontentEncoding &&\n\t\t(contentEncoding.length !== 1 || contentEncoding[0]?.toLowerCase() !== \"identity\")\n\t) {\n\t\tthrow new Error(\"Registry artifact response content encoding is unsupported\");\n\t}\n\tconst contentLength = rawHeaders.get(\"content-length\");\n\tconst transferEncoding = rawHeaders.get(\"transfer-encoding\");\n\tif (contentLength && transferEncoding) {\n\t\tthrow new Error(\"Registry artifact response framing is ambiguous\");\n\t}\n\tconst bodyBytes = bytes.subarray(headerEnd + HEADER_END.length);\n\tlet body: Uint8Array;\n\tif (transferEncoding) {\n\t\tif (transferEncoding.length !== 1 || transferEncoding[0]?.toLowerCase() !== \"chunked\") {\n\t\t\tthrow new Error(\"Registry artifact response transfer encoding is unsupported\");\n\t\t}\n\t\tbody = decodeChunkedBody(bodyBytes, maxResponseBytes);\n\t} else if (contentLength) {\n\t\tif (contentLength.length !== 1 || !CONTENT_LENGTH_RE.test(contentLength[0])) {\n\t\t\tthrow new Error(\"Registry artifact response content length is invalid\");\n\t\t}\n\t\tconst length = Number(contentLength[0]);\n\t\tif (!Number.isSafeInteger(length) || length !== bodyBytes.byteLength) {\n\t\t\tthrow new Error(\"Registry artifact response body length does not match its framing\");\n\t\t}\n\t\tbody = new Uint8Array(bodyBytes);\n\t} else {\n\t\tbody = new Uint8Array(bodyBytes);\n\t}\n\tif (body.byteLength > maxResponseBytes) {\n\t\tthrow new RangeError(\"Registry artifact response exceeds its byte limit\");\n\t}\n\treturn { status: Number(statusMatch[1]), headers, body };\n}\n\nfunction parsedResponseToWebResponse(parsed: ParsedHttpResponse): Response {\n\tconst bodyAllowed = ![204, 205, 304].includes(parsed.status);\n\tlet body: ArrayBuffer | null = null;\n\tif (bodyAllowed) {\n\t\tbody = new ArrayBuffer(parsed.body.byteLength);\n\t\tnew Uint8Array(body).set(parsed.body);\n\t}\n\treturn new Response(body, {\n\t\tstatus: parsed.status,\n\t\theaders: parsed.headers,\n\t});\n}\n\nfunction buildHttpRequest(url: URL): Uint8Array {\n\treturn new TextEncoder().encode(\n\t\t[\n\t\t\t`GET ${url.pathname}${url.search} HTTP/1.1`,\n\t\t\t`Host: ${url.host}`,\n\t\t\t\"Connection: close\",\n\t\t\t\"Accept-Encoding: identity\",\n\t\t\t\"\",\n\t\t\t\"\",\n\t\t].join(\"\\r\\n\"),\n\t);\n}\n\nasync function readWorkerSocketResponse(\n\tsocket: RegistryArtifactWorkerSocket,\n\tmaximumBytes: number,\n\tsignal: AbortSignal,\n): Promise<Uint8Array> {\n\tconst reader = socket.readable.getReader();\n\tconst chunks: Uint8Array[] = [];\n\tlet total = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst next = await abortable(reader.read(), signal, () => socket.close());\n\t\t\tif (next.done) break;\n\t\t\ttotal += next.value.byteLength;\n\t\t\tif (total > maximumBytes) {\n\t\t\t\tthrow new RangeError(\"Registry artifact response exceeds its byte limit\");\n\t\t\t}\n\t\t\tchunks.push(next.value);\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\treturn concatBytes(chunks, total);\n}\n\nfunction decodeChunkedBody(bytes: Uint8Array, maximumBytes: number): Uint8Array {\n\tconst chunks: Uint8Array[] = [];\n\tlet offset = 0;\n\tlet total = 0;\n\tfor (;;) {\n\t\tconst lineEnd = findSequence(bytes, CRLF, offset);\n\t\tif (lineEnd === -1 || lineEnd - offset > 128) {\n\t\t\tthrow new Error(\"Registry artifact chunk size line is invalid\");\n\t\t}\n\t\tconst sizeText = new TextDecoder().decode(bytes.subarray(offset, lineEnd)).split(\";\", 1)[0];\n\t\tif (!sizeText || !CHUNK_SIZE_RE.test(sizeText)) {\n\t\t\tthrow new Error(\"Registry artifact chunk size is invalid\");\n\t\t}\n\t\tconst size = Number.parseInt(sizeText, 16);\n\t\tif (!Number.isSafeInteger(size)) throw new Error(\"Registry artifact chunk size is invalid\");\n\t\toffset = lineEnd + CRLF.length;\n\t\tif (size === 0) {\n\t\t\tif (\n\t\t\t\toffset + CRLF.length !== bytes.length ||\n\t\t\t\tbytes[offset] !== 13 ||\n\t\t\t\tbytes[offset + 1] !== 10\n\t\t\t) {\n\t\t\t\tthrow new Error(\"Registry artifact chunk trailer is invalid\");\n\t\t\t}\n\t\t\tbreak;\n\t\t}\n\t\tif (offset + size + CRLF.length > bytes.length) {\n\t\t\tthrow new Error(\"Registry artifact chunk body is truncated\");\n\t\t}\n\t\tif (bytes[offset + size] !== 13 || bytes[offset + size + 1] !== 10) {\n\t\t\tthrow new Error(\"Registry artifact chunk delimiter is invalid\");\n\t\t}\n\t\ttotal += size;\n\t\tif (total > maximumBytes) {\n\t\t\tthrow new RangeError(\"Registry artifact response exceeds its byte limit\");\n\t\t}\n\t\tchunks.push(new Uint8Array(bytes.subarray(offset, offset + size)));\n\t\toffset += size + CRLF.length;\n\t}\n\treturn concatBytes(chunks, total);\n}\n\nfunction findSequence(bytes: Uint8Array, sequence: Uint8Array, start: number): number {\n\touter: for (let offset = start; offset <= bytes.length - sequence.length; offset += 1) {\n\t\tfor (let index = 0; index < sequence.length; index += 1) {\n\t\t\tif (bytes[offset + index] !== sequence[index]) continue outer;\n\t\t}\n\t\treturn offset;\n\t}\n\treturn -1;\n}\n\nfunction concatBytes(chunks: readonly Uint8Array[], total: number): Uint8Array {\n\tconst bytes = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn bytes;\n}\n\nfunction containsInvalidHeaderValue(value: string): boolean {\n\tfor (const character of value) {\n\t\tconst code = character.codePointAt(0)!;\n\t\tif (code === 0 || code === 10 || code === 13) return true;\n\t}\n\treturn false;\n}\n\nfunction parseHttpsPort(url: URL): number {\n\tconst port = url.port === \"\" ? 443 : Number(url.port);\n\tif (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {\n\t\tthrow new TypeError(\"Registry artifact HTTPS port is invalid\");\n\t}\n\treturn port;\n}\n\nfunction stripIpv6Brackets(hostname: string): string {\n\treturn hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n}\n\nfunction objectProperty(value: unknown, key: string): unknown {\n\tif (typeof value !== \"object\" || value === null) return undefined;\n\treturn Object.getOwnPropertyDescriptor(value, key)?.value;\n}\n\nfunction isWorkerSocketConnect(value: unknown): value is RegistryArtifactWorkerSocketConnect {\n\treturn typeof value === \"function\";\n}\n\nasync function abortable<T>(\n\toperation: Promise<T>,\n\tsignal: AbortSignal,\n\tonAbort: () => void | Promise<void>,\n): Promise<T> {\n\tif (signal.aborted) throw new Error(\"Registry artifact request was aborted\");\n\tlet abort: (() => void) | undefined;\n\tconst aborted = new Promise<never>((_resolve, reject) => {\n\t\tabort = () => {\n\t\t\tvoid onAbort();\n\t\t\treject(new Error(\"Registry artifact request was aborted\"));\n\t\t};\n\t\tsignal.addEventListener(\"abort\", abort, { once: true });\n\t});\n\ttry {\n\t\treturn await Promise.race([operation, aborted]);\n\t} finally {\n\t\tif (abort) signal.removeEventListener(\"abort\", abort);\n\t}\n}\n"],"mappings":";;;;;AAGA,MAAM,SAAS;AACf,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAMA,iBAAe;AACrB,MAAM,uBAAuB;CAC5B,iBAAiB;CACjB,gBAAgB;CAChB,UAAU,KAAK,OAAO;CACtB,cAAc;CACd;AACD,eAAe,sBAAsB,OAAO,SAAS;CACpD,MAAM,SAAS;EACd,iBAAiB,QAAQ,mBAAmB,qBAAqB;EACjE,gBAAgB,QAAQ,kBAAkB,qBAAqB;EAC/D,UAAU,QAAQ,YAAY,qBAAqB;EACnD,cAAc,QAAQ,gBAAgB,qBAAqB;EAC3D;AACD,KAAI,CAAC,eAAe,OAAO,CAAE,QAAO,kBAAkB,eAAe,0CAA0C;CAC/G,MAAM,YAAY,KAAK,KAAK;CAC5B,IAAI,aAAa,oBAAoB,OAAO,KAAK,GAAG,QAAQ,uBAAuB,KAAK;AACxF,KAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAK,IAAI,YAAY,IAAI,aAAa,GAAG;EACxC,MAAM,YAAY,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACxD,MAAI,aAAa,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EAClH,MAAM,OAAO,kBAAkB,WAAW,OAAO,QAAQ,uBAAuB,KAAK,GAAG;GACvF,SAAS;GACT,OAAO;GACP,GAAG,MAAM,aAAa,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AAC5E,MAAI,CAAC,KAAK,QAAS,QAAO;EAC1B,MAAM,2BAA2B,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACvE,MAAI,4BAA4B,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EACjI,MAAM,WAAW,MAAM,cAAc,QAAQ,OAAO,WAAW,OAAO,KAAK,IAAI,0BAA0B,OAAO,gBAAgB,CAAC;AACjI,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,WAAW,SAAS,MAAM,OAAO,EAAE;AACtC,OAAI,aAAa,OAAO,aAAc,QAAO,kBAAkB,2BAA2B,4CAA4C;GACtI,MAAM,WAAW,SAAS,MAAM,QAAQ,IAAI,WAAW;AACvD,OAAI,aAAa,KAAM,QAAO,kBAAkB,6BAA6B,gDAAgD;AAC7H,gBAAa,oBAAoB,UAAU,WAAW,OAAO,QAAQ,uBAAuB,KAAK;AACjG,OAAI,CAAC,WAAW,QAAS,QAAO;AAChC;;AAED,MAAI,CAAC,SAAS,MAAM,MAAM,CAAC,QAAQ,iBAAiB,SAAS,SAAS,MAAM,OAAO,CAAE,QAAO,kBAAkB,yBAAyB,8BAA8B,SAAS,MAAM,OAAO,GAAG;EAC9L,MAAM,gBAAgB,SAAS,MAAM,QAAQ,IAAI,iBAAiB;AAClE,MAAI,kBAAkB,SAAS,CAAC,OAAO,KAAK,cAAc,IAAI,OAAO,cAAc,GAAG,OAAO,UAAW,QAAO,kBAAkB,0BAA0B,uCAAuC;EAClM,MAAM,QAAQ,MAAM,aAAa,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,eAAe;AACnG,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,SAAO;GACN,SAAS;GACT,OAAO;IACN,OAAO,MAAM;IACb,KAAK,WAAW;IAChB,QAAQ,SAAS,MAAM;IACvB,SAAS,SAAS,MAAM;IACxB;GACD;;;AAGH,SAAS,oBAAoB,OAAO,MAAM,qBAAqB,OAAO;CACrE,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,OAAO,KAAK;SACnB;AACP,SAAO,kBAAkB,eAAe,+BAA+B;;AAExE,KAAI,IAAI,aAAa,YAAY,CAAC,kBAAkB,KAAK,mBAAmB,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,QAAO,kBAAkB,eAAe,+DAA+D;AACnO,KAAI,CAAC,kBAAkB,KAAK,mBAAmB,KAAK,YAAY,IAAI,SAAS,IAAI,gBAAgB,IAAI,SAAS,EAAG,QAAO,kBAAkB,iBAAiB,sCAAsC;AACjM,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,SAAS,kBAAkB,KAAK,SAAS;AACxC,KAAI,CAAC,WAAW,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;CAC9E,MAAM,WAAW,IAAI,SAAS,aAAa,CAAC,QAAQA,gBAAc,GAAG;AACrE,QAAO,aAAa,eAAe,SAAS,SAAS,aAAa,IAAI,aAAa,eAAe,aAAa,WAAW,aAAa;;AAExI,eAAe,aAAa,KAAK,UAAU,WAAW;AACrD,KAAI;EACH,MAAM,YAAY,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,SAAS,IAAI,SAAS,CAAC,EAAE,UAAU;AACpG,MAAI,UAAU,WAAW,KAAK,UAAU,KAAK,mBAAmB,CAAE,QAAO,kBAAkB,iBAAiB,qDAAqD;AACjK,SAAO;GACN,SAAS;GACT,OAAO;GACP;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,iBAAiB,4CAA4C;;;AAGxF,eAAe,cAAc,qBAAqB,KAAK,WAAW;CACjE,MAAM,aAAa,IAAI,iBAAiB;AACxC,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,oBAAoB,KAAK;IAC9E,QAAQ;IACR,UAAU;IACV,QAAQ,WAAW;IACnB,CAAC,CAAC,EAAE,iBAAiB,WAAW,OAAO,CAAC;GACzC;UACO,OAAO;AACf,MAAI,WAAW,OAAO,WAAW,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,2CAA2C;AAC9I,SAAO,kBAAkB,gBAAgB,+BAA+B;;;AAG1E,eAAe,aAAa,UAAU,cAAc,WAAW,gBAAgB;AAC9E,KAAI,SAAS,SAAS,KAAM,QAAO;EAClC,SAAS;EACT,OAAO,IAAI,YAAY;EACvB;CACD,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,MAAM,SAAS,EAAE;CACjB,IAAI,SAAS;AACb,KAAI;AACH,WAAS;GACR,MAAM,YAAY,kBAAkB,KAAK,KAAK,GAAG;AACjD,OAAI,aAAa,GAAG;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,oBAAoB,iDAAiD;;GAE/F,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,OAAI,CAAC,MAAM,SAAS;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO;;AAER,OAAI,MAAM,MAAM,KAAM;GACtB,MAAM,QAAQ,MAAM,MAAM;AAC1B,aAAU,MAAM;AAChB,OAAI,SAAS,cAAc;AAC1B,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,0BAA0B,uCAAuC;;AAE3F,UAAO,KAAK,MAAM;;SAEZ;AACP,SAAO,kBAAkB,gBAAgB,2CAA2C;WAC3E;AACT,SAAO,aAAa;;CAErB,MAAM,SAAS,IAAI,WAAW,OAAO;CACrC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,SAAO,IAAI,OAAO,OAAO;AACzB,YAAU,MAAM;;AAEjB,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,gBAAgB,QAAQ,WAAW;AACjD,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,OAAO,MAAM,CAAC,EAAE,UAAU;GAChF;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,gBAAgB,2CAA2C;;;;;;;AAOtF,SAAS,YAAY,WAAW,WAAW,WAAW;AACrD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI,UAAU;EACd,MAAM,UAAU,iBAAiB;AAChC,OAAI,QAAS;AACb,aAAU;AACV,gBAAa;AACb,UAAO,IAAI,aAAa,aAAa,aAAa,CAAC;KACjD,UAAU;AACb,YAAU,MAAM,UAAU;AACzB,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,WAAQ,MAAM;MACX,UAAU;AACb,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,UAAO,MAAM;IACZ;GACD;;AAEH,SAAS,eAAe,QAAQ;AAC/B,QAAO,OAAO,OAAO,OAAO,CAAC,OAAO,UAAU,OAAO,cAAc,MAAM,IAAI,QAAQ,EAAE;;AAExF,SAAS,WAAW,QAAQ;AAC3B,QAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW;;AAE3F,SAAS,aAAa,OAAO;AAC5B,QAAO,iBAAiB,gBAAgB,MAAM,SAAS;;AAExD,SAAS,YAAY,UAAU;AAC9B,QAAO,aAAa,KAAK,SAAS,IAAI,SAAS,SAAS,IAAI;;AAE7D,SAAS,gBAAgB,UAAU;CAClC,MAAM,aAAa,SAAS,aAAa;AACzC,QAAO,eAAe,eAAe,WAAW,SAAS,aAAa,IAAI,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,YAAY;;AAE5I,SAAS,mBAAmB,SAAS;CACpC,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,MAAM;EAClB,MAAM,CAAC,GAAG,KAAK;AACf,SAAO,MAAM,KAAK,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,MAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,MAAM,OAAO,KAAK;;CAEhO,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,KAAM,QAAO;CAC1B,MAAM,QAAQ,KAAK;CACnB,MAAM,gBAAgB,KAAK,OAAO,SAAS,SAAS,EAAE;CACtD,MAAM,aAAa,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO;CAC/E,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,eAAe,QAAQ,WAAW;CACxC,MAAM,eAAe,QAAQ,WAAW;AACxC,KAAI,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO,MAAO,QAAO,mBAAmB,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM;AACvK,QAAO,iBAAiB,cAAc,aAAa,eAAe;;AAEnE,SAAS,UAAU,OAAO;CACzB,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,UAAU,MAAM,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IAAI;AAC9E,KAAI,QAAQ,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAAE,QAAO;AACtF,QAAO;EACN,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR;;AAEF,SAAS,UAAU,OAAO;AACzB,KAAI,MAAM,SAAS,MAAM,IAAI,MAAM,MAAM,KAAK,CAAC,SAAS,EAAG,QAAO;CAClE,MAAM,CAAC,SAAS,IAAI,QAAQ,MAAM,MAAM,MAAM,KAAK;CACnD,MAAM,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,MAAM,IAAI;CACnD,MAAM,OAAO,UAAU,KAAK,EAAE,GAAG,MAAM,MAAM,IAAI;CACjD,MAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK;AAChC,KAAI,MAAM,MAAM,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,MAAM,SAAS,EAAG,QAAO;AAC5E,KAAI,CAAC,MAAM,SAAS,KAAK,IAAI,MAAM,WAAW,EAAG,QAAO;CACxD,MAAM,SAAS,MAAM,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS;AACzD,QAAO;EACN,GAAG;EACH,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,CAAC,CAAC,KAAK,IAAI;EAC3C,GAAG;EACH,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,GAAG,CAAC;;;;;AClP3C,MAAM,yBAAyB,MAAM;AACrC,MAAM,kBAAkB;AACxB,MAAM,cAAc;AACpB,MAAM,sBAAsB;AAC5B,eAAe,qBAAqB,OAAO,SAAS;CACnD,MAAM,WAAW,KAAK,KAAK,IAAI,QAAQ,kBAAkB,qBAAqB;CAC9E,MAAM,EAAE,aAAa;AACrB,KAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,IAAK,QAAO,kBAAkB,mCAAmC,mDAAmD;AACpJ,KAAI,SAAS,iBAAiB,QAAQ,MAAM,SAAS,KAAK,EAAG,QAAO,gBAAgB,MAAM,KAAK;CAC/F,MAAM,UAAU,cAAc,SAAS,KAAK;CAC5C,MAAM,eAAe,WAAW,SAAS,QAAQ,SAAS,SAAS,OAAO,SAAS,OAAO,KAAK;AAC/F,KAAI,SAAS,QAAQ,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,4CAA4C;AACxH,KAAI,SAAS;EACZ,MAAM,WAAW,qBAAqB,QAAQ;AAC9C,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,SAAS,UAAU,SAAS,SAAU,QAAO,kBAAkB,qBAAqB,+DAA+D;;CAExJ,IAAI;AACJ,MAAK,MAAM,SAAS,MAAM,kBAAkB,EAAE,EAAE;EAC/C,MAAM,kBAAkB,0BAA0B,MAAM;AACxD,MAAI,CAAC,mBAAmB,CAAC,QAAS;EAClC,MAAM,WAAW,yBAAyB,iBAAiB,MAAM,QAAQ,QAAQ;AACjF,MAAI,CAAC,SAAS,SAAS;AACtB,eAAY,SAAS;AACrB;;EAED,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,kBAAkB,SAAS,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACvJ,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,KAAI,SAAS;EACZ,MAAM,oBAAoB,eAAe,SAAS,SAAS;AAC3D,MAAI,CAAC,kBAAmB,QAAO,UAAU;EACzC,MAAM,MAAM,MAAM,cAAc;GAC/B,SAAS;GACT,OAAO,MAAM;GACb,GAAG,MAAM,4BAA4B,MAAM,OAAO,KAAK,kBAAkB;AAC1E,MAAI,IAAI,SAAS;GAChB,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,OAAO,KAAK,QAAQ;AACzD,OAAI,IAAI,SAAS;IAChB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,QAAI,CAAC,eAAgB,QAAO,UAAU;IACtC,MAAM,SAAS,MAAM,eAAe,QAAQ,IAAI,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACxI,QAAI,OAAO,QAAS,QAAO;AAC3B,gBAAY,OAAO;SACb,aAAY,IAAI;QACjB,aAAY,IAAI;;AAExB,KAAI,SAAS,KAAK;EACjB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,OAAO,SAAS,KAAK,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AAC1I,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,QAAO,YAAY;EAClB,SAAS;EACT,OAAO;EACP,GAAG,kBAAkB,gBAAgB,6CAA6C;;AAEpF,SAAS,yBAAyB,iBAAiB,QAAQ,SAAS;AACnE,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,gBAAgB;AACzC,MAAI,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,YAAY,SAAS,aAAa,OAAO,SAAS,UAAU,SAAS,KAAM,OAAM,IAAI,OAAO;EAChK,MAAM,WAAW;GAChB;GACA,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP;GACA;AACD,MAAI,CAAC,YAAY,KAAK,OAAO,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,MAAM,YAAY,CAAC,kBAAkB,QAAQ,CAAC,CAAE,OAAM,IAAI,OAAO;AAC7I,SAAO;GACN,SAAS;GACT,OAAO,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,SAAS;GAC5C;SACM;AACP,SAAO,kBAAkB,eAAe,oDAAoD;;;AAG9F,SAAS,0BAA0B,iBAAiB,QAAQ,QAAQ,SAAS;CAC5E,MAAM,MAAM,yBAAyB,iBAAiB,QAAQ,QAAQ;AACtE,KAAI,CAAC,IAAI,QAAS,QAAO;CACzB,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM;AAC9B,KAAI,WAAW,QAAQ,SAAS,IAAI;AACpC,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,4BAA4B,cAAc,SAAS;CACjE,MAAM,cAAc,eAAe,aAAa;AAChD,KAAI,CAAC,YAAa,QAAO,kBAAkB,yBAAyB,sCAAsC;CAC1G,MAAM,UAAU,MAAM,sBAAsB,aAAa;EACxD,GAAG;EACH,UAAU;EACV,CAAC;AACF,KAAI,CAAC,QAAQ,QAAS,QAAO,kBAAkB,yBAAyB,mDAAmD;CAC3H,IAAI;AACJ,KAAI;AACH,aAAW,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,QAAQ,MAAM,MAAM,CAAC;SAC7D;AACP,SAAO,kBAAkB,yBAAyB,2CAA2C;;AAE9F,KAAI,CAAC,SAAS,SAAS,IAAI,SAAS,OAAO,gBAAgB,CAAC,MAAM,QAAQ,SAAS,QAAQ,CAAE,QAAO,kBAAkB,yBAAyB,uDAAuD;CACtM,MAAM,UAAU,SAAS,QAAQ,MAAM,UAAU,SAAS,MAAM,KAAK,MAAM,OAAO,GAAG,aAAa,iBAAiB,MAAM,OAAO,mBAAmB,MAAM,SAAS,+BAA+B,OAAO,MAAM,oBAAoB,SAAS;AAC3O,KAAI,CAAC,SAAS,QAAQ,IAAI,OAAO,QAAQ,oBAAoB,SAAU,QAAO,kBAAkB,yBAAyB,uDAAuD;AAChL,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,QAAQ,gBAAgB;AACjD,MAAI,EAAE,QAAQ,uBAAuB,QAAQ,SAAS,aAAa,YAAY,SAAS,aAAa,eAAe,SAAS,aAAa,iBAAiB,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,SAAU,OAAM,IAAI,OAAO;AACtP,SAAO;GACN,SAAS;GACT,OAAO,SAAS;GAChB;SACM;AACP,SAAO,kBAAkB,yBAAyB,uDAAuD;;;AAG3G,eAAe,eAAe,QAAQ,KAAK,UAAU,SAAS,cAAc;CAC3E,MAAM,UAAU,MAAM,sBAAsB,KAAK,QAAQ;AACzD,KAAI,CAAC,QAAQ,QAAS,QAAO,gBAAgB,QAAQ,MAAM,SAAS,2BAA2B,kBAAkB,0BAA0B,qEAAqE,GAAG;CACnN,MAAM,WAAW,MAAM,gBAAgB,QAAQ,MAAM,OAAO,SAAS;AACrE,KAAI,CAAC,SAAS,QAAS,QAAO;CAC9B,MAAM,cAAc,QAAQ,MAAM,QAAQ,IAAI,eAAe,EAAE,MAAM,KAAK,EAAE,CAAC,IAAI,MAAM;AACvF,KAAI,iBAAiB,QAAQ,MAAM,MAAM,eAAe,aAAa,QAAQ,gBAAgB,KAAK,KAAK,gBAAgB,aAAa,UAAW,QAAO,kBAAkB,0BAA0B,gEAAgE;AAClQ,QAAO;EACN,SAAS;EACT,OAAO;GACN,OAAO,QAAQ,MAAM;GACrB;GACA,KAAK,QAAQ,MAAM;GACnB;EACD;;AAEF,SAAS,kBAAkB,SAAS,cAAc;AACjD,KAAI,CAAC,aAAc,QAAO;AAC1B,QAAO;EACN,GAAG;EACH,UAAU,KAAK,IAAI,QAAQ,YAAY,qBAAqB,UAAU,aAAa,KAAK;EACxF;;AAEF,SAAS,QAAQ,aAAa,cAAc,KAAK;AAChD,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,kCAAkC,YAAY;AAClE,MAAI,aAAa,IAAI,OAAO,aAAa;AACzC,MAAI,aAAa,IAAI,OAAO,IAAI;AAChC,SAAO;GACN,SAAS;GACT,OAAO;GACP;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,eAAe,KAAK;AAC5B,KAAI,gBAAgB,KAAK,IAAI,CAAE,QAAO,yBAAyB,mBAAmB,IAAI;AACtF,KAAI,CAAC,IAAI,WAAW,WAAW,CAAE,QAAO;AACxC,KAAI;EACH,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,mBAAmB;EAC7D,MAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,QAAQ,MAAM,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,KAAK,CAAE,QAAO;EACxF,MAAM,OAAO,MAAM,WAAW,IAAI,0BAA0B,IAAI,MAAM,KAAK,IAAI,CAAC;AAChF,SAAO,IAAI,IAAI,MAAM,WAAW,OAAO,CAAC;SACjC;AACP,SAAO;;;AAGT,SAAS,gBAAgB,MAAM;AAC9B,QAAO,kBAAkB,2BAA2B,0BAA0B,uBAAuB,KAAK,CAAC;;AAE5G,SAAS,eAAe,SAAS,UAAU;CAC1C,MAAM,YAAY,WAAW,KAAK,KAAK;AACvC,KAAI,aAAa,EAAG,QAAO;AAC3B,QAAO;EACN,GAAG;EACH,gBAAgB;EAChB;;AAEF,SAAS,WAAW;AACnB,QAAO,kBAAkB,oBAAoB,iDAAiD;;AAE/F,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAE5E,SAAS,cAAc,MAAM;AAC5B,KAAI,CAAC,QAAQ,EAAE,SAAS,SAAS,OAAO,KAAK,KAAK,UAAU,SAAU,QAAO;AAC7E,QAAO,KAAK,IAAI;;AAEjB,SAAS,0BAA0B,OAAO;AACzC,KAAI,CAAC,SAAS,MAAM,IAAI,MAAM,UAAU,8BAA+B,QAAO;AAC9E,QAAO,OAAO,MAAM,oBAAoB,WAAW,MAAM,kBAAkB;;AAE5E,SAAS,kBAAkB,OAAO;AACjC,KAAI,MAAM,WAAW,KAAK,oBAAoB,KAAK,MAAM,CAAE,QAAO;AAClE,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,YAAY,UAAU,YAAY,EAAE;AAC1C,MAAI,cAAc,KAAK,MAAM,aAAa,MAAM,cAAc,KAAM,QAAO;;AAE5E,QAAO;;;;;AC9MR,MAAM,eAAe;AACrB,MAAM,aAAa,IAAI,WAAW;CAAC;CAAI;CAAI;CAAI;CAAG,CAAC;AACnD,MAAM,OAAO,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC;AACrC,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AACtB,MAAM,mBAAmB,KAAK;AAC9B,MAAM,sBAAsB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA,CAAC;AAqBF,IAAI,mBAAqD;AAUzD,SAAS,oBAAoB,UAA2B;CACvD,MAAM,aAAa,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;AACnE,QACC,oBAAoB,IAAI,WAAW,IACnC,WAAW,SAAS,aAAa,IACjC,eAAe,eACf,eAAe,SACf,eAAe,WACf,WAAW,WAAW,cAAc,IACpC,WAAW,WAAW,eAAe;;AAIvC,eAAe,0BAA0B,WAGtC;CACF,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,UAAU;SACjB;AACP,QAAM,IAAI,MAAM,yBAAyB,YAAY;;AAEtD,KAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QACjD,OAAM,IAAI,MAAM,sCAAsC,IAAI,WAAW;AAEtE,KAAI,IAAI,YAAY,IAAI,SACvB,OAAM,IAAI,MAAM,qDAAqD;CAItE,MAAM,WAAW,kBADG,IAAI,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG,CACzB;CAC/C,MAAM,YAAY,oBAAoB,SAAS;AAE/C,KAAI,CAAC,OAAO,KAAK,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,QACpB,OAAM,IAAI,MAAM,8BAA8B;AAE/C,MAAI,UACH,OAAM,IAAI,MAAM,qCAAqC,WAAW;YAEvD,IAAI,aAAa,WAAW,CAAC,UACvC,OAAM,IAAI,MAAM,uEAAuE;AAGxF,KAAI,UACH,QAAO;EAAE;EAAK,WAAW,EAAE;EAAE;AAG9B,KAAI;AACH,SAAO,MAAM,oCAAoC,IAAI,KAAK;UAClD,OAAO;AACf,MAAI,iBAAiB,UACpB,OAAM,IAAI,MAAM,0BAA0B,MAAM,WAAW,EAAE,OAAO,OAAO,CAAC;AAE7E,QAAM;;;AAQR,eAAsB,yBACrB,WACA,SACoB;AACpB,KAAI,CAAC,OAAO,cAAc,QAAQ,iBAAiB,IAAI,QAAQ,mBAAmB,EACjF,OAAM,IAAI,UAAU,8CAA8C;CAEnE,MAAM,SAAS,MAAM,0BAA0B,UAAU;AACzD,KAAI,OAAO,UAAU,WAAW,EAC/B,QAAO,WAAW,MAAM,OAAO,KAAK;EAAE,UAAU;EAAU,QAAQ,QAAQ;EAAQ,CAAC;CAIpF,MAAM,SAAS,OADG,oBAAqB,MAAM,wCAAwC,EACtD,MAAM;EACpC,KAAK,OAAO;EACZ,kBAAkB,OAAO;EACzB,QAAQ,QAAQ;EAChB,kBAAkB,QAAQ;EAC1B,CAAC;AACF,KAAI,CAAC,OAAO,UAAU,SAAS,OAAO,iBAAiB,EAAE;AACxD,QAAM,OAAO,SAAS,MAAM,QAAQ,CAAC,YAAY,OAAU;AAC3D,QAAM,IAAI,MAAM,0EAA0E;;AAE3F,QAAO,OAAO;;AAGf,eAAe,yCAA6E;AAC3F,KAAI;EAGH,MAAM,UAAU,eADS,MAAM,OAAO,uBACE,UAAU;AAClD,MAAI,CAAC,sBAAsB,QAAQ,CAAE,OAAM,IAAI,UAAU,oCAAoC;AAC7F,SAAO,uCAAuC,QAAQ;SAC/C;AACP,SAAO,qCAAqC;;;AAiB9C,SAAgB,uCACf,SAC4B;AAC5B,QAAO,EACN,MAAM,MAAM,OAAO;EAClB,IAAI;AACJ,OAAK,MAAM,WAAW,MAAM,kBAAkB;AAC7C,OAAI,MAAM,OAAO,QAAS,OAAM,IAAI,MAAM,wCAAwC;GAClF,IAAI;GACJ,IAAI;AACJ,OAAI;AACH,aAAS,QACR;KAAE,UAAU;KAAS,MAAM,eAAe,MAAM,IAAI;KAAE,EACtD;KAAE,iBAAiB;KAAY,eAAe;KAAO,CACrD;AACD,UAAM,UAAU,OAAO,QAAQ,MAAM,cAAc,QAAQ,OAAO,CAAC;AACnE,UAAM,OAAO,SAAS,EACrB,wBAAwB,kBAAkB,MAAM,IAAI,SAAS,EAC7D,CAAC;AACF,UAAM,UAAU,IAAI,QAAQ,MAAM,cAAc,KAAK,OAAO,CAAC;IAC7D,MAAM,SAAS,IAAI,SAAS,WAAW;AACvC,QAAI;AACH,WAAM,UAAU,OAAO,MAAM,iBAAiB,MAAM,IAAI,CAAC,EAAE,MAAM,cAChE,KAAK,OAAO,CACZ;cACQ;AACT,YAAO,aAAa;;IAErB,MAAM,QAAQ,MAAM,yBACnB,KACA,MAAM,mBAAmB,kBACzB,MAAM,OACN;AACD,UAAM,IAAI,OAAO,CAAC,YAAY,OAAU;AACxC,WAAO;KACN,UAAU,4BACT,wBAAwB,OAAO,MAAM,iBAAiB,CACtD;KACD,kBAAkB;KAClB;YACO,OAAO;AACf,UAAM,QAAQ,IAAI,CACjB,KAAK,OAAO,CAAC,YAAY,OAAU,EACnC,QAAQ,OAAO,CAAC,YAAY,OAAU,CACtC,CAAC;AACF,QAAI,MAAM,OAAO,QAAS,OAAM;AAChC,gBAAY;;;AAGd,QAAM,IAAI,MAAM,wEAAwE,EACvF,OAAO,WACP,CAAC;IAEH;;AAGF,eAAe,sCAA0E;CACxF,MAAM,EAAE,YAAY,MAAM,OAAO;AACjC,QAAO,EACN,MAAM,MAAM,OAAO;EAClB,IAAI;AACJ,OAAK,MAAM,WAAW,MAAM,iBAC3B,KAAI;AA8DH,UAAO;IAAE,UA7DQ,MAAM,IAAI,SAAmB,SAAS,WAAW;KACjE,MAAM,SAAuB,EAAE;KAC/B,IAAI,QAAQ;KACZ,MAAM,MAAM,QACX;MACC,UAAU;MACV,UAAU,kBAAkB,MAAM,IAAI,SAAS;MAC/C,MAAM,eAAe,MAAM,IAAI;MAC/B,MAAM,GAAG,MAAM,IAAI,WAAW,MAAM,IAAI;MACxC,QAAQ;MAGR,OAAO;MACP,SAAS;OACR,MAAM,MAAM,IAAI;OAChB,YAAY;OACZ,mBAAmB;OACnB;MACD,SAAS,WAAW,UAAU,aAAa;AAC1C,gBAAS,MAAM,SAAS,QAAQ,SAAS,IAAI,GAAG,IAAI,EAAE;;MAEvD,QAAQ,MAAM;MACd,GACA,aAAa;MACb,MAAM,kBAAkB,SAAS,QAAQ;AACzC,UAAI,mBAAmB,gBAAgB,aAAa,KAAK,YAAY;AACpE,gBAAS,wBACR,IAAI,MAAM,6DAA6D,CACvE;AACD;;AAED,eAAS,GAAG,SAAS,UAAsB;AAC1C,gBAAS,MAAM;AACf,WAAI,QAAQ,MAAM,kBAAkB;AACnC,iBAAS,wBACR,IAAI,WAAW,oDAAoD,CACnE;AACD;;AAED,cAAO,KAAK,IAAI,WAAW,MAAM,CAAC;QACjC;AACF,eAAS,KAAK,SAAS,OAAO;AAC9B,eAAS,KAAK,aAAa;OAC1B,MAAM,QAAQ,YAAY,QAAQ,MAAM;OACxC,MAAM,UAAU,IAAI,SAAS;AAC7B,YAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,WAAW,QAAQ,SAAS,EAChE,SAAQ,OAAO,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,GAAG;AAE3E,eACC,4BAA4B;QAC3B,QAAQ,SAAS,cAAc;QAC/B;QACA,MAAM;QACN,CAAC,CACF;QACA;OAEH;AACD,SAAI,KAAK,SAAS,OAAO;AACzB,SAAI,KAAK;MACR;IACiB,kBAAkB;IAAS;WACtC,OAAO;AACf,OAAI,MAAM,OAAO,QAAS,OAAM;AAChC,eAAY;;AAGd,QAAM,IAAI,MAAM,wEAAwE,EACvF,OAAO,WACP,CAAC;IAEH;;AASF,SAAS,wBAAwB,OAAmB,kBAA8C;CACjG,MAAM,YAAY,aAAa,OAAO,YAAY,EAAE;AACpD,KAAI,cAAc,MAAM,YAAY,iBACnC,OAAM,IAAI,MAAM,8DAA8D;CAG/E,MAAM,QADa,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM,SAAS,GAAG,UAAU,CAAC,CACxE,MAAM,OAAO;CACtC,MAAM,cAAc,eAAe,KAAK,MAAM,OAAO,IAAI,GAAG;AAC5D,KAAI,CAAC,YAAa,OAAM,IAAI,MAAM,oDAAoD;CACtF,MAAM,UAAU,IAAI,SAAS;CAC7B,MAAM,6BAAa,IAAI,KAAuB;AAC9C,MAAK,MAAM,QAAQ,OAAO;AACzB,MAAI,iBAAiB,KAAK,KAAK,CAC9B,OAAM,IAAI,MAAM,iDAAiD;EAElE,MAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,MAAI,YAAY,EAAG,OAAM,IAAI,MAAM,+CAA+C;EAClF,MAAM,OAAO,KAAK,MAAM,GAAG,UAAU;EACrC,MAAM,QAAQ,KAAK,MAAM,YAAY,EAAE,CAAC,MAAM;AAC9C,MAAI,CAAC,eAAe,KAAK,KAAK,IAAI,2BAA2B,MAAM,CAClE,OAAM,IAAI,MAAM,+CAA+C;EAEhE,MAAM,aAAa,KAAK,aAAa;EACrC,MAAM,SAAS,WAAW,IAAI,WAAW,IAAI,EAAE;AAC/C,SAAO,KAAK,MAAM;AAClB,aAAW,IAAI,YAAY,OAAO;AAClC,UAAQ,OAAO,MAAM,MAAM;;CAE5B,MAAM,kBAAkB,WAAW,IAAI,mBAAmB;AAC1D,KACC,oBACC,gBAAgB,WAAW,KAAK,gBAAgB,IAAI,aAAa,KAAK,YAEvE,OAAM,IAAI,MAAM,6DAA6D;CAE9E,MAAM,gBAAgB,WAAW,IAAI,iBAAiB;CACtD,MAAM,mBAAmB,WAAW,IAAI,oBAAoB;AAC5D,KAAI,iBAAiB,iBACpB,OAAM,IAAI,MAAM,kDAAkD;CAEnE,MAAM,YAAY,MAAM,SAAS,YAAY,WAAW,OAAO;CAC/D,IAAI;AACJ,KAAI,kBAAkB;AACrB,MAAI,iBAAiB,WAAW,KAAK,iBAAiB,IAAI,aAAa,KAAK,UAC3E,OAAM,IAAI,MAAM,8DAA8D;AAE/E,SAAO,kBAAkB,WAAW,iBAAiB;YAC3C,eAAe;AACzB,MAAI,cAAc,WAAW,KAAK,CAAC,kBAAkB,KAAK,cAAc,GAAG,CAC1E,OAAM,IAAI,MAAM,uDAAuD;EAExE,MAAM,SAAS,OAAO,cAAc,GAAG;AACvC,MAAI,CAAC,OAAO,cAAc,OAAO,IAAI,WAAW,UAAU,WACzD,OAAM,IAAI,MAAM,oEAAoE;AAErF,SAAO,IAAI,WAAW,UAAU;OAEhC,QAAO,IAAI,WAAW,UAAU;AAEjC,KAAI,KAAK,aAAa,iBACrB,OAAM,IAAI,WAAW,oDAAoD;AAE1E,QAAO;EAAE,QAAQ,OAAO,YAAY,GAAG;EAAE;EAAS;EAAM;;AAGzD,SAAS,4BAA4B,QAAsC;CAC1E,MAAM,cAAc,CAAC;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,OAAO,OAAO;CAC5D,IAAI,OAA2B;AAC/B,KAAI,aAAa;AAChB,SAAO,IAAI,YAAY,OAAO,KAAK,WAAW;AAC9C,MAAI,WAAW,KAAK,CAAC,IAAI,OAAO,KAAK;;AAEtC,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,CAAC;;AAGH,SAAS,iBAAiB,KAAsB;AAC/C,QAAO,IAAI,aAAa,CAAC,OACxB;EACC,OAAO,IAAI,WAAW,IAAI,OAAO;EACjC,SAAS,IAAI;EACb;EACA;EACA;EACA;EACA,CAAC,KAAK,OAAO,CACd;;AAGF,eAAe,yBACd,QACA,cACA,QACsB;CACtB,MAAM,SAAS,OAAO,SAAS,WAAW;CAC1C,MAAM,SAAuB,EAAE;CAC/B,IAAI,QAAQ;AACZ,KAAI;AACH,WAAS;GACR,MAAM,OAAO,MAAM,UAAU,OAAO,MAAM,EAAE,cAAc,OAAO,OAAO,CAAC;AACzE,OAAI,KAAK,KAAM;AACf,YAAS,KAAK,MAAM;AACpB,OAAI,QAAQ,aACX,OAAM,IAAI,WAAW,oDAAoD;AAE1E,UAAO,KAAK,KAAK,MAAM;;WAEf;AACT,SAAO,aAAa;;AAErB,QAAO,YAAY,QAAQ,MAAM;;AAGlC,SAAS,kBAAkB,OAAmB,cAAkC;CAC/E,MAAM,SAAuB,EAAE;CAC/B,IAAI,SAAS;CACb,IAAI,QAAQ;AACZ,UAAS;EACR,MAAM,UAAU,aAAa,OAAO,MAAM,OAAO;AACjD,MAAI,YAAY,MAAM,UAAU,SAAS,IACxC,OAAM,IAAI,MAAM,+CAA+C;EAEhE,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,MAAM,SAAS,QAAQ,QAAQ,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;AACzF,MAAI,CAAC,YAAY,CAAC,cAAc,KAAK,SAAS,CAC7C,OAAM,IAAI,MAAM,0CAA0C;EAE3D,MAAM,OAAO,OAAO,SAAS,UAAU,GAAG;AAC1C,MAAI,CAAC,OAAO,cAAc,KAAK,CAAE,OAAM,IAAI,MAAM,0CAA0C;AAC3F,WAAS,UAAU,KAAK;AACxB,MAAI,SAAS,GAAG;AACf,OACC,SAAS,KAAK,WAAW,MAAM,UAC/B,MAAM,YAAY,MAClB,MAAM,SAAS,OAAO,GAEtB,OAAM,IAAI,MAAM,6CAA6C;AAE9D;;AAED,MAAI,SAAS,OAAO,KAAK,SAAS,MAAM,OACvC,OAAM,IAAI,MAAM,4CAA4C;AAE7D,MAAI,MAAM,SAAS,UAAU,MAAM,MAAM,SAAS,OAAO,OAAO,GAC/D,OAAM,IAAI,MAAM,+CAA+C;AAEhE,WAAS;AACT,MAAI,QAAQ,aACX,OAAM,IAAI,WAAW,oDAAoD;AAE1E,SAAO,KAAK,IAAI,WAAW,MAAM,SAAS,QAAQ,SAAS,KAAK,CAAC,CAAC;AAClE,YAAU,OAAO,KAAK;;AAEvB,QAAO,YAAY,QAAQ,MAAM;;AAGlC,SAAS,aAAa,OAAmB,UAAsB,OAAuB;AACrF,OAAO,MAAK,IAAI,SAAS,OAAO,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,GAAG;AACtF,OAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,QAAQ,SAAS,EACrD,KAAI,MAAM,SAAS,WAAW,SAAS,OAAQ,UAAS;AAEzD,SAAO;;AAER,QAAO;;AAGR,SAAS,YAAY,QAA+B,OAA2B;CAC9E,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,QAAM,IAAI,OAAO,OAAO;AACxB,YAAU,MAAM;;AAEjB,QAAO;;AAGR,SAAS,2BAA2B,OAAwB;AAC3D,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,OAAO,UAAU,YAAY,EAAE;AACrC,MAAI,SAAS,KAAK,SAAS,MAAM,SAAS,GAAI,QAAO;;AAEtD,QAAO;;AAGR,SAAS,eAAe,KAAkB;CACzC,MAAM,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO,IAAI,KAAK;AACrD,KAAI,CAAC,OAAO,cAAc,KAAK,IAAI,OAAO,KAAK,OAAO,MACrD,OAAM,IAAI,UAAU,0CAA0C;AAE/D,QAAO;;AAGR,SAAS,kBAAkB,UAA0B;AACpD,QAAO,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG;;AAGrF,SAAS,eAAe,OAAgB,KAAsB;AAC7D,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAO,OAAO,yBAAyB,OAAO,IAAI,EAAE;;AAGrD,SAAS,sBAAsB,OAA8D;AAC5F,QAAO,OAAO,UAAU;;AAGzB,eAAe,UACd,WACA,QACA,SACa;AACb,KAAI,OAAO,QAAS,OAAM,IAAI,MAAM,wCAAwC;CAC5E,IAAI;CACJ,MAAM,UAAU,IAAI,SAAgB,UAAU,WAAW;AACxD,gBAAc;AACb,GAAK,SAAS;AACd,0BAAO,IAAI,MAAM,wCAAwC,CAAC;;AAE3D,SAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,MAAM,CAAC;GACtD;AACF,KAAI;AACH,SAAO,MAAM,QAAQ,KAAK,CAAC,WAAW,QAAQ,CAAC;WACtC;AACT,MAAI,MAAO,QAAO,oBAAoB,SAAS,MAAM"}

package/dist/astro/index.d.mts

@@ -1,15 +1,17 @@
-import { i as ContentItem } from "../types-BuHW4xDE.mjs";
-import "../options-CYb4y7hM.mjs";
-import "../types-FV23hEoW.mjs";
-import { Dt as ResolvedPlugin } from "../types-B6GrPic4.mjs";
-import "../relations-DnRK4YIT.mjs";
-import { Fi as MediaItem, Mr as LocalStorageConfig, Nr as S3StorageConfig, Pr as StorageDescriptor, jr as getStoredConfig, kr as EmDashConfig } from "../index-BJNMCWmu.mjs";
-import "../runner-YKfIMnaF.mjs";
-import "../index-Du8K7bWa.mjs";
-import { i as ObjectCacheRuntimeConfig, r as ObjectCacheDescriptor } from "../types-CPeXo1wF.mjs";
-import "../types-DczELMop.mjs";
-import "../hreflang-B6hbAuuO.mjs";
-import "../validate-DUP27OYD.mjs";
+import { i as ContentItem } from "../types-DxQWoQLA.mjs";
+import "../parse-tj9XLNO_.mjs";
+import "../types-CbwqGOXm.mjs";
+import { pn as ResolvedPlugin } from "../types-DEHidMEk.mjs";
+import "../options-DAknChnw.mjs";
+import "../entry-lock-DX7QkqEg.mjs";
+import { Cr as LocalStorageConfig, Sr as getStoredConfig, Tr as StorageDescriptor, br as EmDashConfig, wr as S3StorageConfig } from "../config-DS7e4EZ9.mjs";
+import "../runner-3gfxRsJG.mjs";
+import { Z as MediaItem } from "../storage-query-CPctdMKX.mjs";
+import "../index-CDwKDkTq.mjs";
+import { i as ObjectCacheRuntimeConfig, r as ObjectCacheDescriptor } from "../types-_Qtyawiy.mjs";
+import "../types-CCR3ivXE.mjs";
+import "../hreflang-BgS2FqhH.mjs";
+import "../validate-CyQ7I3xF.mjs";
 import { EmDashHandlers, EmDashManifest, ManifestCollection } from "./types.mjs";
 import { AstroIntegration } from "astro";
 

package/dist/astro/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/astro/storage/adapters.ts","../../src/astro/object-cache/adapters.ts","../../src/astro/integration/index.ts"],"mappings":";;;;;;;;;;;;;;;;;AAkFA;;;;;;;;;;;;AC3DA;;;;;AAqBA;;;;;;;;;;;;iBDiBgB,EAAA,CAAG,MAAA,GAAQ,OAAA,CAAQ,eAAA,IAAwB,iBAAA;;;;;;;;;;;;;;;iBAqB3C,KAAA,CAAM,MAAA,EAAQ,kBAAA,GAAqB,iBAAA;;;;UC3DlC,kBAAA,SAA2B,wBAAA;EDsCgC;;;;ECjC3E,UAAA;AAAA;;;ADsDD;;;;;;;;;;;iBCtCgB,WAAA,CAAY,OAAA,GAAS,kBAAA,GAA0B,qBAAA;;;;;;iBCsR/C,MAAA,CAAO,MAAA,GAAQ,YAAA,GAAoB,gBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/astro/storage/adapters.ts","../../src/astro/object-cache/adapters.ts","../../src/astro/integration/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkFA;;;;;;;;;;;;AC3DA;;;;;AAqBA;;;;;;;;;;iBDiBgB,EAAA,CAAG,MAAA,GAAQ,OAAA,CAAQ,eAAA,IAAwB,iBAAA;;AEsQ3D;;;;;;;;;;;;;iBFjPgB,KAAA,CAAM,MAAA,EAAQ,kBAAA,GAAqB,iBAAA;;;;UC3DlC,kBAAA,SAA2B,wBAAA;EDsCjB;;;;ECjC1B,UAAA;AAAA;;;;;ADsDD;;;;;;;;;iBCtCgB,WAAA,CAAY,OAAA,GAAS,kBAAA,GAA0B,qBAAA;;;;;;iBCuR/C,MAAA,CAAO,MAAA,GAAQ,YAAA,GAAoB,gBAAA"}

package/dist/astro/index.mjs

@@ -1,14 +1,16 @@
-import "../runner-BLIDKpmA.mjs";
-import "../dialect-helpers-BSbfaO3F.mjs";
-import "../config-C3EBstHi.mjs";
-import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-C2xNjTSG.mjs";
-import { n as setDevTypegenRefresh } from "../dev-typegen-DzOPfsNj.mjs";
-import { t as defaultSeed } from "../default-Clra32mw.mjs";
-import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-BGglilcs.mjs";
-import { r as normalizeMigrationConfig } from "../policy-Dhtwntrt.mjs";
-import { c as normalizeAstroI18n, n as MIGRATION_CONFIG_SYMBOL, o as serializeMigrationManifest, r as createMigrationIntegrationMetadata, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-COtzuca2.mjs";
-import { n as VERSION, t as COMMIT } from "../version-Bii3suaO.mjs";
-import { r as getCoreMigrationIdentity } from "../identity-DksvEazf.mjs";
+import "../runner-ClrleR8A.mjs";
+import "../dialect-helpers-CtYdsX4W.mjs";
+import "../config-CGVeT8Hc.mjs";
+import "../datetime-normalization-PeiEdcRY.mjs";
+import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-dChXQjwS.mjs";
+import { n as setDevTypegenRefresh } from "../dev-typegen-CZaPLl3V.mjs";
+import { c as resolveRegistryConfigForSandbox, i as normalizeRegistryConfig } from "../config-B2acLeC5.mjs";
+import { t as defaultSeed } from "../default-BtlxWgh9.mjs";
+import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-1Sa-2wZK.mjs";
+import { r as normalizeMigrationConfig } from "../policy-lyZnjpwz.mjs";
+import { c as normalizeAstroI18n, n as MIGRATION_CONFIG_SYMBOL, o as serializeMigrationManifest, r as createMigrationIntegrationMetadata, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-D31UoJCu.mjs";
+import { n as VERSION, t as COMMIT } from "../version-B57E4Uo7.mjs";
+import { r as getCoreMigrationIdentity } from "../identity-DRGSHEEr.mjs";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
@@ -398,6 +400,26 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/manifest",
 		entrypoint: resolveRoute("api/manifest.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/health",
+		entrypoint: resolveRoute("api/health.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/openapi.json",
+		entrypoint: resolveRoute("api/openapi.json.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/visual-editing/action-token",
+		entrypoint: resolveRoute("api/visual-editing/action-token.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/visual-editing/toolbar-labels",
+		entrypoint: resolveRoute("api/visual-editing/toolbar-labels.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/visual-editing/content/[collection]/[id]/publish",
+		entrypoint: resolveRoute("api/visual-editing/content/[collection]/[id]/publish.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/auth/mode",
 		entrypoint: resolveRoute("api/auth/mode.ts")
@@ -406,6 +428,10 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/dashboard",
 		entrypoint: resolveRoute("api/dashboard.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/scheduled-policy-rejections/[collection]/[id]",
+		entrypoint: resolveRoute("api/admin/scheduled-policy-rejections/[collection]/[id].ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]",
 		entrypoint: resolveRoute("api/content/[collection]/index.ts")
@@ -414,6 +440,10 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/content/[collection]/[id]",
 		entrypoint: resolveRoute("api/content/[collection]/[id].ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/content/[collection]/[id]/plugin-extensions/[pluginId]/[kind]/[extensionId]",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/plugin-extensions/[pluginId]/[kind]/[extensionId].ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/[id]/revisions",
 		entrypoint: resolveRoute("api/content/[collection]/[id]/revisions.ts")
@@ -458,10 +488,34 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/content/[collection]/[id]/compare",
 		entrypoint: resolveRoute("api/content/[collection]/[id]/compare.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/content/[collection]/[id]/lock",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/lock.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/[id]/translations",
 		entrypoint: resolveRoute("api/content/[collection]/[id]/translations.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/relations",
+		entrypoint: resolveRoute("api/relations/index.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/relations/[id]",
+		entrypoint: resolveRoute("api/relations/[id]/index.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/relations/[id]/translations",
+		entrypoint: resolveRoute("api/relations/[id]/translations.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/content/[collection]/[id]/references/[relation]/children",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/children.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/content/[collection]/[id]/references/[relation]/parents",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/parents.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/[id]/schedule",
 		entrypoint: resolveRoute("api/content/[collection]/[id]/schedule.ts")
@@ -486,6 +540,10 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/media/file/[...key]",
 		entrypoint: resolveRoute("api/media/file/[...key].ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/media/asset/[id]/[filename]",
+		entrypoint: resolveRoute("api/media/asset/[id]/[filename].ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/media/folders",
 		entrypoint: resolveRoute("api/media/folders/index.ts")
@@ -734,10 +792,22 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/admin/plugins/registry/install",
 		entrypoint: resolveRoute("api/admin/plugins/registry/install.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/plugins/registry/verify",
+		entrypoint: resolveRoute("api/admin/plugins/registry/verify.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/admin/plugins/registry/artifact",
 		entrypoint: resolveRoute("api/admin/plugins/registry/artifact.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/plugins/registry/[id]/update",
+		entrypoint: resolveRoute("api/admin/plugins/registry/[id]/update.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/plugins/registry/[id]/uninstall",
+		entrypoint: resolveRoute("api/admin/plugins/registry/[id]/uninstall.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/admin/plugins/[id]/update",
 		entrypoint: resolveRoute("api/admin/plugins/[id]/update.ts")
@@ -1361,6 +1431,8 @@ function generatePluginsModule(descriptors) {
 				storage: descriptor.storage,
 				adminPages: descriptor.adminPages,
 				adminWidgets: descriptor.adminWidgets,
+				editorPanels: descriptor.editorPanels,
+				editorActions: descriptor.editorActions,
 				settingsSchema: descriptor.settingsSchema,
 				portableTextBlocks: descriptor.portableTextBlocks,
 				fieldWidgets: descriptor.fieldWidgets
@@ -1646,6 +1718,8 @@ export const sandboxedPlugins = [];
     hooks: ${JSON.stringify(descriptor.hooks ?? [])},
     adminPages: ${JSON.stringify(descriptor.adminPages ?? [])},
     adminWidgets: ${JSON.stringify(descriptor.adminWidgets ?? [])},
+    editorPanels: ${JSON.stringify(descriptor.editorPanels ?? [])},
+    editorActions: ${JSON.stringify(descriptor.editorActions ?? [])},
     settingsSchema: ${JSON.stringify(descriptor.settingsSchema)},
     portableTextBlocks: ${JSON.stringify(descriptor.portableTextBlocks ?? [])},
     fieldWidgets: ${JSON.stringify(descriptor.fieldWidgets ?? [])},
@@ -1846,6 +1920,8 @@ function createViteConfig(options, command) {
 	const useSource = adminSourcePath !== void 0;
 	const useSyncExternalStoreShimPath = resolveIntegrationShim("use-sync-external-store.js");
 	const useSyncExternalStoreWithSelectorShimPath = resolveIntegrationShim("use-sync-external-store-with-selector.js");
+	const configuredWatchIgnored = options.astroConfig.vite?.server?.watch?.ignored;
+	const watchIgnored = Array.isArray(configuredWatchIgnored) ? configuredWatchIgnored : configuredWatchIgnored ? [configuredWatchIgnored] : [];
 	return {
 		define: {
 			__EMDASH_VERSION__: JSON.stringify(VERSION),
@@ -1886,6 +1962,7 @@ function createViteConfig(options, command) {
 			]
 		},
 		plugins: [createVirtualModulesPlugin(options, command), ...useSource ? [linguiMacroPlugin(adminSourcePath, adminDistPath)] : []],
+		server: { watch: { ignored: [...watchIgnored, "**/.wrangler/**"] } },
 		ssr: cloudflare ? {
 			noExternal: ["emdash", "@emdash-cms/admin"],
 			optimizeDeps: {
@@ -1898,6 +1975,9 @@ function createViteConfig(options, command) {
 				include: [
 					"emdash > @portabletext/toolkit",
 					"emdash > @unpic/placeholder",
+					"emdash > @atcute/client",
+					"emdash > @atcute/lexicons/syntax",
+					"emdash > @atcute/lexicons/validations",
 					"emdash > blurhash",
 					"emdash > croner",
 					"emdash > jose",
@@ -1907,6 +1987,7 @@ function createViteConfig(options, command) {
 					"emdash > mime/lite",
 					"emdash > modern-tar",
 					"emdash > sanitize-html",
+					"emdash > @tiptap/core",
 					"emdash > ulidx",
 					"emdash > upng-js",
 					"emdash > astro-portabletext",
@@ -1916,6 +1997,19 @@ function createViteConfig(options, command) {
 					"emdash > @emdash-cms/auth > @oslojs/crypto/ecdsa",
 					"emdash > @emdash-cms/auth > @oslojs/crypto/sha2",
 					"emdash > @emdash-cms/auth > @oslojs/webauthn",
+					"emdash > @emdash-cms/registry-lexicons > @atcute/atproto/types/label/defs",
+					"emdash > @emdash-cms/registry-client > @atcute/client",
+					"emdash > @emdash-cms/registry-client > @atcute/crypto",
+					"emdash > @emdash-cms/registry-client > @atcute/identity",
+					"emdash > @emdash-cms/registry-client > @atcute/identity-resolver",
+					"emdash > @emdash-cms/registry-client > @atcute/lexicons/syntax",
+					"emdash > @emdash-cms/registry-client > @atcute/lexicons/validations",
+					"emdash > @emdash-cms/registry-client > @atcute/multibase",
+					"emdash > @emdash-cms/registry-client > @atcute/repo",
+					"emdash > @emdash-cms/registry-client > @emdash-cms/registry-moderation > @atcute/cbor",
+					"emdash > @emdash-cms/registry-client > @emdash-cms/registry-moderation > @atcute/cid",
+					"emdash > @emdash-cms/registry-client > @emdash-cms/registry-moderation > @atcute/crypto",
+					"emdash > @emdash-cms/registry-client > @emdash-cms/registry-moderation > @atcute/multibase",
 					"emdash > @oslojs/crypto/hmac",
 					"emdash > @oslojs/crypto/subtle",
 					"emdash > @oslojs/crypto/rsa",
@@ -1936,6 +2030,7 @@ function createViteConfig(options, command) {
 					"astro/zod",
 					"emdash > zod",
 					"@emdash-cms/cloudflare > kysely-d1",
+					"astro/app/entrypoint",
 					"astro/app/manifest",
 					...hasAstroConsoleLogger ? ["astro/logger/console"] : [],
 					"astro/virtual-modules/middleware.js",
@@ -2177,11 +2272,22 @@ function buildMiddlewareEntries(config, root) {
 * Create the EmDash Astro integration
 */
 function emdash(config = {}) {
+	const registry = resolveRegistryConfigForSandbox({
+		registry: config.registry,
+		experimentalRegistry: config.experimental?.registry,
+		sandboxRunner: config.sandboxRunner,
+		sandboxEnabled: config.sandbox !== false
+	});
 	const resolvedConfig = {
 		...config,
 		storage: config.storage ?? DEFAULT_STORAGE,
-		migrations: normalizeMigrationConfig(config.migrations)
+		migrations: normalizeMigrationConfig(config.migrations),
+		registry: config.registry === false ? false : registry.input
 	};
+	normalizeRegistryConfig(registry.input, {
+		allowLocalhost: true,
+		fieldPrefix: registry.fieldPrefix
+	});
 	if (resolvedConfig.marketplace) {
 		const url = resolvedConfig.marketplace;
 		try {
@@ -2192,7 +2298,6 @@ function emdash(config = {}) {
 			if (e instanceof TypeError) throw new Error(`Invalid marketplace URL: "${url}"`, { cause: e });
 			throw e;
 		}
-		if (!resolvedConfig.sandboxRunner) throw new Error("Marketplace requires `sandboxRunner` to be configured. Marketplace plugins run in sandboxed V8 isolates.");
 	}
 	if (resolvedConfig.siteUrl) {
 		const raw = resolvedConfig.siteUrl;
@@ -2226,6 +2331,7 @@ function emdash(config = {}) {
 		auth: resolvedConfig.auth,
 		authProviders: resolvedConfig.authProviders,
 		marketplace: resolvedConfig.marketplace,
+		registry: resolvedConfig.registry,
 		experimental: resolvedConfig.experimental,
 		siteUrl: resolvedConfig.siteUrl,
 		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders,
@@ -2242,6 +2348,10 @@ function emdash(config = {}) {
 		hooks: {
 			"astro:config:setup": ({ injectRoute, addMiddleware, logger, updateConfig, config: astroConfig, command }) => {
 				astroCommand = command;
+				normalizeRegistryConfig(registry.input, {
+					allowLocalhost: command === "dev" || command === "sync",
+					fieldPrefix: registry.fieldPrefix
+				});
 				printBanner(logger);
 				const astroVersion = resolveAstroVersion();
 				if (astroVersion !== void 0) serializableConfig.astroVersion = astroVersion;